@getstrata/bootstrap 0.2.64 → 0.2.66

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @getstrata/bootstrap changelog
 
+## 0.2.66
+
+- `assertProductionSecrets()` is feature-gated for every app. API tokens no longer imply WorkHub’s encryption/CORS/OAuth/public-read checklist. Published test token strings are still denied. WorkHub’s extra production profile lives in the app (`src/config/productionSecrets.ts`).
+- **Breaking:** `HttpKernel.wrapWebGuest()` defaults `home` to `/` instead of `/organizations`. Apps with an org home should pass that path (WorkHub already does).
+- `createWebRoutes()` no longer seeds a `/` → `/organizations` redirect. The in-repo app owns `/` via its organization module.
+
+## 0.2.65
+
+- App listener discovery reads `src/listeners` from `process.cwd()` so a built `@getstrata/bootstrap` bundle still finds WorkHub registrars (`import.meta.dir` after `build:bootstrap` is the package dist). Listener boot calls each registrar every time (registrars are idempotent per `eventBus`).
+
 ## 0.2.64
 
 - `registerDefaultJobs()` no longer registers WorkHub `webhook.dispatch`. Apps that dispatch model webhooks should call `registerWebhookJobs()` (WorkHub’s webhook provider and `queue:work` do).

package/README.md

@@ -28,14 +28,14 @@ import {
 import { createHttpKernel, createAppContext, coreProviders } from "@getstrata/bootstrap";
 ```
 
-`createAppContext()` does not call `assertProductionSecrets`. WorkHub calls that from `App.serve()` / `queue:work`. Sibling HTMX apps can call it in production without WorkHub API tokens when feature flags are off — see [SIBLING-HTMX.md](../../docs/SIBLING-HTMX.md).
+`createAppContext()` does not call `assertProductionSecrets`. That helper is feature-gated for every app (tokens, CORS, OAuth, encryption only when those features are on). WorkHub also runs its own production extras from `App.serve()` / `queue:work`. Sibling HTMX apps can call the published helper without API tokens when feature flags are off — see [SIBLING-HTMX.md](../../docs/SIBLING-HTMX.md).
 
-Sibling HTMX apps should bind `createCookieSessionAuthManager` from `@getstrata/bootstrap/web/session` instead of HMAC `SessionGuard`. Use `signIn` / `signOut` (or the redirect helpers) instead of calling `CookieSessionStore` from controllers. Pass `mapUser` to map roles in the app. Pass `loadSessionUser` when the default `learn_subscriber` / `is_admin` SELECT does not match your schema. WorkHub’s table is `sessions` (`0031_create_sessions`); its loader is `loadWorkhubSessionUser` (maps `users.role`, decrypts email). WorkHub web login itself stays on HMAC `SessionGuard`.
+Sibling HTMX apps should bind `createCookieSessionAuthManager` from `@getstrata/bootstrap/web/session` instead of HMAC `SessionGuard`. Use `signIn` / `signOut` (or the redirect helpers) instead of calling `CookieSessionStore` from controllers. Pass `mapUser` to map roles in the app. Pass `loadSessionUser` when the default `learn_subscriber` / `is_admin` SELECT does not match your schema.
 
-`wrapWeb` applies the web group (CSRF + flash) and `withErrorHandling`, so CSRF `ForbiddenError` becomes an HTML 403 in `FRONTEND_MODE=server-htmx`. `wrapWebGuest` is Laravel `guest` / `RedirectIfAuthenticated` (signed-in users go to `/organizations` by default; pass a string or `(user) => path` to override). `wrapWebLogin` / `wrapWebRegister` include that web group plus throttle — do not wrap them with `wrapWeb` again. The throttle callback should return an HTML form at 429 (WorkHub’s `/login` and `/register` do).
+`wrapWeb` applies the web group (CSRF + flash) and `withErrorHandling`, so CSRF `ForbiddenError` becomes an HTML 403 in `FRONTEND_MODE=server-htmx`. `wrapWebGuest` is Laravel `guest` / `RedirectIfAuthenticated` (signed-in users go to `/` by default; pass a string or `(user) => path` to override). `wrapWebLogin` / `wrapWebRegister` include that web group plus throttle — do not wrap them with `wrapWeb` again. The throttle callback should return an HTML form at 429.
 
-`registerDefaultJobs()` registers `cache.invalidate-tags` and `audit.export` only. WorkHub webhook dispatch is `registerWebhookJobs()` in the app webhook provider.
+`registerDefaultJobs()` registers `cache.invalidate-tags` and `audit.export` only. Apps that dispatch model webhooks should call `registerWebhookJobs()` themselves.
 
-These subpaths remain WorkHub-oriented and are not a generic starter API: `@getstrata/bootstrap/createRoutes` (includes SCIM), `@getstrata/bootstrap/schedule`, and `@getstrata/bootstrap/createWebRoutes` (redirects `/` to `/organizations`).
+These subpaths assemble the in-repo dogfood app and are not a generic starter API: `@getstrata/bootstrap/createRoutes` (includes SCIM), `@getstrata/bootstrap/schedule`, and `@getstrata/bootstrap/createWebRoutes` (discovers app `webRoutes`; `/` is owned by the app). Sibling apps should use `buildWebModuleRoutes` / `buildModuleRoutes`.
 
 See the [strata](https://github.com/EyK-26/strata) monorepo reference app for full module patterns.

package/dist/bootstrap/rateLimit.d.ts

@@ -0,0 +1,10 @@
+interface LoginRateLimitConfig {
+    maxAttempts: number;
+    decaySeconds: number;
+}
+declare const LOCAL_LOGIN_RATE_LIMIT: LoginRateLimitConfig;
+declare const PRODUCTION_LOGIN_RATE_LIMIT: LoginRateLimitConfig;
+declare function resolveLoginRateLimit(): LoginRateLimitConfig;
+declare function resolveRegisterRateLimit(): LoginRateLimitConfig;
+export type { LoginRateLimitConfig };
+export { LOCAL_LOGIN_RATE_LIMIT, PRODUCTION_LOGIN_RATE_LIMIT, resolveLoginRateLimit, resolveRegisterRateLimit, };

package/dist/entries/buildModuleRoutes.js

@@ -39,7 +39,33 @@ import { isPublicReadsEnabled } from "@getstrata/core/security/publicReads";
 import { createTenantMiddleware } from "@getstrata/core/tenant/tenantMiddleware";
 import { createTracingMiddleware } from "@getstrata/core/tracing/tracingMiddleware";
 
-// ../../src/config/rateLimit.ts
+// ../../src/bootstrap/config.ts
+import {
+  CORE_ABILITY_CHECKER_TOKEN,
+  CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
+  CORE_CACHE_TOKEN,
+  CORE_CONFIG_TOKEN,
+  CORE_EVENT_BUS_TOKEN,
+  CORE_POLICY_GATE_TOKEN,
+  CORE_QUEUE_TOKEN,
+  CORE_TOKEN_SERVICE_TOKEN
+} from "@getstrata/core/contracts/serviceTokens";
+var APP_PORT_CONFIG_KEY = "app.port";
+var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
+var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
+var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
+var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
+var DATABASE_URL_CONFIG_KEY = "database.url";
+var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
+var DEFAULT_APP_PORT = 3000;
+var DEFAULT_CACHE_TTL_MS = 3600000;
+var DEFAULT_CACHE_MAX_ENTRIES = 100;
+var DEFAULT_CACHE_DRIVER = "array";
+var DEFAULT_API_TOKEN = "";
+var DEFAULT_QUEUE_DRIVER = "sync";
+
+// ../../src/bootstrap/rateLimit.ts
 var LOCAL_LOGIN_RATE_LIMIT = {
   maxAttempts: 100,
   decaySeconds: 60
@@ -85,32 +111,6 @@ function resolveRegisterRateLimit() {
   };
 }
 
-// ../../src/bootstrap/config.ts
-import {
-  CORE_ABILITY_CHECKER_TOKEN,
-  CORE_AUTH_TOKEN,
-  CORE_AUTH_USER_DIRECTORY_TOKEN,
-  CORE_CACHE_TOKEN,
-  CORE_CONFIG_TOKEN,
-  CORE_EVENT_BUS_TOKEN,
-  CORE_POLICY_GATE_TOKEN,
-  CORE_QUEUE_TOKEN,
-  CORE_TOKEN_SERVICE_TOKEN
-} from "@getstrata/core/contracts/serviceTokens";
-var APP_PORT_CONFIG_KEY = "app.port";
-var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
-var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
-var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
-var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
-var DATABASE_URL_CONFIG_KEY = "database.url";
-var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
-var DEFAULT_APP_PORT = 3000;
-var DEFAULT_CACHE_TTL_MS = 3600000;
-var DEFAULT_CACHE_MAX_ENTRIES = 100;
-var DEFAULT_CACHE_DRIVER = "array";
-var DEFAULT_API_TOKEN = "";
-var DEFAULT_QUEUE_DRIVER = "sync";
-
 // ../../src/bootstrap/httpKernel.ts
 class HttpKernel {
   dependencies;
@@ -181,7 +181,7 @@ class HttpKernel {
   wrapWeb(handler) {
     return withErrorHandling(this.wrap("web", handler));
   }
-  wrapWebGuest(handler, home = "/organizations") {
+  wrapWebGuest(handler, home = "/") {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     return this.wrapWeb(async (request) => {
       const user = await auth.resolve(request);
@@ -351,7 +351,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. The app preload (or starter) should call it.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);

package/dist/entries/buildWebModuleRoutes.js

@@ -42,7 +42,33 @@ import { isPublicReadsEnabled } from "@getstrata/core/security/publicReads";
