@getstrata/bootstrap 0.2.48 → 0.2.49

package/README.md

@@ -28,7 +28,9 @@ import {
 import { createHttpKernel, createAppContext, coreProviders } from "@getstrata/bootstrap";
 ```
 
-`assertProductionSecrets` (`@getstrata/bootstrap/secretsGuard`) is env-only. It still rejects the well-known WorkHub test tokens.
+`createAppContext()` does not call `assertProductionSecrets`. WorkHub calls that from `App.serve()` / `queue:work`. Sibling apps should call it only if they want those WorkHub production gates (API tokens, Stripe, SCIM, CORS).
+
+`wrapWeb` applies the web group (CSRF + flash) and `withErrorHandling`, so CSRF `ForbiddenError` becomes an HTML 403 in `FRONTEND_MODE=server-htmx`. `wrapWebLogin` / `wrapWebRegister` include that web group plus throttle — do not wrap them with `wrapWeb` again.
 
 These subpaths remain WorkHub-oriented and are not a generic starter API: `@getstrata/bootstrap/createRoutes` (includes SCIM), `@getstrata/bootstrap/schedule`, and `@getstrata/bootstrap/createWebRoutes` (redirects `/` to `/organizations`).
 

package/dist/bootstrap/web/routing.d.ts

@@ -14,9 +14,9 @@ export declare function wrapSecuredRouteModelByKey<TParams extends Record<string
     resource: string;
     action: "view" | "create" | "update" | "delete";
 }, handler: (request: RouteRequest<TParams>, model: TModel) => Response | Promise<Response>): RouteHandler;
-/** Converts kernel login throttle 429 JSON into an HTML response for web forms. */
+/** Web group (CSRF + flash + HTML errors) plus login throttle. Do not wrap with wrapWeb again. */
 export declare function wrapWebLogin(kernel: HttpKernel, handler: RouteHandler, onThrottled: (request: Request) => Response | Promise<Response>): RouteHandler;
-/** Converts kernel register throttle 429 JSON into an HTML response for web forms. */
+/** Web group (CSRF + flash + HTML errors) plus register throttle. Do not wrap with wrapWeb again. */
 export declare function wrapWebRegister(kernel: HttpKernel, handler: RouteHandler, onThrottled: (request: Request) => Response | Promise<Response>): RouteHandler;
 /** Convenience alias: HttpKernel is the Laravel-style router middleware wrapper. */
 export declare function createRouteKernel(dependencies: AppDependencies): HttpKernel;

package/dist/entries/buildModuleRoutes.js

@@ -21,6 +21,7 @@ import { createRequireAbilityMiddleware } from "@getstrata/core/http/requireAbil
 import { createRequireAuthMiddleware } from "@getstrata/core/http/requireAuthMiddleware";
 import { createRequireGlobalAdminMiddleware } from "@getstrata/core/http/requireGlobalAdminMiddleware";
 import { createRequireWebAuthMiddleware } from "@getstrata/core/http/requireWebAuthMiddleware";
+import { withErrorHandling } from "@getstrata/core/http/response";
 import { withMiddleware } from "@getstrata/core/http/routeMiddleware";
 import { createSecurityHeadersMiddleware } from "@getstrata/core/http/securityHeadersMiddleware";
 import { createThrottleMiddleware } from "@getstrata/core/http/throttleMiddleware";
@@ -173,7 +174,7 @@ class HttpKernel {
     return this.wrap(["api", "authenticated"], handler);
   }
   wrapWeb(handler) {
-    return this.wrap("web", handler);
+    return withErrorHandling(this.wrap("web", handler));
   }
   wrapWebPublicRead(handler) {
     if (isPublicReadsEnabled()) {
@@ -183,19 +184,19 @@ class HttpKernel {
   }
   wrapWebAuthenticated(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    return this.wrap("web", withMiddleware(createRequireWebAuthMiddleware(auth))(handler));
+    return this.wrapWeb(withMiddleware(createRequireWebAuthMiddleware(auth))(handler));
   }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
-    return this.wrap("web", withMiddleware(...middleware)(handler));
+    return this.wrapWeb(withMiddleware(...middleware)(handler));
   }
   wrapWebGlobalAdmin(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const middleware = [createRequireWebAuthMiddleware(auth), createRequireGlobalAdminMiddleware()];
-    return this.wrap("web", withMiddleware(...middleware)(handler));
+    return this.wrapWeb(withMiddleware(...middleware)(handler));
   }
   wrapAuthenticated(handler) {
     return this.wrap("authenticated", handler);

package/dist/entries/buildWebModuleRoutes.js

@@ -24,6 +24,7 @@ import { createRequireAbilityMiddleware } from "@getstrata/core/http/requireAbil
 import { createRequireAuthMiddleware } from "@getstrata/core/http/requireAuthMiddleware";
 import { createRequireGlobalAdminMiddleware } from "@getstrata/core/http/requireGlobalAdminMiddleware";
 import { createRequireWebAuthMiddleware } from "@getstrata/core/http/requireWebAuthMiddleware";
+import { withErrorHandling } from "@getstrata/core/http/response";
