@getstrata/bootstrap 0.4.3 → 1.0.1

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @getstrata/bootstrap changelog
 
+## 1.0.1
+
+- `assertProductionSecrets()` rejects secrets still holding a generated `change-me` placeholder. The shipped `SESSION_SECRET` placeholder was 38 characters, so it passed the length check and booted in production unchanged.
+- Cookie sessions write timestamps through the active dialect, so `CookieSessionStore.create()` works on MySQL.
+- Removed the `createRoutes` subpath. It was in-repo fixture HTTP, documented as not an app API, and it packed a stray `dist/_.._/_.._/index.html` asset and dogfood helpers into the tarball.
+- Removed leftover third-party product token strings from the production blocklist.
+- `assertProductionSecrets()` requires `APP_URL` to be a public `http(s)` origin (localhost rejected, plain http warns). Signed links and redirects are built from it.
+- `createWebServer()` records the socket address (IPv4-mapped addresses normalized) in the request context, so throttles, request logs, and session rows see the real client.
+- `CookieSessionAuthManager.signIn()` fills `ip_address` and `user_agent` from the request context when the caller passes no meta. The `Secure` cookie flag now keys on `APP_ENV=production` (or `NODE_ENV`), matching the rest of the framework; generated apps never set `NODE_ENV`, so production cookies were not marked `Secure`.
+- `engines.bun` is declared.
+
+## 1.0.0
+
+- First stable release of `@getstrata/bootstrap`.
+
 ## 0.4.3
 
 - Cookie session `mapUser` / row mapping can pass `email_verified_at` through as `emailVerifiedAt` so HTML email verification works.
@@ -19,7 +34,7 @@
 
 - Peer `@getstrata/core` `^0.7.0`.
 - Production `SESSION_SECRET` is required whenever views are on (`FRONTEND_MODE=server-htmx` or `hybrid`).
-- Hybrid SPA routes stay under `/app/*`. They do not redirect `/`, so staff HTML keeps the home path.
+- Hybrid SPA routes stay under `/app/*`. They do not redirect `/`, so HTML at `/` keeps the home path.
 - `appEnvSchema` validates `FRONTEND_MODE` with the core pattern, including `hybrid`.
 - `HttpKernel.wrapApi` maps thrown HTTP errors to JSON the same way `wrapWeb` maps them to HTML.
 
@@ -27,7 +42,7 @@
 
 - Peer `@getstrata/core` `^0.6.0`.
 - Cookie session SQL uses the current SQL dialect for placeholders, `NOW()`, and `NULLS LAST`.
-- Kernel comments describe guest, verified-email, and password-confirm gates without referring to another framework.
+- Kernel helpers cover guest, verified-email, and password-confirm gates.
 
 ## 0.2.68
 
@@ -42,17 +57,17 @@
 
 ## 0.2.66
 
-- `assertProductionSecrets()` is feature-gated for every app. API tokens no longer imply the previous in-repo app's encryption/CORS/OAuth/public-read checklist. Published test token strings are still denied. the previous in-repo app's extra production profile lives in the app (`src/config/productionSecrets.ts`).
-- **Breaking:** `HttpKernel.wrapWebGuest()` defaults `home` to `/` instead of `/organizations`. Apps with an org home should pass that path (the previous in-repo app already does).
+- `assertProductionSecrets()` is feature-gated for every app. API tokens no longer imply HiroApp's encryption/CORS/OAuth/public-read checklist. Published test token strings are still denied. HiroApp's extra production profile lives in the app (`src/config/productionSecrets.ts`).
+- **Breaking:** `HttpKernel.wrapWebGuest()` defaults `home` to `/` instead of `/organizations`. Apps with an org home should pass that path (HiroApp already does).
 - `createWebRoutes()` no longer seeds a `/` → `/organizations` redirect. The in-repo app owns `/` via its organization module.
 
