@getstrata/bootstrap 0.2.5 → 0.2.6

package/README.md

@@ -1,6 +1,6 @@
 # @getstrata/bootstrap
 
-Application bootstrap for Strata sibling apps — HttpKernel, service container, and web utilities.
+Application bootstrap for Strata sibling apps: HttpKernel, service container, and web utilities.
 
 ## Install
 
@@ -20,6 +20,8 @@ import {
 } from "@getstrata/bootstrap";
 ```
 
+`CookieSessionStore` reads optional `is_admin` from the user row for global admin routing via `wrapWebGlobalAdmin`.
+
 ## HttpKernel (API / module apps)
 
 ```typescript

package/dist/bootstrap/httpKernel.d.ts

@@ -1,5 +1,4 @@
-import type { Policy } from "../core/auth/policy";
-import { type Middleware, type RouteHandler } from "../core/http/middleware";
+import { type Middleware, type Policy, type RouteHandler } from "@getstrata/core";
 import type { AppDependencies } from "./contracts";
 type MiddlewareGroupName = "api" | "authenticated" | "web";
 declare class HttpKernel {

package/dist/bootstrap/middleware.d.ts

@@ -1,4 +1,4 @@
-import { type Middleware } from "../core/http/middleware";
+import { type Middleware } from "@getstrata/core";
 import type { AppDependencies } from "./contracts";
 declare function createDefaultMiddleware(dependencies: AppDependencies): Middleware[];
 export { createDefaultMiddleware };

package/dist/core/admin/registry.d.ts

@@ -1,6 +1,7 @@
 import type { AdminResource, AdminResourceDefinition } from "./types.ts";
 declare class AdminResourceRegistry {
     private readonly resources;
+    constructor();
     register<TEntity extends object>(resource: AdminResource<TEntity>): void;
     get(name: string): AdminResource<object> | undefined;
     list(): AdminResourceDefinition[];

package/dist/core/storage/storage.d.ts

@@ -12,8 +12,9 @@ interface S3StorageConfig {
     endpoint?: string;
 }
 declare class LocalStorageDriver implements StorageDriver {
-    private readonly rootDirectory;
-    constructor(rootDirectory: string);
+    private readonly rootDirectory?;
+    constructor(rootDirectory?: string | undefined);
+    private resolveRootDirectory;
     private resolvePath;
     put(path: string, contents: string | Uint8Array): Promise<string>;
     get(path: string): Promise<Uint8Array | null>;
@@ -37,5 +38,7 @@ declare function resolveS3Config(): S3StorageConfig;
 declare function createS3Client(config?: S3StorageConfig): S3Client;
 declare function createStorageDriver(): StorageDriver;
 declare function storage(): StorageManager;
+/** Test hook: drop the process-wide storage singleton (e.g. after changing STORAGE_PATH). */
+declare function resetDefaultStorage(): void;
 export type { S3StorageConfig, StorageDriver };
-export { createS3Client, createStorageDriver, LocalStorageDriver, resolveS3Config, S3StorageDriver, StorageManager, storage, };
+export { createS3Client, createStorageDriver, LocalStorageDriver, resetDefaultStorage, resolveS3Config, S3StorageDriver, StorageManager, storage, };