 import { withMiddleware } from "@getstrata/core/http/routeMiddleware";
 import { createSecurityHeadersMiddleware } from "@getstrata/core/http/securityHeadersMiddleware";
 import { createThrottleMiddleware } from "@getstrata/core/http/throttleMiddleware";
@@ -176,7 +177,7 @@ class HttpKernel {
     return this.wrap(["api", "authenticated"], handler);
   }
   wrapWeb(handler) {
-    return this.wrap("web", handler);
+    return withErrorHandling(this.wrap("web", handler));
   }
   wrapWebPublicRead(handler) {
     if (isPublicReadsEnabled()) {
@@ -186,19 +187,19 @@ class HttpKernel {
   }
   wrapWebAuthenticated(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    return this.wrap("web", withMiddleware(createRequireWebAuthMiddleware(auth))(handler));
+    return this.wrapWeb(withMiddleware(createRequireWebAuthMiddleware(auth))(handler));
   }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
-    return this.wrap("web", withMiddleware(...middleware)(handler));
+    return this.wrapWeb(withMiddleware(...middleware)(handler));
   }
   wrapWebGlobalAdmin(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const middleware = [createRequireWebAuthMiddleware(auth), createRequireGlobalAdminMiddleware()];
-    return this.wrap("web", withMiddleware(...middleware)(handler));
+    return this.wrapWeb(withMiddleware(...middleware)(handler));
   }
   wrapAuthenticated(handler) {
     return this.wrap("authenticated", handler);

package/dist/entries/context.js

@@ -506,68 +506,6 @@ var coreProviders = [
   viewProvider
 ];
 
-// ../../src/bootstrap/secretsGuard.ts
-var DEFAULT_ADMIN_API_TOKEN = "workhub-admin-test-token";
-var DEFAULT_MEMBER_API_TOKEN = "workhub-member-test-token";
-var DEFAULT_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
-var DEFAULT_TOKENS = new Set([DEFAULT_ADMIN_API_TOKEN, DEFAULT_MEMBER_API_TOKEN]);
-var DEFAULT_SCIM_TOKENS = new Set([DEFAULT_SCIM_BEARER_TOKEN]);
-function isEnabled(value, defaultEnabled) {
-  if (value === undefined) {
-    return defaultEnabled;
-  }
-  return defaultEnabled ? value !== "false" : value === "true";
-}
-function assertProductionSecrets(env = process.env) {
-  const appEnv = env.APP_ENV ?? "local";
-  if (appEnv !== "production") {
-    return;
-  }
-  const adminToken = env.ADMIN_API_TOKEN ?? DEFAULT_ADMIN_API_TOKEN;
-  const memberToken = env.MEMBER_API_TOKEN ?? DEFAULT_MEMBER_API_TOKEN;
-  const scimToken = env.SCIM_BEARER_TOKEN ?? DEFAULT_SCIM_BEARER_TOKEN;
-  const encryptionEnabled = isEnabled(env.FEATURE_FIELD_ENCRYPTION, true);
-  const devHeadersEnabled = isEnabled(env.AUTH_DEV_HEADERS, true);
-  if (devHeadersEnabled) {
-    throw new Error("Production startup blocked: set AUTH_DEV_HEADERS=false to disable development auth headers.");
-  }
-  if (DEFAULT_TOKENS.has(adminToken) || DEFAULT_TOKENS.has(memberToken)) {
-    throw new Error("Production startup blocked: rotate ADMIN_API_TOKEN and MEMBER_API_TOKEN away from default WorkHub test values.");
-  }
-  if (DEFAULT_SCIM_TOKENS.has(scimToken)) {
-    throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from default WorkHub test values.");
-  }
-  if (encryptionEnabled && !env.KMS_ENCRYPTION_KEY?.trim()) {
-    throw new Error("Production startup blocked: set KMS_ENCRYPTION_KEY when field encryption is enabled.");
-  }
-  if (!env.SIEM_EXPORT_URL?.trim() && isEnabled(env.FEATURE_SIEM_EXPORT, true)) {
-    console.warn("[secrets] SIEM_EXPORT_URL is not configured; audit logs remain database-only.");
-  }
-  if (isEnabled(env.FEATURE_BILLING, true) && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
-    throw new Error("Production startup blocked: set STRIPE_WEBHOOK_SECRET when billing webhooks are enabled.");
-  }
-  const corsOrigins = (env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim());
-  if (corsOrigins.includes("*")) {
-    throw new Error("Production startup blocked: set explicit CORS_ALLOWED_ORIGINS instead of wildcard.");
-  }
-  if (isEnabled(env.FEATURE_PUBLIC_READS, true)) {
-    throw new Error("Production startup blocked: set FEATURE_PUBLIC_READS=false for authenticated-only reads.");
-  }
-  if (!env.OAUTH_STATE_SECRET?.trim()) {
-    throw new Error("Production startup blocked: set OAUTH_STATE_SECRET for OAuth CSRF protection.");
-  }
-  if (!env.TOKEN_HASH_PEPPER?.trim()) {
-    throw new Error("Production startup blocked: set TOKEN_HASH_PEPPER for API token hashing.");
-  }
-  if (!env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim()) {
-    throw new Error("Production startup blocked: set API_TOKEN_DEFAULT_EXPIRY_DAYS to enforce token rotation.");
-  }
-  const frontendMode = (env.FRONTEND_MODE ?? "api").trim();
-  if (frontendMode === "server-htmx" && !env.SESSION_SECRET?.trim()) {