 import { createTenantMiddleware } from "@getstrata/core/tenant/tenantMiddleware";
 import { createTracingMiddleware } from "@getstrata/core/tracing/tracingMiddleware";
 
-// ../../src/config/rateLimit.ts
+// ../../src/bootstrap/config.ts
+import {
+  CORE_ABILITY_CHECKER_TOKEN,
+  CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
+  CORE_CACHE_TOKEN,
+  CORE_CONFIG_TOKEN,
+  CORE_EVENT_BUS_TOKEN,
+  CORE_POLICY_GATE_TOKEN,
+  CORE_QUEUE_TOKEN,
+  CORE_TOKEN_SERVICE_TOKEN
+} from "@getstrata/core/contracts/serviceTokens";
+var APP_PORT_CONFIG_KEY = "app.port";
+var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
+var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
+var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
+var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
+var DATABASE_URL_CONFIG_KEY = "database.url";
+var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
+var DEFAULT_APP_PORT = 3000;
+var DEFAULT_CACHE_TTL_MS = 3600000;
+var DEFAULT_CACHE_MAX_ENTRIES = 100;
+var DEFAULT_CACHE_DRIVER = "array";
+var DEFAULT_API_TOKEN = "";
+var DEFAULT_QUEUE_DRIVER = "sync";
+
+// ../../src/bootstrap/rateLimit.ts
 var LOCAL_LOGIN_RATE_LIMIT = {
   maxAttempts: 100,
   decaySeconds: 60
@@ -88,32 +114,6 @@ function resolveRegisterRateLimit() {
   };
 }
 
-// ../../src/bootstrap/config.ts
-import {
-  CORE_ABILITY_CHECKER_TOKEN,
-  CORE_AUTH_TOKEN,
-  CORE_AUTH_USER_DIRECTORY_TOKEN,
-  CORE_CACHE_TOKEN,
-  CORE_CONFIG_TOKEN,
-  CORE_EVENT_BUS_TOKEN,
-  CORE_POLICY_GATE_TOKEN,
-  CORE_QUEUE_TOKEN,
-  CORE_TOKEN_SERVICE_TOKEN
-} from "@getstrata/core/contracts/serviceTokens";
-var APP_PORT_CONFIG_KEY = "app.port";
-var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
-var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
-var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
-var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
-var DATABASE_URL_CONFIG_KEY = "database.url";
-var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
-var DEFAULT_APP_PORT = 3000;
-var DEFAULT_CACHE_TTL_MS = 3600000;
-var DEFAULT_CACHE_MAX_ENTRIES = 100;
-var DEFAULT_CACHE_DRIVER = "array";
-var DEFAULT_API_TOKEN = "";
-var DEFAULT_QUEUE_DRIVER = "sync";
-
 // ../../src/bootstrap/httpKernel.ts
 class HttpKernel {
   dependencies;
@@ -184,7 +184,7 @@ class HttpKernel {
   wrapWeb(handler) {
     return withErrorHandling(this.wrap("web", handler));
   }
-  wrapWebGuest(handler, home = "/organizations") {
+  wrapWebGuest(handler, home = "/") {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     return this.wrapWeb(async (request) => {
       const user = await auth.resolve(request);
@@ -354,7 +354,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. The app preload (or starter) should call it.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);

package/dist/entries/cache/modelCacheTags.js

@@ -26,7 +26,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. The app preload (or starter) should call it.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);

package/dist/entries/context.js

@@ -50,7 +50,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. The app preload (or starter) should call it.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);
@@ -170,7 +170,7 @@ import { validateEnv } from "@getstrata/core/config/envSchema";
 
 // ../../src/config/app.ts
 var appConfig = {
-  name: process.env.APP_NAME?.trim() || "WorkHub",
+  name: process.env.APP_NAME?.trim() || "Strata",
   env: process.env.APP_ENV ?? "local",
   debug: (process.env.APP_DEBUG ?? "true") !== "false",
   url: process.env.APP_URL ?? "http://localhost:3000",
@@ -329,14 +329,21 @@ var eventsProvider = {
 var events_default = eventsProvider;
 
 // ../../src/bootstrap/discoverListeners.ts
-import { readdirSync as readdirSync2 } from "fs";
+import { existsSync, readdirSync as readdirSync2 } from "fs";
 import { join as join2 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
+function resolveListenersDirectory() {
+  const fromCwd = join2(process.cwd(), "src", "listeners");
+  if (existsSync(fromCwd)) {
+    return fromCwd;
+  }
+  return join2(import.meta.dir, "../listeners");
+}
 async function loadDiscoveredListeners() {
-  const listenersDirectory = join2(import.meta.dir, "../listeners");
+  const listenersDirectory = resolveListenersDirectory();
   let entries;
   try {
-    entries = readdirSync2(listenersDirectory, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".ts")).map((entry) => entry.name);
+    entries = readdirSync2(listenersDirectory, { withFileTypes: true }).filter((entry) => entry.isFile() && /\.(ts|js)$/.test(entry.name)).map((entry) => entry.name);
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return [];
@@ -412,8 +419,8 @@ var listenersProvider = {
     registerListenerGroup("cache.invalidate-on-model-write", () => {
       registerInvalidateCacheOnModelWriteListeners();
     });
-    for (const [index, registerListener] of discoverListeners().entries()) {
-      registerListenerGroup(`app.listener.${index}`, registerListener);
+    for (const registerListener of discoverListeners()) {
+      registerListener();
     }
   }
 };

package/dist/entries/createRoutes.js

@@ -12,7 +12,7 @@ var strata_default = __jsonParse("{\"index\":\"_.._/_.._/index.html\",\"files\":
 
 // ../../src/config/app.ts
 var appConfig = {
-  name: process.env.APP_NAME?.trim() || "WorkHub",
+  name: process.env.APP_NAME?.trim() || "Strata",
   env: process.env.APP_ENV ?? "local",
   debug: (process.env.APP_DEBUG ?? "true") !== "false",
   url: process.env.APP_URL ?? "http://localhost:3000",
@@ -79,7 +79,33 @@ import { isPublicReadsEnabled } from "@getstrata/core/security/publicReads";
 import { createTenantMiddleware } from "@getstrata/core/tenant/tenantMiddleware";
 import { createTracingMiddleware } from "@getstrata/core/tracing/tracingMiddleware";
 
-// ../../src/config/rateLimit.ts
+// ../../src/bootstrap/config.ts
+import {
+  CORE_ABILITY_CHECKER_TOKEN,
+  CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
+  CORE_CACHE_TOKEN,
+  CORE_CONFIG_TOKEN,
+  CORE_EVENT_BUS_TOKEN,
+  CORE_POLICY_GATE_TOKEN,
+  CORE_QUEUE_TOKEN,
+  CORE_TOKEN_SERVICE_TOKEN
+} from "@getstrata/core/contracts/serviceTokens";
+var APP_PORT_CONFIG_KEY = "app.port";
+var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
+var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
+var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
+var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
+var DATABASE_URL_CONFIG_KEY = "database.url";
+var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
+var DEFAULT_APP_PORT = 3000;
+var DEFAULT_CACHE_TTL_MS = 3600000;
+var DEFAULT_CACHE_MAX_ENTRIES = 100;
+var DEFAULT_CACHE_DRIVER = "array";
+var DEFAULT_API_TOKEN = "";
+var DEFAULT_QUEUE_DRIVER = "sync";
+
+// ../../src/bootstrap/rateLimit.ts
 var LOCAL_LOGIN_RATE_LIMIT = {
   maxAttempts: 100,
   decaySeconds: 60
@@ -125,32 +151,6 @@ function resolveRegisterRateLimit() {
   };
 }
 
-// ../../src/bootstrap/config.ts
-import {
-  CORE_ABILITY_CHECKER_TOKEN,
-  CORE_AUTH_TOKEN,
-  CORE_AUTH_USER_DIRECTORY_TOKEN,
-  CORE_CACHE_TOKEN,
-  CORE_CONFIG_TOKEN,
-  CORE_EVENT_BUS_TOKEN,
-  CORE_POLICY_GATE_TOKEN,
-  CORE_QUEUE_TOKEN,
-  CORE_TOKEN_SERVICE_TOKEN
-} from "@getstrata/core/contracts/serviceTokens";
-var APP_PORT_CONFIG_KEY = "app.port";
-var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
-var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
-var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
-var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
-var DATABASE_URL_CONFIG_KEY = "database.url";
-var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
-var DEFAULT_APP_PORT = 3000;
-var DEFAULT_CACHE_TTL_MS = 3600000;
-var DEFAULT_CACHE_MAX_ENTRIES = 100;
-var DEFAULT_CACHE_DRIVER = "array";
-var DEFAULT_API_TOKEN = "";
-var DEFAULT_QUEUE_DRIVER = "sync";
-
 // ../../src/bootstrap/httpKernel.ts
 class HttpKernel {
   dependencies;
@@ -221,7 +221,7 @@ class HttpKernel {
   wrapWeb(handler) {
     return withErrorHandling(this.wrap("web", handler));
   }
-  wrapWebGuest(handler, home = "/organizations") {
+  wrapWebGuest(handler, home = "/") {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     return this.wrapWeb(async (request) => {
       const user = await auth.resolve(request);
@@ -391,7 +391,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. The app preload (or starter) should call it.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);
@@ -584,10 +584,7 @@ function registerRoute(method, path, middleware) {
 }
 function createWebRoutes(dependencies) {
   const wrappedRoutes = buildWebModuleRoutes(dependencies, {
-    clearRegistry: false,