package/dist/framework/public-api.d.ts

@@ -10,6 +10,7 @@ export { AdminResourceRegistry, formatAdminValue, } from "../core/admin/index.ts
 export type { AbilityChecker } from "../core/auth/abilityChecker.ts";
 export type { AuthUser } from "../core/auth/authContext.ts";
 export { currentAuthUser, runWithAuthUser } from "../core/auth/authContext.ts";
+export { createMembershipMiddleware } from "../core/auth/membershipMiddleware.ts";
 export { Policy, PolicyGate } from "../core/auth/policy.ts";
 export { default as CacheRepository } from "../core/cache/repository.ts";
 export { CACHE_TAGS } from "../core/cache/tags.ts";
@@ -40,16 +41,20 @@ export { EventBus } from "../core/events/eventBus.ts";
 export { auth, cache, config, events, log, mail, policyGate, queue, storage, } from "../core/facades/index.ts";
 export { createBodySizeLimitMiddleware } from "../core/http/bodySizeLimitMiddleware.ts";
 export { readBunRequestCookie, readRequestCookie } from "../core/http/cookies.ts";
+export { createCorsMiddleware } from "../core/http/corsMiddleware.ts";
 export { createCsrfMiddleware } from "../core/http/csrfMiddleware.ts";
 export { createCsrfProtection } from "../core/http/csrfProtection.ts";
 export { createCsrfTokenCookie, readSubmittedCsrfToken, readSubmittedCsrfTokenFromBody, resolveCsrfToken, resolveCsrfTokenForRequest, verifyCsrfToken, } from "../core/http/csrfToken.ts";
 export { assertIfMatch, etagFromResource, isEtagEnabled, } from "../core/http/etag.ts";
+export { createFlashMiddleware } from "../core/http/flashMiddleware.ts";
 export { FormRequest } from "../core/http/formRequest.ts";
-export { applyMiddlewareToRoutes, composeMiddleware, createAuthMiddleware, createAuthorizeMiddleware, createdResponse, createRequireAuthMiddleware, jsonResponse, noContentResponse, paginatedResponse, parsePaginationQuery, securedBindRouteModel, securedBindRouteModelByKey, withErrorHandling, withMiddleware, } from "../core/http/index.ts";
+export { applyMiddlewareToRoutes, composeMiddleware, createAuthMiddleware, createAuthorizeMiddleware, createdResponse, createRequireAuthMiddleware, jsonResponse, noContentResponse, paginatedResponse, parsePaginationQuery, requestIdMiddleware, securedBindRouteModel, securedBindRouteModelByKey, withErrorHandling, withMiddleware, } from "../core/http/index.ts";
 export { createLoginThrottleMiddleware } from "../core/http/loginThrottleMiddleware.ts";
 export { createMemoryThrottleMiddleware } from "../core/http/memoryThrottleMiddleware.ts";
 export { createMetricsMiddleware, normalizeMetricPath } from "../core/http/metricsMiddleware.ts";
 export type { Middleware, RouteHandler } from "../core/http/middleware.ts";
+export { createRequireAbilityMiddleware } from "../core/http/requireAbilityMiddleware.ts";
+export { createRequireGlobalAdminMiddleware } from "../core/http/requireGlobalAdminMiddleware.ts";
 export { createRequireWebAuthMiddleware } from "../core/http/requireWebAuthMiddleware.ts";
 export { serializeDate, toPaginatedResourceCollection, toResourceCollection, } from "../core/http/resources.ts";
 export type { RouteRequest } from "../core/http/route.ts";
@@ -57,6 +62,7 @@ export { createSecurityHeadersMiddleware } from "../core/http/securityHeadersMid
 export { createThrottleMiddleware } from "../core/http/throttleMiddleware.ts";
 export { WebFormRequest } from "../core/http/webFormRequest.ts";
 export { installGracefulShutdownSignals, registerShutdownHandler, runGracefulShutdown, } from "../core/lifecycle/gracefulShutdown.ts";
+export { createRequestLoggingMiddleware } from "../core/logging/requestLoggingMiddleware.ts";
 export type { MailDriver, MailMessage } from "../core/mail/mailer.ts";
 export { buildSmtpPayload, LogMailDriver, Mailer, mailer, } from "../core/mail/mailer.ts";
 export type { MarkdownMailLayoutOptions, RenderedMarkdownMail } from "../core/mail/markdownMail.ts";
@@ -73,8 +79,11 @@ export { AsyncQueue, createQueue, Job, SyncQueue } from "../core/queue/index.ts"
 export { createFailedJobService, createProductionQueue, createQueueWorker, createTrackedJob, FailedJobRepository, FailedJobService, jobRegistry, QueueWorker, RedisQueue, ResilientQueue, runQueueJob, } from "../core/queue/publicQueue.ts";
 export type { ScheduledTask } from "../core/scheduler/schedule.ts";
 export { appSchedule, runDueScheduledTasks, Schedule } from "../core/scheduler/schedule.ts";
+export { isPublicReadsEnabled } from "../core/security/publicReads.ts";
 export type { StorageDriver } from "../core/storage/storage.ts";
-export { LocalStorageDriver, StorageManager } from "../core/storage/storage.ts";
+export { LocalStorageDriver, resetDefaultStorage, StorageManager, } from "../core/storage/storage.ts";
+export { createTenantMiddleware } from "../core/tenant/tenantMiddleware.ts";
+export { createTracingMiddleware } from "../core/tracing/tracingMiddleware.ts";
 export type { ValidationRule, ValidationSchema } from "../core/validation/rules.ts";
 export { emailRule, maxLength, minLength, required, stringRule, validateObject, } from "../core/validation/rules.ts";
 export { DEFAULT_VIEWS_DIRECTORY, EtaViewEngine, htmlResponse, isHtmxRequest, resolveWebLayoutData, } from "../core/view/index.ts";

package/dist/index.js

@@ -81,9 +81,6 @@ var databaseConfig = {
 // ../../src/core/database/connectionContext.ts
 import { AsyncLocalStorage } from "async_hooks";
 var activeConnection = new AsyncLocalStorage;
-function runWithDatabaseConnection(connection, callback) {
-  return activeConnection.run(connection, callback);
-}
 function getActiveDatabaseConnection(fallback) {
   return activeConnection.getStore() ?? fallback;
 }
@@ -207,12 +204,6 @@ class UnauthorizedError extends HttpError {
   }
 }
 
-class PayloadTooLargeError extends HttpError {
-  constructor(message = "Payload Too Large", details) {
-    super(413, message, details);
-  }
-}
-
 // ../../src/core/security/safeUrl.ts
 var BLOCKED_HOSTNAMES = new Set([
   "localhost",
@@ -836,9 +827,6 @@ var tokenServiceToken = CORE_TOKEN_SERVICE_TOKEN;
 // ../../src/core/auth/authContext.ts
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 var authContext = new AsyncLocalStorage2;
-function runWithAuthUser(user, callback) {
-  return authContext.run(user, callback);
-}
 function currentAuthUser() {
   return authContext.getStore() ?? null;
 }
@@ -3729,8 +3717,14 @@ function registerInvalidateCacheOnModelWriteListeners(bus = eventBus) {
         if (tags.length === 0) {
           return;
         }
-        const cache = resolveApplicationCache();
-        const queue = resolveApplicationQueue();
+        let cache;
+        let queue;
+        try {
+          cache = resolveApplicationCache();
+          queue = resolveApplicationQueue();
+        } catch {
+          return;
+        }
         const job = createTrackedJob("cache.invalidate-tags", new invalidateCacheTagsJob_default(cache));
         await queue.dispatch(job, { tags });
       });
@@ -3840,9 +3834,6 @@ function isViewsEnabled() {
 // ../../src/core/http/requestMetaContext.ts
 import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
 var requestMetaContext = new AsyncLocalStorage3;
-function runWithRequestMeta(meta, callback) {
-  return requestMetaContext.run(meta, callback);
-}
 function currentRequestMeta() {
   return requestMetaContext.getStore() ?? {
     ipAddress: null,
@@ -3892,9 +3883,6 @@ function htmlResponse(html, init = {}) {
     }
   });
 }
-// ../../src/core/http/csrfToken.ts
-import { timingSafeEqual as timingSafeEqual2 } from "crypto";
-
 // ../../src/core/http/cookies.ts
 function readRequestCookie(request, name) {
   const cookies = request.cookies;
@@ -3929,14 +3917,6 @@ function resolveCsrfSecret() {
 function csrfVerifyOptions() {
   return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
 }
-function tokensMatch(left, right) {
-  const leftBuffer = Buffer.from(left);
-  const rightBuffer = Buffer.from(right);
-  if (leftBuffer.length !== rightBuffer.length) {
-    return false;
-  }
-  return timingSafeEqual2(leftBuffer, rightBuffer);
-}
 function createCsrfTokenCookie() {
   const token = Bun.CSRF.generate(resolveCsrfSecret(), { expiresIn: CSRF_TTL_MS });
   return {
@@ -3951,45 +3931,6 @@ function resolveCsrfToken(request) {
   }
   return createCsrfTokenCookie();
 }
-function readSubmittedCsrfToken(request) {
-  const headerToken = request.headers.get("x-csrf-token")?.trim();
-  if (headerToken) {
-    return headerToken;
-  }
-  return null;
-}
-async function readSubmittedCsrfTokenFromBody(request) {
-  const headerToken = readSubmittedCsrfToken(request);
-  if (headerToken) {
-    return headerToken;
-  }
-  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
-  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-    const formData = await request.clone().formData();
-    const field = formData.get("_token");
-    if (typeof field === "string" && field.trim().length > 0) {
-      return field.trim();
-    }
-    const legacyField = formData.get("_csrf");
-    if (typeof legacyField === "string" && legacyField.trim().length > 0) {
-      return legacyField.trim();
-    }
-  }
-  return null;
-}
-function verifyCsrfToken(request, submittedToken) {
-  if (!submittedToken) {
-    return false;
-  }
-  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
-  if (!cookieValue) {
-    return false;
-  }
-  if (!tokensMatch(submittedToken, cookieValue)) {
-    return false;
-  }
-  return Bun.CSRF.verify(submittedToken, csrfVerifyOptions());
-}
 function resolveCsrfTokenForRequest(request) {
   const metaToken = currentRequestMeta().csrfToken;
   if (metaToken) {
@@ -3999,7 +3940,7 @@ function resolveCsrfTokenForRequest(request) {
 }
 
