@getstrata/bootstrap 0.2.48 → 0.2.50

package/CHANGELOG.md

@@ -0,0 +1,8 @@
+# @getstrata/bootstrap changelog
+
+## 0.2.50
+
+- `createCookieSessionAuthManager` / `CookieSessionGuard` turn `CookieSessionStore` into an `AuthGuard` / `AuthManager` for `CORE_AUTH_TOKEN`. Supply a `mapUser` mapper; WorkHub abilities are not baked in. Omit `sql` to read the client from `bindDatabaseConnection()` on every call.
+- `checkDatabase()` / `createHealthRoutes()` ping the bound database client, not WorkHub’s private connection holder. `/health` stays `{ status: "ok" }` unless `{ pingOnHealth: true }`. Extra JSON fields are optional.
+- `assertProductionSecrets()` is feature-gated. A production HTMX app with `SESSION_SECRET` (32+), `AUTH_DEV_HEADERS=false`, and feature flags off does not need WorkHub API tokens. WorkHub’s current production env (rotated tokens, CORS, pepper, expiry) still passes.
+- Re-exports `CORE_ABILITY_CHECKER_TOKEN` and `CORE_AUTH_USER_DIRECTORY_TOKEN`.

package/README.md

@@ -28,7 +28,11 @@ import {
 import { createHttpKernel, createAppContext, coreProviders } from "@getstrata/bootstrap";
 ```
 
-`assertProductionSecrets` (`@getstrata/bootstrap/secretsGuard`) is env-only. It still rejects the well-known WorkHub test tokens.
+`createAppContext()` does not call `assertProductionSecrets`. WorkHub calls that from `App.serve()` / `queue:work`. Sibling HTMX apps can call it in production without WorkHub API tokens when feature flags are off — see [SIBLING-HTMX.md](../../docs/SIBLING-HTMX.md).
+
+Sibling HTMX apps should bind `createCookieSessionAuthManager` from `@getstrata/bootstrap/web/session` instead of HMAC `SessionGuard`. `CookieSessionStore` reads optional `is_admin` from the user row for `wrapWebGlobalAdmin`. Pass `mapUser` to map `is_admin` / `learn_subscriber` onto `AuthUser.role`.
+
+`wrapWeb` applies the web group (CSRF + flash) and `withErrorHandling`, so CSRF `ForbiddenError` becomes an HTML 403 in `FRONTEND_MODE=server-htmx`. `wrapWebLogin` / `wrapWebRegister` include that web group plus throttle — do not wrap them with `wrapWeb` again.
 
 These subpaths remain WorkHub-oriented and are not a generic starter API: `@getstrata/bootstrap/createRoutes` (includes SCIM), `@getstrata/bootstrap/schedule`, and `@getstrata/bootstrap/createWebRoutes` (redirects `/` to `/organizations`).
 

package/dist/bootstrap/config.d.ts

@@ -4,7 +4,7 @@ declare const CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
 declare const CACHE_DRIVER_CONFIG_KEY = "cache.driver";
 declare const REDIS_URL_CONFIG_KEY = "cache.redisUrl";
 declare const DATABASE_URL_CONFIG_KEY = "database.url";
-export { CORE_AUTH_TOKEN, CORE_CACHE_TOKEN, CORE_CONFIG_TOKEN, CORE_EVENT_BUS_TOKEN, CORE_POLICY_GATE_TOKEN, CORE_QUEUE_TOKEN, CORE_TOKEN_SERVICE_TOKEN, } from "@getstrata/core/contracts/serviceTokens";
+export { CORE_ABILITY_CHECKER_TOKEN, CORE_AUTH_TOKEN, CORE_AUTH_USER_DIRECTORY_TOKEN, CORE_CACHE_TOKEN, CORE_CONFIG_TOKEN, CORE_EVENT_BUS_TOKEN, CORE_POLICY_GATE_TOKEN, CORE_QUEUE_TOKEN, CORE_TOKEN_SERVICE_TOKEN, } from "@getstrata/core/contracts/serviceTokens";
 declare const AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
 declare const DEFAULT_APP_PORT = 3000;
 declare const DEFAULT_CACHE_TTL_MS = 3600000;

package/dist/bootstrap/health.d.ts

@@ -1,8 +1,14 @@
 import type { AppDependencies } from "./contracts";
+interface CreateHealthRoutesOptions {
+    pingOnHealth?: boolean;
+    extra?: Record<string, unknown> | (() => Record<string, unknown> | Promise<Record<string, unknown>>);
+}
 declare function checkDatabase(): Promise<boolean>;
+declare function pingDatabase(): Promise<boolean>;