 ## 0.2.65
 
-- App listener discovery reads `src/listeners` from `process.cwd()` so a built `@getstrata/bootstrap` bundle still finds the previous in-repo app registrars (`import.meta.dir` after `build:bootstrap` is the package dist). Listener boot calls each registrar every time (registrars are idempotent per `eventBus`).
+- App listener discovery reads `src/listeners` from `process.cwd()` so a built `@getstrata/bootstrap` bundle still finds HiroApp registrars (`import.meta.dir` after `build:bootstrap` is the package dist). Listener boot calls each registrar every time (registrars are idempotent per `eventBus`).
 
 ## 0.2.64
 
-- `registerDefaultJobs()` no longer registers the previous in-repo app `webhook.dispatch`. Apps that dispatch model webhooks should call `registerWebhookJobs()` (the previous in-repo app's webhook provider and `queue:work` do).
+- `registerDefaultJobs()` no longer registers HiroApp `webhook.dispatch`. Apps that dispatch model webhooks should call `registerWebhookJobs()` (HiroApp's webhook provider and `queue:work` do).
 
 ## 0.2.63
 
@@ -60,7 +75,7 @@
 
 ## 0.2.62
 
-- `HttpKernel.wrapWebPasswordConfirm()` is the previous PHP framework `password.confirm` for HTML routes. Peer `@getstrata/core` `^0.5.75`.
+- `HttpKernel.wrapWebPasswordConfirm()` is the HTML password-confirm gate. Peer `@getstrata/core` `^0.5.75`.
 
 ## 0.2.61
 
@@ -72,7 +87,7 @@
 
 ## 0.2.59
 
-- `HttpKernel.wrapWebGuest()` is the previous PHP framework `guest` / `RedirectIfAuthenticated`. Signed-in HTML users redirect to `/organizations` (override the home path). Peer `@getstrata/core` `^0.5.72`.
+- `HttpKernel.wrapWebGuest()` sends signed-in HTML users to `/organizations` (override the home path). Peer `@getstrata/core` `^0.5.72`.
 
 ## 0.2.58
 
@@ -88,7 +103,7 @@
 
 ## 0.2.55
 
-- HttpKernel and route builders read `isViewsEnabled` / `isSpaEnabled` from `@getstrata/core/runtime/frontendMode` instead of the previous in-repo app `src/config/frontend`.
+- HttpKernel and route builders read `isViewsEnabled` / `isSpaEnabled` from `@getstrata/core/runtime/frontendMode` instead of HiroApp `src/config/frontend`.
 
 ## 0.2.54
 
@@ -112,7 +127,7 @@
 
 ## 0.2.50
 
-- `createCookieSessionAuthManager` / `CookieSessionGuard` turn `CookieSessionStore` into an `AuthGuard` / `AuthManager` for `CORE_AUTH_TOKEN`. Supply a `mapUser` mapper; the previous in-repo app abilities are not baked in. Omit `sql` to read the client from `bindDatabaseConnection()` on every call.
-- `checkDatabase()` / `createHealthRoutes()` ping the bound database client, not the previous in-repo app's private connection holder. `/health` stays `{ status: "ok" }` unless `{ pingOnHealth: true }`. Extra JSON fields are optional.
-- `assertProductionSecrets()` is feature-gated. A production HTMX app with `SESSION_SECRET` (32+), `AUTH_DEV_HEADERS=false`, and feature flags off does not need the previous in-repo app API tokens. the previous in-repo app's current production env (rotated tokens, CORS, pepper, expiry) still passes.
+- `createCookieSessionAuthManager` / `CookieSessionGuard` turn `CookieSessionStore` into an `AuthGuard` / `AuthManager` for `CORE_AUTH_TOKEN`. Supply a `mapUser` mapper; HiroApp abilities are not baked in. Omit `sql` to read the client from `bindDatabaseConnection()` on every call.
+- `checkDatabase()` / `createHealthRoutes()` ping the bound database client, not HiroApp's private connection holder. `/health` stays `{ status: "ok" }` unless `{ pingOnHealth: true }`. Extra JSON fields are optional.
+- `assertProductionSecrets()` is feature-gated. A production HTMX app with `SESSION_SECRET` (32+), `AUTH_DEV_HEADERS=false`, and feature flags off does not need HiroApp API tokens. HiroApp's current production env (rotated tokens, CORS, pepper, expiry) still passes.
 - Re-exports `CORE_ABILITY_CHECKER_TOKEN` and `CORE_AUTH_USER_DIRECTORY_TOKEN`.

