@getstrata/bootstrap 0.2.7 → 0.2.8

package/dist/bootstrap/http/securedRouteModelBinding.d.ts

@@ -0,0 +1,11 @@
+import type { Policy } from "../../core/auth/policy";
+import type { RouteRequest } from "../../core/http/route";
+interface RouteModelAuthorization {
+    resource: string;
+    action: keyof Policy;
+    requireIfMatch?: boolean;
+}
+declare function securedBindRouteModel<TParams extends Record<string, string>, TModel, TParam extends keyof TParams & string>(param: TParam, resolver: (id: number, request: RouteRequest<TParams>) => Promise<TModel>, authorization: RouteModelAuthorization, handler: (request: RouteRequest<TParams>, model: TModel) => Response | Promise<Response>): (request: RouteRequest<TParams>) => Promise<Response>;
+declare function securedBindRouteModelByKey<TParams extends Record<string, string>, TModel, TParam extends keyof TParams & string>(param: TParam, resolver: (key: string, request: RouteRequest<TParams>) => Promise<TModel>, authorization: RouteModelAuthorization, handler: (request: RouteRequest<TParams>, model: TModel) => Response | Promise<Response>): (request: RouteRequest<TParams>) => Promise<Response>;
+export type { RouteModelAuthorization };
+export { securedBindRouteModel, securedBindRouteModelByKey };

package/dist/bootstrap/public-api.d.ts

@@ -10,6 +10,7 @@ export { collectProviders, createAppContext, runProviderPhase } from "./context.
 export type { AppContext, AppDependencies, AppModule, AppRouteMap, CachedJson, ConfigStore, ModuleRouteContext, MutableAppDependencies, ProviderContext, ServiceFactory, ServiceProvider, } from "./contracts.ts";
 export { assertAppDependenciesComplete, getRequiredDependency, resolveService, ServiceContainer, } from "./contracts.ts";
 export { createWebRoutes, mergeWebRoutes } from "./createWebRoutes.ts";
+export { type RouteModelAuthorization, securedBindRouteModel, securedBindRouteModelByKey, } from "./http/securedRouteModelBinding.ts";
 export { createHttpKernel, type HttpKernel, type MiddlewareGroupName } from "./httpKernel.ts";
 export { prefixRouteMap } from "./prefixRouteMap.ts";
 export { coreProviders } from "./providers/index.ts";

package/dist/core/http/securedRouteModelBinding.d.ts

@@ -1,11 +1,2 @@
-import type { Policy } from "../auth/policy";
-import type { RouteRequest } from "./route";
-interface RouteModelAuthorization {
-    resource: string;
-    action: keyof Policy;
-    requireIfMatch?: boolean;
-}
-declare function securedBindRouteModel<TParams extends Record<string, string>, TModel, TParam extends keyof TParams & string>(param: TParam, resolver: (id: number, request: RouteRequest<TParams>) => Promise<TModel>, authorization: RouteModelAuthorization, handler: (request: RouteRequest<TParams>, model: TModel) => Response | Promise<Response>): (request: RouteRequest<TParams>) => Promise<Response>;
-declare function securedBindRouteModelByKey<TParams extends Record<string, string>, TModel, TParam extends keyof TParams & string>(param: TParam, resolver: (key: string, request: RouteRequest<TParams>) => Promise<TModel>, authorization: RouteModelAuthorization, handler: (request: RouteRequest<TParams>, model: TModel) => Response | Promise<Response>): (request: RouteRequest<TParams>) => Promise<Response>;
-export type { RouteModelAuthorization };
-export { securedBindRouteModel, securedBindRouteModelByKey };
+export type { RouteModelAuthorization } from "../../bootstrap/http/securedRouteModelBinding.ts";
+export { securedBindRouteModel, securedBindRouteModelByKey, } from "../../bootstrap/http/securedRouteModelBinding.ts";

package/dist/entries/context.js

@@ -527,6 +527,11 @@ class UnauthorizedError2 extends HttpError {
     super(401, message, details);
   }
 }
+class PreconditionFailedError extends HttpError {
+  constructor(message = "Precondition Failed", details) {
+    super(412, message, details);
+  }
+}
 