 declare function checkRedis(redisUrl: string): Promise<boolean>;
-declare function createHealthRoutes(dependencies: AppDependencies): {
+declare function createHealthRoutes(dependencies: AppDependencies, options?: CreateHealthRoutesOptions): {
     "/health": () => Promise<Response>;
     "/ready": () => Promise<Response>;
 };
-export { checkDatabase, checkRedis, createHealthRoutes };
+export type { CreateHealthRoutesOptions };
+export { checkDatabase, checkRedis, createHealthRoutes, pingDatabase };

package/dist/bootstrap/public-api.d.ts

@@ -9,7 +9,7 @@ export { buildModuleRoutes } from "./buildModuleRoutes.ts";
 export type { BuildWebModuleRoutesOptions } from "./buildWebModuleRoutes.ts";
 export { buildWebModuleRoutes } from "./buildWebModuleRoutes.ts";
 export { cacheTagsForModelWrite, discoverModelTableNames } from "./cache/modelCacheTags.ts";
-export { APP_PORT_CONFIG_KEY, CORE_AUTH_TOKEN, CORE_CACHE_TOKEN, CORE_CONFIG_TOKEN, CORE_EVENT_BUS_TOKEN, CORE_POLICY_GATE_TOKEN, CORE_QUEUE_TOKEN, CORE_TOKEN_SERVICE_TOKEN, DATABASE_URL_CONFIG_KEY, DEFAULT_APP_PORT, REDIS_URL_CONFIG_KEY, } from "./config.ts";
+export { APP_PORT_CONFIG_KEY, CORE_ABILITY_CHECKER_TOKEN, CORE_AUTH_TOKEN, CORE_AUTH_USER_DIRECTORY_TOKEN, CORE_CACHE_TOKEN, CORE_CONFIG_TOKEN, CORE_EVENT_BUS_TOKEN, CORE_POLICY_GATE_TOKEN, CORE_QUEUE_TOKEN, CORE_TOKEN_SERVICE_TOKEN, DATABASE_URL_CONFIG_KEY, DEFAULT_APP_PORT, REDIS_URL_CONFIG_KEY, } from "./config.ts";
 export { collectProviders, createAppContext, runProviderPhase } from "./context.ts";
 export type { AppContext, AppDependencies, AppModule, AppRouteMap, CachedJson, ConfigStore, ModuleRouteContext, MutableAppDependencies, ProviderContext, ServiceFactory, ServiceProvider, } from "./contracts.ts";
 export { assertAppDependenciesComplete, getRequiredDependency, resolveService, ServiceContainer, } from "./contracts.ts";
@@ -17,6 +17,8 @@ export { createWebRoutes, mergeWebRoutes } from "./createWebRoutes.ts";
 export { createAppDependencies } from "./dependencies.ts";
 export type { DiscoverModulesOptions } from "./discoverModules.ts";
 export { configureModulesDirectory, discoverModules, ensureModulesLoaded, } from "./discoverModules.ts";
+export type { CreateHealthRoutesOptions } from "./health.ts";
+export { checkDatabase, checkRedis, createHealthRoutes, pingDatabase } from "./health.ts";
 export { type RouteModelAuthorization, securedBindRouteModel, securedBindRouteModelByKey, } from "./http/securedRouteModelBinding.ts";
 export { createHttpKernel, type HttpKernel, type MiddlewareGroupName } from "./httpKernel.ts";
 export { resolveMembershipService } from "./membershipService.ts";
@@ -25,4 +27,4 @@ export { coreProviders } from "./providers/index.ts";
 export { registerDefaultJobs } from "./queue/defaultJobs.ts";
 export { RouteRegistry, routeRegistry } from "./routeRegistry.ts";
 export { assertProductionSecrets } from "./secretsGuard.ts";
-export { CookieSessionStore, createCsrfProtection, createRouteKernel, createWebServer, type ParsedForm, parseFormBody, routeParams, type SessionUser, slugify, toRouteRequest, type WebServerOptions, wrapSecuredRouteModelByKey, wrapWebLogin, wrapWebRegister, } from "./web/index.ts";
+export { CookieSessionGuard, CookieSessionStore, createCookieSessionAuthManager, createCsrfProtection, createRouteKernel, createWebServer, type MapSessionUser, type ParsedForm, parseFormBody, routeParams, type SessionUser, slugify, toRouteRequest, type WebServerOptions, wrapSecuredRouteModelByKey, wrapWebLogin, wrapWebRegister, } from "./web/index.ts";

package/dist/bootstrap/web/index.d.ts

@@ -4,5 +4,5 @@
 export { createCsrfProtection, type ParsedForm, parseFormBody } from "./forms.ts";
