@getstrata/bootstrap 0.2.6 → 0.2.8

package/dist/index.js

@@ -65,18 +65,13 @@ var appConfig = {
   apiPrefix: process.env.API_PREFIX ?? "/api/v1"
 };
 
-// ../../src/config/database.ts
-function readInteger(name, fallback) {
-  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
-  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
-}
-var databaseConfig = {
-  url: process.env.DATABASE_URL ?? "",
-  poolMax: readInteger("DB_POOL_MAX", 10),
-  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
-  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
-  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
+// ../../src/core/database/boundConnection.ts
+var boundConnectionHolder = {
+  connection: null
 };
+function getBoundDatabaseConnection() {
+  return boundConnectionHolder.connection;
+}
 
 // ../../src/core/database/connectionContext.ts
 import { AsyncLocalStorage } from "async_hooks";
@@ -85,84 +80,65 @@ function getActiveDatabaseConnection(fallback) {
   return activeConnection.getStore() ?? fallback;
 }
 
-// ../../src/db/connection/createConnection.ts
-var {SQL } = globalThis.Bun;
-function createDatabaseConnection(config) {
-  if (!config.url) {
-    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
+// ../../src/core/database/queryProxy.ts
+var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+function createDatabaseQueryProxy(pool) {
+  function resolveDatabase() {
+    return getActiveDatabaseConnection(pool);
   }
-  return new SQL({
-    url: config.url,
-    max: config.poolMax,
-    idleTimeout: config.idleTimeoutSeconds,
-    maxLifetime: config.maxLifetimeSeconds,
-    connectionTimeout: config.connectionTimeoutSeconds
+  function resolveDatabaseForProperty(property) {
+    if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
+      return pool;
+    }
+    return resolveDatabase();
+  }
+  return new Proxy(function database() {}, {
+    apply(_target, _thisArg, args) {
+      return resolveDatabase()(...args);
+    },
+    get(_target, property) {
+      const connection = resolveDatabaseForProperty(property);
+      const value = connection[property];
+      return typeof value === "function" ? value.bind(connection) : value;
+    }
   });
 }
 
-// ../../src/db/connection/index.ts
-var connectionHolder = {
+// ../../src/core/database/defaultConnection.ts
+var defaultPool = {
   connection: null
 };
-function getDatabase() {
-  if (!connectionHolder.connection) {
-    connectionHolder.connection = createDatabaseConnection(databaseConfig);
-  }
-  return connectionHolder.connection;
-}
-var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
-function resolveDatabase() {
-  return getActiveDatabaseConnection(getDatabase());
+var defaultQuery = {
+  connection: null
+};
+function registerDefaultDatabasePool(connection) {
+  defaultPool.connection = connection;
+  defaultQuery.connection = createDatabaseQueryProxy(connection);
 }
-function resolveDatabaseForProperty(property) {
-  if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
-    return getDatabase();
+function getDefaultDatabaseQuery() {
+  if (!defaultQuery.connection) {
+    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
   }
-  return resolveDatabase();
+  return defaultQuery.connection;
 }
-var db = new Proxy(function database() {}, {
+
+// ../../src/core/database/repositoryConnection.ts
+function resolveRepositoryConnection() {
+  return getBoundDatabaseConnection() ?? getDefaultDatabaseQuery();
+}
+var repositoryConnection = new Proxy(function repositoryConnection2() {}, {
   apply(_target, _thisArg, args) {
-    return resolveDatabase()(...args);
+    return resolveRepositoryConnection()(...args);
   },
   get(_target, property) {
-    const connection = resolveDatabaseForProperty(property);
+    const connection = resolveRepositoryConnection();
     const value = connection[property];
     return typeof value === "function" ? value.bind(connection) : value;
   }
 });
-var connection_default = db;
 