 // ../../src/core/auth/authContext.ts
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";

package/dist/entries/http/securedRouteModelBinding.js

@@ -0,0 +1,383 @@
+// @bun
+// ../../src/core/auth/authContext.ts
+import { AsyncLocalStorage } from "async_hooks";
+var authContext = new AsyncLocalStorage;
+function currentAuthUser() {
+  return authContext.getStore() ?? null;
+}
+
+// ../../src/core/errors/http.ts
+class HttpError extends Error {
+  status;
+  details;
+  constructor(status, message, details) {
+    super(message);
+    this.name = new.target.name;
+    this.status = status;
+    this.details = details;
+  }
+}
+
+class BadRequestError extends HttpError {
+  constructor(message = "Bad Request", details) {
+    super(400, message, details);
+  }
+}
+class ConflictError extends HttpError {
+  constructor(message = "Conflict", details) {
+    super(409, message, details);
+  }
+}
+
+class UnprocessableEntityError extends HttpError {
+  constructor(message = "Unprocessable Entity", details) {
+    super(422, message, details);
+  }
+}
+class ForbiddenError extends HttpError {
+  constructor(message = "Forbidden", details) {
+    super(403, message, details);
+  }
+}
+
+class UnauthorizedError extends HttpError {
+  constructor(message = "Unauthorized", details) {
+    super(401, message, details);
+  }
+}
+class PreconditionFailedError extends HttpError {
+  constructor(message = "Precondition Failed", details) {
+    super(412, message, details);
+  }
+}
+
+// ../../src/core/crypto/nonCryptographicHash.ts
+function nonCryptographicDigest(input) {
+  return Bun.hash(input).toString(16);
+}
+
+// ../../src/core/http/etag.ts
+function isEtagEnabled() {
+  return (process.env.FEATURE_ETAG ?? "true") !== "false";
+}
+function formatWeakEtag(digest) {
+  return `W/"${digest}"`;
+}
+function etagFromResource(resource) {
+  const version = resource.updated_at ?? resource.created_at ?? "";
+  const versionText = version instanceof Date ? version.toISOString() : version ? String(version) : "0";
+  const digest = nonCryptographicDigest(`${String(resource.id ?? "0")}:${versionText}`).slice(0, 32);
+  return formatWeakEtag(digest);
+}
+function normalizeEtag(value) {
+  return value.trim();
+}
+function etagValuesMatch(left, right) {
+  return normalizeEtag(left) === normalizeEtag(right);
+}
+function parseEtagList(header) {
+  if (!header) {
+    return [];
+  }
+  return header.split(",").map((value) => normalizeEtag(value)).filter(Boolean);
+}
+function ifNoneMatchSatisfied(request, etag) {
+  const header = request.headers.get("if-none-match");
+  if (!header) {
+    return false;
+  }
+  if (header.trim() === "*") {
+    return true;
+  }
+  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
+}
+function ifMatchSatisfied(request, etag) {
+  const header = request.headers.get("if-match");
+  if (!header) {
+    return false;
+  }
+  if (header.trim() === "*") {
+    return true;
+  }
+  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
+}
+function assertIfMatch(request, etag, options = {}) {
+  const header = request.headers.get("if-match");
+  if (!header) {
+    if (options.required) {
+      throw new PreconditionFailedError("If-Match header is required.");
+    }
+    return;
+  }
+  if (!ifMatchSatisfied(request, etag)) {
+    throw new PreconditionFailedError("Resource ETag does not match If-Match.");
+  }
+}
+function applyEtagHeaders(headers, etag) {
+  const next = new Headers(headers);
+  next.set("ETag", etag);
+  next.set("Cache-Control", "private, must-revalidate");
+  next.append("Vary", "Authorization");
+  next.append("Vary", "X-Tenant-Id");
+  return next;
+}
+function notModifiedResponse(etag) {
+  return new Response(null, {
+    status: 304,
+    headers: applyEtagHeaders(new Headers, etag)
+  });
+}
+function applyConditionalGet(request, response, etag) {
+  if (!isEtagEnabled()) {
+    return response;
+  }
+  if (ifNoneMatchSatisfied(request, etag)) {
+    return notModifiedResponse(etag);
+  }
+  const headers = applyEtagHeaders(new Headers(response.headers), etag);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+
+// ../../src/core/tenant/tenantContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+var tenantContext = new AsyncLocalStorage2;
+
+// ../../src/core/http/validation.ts
+function parsePositiveIntParam(value, name = "id") {
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new BadRequestError(`Invalid ${name}. Expected a positive integer.`);
+  }
+  return parsed;
+}
+
+// ../../src/core/logging/logger.ts
+class Logger {
+  channel;
+  constructor(channel = "app") {
+    this.channel = channel;
+  }
+  write(level, message, context = {}) {
+    const entry = {
+      level,
+      channel: this.channel,
+      message,
+      timestamp: new Date().toISOString(),
+      ...context
+    };
+    const line = JSON.stringify(entry);
+    if (level === "error") {
+      console.error(line);
+      return;
+    }
+    console.log(line);
+  }
+  debug(message, context) {
+    this.write("debug", message, context);
+  }
+  info(message, context) {
+    this.write("info", message, context);
+  }
+  warn(message, context) {
+    this.write("warn", message, context);
+  }
+  error(message, context) {
+    this.write("error", message, context);
+  }
+}
+var appLogger = new Logger("app");
+
+// ../../src/bootstrap/config.ts
+var APP_PORT_CONFIG_KEY = "app.port";
+var CACHE_TTL_MS_CONFIG_KEY = "cache.ttlMs";
+var CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
+var CACHE_DRIVER_CONFIG_KEY = "cache.driver";
+var REDIS_URL_CONFIG_KEY = "cache.redisUrl";
+var DATABASE_URL_CONFIG_KEY = "database.url";
+var CORE_CONFIG_TOKEN = "core.config";
+var CORE_CACHE_TOKEN = "core.cache";
+var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_POLICY_GATE_TOKEN = "core.policyGate";