 export { createRouteKernel, routeParams, toRouteRequest, wrapSecuredRouteModelByKey, wrapWebLogin, wrapWebRegister, } from "./routing.ts";
 export { convertAppRoutesToBunRoutes, createWebServer, type WebServerOptions } from "./server.ts";
-export { CookieSessionStore, type SessionUser } from "./session.ts";
+export { CookieSessionGuard, CookieSessionStore, createCookieSessionAuthManager, type MapSessionUser, type SessionUser, } from "./session.ts";
 export { slugify } from "./slug.ts";

package/dist/bootstrap/web/routing.d.ts

@@ -14,9 +14,9 @@ export declare function wrapSecuredRouteModelByKey<TParams extends Record<string
     resource: string;
     action: "view" | "create" | "update" | "delete";
 }, handler: (request: RouteRequest<TParams>, model: TModel) => Response | Promise<Response>): RouteHandler;
-/** Converts kernel login throttle 429 JSON into an HTML response for web forms. */
+/** Web group (CSRF + flash + HTML errors) plus login throttle. Do not wrap with wrapWeb again. */
 export declare function wrapWebLogin(kernel: HttpKernel, handler: RouteHandler, onThrottled: (request: Request) => Response | Promise<Response>): RouteHandler;
-/** Converts kernel register throttle 429 JSON into an HTML response for web forms. */
+/** Web group (CSRF + flash + HTML errors) plus register throttle. Do not wrap with wrapWeb again. */
 export declare function wrapWebRegister(kernel: HttpKernel, handler: RouteHandler, onThrottled: (request: Request) => Response | Promise<Response>): RouteHandler;
 /** Convenience alias: HttpKernel is the Laravel-style router middleware wrapper. */
 export declare function createRouteKernel(dependencies: AppDependencies): HttpKernel;

package/dist/bootstrap/web/session.d.ts

@@ -1,3 +1,5 @@
+import type { AuthUser } from "@getstrata/core/auth/authContext";
+import { type AuthGuard, AuthManager } from "@getstrata/core/auth/guard";
 export interface SessionUser {
     id: number;
     name: string;
@@ -8,18 +10,38 @@ export interface SessionUser {
 type SqlClient = {
     unsafe<T>(query: string, params?: readonly unknown[]): Promise<T[]>;
 };
+type SqlSource = SqlClient | (() => SqlClient);
+declare function defaultSessionSql(): SqlClient;
+export type MapSessionUser = (user: SessionUser) => AuthUser;
+declare function defaultMapSessionUser(user: SessionUser): AuthUser;
 export declare class CookieSessionStore {
-    private readonly sql;
+    private readonly sqlSource;
     private readonly secret;
     private readonly cookieName;
     private readonly maxAgeSeconds;
-    constructor(sql: SqlClient, secret: string, cookieName?: string, maxAgeSeconds?: number);
+    constructor(sqlSource: SqlSource, secret: string, cookieName?: string, maxAgeSeconds?: number);
     cookieHeader(_user: SessionUser, sessionId: string): string;
     clearCookieHeader(): string;
     private withSecureFlag;
+    private sql;
     create(user: SessionUser): Promise<string>;
     destroy(sessionId: string): Promise<void>;
     read(request: Request): Promise<SessionUser | null>;
     private sign;
 }
-export {};
+export declare class CookieSessionGuard implements AuthGuard {
+    private readonly store;
+    private readonly mapUser;
+    constructor(store: CookieSessionStore, mapUser?: MapSessionUser);
+    resolve(request: Request): Promise<AuthUser | null>;
+}
+export interface CreateCookieSessionAuthManagerOptions {
+    store?: CookieSessionStore;
+    sql?: SqlSource;
+    secret?: string;
+    cookieName?: string;
+    maxAgeSeconds?: number;
+    mapUser?: MapSessionUser;
+}
+declare function createCookieSessionAuthManager(options?: CreateCookieSessionAuthManagerOptions): AuthManager;