-    seedRoutes: {
-      "/": () => Response.redirect("/organizations", 302)
-    }
+    clearRegistry: false
   });
   registerRoute("GET", "/", ["global", "web"]);
   wrappedRoutes["/assets/*"] = async (request) => {
@@ -1122,6 +1119,14 @@ var ADMIN_ABILITIES = [
   "webhooks:write",
   "audit:read"
 ];
+// ../../src/modules/user/browserSessions.ts
+import {
+  createSessionCookieDetails,
+  readSession
+} from "@getstrata/core/auth/sessionCookie";
+import { repositoryConnection as db2 } from "@getstrata/core/database/repositoryConnection";
+import { BadRequestError } from "@getstrata/core/errors/http";
+
 // ../../src/modules/user/mfaRequiredError.ts
 import { UnauthorizedError } from "@getstrata/core/errors/http";
 
@@ -1157,7 +1162,7 @@ var oauthIdentityTable = defineTable4({
 // ../../src/modules/user/passwordResetService.ts
 import { hashPassword as hashPassword2 } from "@getstrata/core/auth/password";
 import { hashApiToken } from "@getstrata/core/auth/tokenHash";
-import { repositoryConnection as db2 } from "@getstrata/core/database/repositoryConnection";
+import { repositoryConnection as db3 } from "@getstrata/core/database/repositoryConnection";
 import { ValidationError as ValidationError2 } from "@getstrata/core/errors/http";
 import { absoluteTemporarySignedUrl } from "@getstrata/core/http/signedUrl";
 import { mailer } from "@getstrata/core/mail/mailer";
@@ -1169,7 +1174,7 @@ var RESET_TTL_SECONDS = 60 * 60;
 var VERIFY_TTL_SECONDS = 60 * 60 * 24;
 
 // ../../src/modules/user/profilePhotoService.ts
-import { BadRequestError, NotFoundError as NotFoundError5 } from "@getstrata/core/errors/http";
+import { BadRequestError as BadRequestError2, NotFoundError as NotFoundError5 } from "@getstrata/core/errors/http";
 import { isImageMimeType, resizeImageContents } from "@getstrata/core/media/imageTransform";
 
 // ../../src/modules/user/repository.ts

package/dist/entries/createWebRoutes.js

@@ -47,7 +47,33 @@ import { isPublicReadsEnabled } from "@getstrata/core/security/publicReads";
 import { createTenantMiddleware } from "@getstrata/core/tenant/tenantMiddleware";
 import { createTracingMiddleware } from "@getstrata/core/tracing/tracingMiddleware";
 
-// ../../src/config/rateLimit.ts
+// ../../src/bootstrap/config.ts
+import {
+  CORE_ABILITY_CHECKER_TOKEN,
+  CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
+  CORE_CACHE_TOKEN,
+  CORE_CONFIG_TOKEN,
+  CORE_EVENT_BUS_TOKEN,
+  CORE_POLICY_GATE_TOKEN,
+  CORE_QUEUE_TOKEN,
+  CORE_TOKEN_SERVICE_TOKEN
+} from "@getstrata/core/contracts/serviceTokens";
+var APP_PORT_CONFIG_KEY = "app.port";
+var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
+var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
+var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
+var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
+var DATABASE_URL_CONFIG_KEY = "database.url";
+var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
+var DEFAULT_APP_PORT = 3000;
+var DEFAULT_CACHE_TTL_MS = 3600000;
+var DEFAULT_CACHE_MAX_ENTRIES = 100;
+var DEFAULT_CACHE_DRIVER = "array";
+var DEFAULT_API_TOKEN = "";
+var DEFAULT_QUEUE_DRIVER = "sync";
+
+// ../../src/bootstrap/rateLimit.ts
 var LOCAL_LOGIN_RATE_LIMIT = {
   maxAttempts: 100,
   decaySeconds: 60
@@ -93,32 +119,6 @@ function resolveRegisterRateLimit() {
   };
 }
 
-// ../../src/bootstrap/config.ts
-import {
-  CORE_ABILITY_CHECKER_TOKEN,
-  CORE_AUTH_TOKEN,
-  CORE_AUTH_USER_DIRECTORY_TOKEN,
-  CORE_CACHE_TOKEN,
-  CORE_CONFIG_TOKEN,
-  CORE_EVENT_BUS_TOKEN,
-  CORE_POLICY_GATE_TOKEN,
-  CORE_QUEUE_TOKEN,
-  CORE_TOKEN_SERVICE_TOKEN
-} from "@getstrata/core/contracts/serviceTokens";
-var APP_PORT_CONFIG_KEY = "app.port";
-var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
-var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
-var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
-var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
-var DATABASE_URL_CONFIG_KEY = "database.url";
-var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
-var DEFAULT_APP_PORT = 3000;
-var DEFAULT_CACHE_TTL_MS = 3600000;
-var DEFAULT_CACHE_MAX_ENTRIES = 100;
-var DEFAULT_CACHE_DRIVER = "array";
-var DEFAULT_API_TOKEN = "";
-var DEFAULT_QUEUE_DRIVER = "sync";
-
 // ../../src/bootstrap/httpKernel.ts
 class HttpKernel {
   dependencies;
@@ -189,7 +189,7 @@ class HttpKernel {
   wrapWeb(handler) {
     return withErrorHandling(this.wrap("web", handler));
   }
-  wrapWebGuest(handler, home = "/organizations") {
+  wrapWebGuest(handler, home = "/") {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     return this.wrapWeb(async (request) => {
       const user = await auth.resolve(request);
@@ -359,7 +359,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. The app preload (or starter) should call it.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);
@@ -508,10 +508,7 @@ function registerRoute(method, path, middleware) {
 }
 function createWebRoutes(dependencies) {
   const wrappedRoutes = buildWebModuleRoutes(dependencies, {
-    clearRegistry: false,
-    seedRoutes: {
-      "/": () => Response.redirect("/organizations", 302)
-    }
+    clearRegistry: false
   });
   registerRoute("GET", "/", ["global", "web"]);
   wrappedRoutes["/assets/*"] = async (request) => {

package/dist/entries/dependencies.js

@@ -50,7 +50,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. The app preload (or starter) should call it.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);
@@ -170,7 +170,7 @@ import { validateEnv } from "@getstrata/core/config/envSchema";
 
 // ../../src/config/app.ts
 var appConfig = {
-  name: process.env.APP_NAME?.trim() || "WorkHub",
+  name: process.env.APP_NAME?.trim() || "Strata",
   env: process.env.APP_ENV ?? "local",
   debug: (process.env.APP_DEBUG ?? "true") !== "false",
   url: process.env.APP_URL ?? "http://localhost:3000",
@@ -329,14 +329,21 @@ var eventsProvider = {
 var events_default = eventsProvider;
 
 // ../../src/bootstrap/discoverListeners.ts
-import { readdirSync as readdirSync2 } from "fs";
+import { existsSync, readdirSync as readdirSync2 } from "fs";
 import { join as join2 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
+function resolveListenersDirectory() {
+  const fromCwd = join2(process.cwd(), "src", "listeners");
+  if (existsSync(fromCwd)) {
+    return fromCwd;
+  }
+  return join2(import.meta.dir, "../listeners");
+}
 async function loadDiscoveredListeners() {
-  const listenersDirectory = join2(import.meta.dir, "../listeners");
+  const listenersDirectory = resolveListenersDirectory();
   let entries;
   try {
-    entries = readdirSync2(listenersDirectory, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".ts")).map((entry) => entry.name);
+    entries = readdirSync2(listenersDirectory, { withFileTypes: true }).filter((entry) => entry.isFile() && /\.(ts|js)$/.test(entry.name)).map((entry) => entry.name);
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return [];
@@ -412,8 +419,8 @@ var listenersProvider = {
     registerListenerGroup("cache.invalidate-on-model-write", () => {
       registerInvalidateCacheOnModelWriteListeners();
     });
-    for (const [index, registerListener] of discoverListeners().entries()) {
-      registerListenerGroup(`app.listener.${index}`, registerListener);
+    for (const registerListener of discoverListeners()) {
+      registerListener();
     }
   }
 };

package/dist/entries/discoverModules.js

@@ -26,7 +26,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. The app preload (or starter) should call it.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);

package/dist/entries/httpKernel.js

@@ -35,7 +35,33 @@ import { isPublicReadsEnabled } from "@getstrata/core/security/publicReads";
 import { createTenantMiddleware } from "@getstrata/core/tenant/tenantMiddleware";
 import { createTracingMiddleware } from "@getstrata/core/tracing/tracingMiddleware";
 
-// ../../src/config/rateLimit.ts
+// ../../src/bootstrap/config.ts
+import {
+  CORE_ABILITY_CHECKER_TOKEN,
+  CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
+  CORE_CACHE_TOKEN,
+  CORE_CONFIG_TOKEN,
+  CORE_EVENT_BUS_TOKEN,
+  CORE_POLICY_GATE_TOKEN,
+  CORE_QUEUE_TOKEN,
+  CORE_TOKEN_SERVICE_TOKEN
+} from "@getstrata/core/contracts/serviceTokens";
+var APP_PORT_CONFIG_KEY = "app.port";
+var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
+var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
+var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
+var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
+var DATABASE_URL_CONFIG_KEY = "database.url";
+var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
+var DEFAULT_APP_PORT = 3000;