package/README.md

@@ -1,6 +1,12 @@
 # @getstrata/bootstrap
 
-Application bootstrap for Strata apps: HttpKernel, service container, and web utilities.
+Application bootstrap for [Strata](https://github.com/EyK-26/strata) apps: HttpKernel, service container, and web session helpers. Requires Bun (tested on 1.4.x).
+
+Generate an app rather than wiring this by hand:
+
+```bash
+bunx create-strata my-app
+```
 
 ## Install
 
@@ -8,6 +14,16 @@ Application bootstrap for Strata apps: HttpKernel, service container, and web ut
 bun add @getstrata/bootstrap @getstrata/core
 ```
 
+## HttpKernel and providers
+
+```typescript
+import { coreProviders, createAppContext, createHttpKernel } from "@getstrata/bootstrap";
+```
+
+`createAppContext()` does not call `assertProductionSecrets`. Call that yourself when `APP_ENV=production`; it is feature-gated, so an HTML app with API tokens off is not asked for token secrets. It rejects empty secrets, short `SESSION_SECRET` values, wildcard `CORS_ALLOWED_ORIGINS`, `AUTH_DEV_HEADERS=true`, `FEATURE_PUBLIC_READS=true`, and any secret still holding a generated `change-me` placeholder.
+
+Build routes with `buildWebModuleRoutes` and `buildModuleRoutes`.
+
 ## Web utilities
 
