@getstrata/bootstrap 0.2.50 → 0.2.51

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # @getstrata/bootstrap changelog
 
+## 0.2.51
+
+- `createCookieSessionAuthManager` returns `CookieSessionAuthManager` (`signIn`, `signOut`, `signInRedirect`, `signOutRedirect`). Controllers no longer need a local cookie helper.
+- Pass `loadSessionUser` to replace the default `users.learn_subscriber` / `users.is_admin` session query. Keep `mapUser` in the app.
+
 ## 0.2.50
 
 - `createCookieSessionAuthManager` / `CookieSessionGuard` turn `CookieSessionStore` into an `AuthGuard` / `AuthManager` for `CORE_AUTH_TOKEN`. Supply a `mapUser` mapper; WorkHub abilities are not baked in. Omit `sql` to read the client from `bindDatabaseConnection()` on every call.

package/README.md

@@ -30,7 +30,7 @@ import { createHttpKernel, createAppContext, coreProviders } from "@getstrata/bo
 
 `createAppContext()` does not call `assertProductionSecrets`. WorkHub calls that from `App.serve()` / `queue:work`. Sibling HTMX apps can call it in production without WorkHub API tokens when feature flags are off — see [SIBLING-HTMX.md](../../docs/SIBLING-HTMX.md).
 
-Sibling HTMX apps should bind `createCookieSessionAuthManager` from `@getstrata/bootstrap/web/session` instead of HMAC `SessionGuard`. `CookieSessionStore` reads optional `is_admin` from the user row for `wrapWebGlobalAdmin`. Pass `mapUser` to map `is_admin` / `learn_subscriber` onto `AuthUser.role`.
+Sibling HTMX apps should bind `createCookieSessionAuthManager` from `@getstrata/bootstrap/web/session` instead of HMAC `SessionGuard`. Use `signIn` / `signOut` (or the redirect helpers) instead of calling `CookieSessionStore` from controllers. Pass `mapUser` to map roles in the app. Pass `loadSessionUser` when the default `learn_subscriber` / `is_admin` SELECT does not match your schema.
 
 `wrapWeb` applies the web group (CSRF + flash) and `withErrorHandling`, so CSRF `ForbiddenError` becomes an HTML 403 in `FRONTEND_MODE=server-htmx`. `wrapWebLogin` / `wrapWebRegister` include that web group plus throttle — do not wrap them with `wrapWeb` again.
 

package/dist/bootstrap/public-api.d.ts

@@ -27,4 +27,4 @@ export { coreProviders } from "./providers/index.ts";
 export { registerDefaultJobs } from "./queue/defaultJobs.ts";
 export { RouteRegistry, routeRegistry } from "./routeRegistry.ts";
 export { assertProductionSecrets } from "./secretsGuard.ts";
-export { CookieSessionGuard, CookieSessionStore, createCookieSessionAuthManager, createCsrfProtection, createRouteKernel, createWebServer, type MapSessionUser, type ParsedForm, parseFormBody, routeParams, type SessionUser, slugify, toRouteRequest, type WebServerOptions, wrapSecuredRouteModelByKey, wrapWebLogin, wrapWebRegister, } from "./web/index.ts";
+export { CookieSessionAuthManager, CookieSessionGuard, CookieSessionStore, createCookieSessionAuthManager, createCsrfProtection, createRouteKernel, createWebServer, type LoadSessionUser, type MapSessionUser, type ParsedForm, parseFormBody, routeParams, type SessionUser, slugify, toRouteRequest, type WebServerOptions, wrapSecuredRouteModelByKey, wrapWebLogin, wrapWebRegister, } from "./web/index.ts";

package/dist/bootstrap/web/index.d.ts

@@ -4,5 +4,5 @@
 export { createCsrfProtection, type ParsedForm, parseFormBody } from "./forms.ts";
 export { createRouteKernel, routeParams, toRouteRequest, wrapSecuredRouteModelByKey, wrapWebLogin, wrapWebRegister, } from "./routing.ts";
 export { convertAppRoutesToBunRoutes, createWebServer, type WebServerOptions } from "./server.ts";
-export { CookieSessionGuard, CookieSessionStore, createCookieSessionAuthManager, type MapSessionUser, type SessionUser, } from "./session.ts";
+export { CookieSessionAuthManager, CookieSessionGuard, CookieSessionStore, createCookieSessionAuthManager, type LoadSessionUser, type MapSessionUser, type SessionUser, } from "./session.ts";
 export { slugify } from "./slug.ts";