 // ../../src/core/http/flashSession.ts
-import { createHmac as createHmac3, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import { createHmac as createHmac3, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var FLASH_COOKIE = "workhub_flash";
 var FLASH_TTL_MS = 60 * 1000;
 function resolveFlashSecret() {
@@ -4046,7 +3987,7 @@ function parseFlashCookie(cookieValue) {
   if (expectedBuffer.length !== actualBuffer.length) {
     return null;
   }
-  if (!timingSafeEqual3(expectedBuffer, actualBuffer)) {
+  if (!timingSafeEqual2(expectedBuffer, actualBuffer)) {
     return null;
   }
   try {
@@ -4062,9 +4003,6 @@ function parseFlashCookie(cookieValue) {
     return null;
   }
 }
-function clearFlashCookie() {
-  return `${FLASH_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
-}
 function pullFlash(request) {
   const cookieValue = readFlashCookie(request);
   if (!cookieValue) {
@@ -4072,15 +4010,6 @@ function pullFlash(request) {
   }
   return parseFlashCookie(cookieValue);
 }
-function withFlashClear(response) {
-  const headers = new Headers(response.headers);
-  headers.append("set-cookie", clearFlashCookie());
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
 
 // ../../src/core/view/webLayoutData.ts
 async function resolveWebLayoutData(container, request) {
@@ -4272,17 +4201,6 @@ function composeMiddleware(...middleware) {
     };
   };
 }
-async function requestIdMiddleware(request, next) {
-  const requestId = request.headers.get("x-request-id") ?? crypto.randomUUID();
-  const response = await next();
-  const headers = new Headers(response.headers);
-  headers.set("x-request-id", requestId);
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
 function wrapRouteHandler(handler, middleware) {
   if (isMethodRouteMap(handler)) {
     const wrapped = {};
@@ -4304,6 +4222,32 @@ function applyMiddlewareToRoutes(routes, middleware) {
   return wrapped;
 }
 
+// ../../src/bootstrap/httpKernel.ts
+import {
+  createAuthMiddleware,
+  createAuthorizeMiddleware,
+  createBodySizeLimitMiddleware,
+  createCorsMiddleware,
+  createCsrfMiddleware,
+  createFlashMiddleware,
+  createLoginThrottleMiddleware,
+  createMembershipMiddleware,
+  createMemoryThrottleMiddleware,
+  createMetricsMiddleware,
+  createRequestLoggingMiddleware,
+  createRequireAbilityMiddleware,
+  createRequireAuthMiddleware,
+  createRequireGlobalAdminMiddleware,
+  createRequireWebAuthMiddleware,
+  createSecurityHeadersMiddleware,
+  createTenantMiddleware,
+  createThrottleMiddleware,
+  createTracingMiddleware,
+  isPublicReadsEnabled,
+  requestIdMiddleware,
+  withMiddleware
+} from "@getstrata/core";
+
 // ../../src/config/rateLimit.ts
 var LOCAL_LOGIN_RATE_LIMIT = {
   maxAttempts: 100,
@@ -4338,849 +4282,6 @@ function resolveRegisterRateLimit() {
   };
 }
 