 ```typescript
@@ -20,22 +36,26 @@ import {
 } from "@getstrata/bootstrap";
 ```
 
-`CookieSessionStore` can read `is_admin` from the user row for `wrapWebGlobalAdmin`. Pass `loadSessionUser` when your `users` table does not match the default `SELECT u.*`.
+`CookieSessionStore` reads `is_admin` from the user row for `wrapWebGlobalAdmin`. Pass `loadSessionUser` when your `users` table does not match the default `SELECT u.*`.
 
-## HttpKernel
+HTML apps should bind `createCookieSessionAuthManager` from `@getstrata/bootstrap/web/session` rather than the HMAC `SessionGuard`, then use `signIn` / `signOut` or the redirect helpers. Pass `mapUser` to map roles.
 
-```typescript
-import { createHttpKernel, createAppContext, coreProviders } from "@getstrata/bootstrap";
-```
+`wrapWeb` applies the web group (CSRF plus flash) and `withErrorHandling`, so a CSRF `ForbiddenError` becomes an HTML 403 when views are on (`FRONTEND_MODE=server-htmx` or `hybrid`). `wrapWebGuest` sends signed-in users to `/` by default; pass a string or `(user) => path` to override. `wrapWebLogin` and `wrapWebRegister` already include the web group plus throttle, so do not wrap them with `wrapWeb` again. The throttle callback should return an HTML form at 429.
+
+## SPA routes
+
+`createSpaRoutes` and `mergeSpaRoutes` serve `SPA_PREFIX` (default `/app`) as `prefix`, `prefix/`, and `prefix/*`. Hybrid keeps HTML at `/`. Pass `distDirectory` and `wrap` when the app is not the process cwd. Until the SPA is built, the prefix answers 503 telling you to run `bun run frontend:build`; generated apps ship that script.
 
-`createAppContext()` does not call `assertProductionSecrets`. That helper is feature-gated (tokens, CORS, OAuth, encryption only when those features are on). HTML apps can call it without API tokens when those flags are off. See [docs/BUILDING-APPS.md](../../docs/BUILDING-APPS.md) and [docs/PRODUCTION.md](../../docs/PRODUCTION.md).
+## Queue
 
-HTML apps should bind `createCookieSessionAuthManager` from `@getstrata/bootstrap/web/session` instead of HMAC `SessionGuard`. Use `signIn` / `signOut` (or the redirect helpers). Pass `mapUser` to map roles in the app.
+`registerDefaultJobs()` registers `cache.invalidate-tags` and `audit.export` only. Apps that dispatch model webhooks call `registerWebhookJobs()` themselves.
 
-`wrapWeb` applies the web group (CSRF + flash) and `withErrorHandling`, so CSRF `ForbiddenError` becomes an HTML 403 when views are on (`FRONTEND_MODE=server-htmx` or `hybrid`). `wrapWebGuest` sends signed-in users to `/` by default (pass a string or `(user) => path` to override). `wrapWebLogin` / `wrapWebRegister` include that web group plus throttle. Do not wrap them with `wrapWeb` again. The throttle callback should return an HTML form at 429.
+## Not a starter API
 
-`createSpaRoutes` / `mergeSpaRoutes` serve `SPA_PREFIX` (default `/app`) as `prefix`, `prefix/`, and `prefix/*`. Hybrid does not redirect `/`. Pass `distDirectory` and `wrap` when the app is not the process cwd. Apps should not copy a second static-file server.
+`@getstrata/bootstrap/createWebRoutes` and `@getstrata/bootstrap/schedule` assemble in-repo fixture HTTP for framework tests. They are not a general app API. New apps use `buildWebModuleRoutes` and `buildModuleRoutes`.
 
-`registerDefaultJobs()` registers `cache.invalidate-tags` and `audit.export` only. Apps that dispatch model webhooks should call `registerWebhookJobs()` themselves.
+## Docs
 
-These subpaths assemble leftover fixture HTTP for framework tests and are not a generic starter API: `@getstrata/bootstrap/createRoutes`, `@getstrata/bootstrap/schedule`, `@getstrata/bootstrap/createWebRoutes`. New apps should use `buildWebModuleRoutes` / `buildModuleRoutes`. Generated examples use `createApp()` in `apps/hiroapp`.
+- [Building apps](https://github.com/EyK-26/strata/blob/main/docs/BUILDING-APPS.md)
+- [Production](https://github.com/EyK-26/strata/blob/main/docs/PRODUCTION.md)
+- [Auth choices](https://github.com/EyK-26/strata/blob/main/docs/AUTH.md)

package/dist/bootstrap/web/server.d.ts

@@ -1,4 +1,4 @@
-import type { BunRequest } from "bun";
+import type { BunRequest, Server } from "bun";