+var CORE_AUTH_TOKEN = "core.auth";
+var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
+var AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
+var DEFAULT_APP_PORT = 3000;
+var DEFAULT_CACHE_TTL_MS = 3600000;
+var DEFAULT_CACHE_MAX_ENTRIES = 100;
+var DEFAULT_CACHE_DRIVER = "array";
+var DEFAULT_API_TOKEN = "";
+var DEFAULT_QUEUE_DRIVER = "sync";
+
+// ../../src/bootstrap/contracts.ts
+class ServiceContainer {
+  services = new Map;
+  singletonFactories = new Map;
+  bindings = new Map;
+  set(key, value) {
+    this.singletonFactories.delete(key);
+    this.bindings.delete(key);
+    this.services.set(key, value);
+    return value;
+  }
+  singleton(key, factory) {
+    this.bindings.delete(key);
+    this.services.delete(key);
+    this.singletonFactories.set(key, factory);
+  }
+  bind(key, factory) {
+    this.singletonFactories.delete(key);
+    this.services.delete(key);
+    this.bindings.set(key, factory);
+  }
+  get(key) {
+    if (this.services.has(key)) {
+      return this.services.get(key);
+    }
+    const singletonFactory = this.singletonFactories.get(key);
+    if (singletonFactory) {
+      const value = singletonFactory(this);
+      this.services.set(key, value);
+      return value;
+    }
+    const binding = this.bindings.get(key);
+    if (binding) {
+      return binding(this);
+    }
+    throw new Error(`Service "${key}" is not registered.`);
+  }
+  resolve(key) {
+    return this.get(key);
+  }
+  has(key) {
+    return this.services.has(key) || this.singletonFactories.has(key) || this.bindings.has(key);
+  }
+}
+
+class ConfigStore {
+  values = new Map;
+  set(key, value) {
+    this.values.set(key, value);
+    return value;
+  }
+  get(key) {
+    return this.values.get(key);
+  }
+  require(key) {
+    if (!this.values.has(key)) {
+      throw new Error(`Config key "${key}" is not defined.`);
+    }
+    return this.values.get(key);
+  }
+  has(key) {
+    return this.values.has(key);
+  }
+}
+var requiredDependencyKeys = [
+  "container",
+  "cache",
+  "storage"
+];
+function getRequiredDependency(dependencies, key) {
+  const dependency = dependencies[key];
+  if (dependency === undefined) {
+    throw new Error(`Required dependency "${key}" is not registered.`);
+  }
+  return dependency;
+}
+function assertAppDependenciesComplete(dependencies) {
+  for (const key of requiredDependencyKeys) {
+    getRequiredDependency(dependencies, key);
+  }
+}
+function resolveService(dependencies, token) {
+  return dependencies.container.resolve(token);
+}
+
+// ../../src/bootstrap/applicationRegistry.ts
+var activeContext;
+function setActiveApplicationContext(context) {
+  activeContext = context;
+}
+function requireActiveApplicationContext() {
+  if (!activeContext) {
+    throw new Error("The application context has not been bootstrapped.");
+  }
+  return activeContext;
+}
+function resolveApplicationCache() {
+  return getRequiredDependency(requireActiveApplicationContext().dependencies, "cache");
+}
+function resolveApplicationQueue() {
+  return requireActiveApplicationContext().container.resolve(CORE_QUEUE_TOKEN);
+}
+function resolveApplicationAuth() {
+  return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN);
+}
+function resolveApplicationPolicyGate() {
+  return requireActiveApplicationContext().container.resolve(CORE_POLICY_GATE_TOKEN);
+}
+function resolveApplicationConfig() {
+  return requireActiveApplicationContext().config;
+}
+function resolveApplicationLogger() {
+  return appLogger;
+}
+function resolveApplicationDependencies() {
+  return requireActiveApplicationContext().dependencies;
+}
+
+// ../../src/bootstrap/http/securedRouteModelBinding.ts
+function isMutatingPolicyAction(action) {
+  return action === "update" || action === "delete";
+}
+function securedBindRouteModel(param, resolver, authorization, handler) {
+  return async (request) => {
+    const id = parsePositiveIntParam(String(request.params[param]), String(param));
+    const model = await resolver(id, request);
+    const gate = resolveApplicationPolicyGate();
+    const auth = resolveApplicationAuth();
+    const user = currentAuthUser() ?? await auth.resolve(request);
+    gate.authorize(authorization.resource, authorization.action, user, model);
+    if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
+      assertIfMatch(request, etagFromResource(model), {
+        required: authorization.requireIfMatch ?? true
+      });
+    }
+    const response = await handler(request, model);
+    if (isEtagEnabled() && authorization.action === "view") {
+      return applyConditionalGet(request, response, etagFromResource(model));
+    }
+    return response;
+  };
+}
+function securedBindRouteModelByKey(param, resolver, authorization, handler) {
+  return async (request) => {
+    const key = String(request.params[param] ?? "").trim();
+    if (!key) {
+      throw new BadRequestError(`Missing route parameter "${String(param)}".`);
+    }
+    const model = await resolver(key, request);
+    const gate = resolveApplicationPolicyGate();
+    const auth = resolveApplicationAuth();
+    const user = currentAuthUser() ?? await auth.resolve(request);
+    gate.authorize(authorization.resource, authorization.action, user, model);
+    if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
+      assertIfMatch(request, etagFromResource(model), {
+        required: authorization.requireIfMatch ?? true
+      });
+    }
+    const response = await handler(request, model);
+    if (isEtagEnabled() && authorization.action === "view") {
+      return applyConditionalGet(request, response, etagFromResource(model));
+    }
+    return response;
+  };
+}
+export {
+  securedBindRouteModelByKey,
+  securedBindRouteModel
+};

