@getstrata/bootstrap 0.2.68 → 0.4.3

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # @getstrata/bootstrap changelog
 
+## 0.4.3
+
+- Cookie session `mapUser` / row mapping can pass `email_verified_at` through as `emailVerifiedAt` so HTML email verification works.
+- Session insert binds `expires_at` as an ISO string so SQLite cookie login does not fail parameter binding.
+
+## 0.4.2
+
+- `HttpKernel.wrapApi` uses `withJsonErrorHandling`. Hybrid views do not turn API errors into HTML.
+
+## 0.4.1
+
+- `createSpaRoutes` reads `SPA_PREFIX`, registers `prefix`, `prefix/`, and `prefix/*`, and accepts `distDirectory` plus `wrap`. Hybrid still does not redirect `/`.
+- `appEnvSchema` defaults `SPA_PREFIX` from core `DEFAULT_SPA_PREFIX`.
+- Peer `@getstrata/core` `^0.7.1`.
+
+## 0.4.0
+
+- Peer `@getstrata/core` `^0.7.0`.
+- Production `SESSION_SECRET` is required whenever views are on (`FRONTEND_MODE=server-htmx` or `hybrid`).
+- Hybrid SPA routes stay under `/app/*`. They do not redirect `/`, so staff HTML keeps the home path.
+- `appEnvSchema` validates `FRONTEND_MODE` with the core pattern, including `hybrid`.
+- `HttpKernel.wrapApi` maps thrown HTTP errors to JSON the same way `wrapWeb` maps them to HTML.
+
+## 0.3.0
+
+- Peer `@getstrata/core` `^0.6.0`.
+- Cookie session SQL uses the current SQL dialect for placeholders, `NOW()`, and `NULLS LAST`.
+- Kernel comments describe guest, verified-email, and password-confirm gates without referring to another framework.
+
 ## 0.2.68
 
 - `configureModulesDirectory()` clears the discovered-module cache when the directory changes, so OpenAPI/`createApp` can load HiroApp after core tests pointed at empty fixtures.
@@ -13,17 +42,17 @@
 
 ## 0.2.66
 
-- `assertProductionSecrets()` is feature-gated for every app. API tokens no longer imply WorkHub’s encryption/CORS/OAuth/public-read checklist. Published test token strings are still denied. WorkHub’s extra production profile lives in the app (`src/config/productionSecrets.ts`).
-- **Breaking:** `HttpKernel.wrapWebGuest()` defaults `home` to `/` instead of `/organizations`. Apps with an org home should pass that path (WorkHub already does).
+- `assertProductionSecrets()` is feature-gated for every app. API tokens no longer imply the previous in-repo app's encryption/CORS/OAuth/public-read checklist. Published test token strings are still denied. the previous in-repo app's extra production profile lives in the app (`src/config/productionSecrets.ts`).
+- **Breaking:** `HttpKernel.wrapWebGuest()` defaults `home` to `/` instead of `/organizations`. Apps with an org home should pass that path (the previous in-repo app already does).
 - `createWebRoutes()` no longer seeds a `/` → `/organizations` redirect. The in-repo app owns `/` via its organization module.
 
 ## 0.2.65
 
-- App listener discovery reads `src/listeners` from `process.cwd()` so a built `@getstrata/bootstrap` bundle still finds WorkHub registrars (`import.meta.dir` after `build:bootstrap` is the package dist). Listener boot calls each registrar every time (registrars are idempotent per `eventBus`).
+- App listener discovery reads `src/listeners` from `process.cwd()` so a built `@getstrata/bootstrap` bundle still finds the previous in-repo app registrars (`import.meta.dir` after `build:bootstrap` is the package dist). Listener boot calls each registrar every time (registrars are idempotent per `eventBus`).
 
 ## 0.2.64
 
-- `registerDefaultJobs()` no longer registers WorkHub `webhook.dispatch`. Apps that dispatch model webhooks should call `registerWebhookJobs()` (WorkHub’s webhook provider and `queue:work` do).
+- `registerDefaultJobs()` no longer registers the previous in-repo app `webhook.dispatch`. Apps that dispatch model webhooks should call `registerWebhookJobs()` (the previous in-repo app's webhook provider and `queue:work` do).
 
 ## 0.2.63
 
@@ -31,7 +60,7 @@
 
 ## 0.2.62
 
-- `HttpKernel.wrapWebPasswordConfirm()` is Laravel `password.confirm` for HTML routes. Peer `@getstrata/core` `^0.5.75`.
+- `HttpKernel.wrapWebPasswordConfirm()` is the previous PHP framework `password.confirm` for HTML routes. Peer `@getstrata/core` `^0.5.75`.
 