-    throw new Error("Production startup blocked: set SESSION_SECRET when FRONTEND_MODE=server-htmx.");
-  }
-}
-
 // ../../src/bootstrap/context.ts
 function collectProviders(modules = discoverModules()) {
   return [...coreProviders, ...modules.flatMap((module) => module.providers ?? [])];
@@ -578,7 +516,6 @@ function runProviderPhase(providers, phase, context) {
   }
 }
 function createAppContext() {
-  assertProductionSecrets();
   const container = new ServiceContainer;
   const config = new ConfigStore;
   const dependencies = {

package/dist/entries/createRoutes.js

@@ -77,6 +77,7 @@ import { createRequireAbilityMiddleware } from "@getstrata/core/http/requireAbil
 import { createRequireAuthMiddleware } from "@getstrata/core/http/requireAuthMiddleware";
 import { createRequireGlobalAdminMiddleware } from "@getstrata/core/http/requireGlobalAdminMiddleware";
 import { createRequireWebAuthMiddleware } from "@getstrata/core/http/requireWebAuthMiddleware";
+import { withErrorHandling } from "@getstrata/core/http/response";
 import { withMiddleware } from "@getstrata/core/http/routeMiddleware";
 import { createSecurityHeadersMiddleware } from "@getstrata/core/http/securityHeadersMiddleware";
 import { createThrottleMiddleware } from "@getstrata/core/http/throttleMiddleware";
@@ -211,7 +212,7 @@ class HttpKernel {
     return this.wrap(["api", "authenticated"], handler);
   }
   wrapWeb(handler) {
-    return this.wrap("web", handler);
+    return withErrorHandling(this.wrap("web", handler));
   }
   wrapWebPublicRead(handler) {
     if (isPublicReadsEnabled()) {
@@ -221,19 +222,19 @@ class HttpKernel {
   }
   wrapWebAuthenticated(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    return this.wrap("web", withMiddleware(createRequireWebAuthMiddleware(auth))(handler));
+    return this.wrapWeb(withMiddleware(createRequireWebAuthMiddleware(auth))(handler));
   }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
-    return this.wrap("web", withMiddleware(...middleware)(handler));
+    return this.wrapWeb(withMiddleware(...middleware)(handler));
   }
   wrapWebGlobalAdmin(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const middleware = [createRequireWebAuthMiddleware(auth), createRequireGlobalAdminMiddleware()];
-    return this.wrap("web", withMiddleware(...middleware)(handler));
+    return this.wrapWeb(withMiddleware(...middleware)(handler));
   }
   wrapAuthenticated(handler) {
     return this.wrap("authenticated", handler);
@@ -781,7 +782,7 @@ import { withMiddleware as withMiddleware2 } from "@getstrata/core/http/routeMid
 import { createScimThrottleMiddleware } from "@getstrata/core/http/scimThrottleMiddleware";
 
 // ../../src/modules/scim/controller.ts
-import { withErrorHandling } from "@getstrata/core/http/response";
+import { withErrorHandling as withErrorHandling2 } from "@getstrata/core/http/response";
 
 // ../../src/modules/scim/scimResponse.ts
 import {
@@ -1246,30 +1247,30 @@ class ScimController {
   constructor(dependencies, service = createScimService(dependencies)) {
     this.service = service;
   }
-  serviceProviderConfig = withErrorHandling(async () => {
+  serviceProviderConfig = withErrorHandling2(async () => {
     return scimResponse(this.service.serviceProviderConfig());
   });
-  listUsers = withErrorHandling(async (request) => {
+  listUsers = withErrorHandling2(async (request) => {
     const url = new URL(request.url);
     const startIndex = Number.parseInt(url.searchParams.get("startIndex") ?? "1", 10);
     const count = Number.parseInt(url.searchParams.get("count") ?? "100", 10);
     return scimResponse(await this.service.listUsers(startIndex, count));
   });
-  createUser = withErrorHandling(async (request) => {
+  createUser = withErrorHandling2(async (request) => {
     const payload = await request.json();
     const user = await this.service.createUser(payload);
     const id = Number.parseInt(user.id, 10);
     const record = await this.service.findUserRecord(id);
     return scimResponse(user, { status: 201, etagSource: record });
   });
-  showUser = withErrorHandling(async (request) => {
+  showUser = withErrorHandling2(async (request) => {
     const params = request.params;
     const id = Number.parseInt(params?.id ?? "", 10);
     const record = await this.service.findUserRecord(id);
     const user = await this.service.getUser(id);
     return scimResponse(user, { request, etagSource: record });
   });
-  patchUser = withErrorHandling(async (request) => {
+  patchUser = withErrorHandling2(async (request) => {
     const params = request.params;
     const id = Number.parseInt(params?.id ?? "", 10);
     const record = await this.service.findUserRecord(id);
@@ -1279,7 +1280,7 @@ class ScimController {