-// ../../src/core/security/safeFetch.ts
-var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
-async function safeFetch(input, init = {}, options = {}) {
-  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
-  const maxRedirects = options.maxRedirects ?? 0;
-  const controller = new AbortController;
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    let currentUrl = input;
-    let redirectCount = 0;
-    while (true) {
-      const response = await fetch(currentUrl, {
-        ...init,
-        signal: controller.signal,
-        redirect: "manual"
-      });
-      if (response.status >= 300 && response.status < 400) {
-        const location = response.headers.get("location");
-        if (!location || redirectCount >= maxRedirects) {
-          return response;
-        }
-        currentUrl = new URL(location, currentUrl).toString();
-        redirectCount += 1;
-        continue;
-      }
-      return response;
-    }
-  } finally {
-    clearTimeout(timeout);
-  }
-}
+// ../../src/core/security/safeUrl.ts
+import { lookup as dnsLookupImpl } from "dns/promises";
 
 // ../../src/core/errors/http.ts
 class HttpError extends Error {
@@ -203,8 +179,14 @@ class UnauthorizedError extends HttpError {
     super(401, message, details);
   }
 }
+class PreconditionFailedError extends HttpError {
+  constructor(message = "Precondition Failed", details) {
+    super(412, message, details);
+  }
+}
 
 // ../../src/core/security/safeUrl.ts
+var dnsLookup = dnsLookupImpl;
 var BLOCKED_HOSTNAMES = new Set([
   "localhost",
   "127.0.0.1",
@@ -276,14 +258,63 @@ function assertSafeOutboundUrl(rawUrl, options = {}) {
   }
   return parsed;
 }
+function isBlockedIpAddress(address) {
+  return isBlockedHostname(address.trim().toLowerCase());
+}
+async function assertSafeOutboundUrlResolved(rawUrl, options = {}) {
+  const parsed = assertSafeOutboundUrl(rawUrl, options);
+  if (options.resolveDns === false) {
+    return parsed;
+  }
+  const hostname = parsed.hostname.trim().toLowerCase();
+  const results = await dnsLookup(hostname, { all: true, verbatim: true });
+  if (results.some((result) => isBlockedIpAddress(result.address))) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  return parsed;
+}
+
+// ../../src/core/security/safeFetch.ts
+var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
+async function safeFetch(input, init = {}, options = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const maxRedirects = options.maxRedirects ?? 0;
+  const resolveDns = options.resolveDns ?? appConfig.env === "production";
+  const urlOptions = { allowHttp: options.allowHttp, resolveDns };
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    let currentUrl = (await assertSafeOutboundUrlResolved(input, urlOptions)).toString();
+    let redirectCount = 0;
+    while (true) {
+      const response = await fetch(currentUrl, {
+        ...init,
+        signal: controller.signal,
+        redirect: "manual"
+      });
+      if (response.status >= 300 && response.status < 400) {
+        const location = response.headers.get("location");
+        if (!location || redirectCount >= maxRedirects) {
+          return response;
+        }
+        currentUrl = (await assertSafeOutboundUrlResolved(new URL(location, currentUrl).toString(), urlOptions)).toString();
+        redirectCount += 1;
+        continue;
+      }
+      return response;
+    }
+  } finally {
+    clearTimeout(timeout);
+  }
+}
 
 // ../../src/core/tenant/databaseTenantContext.ts
 async function runWithMigrationBypass(callback) {
-  await connection_default`SELECT set_config('app.bypass_rls', 'true', false)`;
+  await repositoryConnection`SELECT set_config('app.bypass_rls', 'true', false)`;
   try {
     return await callback();
   } finally {
-    await connection_default`SELECT set_config('app.bypass_rls', 'false', false)`;
+    await repositoryConnection`SELECT set_config('app.bypass_rls', 'false', false)`;
   }
 }
 