+export { createCookieSessionAuthManager, defaultMapSessionUser, defaultSessionSql };

package/dist/entries/buildModuleRoutes.js

@@ -7,6 +7,7 @@ import { applyMiddlewareToRoutes } from "@getstrata/core/http/middleware";
 
 // ../../src/bootstrap/httpKernel.ts
 import { createMembershipMiddleware } from "@getstrata/core/auth/membershipMiddleware";
+import { resolveAbilityChecker } from "@getstrata/core/contracts/serviceTokens";
 import { createAuthMiddleware } from "@getstrata/core/http/authMiddleware";
 import { createAuthorizeMiddleware } from "@getstrata/core/http/authorizeMiddleware";
 import { createBodySizeLimitMiddleware } from "@getstrata/core/http/bodySizeLimitMiddleware";
@@ -21,6 +22,7 @@ import { createRequireAbilityMiddleware } from "@getstrata/core/http/requireAbil
 import { createRequireAuthMiddleware } from "@getstrata/core/http/requireAuthMiddleware";
 import { createRequireGlobalAdminMiddleware } from "@getstrata/core/http/requireGlobalAdminMiddleware";
 import { createRequireWebAuthMiddleware } from "@getstrata/core/http/requireWebAuthMiddleware";
+import { withErrorHandling } from "@getstrata/core/http/response";
 import { withMiddleware } from "@getstrata/core/http/routeMiddleware";
 import { createSecurityHeadersMiddleware } from "@getstrata/core/http/securityHeadersMiddleware";
 import { createThrottleMiddleware } from "@getstrata/core/http/throttleMiddleware";
@@ -66,24 +68,38 @@ function parsePositiveInt(value, fallback) {
   }
   return Math.trunc(parsed);
 }
+function parseWindowSeconds(secondsValue, msValue, fallback) {
+  if (secondsValue !== undefined && secondsValue.trim() !== "") {
+    return parsePositiveInt(secondsValue, fallback);
+  }
+  if (msValue !== undefined && msValue.trim() !== "") {
+    const parsedMs = Number(msValue);
+    if (Number.isFinite(parsedMs) && parsedMs > 0) {
+      return Math.max(1, Math.trunc(parsedMs / 1000));
+    }
+  }
+  return fallback;
+}
 function resolveLoginRateLimit() {
   const defaults = isLocalAppEnv() ? LOCAL_LOGIN_RATE_LIMIT : PRODUCTION_LOGIN_RATE_LIMIT;
   return {
     maxAttempts: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
-    decaySeconds: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_WINDOW_SECONDS, defaults.decaySeconds)
+    decaySeconds: parseWindowSeconds(process.env.LOGIN_RATE_LIMIT_WINDOW_SECONDS, process.env.LOGIN_RATE_LIMIT_WINDOW_MS, defaults.decaySeconds)
   };
 }
 function resolveRegisterRateLimit() {
   const defaults = isLocalAppEnv() ? { maxAttempts: 100, decaySeconds: 60 } : { maxAttempts: 10, decaySeconds: 60 };
   return {
     maxAttempts: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
-    decaySeconds: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_WINDOW_SECONDS ?? process.env.REGISTER_RATE_LIMIT_WINDOW_MS ? String(Number(process.env.REGISTER_RATE_LIMIT_WINDOW_MS) / 1000) : undefined, defaults.decaySeconds)
+    decaySeconds: parseWindowSeconds(process.env.REGISTER_RATE_LIMIT_WINDOW_SECONDS, process.env.REGISTER_RATE_LIMIT_WINDOW_MS, defaults.decaySeconds)
   };
 }
 
 // ../../src/bootstrap/config.ts
 import {
+  CORE_ABILITY_CHECKER_TOKEN,
   CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
   CORE_CACHE_TOKEN,
   CORE_CONFIG_TOKEN,
   CORE_EVENT_BUS_TOKEN,
@@ -173,7 +189,7 @@ class HttpKernel {
     return this.wrap(["api", "authenticated"], handler);
   }
   wrapWeb(handler) {
-    return this.wrap("web", handler);
+    return withErrorHandling(this.wrap("web", handler));
   }
   wrapWebPublicRead(handler) {
     if (isPublicReadsEnabled()) {
@@ -183,19 +199,19 @@ class HttpKernel {
   }