+var DEFAULT_CACHE_TTL_MS = 3600000;
+var DEFAULT_CACHE_MAX_ENTRIES = 100;
+var DEFAULT_CACHE_DRIVER = "array";
+var DEFAULT_API_TOKEN = "";
+var DEFAULT_QUEUE_DRIVER = "sync";
+
+// ../../src/bootstrap/rateLimit.ts
 var LOCAL_LOGIN_RATE_LIMIT = {
   maxAttempts: 100,
   decaySeconds: 60
@@ -81,32 +107,6 @@ function resolveRegisterRateLimit() {
   };
 }
 
-// ../../src/bootstrap/config.ts
-import {
-  CORE_ABILITY_CHECKER_TOKEN,
-  CORE_AUTH_TOKEN,
-  CORE_AUTH_USER_DIRECTORY_TOKEN,
-  CORE_CACHE_TOKEN,
-  CORE_CONFIG_TOKEN,
-  CORE_EVENT_BUS_TOKEN,
-  CORE_POLICY_GATE_TOKEN,
-  CORE_QUEUE_TOKEN,
-  CORE_TOKEN_SERVICE_TOKEN
-} from "@getstrata/core/contracts/serviceTokens";
-var APP_PORT_CONFIG_KEY = "app.port";
-var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
-var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
-var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
-var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
-var DATABASE_URL_CONFIG_KEY = "database.url";
-var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
-var DEFAULT_APP_PORT = 3000;
-var DEFAULT_CACHE_TTL_MS = 3600000;
-var DEFAULT_CACHE_MAX_ENTRIES = 100;
-var DEFAULT_CACHE_DRIVER = "array";
-var DEFAULT_API_TOKEN = "";
-var DEFAULT_QUEUE_DRIVER = "sync";
-
 // ../../src/bootstrap/httpKernel.ts
 class HttpKernel {
   dependencies;
@@ -177,7 +177,7 @@ class HttpKernel {
   wrapWeb(handler) {
     return withErrorHandling(this.wrap("web", handler));
   }
-  wrapWebGuest(handler, home = "/organizations") {
+  wrapWebGuest(handler, home = "/") {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     return this.wrapWeb(async (request) => {
       const user = await auth.resolve(request);

package/dist/entries/listeners/invalidateCacheOnModelWrite.js

@@ -44,7 +44,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. The app preload (or starter) should call it.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);

package/dist/entries/providers.js

@@ -81,7 +81,7 @@ import { validateEnv } from "@getstrata/core/config/envSchema";
 
 // ../../src/config/app.ts
 var appConfig = {
-  name: process.env.APP_NAME?.trim() || "WorkHub",
+  name: process.env.APP_NAME?.trim() || "Strata",
   env: process.env.APP_ENV ?? "local",
   debug: (process.env.APP_DEBUG ?? "true") !== "false",
   url: process.env.APP_URL ?? "http://localhost:3000",
@@ -240,14 +240,21 @@ var eventsProvider = {
 var events_default = eventsProvider;
 
 // ../../src/bootstrap/discoverListeners.ts
-import { readdirSync } from "fs";
+import { existsSync, readdirSync } from "fs";
 import { join } from "path";
 import { pathToFileURL } from "url";
+function resolveListenersDirectory() {
+  const fromCwd = join(process.cwd(), "src", "listeners");
+  if (existsSync(fromCwd)) {
+    return fromCwd;
+  }
+  return join(import.meta.dir, "../listeners");
+}
 async function loadDiscoveredListeners() {
-  const listenersDirectory = join(import.meta.dir, "../listeners");
+  const listenersDirectory = resolveListenersDirectory();
   let entries;
   try {
-    entries = readdirSync(listenersDirectory, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".ts")).map((entry) => entry.name);
+    entries = readdirSync(listenersDirectory, { withFileTypes: true }).filter((entry) => entry.isFile() && /\.(ts|js)$/.test(entry.name)).map((entry) => entry.name);
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return [];
@@ -309,7 +316,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. The app preload (or starter) should call it.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);
@@ -402,8 +409,8 @@ var listenersProvider = {
     registerListenerGroup("cache.invalidate-on-model-write", () => {
       registerInvalidateCacheOnModelWriteListeners();
     });
-    for (const [index, registerListener] of discoverListeners().entries()) {
-      registerListenerGroup(`app.listener.${index}`, registerListener);
+    for (const registerListener of discoverListeners()) {
+      registerListener();
     }
   }
 };

package/dist/entries/secretsGuard.js

@@ -2,12 +2,15 @@
 var __jsonParse = (a) => JSON.parse(a);
 
 // ../../src/bootstrap/secretsGuard.ts
-var DEFAULT_ADMIN_API_TOKEN = "workhub-admin-test-token";
-var DEFAULT_MEMBER_API_TOKEN = "workhub-member-test-token";
-var DEFAULT_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
+var PUBLISHED_TEST_ADMIN_API_TOKEN = "workhub-admin-test-token";
+var PUBLISHED_TEST_MEMBER_API_TOKEN = "workhub-member-test-token";
+var PUBLISHED_TEST_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
 var MIN_SESSION_SECRET_LENGTH = 32;
-var DEFAULT_TOKENS = new Set([DEFAULT_ADMIN_API_TOKEN, DEFAULT_MEMBER_API_TOKEN]);
-var DEFAULT_SCIM_TOKENS = new Set([DEFAULT_SCIM_BEARER_TOKEN]);
+var PUBLISHED_TEST_TOKENS = new Set([
+  PUBLISHED_TEST_ADMIN_API_TOKEN,
+  PUBLISHED_TEST_MEMBER_API_TOKEN
+]);
+var PUBLISHED_TEST_SCIM_TOKENS = new Set([PUBLISHED_TEST_SCIM_BEARER_TOKEN]);
 function isEnabled(value, defaultEnabled) {
   if (value === undefined) {
     return defaultEnabled;
@@ -34,36 +37,19 @@ function assertSessionSecret(env) {
     throw new Error("Production startup blocked: set SESSION_SECRET when FRONTEND_MODE=server-htmx (32+ characters).");
   }
 }
-function assertWorkHubProductionSecrets(env) {
-  const adminToken = env.ADMIN_API_TOKEN ?? DEFAULT_ADMIN_API_TOKEN;
-  const memberToken = env.MEMBER_API_TOKEN ?? DEFAULT_MEMBER_API_TOKEN;
-  const scimToken = env.SCIM_BEARER_TOKEN ?? DEFAULT_SCIM_BEARER_TOKEN;
-  const encryptionEnabled = isEnabled(env.FEATURE_FIELD_ENCRYPTION, true);
-  if (DEFAULT_TOKENS.has(adminToken) || DEFAULT_TOKENS.has(memberToken)) {
-    throw new Error("Production startup blocked: rotate ADMIN_API_TOKEN and MEMBER_API_TOKEN away from default WorkHub test values.");
-  }
-  if (DEFAULT_SCIM_TOKENS.has(scimToken)) {
-    throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from default WorkHub test values.");
-  }
-  if (encryptionEnabled && !env.KMS_ENCRYPTION_KEY?.trim()) {
-    throw new Error("Production startup blocked: set KMS_ENCRYPTION_KEY when field encryption is enabled.");
-  }
-  if (!env.SIEM_EXPORT_URL?.trim() && isEnabled(env.FEATURE_SIEM_EXPORT, true)) {
-    console.warn("[secrets] SIEM_EXPORT_URL is not configured; audit logs remain database-only.");
-  }
-  if (isEnabled(env.FEATURE_BILLING, true) && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
-    throw new Error("Production startup blocked: set STRIPE_WEBHOOK_SECRET when billing webhooks are enabled.");
+function assertPublishedTestTokensRotated(env) {
+  const adminToken = env.ADMIN_API_TOKEN ?? "";
+  const memberToken = env.MEMBER_API_TOKEN ?? "";
+  const scimToken = env.SCIM_BEARER_TOKEN ?? "";
+  if (PUBLISHED_TEST_TOKENS.has(adminToken) || PUBLISHED_TEST_TOKENS.has(memberToken)) {
+    throw new Error("Production startup blocked: rotate ADMIN_API_TOKEN and MEMBER_API_TOKEN away from published test defaults.");
   }
-  const corsOrigins = (env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim());
-  if (corsOrigins.includes("*")) {
-    throw new Error("Production startup blocked: set explicit CORS_ALLOWED_ORIGINS instead of wildcard.");
-  }
-  if (isEnabled(env.FEATURE_PUBLIC_READS, true)) {
-    throw new Error("Production startup blocked: set FEATURE_PUBLIC_READS=false for authenticated-only reads.");
-  }
-  if (!env.OAUTH_STATE_SECRET?.trim()) {
-    throw new Error("Production startup blocked: set OAUTH_STATE_SECRET for OAuth CSRF protection.");
+  if (scimToken && PUBLISHED_TEST_SCIM_TOKENS.has(scimToken)) {
+    throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from published test defaults.");
   }
+}
+function assertTokenAuthProductionSecrets(env) {
+  assertPublishedTestTokensRotated(env);
   if (!env.TOKEN_HASH_PEPPER?.trim()) {
     throw new Error("Production startup blocked: set TOKEN_HASH_PEPPER for API token hashing.");
   }
@@ -71,11 +57,11 @@ function assertWorkHubProductionSecrets(env) {
     throw new Error("Production startup blocked: set API_TOKEN_DEFAULT_EXPIRY_DAYS to enforce token rotation.");
   }
 }
-function assertSiblingProductionSecrets(env) {
+function assertFeatureProductionSecrets(env) {
   if (isEnabled(env.FEATURE_SCIM, false)) {
-    const scimToken = env.SCIM_BEARER_TOKEN ?? DEFAULT_SCIM_BEARER_TOKEN;
-    if (DEFAULT_SCIM_TOKENS.has(scimToken) || !env.SCIM_BEARER_TOKEN?.trim()) {
-      throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from default WorkHub test values.");
+    const scimToken = env.SCIM_BEARER_TOKEN ?? PUBLISHED_TEST_SCIM_BEARER_TOKEN;
+    if (PUBLISHED_TEST_SCIM_TOKENS.has(scimToken) || !env.SCIM_BEARER_TOKEN?.trim()) {
+      throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from published test defaults.");