package/dist/bootstrap/web/session.d.ts

@@ -11,6 +11,7 @@ type SqlClient = {
     unsafe<T>(query: string, params?: readonly unknown[]): Promise<T[]>;
 };
 type SqlSource = SqlClient | (() => SqlClient);
+export type LoadSessionUser = (sql: SqlClient, sessionId: string) => Promise<SessionUser | null>;
 declare function defaultSessionSql(): SqlClient;
 export type MapSessionUser = (user: SessionUser) => AuthUser;
 declare function defaultMapSessionUser(user: SessionUser): AuthUser;
@@ -19,9 +20,11 @@ export declare class CookieSessionStore {
     private readonly secret;
     private readonly cookieName;
     private readonly maxAgeSeconds;
-    constructor(sqlSource: SqlSource, secret: string, cookieName?: string, maxAgeSeconds?: number);
+    private readonly loadSessionUser;
+    constructor(sqlSource: SqlSource, secret: string, cookieName?: string, maxAgeSeconds?: number, loadSessionUser?: LoadSessionUser);
     cookieHeader(_user: SessionUser, sessionId: string): string;
     clearCookieHeader(): string;
+    sessionIdFromRequest(request: Request): string | null;
     private withSecureFlag;
     private sql;
     create(user: SessionUser): Promise<string>;
@@ -35,6 +38,19 @@ export declare class CookieSessionGuard implements AuthGuard {
     constructor(store: CookieSessionStore, mapUser?: MapSessionUser);
     resolve(request: Request): Promise<AuthUser | null>;
 }
+export declare class CookieSessionAuthManager extends AuthManager {
+    readonly store: CookieSessionStore;
+    constructor(store: CookieSessionStore, mapUser?: MapSessionUser);
+    signIn(user: SessionUser): Promise<{
+        sessionId: string;
+        setCookie: string;
+    }>;
+    signOut(request: Request): Promise<{
+        setCookie: string;
+    }>;
+    signInRedirect(user: SessionUser, location: string, status?: number): Promise<Response>;
+    signOutRedirect(request: Request, location: string, status?: number): Promise<Response>;
+}
 export interface CreateCookieSessionAuthManagerOptions {
     store?: CookieSessionStore;
     sql?: SqlSource;
@@ -42,6 +58,7 @@ export interface CreateCookieSessionAuthManagerOptions {
     cookieName?: string;
     maxAgeSeconds?: number;
     mapUser?: MapSessionUser;
+    loadSessionUser?: LoadSessionUser;
 }
-declare function createCookieSessionAuthManager(options?: CreateCookieSessionAuthManagerOptions): AuthManager;
+declare function createCookieSessionAuthManager(options?: CreateCookieSessionAuthManagerOptions): CookieSessionAuthManager;
 export { createCookieSessionAuthManager, defaultMapSessionUser, defaultSessionSql };

package/dist/entries/web/session.js

@@ -29,17 +29,45 @@ function defaultMapSessionUser(user) {
     role: user.is_admin ? "admin" : "member"
   };
 }
+async function defaultLoadSessionUser(sql, sessionId) {
+  const rows = await sql.unsafe(`SELECT s.id, s.user_id, s.expires_at, u.name, u.email, u.learn_subscriber,
+            COALESCE(u.is_admin, false) AS is_admin
+     FROM sessions s
+     INNER JOIN users u ON u.id = s.user_id
+     WHERE s.id = $1 AND s.expires_at > NOW()`, [sessionId]);
+  const row = rows[0];
+  if (!row)
+    return null;
+  return {
+    id: row.user_id,
+    name: row.name,
+    email: row.email,
+    learn_subscriber: row.learn_subscriber,
+    is_admin: row.is_admin
+  };
+}
+function redirectWithCookie(location, setCookie, status) {
+  return new Response(null, {
+    status,
+    headers: {
+      Location: location,
+      "Set-Cookie": setCookie
+    }
+  });
+}
 