 ## 0.2.61
 
@@ -43,7 +72,7 @@
 
 ## 0.2.59
 
-- `HttpKernel.wrapWebGuest()` is Laravel `guest` / `RedirectIfAuthenticated`. Signed-in HTML users redirect to `/organizations` (override the home path). Peer `@getstrata/core` `^0.5.72`.
+- `HttpKernel.wrapWebGuest()` is the previous PHP framework `guest` / `RedirectIfAuthenticated`. Signed-in HTML users redirect to `/organizations` (override the home path). Peer `@getstrata/core` `^0.5.72`.
 
 ## 0.2.58
 
@@ -59,7 +88,7 @@
 
 ## 0.2.55
 
-- HttpKernel and route builders read `isViewsEnabled` / `isSpaEnabled` from `@getstrata/core/runtime/frontendMode` instead of WorkHub `src/config/frontend`.
+- HttpKernel and route builders read `isViewsEnabled` / `isSpaEnabled` from `@getstrata/core/runtime/frontendMode` instead of the previous in-repo app `src/config/frontend`.
 
 ## 0.2.54
 
@@ -83,7 +112,7 @@
 
 ## 0.2.50
 
-- `createCookieSessionAuthManager` / `CookieSessionGuard` turn `CookieSessionStore` into an `AuthGuard` / `AuthManager` for `CORE_AUTH_TOKEN`. Supply a `mapUser` mapper; WorkHub abilities are not baked in. Omit `sql` to read the client from `bindDatabaseConnection()` on every call.
-- `checkDatabase()` / `createHealthRoutes()` ping the bound database client, not WorkHub’s private connection holder. `/health` stays `{ status: "ok" }` unless `{ pingOnHealth: true }`. Extra JSON fields are optional.
-- `assertProductionSecrets()` is feature-gated. A production HTMX app with `SESSION_SECRET` (32+), `AUTH_DEV_HEADERS=false`, and feature flags off does not need WorkHub API tokens. WorkHub’s current production env (rotated tokens, CORS, pepper, expiry) still passes.
+- `createCookieSessionAuthManager` / `CookieSessionGuard` turn `CookieSessionStore` into an `AuthGuard` / `AuthManager` for `CORE_AUTH_TOKEN`. Supply a `mapUser` mapper; the previous in-repo app abilities are not baked in. Omit `sql` to read the client from `bindDatabaseConnection()` on every call.
+- `checkDatabase()` / `createHealthRoutes()` ping the bound database client, not the previous in-repo app's private connection holder. `/health` stays `{ status: "ok" }` unless `{ pingOnHealth: true }`. Extra JSON fields are optional.
+- `assertProductionSecrets()` is feature-gated. A production HTMX app with `SESSION_SECRET` (32+), `AUTH_DEV_HEADERS=false`, and feature flags off does not need the previous in-repo app API tokens. the previous in-repo app's current production env (rotated tokens, CORS, pepper, expiry) still passes.
 - Re-exports `CORE_ABILITY_CHECKER_TOKEN` and `CORE_AUTH_USER_DIRECTORY_TOKEN`.

package/README.md

@@ -1,6 +1,6 @@
 # @getstrata/bootstrap
 
-Application bootstrap for Strata sibling apps: HttpKernel, service container, and web utilities.
+Application bootstrap for Strata apps: HttpKernel, service container, and web utilities.
 
 ## Install
 
@@ -8,7 +8,7 @@ Application bootstrap for Strata sibling apps: HttpKernel, service container, an
 bun add @getstrata/bootstrap @getstrata/core
 ```
 
-## Web utilities (getstrata-style apps)
+## Web utilities
 
 ```typescript
 import {
@@ -20,22 +20,22 @@ import {
 } from "@getstrata/bootstrap";
 ```
 
-`CookieSessionStore` reads optional `is_admin` from the user row for global admin routing via `wrapWebGlobalAdmin`.
+`CookieSessionStore` can read `is_admin` from the user row for `wrapWebGlobalAdmin`. Pass `loadSessionUser` when your `users` table does not match the default `SELECT u.*`.
 
-## HttpKernel (API / module apps)
+## HttpKernel
 