 import type { AppRouteMap } from "../contracts.ts";
 export interface WebServerOptions {
     port: number;
@@ -7,7 +7,7 @@ export interface WebServerOptions {
     publicDir?: string;
     onRequest?: (request: Request) => Promise<void> | void;
 }
-type BunRouteHandler = (request: BunRequest) => Response | Promise<Response>;
+type BunRouteHandler = (request: BunRequest, server: Server<unknown>) => Response | Promise<Response>;
 declare function convertAppRoutesToBunRoutes(routes: AppRouteMap): Record<string, Record<string, BunRouteHandler>>;
-export declare function createWebServer(options: WebServerOptions): Bun.Server<undefined>;
+export declare function createWebServer(options: WebServerOptions): Server<undefined>;
 export { convertAppRoutesToBunRoutes };

package/dist/entries/applicationRegistry.js

@@ -1,6 +1,4 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/applicationRegistry.ts
 import {
   resolveApplicationAuth,

package/dist/entries/buildModuleRoutes.js

@@ -1,6 +1,4 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/buildModuleRoutes.ts
 import { conditionalJsonResponse } from "@getstrata/core/http/conditionalResponse";
 import { applyMiddlewareToRoutes } from "@getstrata/core/http/middleware";
@@ -146,10 +144,10 @@ class HttpKernel {
         const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
         const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
         if (!redisUrl) {
-          const maxAttempts2 = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
+          const maxAttempts = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
           return [
             createMemoryThrottleMiddleware({
-              maxAttempts: Number.isFinite(maxAttempts2) ? maxAttempts2 : 120,
+              maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
               decaySeconds: 60
             })
           ];

package/dist/entries/buildWebModuleRoutes.js

@@ -1,6 +1,4 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/buildWebModuleRoutes.ts
 import { applyMiddlewareToRoutes as applyMiddlewareToRoutes2 } from "@getstrata/core/http/middleware";
 
@@ -149,10 +147,10 @@ class HttpKernel {
         const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
         const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
         if (!redisUrl) {
-          const maxAttempts2 = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
+          const maxAttempts = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
           return [
             createMemoryThrottleMiddleware({
-              maxAttempts: Number.isFinite(maxAttempts2) ? maxAttempts2 : 120,
+              maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
               decaySeconds: 60
             })
           ];

package/dist/entries/cache/modelCacheTags.js

@@ -1,6 +1,4 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/discoverModules.ts
 import { readdirSync } from "fs";
 import { join } from "path";

package/dist/entries/config.js

@@ -1,6 +1,4 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/config.ts
 import {
   CORE_ABILITY_CHECKER_TOKEN,

package/dist/entries/context.js

@@ -1,6 +1,4 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/applicationRegistry.ts
 import {
   resolveApplicationAuth,

package/dist/entries/contracts.js

@@ -1,6 +1,4 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/contracts.ts
 import {
   ConfigStore,

package/dist/entries/createSpaRoutes.js

@@ -1,6 +1,4 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/createSpaRoutes.ts
 import { join } from "path";
 import { jsonResponse } from "@getstrata/core/http/response";
@@ -41,7 +39,7 @@ function createSpaDocumentHandler(prefix, distDirectory) {
 function createSpaRoutes(_dependencies, options = {}) {
   const prefix = options.prefix ?? readSpaPrefix();
   const distDirectory = options.distDirectory ?? SPA_DIST_DIRECTORY;
-  const wrap = options.wrap ?? ((handler2) => handler2);
+  const wrap = options.wrap ?? ((handler) => handler);
   const handler = wrap(createSpaDocumentHandler(prefix, distDirectory));
   const routes = {
     [prefix]: handler,