package/dist/entries/providers.js

@@ -416,6 +416,11 @@ class UnauthorizedError2 extends HttpError {
     super(401, message, details);
   }
 }
+class PreconditionFailedError extends HttpError {
+  constructor(message = "Precondition Failed", details) {
+    super(412, message, details);
+  }
+}
 
 // ../../src/core/auth/authContext.ts
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";

package/dist/framework/public-api.d.ts

@@ -19,6 +19,7 @@ export { appendOrganizationScope, appendProjectScope, assertOrganizationReadable
 export { default as MembershipService, resolveMembershipService, } from "../core/auth/membershipService.ts";
 export { Policy, PolicyGate } from "../core/auth/policy.ts";
 export { createScimAuthMiddleware } from "../core/auth/scimAuthMiddleware.ts";
+export { type CacheDriver, type CreateCacheStoreOptions, createCacheStore, } from "../core/cache/createCacheStore.ts";
 export { default as CacheRepository } from "../core/cache/repository.ts";
 export { CACHE_TAGS } from "../core/cache/tags.ts";
 export type { DatabaseConnection } from "../core/database/baseRepository.ts";

package/dist/index.js

@@ -179,6 +179,11 @@ class UnauthorizedError extends HttpError {
     super(401, message, details);
   }
 }
+class PreconditionFailedError extends HttpError {
+  constructor(message = "Precondition Failed", details) {
+    super(412, message, details);
+  }
+}
 