     const updated = await this.service.findUserRecord(id);
     return scimResponse(user, { etagSource: updated });
   });
-  deleteUser = withErrorHandling(async (request) => {
+  deleteUser = withErrorHandling2(async (request) => {
     const params = request.params;
     const id = Number.parseInt(params?.id ?? "", 10);
     const record = await this.service.findUserRecord(id);
@@ -1287,20 +1288,20 @@ class ScimController {
     await this.service.deleteUser(id);
     return new Response(null, { status: 204 });
   });
-  listGroups = withErrorHandling(async (request) => {
+  listGroups = withErrorHandling2(async (request) => {
     const url = new URL(request.url);
     const startIndex = Number.parseInt(url.searchParams.get("startIndex") ?? "1", 10);
     const count = Number.parseInt(url.searchParams.get("count") ?? "100", 10);
     return scimResponse(await this.service.listGroups(startIndex, count));
   });
-  showGroup = withErrorHandling(async (request) => {
+  showGroup = withErrorHandling2(async (request) => {
     const params = request.params;
     const id = Number.parseInt(params?.id ?? "", 10);
     const record = await this.service.findOrganizationRecord(id);
     const group = await this.service.getGroup(id);
     return scimResponse(group, { request, etagSource: record });
   });
-  patchGroup = withErrorHandling(async (request) => {
+  patchGroup = withErrorHandling2(async (request) => {
     const params = request.params;
     const id = Number.parseInt(params?.id ?? "", 10);
     const record = await this.service.findOrganizationRecord(id);

package/dist/entries/createWebRoutes.js

@@ -46,6 +46,7 @@ import { createRequireAbilityMiddleware } from "@getstrata/core/http/requireAbil
 import { createRequireAuthMiddleware } from "@getstrata/core/http/requireAuthMiddleware";
 import { createRequireGlobalAdminMiddleware } from "@getstrata/core/http/requireGlobalAdminMiddleware";
 import { createRequireWebAuthMiddleware } from "@getstrata/core/http/requireWebAuthMiddleware";
+import { withErrorHandling } from "@getstrata/core/http/response";
 import { withMiddleware } from "@getstrata/core/http/routeMiddleware";
 import { createSecurityHeadersMiddleware } from "@getstrata/core/http/securityHeadersMiddleware";
 import { createThrottleMiddleware } from "@getstrata/core/http/throttleMiddleware";
@@ -180,7 +181,7 @@ class HttpKernel {
     return this.wrap(["api", "authenticated"], handler);
   }
   wrapWeb(handler) {
-    return this.wrap("web", handler);
+    return withErrorHandling(this.wrap("web", handler));
   }
   wrapWebPublicRead(handler) {
     if (isPublicReadsEnabled()) {
@@ -190,19 +191,19 @@ class HttpKernel {
   }
   wrapWebAuthenticated(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    return this.wrap("web", withMiddleware(createRequireWebAuthMiddleware(auth))(handler));
+    return this.wrapWeb(withMiddleware(createRequireWebAuthMiddleware(auth))(handler));
   }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
-    return this.wrap("web", withMiddleware(...middleware)(handler));
+    return this.wrapWeb(withMiddleware(...middleware)(handler));
   }
   wrapWebGlobalAdmin(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const middleware = [createRequireWebAuthMiddleware(auth), createRequireGlobalAdminMiddleware()];
-    return this.wrap("web", withMiddleware(...middleware)(handler));
+    return this.wrapWeb(withMiddleware(...middleware)(handler));
   }
   wrapAuthenticated(handler) {
     return this.wrap("authenticated", handler);

package/dist/entries/dependencies.js

@@ -506,68 +506,6 @@ var coreProviders = [
   viewProvider
 ];
 
-// ../../src/bootstrap/secretsGuard.ts
-var DEFAULT_ADMIN_API_TOKEN = "workhub-admin-test-token";
-var DEFAULT_MEMBER_API_TOKEN = "workhub-member-test-token";
-var DEFAULT_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
-var DEFAULT_TOKENS = new Set([DEFAULT_ADMIN_API_TOKEN, DEFAULT_MEMBER_API_TOKEN]);
-var DEFAULT_SCIM_TOKENS = new Set([DEFAULT_SCIM_BEARER_TOKEN]);
-function isEnabled(value, defaultEnabled) {
-  if (value === undefined) {
-    return defaultEnabled;
-  }
-  return defaultEnabled ? value !== "false" : value === "true";
-}
-function assertProductionSecrets(env = process.env) {
-  const appEnv = env.APP_ENV ?? "local";
-  if (appEnv !== "production") {
-    return;
-  }
-  const adminToken = env.ADMIN_API_TOKEN ?? DEFAULT_ADMIN_API_TOKEN;
-  const memberToken = env.MEMBER_API_TOKEN ?? DEFAULT_MEMBER_API_TOKEN;
-  const scimToken = env.SCIM_BEARER_TOKEN ?? DEFAULT_SCIM_BEARER_TOKEN;
-  const encryptionEnabled = isEnabled(env.FEATURE_FIELD_ENCRYPTION, true);
-  const devHeadersEnabled = isEnabled(env.AUTH_DEV_HEADERS, true);
-  if (devHeadersEnabled) {