-// ../../src/core/auth/membershipContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
-
-// ../../src/modules/organization/memberRepository.ts
-class OrganizationMemberRepository {
-  constructor() {}
-  async findMembership(userId, organizationId) {
-    const rows = await connection_default`
-      SELECT id, organization_id, user_id, role, created_at
-      FROM organization_member
-      WHERE user_id = ${userId} AND organization_id = ${organizationId}
-      LIMIT 1
-    `;
-    return rows[0] ?? null;
-  }
-  async listForUser(userId) {
-    return await connection_default`
-      SELECT id, organization_id, user_id, role, created_at
-      FROM organization_member
-      WHERE user_id = ${userId}
-      ORDER BY organization_id
-    `;
-  }
-  async listForOrganization(organizationId) {
-    return await connection_default`
-      SELECT id, organization_id, user_id, role, created_at
-      FROM organization_member
-      WHERE organization_id = ${organizationId}
-      ORDER BY id
-    `;
-  }
-  async addMember(input) {
-    const rows = await connection_default`
-      INSERT INTO organization_member (organization_id, user_id, role)
-      VALUES (${input.organizationId}, ${input.userId}, ${input.role ?? "member"})
-      RETURNING id, organization_id, user_id, role, created_at
-    `;
-    const row = rows[0];
-    if (!row) {
-      throw new Error("Organization member insert did not return a row.");
-    }
-    return row;
-  }
-  async removeMember(organizationId, userId) {
-    const rows = await connection_default`
-      DELETE FROM organization_member
-      WHERE organization_id = ${organizationId} AND user_id = ${userId}
-      RETURNING id
-    `;
-    return rows.length > 0;
-  }
-}
-var memberRepository_default = OrganizationMemberRepository;
-
-// ../../src/core/auth/accessControl.ts
-function isGlobalAdmin(user) {
-  return user?.role === "admin";
-}
-function resolveUserId(user) {
-  const userId = typeof user.id === "number" ? user.id : Number(user.id);
-  if (!Number.isInteger(userId) || userId <= 0) {
-    throw new ForbiddenError("Invalid authenticated user.");
-  }
-  return userId;
-}
-
-// ../../src/core/auth/membershipContext.ts
-var membershipContext = new AsyncLocalStorage4;
-var membershipRepository = new memberRepository_default;
-async function runWithMembershipContext(callback) {
-  const user = currentAuthUser();
-  if (!user || isGlobalAdmin(user)) {
-    return await callback();
-  }
-  const memberships = await membershipRepository.listForUser(resolveUserId(user));
-  const context = {
-    organizationIds: memberships.map((membership) => membership.organization_id),
-    rolesByOrganizationId: new Map(memberships.map((membership) => [membership.organization_id, membership.role]))
-  };
-  return await membershipContext.run(context, callback);
-}
-
-// ../../src/core/auth/membershipContextMiddleware.ts
-function createMembershipContextMiddleware() {
-  return async (_request, next) => {
-    return await runWithMembershipContext(async () => await next());
-  };
-}
-
-// ../../src/core/auth/membershipMiddleware.ts
-function createMembershipMiddleware() {
-  return createMembershipContextMiddleware();
-}
-
-// ../../src/core/http/authMiddleware.ts
-function createAuthMiddleware(auth) {
-  return async (request, next) => {
-    const user = await auth.resolve(request);
-    return await runWithAuthUser(user, async () => {
-      const response = await next();
-      if (user) {
-        const headers = new Headers(response.headers);
-        headers.set("x-authenticated-user-id", String(user.id));
-        return new Response(response.body, {
-          status: response.status,
-          statusText: response.statusText,
-          headers
-        });
-      }
-      return response;
-    });
-  };
-}
-
-// ../../src/core/http/authorizeMiddleware.ts
-function createAuthorizeMiddleware(gate, auth, resource, action) {
-  return async (request, next) => {
-    const user = await auth.resolve(request);
-    if (!gate.allows(resource, action, user)) {
-      const error = new ForbiddenError;
-      return Response.json({ error: error.message }, { status: error.status });
-    }
-    return await next();
-  };
-}
-
-// ../../src/core/http/bodySizeLimitMiddleware.ts
-var DEFAULT_MAX_BODY_BYTES = 1048576;
-function resolveMaxBodyBytes() {
-  const raw = process.env.MAX_REQUEST_BODY_BYTES?.trim();
-  if (!raw) {
-    return DEFAULT_MAX_BODY_BYTES;
-  }
-  const parsed = Number.parseInt(raw, 10);
-  if (!Number.isInteger(parsed) || parsed <= 0) {
-    return DEFAULT_MAX_BODY_BYTES;
-  }
-  return parsed;
-}
-function createBodySizeLimitMiddleware(maxBytes = resolveMaxBodyBytes()) {
-  return async (request, next) => {
-    const contentLength = request.headers.get("content-length");
-    if (contentLength) {
-      const bytes = Number.parseInt(contentLength, 10);
-      if (Number.isInteger(bytes) && bytes > maxBytes) {
-        const error = new PayloadTooLargeError(`Request body exceeds the ${maxBytes} byte limit.`);
-        return Response.json({ error: error.message }, { status: error.status });
-      }
-    }
-    return await next();
-  };
-}
-
-// ../../src/config/cors.ts
-var corsConfig = {
-  allowedOrigins: (process.env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim()).filter(Boolean),
-  allowedMethods: ["GET", "POST", "PATCH", "PUT", "DELETE", "OPTIONS"],
-  allowedHeaders: [
-    "Authorization",
-    "Content-Type",
-    "X-Request-Id",
-    "X-Tenant-Id",
-    "X-Authenticated-User-Id",
-    "X-Authenticated-User-Role",
-    "If-Match",
-    "If-None-Match"
-  ],
-  maxAgeSeconds: 86400
-};
-
-// ../../src/core/http/corsMiddleware.ts
-function createCorsMiddleware() {
-  return async (request, next) => {
-    if (request.method === "OPTIONS") {
-      return new Response(null, {
-        status: 204,
