@getstrata/bootstrap 0.2.47 → 0.2.49

package/dist/entries/createRoutes.js

@@ -7,7 +7,7 @@ import { jsonResponse as jsonResponse4 } from "@getstrata/core/http/response";
 import { htmlResponse as htmlResponse2 } from "@getstrata/core/view";
 
 // ../../index.html
-var strata_default = __jsonParse("{\"index\":\"../../index.html\",\"files\":[{\"input\":\"../../index.html\",\"path\":\"./index-sfreg6q3.js\",\"loader\":\"js\",\"isEntry\":true,\"headers\":{\"etag\":\"Oc_YLpCmV6M\",\"content-type\":\"text/javascript;charset=utf-8\"}},{\"input\":\"../../index.html\",\"path\":\"../../index.html\",\"loader\":\"html\",\"isEntry\":true,\"headers\":{\"etag\":\"rWY90LWIcx8\",\"content-type\":\"text/html;charset=utf-8\"}}]}");
+var strata_default = __jsonParse("{\"index\":\"_.._/_.._/index.html\",\"files\":[{\"input\":\"../../index.html\",\"path\":\"./index-sfreg6q3.js\",\"loader\":\"js\",\"isEntry\":true,\"headers\":{\"etag\":\"Oc_YLpCmV6M\",\"content-type\":\"text/javascript;charset=utf-8\"}},{\"input\":\"../../index.html\",\"path\":\"_.._/_.._/index.html\",\"loader\":\"html\",\"isEntry\":true,\"headers\":{\"etag\":\"rWY90LWIcx8\",\"content-type\":\"text/html;charset=utf-8\"}}]}");
 
 // ../../src/config/app.ts
 var appConfig = {
@@ -77,6 +77,7 @@ import { createRequireAbilityMiddleware } from "@getstrata/core/http/requireAbil
 import { createRequireAuthMiddleware } from "@getstrata/core/http/requireAuthMiddleware";
 import { createRequireGlobalAdminMiddleware } from "@getstrata/core/http/requireGlobalAdminMiddleware";
 import { createRequireWebAuthMiddleware } from "@getstrata/core/http/requireWebAuthMiddleware";
+import { withErrorHandling } from "@getstrata/core/http/response";
 import { withMiddleware } from "@getstrata/core/http/routeMiddleware";
 import { createSecurityHeadersMiddleware } from "@getstrata/core/http/securityHeadersMiddleware";
 import { createThrottleMiddleware } from "@getstrata/core/http/throttleMiddleware";
@@ -211,7 +212,7 @@ class HttpKernel {
     return this.wrap(["api", "authenticated"], handler);
   }
   wrapWeb(handler) {
-    return handler;
+    return withErrorHandling(this.wrap("web", handler));
   }
   wrapWebPublicRead(handler) {
     if (isPublicReadsEnabled()) {
@@ -221,19 +222,19 @@ class HttpKernel {
   }
   wrapWebAuthenticated(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    return withMiddleware(createRequireWebAuthMiddleware(auth))(handler);
+    return this.wrapWeb(withMiddleware(createRequireWebAuthMiddleware(auth))(handler));
   }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
-    return withMiddleware(...middleware)(handler);
+    return this.wrapWeb(withMiddleware(...middleware)(handler));
   }
   wrapWebGlobalAdmin(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const middleware = [createRequireWebAuthMiddleware(auth), createRequireGlobalAdminMiddleware()];
-    return withMiddleware(...middleware)(handler);
+    return this.wrapWeb(withMiddleware(...middleware)(handler));
   }
   wrapAuthenticated(handler) {
     return this.wrap("authenticated", handler);
@@ -332,7 +333,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  return join(import.meta.dir, "../modules");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);
@@ -366,6 +367,12 @@ async function ensureModulesLoaded(options) {
 function discoverModules() {
   return readDiscoverModulesState().appModules;
 }
+function resetDiscoverModulesForTests() {
+  const state = readDiscoverModulesState();
+  state.configuredModulesDir = undefined;
+  state.appModules.length = 0;
+  state.modulesReady = undefined;
+}
 // ../../src/bootstrap/prefixRouteMap.ts
 function prefixRouteMap(prefix, routes) {
   const normalizedPrefix = prefix.replace(/\/$/, "");
@@ -496,7 +503,7 @@ function buildWebModuleRoutes(dependencies, options = {}) {
     routeRegistry.clear();
   }
   const kernel = createHttpKernel(dependencies);
-  const middleware = [...kernel.globalMiddleware(), ...kernel.group("web")];
+  const middleware = kernel.globalMiddleware();
   const moduleRoutes = { ...seedRoutes };
   for (const module of modules) {
     if (!module.webRoutes) {
@@ -731,15 +738,41 @@ function createHealthRoutes(dependencies) {
 }
 