 ```typescript
 import { createHttpKernel, createAppContext, coreProviders } from "@getstrata/bootstrap";
 ```
 
-`createAppContext()` does not call `assertProductionSecrets`. That helper is feature-gated for every app (tokens, CORS, OAuth, encryption only when those features are on). WorkHub also runs its own production extras from `App.serve()` / `queue:work`. Sibling HTMX apps can call the published helper without API tokens when feature flags are off — see [SIBLING-HTMX.md](../../docs/SIBLING-HTMX.md).
+`createAppContext()` does not call `assertProductionSecrets`. That helper is feature-gated (tokens, CORS, OAuth, encryption only when those features are on). HTML apps can call it without API tokens when those flags are off. See [docs/BUILDING-APPS.md](../../docs/BUILDING-APPS.md) and [docs/PRODUCTION.md](../../docs/PRODUCTION.md).
 
-Sibling HTMX apps should bind `createCookieSessionAuthManager` from `@getstrata/bootstrap/web/session` instead of HMAC `SessionGuard`. Use `signIn` / `signOut` (or the redirect helpers) instead of calling `CookieSessionStore` from controllers. Pass `mapUser` to map roles in the app. Pass `loadSessionUser` when the default `learn_subscriber` / `is_admin` SELECT does not match your schema.
+HTML apps should bind `createCookieSessionAuthManager` from `@getstrata/bootstrap/web/session` instead of HMAC `SessionGuard`. Use `signIn` / `signOut` (or the redirect helpers). Pass `mapUser` to map roles in the app.
 
-`wrapWeb` applies the web group (CSRF + flash) and `withErrorHandling`, so CSRF `ForbiddenError` becomes an HTML 403 in `FRONTEND_MODE=server-htmx`. `wrapWebGuest` is Laravel `guest` / `RedirectIfAuthenticated` (signed-in users go to `/` by default; pass a string or `(user) => path` to override). `wrapWebLogin` / `wrapWebRegister` include that web group plus throttle — do not wrap them with `wrapWeb` again. The throttle callback should return an HTML form at 429.
+`wrapWeb` applies the web group (CSRF + flash) and `withErrorHandling`, so CSRF `ForbiddenError` becomes an HTML 403 when views are on (`FRONTEND_MODE=server-htmx` or `hybrid`). `wrapWebGuest` sends signed-in users to `/` by default (pass a string or `(user) => path` to override). `wrapWebLogin` / `wrapWebRegister` include that web group plus throttle. Do not wrap them with `wrapWeb` again. The throttle callback should return an HTML form at 429.
 
-`registerDefaultJobs()` registers `cache.invalidate-tags` and `audit.export` only. Apps that dispatch model webhooks should call `registerWebhookJobs()` themselves.
+`createSpaRoutes` / `mergeSpaRoutes` serve `SPA_PREFIX` (default `/app`) as `prefix`, `prefix/`, and `prefix/*`. Hybrid does not redirect `/`. Pass `distDirectory` and `wrap` when the app is not the process cwd. Apps should not copy a second static-file server.
 
-These subpaths assemble the in-repo dogfood app and are not a generic starter API: `@getstrata/bootstrap/createRoutes` (includes SCIM), `@getstrata/bootstrap/schedule`, and `@getstrata/bootstrap/createWebRoutes` (discovers app `webRoutes`; `/` is owned by the app). Sibling apps should use `buildWebModuleRoutes` / `buildModuleRoutes`.
+`registerDefaultJobs()` registers `cache.invalidate-tags` and `audit.export` only. Apps that dispatch model webhooks should call `registerWebhookJobs()` themselves.
 
-See the [strata](https://github.com/EyK-26/strata) monorepo reference app for full module patterns.
+These subpaths assemble leftover fixture HTTP for framework tests and are not a generic starter API: `@getstrata/bootstrap/createRoutes`, `@getstrata/bootstrap/schedule`, `@getstrata/bootstrap/createWebRoutes`. New apps should use `buildWebModuleRoutes` / `buildModuleRoutes`. Generated examples use `createApp()` in `apps/hiroapp`.

package/dist/_.._/_.._/index.html

@@ -3,7 +3,7 @@
     <head>
         <meta charset="UTF-8" />
         <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-        <title>WorkHub API</title>