package/dist/entries/createWebRoutes.js

@@ -1,6 +1,4 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/createWebRoutes.ts
 import { join as join2 } from "path";
 import { isViewsEnabled as isViewsEnabled2 } from "@getstrata/core/runtime/frontendMode";
@@ -154,10 +152,10 @@ class HttpKernel {
         const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
         const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
         if (!redisUrl) {
-          const maxAttempts2 = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
+          const maxAttempts = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
           return [
             createMemoryThrottleMiddleware({
-              maxAttempts: Number.isFinite(maxAttempts2) ? maxAttempts2 : 120,
+              maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
               decaySeconds: 60
             })
           ];

package/dist/entries/dependencies.js

@@ -1,6 +1,4 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/applicationRegistry.ts
 import {
   resolveApplicationAuth,

package/dist/entries/discoverModules.js

@@ -1,6 +1,4 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/discoverModules.ts
 import { readdirSync } from "fs";
 import { join } from "path";

package/dist/entries/health.js

@@ -1,6 +1,4 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/health.ts
 import { getBoundDatabaseConnection } from "@getstrata/core/database/boundConnection";
 import { getDefaultDatabasePool } from "@getstrata/core/database/defaultConnection";

package/dist/entries/http/securedRouteModelBinding.js

@@ -1,6 +1,4 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/http/securedRouteModelBinding.ts
 import {
   securedBindRouteModel,

package/dist/entries/httpKernel.js

@@ -1,6 +1,4 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/httpKernel.ts
 import {
   hasVerifiedEmail,
@@ -142,10 +140,10 @@ class HttpKernel {
         const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
         const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
         if (!redisUrl) {
-          const maxAttempts2 = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
+          const maxAttempts = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
           return [
             createMemoryThrottleMiddleware({
-              maxAttempts: Number.isFinite(maxAttempts2) ? maxAttempts2 : 120,
+              maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
               decaySeconds: 60
             })
           ];

package/dist/entries/listeners/invalidateCacheOnModelWrite.js

@@ -1,6 +1,4 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/listeners/invalidateCacheOnModelWrite.ts
 import { eventBus, modelEventName } from "@getstrata/core/events";
 import { InvalidateCacheTagsJob } from "@getstrata/core/jobs/invalidateCacheTagsJob";

package/dist/entries/membershipService.js

@@ -1,6 +1,4 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/membershipService.ts
 import { resolveMembershipService } from "@getstrata/core/auth/membershipService";
 export {

package/dist/entries/metricsRoutes.js

@@ -1,6 +1,4 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/metricsRoutes.ts
 import { timingSafeEqual } from "crypto";
 import { prometheusRegistry } from "@getstrata/core/metrics/prometheus";

package/dist/entries/providers/view.js

@@ -1,6 +1,4 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/providers/view.ts
 import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
 import { appDisplayName } from "@getstrata/core/runtime/appKeyPrefix";

package/dist/entries/providers.js

@@ -1,6 +1,4 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/providers/auth.ts
 import { BasicAuthGuard } from "@getstrata/core/auth/basicAuthGuard";
 import {

package/dist/entries/queue/defaultJobs.js

@@ -1,6 +1,4 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/queue/defaultJobs.ts
 import { ExportAuditLogsJob } from "@getstrata/core/jobs/exportAuditLogsJob";
 import { InvalidateCacheTagsJob } from "@getstrata/core/jobs/invalidateCacheTagsJob";

package/dist/entries/routeRegistry.js