@@ -340,7 +371,7 @@ async function exportPendingAuditLogs() {
     return 0;
   }
   return await runWithMigrationBypass(async () => {
-    const rows = await connection_default`
+    const rows = await repositoryConnection`
       SELECT
         id,
         user_id,
@@ -384,13 +415,13 @@ async function exportPendingAuditLogs() {
         ...process.env.SIEM_EXPORT_TOKEN ? { authorization: `Bearer ${process.env.SIEM_EXPORT_TOKEN}` } : {}
       },
       body
-    });
+    }, { allowHttp: appConfig.env !== "production" });
     if (!response.ok) {
       throw new Error(`SIEM export failed with status ${response.status}.`);
     }
     const ids = rows.map((row) => row.id);
     for (const id of ids) {
-      await connection_default`UPDATE audit_log SET exported_at = NOW() WHERE id = ${id}`;
+      await repositoryConnection`UPDATE audit_log SET exported_at = NOW() WHERE id = ${id}`;
     }
     return rows.length;
   });
@@ -550,7 +581,8 @@ class ConfigStore {
 }
 var requiredDependencyKeys = [
   "container",
-  "cache"
+  "cache",
+  "storage"
 ];
 function getRequiredDependency(dependencies, key) {
   const dependency = dependencies[key];
@@ -643,6 +675,60 @@ import { SamlProvider } from "@getstrata/core/auth/oauth/samlProvider";
 // ../../src/modules/user/apiTokenRepository.ts
 import { BaseRepository } from "@getstrata/core/database";
 
+// ../../src/config/database.ts
+function readInteger(name, fallback) {
+  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
+  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
+}
+var databaseConfig = {
+  url: process.env.DATABASE_URL ?? "",
+  poolMax: readInteger("DB_POOL_MAX", 10),
+  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
+  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
+  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
+};
+
+// ../../src/db/connection/createConnection.ts
+var {SQL } = globalThis.Bun;
+function createDatabaseConnection(config) {
+  if (!config.url) {
+    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
+  }
+  return new SQL({
+    url: config.url,
+    max: config.poolMax,
+    idleTimeout: config.idleTimeoutSeconds,
+    maxLifetime: config.maxLifetimeSeconds,
+    connectionTimeout: config.connectionTimeoutSeconds
+  });
+}
+
+// ../../src/db/connection/index.ts
+var connectionHolder = {
+  connection: null
+};
+function getDatabase() {
+  if (!connectionHolder.connection) {
+    connectionHolder.connection = createDatabaseConnection(databaseConfig);
+    registerDefaultDatabasePool(connectionHolder.connection);
+  }
+  return connectionHolder.connection;
+}
+function getDb() {
+  getDatabase();
+  return getDefaultDatabaseQuery();
+}
+var db = new Proxy(function database() {}, {
+  apply(_target, _thisArg, args) {
+    return getDb()(...args);
+  },
+  get(_target, property) {
+    const connection = getDb();
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
+  }
+});
+
 // ../../src/modules/user/apiTokenTable.ts
 import { defineTable } from "@getstrata/core/database";
 var apiTokenTable = defineTable({
@@ -1737,17 +1823,20 @@ function resolveApplicationCache() {
 function resolveApplicationQueue() {
   return requireActiveApplicationContext().container.resolve(CORE_QUEUE_TOKEN);
 }
+function resolveApplicationAuth() {
+  return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN);
+}
+function resolveApplicationPolicyGate() {
+  return requireActiveApplicationContext().container.resolve(CORE_POLICY_GATE_TOKEN);
+}
 
 // ../../src/core/jobs/dispatchWebhookJob.ts
 import { createHmac as createHmac2 } from "crypto";
 class DispatchWebhookJob extends Job {
-  constructor() {
-    super();
-  }
   maxAttempts = 3;
   backoffMs = 2000;
   async handle(payload) {
-    const rows = await connection_default`
+    const rows = await repositoryConnection`
       SELECT id, url, secret
       FROM webhook
       WHERE id = ${payload.webhookId} AND active = TRUE
@@ -1770,14 +1859,14 @@ class DispatchWebhookJob extends Job {
           "x-workhub-signature": signature
         },
         body
-      });
+      }, { allowHttp: appConfig.env !== "production" });
       responseStatus = response.status;
       if (!response.ok) {
         throw new Error(`Webhook delivery failed with status ${response.status}.`);
       }
     } catch (error) {
       errorMessage = error instanceof Error ? error.message : String(error);
-      await connection_default`
+      await repositoryConnection`
         INSERT INTO webhook_delivery (webhook_id, event, payload, response_status, error)
         VALUES (
           ${webhook.id},
@@ -1789,7 +1878,7 @@ class DispatchWebhookJob extends Job {
       `;
       throw error instanceof Error ? error : new Error(errorMessage);
     }
-    await connection_default`
+    await repositoryConnection`
       INSERT INTO webhook_delivery (webhook_id, event, payload, response_status)
       VALUES (
         ${webhook.id},
@@ -2369,26 +2458,6 @@ function indexMorphToRelation(children, parentsByType, relation) {
   return result;
 }
 