 // ../../src/bootstrap/metricsRoutes.ts
+import { timingSafeEqual } from "crypto";
 import { prometheusRegistry } from "@getstrata/core/metrics/prometheus";
+function tokensMatch(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  if (leftBuffer.length !== rightBuffer.length) {
+    return false;
+  }
+  return timingSafeEqual(leftBuffer, rightBuffer);
+}
+function authorizeMetrics(request) {
+  const expected = process.env.METRICS_TOKEN?.trim();
+  const authorization = request.headers.get("authorization") ?? "";
+  const presented = authorization.startsWith("Bearer ") ? authorization.slice("Bearer ".length) : "";
+  if (expected) {
+    return presented.length > 0 && tokensMatch(presented, expected);
+  }
+  if ((process.env.APP_ENV ?? "local") === "production") {
+    return false;
+  }
+  return true;
+}
 function createMetricsRoutes() {
   return {
-    "/metrics": async () => new Response(prometheusRegistry.renderMetrics(), {
-      status: 200,
-      headers: {
-        "content-type": "text/plain; version=0.0.4; charset=utf-8"
+    "/metrics": async (request) => {
+      if (!authorizeMetrics(request)) {
+        return new Response("Not Found", { status: 404 });
       }
-    })
+      return new Response(prometheusRegistry.renderMetrics(), {
+        status: 200,
+        headers: {
+          "content-type": "text/plain; version=0.0.4; charset=utf-8"
+        }
+      });
+    }
   };
 }
 
@@ -749,7 +782,7 @@ import { withMiddleware as withMiddleware2 } from "@getstrata/core/http/routeMid
 import { createScimThrottleMiddleware } from "@getstrata/core/http/scimThrottleMiddleware";
 
 // ../../src/modules/scim/controller.ts
-import { withErrorHandling } from "@getstrata/core/http/response";
+import { withErrorHandling as withErrorHandling2 } from "@getstrata/core/http/response";
 
 // ../../src/modules/scim/scimResponse.ts
 import {
@@ -797,8 +830,6 @@ import { NotFoundError as NotFoundError4 } from "@getstrata/core/errors/http";
 import { currentTenantId as currentTenantId4 } from "@getstrata/core/tenant/tenantContext";
 
 // ../../src/domain/scim.ts
-var TEST_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
-var DEFAULT_SCIM_BEARER_TOKEN = TEST_SCIM_BEARER_TOKEN;
 var SCIM_SCHEMAS = {
   user: "urn:ietf:params:scim:schemas:core:2.0:User",
   group: "urn:ietf:params:scim:schemas:core:2.0:Group",
@@ -942,7 +973,7 @@ import { resolveDefaultTokenExpiryDays } from "@getstrata/core/security/tokenExp
 import { verifyTotp } from "@getstrata/core/security/totp";
 import { currentTenantId as currentTenantId2 } from "@getstrata/core/tenant/tenantContext";
 