@@ -1,6 +1,4 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/routeRegistry.ts
 class RouteRegistry {
   routes = [];

package/dist/entries/schedule.js

@@ -1,6 +1,4 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/schedule.ts
 import { ExportAuditLogsJob } from "@getstrata/core/jobs/exportAuditLogsJob";
 import { appLogger } from "@getstrata/core/logging/logger";

package/dist/entries/secretsGuard.js

@@ -1,6 +1,4 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/secretsGuard.ts
 import { isViewsMode, parseFrontendMode } from "@getstrata/core/runtime/frontendMode";
 var PUBLISHED_TEST_ADMIN_API_TOKEN = "strata-admin-test-token";
@@ -9,14 +7,28 @@ var PUBLISHED_TEST_SCIM_BEARER_TOKEN = "strata-scim-test-token";
 var MIN_SESSION_SECRET_LENGTH = 32;
 var PUBLISHED_TEST_TOKENS = new Set([
   PUBLISHED_TEST_ADMIN_API_TOKEN,
-  PUBLISHED_TEST_MEMBER_API_TOKEN,
-  "workhub-admin-test-token",
-  "workhub-member-test-token"
-]);
-var PUBLISHED_TEST_SCIM_TOKENS = new Set([
-  PUBLISHED_TEST_SCIM_BEARER_TOKEN,
-  "workhub-scim-test-token"
+  PUBLISHED_TEST_MEMBER_API_TOKEN
 ]);
+var PUBLISHED_TEST_SCIM_TOKENS = new Set([PUBLISHED_TEST_SCIM_BEARER_TOKEN]);
+var PLACEHOLDER_SECRET_PATTERN = /change-me/i;
+var SECRETS_TO_ROTATE = [
+  "SESSION_SECRET",
+  "TOKEN_HASH_PEPPER",
+  "METRICS_TOKEN",
+  "SCIM_BEARER_TOKEN",
+  "JWT_SECRET",
+  "OAUTH_STATE_SECRET",
+  "KMS_ENCRYPTION_KEY",
+  "STRIPE_WEBHOOK_SECRET",
+  "ADMIN_API_TOKEN",
+  "MEMBER_API_TOKEN"
+];
+function assertNoPlaceholderSecrets(env) {
+  const unrotated = SECRETS_TO_ROTATE.filter((name) => PLACEHOLDER_SECRET_PATTERN.test(env[name]?.trim() ?? ""));
+  if (unrotated.length > 0) {
+    throw new Error(`Production startup blocked: replace the generated placeholder values for ${unrotated.join(", ")}.`);
+  }
+}
 function isEnabled(value, defaultEnabled) {
   if (value === undefined) {
     return defaultEnabled;
@@ -92,12 +104,30 @@ function assertFeatureProductionSecrets(env) {
     console.warn("[secrets] SIEM_EXPORT_URL is not configured; audit logs remain database-only.");
   }
 }
+var LOCAL_HOSTS = new Set(["localhost", "127.0.0.1", "0.0.0.0", "::1", "[::1]"]);
+function assertPublicAppUrl(env) {
+  const raw = env.APP_URL?.trim() ?? "";
+  let url = null;
+  try {
+    url = raw ? new URL(raw) : null;
+  } catch {
+    url = null;
+  }
+  if (!url || !/^https?:$/.test(url.protocol) || LOCAL_HOSTS.has(url.hostname)) {
+    throw new Error("Production startup blocked: set APP_URL to the public origin of this app (for example https://app.example.com). Signed links and redirects are built from it.");
+  }
+  if (url.protocol === "http:") {
+    console.warn(`[secrets] APP_URL uses http; session cookies are marked Secure in production and will not be sent over ${raw}.`);
+  }
+}
 function assertProductionSecrets(env = process.env) {
   const appEnv = env.APP_ENV ?? "local";
   if (appEnv !== "production") {
     return;
   }
+  assertNoPlaceholderSecrets(env);
   assertAuthDevHeadersDisabled(env);
+  assertPublicAppUrl(env);
   if (isTokenAuthEnabled(env)) {
     assertTokenAuthProductionSecrets(env);
   }

package/dist/entries/web/forms.js

@@ -1,6 +1,4 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/web/forms.ts
 import {
   createCsrfProtection

package/dist/entries/web/routing.js

@@ -1,6 +1,4 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/web/routing.ts
 import { requestPrefersJson } from "@getstrata/core/http/contentNegotiation";
 import { withErrorHandling as withErrorHandling2 } from "@getstrata/core/http/response";
@@ -152,10 +150,10 @@ class HttpKernel {
         const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
         const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
         if (!redisUrl) {
-          const maxAttempts2 = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
+          const maxAttempts = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
           return [
             createMemoryThrottleMiddleware({
-              maxAttempts: Number.isFinite(maxAttempts2) ? maxAttempts2 : 120,
+              maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
               decaySeconds: 60