-// ../../src/core/database/boundConnection.ts
-var boundConnectionHolder = {
-  connection: null
-};
-function getBoundDatabaseConnection() {
-  return boundConnectionHolder.connection;
-}
-
-// ../../src/core/database/repositoryConnection.ts
-function resolveRepositoryConnection() {
-  return getBoundDatabaseConnection() ?? connection_default;
-}
-var repositoryConnection = new Proxy({}, {
-  get(_target, property) {
-    const connection = resolveRepositoryConnection();
-    const value = connection[property];
-    return typeof value === "function" ? value.bind(connection) : value;
-  }
-});
-
 // ../../src/core/database/whereBuilder.ts
 class WhereBuilder {
   nodes = [];
@@ -3816,6 +3885,128 @@ var queueProvider = {
 };
 var queue_default = queueProvider;
 
+// ../../src/core/storage/storage.ts
+import { mkdir, readFile, unlink, writeFile } from "fs/promises";
+import { dirname, join as join3 } from "path";
+var {S3Client } = globalThis.Bun;
+
+class LocalStorageDriver {
+  rootDirectory;
+  constructor(rootDirectory) {
+    this.rootDirectory = rootDirectory;
+  }
+  resolveRootDirectory() {
+    return this.rootDirectory ?? process.env.STORAGE_PATH ?? "storage";
+  }
+  resolvePath(path) {
+    return join3(this.resolveRootDirectory(), path.replace(/^\/+/, ""));
+  }
+  async put(path, contents) {
+    const absolutePath = this.resolvePath(path);
+    await mkdir(dirname(absolutePath), { recursive: true });
+    await writeFile(absolutePath, contents);
+    return path;
+  }
+  async get(path) {
+    try {
+      return await readFile(this.resolvePath(path));
+    } catch {
+      return null;
+    }
+  }
+  async delete(path) {
+    try {
+      await unlink(this.resolvePath(path));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}
+
+class S3StorageDriver {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async put(path, contents) {
+    await this.client.write(path.replace(/^\/+/, ""), contents);
+    return path;
+  }
+  async get(path) {
+    const normalizedPath = path.replace(/^\/+/, "");
+    const file = this.client.file(normalizedPath);
+    if (!await file.exists()) {
+      return null;
+    }
+    return new Uint8Array(await file.arrayBuffer());
+  }
+  async delete(path) {
+    try {
+      await this.client.unlink(path.replace(/^\/+/, ""));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}
+
+class StorageManager {
+  driver;
+  constructor(driver) {
+    this.driver = driver;
+  }
+  put(path, contents) {
+    return this.driver.put(path, contents);
+  }
+  get(path) {
+    return this.driver.get(path);
+  }
+  delete(path) {
+    return this.driver.delete(path);
+  }
+}
+function resolveS3Config() {
+  const accessKeyId = process.env.AWS_ACCESS_KEY_ID?.trim();
+  const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY?.trim();
+  const bucket = process.env.AWS_BUCKET?.trim();
+  if (!accessKeyId || !secretAccessKey || !bucket) {
+    throw new Error('STORAGE_DRIVER="s3" requires AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_BUCKET.');
+  }
+  return {
+    accessKeyId,
+    secretAccessKey,
+    bucket,
+    ...process.env.AWS_REGION?.trim() ? { region: process.env.AWS_REGION.trim() } : {},
+    ...process.env.AWS_ENDPOINT?.trim() ? { endpoint: process.env.AWS_ENDPOINT.trim() } : {}
+  };
+}
+function createS3Client(config = resolveS3Config()) {
+  return new S3Client({
+    accessKeyId: config.accessKeyId,
+    secretAccessKey: config.secretAccessKey,
+    bucket: config.bucket,
+    ...config.region ? { region: config.region } : {},
+    ...config.endpoint ? { endpoint: config.endpoint } : {}
+  });
+}
+function createStorageDriver() {
+  const driver = process.env.STORAGE_DRIVER ?? "local";
+  if (driver === "s3") {
+    return new S3StorageDriver(createS3Client());
+  }
+  return new LocalStorageDriver;
+}
+
+// ../../src/bootstrap/providers/storage.ts
+var storageProvider = {
+  name: "core.storage",
+  register({ dependencies }) {
+    dependencies.storage = new StorageManager(createStorageDriver());
+  }
+};
+var storage_default = storageProvider;
+
 // ../../src/config/frontend.ts
 function readFrontendMode() {
   const mode = (process.env.FRONTEND_MODE ?? "api").trim();
@@ -3842,9 +4033,9 @@ function currentRequestMeta() {
 }
 