-// ../../src/domain/abilities.ts
+// ../../src/core/auth/abilityCatalog.ts
 var MEMBER_ABILITIES = [
   "organizations:read",
   "projects:read",
@@ -972,107 +1003,6 @@ var ADMIN_ABILITIES = [
   "webhooks:write",
   "audit:read"
 ];
-var PLATFORM_ADMIN_ABILITIES = ["*"];
-function resolveAbilitiesForRole(role) {
-  if (role === "admin") {
-    return [...PLATFORM_ADMIN_ABILITIES];
-  }
-  return [...MEMBER_ABILITIES];
-}
-
-// ../../src/modules/user/authService.ts
-class AuthService {
-  users;
-  tokens;
-  oauthIdentities;
-  oauthProviders = new Map;
-  constructor(users, tokens, oauthIdentities) {
-    this.users = users;
-    this.tokens = tokens;
-    this.oauthIdentities = oauthIdentities;
-  }
-  registerOAuthProvider(provider) {
-    this.oauthProviders.set(provider.name, provider);
-  }
-  getOAuthProvider(name) {
-    return this.oauthProviders.get(name);
-  }
-  async loginWithPassword(email, password, options = {}) {
-    const user = await this.users.findByEmail(email);
-    if (!user?.password_hash) {
-      logSecurityEvent("auth_login_failed", { reason: "unknown_user", email });
-      throw new UnauthorizedError("Invalid credentials.");
-    }
-    const valid = await verifyPassword(password, user.password_hash);
-    if (!valid) {
-      logSecurityEvent("auth_login_failed", { reason: "invalid_password", user_id: user.id });
-      throw new UnauthorizedError("Invalid credentials.");
-    }
-    if (isFeatureEnabled("emailVerification") && !user.email_verified_at) {
-      logSecurityEvent("auth_login_blocked", { reason: "email_unverified", user_id: user.id });
-      throw new UnauthorizedError("Email address is not verified.");
-    }
-    if (isFeatureEnabled("mfa") && user.mfa_enabled) {
-      const mfaSecret = revealMfaSecret(user.mfa_secret);
-      if (!mfaSecret || !options.mfaCode || !verifyTotp(mfaSecret, options.mfaCode)) {
-        logSecurityEvent("auth_login_failed", { reason: "invalid_mfa", user_id: user.id });
-        throw new UnauthorizedError("Invalid MFA code.");
-      }
-    }
-    logSecurityEvent("auth_login_success", { user_id: user.id, method: "password" });
-    return await this.tokens.createToken(user.id, {
-      name: "password-login",
-      abilities: resolveAbilitiesForRole(user.role),
-      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
-    });
-  }
-  async loginWithOAuth(providerName, code) {
-    const provider = this.oauthProviders.get(providerName);
-    if (!provider) {
-      throw new UnauthorizedError("Unsupported OAuth provider.");
-    }
-    const profile = await provider.exchangeCode(code);
-    const user = await this.findOrCreateOAuthUser(providerName, profile);
-    logSecurityEvent("auth_login_success", { user_id: user.id, method: `oauth:${providerName}` });
-    return await this.tokens.createToken(user.id, {
-      name: `${providerName}-oauth`,
-      abilities: resolveAbilitiesForRole(user.role),
-      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
-    });
-  }
-  buildOAuthAuthorizationUrl(providerName, state) {
-    const provider = this.oauthProviders.get(providerName);
-    if (!provider) {
-      throw new UnauthorizedError("Unsupported OAuth provider.");
-    }
-    return provider.getAuthorizationUrl(state);
-  }
-  async findOrCreateOAuthUser(providerName, profile) {
-    const existingIdentity = await this.oauthIdentities.findByProviderUser(providerName, profile.providerUserId);
-    if (existingIdentity) {
-      return await this.users.findByIdOrThrow(existingIdentity.user_id);
-    }
-    const existingUser = await this.users.findByEmail(profile.email);
-    const user = existingUser ?? await this.users.create({
-      name: profile.name,
-      email: profile.email,
-      role: "member",
-      tenant_id: currentTenantId2(),
-      email_verified_at: new Date,
-      created_at: new Date,
-      updated_at: new Date
-    });
-    await this.oauthIdentities.create({
-      user_id: user.id,
-      provider: providerName,
-      provider_user_id: profile.providerUserId,
-      email: profile.email,
-      created_at: new Date
-    });
-    return user;
-  }
-}
-
 // ../../src/modules/user/notificationRepository.ts
 import { BaseRepository as BaseRepository3 } from "@getstrata/core/database/baseRepository";
 