+        <title>Strata</title>
         <style>
             :root {
                 color-scheme: dark;
@@ -78,7 +78,7 @@
     <script type="module" crossorigin src="../../index-sfreg6q3.js"></script></head>
 
     <body>
-        <h1>WorkHub API</h1>
+        <h1>Strata</h1>
         <p class="hint">
             Framework reference domain for organizations, projects, tasks, and
             comments.

package/dist/bootstrap/createSpaRoutes.d.ts

@@ -1,5 +1,12 @@
+import type { RouteHandler } from "@getstrata/core/http/middleware";
 import type { AppDependencies, AppRouteMap } from "./contracts";
 declare const SPA_DIST_DIRECTORY: string;
-declare function createSpaRoutes(_dependencies: AppDependencies): AppRouteMap;
-declare function mergeSpaRoutes(dependencies: AppDependencies, routes: AppRouteMap): AppRouteMap;
+type SpaRouteOptions = {
+    prefix?: string;
+    distDirectory?: string;
+    wrap?: (handler: RouteHandler) => RouteHandler;
+};
+declare function createSpaRoutes(_dependencies: AppDependencies, options?: SpaRouteOptions): AppRouteMap;
+declare function mergeSpaRoutes(dependencies: AppDependencies, routes: AppRouteMap, options?: SpaRouteOptions): AppRouteMap;
+export type { SpaRouteOptions };
 export { createSpaRoutes, mergeSpaRoutes, SPA_DIST_DIRECTORY };

package/dist/bootstrap/dogfoodApp.d.ts

@@ -1,4 +1,4 @@
-type DogfoodApp = "workhub" | "hiroapp";
+type DogfoodApp = "hiroapp";
 declare function readDogfoodApp(): DogfoodApp;
 declare function isHiroappDogfood(): boolean;
 declare function hiroappSourcePath(...segments: string[]): string;

package/dist/bootstrap/httpKernel.d.ts

@@ -12,19 +12,19 @@ declare class HttpKernel {
     wrap(groups: MiddlewareGroupName | MiddlewareGroupName[], handler: RouteHandler): RouteHandler;
     wrapApi(handler: RouteHandler): RouteHandler;
     wrapWeb(handler: RouteHandler): RouteHandler;
-    /** Laravel `guest` / `RedirectIfAuthenticated` — signed-in users go to `home`. */
+    /** Signed-in HTML users redirect to `home` instead of seeing guest pages. */
     wrapWebGuest(handler: RouteHandler, home?: WebGuestHome): RouteHandler;
     wrapWebPublicRead(handler: RouteHandler): RouteHandler;
     wrapWebAuthenticated(handler: RouteHandler): RouteHandler;
-    /** Signed-in HTML without Laravel `verified` (logout, verification notice). */
+    /** Signed-in HTML without the email-verified gate (logout, verification notice). */
     wrapWebAuthenticatedAllowUnverified(handler: RouteHandler): RouteHandler;
     wrapWebVerified(handler: RouteHandler): RouteHandler;
-    /** Laravel `password.confirm` — requires a fresh signed confirmation cookie. */
+    /** Requires a fresh signed password-confirmation cookie. */
     wrapWebPasswordConfirm(handler: RouteHandler): RouteHandler;
     wrapWebAbility(ability: string, handler: RouteHandler): RouteHandler;
     wrapWebGlobalAdmin(handler: RouteHandler): RouteHandler;
     wrapAuthenticated(handler: RouteHandler): RouteHandler;
-    /** Laravel `verified` for JSON/API routes. No-op when `FEATURE_EMAIL_VERIFICATION` is off. */
+    /** JSON routes that require a verified email. No-op when `FEATURE_EMAIL_VERIFICATION` is off. */
     wrapVerified(handler: RouteHandler): RouteHandler;
     wrapPublicRead(handler: RouteHandler): RouteHandler;
     wrapGlobalAdmin(handler: RouteHandler): RouteHandler;

package/dist/bootstrap/public-api.d.ts

@@ -1,5 +1,5 @@
 /**
- * @getstrata/bootstrap — application shell for Strata sibling apps.
+ * @getstrata/bootstrap: application shell for Strata apps.
  */
 export type { ScheduledTask } from "@getstrata/core/scheduler/schedule";
 export { appSchedule, runDueScheduledTasks, Schedule } from "@getstrata/core/scheduler/schedule";

package/dist/bootstrap/schemaTarget.d.ts

@@ -0,0 +1,5 @@
+type SchemaTarget = "app" | "fixture";
+declare function readSchemaTarget(): SchemaTarget;