 // ../../src/core/view/etaViewEngine.ts
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 import { Eta } from "eta";
-var DEFAULT_VIEWS_DIRECTORY = join3(process.cwd(), "resources/views");
+var DEFAULT_VIEWS_DIRECTORY = join4(process.cwd(), "resources/views");
 var DEFAULT_LAYOUT = "layouts/app.eta";
 
 class EtaViewEngine {
@@ -4069,6 +4260,7 @@ var viewProvider = {
 var coreProviders = [
   config_default,
   cache_default,
+  storage_default,
   auth_default,
   events_default,
   policy_default,
@@ -4169,7 +4361,7 @@ function createAppContext() {
   return appContext;
 }
 // ../../src/bootstrap/createWebRoutes.ts
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 
 // ../../src/core/http/middleware.ts
 function isRouteHandler(value) {
@@ -4503,7 +4695,7 @@ function createWebRoutes(dependencies) {
     registerRoute("GET", "/assets/*", ["global", "web"]);
     const pathname = new URL(request.url).pathname;
     const relativePath = pathname.replace(/^\//, "");
-    const file = Bun.file(join4(process.cwd(), "public", relativePath));
+    const file = Bun.file(join5(process.cwd(), "public", relativePath));
     if (!await file.exists()) {
       return htmlResponse("Not Found", { status: 404 });
     }
@@ -4521,6 +4713,157 @@ function mergeWebRoutes(dependencies, routes) {
     ...routes
   };
 }
+// ../../src/core/crypto/nonCryptographicHash.ts
+function nonCryptographicDigest(input) {
+  return Bun.hash(input).toString(16);
+}
+
+// ../../src/core/http/etag.ts
+function isEtagEnabled() {
+  return (process.env.FEATURE_ETAG ?? "true") !== "false";
+}
+function formatWeakEtag(digest) {
+  return `W/"${digest}"`;
+}
+function etagFromResource(resource) {
+  const version = resource.updated_at ?? resource.created_at ?? "";
+  const versionText = version instanceof Date ? version.toISOString() : version ? String(version) : "0";
+  const digest = nonCryptographicDigest(`${String(resource.id ?? "0")}:${versionText}`).slice(0, 32);
+  return formatWeakEtag(digest);
+}
+function normalizeEtag(value) {
+  return value.trim();
+}
+function etagValuesMatch(left, right) {
+  return normalizeEtag(left) === normalizeEtag(right);
+}
+function parseEtagList(header) {
+  if (!header) {
+    return [];
+  }
+  return header.split(",").map((value) => normalizeEtag(value)).filter(Boolean);
+}
+function ifNoneMatchSatisfied(request, etag) {
+  const header = request.headers.get("if-none-match");
+  if (!header) {
+    return false;
+  }
+  if (header.trim() === "*") {
+    return true;
+  }
+  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
+}
+function ifMatchSatisfied(request, etag) {
+  const header = request.headers.get("if-match");
+  if (!header) {
+    return false;
+  }
+  if (header.trim() === "*") {
+    return true;
+  }
+  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
+}
+function assertIfMatch(request, etag, options = {}) {
+  const header = request.headers.get("if-match");
+  if (!header) {
+    if (options.required) {
+      throw new PreconditionFailedError("If-Match header is required.");
+    }
+    return;
+  }
+  if (!ifMatchSatisfied(request, etag)) {
+    throw new PreconditionFailedError("Resource ETag does not match If-Match.");
+  }
+}
+function applyEtagHeaders(headers, etag) {
+  const next = new Headers(headers);
+  next.set("ETag", etag);
+  next.set("Cache-Control", "private, must-revalidate");
+  next.append("Vary", "Authorization");
+  next.append("Vary", "X-Tenant-Id");
+  return next;
+}
+function notModifiedResponse(etag) {
+  return new Response(null, {
+    status: 304,