 class CookieSessionStore {
   sqlSource;
   secret;
   cookieName;
   maxAgeSeconds;
-  constructor(sqlSource, secret, cookieName = "strata_session", maxAgeSeconds = 60 * 60 * 24 * 14) {
+  loadSessionUser;
+  constructor(sqlSource, secret, cookieName = "strata_session", maxAgeSeconds = 60 * 60 * 24 * 14, loadSessionUser = defaultLoadSessionUser) {
     this.sqlSource = sqlSource;
     this.secret = secret;
     this.cookieName = cookieName;
     this.maxAgeSeconds = maxAgeSeconds;
+    this.loadSessionUser = loadSessionUser;
   }
   cookieHeader(_user, sessionId) {
     const payload = `${sessionId}.${this.sign(sessionId)}`;
@@ -48,6 +76,17 @@ class CookieSessionStore {
   clearCookieHeader() {
     return this.withSecureFlag(`${this.cookieName}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`);
   }
+  sessionIdFromRequest(request) {
+    const cookie = readRequestCookie(request, this.cookieName);
+    const raw = cookie ?? null;
+    if (!raw)
+      return null;
+    const [sessionId, signature] = raw.split(".");
+    if (!sessionId || !signature || signature !== this.sign(sessionId)) {
+      return null;
+    }
+    return sessionId;
+  }
   withSecureFlag(header) {
     if (true) {
       return header;
@@ -71,29 +110,10 @@ class CookieSessionStore {
     await this.sql().unsafe(`DELETE FROM sessions WHERE id = $1`, [sessionId]);
   }
   async read(request) {
-    const cookie = readRequestCookie(request, this.cookieName);
-    const raw = cookie ?? null;
-    if (!raw)
+    const sessionId = this.sessionIdFromRequest(request);
+    if (!sessionId)
       return null;
-    const [sessionId, signature] = raw.split(".");
-    if (!sessionId || !signature || signature !== this.sign(sessionId)) {
-      return null;
-    }
-    const rows = await this.sql().unsafe(`SELECT s.id, s.user_id, s.expires_at, u.name, u.email, u.learn_subscriber,
-              COALESCE(u.is_admin, false) AS is_admin
-       FROM sessions s
-       INNER JOIN users u ON u.id = s.user_id
-       WHERE s.id = $1 AND s.expires_at > NOW()`, [sessionId]);
-    const row = rows[0];
-    if (!row)
-      return null;
-    return {
-      id: row.user_id,
-      name: row.name,
-      email: row.email,
-      learn_subscriber: row.learn_subscriber,
-      is_admin: row.is_admin
-    };
+    return this.loadSessionUser(this.sql(), sessionId);
   }
   sign(value) {
     return createHash("sha256").update(`${value}.${this.secret}`).digest("hex").slice(0, 32);
@@ -115,11 +135,39 @@ class CookieSessionGuard {
     return this.mapUser(user);
   }
 }
+
+class CookieSessionAuthManager extends AuthManager {
+  store;
+  constructor(store, mapUser = defaultMapSessionUser) {
+    super(new CookieSessionGuard(store, mapUser));
+    this.store = store;
+  }
+  async signIn(user) {
+    const sessionId = await this.store.create(user);
+    return { sessionId, setCookie: this.store.cookieHeader(user, sessionId) };
+  }
+  async signOut(request) {
+    const sessionId = this.store.sessionIdFromRequest(request);
+    if (sessionId) {
+      await this.store.destroy(sessionId);
+    }
+    return { setCookie: this.store.clearCookieHeader() };
+  }
+  async signInRedirect(user, location, status = 302) {
+    const { setCookie } = await this.signIn(user);
+    return redirectWithCookie(location, setCookie, status);
+  }
+  async signOutRedirect(request, location, status = 302) {
+    const { setCookie } = await this.signOut(request);
+    return redirectWithCookie(location, setCookie, status);
+  }
+}
 function createCookieSessionAuthManager(options = {}) {
-  const store = options.store ?? new CookieSessionStore(options.sql ?? defaultSessionSql, options.secret ?? process.env.SESSION_SECRET?.trim() ?? "", options.cookieName, options.maxAgeSeconds);
-  return new AuthManager(new CookieSessionGuard(store, options.mapUser ?? defaultMapSessionUser));
+  const store = options.store ?? new CookieSessionStore(options.sql ?? defaultSessionSql, options.secret ?? process.env.SESSION_SECRET?.trim() ?? "", options.cookieName, options.maxAgeSeconds, options.loadSessionUser);
+  return new CookieSessionAuthManager(store, options.mapUser ?? defaultMapSessionUser);
 }
 export {
+  CookieSessionAuthManager,
   CookieSessionGuard,
   CookieSessionStore,
   createCookieSessionAuthManager,

package/dist/index.js

@@ -1280,17 +1280,45 @@ function defaultMapSessionUser(user) {
     role: user.is_admin ? "admin" : "member"
   };
 }
+async function defaultLoadSessionUser(sql, sessionId) {
+  const rows = await sql.unsafe(`SELECT s.id, s.user_id, s.expires_at, u.name, u.email, u.learn_subscriber,
+            COALESCE(u.is_admin, false) AS is_admin
+     FROM sessions s
+     INNER JOIN users u ON u.id = s.user_id
+     WHERE s.id = $1 AND s.expires_at > NOW()`, [sessionId]);
+  const row = rows[0];
+  if (!row)
+    return null;
+  return {
+    id: row.user_id,
+    name: row.name,
+    email: row.email,
+    learn_subscriber: row.learn_subscriber,
+    is_admin: row.is_admin
+  };
+}
+function redirectWithCookie(location, setCookie, status) {
+  return new Response(null, {
+    status,
+    headers: {
+      Location: location,
+      "Set-Cookie": setCookie
+    }
+  });
+}
 
