@getstrata/bootstrap 0.2.49 → 0.2.51

package/dist/index.js

@@ -20,6 +20,7 @@ import { applyMiddlewareToRoutes } from "@getstrata/core/http/middleware";
 
 // ../../src/bootstrap/httpKernel.ts
 import { createMembershipMiddleware } from "@getstrata/core/auth/membershipMiddleware";
+import { resolveAbilityChecker } from "@getstrata/core/contracts/serviceTokens";
 import { createAuthMiddleware } from "@getstrata/core/http/authMiddleware";
 import { createAuthorizeMiddleware } from "@getstrata/core/http/authorizeMiddleware";
 import { createBodySizeLimitMiddleware } from "@getstrata/core/http/bodySizeLimitMiddleware";
@@ -77,24 +78,38 @@ function parsePositiveInt(value, fallback) {
   }
   return Math.trunc(parsed);
 }
+function parseWindowSeconds(secondsValue, msValue, fallback) {
+  if (secondsValue !== undefined && secondsValue.trim() !== "") {
+    return parsePositiveInt(secondsValue, fallback);
+  }
+  if (msValue !== undefined && msValue.trim() !== "") {
+    const parsedMs = Number(msValue);
+    if (Number.isFinite(parsedMs) && parsedMs > 0) {
+      return Math.max(1, Math.trunc(parsedMs / 1000));
+    }
+  }
+  return fallback;
+}
 function resolveLoginRateLimit() {
   const defaults = isLocalAppEnv() ? LOCAL_LOGIN_RATE_LIMIT : PRODUCTION_LOGIN_RATE_LIMIT;
   return {
     maxAttempts: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
-    decaySeconds: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_WINDOW_SECONDS, defaults.decaySeconds)
+    decaySeconds: parseWindowSeconds(process.env.LOGIN_RATE_LIMIT_WINDOW_SECONDS, process.env.LOGIN_RATE_LIMIT_WINDOW_MS, defaults.decaySeconds)
   };
 }
 function resolveRegisterRateLimit() {
   const defaults = isLocalAppEnv() ? { maxAttempts: 100, decaySeconds: 60 } : { maxAttempts: 10, decaySeconds: 60 };
   return {
     maxAttempts: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
-    decaySeconds: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_WINDOW_SECONDS ?? process.env.REGISTER_RATE_LIMIT_WINDOW_MS ? String(Number(process.env.REGISTER_RATE_LIMIT_WINDOW_MS) / 1000) : undefined, defaults.decaySeconds)
+    decaySeconds: parseWindowSeconds(process.env.REGISTER_RATE_LIMIT_WINDOW_SECONDS, process.env.REGISTER_RATE_LIMIT_WINDOW_MS, defaults.decaySeconds)
   };
 }
 
 // ../../src/bootstrap/config.ts
 import {
+  CORE_ABILITY_CHECKER_TOKEN,
   CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
   CORE_CACHE_TOKEN,
   CORE_CONFIG_TOKEN,
   CORE_EVENT_BUS_TOKEN,
@@ -197,7 +212,7 @@ class HttpKernel {
   }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const abilityChecker = resolveAbilityChecker(this.dependencies.container);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
     return this.wrapWeb(withMiddleware(...middleware)(handler));
@@ -221,7 +236,7 @@ class HttpKernel {
     return withMiddleware(...middleware)(handler);
   }
   wrapAbility(ability, handler) {
-    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const abilityChecker = resolveAbilityChecker(this.dependencies.container);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [...this.group("authenticated"), requireAbility(ability)];
     return withMiddleware(...middleware)(handler);
@@ -891,6 +906,101 @@ function mergeWebRoutes(dependencies, routes) {
 function createAppDependencies() {
   return createAppContext().dependencies;
 }
+// ../../src/bootstrap/health.ts
+import { getBoundDatabaseConnection } from "@getstrata/core/database/boundConnection";
+import { getDefaultDatabasePool } from "@getstrata/core/database/defaultConnection";
+import { jsonResponse } from "@getstrata/core/http/response";
+var {RedisClient } = globalThis.Bun;
+function resolveRedisUrl(dependencies) {
+  if (!dependencies.container.has(CORE_CONFIG_TOKEN)) {
+    return process.env.REDIS_URL?.trim() || undefined;
+  }
+  const config = dependencies.container.resolve(CORE_CONFIG_TOKEN);
+  const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim();
+  return redisUrl || undefined;
+}
+function resolveHealthDatabase() {
+  const bound = getBoundDatabaseConnection();
+  if (bound) {
+    return bound;
+  }
+  try {
+    return getDefaultDatabasePool();
+  } catch {
+    return null;
+  }
+}
+async function pingDatabaseClient(connection) {
+  try {
+    await connection.unsafe("SELECT 1");
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function checkDatabase() {
+  const connection = resolveHealthDatabase();
+  if (!connection) {
+    return false;
+  }
+  return await pingDatabaseClient(connection);
+}
+async function pingDatabase() {
+  return await checkDatabase();
+}
+async function checkRedis(redisUrl) {
+  try {
+    const client = new RedisClient(redisUrl);
+    const response = await client.ping();
+    return response === "PONG";
+  } catch {
+    return false;
+  }
+}
+async function resolveExtraFields(extra) {
+  if (!extra) {
+    return {};
+  }