+declare function isFixtureSchema(): boolean;
+export type { SchemaTarget };
+export { isFixtureSchema, readSchemaTarget };

package/dist/bootstrap/server.d.ts

@@ -1 +1 @@
-import "./preloadModules.ts";
+export {};

package/dist/bootstrap/web/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * Web-focused bootstrap utilities for sibling apps (getstrata, marketing sites).
+ * Web-focused bootstrap utilities for HTML and cookie-session apps.
  */
 export { createCsrfProtection, type ParsedForm, parseFormBody } from "./forms.ts";
 export { createRouteKernel, routeParams, toRouteRequest, wrapSecuredRouteModelByKey, wrapWebLogin, wrapWebRegister, } from "./routing.ts";

package/dist/bootstrap/web/routing.d.ts

@@ -10,7 +10,7 @@ export declare function routeParams(request: Request): Record<string, string>;
  */
 export declare function toRouteRequest<TParams extends Record<string, string>>(request: Request): RouteRequest<TParams>;
 /**
- * Laravel-style secured route-model binding for string keys (slugs, UUIDs).
+ * Secured route-model binding for string keys (slugs, UUIDs).
  * Public HTML show pages should look up the model in the controller instead.
  * If this wrapper is still used on HTML, a missing model becomes a styled 404
  * and GET ETags are skipped for HTML / composite objects unless `etag: true`.
@@ -24,5 +24,5 @@ export declare function wrapSecuredRouteModelByKey<TParams extends Record<string
 export declare function wrapWebLogin(kernel: HttpKernel, handler: RouteHandler, onThrottled: (request: Request) => Response | Promise<Response>): RouteHandler;
 /** Web group (CSRF + flash + HTML errors) plus register throttle. Do not wrap with wrapWeb again. */
 export declare function wrapWebRegister(kernel: HttpKernel, handler: RouteHandler, onThrottled: (request: Request) => Response | Promise<Response>): RouteHandler;
-/** Convenience alias: HttpKernel is the Laravel-style router middleware wrapper. */
+/** Convenience alias for `createHttpKernel`. */
 export declare function createRouteKernel(dependencies: AppDependencies): HttpKernel;

package/dist/bootstrap/web/session.d.ts

@@ -6,6 +6,7 @@ export interface SessionUser {
     email: string;
     learn_subscriber?: boolean;
     is_admin?: boolean;
+    email_verified_at?: Date | string | null;
 }
 type SqlClient = {
     unsafe<T>(query: string, params?: readonly unknown[]): Promise<T[]>;

package/dist/entries/buildModuleRoutes.js

@@ -28,7 +28,7 @@ import { createRequireGlobalAdminMiddleware } from "@getstrata/core/http/require
 import { createRequirePasswordConfirmMiddleware } from "@getstrata/core/http/requirePasswordConfirmMiddleware";
 import { createRequireVerifiedMiddleware } from "@getstrata/core/http/requireVerifiedMiddleware";
 import { createRequireWebAuthMiddleware } from "@getstrata/core/http/requireWebAuthMiddleware";
-import { withErrorHandling } from "@getstrata/core/http/response";
+import { withErrorHandling, withJsonErrorHandling } from "@getstrata/core/http/response";
 import { withMiddleware } from "@getstrata/core/http/routeMiddleware";
 import { createSecurityHeadersMiddleware } from "@getstrata/core/http/securityHeadersMiddleware";
 import { createValidateSignatureMiddleware } from "@getstrata/core/http/signedUrl";
@@ -176,7 +176,7 @@ class HttpKernel {
     return withMiddleware(...middleware)(handler);
   }
   wrapApi(handler) {
-    return this.wrap(["api", "authenticated"], handler);
+    return withJsonErrorHandling(this.wrap(["api", "authenticated"], handler));
   }
   wrapWeb(handler) {
     return withErrorHandling(this.wrap("web", handler));

package/dist/entries/buildWebModuleRoutes.js

@@ -31,7 +31,7 @@ import { createRequireGlobalAdminMiddleware } from "@getstrata/core/http/require
 import { createRequirePasswordConfirmMiddleware } from "@getstrata/core/http/requirePasswordConfirmMiddleware";
 import { createRequireVerifiedMiddleware } from "@getstrata/core/http/requireVerifiedMiddleware";