             })
           ];

package/dist/entries/web/server.js

@@ -1,17 +1,20 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/web/server.ts
 import { currentRequestMeta, runWithRequestMeta } from "@getstrata/core/http/requestMetaContext";
 import { notFoundHtmlResponse } from "@getstrata/core/view";
+function socketAddress(server, request) {
+  const address = server?.requestIP(request)?.address;
+  return address ? address.replace(/^::ffff:/i, "") : null;
+}
 async function missingHtmlResponse() {
   return notFoundHtmlResponse();
 }
 function wrapRouteHandler(handler) {
-  return async (request) => {
+  return async (request, server) => {
     return await runWithRequestMeta({
       ...currentRequestMeta(),
       request,
+      ipAddress: socketAddress(server, request),
       userAgent: request.headers.get("user-agent")
     }, async () => {
       const response = await handler(request);
@@ -47,10 +50,11 @@ function createWebServer(options) {
   return Bun.serve({
     port: options.port,
     ...bunRoutes ? { routes: bunRoutes } : {},
-    async fetch(request) {
+    async fetch(request, server) {
       return await runWithRequestMeta({
         ...currentRequestMeta(),
         request,
+        ipAddress: socketAddress(server, request),
         userAgent: request.headers.get("user-agent")
       }, async () => {
         await options.onRequest?.(request);

package/dist/entries/web/session.js

@@ -1,13 +1,13 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/web/session.ts
 import { createHmac, randomBytes } from "crypto";
 import { AuthManager } from "@getstrata/core/auth/guard";
 import { getBoundDatabaseConnection } from "@getstrata/core/database/boundConnection";
 import { getDefaultDatabasePool } from "@getstrata/core/database/defaultConnection";
-import { currentSqlDialect } from "@getstrata/core/database/dialect";
+import { currentSqlDialect, sqlTimestamp } from "@getstrata/core/database/dialect";
 import { readRequestCookie } from "@getstrata/core/http/cookies";
+import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
+import { isProductionEnv } from "@getstrata/core/runtime/appEnv";
 import { timingSafeCompareString } from "@getstrata/core/security/timingSafeCompare";
 function sqlPlaceholder(index) {
   return currentSqlDialect().placeholder(index);
@@ -110,7 +110,7 @@ class CookieSessionStore {
     return sessionId;
   }
   withSecureFlag(header) {
-    if (true) {
+    if (!isProductionEnv()) {
       return header;
     }
     return header.includes("Secure") ? header : `${header}; Secure`;
@@ -122,7 +122,7 @@ class CookieSessionStore {
     const id = randomBytes(32).toString("hex");
     const expires = new Date(Date.now() + this.maxAgeSeconds * 1000);
     await this.sql().unsafe(`INSERT INTO sessions (id, user_id, expires_at, user_agent, ip_address, last_active_at)
-       VALUES (${sqlPlaceholder(1)}, ${sqlPlaceholder(2)}, ${sqlPlaceholder(3)}, ${sqlPlaceholder(4)}, ${sqlPlaceholder(5)}, ${sqlNow()})`, [id, user.id, expires.toISOString(), meta.userAgent ?? null, meta.ipAddress ?? null]);
+       VALUES (${sqlPlaceholder(1)}, ${sqlPlaceholder(2)}, ${sqlPlaceholder(3)}, ${sqlPlaceholder(4)}, ${sqlPlaceholder(5)}, ${sqlNow()})`, [id, user.id, sqlTimestamp(expires), meta.userAgent ?? null, meta.ipAddress ?? null]);
     return id;
   }
   async destroy(sessionId) {
@@ -178,7 +178,11 @@ class CookieSessionAuthManager extends AuthManager {
     this.registerGuard("session", guard);
   }
   async signIn(user, meta = {}) {
-    const sessionId = await this.store.create(user, meta);
+    const current = currentRequestMeta();
+    const sessionId = await this.store.create(user, {
+      userAgent: meta.userAgent ?? current.userAgent ?? null,
+      ipAddress: meta.ipAddress ?? current.ipAddress ?? null
+    });
     return { sessionId, setCookie: this.store.cookieHeader(user, sessionId) };
   }
   async signOut(request) {

package/dist/entries/web/slug.js

@@ -1,6 +1,4 @@
 // @bun
-var __jsonParse = (a) => JSON.parse(a);
-
 // ../../src/bootstrap/web/slug.ts
 function slugify(value) {
   return value.toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80);