+  return typeof extra === "function" ? await extra() : extra;
+}
+async function collectDependencyChecks(dependencies) {
+  const checks = {
+    database: await checkDatabase() ? "ok" : "error"
+  };
+  const redisUrl = resolveRedisUrl(dependencies);
+  if (redisUrl) {
+    checks.redis = await checkRedis(redisUrl) ? "ok" : "error";
+  } else {
+    checks.redis = "skipped";
+  }
+  const ready = checks.database === "ok" && (checks.redis === "ok" || checks.redis === "skipped");
+  return { checks, ready };
+}
+function createHealthRoutes(dependencies, options = {}) {
+  return {
+    "/health": async () => {
+      const extra = await resolveExtraFields(options.extra);
+      if (!options.pingOnHealth) {
+        return jsonResponse({ status: "ok", ...extra });
+      }
+      const { checks, ready } = await collectDependencyChecks(dependencies);
+      return jsonResponse({
+        status: ready ? "ok" : "error",
+        checks,
+        ...extra
+      }, { status: ready ? 200 : 503 });
+    },
+    "/ready": async () => {
+      const extra = await resolveExtraFields(options.extra);
+      const { checks, ready } = await collectDependencyChecks(dependencies);
+      return jsonResponse({
+        status: ready ? "ready" : "not_ready",
+        checks,
+        ...extra
+      }, { status: ready ? 200 : 503 });
+    }
+  };
+}
 // ../../src/bootstrap/http/securedRouteModelBinding.ts
 import {
   securedBindRouteModel,
@@ -902,6 +1012,7 @@ import { resolveMembershipService } from "@getstrata/core/auth/membershipService
 var DEFAULT_ADMIN_API_TOKEN = "workhub-admin-test-token";
 var DEFAULT_MEMBER_API_TOKEN = "workhub-member-test-token";
 var DEFAULT_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
+var MIN_SESSION_SECRET_LENGTH = 32;
 var DEFAULT_TOKENS = new Set([DEFAULT_ADMIN_API_TOKEN, DEFAULT_MEMBER_API_TOKEN]);
 var DEFAULT_SCIM_TOKENS = new Set([DEFAULT_SCIM_BEARER_TOKEN]);
 function isEnabled(value, defaultEnabled) {
@@ -910,19 +1021,31 @@ function isEnabled(value, defaultEnabled) {
   }
   return defaultEnabled ? value !== "false" : value === "true";
 }
-function assertProductionSecrets(env = process.env) {
-  const appEnv = env.APP_ENV ?? "local";
-  if (appEnv !== "production") {
-    return;
+function isTokenAuthEnabled(env) {
+  return Boolean(env.ADMIN_API_TOKEN?.trim()) || Boolean(env.MEMBER_API_TOKEN?.trim()) || env.FEATURE_API_TOKENS === "true";
+}
+function isOAuthEnabled(env) {
+  return isEnabled(env.FEATURE_OAUTH, false) || isEnabled(env.FEATURE_SAML, false) || Boolean(env.GITHUB_CLIENT_ID?.trim()) || Boolean(env.OIDC_ISSUER?.trim()) || Boolean(env.SAML_LOGIN_URL?.trim());
+}
+function isCorsConfigured(env) {
+  return env.CORS_ALLOWED_ORIGINS !== undefined;
+}
+function assertAuthDevHeadersDisabled(env) {
+  if (isEnabled(env.AUTH_DEV_HEADERS, true)) {
+    throw new Error("Production startup blocked: set AUTH_DEV_HEADERS=false to disable development auth headers.");
   }
+}
+function assertSessionSecret(env) {
+  const secret = env.SESSION_SECRET?.trim() ?? "";
+  if (secret.length < MIN_SESSION_SECRET_LENGTH) {
+    throw new Error("Production startup blocked: set SESSION_SECRET when FRONTEND_MODE=server-htmx (32+ characters).");
+  }
+}
+function assertWorkHubProductionSecrets(env) {
   const adminToken = env.ADMIN_API_TOKEN ?? DEFAULT_ADMIN_API_TOKEN;
   const memberToken = env.MEMBER_API_TOKEN ?? DEFAULT_MEMBER_API_TOKEN;
   const scimToken = env.SCIM_BEARER_TOKEN ?? DEFAULT_SCIM_BEARER_TOKEN;
   const encryptionEnabled = isEnabled(env.FEATURE_FIELD_ENCRYPTION, true);
-  const devHeadersEnabled = isEnabled(env.AUTH_DEV_HEADERS, true);
-  if (devHeadersEnabled) {
-    throw new Error("Production startup blocked: set AUTH_DEV_HEADERS=false to disable development auth headers.");
-  }
   if (DEFAULT_TOKENS.has(adminToken) || DEFAULT_TOKENS.has(memberToken)) {
     throw new Error("Production startup blocked: rotate ADMIN_API_TOKEN and MEMBER_API_TOKEN away from default WorkHub test values.");
   }
@@ -954,9 +1077,50 @@ function assertProductionSecrets(env = process.env) {
   if (!env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim()) {
     throw new Error("Production startup blocked: set API_TOKEN_DEFAULT_EXPIRY_DAYS to enforce token rotation.");
   }
+}
+function assertSiblingProductionSecrets(env) {
+  if (isEnabled(env.FEATURE_SCIM, false)) {
+    const scimToken = env.SCIM_BEARER_TOKEN ?? DEFAULT_SCIM_BEARER_TOKEN;
+    if (DEFAULT_SCIM_TOKENS.has(scimToken) || !env.SCIM_BEARER_TOKEN?.trim()) {
+      throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from default WorkHub test values.");
+    }
+  }
+  if (isEnabled(env.FEATURE_FIELD_ENCRYPTION, false) && !env.KMS_ENCRYPTION_KEY?.trim()) {
+    throw new Error("Production startup blocked: set KMS_ENCRYPTION_KEY when field encryption is enabled.");
+  }