-        headers: buildCorsHeaders(request)
-      });
-    }
-    const response = await next();
-    const headers = new Headers(response.headers);
-    for (const [key, value] of buildCorsHeaders(request)) {
-      headers.set(key, value);
-    }
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers
-    });
-  };
-}
-function buildCorsHeaders(request) {
-  const headers = new Headers;
-  const origin = request.headers.get("origin");
-  const allowedOrigins = corsConfig.allowedOrigins;
-  const allowOrigin = allowedOrigins.includes("*") || origin && allowedOrigins.includes(origin) ? origin ?? "*" : allowedOrigins[0] ?? "*";
-  headers.set("Access-Control-Allow-Origin", allowOrigin);
-  headers.set("Access-Control-Allow-Methods", corsConfig.allowedMethods.join(", "));
-  headers.set("Access-Control-Allow-Headers", corsConfig.allowedHeaders.join(", "));
-  headers.set("Access-Control-Max-Age", String(corsConfig.maxAgeSeconds));
-  headers.set("Vary", "Origin");
-  return headers;
-}
-
-// ../../src/core/http/csrfMiddleware.ts
-var MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
-function appendSetCookie(response, cookie) {
-  const headers = new Headers(response.headers);
-  headers.append("set-cookie", cookie);
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
-function createCsrfMiddleware() {
-  return async (request, next) => {
-    const method = request.method.toUpperCase();
-    if (!MUTATING_METHODS.has(method)) {
-      const csrf = resolveCsrfToken(request);
-      const meta = currentRequestMeta();
-      meta.csrfToken = csrf.token;
-      const response = await next();
-      if (!csrf.cookie) {
-        return response;
-      }
-      return appendSetCookie(response, csrf.cookie);
-    }
-    const submitted = await readSubmittedCsrfTokenFromBody(request);
-    if (!verifyCsrfToken(request, submitted)) {
-      throw new ForbiddenError("Invalid or missing CSRF token.");
-    }
-    return await next();
-  };
-}
-
-// ../../src/core/http/flashMiddleware.ts
-function createFlashMiddleware() {
-  return async (request, next) => {
-    const flash = pullFlash(request);
-    const meta = currentRequestMeta();
-    return await runWithRequestMeta({ ...meta, request, flash }, async () => {
-      const response = await next();
-      if (flash) {
-        return withFlashClear(response);
-      }
-      return response;
-    });
-  };
-}
-
-// ../../src/core/http/loginThrottleMiddleware.ts
-var {RedisClient: RedisClient3 } = globalThis.Bun;
-function resolveLoginIdentity(request) {
-  return request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
-}
-async function resolveLoginEmail(request) {
-  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
-  try {
-    if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-      const formData = await request.clone().formData();
-      const email = formData.get("email");
-      return typeof email === "string" ? email.trim().toLowerCase() : "unknown";
-    }
-    const payload = await request.clone().json();
-    return typeof payload.email === "string" ? payload.email.trim().toLowerCase() : "unknown";
-  } catch {
-    return "unknown";
-  }
-}
-function createLoginThrottleMiddleware(options) {
-  const client = new RedisClient3(options.redisUrl);
-  const prefix = options.keyPrefix ?? "workhub:login-throttle:";
-  return async (request, next) => {
-    const identity = resolveLoginIdentity(request);
-    const email = await resolveLoginEmail(request);
-    const throttleKey = `${prefix}${identity}:${email}`;
-    const attempts = Number(await client.incr(throttleKey));
-    if (attempts === 1) {
-      await client.expire(throttleKey, options.decaySeconds);
-    }
-    if (attempts > options.maxAttempts) {
-      return Response.json({ error: "Too many login attempts. Try again later." }, {
-        status: 429,
-        headers: {
-          "retry-after": String(options.decaySeconds)
-        }
-      });
-    }
-    return await next();
-  };
-}
-
-// ../../src/core/http/memoryThrottleMiddleware.ts
-var buckets = new Map;
-function createMemoryThrottleMiddleware(options) {
-  const prefix = options.keyPrefix ?? "workhub:memory-throttle:";
-  return async (request, next) => {
-    const path = new URL(request.url).pathname;
-    const identity = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? request.headers.get("authorization")?.slice(0, 32) ?? "unknown";
-    const key = `${prefix}${identity}:${path}`;
-    const now = Date.now();
-    const existing = buckets.get(key);
-    if (!existing || existing.resetAt <= now) {
-      buckets.set(key, { count: 1, resetAt: now + options.decaySeconds * 1000 });
-      return await next();
-    }
-    existing.count += 1;
-    if (existing.count > options.maxAttempts) {
-      return Response.json({ error: "Too many requests." }, {
-        status: 429,
-        headers: {
-          "retry-after": String(options.decaySeconds)
-        }
-      });
-    }
-    return await next();
-  };
-}
-
-// ../../src/core/metrics/prometheus.ts
-class PrometheusRegistry {
-  httpRequestsTotal = new Map;
-  httpRequestDurationMs = new Map;
-  incrementHttpRequest(labels) {
-    const key = this.metricKey(labels);
-    this.httpRequestsTotal.set(key, (this.httpRequestsTotal.get(key) ?? 0) + 1);
-  }
-  observeHttpDuration(labels, durationMs) {
-    const key = this.metricKey(labels);
-    const samples = this.httpRequestDurationMs.get(key) ?? [];
-    samples.push(durationMs);
-    this.httpRequestDurationMs.set(key, samples);
-  }
-  renderMetrics() {
-    const lines = [
-      "# HELP http_requests_total Total HTTP requests processed.",
-      "# TYPE http_requests_total counter"
-    ];
-    for (const [key, value] of this.httpRequestsTotal) {
-      lines.push(`http_requests_total{${key}} ${value}`);
-    }