 import { createRequireWebAuthMiddleware } from "@getstrata/core/http/requireWebAuthMiddleware";
-import { withErrorHandling } from "@getstrata/core/http/response";
+import { withErrorHandling, withJsonErrorHandling } from "@getstrata/core/http/response";
 import { withMiddleware } from "@getstrata/core/http/routeMiddleware";
 import { createSecurityHeadersMiddleware } from "@getstrata/core/http/securityHeadersMiddleware";
 import { createValidateSignatureMiddleware } from "@getstrata/core/http/signedUrl";
@@ -179,7 +179,7 @@ class HttpKernel {
     return withMiddleware(...middleware)(handler);
   }
   wrapApi(handler) {
-    return this.wrap(["api", "authenticated"], handler);
+    return withJsonErrorHandling(this.wrap(["api", "authenticated"], handler));
   }
   wrapWeb(handler) {
     return withErrorHandling(this.wrap("web", handler));

package/dist/entries/context.js

@@ -96,17 +96,19 @@ function resetDiscoverModulesForTests() {
   state.modulesReady = undefined;
 }
 // ../../src/bootstrap/providers/auth.ts
+import { BasicAuthGuard } from "@getstrata/core/auth/basicAuthGuard";
 import {
   AuthManager,
   CompositeGuard,
   DatabaseTokenGuard,
   GuestGuard
 } from "@getstrata/core/auth/guard";
+import { JwtGuard } from "@getstrata/core/auth/jwtGuard";
 import { SessionGuard } from "@getstrata/core/auth/sessionGuard";
 
 // ../../src/config/auth.ts
 var authConfig = {
-  allowDevHeaders: (process.env.AUTH_DEV_HEADERS ?? "true") !== "false",
+  allowDevHeaders: process.env.AUTH_DEV_HEADERS === "true",
   tokenDefaultAbilities: ["*"]
 };
 
@@ -141,11 +143,22 @@ var authProvider = {
   name: "core.auth",
   register({ container, config }) {
     config.set("auth.allowDevHeaders", authConfig.allowDevHeaders);
-    const guards = [new DatabaseTokenGuard(container), new SessionGuard(container)];
+    const apiGuard = new DatabaseTokenGuard(container);
+    const sessionGuard = new SessionGuard(container);
+    const jwtGuard = new JwtGuard;
+    const basicGuard = new BasicAuthGuard(container);
+    const guards = [apiGuard, jwtGuard, basicGuard, sessionGuard];
     if (authConfig.allowDevHeaders) {
       guards.push(new GuestGuard);
     }
-    container.set(CORE_AUTH_TOKEN, new AuthManager(new CompositeGuard(guards)));
+    const auth = new AuthManager(new CompositeGuard(guards));
+    auth.registerGuard("api", apiGuard);
+    auth.registerGuard("access_token", apiGuard);
+    auth.registerGuard("jwt", jwtGuard);
+    auth.registerGuard("basic", basicGuard);
+    auth.registerGuard("web", sessionGuard);
+    auth.registerGuard("session", sessionGuard);
+    container.set(CORE_AUTH_TOKEN, auth);
   }
 };
 var auth_default = authProvider;
@@ -206,8 +219,12 @@ var queueConfig = {
 };
 // ../../src/bootstrap/env.ts
 import { defineEnvSchema } from "@getstrata/core/config/envSchema";
+import { DEFAULT_SPA_PREFIX, FRONTEND_MODE_PATTERN } from "@getstrata/core/runtime/frontendMode";
 var appEnvSchema = defineEnvSchema({
-  DATABASE_URL: { required: true, pattern: /^postgres(ql)?:\/\// },
+  DATABASE_URL: {
+    required: true,
+    pattern: /^(postgres(ql)?|mysql|sqlite):\/\//i
+  },
   PORT: {
     integer: true,
     minimum: 1,
@@ -235,9 +252,21 @@ var appEnvSchema = defineEnvSchema({
     pattern: /^(sync|async|redis)$/
   },
   AUTH_DEV_HEADERS: {
-    default: "true",
+    default: "false",
     pattern: /^(true|false|0|1)$/
   },
+  DB_CONNECTION: {
+    default: "",
+    pattern: /^(pgsql|postgres|postgresql|mysql|mariadb|sqlite)?$/i
+  },
+  AUTH_DEFAULT_GUARD: {
+    default: "web"
+  },
+  JWT_TTL_SECONDS: {
+    integer: true,
+    minimum: 60,
+    default: "3600"
+  },
   APP_ENV: {
     default: "local"
   },
@@ -247,6 +276,13 @@ var appEnvSchema = defineEnvSchema({
   APP_URL: {
     default: "http://localhost:3000"
   },
+  FRONTEND_MODE: {
+    default: "api",
+    pattern: FRONTEND_MODE_PATTERN
+  },
+  SPA_PREFIX: {