+  if (isEnabled(env.FEATURE_BILLING, false) && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
+    throw new Error("Production startup blocked: set STRIPE_WEBHOOK_SECRET when billing webhooks are enabled.");
+  }
+  if (isOAuthEnabled(env) && !env.OAUTH_STATE_SECRET?.trim()) {
+    throw new Error("Production startup blocked: set OAUTH_STATE_SECRET for OAuth CSRF protection.");
+  }
+  if (isCorsConfigured(env)) {
+    const corsOrigins = (env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim());
+    if (corsOrigins.includes("*")) {
+      throw new Error("Production startup blocked: set explicit CORS_ALLOWED_ORIGINS instead of wildcard.");
+    }
+  }
+  if (isEnabled(env.FEATURE_PUBLIC_READS, false)) {
+    throw new Error("Production startup blocked: set FEATURE_PUBLIC_READS=false for authenticated-only reads.");
+  }
+  if (!env.SIEM_EXPORT_URL?.trim() && isEnabled(env.FEATURE_SIEM_EXPORT, false)) {
+    console.warn("[secrets] SIEM_EXPORT_URL is not configured; audit logs remain database-only.");
+  }
+}
+function assertProductionSecrets(env = process.env) {
+  const appEnv = env.APP_ENV ?? "local";
+  if (appEnv !== "production") {
+    return;
+  }
+  assertAuthDevHeadersDisabled(env);
+  if (isTokenAuthEnabled(env)) {
+    assertWorkHubProductionSecrets(env);
+  } else {
+    assertSiblingProductionSecrets(env);
+  }
   const frontendMode = (env.FRONTEND_MODE ?? "api").trim();
-  if (frontendMode === "server-htmx" && !env.SESSION_SECRET?.trim()) {
-    throw new Error("Production startup blocked: set SESSION_SECRET when FRONTEND_MODE=server-htmx.");
+  if (frontendMode === "server-htmx") {
+    assertSessionSecret(env);
   }
 }
 // ../../src/bootstrap/web/forms.ts
@@ -1090,18 +1254,71 @@ function createWebServer(options) {
 }
 // ../../src/bootstrap/web/session.ts
 import { createHash, randomBytes } from "crypto";
+import { AuthManager as AuthManager2 } from "@getstrata/core/auth/guard";
+import { getBoundDatabaseConnection as getBoundDatabaseConnection2 } from "@getstrata/core/database/boundConnection";
+import { getDefaultDatabasePool as getDefaultDatabasePool2 } from "@getstrata/core/database/defaultConnection";
 import { readRequestCookie } from "@getstrata/core/http/cookies";
+function isSqlClient(value) {
+  return typeof value.unsafe === "function";
+}
+function resolveSql(source) {
+  if (isSqlClient(source)) {
+    return source;
+  }
+  return source();
+}
+function defaultSessionSql() {
+  const bound = getBoundDatabaseConnection2();
+  if (bound) {
+    return bound;
+  }
+  return getDefaultDatabasePool2();
+}
+function defaultMapSessionUser(user) {
+  return {
+    id: user.id,
+    role: user.is_admin ? "admin" : "member"
+  };
+}
+async function defaultLoadSessionUser(sql, sessionId) {
+  const rows = await sql.unsafe(`SELECT s.id, s.user_id, s.expires_at, u.name, u.email, u.learn_subscriber,
+            COALESCE(u.is_admin, false) AS is_admin
+     FROM sessions s
+     INNER JOIN users u ON u.id = s.user_id
+     WHERE s.id = $1 AND s.expires_at > NOW()`, [sessionId]);
+  const row = rows[0];
+  if (!row)
+    return null;
+  return {
+    id: row.user_id,
+    name: row.name,
+    email: row.email,
+    learn_subscriber: row.learn_subscriber,
+    is_admin: row.is_admin
+  };
+}
+function redirectWithCookie(location, setCookie, status) {
+  return new Response(null, {
+    status,
+    headers: {
+      Location: location,
+      "Set-Cookie": setCookie
+    }
+  });
+}
 
 class CookieSessionStore {
-  sql;
+  sqlSource;
   secret;
   cookieName;
   maxAgeSeconds;
-  constructor(sql, secret, cookieName = "strata_session", maxAgeSeconds = 60 * 60 * 24 * 14) {
-    this.sql = sql;
+  loadSessionUser;
+  constructor(sqlSource, secret, cookieName = "strata_session", maxAgeSeconds = 60 * 60 * 24 * 14, loadSessionUser = defaultLoadSessionUser) {
+    this.sqlSource = sqlSource;
     this.secret = secret;
     this.cookieName = cookieName;
     this.maxAgeSeconds = maxAgeSeconds;
+    this.loadSessionUser = loadSessionUser;
   }
   cookieHeader(_user, sessionId) {
     const payload = `${sessionId}.${this.sign(sessionId)}`;
@@ -1110,16 +1327,30 @@ class CookieSessionStore {
   clearCookieHeader() {
     return this.withSecureFlag(`${this.cookieName}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`);
   }
+  sessionIdFromRequest(request) {
+    const cookie = readRequestCookie(request, this.cookieName);
+    const raw = cookie ?? null;
+    if (!raw)
+      return null;
+    const [sessionId, signature] = raw.split(".");
+    if (!sessionId || !signature || signature !== this.sign(sessionId)) {
+      return null;
+    }
+    return sessionId;
+  }
   withSecureFlag(header) {
     if (true) {
       return header;
     }
     return header.includes("Secure") ? header : `${header}; Secure`;
   }
+  sql() {
+    return resolveSql(this.sqlSource);
+  }
   async create(user) {