-    lines.push("# HELP http_request_duration_ms_sum Sum of HTTP request durations in milliseconds.", "# TYPE http_request_duration_ms_sum counter");
-    for (const [key, samples] of this.httpRequestDurationMs) {
-      const sum = samples.reduce((total, sample) => total + sample, 0);
-      lines.push(`http_request_duration_ms_sum{${key}} ${sum}`);
-    }
-    return `${lines.join(`
-`)}
-`;
-  }
-  resetForTests() {
-    this.httpRequestsTotal.clear();
-    this.httpRequestDurationMs.clear();
-  }
-  getHttpRequestSummary() {
-    const byStatus = {};
-    const pathCounts = new Map;
-    let totalRequests = 0;
-    for (const [key, count] of this.httpRequestsTotal) {
-      totalRequests += count;
-      const method = key.match(/method="([^"]+)"/)?.[1] ?? "GET";
-      const path = key.match(/path="([^"]+)"/)?.[1] ?? "/";
-      const status = key.match(/status="([^"]+)"/)?.[1] ?? "200";
-      byStatus[status] = (byStatus[status] ?? 0) + count;
-      const pathKey = `${method} ${path}`;
-      const existing = pathCounts.get(pathKey);
-      if (existing) {
-        existing.count += count;
-      } else {
-        pathCounts.set(pathKey, { method, path, count });
-      }
-    }
-    const topPaths = Array.from(pathCounts.values()).sort((left, right) => right.count - left.count).slice(0, 10);
-    return {
-      totalRequests,
-      byStatus,
-      topPaths
-    };
-  }
-  metricKey(labels) {
-    return `method="${labels.method}",path="${labels.path}",status="${labels.status}"`;
-  }
-}
-var prometheusRegistry = new PrometheusRegistry;
-
-// ../../src/core/http/metricsMiddleware.ts
-function normalizeMetricPath(pathname) {
-  return pathname.replace(/\/\d+/g, "/:id").replace(/\/[0-9a-f-]{36}/gi, "/:id");
-}
-function createMetricsMiddleware() {
-  return async (request, next) => {
-    const startedAt = performance.now();
-    const response = await next();
-    const durationMs = performance.now() - startedAt;
-    const path = normalizeMetricPath(new URL(request.url).pathname);
-    const labels = {
-      method: request.method,
-      path,
-      status: String(response.status)
-    };
-    prometheusRegistry.incrementHttpRequest(labels);
-    prometheusRegistry.observeHttpDuration(labels, durationMs);
-    return response;
-  };
-}
-
-// ../../src/core/http/requireAbilityMiddleware.ts
-function createRequireAbilityMiddleware(abilityChecker) {
-  return (ability) => {
-    return async (_request, next) => {
-      const user = currentAuthUser();
-      try {
-        abilityChecker.requireAbility(user, ability);
-      } catch (error) {
-        if (error instanceof ForbiddenError) {
-          return Response.json({ error: error.message }, { status: error.status });
-        }
-        throw error;
-      }
-      return await next();
-    };
-  };
-}
-
-// ../../src/core/http/requireAuthMiddleware.ts
-function createRequireAuthMiddleware(auth) {
-  return async (request, next) => {
-    if (!await auth.check(request)) {
-      const error = new UnauthorizedError;
-      return Response.json({ error: error.message }, { status: error.status });
-    }
-    return await next();
-  };
-}
-
-// ../../src/core/security/securityEvents.ts
-function logSecurityEvent2(event, details = {}) {
-  const meta = currentRequestMeta();
-  const user = currentAuthUser();
-  console.log(JSON.stringify({
-    level: "security",
-    event,
-    timestamp: new Date().toISOString(),
-    ip_address: meta.ipAddress ?? null,
-    user_agent: meta.userAgent ?? null,
-    user_id: user?.id ?? null,
-    ...details
-  }));
-}
-
-// ../../src/core/http/requireGlobalAdminMiddleware.ts
-function createRequireGlobalAdminMiddleware() {
-  return async (_request, next) => {
-    const user = currentAuthUser();
-    if (!isGlobalAdmin(user)) {
-      logSecurityEvent2("privilege_escalation_blocked", {
-        required_role: "platform_admin",
-        path: new URL(_request.url).pathname
-      });
-      const error = new ForbiddenError("Platform admin access required.");
-      return Response.json({ error: error.message }, { status: error.status });
-    }
-    return await next();
-  };
-}
-
-// ../../src/core/http/contentNegotiation.ts
-function requestPrefersJson(request) {
-  if (!request) {
-    return true;
-  }
-  if (request.headers.get("HX-Request") === "true") {
-    return false;
-  }
-  const accept = request.headers.get("accept")?.toLowerCase() ?? "";
-  if (accept.includes("text/html")) {
-    return false;
-  }
-  if (accept.includes("application/json")) {
-    return true;
-  }
-  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
-  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-    return false;
-  }
-  const pathname = new URL(request.url).pathname;
-  return pathname.startsWith("/api/");
-}
-
-// ../../src/core/http/requireWebAuthMiddleware.ts
-function createRequireWebAuthMiddleware(auth) {
-  return async (request, next) => {
-    const user = await auth.resolve(request);
-    if (user) {
-      return await next();
-    }
-    if (requestPrefersJson(request)) {
-      throw new UnauthorizedError;
-    }
-    const redirectTarget = encodeURIComponent(new URL(request.url).pathname);
-    return Response.redirect(`/login?redirect=${redirectTarget}`, 302);
-  };
-}
-
-// ../../src/core/http/routeMiddleware.ts
-function withMiddleware(...middleware) {
-  const wrap = composeMiddleware(...middleware);
-  return (handler) => {
-    return wrap(handler);
-  };
-}
-
-// ../../src/config/contentSecurityPolicy.ts
-function strictApiContentSecurityPolicy() {
-  return "default-src 'none'; frame-ancestors 'none'; base-uri 'none'";
-}
-function serverHtmxContentSecurityPolicy() {
-  return [
-    "default-src 'self'",
-    "script-src 'self' https://unpkg.com",
-    "style-src 'self'",
-    "connect-src 'self'",
-    "img-src 'self'",
-    "font-src 'self'",
-    "form-action 'self'",
-    "frame-ancestors 'none'",