-    throw new Error("Production startup blocked: set AUTH_DEV_HEADERS=false to disable development auth headers.");
-  }
-  if (DEFAULT_TOKENS.has(adminToken) || DEFAULT_TOKENS.has(memberToken)) {
-    throw new Error("Production startup blocked: rotate ADMIN_API_TOKEN and MEMBER_API_TOKEN away from default WorkHub test values.");
-  }
-  if (DEFAULT_SCIM_TOKENS.has(scimToken)) {
-    throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from default WorkHub test values.");
-  }
-  if (encryptionEnabled && !env.KMS_ENCRYPTION_KEY?.trim()) {
-    throw new Error("Production startup blocked: set KMS_ENCRYPTION_KEY when field encryption is enabled.");
-  }
-  if (!env.SIEM_EXPORT_URL?.trim() && isEnabled(env.FEATURE_SIEM_EXPORT, true)) {
-    console.warn("[secrets] SIEM_EXPORT_URL is not configured; audit logs remain database-only.");
-  }
-  if (isEnabled(env.FEATURE_BILLING, true) && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
-    throw new Error("Production startup blocked: set STRIPE_WEBHOOK_SECRET when billing webhooks are enabled.");
-  }
-  const corsOrigins = (env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim());
-  if (corsOrigins.includes("*")) {
-    throw new Error("Production startup blocked: set explicit CORS_ALLOWED_ORIGINS instead of wildcard.");
-  }
-  if (isEnabled(env.FEATURE_PUBLIC_READS, true)) {
-    throw new Error("Production startup blocked: set FEATURE_PUBLIC_READS=false for authenticated-only reads.");
-  }
-  if (!env.OAUTH_STATE_SECRET?.trim()) {
-    throw new Error("Production startup blocked: set OAUTH_STATE_SECRET for OAuth CSRF protection.");
-  }
-  if (!env.TOKEN_HASH_PEPPER?.trim()) {
-    throw new Error("Production startup blocked: set TOKEN_HASH_PEPPER for API token hashing.");
-  }
-  if (!env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim()) {
-    throw new Error("Production startup blocked: set API_TOKEN_DEFAULT_EXPIRY_DAYS to enforce token rotation.");
-  }
-  const frontendMode = (env.FRONTEND_MODE ?? "api").trim();
-  if (frontendMode === "server-htmx" && !env.SESSION_SECRET?.trim()) {
-    throw new Error("Production startup blocked: set SESSION_SECRET when FRONTEND_MODE=server-htmx.");
-  }
-}
-
 // ../../src/bootstrap/context.ts
 function collectProviders(modules = discoverModules()) {
   return [...coreProviders, ...modules.flatMap((module) => module.providers ?? [])];
@@ -578,7 +516,6 @@ function runProviderPhase(providers, phase, context) {
   }
 }
 function createAppContext() {
-  assertProductionSecrets();
   const container = new ServiceContainer;
   const config = new ConfigStore;
   const dependencies = {

package/dist/entries/httpKernel.js

@@ -17,6 +17,7 @@ import { createRequireAbilityMiddleware } from "@getstrata/core/http/requireAbil
 import { createRequireAuthMiddleware } from "@getstrata/core/http/requireAuthMiddleware";
 import { createRequireGlobalAdminMiddleware } from "@getstrata/core/http/requireGlobalAdminMiddleware";
 import { createRequireWebAuthMiddleware } from "@getstrata/core/http/requireWebAuthMiddleware";
+import { withErrorHandling } from "@getstrata/core/http/response";
 import { withMiddleware } from "@getstrata/core/http/routeMiddleware";
 import { createSecurityHeadersMiddleware } from "@getstrata/core/http/securityHeadersMiddleware";
 import { createThrottleMiddleware } from "@getstrata/core/http/throttleMiddleware";
@@ -169,7 +170,7 @@ class HttpKernel {
     return this.wrap(["api", "authenticated"], handler);
   }
   wrapWeb(handler) {
-    return this.wrap("web", handler);
+    return withErrorHandling(this.wrap("web", handler));
   }
   wrapWebPublicRead(handler) {
     if (isPublicReadsEnabled()) {
@@ -179,19 +180,19 @@ class HttpKernel {
   }
   wrapWebAuthenticated(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    return this.wrap("web", withMiddleware(createRequireWebAuthMiddleware(auth))(handler));
+    return this.wrapWeb(withMiddleware(createRequireWebAuthMiddleware(auth))(handler));
   }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
-    return this.wrap("web", withMiddleware(...middleware)(handler));
+    return this.wrapWeb(withMiddleware(...middleware)(handler));
   }
   wrapWebGlobalAdmin(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const middleware = [createRequireWebAuthMiddleware(auth), createRequireGlobalAdminMiddleware()];
-    return this.wrap("web", withMiddleware(...middleware)(handler));
+    return this.wrapWeb(withMiddleware(...middleware)(handler));
   }
   wrapAuthenticated(handler) {
     return this.wrap("authenticated", handler);

package/dist/entries/web/routing.js

@@ -2,7 +2,7 @@
 var __jsonParse = (a) => JSON.parse(a);
 
 // ../../src/bootstrap/web/routing.ts
-import { withErrorHandling } from "@getstrata/core/http/response";