     const id = randomBytes(32).toString("hex");
     const expires = new Date(Date.now() + this.maxAgeSeconds * 1000);
-    await this.sql.unsafe(`INSERT INTO sessions (id, user_id, expires_at) VALUES ($1, $2, $3)`, [
+    await this.sql().unsafe(`INSERT INTO sessions (id, user_id, expires_at) VALUES ($1, $2, $3)`, [
       id,
       user.id,
       expires
@@ -1127,50 +1358,82 @@ class CookieSessionStore {
     return id;
   }
   async destroy(sessionId) {
-    await this.sql.unsafe(`DELETE FROM sessions WHERE id = $1`, [sessionId]);
+    await this.sql().unsafe(`DELETE FROM sessions WHERE id = $1`, [sessionId]);
   }
   async read(request) {
-    const cookie = readRequestCookie(request, this.cookieName);
-    const raw = cookie ?? null;
-    if (!raw)
-      return null;
-    const [sessionId, signature] = raw.split(".");
-    if (!sessionId || !signature || signature !== this.sign(sessionId)) {
-      return null;
-    }
-    const rows = await this.sql.unsafe(`SELECT s.id, s.user_id, s.expires_at, u.name, u.email, u.learn_subscriber,
-              COALESCE(u.is_admin, false) AS is_admin
-       FROM sessions s
-       INNER JOIN users u ON u.id = s.user_id
-       WHERE s.id = $1 AND s.expires_at > NOW()`, [sessionId]);
-    const row = rows[0];
-    if (!row)
+    const sessionId = this.sessionIdFromRequest(request);
+    if (!sessionId)
       return null;
-    return {
-      id: row.user_id,
-      name: row.name,
-      email: row.email,
-      learn_subscriber: row.learn_subscriber,
-      is_admin: row.is_admin
-    };
+    return this.loadSessionUser(this.sql(), sessionId);
   }
   sign(value) {
     return createHash("sha256").update(`${value}.${this.secret}`).digest("hex").slice(0, 32);
   }
 }
+
+class CookieSessionGuard {
+  store;
+  mapUser;
+  constructor(store, mapUser = defaultMapSessionUser) {
+    this.store = store;
+    this.mapUser = mapUser;
+  }
+  async resolve(request) {
+    const user = await this.store.read(request);
+    if (!user) {
+      return null;
+    }
+    return this.mapUser(user);
+  }
+}
+
+class CookieSessionAuthManager extends AuthManager2 {
+  store;
+  constructor(store, mapUser = defaultMapSessionUser) {
+    super(new CookieSessionGuard(store, mapUser));
+    this.store = store;
+  }
+  async signIn(user) {
+    const sessionId = await this.store.create(user);
+    return { sessionId, setCookie: this.store.cookieHeader(user, sessionId) };
+  }
+  async signOut(request) {
+    const sessionId = this.store.sessionIdFromRequest(request);
+    if (sessionId) {
+      await this.store.destroy(sessionId);
+    }
+    return { setCookie: this.store.clearCookieHeader() };
+  }
+  async signInRedirect(user, location, status = 302) {
+    const { setCookie } = await this.signIn(user);
+    return redirectWithCookie(location, setCookie, status);
+  }
+  async signOutRedirect(request, location, status = 302) {
+    const { setCookie } = await this.signOut(request);
+    return redirectWithCookie(location, setCookie, status);
+  }
+}
+function createCookieSessionAuthManager(options = {}) {
+  const store = options.store ?? new CookieSessionStore(options.sql ?? defaultSessionSql, options.secret ?? process.env.SESSION_SECRET?.trim() ?? "", options.cookieName, options.maxAgeSeconds, options.loadSessionUser);
+  return new CookieSessionAuthManager(store, options.mapUser ?? defaultMapSessionUser);
+}
 // ../../src/bootstrap/web/slug.ts
 function slugify(value) {
   return value.toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80);
 }
 export {
   APP_PORT_CONFIG_KEY,
+  CORE_ABILITY_CHECKER_TOKEN,
   CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
   CORE_CACHE_TOKEN,
   CORE_CONFIG_TOKEN,
   CORE_EVENT_BUS_TOKEN,
   CORE_POLICY_GATE_TOKEN,
   CORE_QUEUE_TOKEN,
   CORE_TOKEN_SERVICE_TOKEN,
+  CookieSessionAuthManager,
+  CookieSessionGuard,
   CookieSessionStore,
   DATABASE_URL_CONFIG_KEY,
   DEFAULT_APP_PORT,
@@ -1184,12 +1447,16 @@ export {
   buildModuleRoutes,
   buildWebModuleRoutes,
   cacheTagsForModelWrite,
+  checkDatabase,
+  checkRedis,
   collectProviders,
   configureModulesDirectory,
   coreProviders,
   createAppContext,
   createAppDependencies,
+  createCookieSessionAuthManager,
   createCsrfProtection,
+  createHealthRoutes,
   createHttpKernel,
   createRouteKernel,
   createWebRoutes,
@@ -1200,6 +1467,7 @@ export {
   getRequiredDependency,
   mergeWebRoutes,
   parseFormBody,
+  pingDatabase,
   prefixRouteMap,
   registerDefaultJobs,
   resolveApplicationAuth,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/bootstrap",
-  "version": "0.2.49",
+  "version": "0.2.51",
   "description": "Strata application bootstrap — HttpKernel, DI, web session helpers",
   "type": "module",
   "license": "MIT",
@@ -116,7 +116,7 @@
       "default": "./dist/entries/providers.js"
     },
     "./providers/view": {
-      "types": "./dist/bootstrap/providers/view/index.d.ts",