+    default: DEFAULT_SPA_PREFIX
+  },
   API_PREFIX: {
     default: "/api/v1"
   },

package/dist/entries/createRoutes.js

@@ -3,11 +3,11 @@ var __jsonParse = (a) => JSON.parse(a);
 
 // ../../src/bootstrap/createRoutes.ts
 import { jsonResponse as jsonResponse3 } from "@getstrata/core/http/response";
-import { isSpaEnabled as isSpaEnabled2, isViewsEnabled as isViewsEnabled3 } from "@getstrata/core/runtime/frontendMode";
+import { isSpaEnabled as isSpaEnabled2, isViewsEnabled as isViewsEnabled4 } from "@getstrata/core/runtime/frontendMode";
 import { notFoundHtmlResponse as notFoundHtmlResponse2 } from "@getstrata/core/view";
 
 // ../../index.html
-var strata_default = __jsonParse("{\"index\":\"_.._/_.._/index.html\",\"files\":[{\"input\":\"../../index.html\",\"path\":\"./index-sfreg6q3.js\",\"loader\":\"js\",\"isEntry\":true,\"headers\":{\"etag\":\"Oc_YLpCmV6M\",\"content-type\":\"text/javascript;charset=utf-8\"}},{\"input\":\"../../index.html\",\"path\":\"_.._/_.._/index.html\",\"loader\":\"html\",\"isEntry\":true,\"headers\":{\"etag\":\"rWY90LWIcx8\",\"content-type\":\"text/html;charset=utf-8\"}}]}");
+var strata_default = __jsonParse("{\"index\":\"_.._/_.._/index.html\",\"files\":[{\"input\":\"../../index.html\",\"path\":\"./index-sfreg6q3.js\",\"loader\":\"js\",\"isEntry\":true,\"headers\":{\"etag\":\"Oc_YLpCmV6M\",\"content-type\":\"text/javascript;charset=utf-8\"}},{\"input\":\"../../index.html\",\"path\":\"_.._/_.._/index.html\",\"loader\":\"html\",\"isEntry\":true,\"headers\":{\"etag\":\"ojosdcZCk7g\",\"content-type\":\"text/html;charset=utf-8\"}}]}");
 
 // ../../src/config/app.ts
 var appConfig = {
@@ -45,7 +45,7 @@ import { createRequireGlobalAdminMiddleware } from "@getstrata/core/http/require
 import { createRequirePasswordConfirmMiddleware } from "@getstrata/core/http/requirePasswordConfirmMiddleware";
 import { createRequireVerifiedMiddleware } from "@getstrata/core/http/requireVerifiedMiddleware";
 import { createRequireWebAuthMiddleware } from "@getstrata/core/http/requireWebAuthMiddleware";
-import { withErrorHandling } from "@getstrata/core/http/response";
+import { withErrorHandling, withJsonErrorHandling } from "@getstrata/core/http/response";
 import { withMiddleware } from "@getstrata/core/http/routeMiddleware";
 import { createSecurityHeadersMiddleware } from "@getstrata/core/http/securityHeadersMiddleware";
 import { createValidateSignatureMiddleware } from "@getstrata/core/http/signedUrl";
@@ -193,7 +193,7 @@ class HttpKernel {
     return withMiddleware(...middleware)(handler);
   }
   wrapApi(handler) {
-    return this.wrap(["api", "authenticated"], handler);
+    return withJsonErrorHandling(this.wrap(["api", "authenticated"], handler));
   }
   wrapWeb(handler) {
     return withErrorHandling(this.wrap("web", handler));
@@ -497,44 +497,68 @@ function buildModuleRoutes(dependencies, options = {}) {
 // ../../src/bootstrap/createSpaRoutes.ts
 import { join as join2 } from "path";
 import { jsonResponse } from "@getstrata/core/http/response";
-import { isSpaEnabled } from "@getstrata/core/runtime/frontendMode";
+import { isSpaEnabled, isViewsEnabled as isViewsEnabled2, readSpaPrefix } from "@getstrata/core/runtime/frontendMode";
 var SPA_DIST_DIRECTORY = join2(process.cwd(), "frontend/dist");
-var SPA_INDEX_FILE = join2(SPA_DIST_DIRECTORY, "index.html");
-function createSpaRoutes(_dependencies) {
-  return {
-    "/app/*": async (request) => {
-      const pathname = new URL(request.url).pathname;
-      const relativePath = pathname.replace(/^\/app\//, "");
-      const assetFile = Bun.file(join2(SPA_DIST_DIRECTORY, relativePath));
-      if (relativePath.length > 0 && await assetFile.exists()) {
-        return new Response(assetFile);
-      }
-      const indexFile = Bun.file(SPA_INDEX_FILE);
-      if (await indexFile.exists()) {
-        return new Response(indexFile, {
-          headers: { "Content-Type": "text/html; charset=utf-8" }