+import { withErrorHandling as withErrorHandling2 } from "@getstrata/core/http/response";
 
 // ../../src/bootstrap/http/securedRouteModelBinding.ts
 import {
@@ -26,6 +26,7 @@ import { createRequireAbilityMiddleware } from "@getstrata/core/http/requireAbil
 import { createRequireAuthMiddleware } from "@getstrata/core/http/requireAuthMiddleware";
 import { createRequireGlobalAdminMiddleware } from "@getstrata/core/http/requireGlobalAdminMiddleware";
 import { createRequireWebAuthMiddleware } from "@getstrata/core/http/requireWebAuthMiddleware";
+import { withErrorHandling } from "@getstrata/core/http/response";
 import { withMiddleware } from "@getstrata/core/http/routeMiddleware";
 import { createSecurityHeadersMiddleware } from "@getstrata/core/http/securityHeadersMiddleware";
 import { createThrottleMiddleware } from "@getstrata/core/http/throttleMiddleware";
@@ -178,7 +179,7 @@ class HttpKernel {
     return this.wrap(["api", "authenticated"], handler);
   }
   wrapWeb(handler) {
-    return this.wrap("web", handler);
+    return withErrorHandling(this.wrap("web", handler));
   }
   wrapWebPublicRead(handler) {
     if (isPublicReadsEnabled()) {
@@ -188,19 +189,19 @@ class HttpKernel {
   }
   wrapWebAuthenticated(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    return this.wrap("web", withMiddleware(createRequireWebAuthMiddleware(auth))(handler));
+    return this.wrapWeb(withMiddleware(createRequireWebAuthMiddleware(auth))(handler));
   }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
-    return this.wrap("web", withMiddleware(...middleware)(handler));
+    return this.wrapWeb(withMiddleware(...middleware)(handler));
   }
   wrapWebGlobalAdmin(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const middleware = [createRequireWebAuthMiddleware(auth), createRequireGlobalAdminMiddleware()];
-    return this.wrap("web", withMiddleware(...middleware)(handler));
+    return this.wrapWeb(withMiddleware(...middleware)(handler));
   }
   wrapAuthenticated(handler) {
     return this.wrap("authenticated", handler);
@@ -296,14 +297,14 @@ function toRouteRequest(request) {
   return request;
 }
 function wrapSecuredRouteModelByKey(param, resolver, authorization, handler) {
-  const bound = withErrorHandling(securedBindRouteModelByKey(param, resolver, authorization, handler));
+  const bound = withErrorHandling2(securedBindRouteModelByKey(param, resolver, authorization, handler));
   return async (request) => bound(toRouteRequest(request));
 }
 function wrapWebLogin(kernel, handler, onThrottled) {
-  return wrapWebThrottle(kernel, "login", handler, onThrottled);
+  return kernel.wrapWeb(wrapWebThrottle(kernel, "login", handler, onThrottled));
 }
 function wrapWebRegister(kernel, handler, onThrottled) {
-  return wrapWebThrottle(kernel, "register", handler, onThrottled);
+  return kernel.wrapWeb(wrapWebThrottle(kernel, "register", handler, onThrottled));
 }
 function wrapWebThrottle(kernel, scope, handler, onThrottled) {
   const throttled = scope === "login" ? kernel.wrapLogin(handler) : kernel.wrapRegister(handler);

package/dist/index.js

@@ -34,6 +34,7 @@ import { createRequireAbilityMiddleware } from "@getstrata/core/http/requireAbil
 import { createRequireAuthMiddleware } from "@getstrata/core/http/requireAuthMiddleware";
 import { createRequireGlobalAdminMiddleware } from "@getstrata/core/http/requireGlobalAdminMiddleware";
 import { createRequireWebAuthMiddleware } from "@getstrata/core/http/requireWebAuthMiddleware";
+import { withErrorHandling } from "@getstrata/core/http/response";
 import { withMiddleware } from "@getstrata/core/http/routeMiddleware";
 import { createSecurityHeadersMiddleware } from "@getstrata/core/http/securityHeadersMiddleware";
 import { createThrottleMiddleware } from "@getstrata/core/http/throttleMiddleware";
@@ -182,7 +183,7 @@ class HttpKernel {
     return this.wrap(["api", "authenticated"], handler);
   }
   wrapWeb(handler) {
-    return this.wrap("web", handler);
+    return withErrorHandling(this.wrap("web", handler));
   }
   wrapWebPublicRead(handler) {
     if (isPublicReadsEnabled()) {
@@ -192,19 +193,19 @@ class HttpKernel {
   }
   wrapWebAuthenticated(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    return this.wrap("web", withMiddleware(createRequireWebAuthMiddleware(auth))(handler));
+    return this.wrapWeb(withMiddleware(createRequireWebAuthMiddleware(auth))(handler));
   }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
-    return this.wrap("web", withMiddleware(...middleware)(handler));
+    return this.wrapWeb(withMiddleware(...middleware)(handler));
   }
   wrapWebGlobalAdmin(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const middleware = [createRequireWebAuthMiddleware(auth), createRequireGlobalAdminMiddleware()];