+      "types": "./dist/bootstrap/providers/view.d.ts",
       "import": "./dist/entries/providers/view.js",
       "default": "./dist/entries/providers/view.js"
     },
@@ -165,21 +165,22 @@
   "types": "./dist/bootstrap/public-api.d.ts",
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "CHANGELOG.md"
   ],
   "scripts": {
     "build": "bun run build:bundle && bun run build:shims && bun run build:subpaths && bun run build:types",
     "build:bundle": "bun build index.ts --outdir dist --target bun --external bun --external eta --external @getstrata/core",
     "build:types": "tsc -p tsconfig.types.json && bun ../../scripts/prune-bootstrap-dist-types.ts",
     "prepublishOnly": "bun run build",
-    "build:subpaths": "bun build entries/applicationRegistry.ts entries/buildModuleRoutes.ts entries/buildWebModuleRoutes.ts entries/cache/modelCacheTags.ts entries/config.ts entries/context.ts entries/contracts.ts entries/createWebRoutes.ts entries/createRoutes.ts entries/createSpaRoutes.ts entries/dependencies.ts entries/discoverModules.ts entries/health.ts entries/http/securedRouteModelBinding.ts entries/httpKernel.ts entries/listeners/invalidateCacheOnModelWrite.ts entries/membershipService.ts entries/metricsRoutes.ts entries/queue/defaultJobs.ts entries/providers.ts entries/providers/view.ts entries/routeRegistry.ts entries/schedule.ts entries/secretsGuard.ts entries/web/forms.ts entries/web/routing.ts entries/web/server.ts entries/web/session.ts entries/web/slug.ts --outdir dist --root . --target bun --external bun --external eta --external @getstrata/core --external @getstrata/bootstrap --external @getstrata/bootstrap/applicationRegistry --external @getstrata/bootstrap/buildModuleRoutes --external @getstrata/bootstrap/buildWebModuleRoutes --external @getstrata/bootstrap/cache/modelCacheTags --external @getstrata/bootstrap/config --external @getstrata/bootstrap/context --external @getstrata/bootstrap/contracts --external @getstrata/bootstrap/createWebRoutes --external @getstrata/bootstrap/createRoutes --external @getstrata/bootstrap/createSpaRoutes --external @getstrata/bootstrap/dependencies --external @getstrata/bootstrap/discoverModules --external @getstrata/bootstrap/health --external @getstrata/bootstrap/http/securedRouteModelBinding --external @getstrata/bootstrap/httpKernel --external @getstrata/bootstrap/listeners/invalidateCacheOnModelWrite --external @getstrata/bootstrap/membershipService --external @getstrata/bootstrap/metricsRoutes --external @getstrata/bootstrap/queue/defaultJobs --external @getstrata/bootstrap/providers --external @getstrata/bootstrap/providers/view --external @getstrata/bootstrap/routeRegistry --external @getstrata/bootstrap/schedule --external @getstrata/bootstrap/secretsGuard --external @getstrata/bootstrap/web/forms --external @getstrata/bootstrap/web/routing --external @getstrata/bootstrap/web/server --external @getstrata/bootstrap/web/session --external @getstrata/bootstrap/web/slug --external @getstrata/core/auth/accessControl --external @getstrata/core/auth/abilityChecker --external @getstrata/core/auth/authContext --external @getstrata/core/auth/guard --external @getstrata/core/auth/membershipContext --external @getstrata/core/auth/membershipMiddleware --external @getstrata/core/auth/membershipScope --external @getstrata/core/auth/membershipService --external @getstrata/core/auth/oauth/oidcProvider --external @getstrata/core/auth/oauth/providers --external @getstrata/core/auth/oauth/samlProvider --external @getstrata/core/auth/oauth/types --external @getstrata/core/auth/password --external @getstrata/core/auth/policy --external @getstrata/core/auth/scimAuthMiddleware --external @getstrata/core/auth/sessionCookie --external @getstrata/core/auth/sessionGuard --external @getstrata/core/auth/tokenHash --external @getstrata/core/audit/exportAuditLogs --external @getstrata/core/audit/siemFormatter --external @getstrata/core/admin/formatValue --external @getstrata/core/admin/registry --external @getstrata/core/admin/types --external @getstrata/core/cache/tags --external @getstrata/core/cache/createCacheStore --external @getstrata/core/cache/repository --external @getstrata/core/cache/simpleCache --external @getstrata/core/cache/simpleCacheStore --external @getstrata/core/config/envSchema --external @getstrata/core/contracts/serviceTokens --external @getstrata/core/contracts/container --external @getstrata/core/contracts/di --external @getstrata/core/crypto/fieldEncryption --external @getstrata/core/crypto/mfaSecret --external @getstrata/core/database --external @getstrata/core/database/baseRepository --external @getstrata/core/database/bindConnection --external @getstrata/core/database/boundConnection --external @getstrata/core/database/connection --external @getstrata/core/database/defaultConnection --external @getstrata/core/database/errors --external @getstrata/core/database/factory --external @getstrata/core/database/migrations --external @getstrata/core/database/migrations/types --external @getstrata/core/database/model --external @getstrata/core/database/query --external @getstrata/core/database/relationships --external @getstrata/core/database/repositoryConnection --external @getstrata/core/database/repositoryQuery --external @getstrata/core/database/seeders --external @getstrata/core/database/seeders/types --external @getstrata/core/database/schema --external @getstrata/core/database/table --external @getstrata/core/database/transaction --external @getstrata/core/database/types --external @getstrata/core/database/whereBuilder --external @getstrata/core/errors/http --external @getstrata/core/events --external @getstrata/core/facades --external @getstrata/core/http --external @getstrata/core/http/authMiddleware --external @getstrata/core/http/authorizeMiddleware --external @getstrata/core/http/bodySizeLimitMiddleware --external @getstrata/core/http/clientIp --external @getstrata/core/http/cookies --external @getstrata/core/http/contentNegotiation --external @getstrata/core/http/conditionalResponse --external @getstrata/core/http/corsMiddleware --external @getstrata/core/http/csrfMiddleware --external @getstrata/core/http/csrfProtection --external @getstrata/core/http/csrfToken --external @getstrata/core/http/etag --external @getstrata/core/http/flashSession --external @getstrata/core/http/flashMiddleware --external @getstrata/core/http/formRequest --external @getstrata/core/http/middleware --external @getstrata/core/http/metricsMiddleware --external @getstrata/core/http/loginThrottleMiddleware --external @getstrata/core/http/memoryThrottleMiddleware --external @getstrata/core/http/pagination --external @getstrata/core/http/parseFormBody --external @getstrata/core/http/parseMultipartUpload --external @getstrata/core/http/requireAbilityMiddleware --external @getstrata/core/http/requireAuthMiddleware --external @getstrata/core/http/requireGlobalAdminMiddleware --external @getstrata/core/http/requireWebAuthMiddleware --external @getstrata/core/http/resources --external @getstrata/core/http/response --external @getstrata/core/http/route --external @getstrata/core/http/routeMiddleware --external @getstrata/core/http/routeModelBinding --external @getstrata/core/http/scimThrottleMiddleware --external @getstrata/core/http/securityHeadersMiddleware --external @getstrata/core/http/securedRouteModelBinding --external @getstrata/core/http/requestMetaContext --external @getstrata/core/http/webErrorResponse --external @getstrata/core/http/webFormRequest --external @getstrata/core/http/throttleMiddleware --external @getstrata/core/http/validation --external @getstrata/core/jobs/dispatchWebhookJob --external @getstrata/core/jobs/invalidateCacheTagsJob --external @getstrata/core/lifecycle/gracefulShutdown --external @getstrata/core/logging/logger --external @getstrata/core/logging/requestLoggingMiddleware --external @getstrata/core/mail/mailer --external @getstrata/core/mail/markdownMail --external @getstrata/core/mail/markdownMailable --external @getstrata/core/media/imageTransform --external @getstrata/core/metrics/prometheus --external @getstrata/core/notifications --external @getstrata/core/openapi/generator --external @getstrata/core/openapi/registeredRoute --external @getstrata/core/openapi/validate --external @getstrata/core/pagination --external @getstrata/core/queue --external @getstrata/core/queue/createAppQueue --external @getstrata/core/queue/failedJobRepository --external @getstrata/core/queue/failedJobService --external @getstrata/core/queue/jobRegistry --external @getstrata/core/queue/jobRunner --external @getstrata/core/queue/queueMetrics --external @getstrata/core/queue/publicQueue --external @getstrata/core/queue/redisQueue --external @getstrata/core/queue/types --external @getstrata/core/runtime/applicationRegistry --external @getstrata/core/runtime/asyncContextStore --external @getstrata/core/scheduler/schedule --external @getstrata/core/scheduler/osCron --external @getstrata/core/security/oauthState --external @getstrata/core/security/publicReads --external @getstrata/core/security/safeFetch --external @getstrata/core/security/safeUrl --external @getstrata/core/security/scimTenantTokens --external @getstrata/core/security/securityEvents --external @getstrata/core/security/stripeWebhook --external @getstrata/core/security/timingSafeCompare --external @getstrata/core/security/tokenExpiry --external @getstrata/core/security/totp --external @getstrata/core/storage/storage --external @getstrata/core/tenant/tenancyConfig --external @getstrata/core/tenant/tenantContext --external @getstrata/core/tenant/tenantDatabaseScope --external @getstrata/core/tenant/databaseTenantContext --external @getstrata/core/tenant/tenantMiddleware --external @getstrata/core/terminal/runShell --external @getstrata/core/tracing/traceContext --external @getstrata/core/tracing/tracingMiddleware --external @getstrata/core/validation/rules --external @getstrata/core/view",