 // ../../src/core/security/safeUrl.ts
 var dnsLookup = dnsLookupImpl;
@@ -1818,6 +1823,12 @@ function resolveApplicationCache() {
 function resolveApplicationQueue() {
   return requireActiveApplicationContext().container.resolve(CORE_QUEUE_TOKEN);
 }
+function resolveApplicationAuth() {
+  return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN);
+}
+function resolveApplicationPolicyGate() {
+  return requireActiveApplicationContext().container.resolve(CORE_POLICY_GATE_TOKEN);
+}
 
 // ../../src/core/jobs/dispatchWebhookJob.ts
 import { createHmac as createHmac2 } from "crypto";
@@ -4702,6 +4713,157 @@ function mergeWebRoutes(dependencies, routes) {
     ...routes
   };
 }
+// ../../src/core/crypto/nonCryptographicHash.ts
+function nonCryptographicDigest(input) {
+  return Bun.hash(input).toString(16);
+}
+
+// ../../src/core/http/etag.ts
+function isEtagEnabled() {
+  return (process.env.FEATURE_ETAG ?? "true") !== "false";
+}
+function formatWeakEtag(digest) {
+  return `W/"${digest}"`;
+}
+function etagFromResource(resource) {
+  const version = resource.updated_at ?? resource.created_at ?? "";
+  const versionText = version instanceof Date ? version.toISOString() : version ? String(version) : "0";
+  const digest = nonCryptographicDigest(`${String(resource.id ?? "0")}:${versionText}`).slice(0, 32);
+  return formatWeakEtag(digest);
+}
+function normalizeEtag(value) {
+  return value.trim();
+}
+function etagValuesMatch(left, right) {
+  return normalizeEtag(left) === normalizeEtag(right);
+}
+function parseEtagList(header) {
+  if (!header) {
+    return [];
+  }
+  return header.split(",").map((value) => normalizeEtag(value)).filter(Boolean);
+}
+function ifNoneMatchSatisfied(request, etag) {
+  const header = request.headers.get("if-none-match");
+  if (!header) {
+    return false;
+  }
+  if (header.trim() === "*") {
+    return true;
+  }
+  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
+}
+function ifMatchSatisfied(request, etag) {
+  const header = request.headers.get("if-match");
+  if (!header) {
+    return false;
+  }
+  if (header.trim() === "*") {
+    return true;
+  }
+  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
+}
+function assertIfMatch(request, etag, options = {}) {
+  const header = request.headers.get("if-match");
+  if (!header) {
+    if (options.required) {
+      throw new PreconditionFailedError("If-Match header is required.");
+    }
+    return;
+  }
+  if (!ifMatchSatisfied(request, etag)) {
+    throw new PreconditionFailedError("Resource ETag does not match If-Match.");
+  }
+}
+function applyEtagHeaders(headers, etag) {
+  const next = new Headers(headers);
+  next.set("ETag", etag);
+  next.set("Cache-Control", "private, must-revalidate");
+  next.append("Vary", "Authorization");
+  next.append("Vary", "X-Tenant-Id");
+  return next;
+}
+function notModifiedResponse(etag) {
+  return new Response(null, {
+    status: 304,
+    headers: applyEtagHeaders(new Headers, etag)
+  });
+}
+function applyConditionalGet(request, response, etag) {
+  if (!isEtagEnabled()) {
+    return response;
+  }
+  if (ifNoneMatchSatisfied(request, etag)) {
+    return notModifiedResponse(etag);
+  }
+  const headers = applyEtagHeaders(new Headers(response.headers), etag);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+
+// ../../src/core/tenant/tenantContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
+var tenantContext = new AsyncLocalStorage4;
+
+// ../../src/core/http/validation.ts
+function parsePositiveIntParam(value, name = "id") {
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new BadRequestError(`Invalid ${name}. Expected a positive integer.`);
+  }
+  return parsed;
+}
+
+// ../../src/bootstrap/http/securedRouteModelBinding.ts
+function isMutatingPolicyAction(action) {
+  return action === "update" || action === "delete";
+}
+function securedBindRouteModel(param, resolver, authorization, handler) {
+  return async (request) => {
+    const id = parsePositiveIntParam(String(request.params[param]), String(param));
+    const model = await resolver(id, request);
+    const gate = resolveApplicationPolicyGate();
+    const auth = resolveApplicationAuth();