 class CookieSessionStore {
   sqlSource;
   secret;
   cookieName;
   maxAgeSeconds;
-  constructor(sqlSource, secret, cookieName = "strata_session", maxAgeSeconds = 60 * 60 * 24 * 14) {
+  loadSessionUser;
+  constructor(sqlSource, secret, cookieName = "strata_session", maxAgeSeconds = 60 * 60 * 24 * 14, loadSessionUser = defaultLoadSessionUser) {
     this.sqlSource = sqlSource;
     this.secret = secret;
     this.cookieName = cookieName;
     this.maxAgeSeconds = maxAgeSeconds;
+    this.loadSessionUser = loadSessionUser;
   }
   cookieHeader(_user, sessionId) {
     const payload = `${sessionId}.${this.sign(sessionId)}`;
@@ -1299,6 +1327,17 @@ class CookieSessionStore {
   clearCookieHeader() {
     return this.withSecureFlag(`${this.cookieName}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`);
   }
+  sessionIdFromRequest(request) {
+    const cookie = readRequestCookie(request, this.cookieName);
+    const raw = cookie ?? null;
+    if (!raw)
+      return null;
+    const [sessionId, signature] = raw.split(".");
+    if (!sessionId || !signature || signature !== this.sign(sessionId)) {
+      return null;
+    }
+    return sessionId;
+  }
   withSecureFlag(header) {
     if (true) {
       return header;
@@ -1322,29 +1361,10 @@ class CookieSessionStore {
     await this.sql().unsafe(`DELETE FROM sessions WHERE id = $1`, [sessionId]);
   }
   async read(request) {
-    const cookie = readRequestCookie(request, this.cookieName);
-    const raw = cookie ?? null;
-    if (!raw)
+    const sessionId = this.sessionIdFromRequest(request);
+    if (!sessionId)
       return null;
-    const [sessionId, signature] = raw.split(".");
-    if (!sessionId || !signature || signature !== this.sign(sessionId)) {
-      return null;
-    }
-    const rows = await this.sql().unsafe(`SELECT s.id, s.user_id, s.expires_at, u.name, u.email, u.learn_subscriber,
-              COALESCE(u.is_admin, false) AS is_admin
-       FROM sessions s
-       INNER JOIN users u ON u.id = s.user_id
-       WHERE s.id = $1 AND s.expires_at > NOW()`, [sessionId]);
-    const row = rows[0];
-    if (!row)
-      return null;
-    return {
-      id: row.user_id,
-      name: row.name,
-      email: row.email,
-      learn_subscriber: row.learn_subscriber,
-      is_admin: row.is_admin
-    };
+    return this.loadSessionUser(this.sql(), sessionId);
   }
   sign(value) {
     return createHash("sha256").update(`${value}.${this.secret}`).digest("hex").slice(0, 32);
@@ -1366,9 +1386,36 @@ class CookieSessionGuard {
     return this.mapUser(user);
   }
 }
+
+class CookieSessionAuthManager extends AuthManager2 {
+  store;
+  constructor(store, mapUser = defaultMapSessionUser) {
+    super(new CookieSessionGuard(store, mapUser));
+    this.store = store;
+  }
+  async signIn(user) {
+    const sessionId = await this.store.create(user);
+    return { sessionId, setCookie: this.store.cookieHeader(user, sessionId) };
+  }
+  async signOut(request) {
+    const sessionId = this.store.sessionIdFromRequest(request);
+    if (sessionId) {
+      await this.store.destroy(sessionId);
+    }
+    return { setCookie: this.store.clearCookieHeader() };
+  }
+  async signInRedirect(user, location, status = 302) {
+    const { setCookie } = await this.signIn(user);
+    return redirectWithCookie(location, setCookie, status);
+  }
+  async signOutRedirect(request, location, status = 302) {
+    const { setCookie } = await this.signOut(request);
+    return redirectWithCookie(location, setCookie, status);
+  }
+}
 function createCookieSessionAuthManager(options = {}) {
-  const store = options.store ?? new CookieSessionStore(options.sql ?? defaultSessionSql, options.secret ?? process.env.SESSION_SECRET?.trim() ?? "", options.cookieName, options.maxAgeSeconds);
-  return new AuthManager2(new CookieSessionGuard(store, options.mapUser ?? defaultMapSessionUser));
+  const store = options.store ?? new CookieSessionStore(options.sql ?? defaultSessionSql, options.secret ?? process.env.SESSION_SECRET?.trim() ?? "", options.cookieName, options.maxAgeSeconds, options.loadSessionUser);
+  return new CookieSessionAuthManager(store, options.mapUser ?? defaultMapSessionUser);
 }
 // ../../src/bootstrap/web/slug.ts
 function slugify(value) {
@@ -1385,6 +1432,7 @@ export {
   CORE_POLICY_GATE_TOKEN,
   CORE_QUEUE_TOKEN,
   CORE_TOKEN_SERVICE_TOKEN,
+  CookieSessionAuthManager,
   CookieSessionGuard,
   CookieSessionStore,
   DATABASE_URL_CONFIG_KEY,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/bootstrap",
-  "version": "0.2.50",
+  "version": "0.2.51",
   "description": "Strata application bootstrap — HttpKernel, DI, web session helpers",
   "type": "module",
   "license": "MIT",
@@ -173,14 +173,14 @@