-    "base-uri 'self'"
-  ].join("; ");
-}
-function spaContentSecurityPolicy() {
-  return [
-    "default-src 'self'",
-    "script-src 'self'",
-    "style-src 'self'",
-    "connect-src 'self'",
-    "img-src 'self'",
-    "font-src 'self'",
-    "frame-ancestors 'none'",
-    "base-uri 'self'"
-  ].join("; ");
-}
-function resolveContentSecurityPolicy(response) {
-  const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
-  if (!contentType.includes("text/html")) {
-    return strictApiContentSecurityPolicy();
-  }
-  const frontendMode = (process.env.FRONTEND_MODE ?? "api").trim();
-  if (frontendMode === "server-htmx") {
-    return serverHtmxContentSecurityPolicy();
-  }
-  if (frontendMode === "spa-react") {
-    return spaContentSecurityPolicy();
-  }
-  return strictApiContentSecurityPolicy();
-}
-
-// ../../src/core/http/securityHeadersMiddleware.ts
-function createSecurityHeadersMiddleware() {
-  return async (_request, next) => {
-    const response = await next();
-    const headers = new Headers(response.headers);
-    headers.set("X-Content-Type-Options", "nosniff");
-    headers.set("X-Frame-Options", "DENY");
-    headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
-    headers.set("X-XSS-Protection", "0");
-    headers.set("Content-Security-Policy", resolveContentSecurityPolicy(response));
-    if (appConfig.env === "production") {
-      headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
-    }
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers
-    });
-  };
-}
-
-// ../../src/core/http/throttleMiddleware.ts
-var {RedisClient: RedisClient4 } = globalThis.Bun;
-
-// ../../src/core/tenant/tenantContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage5 } from "async_hooks";
-var tenantContext = new AsyncLocalStorage5;
-function runWithTenant(tenant, callback) {
-  return tenantContext.run(tenant, callback);
-}
-function currentTenant() {
-  return tenantContext.getStore() ?? null;
-}
-function rateLimitMultiplierForPlan(plan) {
-  switch (plan) {
-    case "enterprise":
-      return 4;
-    case "pro":
-      return 2;
-    default:
-      return 1;
-  }
-}
-
-// ../../src/core/http/throttleMiddleware.ts
-function resolveThrottleIdentity(request) {
-  const user = currentAuthUser();
-  if (user?.tokenId !== undefined) {
-    return `token:${user.tokenId}`;
-  }
-  if (user) {
-    return `user:${user.id}`;
-  }
-  return request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
-}
-function createThrottleMiddleware(options) {
-  const client = new RedisClient4(options.redisUrl);
-  const prefix = options.keyPrefix ?? "workhub:throttle:";
-  return async (request, next) => {
-    const identity = resolveThrottleIdentity(request);
-    const path = new URL(request.url).pathname;
-    const throttleKey = `${prefix}${identity}:${path}`;
-    const attempts = Number(await client.incr(throttleKey));
-    if (attempts === 1) {
-      await client.expire(throttleKey, options.decaySeconds);
-    }
-    const maxAttempts = options.maxAttempts * rateLimitMultiplierForPlan(currentTenant()?.plan ?? "free");
-    if (attempts > maxAttempts) {
-      return Response.json({ error: "Too many requests." }, {
-        status: 429,
-        headers: {
-          "retry-after": String(options.decaySeconds)
-        }
-      });
-    }
-    return await next();
-  };
-}
-
-// ../../src/core/logging/requestLoggingMiddleware.ts
-function createRequestLoggingMiddleware() {
-  return async (request, next) => {
-    return await runWithRequestMeta({
-      ipAddress: request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? request.headers.get("x-real-ip"),
-      userAgent: request.headers.get("user-agent"),
-      request
-    }, async () => {
-      const startedAt = performance.now();
-      const requestId = request.headers.get("x-request-id") ?? crypto.randomUUID();
-      const response = await next();
-      const durationMs = Math.round(performance.now() - startedAt);
-      appLogger.info("HTTP request completed", {
-        requestId,
-        method: request.method,
-        path: new URL(request.url).pathname,
-        status: response.status,
-        durationMs
-      });
-      return response;
-    });
-  };
-}
-
-// ../../src/core/security/publicReads.ts
-function isPublicReadsEnabled() {
-  return isFeatureEnabled("publicReads");
-}
-
-// ../../src/core/tenant/resolveTenant.ts
-async function resolveTenant(tenantId) {
-  const rows = await connection_default`
-    SELECT id, slug, plan, region
-    FROM tenant
-    WHERE id = ${tenantId}
-    LIMIT 1
-  `;
-  const row = rows[0];
-  return row ? { id: row.id, slug: row.slug, plan: row.plan, region: row.region ?? "eu" } : null;
-}
-
-// ../../src/core/tenant/tenantDatabaseScope.ts
-async function applyTenantContextToTransaction(transaction, tenantId) {
-  await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
-  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
-}
-async function runWithTenantDatabase(tenant, callback) {
-  return await getDatabase().begin(async (transaction) => {
-    await applyTenantContextToTransaction(transaction, tenant.id);
-    return await runWithDatabaseConnection(transaction, async () => {
-      return await runWithTenant(tenant, callback);
-    });
-  });
-}
-
-// ../../src/core/tenant/tenantMiddleware.ts
-var DEFAULT_TENANT = {
-  id: 1,
-  slug: "default",
-  plan: "enterprise",
-  region: "eu"
-};
-async function resolveUserTenantId(userId) {
-  return await runWithMigrationBypass(async () => {
-    const rows = await connection_default`
-      SELECT tenant_id
-      FROM users
-      WHERE id = ${userId}
-      LIMIT 1
-    `;
-    return rows[0]?.tenant_id ?? DEFAULT_TENANT.id;
-  });
-}
-async function resolveTenantForRequest(request) {
-  const user = currentAuthUser();
-  const headerValue = request.headers.get("x-tenant-id")?.trim();