     }
   }
   if (isEnabled(env.FEATURE_FIELD_ENCRYPTION, false) && !env.KMS_ENCRYPTION_KEY?.trim()) {
@@ -107,10 +93,9 @@ function assertProductionSecrets(env = process.env) {
   }
   assertAuthDevHeadersDisabled(env);
   if (isTokenAuthEnabled(env)) {
-    assertWorkHubProductionSecrets(env);
-  } else {
-    assertSiblingProductionSecrets(env);
+    assertTokenAuthProductionSecrets(env);
   }
+  assertFeatureProductionSecrets(env);
   const frontendMode = (env.FRONTEND_MODE ?? "api").trim();
   if (frontendMode === "server-htmx") {
     assertSessionSecret(env);

package/dist/entries/web/routing.js

@@ -44,7 +44,33 @@ import { isPublicReadsEnabled } from "@getstrata/core/security/publicReads";
 import { createTenantMiddleware } from "@getstrata/core/tenant/tenantMiddleware";
 import { createTracingMiddleware } from "@getstrata/core/tracing/tracingMiddleware";
 
-// ../../src/config/rateLimit.ts
+// ../../src/bootstrap/config.ts
+import {
+  CORE_ABILITY_CHECKER_TOKEN,
+  CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
+  CORE_CACHE_TOKEN,
+  CORE_CONFIG_TOKEN,
+  CORE_EVENT_BUS_TOKEN,
+  CORE_POLICY_GATE_TOKEN,
+  CORE_QUEUE_TOKEN,
+  CORE_TOKEN_SERVICE_TOKEN
+} from "@getstrata/core/contracts/serviceTokens";
+var APP_PORT_CONFIG_KEY = "app.port";
+var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
+var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
+var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
+var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
+var DATABASE_URL_CONFIG_KEY = "database.url";
+var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
+var DEFAULT_APP_PORT = 3000;
+var DEFAULT_CACHE_TTL_MS = 3600000;
+var DEFAULT_CACHE_MAX_ENTRIES = 100;
+var DEFAULT_CACHE_DRIVER = "array";
+var DEFAULT_API_TOKEN = "";
+var DEFAULT_QUEUE_DRIVER = "sync";
+
+// ../../src/bootstrap/rateLimit.ts
 var LOCAL_LOGIN_RATE_LIMIT = {
   maxAttempts: 100,
   decaySeconds: 60
@@ -90,32 +116,6 @@ function resolveRegisterRateLimit() {
   };
 }
 
-// ../../src/bootstrap/config.ts
-import {
-  CORE_ABILITY_CHECKER_TOKEN,
-  CORE_AUTH_TOKEN,
-  CORE_AUTH_USER_DIRECTORY_TOKEN,
-  CORE_CACHE_TOKEN,
-  CORE_CONFIG_TOKEN,
-  CORE_EVENT_BUS_TOKEN,
-  CORE_POLICY_GATE_TOKEN,
-  CORE_QUEUE_TOKEN,
-  CORE_TOKEN_SERVICE_TOKEN
-} from "@getstrata/core/contracts/serviceTokens";
-var APP_PORT_CONFIG_KEY = "app.port";
-var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
-var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
-var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
-var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
-var DATABASE_URL_CONFIG_KEY = "database.url";
-var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
-var DEFAULT_APP_PORT = 3000;
-var DEFAULT_CACHE_TTL_MS = 3600000;
-var DEFAULT_CACHE_MAX_ENTRIES = 100;
-var DEFAULT_CACHE_DRIVER = "array";
-var DEFAULT_API_TOKEN = "";
-var DEFAULT_QUEUE_DRIVER = "sync";
-
 // ../../src/bootstrap/httpKernel.ts
 class HttpKernel {
   dependencies;
@@ -186,7 +186,7 @@ class HttpKernel {
   wrapWeb(handler) {
     return withErrorHandling(this.wrap("web", handler));
   }
-  wrapWebGuest(handler, home = "/organizations") {
+  wrapWebGuest(handler, home = "/") {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     return this.wrapWeb(async (request) => {
       const user = await auth.resolve(request);

package/dist/index.js

@@ -52,7 +52,32 @@ import { isPublicReadsEnabled } from "@getstrata/core/security/publicReads";
 import { createTenantMiddleware } from "@getstrata/core/tenant/tenantMiddleware";
 import { createTracingMiddleware } from "@getstrata/core/tracing/tracingMiddleware";
 
-// ../../src/config/rateLimit.ts
+// ../../src/bootstrap/config.ts
+import {
+  CORE_ABILITY_CHECKER_TOKEN,
+  CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
+  CORE_CACHE_TOKEN,
+  CORE_CONFIG_TOKEN,
+  CORE_EVENT_BUS_TOKEN,
+  CORE_POLICY_GATE_TOKEN,
+  CORE_QUEUE_TOKEN,
+  CORE_TOKEN_SERVICE_TOKEN
+} from "@getstrata/core/contracts/serviceTokens";
+var APP_PORT_CONFIG_KEY = "app.port";
+var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
+var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
+var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
+var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
+var DATABASE_URL_CONFIG_KEY = "database.url";
+var DEFAULT_APP_PORT = 3000;
+var DEFAULT_CACHE_TTL_MS = 3600000;
+var DEFAULT_CACHE_MAX_ENTRIES = 100;
+var DEFAULT_CACHE_DRIVER = "array";
+var DEFAULT_API_TOKEN = "";
+var DEFAULT_QUEUE_DRIVER = "sync";
+
+// ../../src/bootstrap/rateLimit.ts
 var LOCAL_LOGIN_RATE_LIMIT = {
   maxAttempts: 100,
   decaySeconds: 60
@@ -98,31 +123,6 @@ function resolveRegisterRateLimit() {
   };
 }
 
-// ../../src/bootstrap/config.ts
-import {
-  CORE_ABILITY_CHECKER_TOKEN,
-  CORE_AUTH_TOKEN,
-  CORE_AUTH_USER_DIRECTORY_TOKEN,
-  CORE_CACHE_TOKEN,
-  CORE_CONFIG_TOKEN,
-  CORE_EVENT_BUS_TOKEN,
-  CORE_POLICY_GATE_TOKEN,
-  CORE_QUEUE_TOKEN,
-  CORE_TOKEN_SERVICE_TOKEN
-} from "@getstrata/core/contracts/serviceTokens";
-var APP_PORT_CONFIG_KEY = "app.port";
-var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
-var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
-var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
-var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
-var DATABASE_URL_CONFIG_KEY = "database.url";
-var DEFAULT_APP_PORT = 3000;
-var DEFAULT_CACHE_TTL_MS = 3600000;
-var DEFAULT_CACHE_MAX_ENTRIES = 100;
-var DEFAULT_CACHE_DRIVER = "array";
-var DEFAULT_API_TOKEN = "";
-var DEFAULT_QUEUE_DRIVER = "sync";
-
 // ../../src/bootstrap/httpKernel.ts
 class HttpKernel {
   dependencies;
@@ -193,7 +193,7 @@ class HttpKernel {
   wrapWeb(handler) {
     return withErrorHandling(this.wrap("web", handler));
   }
-  wrapWebGuest(handler, home = "/organizations") {
+  wrapWebGuest(handler, home = "/") {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     return this.wrapWeb(async (request) => {
       const user = await auth.resolve(request);
@@ -363,7 +363,7 @@ function resolveModulesDirectory(options) {
   if (state.configuredModulesDir) {
     return state.configuredModulesDir;
   }
-  throw new Error("configureModulesDirectory() must be called before discovering modules. WorkHub and the starter do this from preload.");
+  throw new Error("configureModulesDirectory() must be called before discovering modules. The app preload (or starter) should call it.");
 }
 async function loadDiscoveredModules(options) {
   const modulesDirectory = resolveModulesDirectory(options);
@@ -575,7 +575,7 @@ import { validateEnv } from "@getstrata/core/config/envSchema";
 
 // ../../src/config/app.ts
 var appConfig = {
-  name: process.env.APP_NAME?.trim() || "WorkHub",
+  name: process.env.APP_NAME?.trim() || "Strata",
   env: process.env.APP_ENV ?? "local",
   debug: (process.env.APP_DEBUG ?? "true") !== "false",
   url: process.env.APP_URL ?? "http://localhost:3000",
@@ -734,14 +734,21 @@ var eventsProvider = {
 var events_default = eventsProvider;
 
 // ../../src/bootstrap/discoverListeners.ts
-import { readdirSync as readdirSync2 } from "fs";
+import { existsSync, readdirSync as readdirSync2 } from "fs";
 import { join as join2 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
+function resolveListenersDirectory() {
+  const fromCwd = join2(process.cwd(), "src", "listeners");
+  if (existsSync(fromCwd)) {
+    return fromCwd;
+  }
+  return join2(import.meta.dir, "../listeners");
+}
 async function loadDiscoveredListeners() {
-  const listenersDirectory = join2(import.meta.dir, "../listeners");
+  const listenersDirectory = resolveListenersDirectory();
   let entries;
   try {
-    entries = readdirSync2(listenersDirectory, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".ts")).map((entry) => entry.name);
+    entries = readdirSync2(listenersDirectory, { withFileTypes: true }).filter((entry) => entry.isFile() && /\.(ts|js)$/.test(entry.name)).map((entry) => entry.name);
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return [];
@@ -803,8 +810,8 @@ var listenersProvider = {
     registerListenerGroup("cache.invalidate-on-model-write", () => {
       registerInvalidateCacheOnModelWriteListeners();
     });
-    for (const [index, registerListener] of discoverListeners().entries()) {
-      registerListenerGroup(`app.listener.${index}`, registerListener);
+    for (const registerListener of discoverListeners()) {
+      registerListener();
     }
   }
 };
@@ -1113,10 +1120,7 @@ function registerRoute(method, path, middleware) {
 }
 function createWebRoutes(dependencies) {
   const wrappedRoutes = buildWebModuleRoutes(dependencies, {
-    clearRegistry: false,