@@ -1317,30 +1247,30 @@ class ScimController {
   constructor(dependencies, service = createScimService(dependencies)) {
     this.service = service;
   }
-  serviceProviderConfig = withErrorHandling(async () => {
+  serviceProviderConfig = withErrorHandling2(async () => {
     return scimResponse(this.service.serviceProviderConfig());
   });
-  listUsers = withErrorHandling(async (request) => {
+  listUsers = withErrorHandling2(async (request) => {
     const url = new URL(request.url);
     const startIndex = Number.parseInt(url.searchParams.get("startIndex") ?? "1", 10);
     const count = Number.parseInt(url.searchParams.get("count") ?? "100", 10);
     return scimResponse(await this.service.listUsers(startIndex, count));
   });
-  createUser = withErrorHandling(async (request) => {
+  createUser = withErrorHandling2(async (request) => {
     const payload = await request.json();
     const user = await this.service.createUser(payload);
     const id = Number.parseInt(user.id, 10);
     const record = await this.service.findUserRecord(id);
     return scimResponse(user, { status: 201, etagSource: record });
   });
-  showUser = withErrorHandling(async (request) => {
+  showUser = withErrorHandling2(async (request) => {
     const params = request.params;
     const id = Number.parseInt(params?.id ?? "", 10);
     const record = await this.service.findUserRecord(id);
     const user = await this.service.getUser(id);
     return scimResponse(user, { request, etagSource: record });
   });
-  patchUser = withErrorHandling(async (request) => {
+  patchUser = withErrorHandling2(async (request) => {
     const params = request.params;
     const id = Number.parseInt(params?.id ?? "", 10);
     const record = await this.service.findUserRecord(id);
@@ -1350,7 +1280,7 @@ class ScimController {
     const updated = await this.service.findUserRecord(id);
     return scimResponse(user, { etagSource: updated });
   });
-  deleteUser = withErrorHandling(async (request) => {
+  deleteUser = withErrorHandling2(async (request) => {
     const params = request.params;
     const id = Number.parseInt(params?.id ?? "", 10);
     const record = await this.service.findUserRecord(id);
@@ -1358,20 +1288,20 @@ class ScimController {
     await this.service.deleteUser(id);
     return new Response(null, { status: 204 });
   });
-  listGroups = withErrorHandling(async (request) => {
+  listGroups = withErrorHandling2(async (request) => {
     const url = new URL(request.url);
     const startIndex = Number.parseInt(url.searchParams.get("startIndex") ?? "1", 10);
     const count = Number.parseInt(url.searchParams.get("count") ?? "100", 10);
     return scimResponse(await this.service.listGroups(startIndex, count));
   });
-  showGroup = withErrorHandling(async (request) => {
+  showGroup = withErrorHandling2(async (request) => {
     const params = request.params;
     const id = Number.parseInt(params?.id ?? "", 10);
     const record = await this.service.findOrganizationRecord(id);
     const group = await this.service.getGroup(id);
     return scimResponse(group, { request, etagSource: record });
   });
-  patchGroup = withErrorHandling(async (request) => {
+  patchGroup = withErrorHandling2(async (request) => {
     const params = request.params;
     const id = Number.parseInt(params?.id ?? "", 10);
     const record = await this.service.findOrganizationRecord(id);

package/dist/entries/createSpaRoutes.js

@@ -58,7 +58,7 @@ function mergeSpaRoutes(dependencies, routes) {
   };
 }
 export {
-  mergeSpaRoutes,
+  SPA_DIST_DIRECTORY,
   createSpaRoutes,
-  SPA_DIST_DIRECTORY
+  mergeSpaRoutes
 };