     "build:bundle": "bun build index.ts --outdir dist --target bun --external bun --external eta --external @getstrata/core",
     "build:types": "tsc -p tsconfig.types.json && bun ../../scripts/prune-bootstrap-dist-types.ts",
     "prepublishOnly": "bun run build",
-    "build:subpaths": "bun build entries/applicationRegistry.ts entries/buildModuleRoutes.ts entries/buildWebModuleRoutes.ts entries/cache/modelCacheTags.ts entries/config.ts entries/context.ts entries/contracts.ts entries/createWebRoutes.ts entries/createRoutes.ts entries/createSpaRoutes.ts entries/dependencies.ts entries/discoverModules.ts entries/health.ts entries/http/securedRouteModelBinding.ts entries/httpKernel.ts entries/listeners/invalidateCacheOnModelWrite.ts entries/membershipService.ts entries/metricsRoutes.ts entries/queue/defaultJobs.ts entries/providers.ts entries/providers/view.ts entries/routeRegistry.ts entries/schedule.ts entries/secretsGuard.ts entries/web/forms.ts entries/web/routing.ts entries/web/server.ts entries/web/session.ts entries/web/slug.ts --outdir dist --root . --target bun --external bun --external eta --external @getstrata/core --external @getstrata/bootstrap --external @getstrata/bootstrap/applicationRegistry --external @getstrata/bootstrap/buildModuleRoutes --external @getstrata/bootstrap/buildWebModuleRoutes --external @getstrata/bootstrap/cache/modelCacheTags --external @getstrata/bootstrap/config --external @getstrata/bootstrap/context --external @getstrata/bootstrap/contracts --external @getstrata/bootstrap/createWebRoutes --external @getstrata/bootstrap/createRoutes --external @getstrata/bootstrap/createSpaRoutes --external @getstrata/bootstrap/dependencies --external @getstrata/bootstrap/discoverModules --external @getstrata/bootstrap/health --external @getstrata/bootstrap/http/securedRouteModelBinding --external @getstrata/bootstrap/httpKernel --external @getstrata/bootstrap/listeners/invalidateCacheOnModelWrite --external @getstrata/bootstrap/membershipService --external @getstrata/bootstrap/metricsRoutes --external @getstrata/bootstrap/queue/defaultJobs --external @getstrata/bootstrap/providers --external @getstrata/bootstrap/providers/view --external @getstrata/bootstrap/routeRegistry --external @getstrata/bootstrap/schedule --external @getstrata/bootstrap/secretsGuard --external @getstrata/bootstrap/web/forms --external @getstrata/bootstrap/web/routing --external @getstrata/bootstrap/web/server --external @getstrata/bootstrap/web/session --external @getstrata/bootstrap/web/slug --external @getstrata/core/auth/accessControl --external @getstrata/core/auth/abilityChecker --external @getstrata/core/auth/authContext --external @getstrata/core/auth/guard --external @getstrata/core/auth/membershipContext --external @getstrata/core/auth/membershipMiddleware --external @getstrata/core/auth/membershipScope --external @getstrata/core/auth/membershipService --external @getstrata/core/auth/oauth/oidcProvider --external @getstrata/core/auth/oauth/providers --external @getstrata/core/auth/oauth/samlProvider --external @getstrata/core/auth/oauth/types --external @getstrata/core/auth/password --external @getstrata/core/auth/policy --external @getstrata/core/auth/scimAuthMiddleware --external @getstrata/core/auth/sessionCookie --external @getstrata/core/auth/sessionGuard --external @getstrata/core/auth/tokenHash --external @getstrata/core/audit/exportAuditLogs --external @getstrata/core/audit/siemFormatter --external @getstrata/core/admin/formatValue --external @getstrata/core/admin/registry --external @getstrata/core/admin/types --external @getstrata/core/cache/tags --external @getstrata/core/cache/createCacheStore --external @getstrata/core/cache/repository --external @getstrata/core/cache/simpleCache --external @getstrata/core/cache/simpleCacheStore --external @getstrata/core/config/envSchema --external @getstrata/core/contracts/serviceTokens --external @getstrata/core/contracts/container --external @getstrata/core/contracts/di --external @getstrata/core/crypto/fieldEncryption --external @getstrata/core/crypto/mfaSecret --external @getstrata/core/database --external @getstrata/core/database/baseRepository --external @getstrata/core/database/bindConnection --external @getstrata/core/database/boundConnection --external @getstrata/core/database/connection --external @getstrata/core/database/defaultConnection --external @getstrata/core/database/errors --external @getstrata/core/database/factory --external @getstrata/core/database/migrations --external @getstrata/core/database/migrations/types --external @getstrata/core/database/model --external @getstrata/core/database/query --external @getstrata/core/database/relationships --external @getstrata/core/database/repositoryConnection --external @getstrata/core/database/repositoryQuery --external @getstrata/core/database/seeders --external @getstrata/core/database/seeders/types --external @getstrata/core/database/schema --external @getstrata/core/database/table --external @getstrata/core/database/transaction --external @getstrata/core/database/types --external @getstrata/core/database/whereBuilder --external @getstrata/core/errors/http --external @getstrata/core/events --external @getstrata/core/facades --external @getstrata/core/http --external @getstrata/core/http/authMiddleware --external @getstrata/core/http/authorizeMiddleware --external @getstrata/core/http/bodySizeLimitMiddleware --external @getstrata/core/http/clientIp --external @getstrata/core/http/cookies --external @getstrata/core/http/contentNegotiation --external @getstrata/core/http/conditionalResponse --external @getstrata/core/http/corsMiddleware --external @getstrata/core/http/csrfMiddleware --external @getstrata/core/http/csrfProtection --external @getstrata/core/http/csrfToken --external @getstrata/core/http/etag --external @getstrata/core/http/flashSession --external @getstrata/core/http/flashMiddleware --external @getstrata/core/http/formRequest --external @getstrata/core/http/middleware --external @getstrata/core/http/metricsMiddleware --external @getstrata/core/http/loginThrottleMiddleware --external @getstrata/core/http/memoryThrottleMiddleware --external @getstrata/core/http/pagination --external @getstrata/core/http/parseFormBody --external @getstrata/core/http/parseMultipartUpload --external @getstrata/core/http/requireAbilityMiddleware --external @getstrata/core/http/requireAuthMiddleware --external @getstrata/core/http/requireGlobalAdminMiddleware --external @getstrata/core/http/requireWebAuthMiddleware --external @getstrata/core/http/resources --external @getstrata/core/http/response --external @getstrata/core/http/route --external @getstrata/core/http/routeMiddleware --external @getstrata/core/http/routeModelBinding --external @getstrata/core/http/scimThrottleMiddleware --external @getstrata/core/http/securityHeadersMiddleware --external @getstrata/core/http/securedRouteModelBinding --external @getstrata/core/http/requestMetaContext --external @getstrata/core/http/webErrorResponse --external @getstrata/core/http/webFormRequest --external @getstrata/core/http/throttleMiddleware --external @getstrata/core/http/validation --external @getstrata/core/jobs/dispatchWebhookJob --external @getstrata/core/jobs/invalidateCacheTagsJob --external @getstrata/core/lifecycle/gracefulShutdown --external @getstrata/core/logging/logger --external @getstrata/core/logging/requestLoggingMiddleware --external @getstrata/core/mail/mailer --external @getstrata/core/mail/markdownMail --external @getstrata/core/mail/markdownMailable --external @getstrata/core/media/imageTransform --external @getstrata/core/metrics/prometheus --external @getstrata/core/notifications --external @getstrata/core/openapi/generator --external @getstrata/core/openapi/registeredRoute --external @getstrata/core/openapi/validate --external @getstrata/core/pagination --external @getstrata/core/queue --external @getstrata/core/queue/createAppQueue --external @getstrata/core/queue/failedJobRepository --external @getstrata/core/queue/failedJobService --external @getstrata/core/queue/jobRegistry --external @getstrata/core/queue/jobRunner --external @getstrata/core/queue/queueMetrics --external @getstrata/core/queue/publicQueue --external @getstrata/core/queue/redisQueue --external @getstrata/core/queue/types --external @getstrata/core/runtime/applicationRegistry --external @getstrata/core/runtime/asyncContextStore --external @getstrata/core/scheduler/schedule --external @getstrata/core/scheduler/osCron --external @getstrata/core/security/oauthState --external @getstrata/core/security/publicReads --external @getstrata/core/security/safeFetch --external @getstrata/core/security/safeUrl --external @getstrata/core/security/scimTenantTokens --external @getstrata/core/security/securityEvents --external @getstrata/core/security/stripeWebhook --external @getstrata/core/security/timingSafeCompare --external @getstrata/core/security/tokenExpiry --external @getstrata/core/security/totp --external @getstrata/core/storage/storage --external @getstrata/core/tenant/tenancyConfig --external @getstrata/core/tenant/tenantContext --external @getstrata/core/tenant/tenantDatabaseScope --external @getstrata/core/tenant/databaseTenantContext --external @getstrata/core/tenant/tenantMiddleware --external @getstrata/core/terminal/runShell --external @getstrata/core/tracing/traceContext --external @getstrata/core/tracing/tracingMiddleware --external @getstrata/core/validation/rules --external @getstrata/core/view",