   wrapWebAuthenticated(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    return this.wrap("web", withMiddleware(createRequireWebAuthMiddleware(auth))(handler));
+    return this.wrapWeb(withMiddleware(createRequireWebAuthMiddleware(auth))(handler));
   }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const abilityChecker = resolveAbilityChecker(this.dependencies.container);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
-    return this.wrap("web", withMiddleware(...middleware)(handler));
+    return this.wrapWeb(withMiddleware(...middleware)(handler));
   }
   wrapWebGlobalAdmin(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const middleware = [createRequireWebAuthMiddleware(auth), createRequireGlobalAdminMiddleware()];
-    return this.wrap("web", withMiddleware(...middleware)(handler));
+    return this.wrapWeb(withMiddleware(...middleware)(handler));
   }
   wrapAuthenticated(handler) {
     return this.wrap("authenticated", handler);
@@ -211,7 +227,7 @@ class HttpKernel {
     return withMiddleware(...middleware)(handler);
   }
   wrapAbility(ability, handler) {
-    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const abilityChecker = resolveAbilityChecker(this.dependencies.container);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [...this.group("authenticated"), requireAbility(ability)];
     return withMiddleware(...middleware)(handler);

package/dist/entries/buildWebModuleRoutes.js

@@ -10,6 +10,7 @@ import { applyMiddlewareToRoutes } from "@getstrata/core/http/middleware";
 
 // ../../src/bootstrap/httpKernel.ts
 import { createMembershipMiddleware } from "@getstrata/core/auth/membershipMiddleware";
+import { resolveAbilityChecker } from "@getstrata/core/contracts/serviceTokens";
 import { createAuthMiddleware } from "@getstrata/core/http/authMiddleware";
 import { createAuthorizeMiddleware } from "@getstrata/core/http/authorizeMiddleware";
 import { createBodySizeLimitMiddleware } from "@getstrata/core/http/bodySizeLimitMiddleware";
@@ -24,6 +25,7 @@ import { createRequireAbilityMiddleware } from "@getstrata/core/http/requireAbil
 import { createRequireAuthMiddleware } from "@getstrata/core/http/requireAuthMiddleware";
 import { createRequireGlobalAdminMiddleware } from "@getstrata/core/http/requireGlobalAdminMiddleware";
 import { createRequireWebAuthMiddleware } from "@getstrata/core/http/requireWebAuthMiddleware";
+import { withErrorHandling } from "@getstrata/core/http/response";
 import { withMiddleware } from "@getstrata/core/http/routeMiddleware";
 import { createSecurityHeadersMiddleware } from "@getstrata/core/http/securityHeadersMiddleware";
 import { createThrottleMiddleware } from "@getstrata/core/http/throttleMiddleware";
@@ -69,24 +71,38 @@ function parsePositiveInt(value, fallback) {
   }
   return Math.trunc(parsed);
 }
+function parseWindowSeconds(secondsValue, msValue, fallback) {
+  if (secondsValue !== undefined && secondsValue.trim() !== "") {
+    return parsePositiveInt(secondsValue, fallback);
+  }
+  if (msValue !== undefined && msValue.trim() !== "") {
+    const parsedMs = Number(msValue);
+    if (Number.isFinite(parsedMs) && parsedMs > 0) {
+      return Math.max(1, Math.trunc(parsedMs / 1000));
+    }
+  }
+  return fallback;
+}
 function resolveLoginRateLimit() {
   const defaults = isLocalAppEnv() ? LOCAL_LOGIN_RATE_LIMIT : PRODUCTION_LOGIN_RATE_LIMIT;
   return {
     maxAttempts: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
-    decaySeconds: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_WINDOW_SECONDS, defaults.decaySeconds)