package/dist/entries/createWebRoutes.js

@@ -46,6 +46,7 @@ import { createRequireAbilityMiddleware } from "@getstrata/core/http/requireAbil
 import { createRequireAuthMiddleware } from "@getstrata/core/http/requireAuthMiddleware";
 import { createRequireGlobalAdminMiddleware } from "@getstrata/core/http/requireGlobalAdminMiddleware";
 import { createRequireWebAuthMiddleware } from "@getstrata/core/http/requireWebAuthMiddleware";
+import { withErrorHandling } from "@getstrata/core/http/response";
 import { withMiddleware } from "@getstrata/core/http/routeMiddleware";
 import { createSecurityHeadersMiddleware } from "@getstrata/core/http/securityHeadersMiddleware";
 import { createThrottleMiddleware } from "@getstrata/core/http/throttleMiddleware";
@@ -180,7 +181,7 @@ class HttpKernel {
     return this.wrap(["api", "authenticated"], handler);
   }
   wrapWeb(handler) {
-    return handler;
+    return withErrorHandling(this.wrap("web", handler));
   }
   wrapWebPublicRead(handler) {
     if (isPublicReadsEnabled()) {
@@ -190,19 +191,19 @@ class HttpKernel {
   }
   wrapWebAuthenticated(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    return withMiddleware(createRequireWebAuthMiddleware(auth))(handler);
+    return this.wrapWeb(withMiddleware(createRequireWebAuthMiddleware(auth))(handler));
   }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
-    return withMiddleware(...middleware)(handler);
+    return this.wrapWeb(withMiddleware(...middleware)(handler));
   }
   wrapWebGlobalAdmin(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const middleware = [createRequireWebAuthMiddleware(auth), createRequireGlobalAdminMiddleware()];
-    return withMiddleware(...middleware)(handler);
+    return this.wrapWeb(withMiddleware(...middleware)(handler));
   }
   wrapAuthenticated(handler) {
     return this.wrap("authenticated", handler);
@@ -301,7 +302,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  return join(import.meta.dir, "../modules");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);
@@ -335,6 +336,12 @@ async function ensureModulesLoaded(options) {
 function discoverModules() {
   return readDiscoverModulesState().appModules;
 }
+function resetDiscoverModulesForTests() {
+  const state = readDiscoverModulesState();
+  state.configuredModulesDir = undefined;
+  state.appModules.length = 0;
+  state.modulesReady = undefined;
+}
 // ../../src/bootstrap/prefixRouteMap.ts
 function prefixRouteMap(prefix, routes) {
   const normalizedPrefix = prefix.replace(/\/$/, "");
@@ -423,7 +430,7 @@ function buildWebModuleRoutes(dependencies, options = {}) {
     routeRegistry.clear();
   }
   const kernel = createHttpKernel(dependencies);
-  const middleware = [...kernel.globalMiddleware(), ...kernel.group("web")];
+  const middleware = kernel.globalMiddleware();
   const moduleRoutes = { ...seedRoutes };
   for (const module of modules) {
     if (!module.webRoutes) {
@@ -473,6 +480,6 @@ function mergeWebRoutes(dependencies, routes) {
   };
 }
 export {
-  mergeWebRoutes,
-  createWebRoutes
+  createWebRoutes,
+  mergeWebRoutes
 };

package/dist/entries/dependencies.js

@@ -50,7 +50,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  return join(import.meta.dir, "../modules");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);
@@ -84,6 +84,12 @@ async function ensureModulesLoaded(options) {
 function discoverModules() {
   return readDiscoverModulesState().appModules;
 }
+function resetDiscoverModulesForTests() {
+  const state = readDiscoverModulesState();
+  state.configuredModulesDir = undefined;
+  state.appModules.length = 0;
+  state.modulesReady = undefined;
+}
 // ../../src/bootstrap/providers/auth.ts
 import {
   AuthManager,
@@ -500,92 +506,6 @@ var coreProviders = [
   viewProvider
 ];
 