-    return this.wrap("web", withMiddleware(...middleware)(handler));
+    return this.wrapWeb(withMiddleware(...middleware)(handler));
   }
   wrapAuthenticated(handler) {
     return this.wrap("authenticated", handler);
@@ -818,68 +819,6 @@ var coreProviders = [
   viewProvider
 ];
 
-// ../../src/bootstrap/secretsGuard.ts
-var DEFAULT_ADMIN_API_TOKEN = "workhub-admin-test-token";
-var DEFAULT_MEMBER_API_TOKEN = "workhub-member-test-token";
-var DEFAULT_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
-var DEFAULT_TOKENS = new Set([DEFAULT_ADMIN_API_TOKEN, DEFAULT_MEMBER_API_TOKEN]);
-var DEFAULT_SCIM_TOKENS = new Set([DEFAULT_SCIM_BEARER_TOKEN]);
-function isEnabled(value, defaultEnabled) {
-  if (value === undefined) {
-    return defaultEnabled;
-  }
-  return defaultEnabled ? value !== "false" : value === "true";
-}
-function assertProductionSecrets(env = process.env) {
-  const appEnv = env.APP_ENV ?? "local";
-  if (appEnv !== "production") {
-    return;
-  }
-  const adminToken = env.ADMIN_API_TOKEN ?? DEFAULT_ADMIN_API_TOKEN;
-  const memberToken = env.MEMBER_API_TOKEN ?? DEFAULT_MEMBER_API_TOKEN;
-  const scimToken = env.SCIM_BEARER_TOKEN ?? DEFAULT_SCIM_BEARER_TOKEN;
-  const encryptionEnabled = isEnabled(env.FEATURE_FIELD_ENCRYPTION, true);
-  const devHeadersEnabled = isEnabled(env.AUTH_DEV_HEADERS, true);
-  if (devHeadersEnabled) {
-    throw new Error("Production startup blocked: set AUTH_DEV_HEADERS=false to disable development auth headers.");
-  }
-  if (DEFAULT_TOKENS.has(adminToken) || DEFAULT_TOKENS.has(memberToken)) {
-    throw new Error("Production startup blocked: rotate ADMIN_API_TOKEN and MEMBER_API_TOKEN away from default WorkHub test values.");
-  }
-  if (DEFAULT_SCIM_TOKENS.has(scimToken)) {
-    throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from default WorkHub test values.");
-  }
-  if (encryptionEnabled && !env.KMS_ENCRYPTION_KEY?.trim()) {
-    throw new Error("Production startup blocked: set KMS_ENCRYPTION_KEY when field encryption is enabled.");
-  }
-  if (!env.SIEM_EXPORT_URL?.trim() && isEnabled(env.FEATURE_SIEM_EXPORT, true)) {
-    console.warn("[secrets] SIEM_EXPORT_URL is not configured; audit logs remain database-only.");
-  }
-  if (isEnabled(env.FEATURE_BILLING, true) && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
-    throw new Error("Production startup blocked: set STRIPE_WEBHOOK_SECRET when billing webhooks are enabled.");
-  }
-  const corsOrigins = (env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim());
-  if (corsOrigins.includes("*")) {
-    throw new Error("Production startup blocked: set explicit CORS_ALLOWED_ORIGINS instead of wildcard.");
-  }
-  if (isEnabled(env.FEATURE_PUBLIC_READS, true)) {
-    throw new Error("Production startup blocked: set FEATURE_PUBLIC_READS=false for authenticated-only reads.");
-  }
-  if (!env.OAUTH_STATE_SECRET?.trim()) {
-    throw new Error("Production startup blocked: set OAUTH_STATE_SECRET for OAuth CSRF protection.");
-  }
-  if (!env.TOKEN_HASH_PEPPER?.trim()) {
-    throw new Error("Production startup blocked: set TOKEN_HASH_PEPPER for API token hashing.");
-  }
-  if (!env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim()) {
-    throw new Error("Production startup blocked: set API_TOKEN_DEFAULT_EXPIRY_DAYS to enforce token rotation.");
-  }
-  const frontendMode = (env.FRONTEND_MODE ?? "api").trim();
-  if (frontendMode === "server-htmx" && !env.SESSION_SECRET?.trim()) {
-    throw new Error("Production startup blocked: set SESSION_SECRET when FRONTEND_MODE=server-htmx.");
-  }
-}
-
 // ../../src/bootstrap/context.ts
 function collectProviders(modules = discoverModules()) {
   return [...coreProviders, ...modules.flatMap((module) => module.providers ?? [])];
@@ -890,7 +829,6 @@ function runProviderPhase(providers, phase, context) {
   }
 }
 function createAppContext() {
-  assertProductionSecrets();
   const container = new ServiceContainer;
   const config = new ConfigStore;
   const dependencies = {
@@ -960,6 +898,67 @@ import {
 } from "@getstrata/core/http/securedRouteModelBinding";
 // ../../src/bootstrap/membershipService.ts
 import { resolveMembershipService } from "@getstrata/core/auth/membershipService";
+// ../../src/bootstrap/secretsGuard.ts
+var DEFAULT_ADMIN_API_TOKEN = "workhub-admin-test-token";
+var DEFAULT_MEMBER_API_TOKEN = "workhub-member-test-token";
+var DEFAULT_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
+var DEFAULT_TOKENS = new Set([DEFAULT_ADMIN_API_TOKEN, DEFAULT_MEMBER_API_TOKEN]);
+var DEFAULT_SCIM_TOKENS = new Set([DEFAULT_SCIM_BEARER_TOKEN]);
+function isEnabled(value, defaultEnabled) {
+  if (value === undefined) {