+    decaySeconds: parseWindowSeconds(process.env.LOGIN_RATE_LIMIT_WINDOW_SECONDS, process.env.LOGIN_RATE_LIMIT_WINDOW_MS, defaults.decaySeconds)
   };
 }
 function resolveRegisterRateLimit() {
   const defaults = isLocalAppEnv() ? { maxAttempts: 100, decaySeconds: 60 } : { maxAttempts: 10, decaySeconds: 60 };
   return {
     maxAttempts: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
-    decaySeconds: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_WINDOW_SECONDS ?? process.env.REGISTER_RATE_LIMIT_WINDOW_MS ? String(Number(process.env.REGISTER_RATE_LIMIT_WINDOW_MS) / 1000) : undefined, defaults.decaySeconds)
+    decaySeconds: parseWindowSeconds(process.env.REGISTER_RATE_LIMIT_WINDOW_SECONDS, process.env.REGISTER_RATE_LIMIT_WINDOW_MS, defaults.decaySeconds)
   };
 }
 
 // ../../src/bootstrap/config.ts
 import {
+  CORE_ABILITY_CHECKER_TOKEN,
   CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
   CORE_CACHE_TOKEN,
   CORE_CONFIG_TOKEN,
   CORE_EVENT_BUS_TOKEN,
@@ -176,7 +192,7 @@ class HttpKernel {
     return this.wrap(["api", "authenticated"], handler);
   }
   wrapWeb(handler) {
-    return this.wrap("web", handler);
+    return withErrorHandling(this.wrap("web", handler));
   }
   wrapWebPublicRead(handler) {
     if (isPublicReadsEnabled()) {
@@ -186,19 +202,19 @@ class HttpKernel {
   }
   wrapWebAuthenticated(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    return this.wrap("web", withMiddleware(createRequireWebAuthMiddleware(auth))(handler));
+    return this.wrapWeb(withMiddleware(createRequireWebAuthMiddleware(auth))(handler));
   }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const abilityChecker = resolveAbilityChecker(this.dependencies.container);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
-    return this.wrap("web", withMiddleware(...middleware)(handler));
+    return this.wrapWeb(withMiddleware(...middleware)(handler));
   }
   wrapWebGlobalAdmin(handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const middleware = [createRequireWebAuthMiddleware(auth), createRequireGlobalAdminMiddleware()];
-    return this.wrap("web", withMiddleware(...middleware)(handler));
+    return this.wrapWeb(withMiddleware(...middleware)(handler));
   }
   wrapAuthenticated(handler) {
     return this.wrap("authenticated", handler);
@@ -214,7 +230,7 @@ class HttpKernel {
     return withMiddleware(...middleware)(handler);
   }
   wrapAbility(ability, handler) {
-    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const abilityChecker = resolveAbilityChecker(this.dependencies.container);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [...this.group("authenticated"), requireAbility(ability)];
     return withMiddleware(...middleware)(handler);

package/dist/entries/config.js

@@ -3,7 +3,9 @@ var __jsonParse = (a) => JSON.parse(a);
 
 // ../../src/bootstrap/config.ts
 import {
+  CORE_ABILITY_CHECKER_TOKEN,
   CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
   CORE_CACHE_TOKEN,
   CORE_CONFIG_TOKEN,
   CORE_EVENT_BUS_TOKEN,
@@ -30,7 +32,9 @@ export {
   CACHE_DRIVER_CONFIG_KEY,
   CACHE_MAX_ENTRIES_CONFIG_KEY,
   CACHE_TTL_MS_CONFIG_KEY,
+  CORE_ABILITY_CHECKER_TOKEN,
   CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
   CORE_CACHE_TOKEN,
   CORE_CONFIG_TOKEN,
   CORE_EVENT_BUS_TOKEN,

package/dist/entries/context.js

@@ -107,7 +107,9 @@ var authConfig = {
 
 // ../../src/bootstrap/config.ts
 import {
+  CORE_ABILITY_CHECKER_TOKEN,
   CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
   CORE_CACHE_TOKEN,
   CORE_CONFIG_TOKEN,
   CORE_EVENT_BUS_TOKEN,
@@ -506,68 +508,6 @@ var coreProviders = [
   viewProvider
 ];
 
-// ../../src/bootstrap/secretsGuard.ts
-var DEFAULT_ADMIN_API_TOKEN = "workhub-admin-test-token";