+    "build:subpaths": "bun build entries/applicationRegistry.ts entries/buildModuleRoutes.ts entries/buildWebModuleRoutes.ts entries/cache/modelCacheTags.ts entries/config.ts entries/context.ts entries/contracts.ts entries/createWebRoutes.ts entries/createRoutes.ts entries/createSpaRoutes.ts entries/dependencies.ts entries/discoverModules.ts entries/health.ts entries/http/securedRouteModelBinding.ts entries/httpKernel.ts entries/listeners/invalidateCacheOnModelWrite.ts entries/membershipService.ts entries/metricsRoutes.ts entries/queue/defaultJobs.ts entries/providers.ts entries/providers/view.ts entries/routeRegistry.ts entries/schedule.ts entries/secretsGuard.ts entries/web/forms.ts entries/web/routing.ts entries/web/server.ts entries/web/session.ts entries/web/slug.ts --outdir dist --root . --target bun --external bun --external eta --external @getstrata/core --external @getstrata/bootstrap --external @getstrata/bootstrap/applicationRegistry --external @getstrata/bootstrap/buildModuleRoutes --external @getstrata/bootstrap/buildWebModuleRoutes --external @getstrata/bootstrap/cache/modelCacheTags --external @getstrata/bootstrap/config --external @getstrata/bootstrap/context --external @getstrata/bootstrap/contracts --external @getstrata/bootstrap/createWebRoutes --external @getstrata/bootstrap/createRoutes --external @getstrata/bootstrap/createSpaRoutes --external @getstrata/bootstrap/dependencies --external @getstrata/bootstrap/discoverModules --external @getstrata/bootstrap/health --external @getstrata/bootstrap/http/securedRouteModelBinding --external @getstrata/bootstrap/httpKernel --external @getstrata/bootstrap/listeners/invalidateCacheOnModelWrite --external @getstrata/bootstrap/membershipService --external @getstrata/bootstrap/metricsRoutes --external @getstrata/bootstrap/queue/defaultJobs --external @getstrata/bootstrap/providers --external @getstrata/bootstrap/providers/view --external @getstrata/bootstrap/routeRegistry --external @getstrata/bootstrap/schedule --external @getstrata/bootstrap/secretsGuard --external @getstrata/bootstrap/web/forms --external @getstrata/bootstrap/web/routing --external @getstrata/bootstrap/web/server --external @getstrata/bootstrap/web/session --external @getstrata/bootstrap/web/slug --external @getstrata/core/auth/accessControl --external @getstrata/core/auth/abilityChecker --external @getstrata/core/auth/authContext --external @getstrata/core/auth/guard --external @getstrata/core/auth/membershipContext --external @getstrata/core/auth/membershipMiddleware --external @getstrata/core/auth/membershipScope --external @getstrata/core/auth/membershipService --external @getstrata/core/auth/oauth/oidcProvider --external @getstrata/core/auth/oauth/providers --external @getstrata/core/auth/oauth/samlProvider --external @getstrata/core/auth/oauth/types --external @getstrata/core/auth/password --external @getstrata/core/auth/policy --external @getstrata/core/auth/scimAuthMiddleware --external @getstrata/core/auth/sessionCookie --external @getstrata/core/auth/sessionGuard --external @getstrata/core/auth/tokenHash --external @getstrata/core/audit/exportAuditLogs --external @getstrata/core/audit/siemFormatter --external @getstrata/core/admin/formatValue --external @getstrata/core/admin/registry --external @getstrata/core/admin/types --external @getstrata/core/cache/tags --external @getstrata/core/cache/createCacheStore --external @getstrata/core/cache/repository --external @getstrata/core/cache/simpleCache --external @getstrata/core/cache/simpleCacheStore --external @getstrata/core/config/envSchema --external @getstrata/core/contracts/serviceTokens --external @getstrata/core/contracts/container --external @getstrata/core/contracts/di --external @getstrata/core/crypto/fieldEncryption --external @getstrata/core/crypto/mfaSecret --external @getstrata/core/database --external @getstrata/core/database/baseRepository --external @getstrata/core/database/bindConnection --external @getstrata/core/database/boundConnection --external @getstrata/core/database/bunSql --external @getstrata/core/database/connection --external @getstrata/core/database/defaultConnection --external @getstrata/core/database/errors --external @getstrata/core/database/factory --external @getstrata/core/database/migrations --external @getstrata/core/database/migrations/types --external @getstrata/core/database/model --external @getstrata/core/database/query --external @getstrata/core/database/relationships --external @getstrata/core/database/repositoryConnection --external @getstrata/core/database/repositoryQuery --external @getstrata/core/database/seeders --external @getstrata/core/database/seeders/types --external @getstrata/core/database/schema --external @getstrata/core/database/table --external @getstrata/core/database/transaction --external @getstrata/core/database/types --external @getstrata/core/database/whereBuilder --external @getstrata/core/errors/http --external @getstrata/core/events --external @getstrata/core/facades --external @getstrata/core/http --external @getstrata/core/http/authMiddleware --external @getstrata/core/http/authorizeMiddleware --external @getstrata/core/http/bodySizeLimitMiddleware --external @getstrata/core/http/clientIp --external @getstrata/core/http/cookies --external @getstrata/core/http/contentNegotiation --external @getstrata/core/http/conditionalResponse --external @getstrata/core/http/corsMiddleware --external @getstrata/core/http/csrfMiddleware --external @getstrata/core/http/csrfProtection --external @getstrata/core/http/csrfToken --external @getstrata/core/http/etag --external @getstrata/core/http/flashSession --external @getstrata/core/http/flashMiddleware --external @getstrata/core/http/formRequest --external @getstrata/core/http/middleware --external @getstrata/core/http/metricsMiddleware --external @getstrata/core/http/loginThrottleMiddleware --external @getstrata/core/http/memoryThrottleMiddleware --external @getstrata/core/http/pagination --external @getstrata/core/http/parseFormBody --external @getstrata/core/http/parseMultipartUpload --external @getstrata/core/http/requireAbilityMiddleware --external @getstrata/core/http/requireAuthMiddleware --external @getstrata/core/http/requireGlobalAdminMiddleware --external @getstrata/core/http/requireWebAuthMiddleware --external @getstrata/core/http/resources --external @getstrata/core/http/response --external @getstrata/core/http/route --external @getstrata/core/http/routeMiddleware --external @getstrata/core/http/routeModelBinding --external @getstrata/core/http/scimThrottleMiddleware --external @getstrata/core/http/securityHeadersMiddleware --external @getstrata/core/http/securedRouteModelBinding --external @getstrata/core/http/requestMetaContext --external @getstrata/core/http/webErrorResponse --external @getstrata/core/http/webFormRequest --external @getstrata/core/http/throttleMiddleware --external @getstrata/core/http/validation --external @getstrata/core/jobs/dispatchWebhookJob --external @getstrata/core/jobs/invalidateCacheTagsJob --external @getstrata/core/lifecycle/gracefulShutdown --external @getstrata/core/logging/logger --external @getstrata/core/logging/requestLoggingMiddleware --external @getstrata/core/mail/mailer --external @getstrata/core/mail/markdownMail --external @getstrata/core/mail/markdownMailable --external @getstrata/core/media/imageTransform --external @getstrata/core/metrics/prometheus --external @getstrata/core/notifications --external @getstrata/core/openapi/generator --external @getstrata/core/openapi/registeredRoute --external @getstrata/core/openapi/validate --external @getstrata/core/pagination --external @getstrata/core/queue --external @getstrata/core/queue/createAppQueue --external @getstrata/core/queue/failedJobRepository --external @getstrata/core/queue/failedJobService --external @getstrata/core/queue/jobRegistry --external @getstrata/core/queue/jobRunner --external @getstrata/core/queue/queueMetrics --external @getstrata/core/queue/publicQueue --external @getstrata/core/queue/redisQueue --external @getstrata/core/queue/types --external @getstrata/core/runtime/applicationRegistry --external @getstrata/core/runtime/asyncContextStore --external @getstrata/core/scheduler/schedule --external @getstrata/core/scheduler/osCron --external @getstrata/core/security/oauthState --external @getstrata/core/security/publicReads --external @getstrata/core/security/safeFetch --external @getstrata/core/security/safeUrl --external @getstrata/core/security/scimTenantTokens --external @getstrata/core/security/securityEvents --external @getstrata/core/security/stripeWebhook --external @getstrata/core/security/timingSafeCompare --external @getstrata/core/security/tokenExpiry --external @getstrata/core/security/totp --external @getstrata/core/storage/storage --external @getstrata/core/tenant/tenancyConfig --external @getstrata/core/tenant/tenantContext --external @getstrata/core/tenant/tenantDatabaseScope --external @getstrata/core/tenant/databaseTenantContext --external @getstrata/core/tenant/tenantMiddleware --external @getstrata/core/terminal/runShell --external @getstrata/core/tracing/traceContext --external @getstrata/core/tracing/tracingMiddleware --external @getstrata/core/validation/rules --external @getstrata/core/view",
     "build:shims": "true"
   },
   "publishConfig": {
     "access": "public"
   },
   "peerDependencies": {
-    "@getstrata/core": "^0.5.58",
+    "@getstrata/core": "^0.5.60",
     "typescript": "^5.9.0"
   }
 }