+    "build:subpaths": "bun build entries/applicationRegistry.ts entries/buildModuleRoutes.ts entries/buildWebModuleRoutes.ts entries/cache/modelCacheTags.ts entries/config.ts entries/context.ts entries/contracts.ts entries/createWebRoutes.ts entries/createRoutes.ts entries/createSpaRoutes.ts entries/dependencies.ts entries/discoverModules.ts entries/health.ts entries/http/securedRouteModelBinding.ts entries/httpKernel.ts entries/listeners/invalidateCacheOnModelWrite.ts entries/membershipService.ts entries/metricsRoutes.ts entries/queue/defaultJobs.ts entries/providers.ts entries/providers/view.ts entries/routeRegistry.ts entries/schedule.ts entries/secretsGuard.ts entries/web/forms.ts entries/web/routing.ts entries/web/server.ts entries/web/session.ts entries/web/slug.ts --outdir dist --root . --target bun --external bun --external eta --external @getstrata/core --external @getstrata/bootstrap --external @getstrata/bootstrap/applicationRegistry --external @getstrata/bootstrap/buildModuleRoutes --external @getstrata/bootstrap/buildWebModuleRoutes --external @getstrata/bootstrap/cache/modelCacheTags --external @getstrata/bootstrap/config --external @getstrata/bootstrap/context --external @getstrata/bootstrap/contracts --external @getstrata/bootstrap/createWebRoutes --external @getstrata/bootstrap/createRoutes --external @getstrata/bootstrap/createSpaRoutes --external @getstrata/bootstrap/dependencies --external @getstrata/bootstrap/discoverModules --external @getstrata/bootstrap/health --external @getstrata/bootstrap/http/securedRouteModelBinding --external @getstrata/bootstrap/httpKernel --external @getstrata/bootstrap/listeners/invalidateCacheOnModelWrite --external @getstrata/bootstrap/membershipService --external @getstrata/bootstrap/metricsRoutes --external @getstrata/bootstrap/queue/defaultJobs --external @getstrata/bootstrap/providers --external @getstrata/bootstrap/providers/view --external @getstrata/bootstrap/routeRegistry --external @getstrata/bootstrap/schedule --external @getstrata/bootstrap/secretsGuard --external @getstrata/bootstrap/web/forms --external @getstrata/bootstrap/web/routing --external @getstrata/bootstrap/web/server --external @getstrata/bootstrap/web/session --external @getstrata/bootstrap/web/slug --external @getstrata/core/auth/accessControl --external @getstrata/core/auth/abilityChecker --external @getstrata/core/auth/authContext --external @getstrata/core/auth/guard --external @getstrata/core/auth/membershipContext --external @getstrata/core/auth/membershipMiddleware --external @getstrata/core/auth/membershipScope --external @getstrata/core/auth/membershipService --external @getstrata/core/auth/oauth/oidcProvider --external @getstrata/core/auth/oauth/providers --external @getstrata/core/auth/oauth/samlProvider --external @getstrata/core/auth/oauth/types --external @getstrata/core/auth/password --external @getstrata/core/auth/policy --external @getstrata/core/auth/scimAuthMiddleware --external @getstrata/core/auth/sessionCookie --external @getstrata/core/auth/sessionGuard --external @getstrata/core/auth/tokenHash --external @getstrata/core/audit/exportAuditLogs --external @getstrata/core/audit/siemFormatter --external @getstrata/core/admin/formatValue --external @getstrata/core/admin/registry --external @getstrata/core/admin/types --external @getstrata/core/cache/tags --external @getstrata/core/cache/createCacheStore --external @getstrata/core/cache/repository --external @getstrata/core/cache/simpleCache --external @getstrata/core/cache/simpleCacheStore --external @getstrata/core/config/envSchema --external @getstrata/core/contracts/serviceTokens --external @getstrata/core/contracts/container --external @getstrata/core/contracts/di --external @getstrata/core/crypto/fieldEncryption --external @getstrata/core/crypto/mfaSecret --external @getstrata/core/database --external @getstrata/core/database/baseRepository --external @getstrata/core/database/bindConnection --external @getstrata/core/database/boundConnection --external @getstrata/core/database/bunSql --external @getstrata/core/database/connection --external @getstrata/core/database/defaultConnection --external @getstrata/core/database/errors --external @getstrata/core/database/factory --external @getstrata/core/database/migrations --external @getstrata/core/database/migrations/types --external @getstrata/core/database/model --external @getstrata/core/database/query --external @getstrata/core/database/relationships --external @getstrata/core/database/repositoryConnection --external @getstrata/core/database/repositoryQuery --external @getstrata/core/database/seeders --external @getstrata/core/database/seeders/types --external @getstrata/core/database/schema --external @getstrata/core/database/table --external @getstrata/core/database/transaction --external @getstrata/core/database/types --external @getstrata/core/database/whereBuilder --external @getstrata/core/errors/http --external @getstrata/core/events --external @getstrata/core/facades --external @getstrata/core/http --external @getstrata/core/http/authMiddleware --external @getstrata/core/http/authorizeMiddleware --external @getstrata/core/http/bodySizeLimitMiddleware --external @getstrata/core/http/clientIp --external @getstrata/core/http/cookies --external @getstrata/core/http/contentNegotiation --external @getstrata/core/http/conditionalResponse --external @getstrata/core/http/corsMiddleware --external @getstrata/core/http/csrfMiddleware --external @getstrata/core/http/csrfProtection --external @getstrata/core/http/csrfToken --external @getstrata/core/http/etag --external @getstrata/core/http/flashSession --external @getstrata/core/http/flashMiddleware --external @getstrata/core/http/formRequest --external @getstrata/core/http/middleware --external @getstrata/core/http/metricsMiddleware --external @getstrata/core/http/loginThrottleMiddleware --external @getstrata/core/http/memoryThrottleMiddleware --external @getstrata/core/http/pagination --external @getstrata/core/http/parseFormBody --external @getstrata/core/http/parseMultipartUpload --external @getstrata/core/http/requireAbilityMiddleware --external @getstrata/core/http/requireAuthMiddleware --external @getstrata/core/http/requireGlobalAdminMiddleware --external @getstrata/core/http/requireWebAuthMiddleware --external @getstrata/core/http/resources --external @getstrata/core/http/response --external @getstrata/core/http/route --external @getstrata/core/http/routeMiddleware --external @getstrata/core/http/routeModelBinding --external @getstrata/core/http/scimThrottleMiddleware --external @getstrata/core/http/securityHeadersMiddleware --external @getstrata/core/http/securedRouteModelBinding --external @getstrata/core/http/requestMetaContext --external @getstrata/core/http/webErrorResponse --external @getstrata/core/http/webFormRequest --external @getstrata/core/http/throttleMiddleware --external @getstrata/core/http/validation --external @getstrata/core/jobs/dispatchWebhookJob --external @getstrata/core/jobs/invalidateCacheTagsJob --external @getstrata/core/lifecycle/gracefulShutdown --external @getstrata/core/logging/logger --external @getstrata/core/logging/requestLoggingMiddleware --external @getstrata/core/mail/mailer --external @getstrata/core/mail/markdownMail --external @getstrata/core/mail/markdownMailable --external @getstrata/core/media/imageTransform --external @getstrata/core/metrics/prometheus --external @getstrata/core/notifications --external @getstrata/core/openapi/generator --external @getstrata/core/openapi/registeredRoute --external @getstrata/core/openapi/validate --external @getstrata/core/pagination --external @getstrata/core/queue --external @getstrata/core/queue/createAppQueue --external @getstrata/core/queue/failedJobRepository --external @getstrata/core/queue/failedJobService --external @getstrata/core/queue/jobRegistry --external @getstrata/core/queue/jobRunner --external @getstrata/core/queue/queueMetrics --external @getstrata/core/queue/publicQueue --external @getstrata/core/queue/redisQueue --external @getstrata/core/queue/types --external @getstrata/core/runtime/applicationRegistry --external @getstrata/core/runtime/asyncContextStore --external @getstrata/core/scheduler/schedule --external @getstrata/core/scheduler/osCron --external @getstrata/core/security/oauthState --external @getstrata/core/security/publicReads --external @getstrata/core/security/safeFetch --external @getstrata/core/security/safeUrl --external @getstrata/core/security/scimTenantTokens --external @getstrata/core/security/securityEvents --external @getstrata/core/security/stripeWebhook --external @getstrata/core/security/timingSafeCompare --external @getstrata/core/security/tokenExpiry --external @getstrata/core/security/totp --external @getstrata/core/storage/storage --external @getstrata/core/tenant/tenancyConfig --external @getstrata/core/tenant/tenantContext --external @getstrata/core/tenant/tenantDatabaseScope --external @getstrata/core/tenant/databaseTenantContext --external @getstrata/core/tenant/tenantMiddleware --external @getstrata/core/terminal/runShell --external @getstrata/core/tracing/traceContext --external @getstrata/core/tracing/tracingMiddleware --external @getstrata/core/validation/rules --external @getstrata/core/view",
     "build:shims": "true"
   },
   "publishConfig": {
     "access": "public"
   },
   "peerDependencies": {
-    "@getstrata/core": "^0.5.59",
+    "@getstrata/core": "^0.5.60",
     "typescript": "^5.9.0"
   }
 }