-var DEFAULT_MEMBER_API_TOKEN = "workhub-member-test-token";
-var DEFAULT_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
-var DEFAULT_TOKENS = new Set([DEFAULT_ADMIN_API_TOKEN, DEFAULT_MEMBER_API_TOKEN]);
-var DEFAULT_SCIM_TOKENS = new Set([DEFAULT_SCIM_BEARER_TOKEN]);
-function isEnabled(value, defaultEnabled) {
-  if (value === undefined) {
-    return defaultEnabled;
-  }
-  return defaultEnabled ? value !== "false" : value === "true";
-}
-function assertProductionSecrets(env = process.env) {
-  const appEnv = env.APP_ENV ?? "local";
-  if (appEnv !== "production") {
-    return;
-  }
-  const adminToken = env.ADMIN_API_TOKEN ?? DEFAULT_ADMIN_API_TOKEN;
-  const memberToken = env.MEMBER_API_TOKEN ?? DEFAULT_MEMBER_API_TOKEN;
-  const scimToken = env.SCIM_BEARER_TOKEN ?? DEFAULT_SCIM_BEARER_TOKEN;
-  const encryptionEnabled = isEnabled(env.FEATURE_FIELD_ENCRYPTION, true);
-  const devHeadersEnabled = isEnabled(env.AUTH_DEV_HEADERS, true);
-  if (devHeadersEnabled) {
-    throw new Error("Production startup blocked: set AUTH_DEV_HEADERS=false to disable development auth headers.");
-  }
-  if (DEFAULT_TOKENS.has(adminToken) || DEFAULT_TOKENS.has(memberToken)) {
-    throw new Error("Production startup blocked: rotate ADMIN_API_TOKEN and MEMBER_API_TOKEN away from default WorkHub test values.");
-  }
-  if (DEFAULT_SCIM_TOKENS.has(scimToken)) {
-    throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from default WorkHub test values.");
-  }
-  if (encryptionEnabled && !env.KMS_ENCRYPTION_KEY?.trim()) {
-    throw new Error("Production startup blocked: set KMS_ENCRYPTION_KEY when field encryption is enabled.");
-  }
-  if (!env.SIEM_EXPORT_URL?.trim() && isEnabled(env.FEATURE_SIEM_EXPORT, true)) {
-    console.warn("[secrets] SIEM_EXPORT_URL is not configured; audit logs remain database-only.");
-  }
-  if (isEnabled(env.FEATURE_BILLING, true) && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
-    throw new Error("Production startup blocked: set STRIPE_WEBHOOK_SECRET when billing webhooks are enabled.");
-  }
-  const corsOrigins = (env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim());
-  if (corsOrigins.includes("*")) {
-    throw new Error("Production startup blocked: set explicit CORS_ALLOWED_ORIGINS instead of wildcard.");
-  }
-  if (isEnabled(env.FEATURE_PUBLIC_READS, true)) {
-    throw new Error("Production startup blocked: set FEATURE_PUBLIC_READS=false for authenticated-only reads.");
-  }
-  if (!env.OAUTH_STATE_SECRET?.trim()) {
-    throw new Error("Production startup blocked: set OAUTH_STATE_SECRET for OAuth CSRF protection.");
-  }
-  if (!env.TOKEN_HASH_PEPPER?.trim()) {
-    throw new Error("Production startup blocked: set TOKEN_HASH_PEPPER for API token hashing.");
-  }
-  if (!env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim()) {
-    throw new Error("Production startup blocked: set API_TOKEN_DEFAULT_EXPIRY_DAYS to enforce token rotation.");
-  }
-  const frontendMode = (env.FRONTEND_MODE ?? "api").trim();
-  if (frontendMode === "server-htmx" && !env.SESSION_SECRET?.trim()) {
-    throw new Error("Production startup blocked: set SESSION_SECRET when FRONTEND_MODE=server-htmx.");
-  }
-}
-
 // ../../src/bootstrap/context.ts
 function collectProviders(modules = discoverModules()) {
   return [...coreProviders, ...modules.flatMap((module) => module.providers ?? [])];
@@ -578,7 +518,6 @@ function runProviderPhase(providers, phase, context) {
   }
 }
 function createAppContext() {
-  assertProductionSecrets();
   const container = new ServiceContainer;
   const config = new ConfigStore;
   const dependencies = {