-// ../../src/config/features.ts
-function readFeatureFlags() {
-  return {
-    webhooks: (process.env.FEATURE_WEBHOOKS ?? "true") !== "false",
-    fullTextSearch: (process.env.FEATURE_SEARCH ?? "true") !== "false",
-    auditLog: (process.env.FEATURE_AUDIT_LOG ?? "true") !== "false",
-    oauthLogin: (process.env.FEATURE_OAUTH ?? "true") !== "false",
-    samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
-    scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
-    billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
-    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
-    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
-    emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
-    mfa: (process.env.FEATURE_MFA ?? "false") === "true"
-  };
-}
-var featureFlags = readFeatureFlags();
-function isFeatureEnabled(feature) {
-  return readFeatureFlags()[feature];
-}
-
-// ../../src/domain/auth.ts
-var TEST_ADMIN_API_TOKEN = "workhub-admin-test-token";
-var TEST_MEMBER_API_TOKEN = "workhub-member-test-token";
-
-// ../../src/domain/scim.ts
-var TEST_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
-var DEFAULT_SCIM_BEARER_TOKEN = TEST_SCIM_BEARER_TOKEN;
-var SCIM_SCHEMAS = {
-  user: "urn:ietf:params:scim:schemas:core:2.0:User",
-  group: "urn:ietf:params:scim:schemas:core:2.0:Group",
-  listResponse: "urn:ietf:params:scim:api:messages:2.0:ListResponse",
-  patchOp: "urn:ietf:params:scim:api:messages:2.0:PatchOp",
-  serviceProviderConfig: "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"
-};
-
-// ../../src/bootstrap/secretsGuard.ts
-var DEFAULT_TOKENS = new Set([TEST_ADMIN_API_TOKEN, TEST_MEMBER_API_TOKEN]);
-var DEFAULT_SCIM_TOKENS = new Set([TEST_SCIM_BEARER_TOKEN, DEFAULT_SCIM_BEARER_TOKEN]);
-function assertProductionSecrets(env = process.env) {
-  const appEnv = env.APP_ENV ?? appConfig.env;
-  if (appEnv !== "production") {
-    return;
-  }
-  const adminToken = env.ADMIN_API_TOKEN ?? TEST_ADMIN_API_TOKEN;
-  const memberToken = env.MEMBER_API_TOKEN ?? TEST_MEMBER_API_TOKEN;
-  const scimToken = env.SCIM_BEARER_TOKEN ?? DEFAULT_SCIM_BEARER_TOKEN;
-  const encryptionEnabled = env.FEATURE_FIELD_ENCRYPTION !== "false";
-  const devHeadersEnabled = (env.AUTH_DEV_HEADERS ?? "true") !== "false";
-  if (devHeadersEnabled) {
-    throw new Error("Production startup blocked: set AUTH_DEV_HEADERS=false to disable development auth headers.");
-  }
-  if (DEFAULT_TOKENS.has(adminToken) || DEFAULT_TOKENS.has(memberToken)) {
-    throw new Error("Production startup blocked: rotate ADMIN_API_TOKEN and MEMBER_API_TOKEN away from default WorkHub test values.");
-  }
-  if (DEFAULT_SCIM_TOKENS.has(scimToken)) {
-    throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from default WorkHub test values.");
-  }
-  if (encryptionEnabled && !env.KMS_ENCRYPTION_KEY?.trim()) {
-    throw new Error("Production startup blocked: set KMS_ENCRYPTION_KEY when field encryption is enabled.");
-  }
-  if (!env.SIEM_EXPORT_URL?.trim() && isFeatureEnabled("siemExport")) {
-    console.warn("[secrets] SIEM_EXPORT_URL is not configured; audit logs remain database-only.");
-  }
-  const billingEnabled = (env.FEATURE_BILLING ?? "true") !== "false";
-  if (billingEnabled && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
-    throw new Error("Production startup blocked: set STRIPE_WEBHOOK_SECRET when billing webhooks are enabled.");
-  }
-  const corsOrigins = (env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim());
-  if (corsOrigins.includes("*")) {
-    throw new Error("Production startup blocked: set explicit CORS_ALLOWED_ORIGINS instead of wildcard.");
-  }
-  if ((env.FEATURE_PUBLIC_READS ?? "true") !== "false") {
-    throw new Error("Production startup blocked: set FEATURE_PUBLIC_READS=false for authenticated-only reads.");
-  }
-  if (!env.OAUTH_STATE_SECRET?.trim()) {
-    throw new Error("Production startup blocked: set OAUTH_STATE_SECRET for OAuth CSRF protection.");
-  }
-  if (!env.TOKEN_HASH_PEPPER?.trim()) {
-    throw new Error("Production startup blocked: set TOKEN_HASH_PEPPER for API token hashing.");
-  }
-  if (!env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim()) {
-    throw new Error("Production startup blocked: set API_TOKEN_DEFAULT_EXPIRY_DAYS to enforce token rotation.");
-  }
-}
-
 // ../../src/bootstrap/context.ts
 function collectProviders(modules = discoverModules()) {
   return [...coreProviders, ...modules.flatMap((module) => module.providers ?? [])];
@@ -596,7 +516,6 @@ function runProviderPhase(providers, phase, context) {
   }
 }
 function createAppContext() {
-  assertProductionSecrets();
   const container = new ServiceContainer;
   const config = new ConfigStore;
   const dependencies = {
@@ -641,6 +560,6 @@ function createAppDependencies() {
   return createAppContext().dependencies;
 }
 export {
-  createAppDependencies,
-  createAppContext
+  createAppContext,
+  createAppDependencies
 };