-  const parsedHeader = headerValue !== undefined && headerValue.length > 0 ? Number.parseInt(headerValue, 10) : Number.NaN;
-  if (user) {
-    const userId = typeof user.id === "number" ? user.id : Number.parseInt(String(user.id), 10);
-    if (Number.isInteger(userId) && userId > 0) {
-      const userTenantId = await resolveUserTenantId(userId);
-      if (!isGlobalAdmin(user)) {
-        if (Number.isInteger(parsedHeader) && parsedHeader > 0 && parsedHeader !== userTenantId) {
-          throw new ForbiddenError("Tenant header does not match your account.");
-        }
-        return await resolveTenant(userTenantId) ?? DEFAULT_TENANT;
-      }
-      if (Number.isInteger(parsedHeader) && parsedHeader > 0) {
-        return await resolveTenant(parsedHeader) ?? DEFAULT_TENANT;
-      }
-      return await resolveTenant(userTenantId) ?? DEFAULT_TENANT;
-    }
-  }
-  const tenantId = Number.isInteger(parsedHeader) && parsedHeader > 0 ? parsedHeader : DEFAULT_TENANT.id;
-  return await resolveTenant(tenantId) ?? DEFAULT_TENANT;
-}
-function createTenantMiddleware() {
-  return async (request, next) => {
-    try {
-      const tenant = await resolveTenantForRequest(request);
-      return await runWithTenantDatabase(tenant, async () => {
-        const response = await next();
-        const headers = new Headers(response.headers);
-        headers.set("x-tenant-id", String(tenant.id));
-        headers.set("x-tenant-region", tenant.region);
-        return new Response(response.body, {
-          status: response.status,
-          statusText: response.statusText,
-          headers
-        });
-      });
-    } catch (error) {
-      if (error instanceof HttpError) {
-        return Response.json({ error: error.message }, { status: error.status });
-      }
-      throw error;
-    }
-  };
-}
-
-// ../../src/core/tracing/otel.ts
-import { randomBytes } from "crypto";
-function randomHex(bytes) {
-  return randomBytes(bytes).toString("hex");
-}
-function createSpan(input) {
-  const spanId = randomHex(8);
-  return {
-    traceId: input.traceId,
-    spanId,
-    name: input.name,
-    startTimeUnixNano: String(Math.floor(input.startedAt * 1e6)),
-    endTimeUnixNano: String(Math.floor(input.endedAt * 1e6)),
-    attributes: Object.entries(input.attributes ?? {}).map(([key, value]) => ({
-      key,
-      value: { stringValue: value }
-    })),
-    status: { code: 1 }
-  };
-}
-async function exportOtelSpan(span) {
-  const endpoint = process.env.OTEL_EXPORTER_OTLP_ENDPOINT?.trim();
-  if (!endpoint) {
-    return;
-  }
-  const serviceName = process.env.OTEL_SERVICE_NAME?.trim() ?? "workhub-api";
-  const url = endpoint.endsWith("/v1/traces") ? endpoint : `${endpoint.replace(/\/$/, "")}/v1/traces`;
-  await fetch(url, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({
-      resourceSpans: [
-        {
-          resource: {
-            attributes: [{ key: "service.name", value: { stringValue: serviceName } }]
-          },
-          scopeSpans: [{ spans: [span] }]
-        }
-      ]
-    })
-  });
-}
-
-// ../../src/core/tracing/traceContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage6 } from "async_hooks";
-var traceContextStorage = new AsyncLocalStorage6;
-function runWithTraceContext(context, callback) {
-  return traceContextStorage.run(context, callback);
-}
-
-// ../../src/core/tracing/tracingMiddleware.ts
-function createTracingMiddleware() {
-  return async (request, next) => {
-    const traceId = (request.headers.get("x-trace-id") ?? crypto.randomUUID()).replace(/-/g, "");
-    const spanId = crypto.randomUUID().replace(/-/g, "").slice(0, 16);
-    const startedAt = performance.now();
-    const path = new URL(request.url).pathname;
-    return await runWithTraceContext({ traceId, spanId }, async () => {
-      const response = await next();
-      const endedAt = performance.now();
-      const headers = new Headers(response.headers);
-      headers.set("x-trace-id", traceId);
-      headers.set("x-span-id", spanId);
-      headers.set("traceparent", `00-${traceId}-${spanId}-01`);
-      headers.set("server-timing", `app;dur=${(endedAt - startedAt).toFixed(2)}`);
-      exportOtelSpan(createSpan({
-        traceId,
-        name: `${request.method} ${path}`,
-        startedAt,
-        endedAt,
-        attributes: {
-          "http.method": request.method,
-          "http.route": path,
-          "http.status_code": String(response.status)
-        }
-      })).catch(() => {
-        return;
-      });
-      return new Response(response.body, {
-        status: response.status,
-        statusText: response.statusText,
-        headers
-      });
-    });
-  };
-}
-
 // ../../src/bootstrap/httpKernel.ts
 class HttpKernel {
   dependencies;
@@ -5576,7 +4677,7 @@ function createWebServer(options) {
   });
 }
 // ../../src/bootstrap/web/session.ts
-import { createHash, randomBytes as randomBytes2 } from "crypto";
+import { createHash, randomBytes } from "crypto";
 class CookieSessionStore {
   sql;
   secret;
@@ -5602,7 +4703,7 @@ class CookieSessionStore {
     return header.includes("Secure") ? header : `${header}; Secure`;
   }
   async create(user) {
-    const id = randomBytes2(32).toString("hex");
+    const id = randomBytes(32).toString("hex");
     const expires = new Date(Date.now() + this.maxAgeSeconds * 1000);
     await this.sql.unsafe(`INSERT INTO sessions (id, user_id, expires_at) VALUES ($1, $2, $3)`, [
       id,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/bootstrap",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "Strata application bootstrap — HttpKernel, DI, web session helpers",
   "type": "module",
   "license": "MIT",
@@ -73,7 +73,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@getstrata/core": "^0.5.9",
+    "@getstrata/core": "^0.5.14",
     "typescript": "^5.9.0"
   }
 }