-        });
-      }
-      return jsonResponse({
-        error: "SPA build not found. Run `bun run build:frontend`."
-      }, { status: 503 });
-    },
-    "/": async () => Response.redirect("/app/", 302)
+function relativeSpaPath(pathname, prefix) {
+  if (pathname === prefix || pathname === `${prefix}/`) {
+    return "";
+  }
+  if (pathname.startsWith(`${prefix}/`)) {
+    return pathname.slice(prefix.length + 1);
+  }
+  return "";
+}
+function createSpaDocumentHandler(prefix, distDirectory) {
+  const indexFilePath = join2(distDirectory, "index.html");
+  return async (request) => {
+    const pathname = new URL(request.url).pathname;
+    if (pathname.startsWith("/api/")) {
+      return new Response("Not found", { status: 404 });
+    }
+    const relativePath = relativeSpaPath(pathname, prefix);
+    const assetFile = Bun.file(join2(distDirectory, relativePath));
+    if (relativePath.length > 0 && await assetFile.exists()) {
+      return new Response(assetFile);
+    }
+    const indexFile = Bun.file(indexFilePath);
+    if (await indexFile.exists()) {
+      return new Response(indexFile, {
+        headers: { "Content-Type": "text/html; charset=utf-8" }
+      });
+    }
+    return jsonResponse({
+      error: "SPA build not found. Run `bun run frontend:build` in your app."
+    }, { status: 503 });
+  };
+}
+function createSpaRoutes(_dependencies, options = {}) {
+  const prefix = options.prefix ?? readSpaPrefix();
+  const distDirectory = options.distDirectory ?? SPA_DIST_DIRECTORY;
+  const wrap = options.wrap ?? ((handler2) => handler2);
+  const handler = wrap(createSpaDocumentHandler(prefix, distDirectory));
+  const routes = {
+    [prefix]: handler,
+    [`${prefix}/`]: handler,
+    [`${prefix}/*`]: handler
   };
+  if (!isViewsEnabled2()) {
+    routes["/"] = async () => Response.redirect(`${prefix}/`, 302);
+  }
+  return routes;
 }
-function mergeSpaRoutes(dependencies, routes) {
+function mergeSpaRoutes(dependencies, routes, options) {
   if (!isSpaEnabled()) {
     return routes;
   }
   return {
-    ...createSpaRoutes(dependencies),
+    ...createSpaRoutes(dependencies, options),
     ...routes
   };
 }
 
 // ../../src/bootstrap/createWebRoutes.ts
 import { join as join3 } from "path";
-import { isViewsEnabled as isViewsEnabled2 } from "@getstrata/core/runtime/frontendMode";
+import { isViewsEnabled as isViewsEnabled3 } from "@getstrata/core/runtime/frontendMode";
 import { notFoundHtmlResponse } from "@getstrata/core/view";
 
 // ../../src/bootstrap/buildWebModuleRoutes.ts
@@ -584,7 +608,7 @@ function createWebRoutes(dependencies, options = {}) {
   return wrappedRoutes;
 }
 function mergeWebRoutes(dependencies, routes, options = {}) {
-  if (!isViewsEnabled2()) {
+  if (!isViewsEnabled3()) {
     return routes;
   }
   return {
@@ -594,12 +618,8 @@ function mergeWebRoutes(dependencies, routes, options = {}) {
 }
 
 // ../../src/bootstrap/dogfoodApp.ts
-function readDogfoodApp() {
-  const value = (process.env.DOGFOOD_APP ?? "hiroapp").trim().toLowerCase();
-  return value === "workhub" ? "workhub" : "hiroapp";
-}
 function isHiroappDogfood() {
-  return readDogfoodApp() === "hiroapp";
+  return true;
 }
 
 // ../../src/bootstrap/health.ts
@@ -757,7 +777,7 @@ function createRoutes(dependencies) {
   const baseRoutes = {
     ...healthRoutes,
     ...metricsRoutes,
-    ...isViewsEnabled3() || isSpaEnabled2() ? {} : { "/": strata_default },
+    ...isViewsEnabled4() || isSpaEnabled2() ? {} : { "/": strata_default },
     ...wrappedModuleRoutes,
     [notFoundApiPath]: async () => {
       registerRoute2("GET", notFoundApiPath, ["global", "api"]);
@@ -765,7 +785,7 @@ function createRoutes(dependencies) {
     },
     "/*": async () => {
       registerRoute2("GET", "/*", []);
-      if (isViewsEnabled3()) {
+      if (isViewsEnabled4()) {
         return notFoundHtmlResponse2();
       }
       if (isSpaEnabled2()) {