-    seedRoutes: {
-      "/": () => Response.redirect("/organizations", 302)
-    }
+    clearRegistry: false
   });
   registerRoute("GET", "/", ["global", "web"]);
   wrappedRoutes["/assets/*"] = async (request) => {
@@ -1248,12 +1252,15 @@ import {
 // ../../src/bootstrap/membershipService.ts
 import { resolveMembershipService } from "@getstrata/core/auth/membershipService";
 // ../../src/bootstrap/secretsGuard.ts
-var DEFAULT_ADMIN_API_TOKEN = "workhub-admin-test-token";
-var DEFAULT_MEMBER_API_TOKEN = "workhub-member-test-token";
-var DEFAULT_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
+var PUBLISHED_TEST_ADMIN_API_TOKEN = "workhub-admin-test-token";
+var PUBLISHED_TEST_MEMBER_API_TOKEN = "workhub-member-test-token";
+var PUBLISHED_TEST_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
 var MIN_SESSION_SECRET_LENGTH = 32;
-var DEFAULT_TOKENS = new Set([DEFAULT_ADMIN_API_TOKEN, DEFAULT_MEMBER_API_TOKEN]);
-var DEFAULT_SCIM_TOKENS = new Set([DEFAULT_SCIM_BEARER_TOKEN]);
+var PUBLISHED_TEST_TOKENS = new Set([
+  PUBLISHED_TEST_ADMIN_API_TOKEN,
+  PUBLISHED_TEST_MEMBER_API_TOKEN
+]);
+var PUBLISHED_TEST_SCIM_TOKENS = new Set([PUBLISHED_TEST_SCIM_BEARER_TOKEN]);
 function isEnabled(value, defaultEnabled) {
   if (value === undefined) {
     return defaultEnabled;
@@ -1280,36 +1287,19 @@ function assertSessionSecret(env) {
     throw new Error("Production startup blocked: set SESSION_SECRET when FRONTEND_MODE=server-htmx (32+ characters).");
   }
 }
-function assertWorkHubProductionSecrets(env) {
-  const adminToken = env.ADMIN_API_TOKEN ?? DEFAULT_ADMIN_API_TOKEN;
-  const memberToken = env.MEMBER_API_TOKEN ?? DEFAULT_MEMBER_API_TOKEN;
-  const scimToken = env.SCIM_BEARER_TOKEN ?? DEFAULT_SCIM_BEARER_TOKEN;
-  const encryptionEnabled = isEnabled(env.FEATURE_FIELD_ENCRYPTION, true);
-  if (DEFAULT_TOKENS.has(adminToken) || DEFAULT_TOKENS.has(memberToken)) {
-    throw new Error("Production startup blocked: rotate ADMIN_API_TOKEN and MEMBER_API_TOKEN away from default WorkHub test values.");
-  }
-  if (DEFAULT_SCIM_TOKENS.has(scimToken)) {
-    throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from default WorkHub test values.");
-  }
-  if (encryptionEnabled && !env.KMS_ENCRYPTION_KEY?.trim()) {
-    throw new Error("Production startup blocked: set KMS_ENCRYPTION_KEY when field encryption is enabled.");
-  }
-  if (!env.SIEM_EXPORT_URL?.trim() && isEnabled(env.FEATURE_SIEM_EXPORT, true)) {
-    console.warn("[secrets] SIEM_EXPORT_URL is not configured; audit logs remain database-only.");
+function assertPublishedTestTokensRotated(env) {
+  const adminToken = env.ADMIN_API_TOKEN ?? "";
+  const memberToken = env.MEMBER_API_TOKEN ?? "";
+  const scimToken = env.SCIM_BEARER_TOKEN ?? "";
+  if (PUBLISHED_TEST_TOKENS.has(adminToken) || PUBLISHED_TEST_TOKENS.has(memberToken)) {
+    throw new Error("Production startup blocked: rotate ADMIN_API_TOKEN and MEMBER_API_TOKEN away from published test defaults.");
   }
-  if (isEnabled(env.FEATURE_BILLING, true) && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
-    throw new Error("Production startup blocked: set STRIPE_WEBHOOK_SECRET when billing webhooks are enabled.");
-  }
-  const corsOrigins = (env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim());
-  if (corsOrigins.includes("*")) {
-    throw new Error("Production startup blocked: set explicit CORS_ALLOWED_ORIGINS instead of wildcard.");
-  }
-  if (isEnabled(env.FEATURE_PUBLIC_READS, true)) {
-    throw new Error("Production startup blocked: set FEATURE_PUBLIC_READS=false for authenticated-only reads.");
-  }
-  if (!env.OAUTH_STATE_SECRET?.trim()) {
-    throw new Error("Production startup blocked: set OAUTH_STATE_SECRET for OAuth CSRF protection.");
+  if (scimToken && PUBLISHED_TEST_SCIM_TOKENS.has(scimToken)) {
+    throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from published test defaults.");
   }
+}
+function assertTokenAuthProductionSecrets(env) {
+  assertPublishedTestTokensRotated(env);
   if (!env.TOKEN_HASH_PEPPER?.trim()) {
     throw new Error("Production startup blocked: set TOKEN_HASH_PEPPER for API token hashing.");
   }
@@ -1317,11 +1307,11 @@ function assertWorkHubProductionSecrets(env) {
     throw new Error("Production startup blocked: set API_TOKEN_DEFAULT_EXPIRY_DAYS to enforce token rotation.");
   }
 }
-function assertSiblingProductionSecrets(env) {
+function assertFeatureProductionSecrets(env) {
   if (isEnabled(env.FEATURE_SCIM, false)) {
-    const scimToken = env.SCIM_BEARER_TOKEN ?? DEFAULT_SCIM_BEARER_TOKEN;
-    if (DEFAULT_SCIM_TOKENS.has(scimToken) || !env.SCIM_BEARER_TOKEN?.trim()) {
-      throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from default WorkHub test values.");
+    const scimToken = env.SCIM_BEARER_TOKEN ?? PUBLISHED_TEST_SCIM_BEARER_TOKEN;
+    if (PUBLISHED_TEST_SCIM_TOKENS.has(scimToken) || !env.SCIM_BEARER_TOKEN?.trim()) {
+      throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from published test defaults.");
     }
   }
   if (isEnabled(env.FEATURE_FIELD_ENCRYPTION, false) && !env.KMS_ENCRYPTION_KEY?.trim()) {
@@ -1353,10 +1343,9 @@ function assertProductionSecrets(env = process.env) {
   }
   assertAuthDevHeadersDisabled(env);
   if (isTokenAuthEnabled(env)) {
-    assertWorkHubProductionSecrets(env);
-  } else {
-    assertSiblingProductionSecrets(env);
+    assertTokenAuthProductionSecrets(env);
   }
+  assertFeatureProductionSecrets(env);
   const frontendMode = (env.FRONTEND_MODE ?? "api").trim();
   if (frontendMode === "server-htmx") {
     assertSessionSecret(env);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/bootstrap",
-  "version": "0.2.64",
+  "version": "0.2.66",
   "description": "Strata application bootstrap — HttpKernel, DI, web session helpers",
   "type": "module",
   "license": "MIT",
@@ -173,7 +173,7 @@
     "build:bundle": "bun build index.ts --outdir dist --target bun --external bun --external eta --external @getstrata/core",
     "build:types": "tsc -p tsconfig.types.json && bun ../../scripts/prune-bootstrap-dist-types.ts",
     "prepublishOnly": "bun run build",
-    "build:subpaths": "bun build entries/applicationRegistry.ts entries/buildModuleRoutes.ts entries/buildWebModuleRoutes.ts entries/cache/modelCacheTags.ts entries/config.ts entries/context.ts entries/contracts.ts entries/createWebRoutes.ts entries/createRoutes.ts entries/createSpaRoutes.ts entries/dependencies.ts entries/discoverModules.ts entries/health.ts entries/http/securedRouteModelBinding.ts entries/httpKernel.ts entries/listeners/invalidateCacheOnModelWrite.ts entries/membershipService.ts entries/metricsRoutes.ts entries/queue/defaultJobs.ts entries/providers.ts entries/providers/view.ts entries/routeRegistry.ts entries/schedule.ts entries/secretsGuard.ts entries/web/forms.ts entries/web/routing.ts entries/web/server.ts entries/web/session.ts entries/web/slug.ts --outdir dist --root . --target bun --external bun --external eta --external @getstrata/core --external @getstrata/bootstrap --external @getstrata/bootstrap/applicationRegistry --external @getstrata/bootstrap/buildModuleRoutes --external @getstrata/bootstrap/buildWebModuleRoutes --external @getstrata/bootstrap/cache/modelCacheTags --external @getstrata/bootstrap/config --external @getstrata/bootstrap/context --external @getstrata/bootstrap/contracts --external @getstrata/bootstrap/createWebRoutes --external @getstrata/bootstrap/createRoutes --external @getstrata/bootstrap/createSpaRoutes --external @getstrata/bootstrap/dependencies --external @getstrata/bootstrap/discoverModules --external @getstrata/bootstrap/health --external @getstrata/bootstrap/http/securedRouteModelBinding --external @getstrata/bootstrap/httpKernel --external @getstrata/bootstrap/listeners/invalidateCacheOnModelWrite --external @getstrata/bootstrap/membershipService --external @getstrata/bootstrap/metricsRoutes --external @getstrata/bootstrap/queue/defaultJobs --external @getstrata/bootstrap/providers --external @getstrata/bootstrap/providers/view --external @getstrata/bootstrap/routeRegistry --external @getstrata/bootstrap/schedule --external @getstrata/bootstrap/secretsGuard --external @getstrata/bootstrap/web/forms --external @getstrata/bootstrap/web/routing --external @getstrata/bootstrap/web/server --external @getstrata/bootstrap/web/session --external @getstrata/bootstrap/web/slug --external @getstrata/core/auth/accessControl --external @getstrata/core/auth/abilityChecker --external @getstrata/core/auth/authContext --external @getstrata/core/auth/emailVerification --external @getstrata/core/auth/guard --external @getstrata/core/auth/membershipContext --external @getstrata/core/auth/membershipMiddleware --external @getstrata/core/auth/membershipScope --external @getstrata/core/auth/membershipService --external @getstrata/core/auth/oauth/oidcProvider --external @getstrata/core/auth/oauth/providers --external @getstrata/core/auth/oauth/samlProvider --external @getstrata/core/auth/oauth/types --external @getstrata/core/auth/password --external @getstrata/core/auth/intendedUrlCookie --external @getstrata/core/auth/passwordConfirmCookie --external @getstrata/core/auth/policy --external @getstrata/core/auth/scimAuthMiddleware --external @getstrata/core/auth/sessionCookie --external @getstrata/core/auth/sessionGuard --external @getstrata/core/auth/tokenHash --external @getstrata/core/audit/exportAuditLogs --external @getstrata/core/audit/siemFormatter --external @getstrata/core/admin/formatValue --external @getstrata/core/admin/registry --external @getstrata/core/admin/types --external @getstrata/core/cache/tags --external @getstrata/core/cache/createCacheStore --external @getstrata/core/cache/repository --external @getstrata/core/cache/simpleCache --external @getstrata/core/cache/simpleCacheStore --external @getstrata/core/config/envSchema --external @getstrata/core/contracts/serviceTokens --external @getstrata/core/contracts/container --external @getstrata/core/contracts/di --external @getstrata/core/crypto/fieldEncryption --external @getstrata/core/crypto/mfaSecret --external @getstrata/core/database --external @getstrata/core/database/baseRepository --external @getstrata/core/database/bindConnection --external @getstrata/core/database/boundConnection --external @getstrata/core/database/bunSql --external @getstrata/core/database/connection --external @getstrata/core/database/defaultConnection --external @getstrata/core/database/errors --external @getstrata/core/database/factory --external @getstrata/core/database/migrations --external @getstrata/core/database/migrations/types --external @getstrata/core/database/model --external @getstrata/core/database/query --external @getstrata/core/database/relationships --external @getstrata/core/database/repositoryConnection --external @getstrata/core/database/repositoryQuery --external @getstrata/core/database/seeders --external @getstrata/core/database/seeders/types --external @getstrata/core/database/schema --external @getstrata/core/database/table --external @getstrata/core/database/transaction --external @getstrata/core/database/types --external @getstrata/core/database/whereBuilder --external @getstrata/core/errors/http --external @getstrata/core/events --external @getstrata/core/facades --external @getstrata/core/http --external @getstrata/core/http/authMiddleware --external @getstrata/core/http/authorizeMiddleware --external @getstrata/core/http/bodySizeLimitMiddleware --external @getstrata/core/http/clientIp --external @getstrata/core/http/cookies --external @getstrata/core/http/contentNegotiation --external @getstrata/core/http/contentSecurityPolicy --external @getstrata/core/http/conditionalResponse --external @getstrata/core/http/corsMiddleware --external @getstrata/core/http/csrfMiddleware --external @getstrata/core/http/csrfProtection --external @getstrata/core/http/csrfToken --external @getstrata/core/http/etag --external @getstrata/core/http/flashSession --external @getstrata/core/http/flashMiddleware --external @getstrata/core/http/formRequest --external @getstrata/core/http/middleware --external @getstrata/core/http/metricsMiddleware --external @getstrata/core/http/loginThrottleMiddleware --external @getstrata/core/http/memoryThrottleMiddleware --external @getstrata/core/http/pagination --external @getstrata/core/http/parseFormBody --external @getstrata/core/http/parseMultipartUpload --external @getstrata/core/http/requireAbilityMiddleware --external @getstrata/core/http/requireAuthMiddleware --external @getstrata/core/http/requireGlobalAdminMiddleware --external @getstrata/core/http/requireWebAuthMiddleware --external @getstrata/core/http/requireVerifiedMiddleware --external @getstrata/core/http/requirePasswordConfirmMiddleware --external @getstrata/core/http/resources --external @getstrata/core/http/response --external @getstrata/core/http/route --external @getstrata/core/http/routeMiddleware --external @getstrata/core/http/routeModelBinding --external @getstrata/core/http/safeInternalPath --external @getstrata/core/http/signedUrl --external @getstrata/core/http/scimThrottleMiddleware --external @getstrata/core/http/securityHeadersMiddleware --external @getstrata/core/http/securedRouteModelBinding --external @getstrata/core/http/requestMetaContext --external @getstrata/core/http/webErrorResponse --external @getstrata/core/http/webFormRequest --external @getstrata/core/http/throttleMiddleware --external @getstrata/core/http/validation --external @getstrata/core/jobs/dispatchWebhookJob --external @getstrata/core/jobs/exportAuditLogsJob --external @getstrata/core/jobs/invalidateCacheTagsJob --external @getstrata/core/lifecycle/gracefulShutdown --external @getstrata/core/logging/logger --external @getstrata/core/logging/requestLoggingMiddleware --external @getstrata/core/mail/mailer --external @getstrata/core/mail/markdownMail --external @getstrata/core/mail/markdownMailable --external @getstrata/core/mail/sanitizeMailHtml --external @getstrata/core/media/imageTransform --external @getstrata/core/metrics/prometheus --external @getstrata/core/notifications --external @getstrata/core/openapi/generator --external @getstrata/core/openapi/registeredRoute --external @getstrata/core/openapi/validate --external @getstrata/core/pagination --external @getstrata/core/queue --external @getstrata/core/queue/createAppQueue --external @getstrata/core/queue/failedJobRepository --external @getstrata/core/queue/failedJobService --external @getstrata/core/queue/jobRegistry --external @getstrata/core/queue/jobRunner --external @getstrata/core/queue/queueMetrics --external @getstrata/core/queue/publicQueue --external @getstrata/core/queue/redisQueue --external @getstrata/core/queue/types --external @getstrata/core/runtime/appKeyPrefix --external @getstrata/core/runtime/frontendMode --external @getstrata/core/runtime/applicationRegistry --external @getstrata/core/runtime/asyncContextStore --external @getstrata/core/scheduler/schedule --external @getstrata/core/scheduler/osCron --external @getstrata/core/security/oauthState --external @getstrata/core/security/publicReads --external @getstrata/core/security/recoveryCodes --external @getstrata/core/security/safeFetch --external @getstrata/core/security/safeUrl --external @getstrata/core/security/scimTenantTokens --external @getstrata/core/security/securityEvents --external @getstrata/core/security/stripeWebhook --external @getstrata/core/security/timingSafeCompare --external @getstrata/core/security/tokenExpiry --external @getstrata/core/security/totp --external @getstrata/core/storage/storage --external @getstrata/core/tenant/tenancyConfig --external @getstrata/core/tenant/tenantContext --external @getstrata/core/tenant/tenantDatabaseScope --external @getstrata/core/tenant/databaseTenantContext --external @getstrata/core/tenant/tenantMiddleware --external @getstrata/core/terminal/runShell --external @getstrata/core/tracing/traceContext --external @getstrata/core/tracing/tracingMiddleware --external @getstrata/core/validation/rules --external @getstrata/core/view",