+    const user = currentAuthUser() ?? await auth.resolve(request);
+    gate.authorize(authorization.resource, authorization.action, user, model);
+    if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
+      assertIfMatch(request, etagFromResource(model), {
+        required: authorization.requireIfMatch ?? true
+      });
+    }
+    const response = await handler(request, model);
+    if (isEtagEnabled() && authorization.action === "view") {
+      return applyConditionalGet(request, response, etagFromResource(model));
+    }
+    return response;
+  };
+}
+function securedBindRouteModelByKey(param, resolver, authorization, handler) {
+  return async (request) => {
+    const key = String(request.params[param] ?? "").trim();
+    if (!key) {
+      throw new BadRequestError(`Missing route parameter "${String(param)}".`);
+    }
+    const model = await resolver(key, request);
+    const gate = resolveApplicationPolicyGate();
+    const auth = resolveApplicationAuth();
+    const user = currentAuthUser() ?? await auth.resolve(request);
+    gate.authorize(authorization.resource, authorization.action, user, model);
+    if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
+      assertIfMatch(request, etagFromResource(model), {
+        required: authorization.requireIfMatch ?? true
+      });
+    }
+    const response = await handler(request, model);
+    if (isEtagEnabled() && authorization.action === "view") {
+      return applyConditionalGet(request, response, etagFromResource(model));
+    }
+    return response;
+  };
+}
 // ../../src/bootstrap/prefixRouteMap.ts
 function prefixRouteMap(prefix, routes) {
   const normalizedPrefix = prefix.replace(/\/$/, "");
@@ -4761,7 +4923,7 @@ async function parseFormBody(request) {
   return { fields, files };
 }
 // ../../src/bootstrap/web/routing.ts
-import { securedBindRouteModelByKey, withErrorHandling } from "@getstrata/core";
+import { withErrorHandling } from "@getstrata/core";
 function routeParams(request) {
   const normalized = {};
   const raw = request.params;
@@ -4936,6 +5098,8 @@ export {
   toRouteRequest,
   slugify,
   setActiveApplicationContext2 as setActiveApplicationContext,
+  securedBindRouteModelByKey,
+  securedBindRouteModel,
   scheduleRunCommand,
   runProviderPhase,
   runDueScheduledTasks,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/bootstrap",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "description": "Strata application bootstrap — HttpKernel, DI, web session helpers",
   "type": "module",
   "license": "MIT",
@@ -40,6 +40,11 @@
       "import": "./dist/entries/createWebRoutes.js",
       "default": "./dist/entries/createWebRoutes.js"
     },
+    "./http/securedRouteModelBinding": {
+      "types": "./dist/bootstrap/http/securedRouteModelBinding.d.ts",
+      "import": "./dist/entries/http/securedRouteModelBinding.js",
+      "default": "./dist/entries/http/securedRouteModelBinding.js"
+    },
     "./httpKernel": {
       "types": "./dist/bootstrap/httpKernel.d.ts",
       "import": "./dist/entries/httpKernel.js",
@@ -67,14 +72,14 @@
     "build:bundle": "bun build index.ts --outdir dist --target bun --external bun --external eta --external @getstrata/core",
     "build:types": "tsc -p tsconfig.types.json",
     "prepublishOnly": "bun run build",
-    "build:subpaths": "bun build entries/applicationRegistry.ts entries/config.ts entries/context.ts entries/contracts.ts entries/createWebRoutes.ts entries/httpKernel.ts entries/providers.ts entries/providers/view.ts --outdir dist --root . --target bun --external bun --external eta --external @getstrata/core",
+    "build:subpaths": "bun build entries/applicationRegistry.ts entries/config.ts entries/context.ts entries/contracts.ts entries/createWebRoutes.ts entries/http/securedRouteModelBinding.ts entries/httpKernel.ts entries/providers.ts entries/providers/view.ts --outdir dist --root . --target bun --external bun --external eta --external @getstrata/core",
     "build:shims": "true"
   },
   "publishConfig": {
     "access": "public"
   },
   "peerDependencies": {
-    "@getstrata/core": "^0.5.15",
+    "@getstrata/core": "^0.5.16",
     "typescript": "^5.9.0"
   }
 }