+    headers: applyEtagHeaders(new Headers, etag)
+  });
+}
+function applyConditionalGet(request, response, etag) {
+  if (!isEtagEnabled()) {
+    return response;
+  }
+  if (ifNoneMatchSatisfied(request, etag)) {
+    return notModifiedResponse(etag);
+  }
+  const headers = applyEtagHeaders(new Headers(response.headers), etag);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+
+// ../../src/core/tenant/tenantContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
+var tenantContext = new AsyncLocalStorage4;
+
+// ../../src/core/http/validation.ts
+function parsePositiveIntParam(value, name = "id") {
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new BadRequestError(`Invalid ${name}. Expected a positive integer.`);
+  }
+  return parsed;
+}
+
+// ../../src/bootstrap/http/securedRouteModelBinding.ts
+function isMutatingPolicyAction(action) {
+  return action === "update" || action === "delete";
+}
+function securedBindRouteModel(param, resolver, authorization, handler) {
+  return async (request) => {
+    const id = parsePositiveIntParam(String(request.params[param]), String(param));
+    const model = await resolver(id, request);
+    const gate = resolveApplicationPolicyGate();
+    const auth = resolveApplicationAuth();
+    const user = currentAuthUser() ?? await auth.resolve(request);
+    gate.authorize(authorization.resource, authorization.action, user, model);
+    if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
+      assertIfMatch(request, etagFromResource(model), {
+        required: authorization.requireIfMatch ?? true
+      });
+    }
+    const response = await handler(request, model);
+    if (isEtagEnabled() && authorization.action === "view") {
+      return applyConditionalGet(request, response, etagFromResource(model));
+    }
+    return response;
+  };
+}
+function securedBindRouteModelByKey(param, resolver, authorization, handler) {
+  return async (request) => {
+    const key = String(request.params[param] ?? "").trim();
+    if (!key) {
+      throw new BadRequestError(`Missing route parameter "${String(param)}".`);
+    }
+    const model = await resolver(key, request);
+    const gate = resolveApplicationPolicyGate();
+    const auth = resolveApplicationAuth();
+    const user = currentAuthUser() ?? await auth.resolve(request);
+    gate.authorize(authorization.resource, authorization.action, user, model);
+    if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
+      assertIfMatch(request, etagFromResource(model), {
+        required: authorization.requireIfMatch ?? true
+      });
+    }
+    const response = await handler(request, model);
+    if (isEtagEnabled() && authorization.action === "view") {
+      return applyConditionalGet(request, response, etagFromResource(model));
+    }
+    return response;
+  };
+}
 // ../../src/bootstrap/prefixRouteMap.ts
 function prefixRouteMap(prefix, routes) {
   const normalizedPrefix = prefix.replace(/\/$/, "");
@@ -4580,7 +4923,7 @@ async function parseFormBody(request) {
   return { fields, files };
 }
 // ../../src/bootstrap/web/routing.ts
-import { securedBindRouteModelByKey, withErrorHandling } from "@getstrata/core";
+import { withErrorHandling } from "@getstrata/core";
 function routeParams(request) {
   const normalized = {};
   const raw = request.params;
@@ -4755,6 +5098,8 @@ export {
   toRouteRequest,
   slugify,
   setActiveApplicationContext2 as setActiveApplicationContext,
+  securedBindRouteModelByKey,
+  securedBindRouteModel,
   scheduleRunCommand,
   runProviderPhase,
   runDueScheduledTasks,