+    return defaultEnabled;
+  }
+  return defaultEnabled ? value !== "false" : value === "true";
+}
+function assertProductionSecrets(env = process.env) {
+  const appEnv = env.APP_ENV ?? "local";
+  if (appEnv !== "production") {
+    return;
+  }
+  const adminToken = env.ADMIN_API_TOKEN ?? DEFAULT_ADMIN_API_TOKEN;
+  const memberToken = env.MEMBER_API_TOKEN ?? DEFAULT_MEMBER_API_TOKEN;
+  const scimToken = env.SCIM_BEARER_TOKEN ?? DEFAULT_SCIM_BEARER_TOKEN;
+  const encryptionEnabled = isEnabled(env.FEATURE_FIELD_ENCRYPTION, true);
+  const devHeadersEnabled = isEnabled(env.AUTH_DEV_HEADERS, true);
+  if (devHeadersEnabled) {
+    throw new Error("Production startup blocked: set AUTH_DEV_HEADERS=false to disable development auth headers.");
+  }
+  if (DEFAULT_TOKENS.has(adminToken) || DEFAULT_TOKENS.has(memberToken)) {
+    throw new Error("Production startup blocked: rotate ADMIN_API_TOKEN and MEMBER_API_TOKEN away from default WorkHub test values.");
+  }
+  if (DEFAULT_SCIM_TOKENS.has(scimToken)) {
+    throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from default WorkHub test values.");
+  }
+  if (encryptionEnabled && !env.KMS_ENCRYPTION_KEY?.trim()) {
+    throw new Error("Production startup blocked: set KMS_ENCRYPTION_KEY when field encryption is enabled.");
+  }
+  if (!env.SIEM_EXPORT_URL?.trim() && isEnabled(env.FEATURE_SIEM_EXPORT, true)) {
+    console.warn("[secrets] SIEM_EXPORT_URL is not configured; audit logs remain database-only.");
+  }
+  if (isEnabled(env.FEATURE_BILLING, true) && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
+    throw new Error("Production startup blocked: set STRIPE_WEBHOOK_SECRET when billing webhooks are enabled.");
+  }
+  const corsOrigins = (env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim());
+  if (corsOrigins.includes("*")) {
+    throw new Error("Production startup blocked: set explicit CORS_ALLOWED_ORIGINS instead of wildcard.");
+  }
+  if (isEnabled(env.FEATURE_PUBLIC_READS, true)) {
+    throw new Error("Production startup blocked: set FEATURE_PUBLIC_READS=false for authenticated-only reads.");
+  }
+  if (!env.OAUTH_STATE_SECRET?.trim()) {
+    throw new Error("Production startup blocked: set OAUTH_STATE_SECRET for OAuth CSRF protection.");
+  }
+  if (!env.TOKEN_HASH_PEPPER?.trim()) {
+    throw new Error("Production startup blocked: set TOKEN_HASH_PEPPER for API token hashing.");
+  }
+  if (!env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim()) {
+    throw new Error("Production startup blocked: set API_TOKEN_DEFAULT_EXPIRY_DAYS to enforce token rotation.");
+  }
+  const frontendMode = (env.FRONTEND_MODE ?? "api").trim();
+  if (frontendMode === "server-htmx" && !env.SESSION_SECRET?.trim()) {
+    throw new Error("Production startup blocked: set SESSION_SECRET when FRONTEND_MODE=server-htmx.");
+  }
+}
 // ../../src/bootstrap/web/forms.ts
 import {
   createCsrfProtection
@@ -993,7 +992,7 @@ async function parseFormBody(request) {
   return { fields, files };
 }
 // ../../src/bootstrap/web/routing.ts
-import { withErrorHandling } from "@getstrata/core/http/response";
+import { withErrorHandling as withErrorHandling2 } from "@getstrata/core/http/response";
 function routeParams(request) {
   const normalized = {};
   const raw = request.params;
@@ -1015,14 +1014,14 @@ function toRouteRequest(request) {
   return request;
 }
 function wrapSecuredRouteModelByKey(param, resolver, authorization, handler) {
-  const bound = withErrorHandling(securedBindRouteModelByKey(param, resolver, authorization, handler));
+  const bound = withErrorHandling2(securedBindRouteModelByKey(param, resolver, authorization, handler));
   return async (request) => bound(toRouteRequest(request));
 }
 function wrapWebLogin(kernel, handler, onThrottled) {
-  return wrapWebThrottle(kernel, "login", handler, onThrottled);
+  return kernel.wrapWeb(wrapWebThrottle(kernel, "login", handler, onThrottled));
 }
 function wrapWebRegister(kernel, handler, onThrottled) {
-  return wrapWebThrottle(kernel, "register", handler, onThrottled);
+  return kernel.wrapWeb(wrapWebThrottle(kernel, "register", handler, onThrottled));
 }
 function wrapWebThrottle(kernel, scope, handler, onThrottled) {
   const throttled = scope === "login" ? kernel.wrapLogin(handler) : kernel.wrapRegister(handler);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/bootstrap",
-  "version": "0.2.48",
+  "version": "0.2.49",
   "description": "Strata application bootstrap — HttpKernel, DI, web session helpers",
   "type": "module",
   "license": "MIT",
@@ -179,7 +179,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@getstrata/core": "^0.5.57",
+    "@getstrata/core": "^0.5.58",
     "typescript": "^5.9.0"
   }
 }