package/dist/entries/discoverModules.js

@@ -26,7 +26,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  return join(import.meta.dir, "../modules");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);
@@ -60,8 +60,15 @@ async function ensureModulesLoaded(options) {
 function discoverModules() {
   return readDiscoverModulesState().appModules;
 }
+function resetDiscoverModulesForTests() {
+  const state = readDiscoverModulesState();
+  state.configuredModulesDir = undefined;
+  state.appModules.length = 0;
+  state.modulesReady = undefined;
+}
 export {
-  ensureModulesLoaded,
+  configureModulesDirectory,
   discoverModules,
-  configureModulesDirectory
+  ensureModulesLoaded,
+  resetDiscoverModulesForTests
 };

package/dist/entries/health.js

@@ -209,7 +209,7 @@ function createHealthRoutes(dependencies) {
   };
 }
 export {
-  createHealthRoutes,
+  checkDatabase,
   checkRedis,
-  checkDatabase
+  createHealthRoutes
 };

package/dist/entries/http/securedRouteModelBinding.js

@@ -7,6 +7,6 @@ import {
   securedBindRouteModelByKey
 } from "@getstrata/core/http/securedRouteModelBinding";
 export {
-  securedBindRouteModelByKey,
-  securedBindRouteModel
+  securedBindRouteModel,
+  securedBindRouteModelByKey
 };

package/dist/entries/httpKernel.js

@@ -17,6 +17,7 @@ import { createRequireAbilityMiddleware } from "@getstrata/core/http/requireAbil
 import { createRequireAuthMiddleware } from "@getstrata/core/http/requireAuthMiddleware";
 import { createRequireGlobalAdminMiddleware } from "@getstrata/core/http/requireGlobalAdminMiddleware";
 import { createRequireWebAuthMiddleware } from "@getstrata/core/http/requireWebAuthMiddleware";
+import { withErrorHandling } from "@getstrata/core/http/response";
 import { withMiddleware } from "@getstrata/core/http/routeMiddleware";
 import { createSecurityHeadersMiddleware } from "@getstrata/core/http/securityHeadersMiddleware";
 import { createThrottleMiddleware } from "@getstrata/core/http/throttleMiddleware";
@@ -169,7 +170,7 @@ class HttpKernel {
     return this.wrap(["api", "authenticated"], handler);
   }
   wrapWeb(handler) {
-    return handler;
+    return withErrorHandling(this.wrap("web", handler));
   }
   wrapWebPublicRead(handler) {
     if (isPublicReadsEnabled()) {
@@ -179,19 +180,19 @@ class HttpKernel {
   }
   wrapWebAuthenticated(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    return withMiddleware(createRequireWebAuthMiddleware(auth))(handler);
+    return this.wrapWeb(withMiddleware(createRequireWebAuthMiddleware(auth))(handler));
   }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
-    return withMiddleware(...middleware)(handler);
+    return this.wrapWeb(withMiddleware(...middleware)(handler));
   }
   wrapWebGlobalAdmin(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const middleware = [createRequireWebAuthMiddleware(auth), createRequireGlobalAdminMiddleware()];
-    return withMiddleware(...middleware)(handler);
+    return this.wrapWeb(withMiddleware(...middleware)(handler));
   }
   wrapAuthenticated(handler) {
     return this.wrap("authenticated", handler);
@@ -265,6 +266,6 @@ function createHttpKernel(dependencies) {
   return new HttpKernel(dependencies);
 }
 export {
-  createHttpKernel,
-  HttpKernel
+  HttpKernel,
+  createHttpKernel
 };

package/dist/entries/listeners/invalidateCacheOnModelWrite.js

@@ -44,7 +44,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  return join(import.meta.dir, "../modules");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);
@@ -78,6 +78,12 @@ async function ensureModulesLoaded(options) {
 function discoverModules() {
   return readDiscoverModulesState().appModules;
 }
+function resetDiscoverModulesForTests() {
+  const state = readDiscoverModulesState();
+  state.configuredModulesDir = undefined;
+  state.appModules.length = 0;
+  state.modulesReady = undefined;
+}
 
 // ../../src/bootstrap/cache/modelCacheTags.ts
 function cacheTagsForModelWrite(tableName, action) {