+    "build:subpaths": "bun build entries/applicationRegistry.ts entries/buildModuleRoutes.ts entries/buildWebModuleRoutes.ts entries/cache/modelCacheTags.ts entries/config.ts entries/context.ts entries/contracts.ts entries/createWebRoutes.ts entries/createRoutes.ts entries/createSpaRoutes.ts entries/dependencies.ts entries/discoverModules.ts entries/health.ts entries/http/securedRouteModelBinding.ts entries/httpKernel.ts entries/listeners/invalidateCacheOnModelWrite.ts entries/membershipService.ts entries/metricsRoutes.ts entries/queue/defaultJobs.ts entries/providers.ts entries/providers/view.ts entries/routeRegistry.ts entries/schedule.ts entries/secretsGuard.ts entries/web/forms.ts entries/web/routing.ts entries/web/server.ts entries/web/session.ts entries/web/slug.ts --outdir dist --root . --target bun --external bun --external eta --external @getstrata/core --external @getstrata/bootstrap --external @getstrata/bootstrap/applicationRegistry --external @getstrata/bootstrap/buildModuleRoutes --external @getstrata/bootstrap/buildWebModuleRoutes --external @getstrata/bootstrap/cache/modelCacheTags --external @getstrata/bootstrap/config --external @getstrata/bootstrap/context --external @getstrata/bootstrap/contracts --external @getstrata/bootstrap/createWebRoutes --external @getstrata/bootstrap/createRoutes --external @getstrata/bootstrap/createSpaRoutes --external @getstrata/bootstrap/dependencies --external @getstrata/bootstrap/discoverModules --external @getstrata/bootstrap/health --external @getstrata/bootstrap/http/securedRouteModelBinding --external @getstrata/bootstrap/httpKernel --external @getstrata/bootstrap/listeners/invalidateCacheOnModelWrite --external @getstrata/bootstrap/membershipService --external @getstrata/bootstrap/metricsRoutes --external @getstrata/bootstrap/queue/defaultJobs --external @getstrata/bootstrap/providers --external @getstrata/bootstrap/providers/view --external @getstrata/bootstrap/routeRegistry --external @getstrata/bootstrap/schedule --external @getstrata/bootstrap/secretsGuard --external @getstrata/bootstrap/web/forms --external @getstrata/bootstrap/web/routing --external @getstrata/bootstrap/web/server --external @getstrata/bootstrap/web/session --external @getstrata/bootstrap/web/slug --external @getstrata/core/auth/accessControl --external @getstrata/core/auth/abilityChecker --external @getstrata/core/auth/authContext --external @getstrata/core/auth/emailVerification --external @getstrata/core/auth/guard --external @getstrata/core/auth/membershipContext --external @getstrata/core/auth/membershipMiddleware --external @getstrata/core/auth/membershipScope --external @getstrata/core/auth/membershipService --external @getstrata/core/auth/oauth/oidcProvider --external @getstrata/core/auth/oauth/providers --external @getstrata/core/auth/oauth/samlProvider --external @getstrata/core/auth/oauth/types --external @getstrata/core/auth/password --external @getstrata/core/auth/intendedUrlCookie --external @getstrata/core/auth/passwordConfirmCookie --external @getstrata/core/auth/policy --external @getstrata/core/auth/scimAuthMiddleware --external @getstrata/core/auth/sessionCookie --external @getstrata/core/auth/sessionGuard --external @getstrata/core/auth/tokenHash --external @getstrata/core/audit/exportAuditLogs --external @getstrata/core/audit/siemFormatter --external @getstrata/core/admin/formatValue --external @getstrata/core/admin/registry --external @getstrata/core/admin/types --external @getstrata/core/cache/tags --external @getstrata/core/cache/createCacheStore --external @getstrata/core/cache/repository --external @getstrata/core/cache/simpleCache --external @getstrata/core/cache/simpleCacheStore --external @getstrata/core/config/envSchema --external @getstrata/core/contracts/serviceTokens --external @getstrata/core/contracts/container --external @getstrata/core/contracts/di --external @getstrata/core/crypto/fieldEncryption --external @getstrata/core/crypto/mfaSecret --external @getstrata/core/database --external @getstrata/core/database/baseRepository --external @getstrata/core/database/bindConnection --external @getstrata/core/database/boundConnection --external @getstrata/core/database/bunSql --external @getstrata/core/database/connection --external @getstrata/core/database/defaultConnection --external @getstrata/core/database/errors --external @getstrata/core/database/factory --external @getstrata/core/database/migrations --external @getstrata/core/database/migrations/types --external @getstrata/core/database/model --external @getstrata/core/database/query --external @getstrata/core/database/relationships --external @getstrata/core/database/repositoryConnection --external @getstrata/core/database/repositoryQuery --external @getstrata/core/database/seeders --external @getstrata/core/database/seeders/types --external @getstrata/core/database/schema --external @getstrata/core/database/table --external @getstrata/core/database/transaction --external @getstrata/core/database/types --external @getstrata/core/database/whereBuilder --external @getstrata/core/errors/http --external @getstrata/core/events --external @getstrata/core/facades --external @getstrata/core/http --external @getstrata/core/http/authMiddleware --external @getstrata/core/http/authorizeMiddleware --external @getstrata/core/http/bodySizeLimitMiddleware --external @getstrata/core/http/clientIp --external @getstrata/core/http/cookies --external @getstrata/core/http/contentNegotiation --external @getstrata/core/http/contentSecurityPolicy --external @getstrata/core/http/conditionalResponse --external @getstrata/core/http/corsMiddleware --external @getstrata/core/http/csrfMiddleware --external @getstrata/core/http/csrfProtection --external @getstrata/core/http/csrfToken --external @getstrata/core/http/etag --external @getstrata/core/http/flashSession --external @getstrata/core/http/flashMiddleware --external @getstrata/core/http/formRequest --external @getstrata/core/http/middleware --external @getstrata/core/http/metricsMiddleware --external @getstrata/core/http/loginThrottleMiddleware --external @getstrata/core/http/memoryThrottleMiddleware --external @getstrata/core/http/pagination --external @getstrata/core/http/parseFormBody --external @getstrata/core/http/parseMultipartUpload --external @getstrata/core/http/requireAbilityMiddleware --external @getstrata/core/http/requireAuthMiddleware --external @getstrata/core/http/requireGlobalAdminMiddleware --external @getstrata/core/http/requireWebAuthMiddleware --external @getstrata/core/http/requireVerifiedMiddleware --external @getstrata/core/http/requirePasswordConfirmMiddleware --external @getstrata/core/http/resources --external @getstrata/core/http/response --external @getstrata/core/http/route --external @getstrata/core/http/routeMiddleware --external @getstrata/core/http/routeModelBinding --external @getstrata/core/http/safeInternalPath --external @getstrata/core/http/signedUrl --external @getstrata/core/http/scimThrottleMiddleware --external @getstrata/core/http/securityHeadersMiddleware --external @getstrata/core/http/securedRouteModelBinding --external @getstrata/core/http/requestMetaContext --external @getstrata/core/http/webErrorResponse --external @getstrata/core/http/webFormRequest --external @getstrata/core/http/throttleMiddleware --external @getstrata/core/http/validation --external @getstrata/core/jobs/exportAuditLogsJob --external @getstrata/core/jobs/invalidateCacheTagsJob --external @getstrata/core/lifecycle/gracefulShutdown --external @getstrata/core/logging/logger --external @getstrata/core/logging/requestLoggingMiddleware --external @getstrata/core/mail/mailer --external @getstrata/core/mail/markdownMail --external @getstrata/core/mail/markdownMailable --external @getstrata/core/mail/sanitizeMailHtml --external @getstrata/core/media/imageTransform --external @getstrata/core/metrics/prometheus --external @getstrata/core/notifications --external @getstrata/core/openapi/generator --external @getstrata/core/openapi/registeredRoute --external @getstrata/core/openapi/validate --external @getstrata/core/pagination --external @getstrata/core/queue --external @getstrata/core/queue/createAppQueue --external @getstrata/core/queue/failedJobRepository --external @getstrata/core/queue/failedJobService --external @getstrata/core/queue/jobRegistry --external @getstrata/core/queue/jobRunner --external @getstrata/core/queue/queueMetrics --external @getstrata/core/queue/publicQueue --external @getstrata/core/queue/redisQueue --external @getstrata/core/queue/types --external @getstrata/core/runtime/appKeyPrefix --external @getstrata/core/runtime/frontendMode --external @getstrata/core/runtime/applicationRegistry --external @getstrata/core/runtime/asyncContextStore --external @getstrata/core/scheduler/schedule --external @getstrata/core/scheduler/osCron --external @getstrata/core/security/oauthState --external @getstrata/core/security/publicReads --external @getstrata/core/security/recoveryCodes --external @getstrata/core/security/safeFetch --external @getstrata/core/security/safeUrl --external @getstrata/core/security/scimTenantTokens --external @getstrata/core/security/securityEvents --external @getstrata/core/security/stripeWebhook --external @getstrata/core/security/timingSafeCompare --external @getstrata/core/security/tokenExpiry --external @getstrata/core/security/totp --external @getstrata/core/storage/storage --external @getstrata/core/tenant/tenancyConfig --external @getstrata/core/tenant/tenantContext --external @getstrata/core/tenant/tenantDatabaseScope --external @getstrata/core/tenant/databaseTenantContext --external @getstrata/core/tenant/tenantMiddleware --external @getstrata/core/terminal/runShell --external @getstrata/core/tracing/traceContext --external @getstrata/core/tracing/tracingMiddleware --external @getstrata/core/validation/rules --external @getstrata/core/view",
     "build:shims": "true"
   },
   "publishConfig": {