@getstrata/bootstrap 1.0.9 → 1.1.1

package/dist/entries/discoverListeners.js

@@ -0,0 +1,54 @@
+// @bun
+// ../../src/bootstrap/discoverListeners.ts
+import { existsSync, readdirSync } from "fs";
+import { createRequire } from "module";
+import { join } from "path";
+var requireListener = createRequire(import.meta.url);
+var DISCOVER_LISTENERS_STATE_KEY = Symbol.for("@getstrata/discoverListenersState");
+function readDiscoverListenersState() {
+  const existing = globalThis[DISCOVER_LISTENERS_STATE_KEY];
+  if (existing) {
+    return existing;
+  }
+  const state = {};
+  globalThis[DISCOVER_LISTENERS_STATE_KEY] = state;
+  return state;
+}
+function resolveListenersDirectory() {
+  const fromCwd = join(process.cwd(), "src", "listeners");
+  if (existsSync(fromCwd)) {
+    return fromCwd;
+  }
+  return join(import.meta.dir, "../listeners");
+}
+function loadDiscoveredListeners() {
+  const listenersDirectory = resolveListenersDirectory();
+  let entries;
+  try {
+    entries = readdirSync(listenersDirectory, { withFileTypes: true }).filter((entry) => entry.isFile() && /\.(ts|js)$/.test(entry.name)).map((entry) => entry.name);
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return [];
+    }
+    throw error;
+  }
+  const listeners = entries.map((fileName) => {
+    const filePath = join(listenersDirectory, fileName);
+    const loaded = requireListener(filePath);
+    return loaded.default;
+  });
+  return listeners.filter((listener) => typeof listener === "function");
+}
+function discoverListeners() {
+  const state = readDiscoverListenersState();
+  state.appListeners ??= loadDiscoveredListeners();
+  return state.appListeners;
+}
+function resetDiscoverListenersForTests() {
+  const state = readDiscoverListenersState();
+  state.appListeners = undefined;
+}
+export {
+  discoverListeners,
+  resetDiscoverListenersForTests
+};

package/dist/entries/health.js

@@ -3,6 +3,7 @@
 import { getBoundDatabaseConnection } from "@getstrata/core/database/boundConnection";
 import { getDefaultDatabasePool } from "@getstrata/core/database/defaultConnection";
 import { jsonResponse } from "@getstrata/core/http/response";
+import { envFlagEnabled } from "@getstrata/core/runtime/appEnv";
 var {RedisClient } = globalThis.Bun;
 
 // ../../src/bootstrap/config.ts
@@ -114,10 +115,10 @@ function createHealthRoutes(dependencies, options = {}) {
     "/ready": async () => {
       const extra = await resolveExtraFields(options.extra);
       const { checks, ready } = await collectDependencyChecks(dependencies);
+      const debug = envFlagEnabled(process.env.APP_DEBUG);
       return jsonResponse({
         status: ready ? "ready" : "not_ready",
-        checks,
-        ...extra
+        ...debug ? { checks, ...extra } : {}
       }, { status: ready ? 200 : 503 });
     }
   };

package/dist/entries/httpKernel.js

@@ -134,8 +134,9 @@ class HttpKernel {
       case "web":
         return isViewsEnabled() ? [createFlashMiddleware(), createCsrfMiddleware()] : [];
       case "api": {
+        const csrf = createCsrfMiddleware();
         if (!this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
-          return [];
+          return [csrf];
         }
         const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
         const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
@@ -145,7 +146,8 @@ class HttpKernel {
             createMemoryThrottleMiddleware({
               maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
               decaySeconds: 60
-            })
+            }),
+            csrf
           ];
         }
         const maxAttempts = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
@@ -154,7 +156,8 @@ class HttpKernel {
             redisUrl,
             maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
             decaySeconds: 60
-          })
+          }),
+          csrf
         ];
       }
       default:
@@ -164,13 +167,14 @@ class HttpKernel {
   wrap(groups, handler) {
     const names = Array.isArray(groups) ? groups : [groups];
     const middleware = names.flatMap((name) => this.group(name));
-    if (middleware.length === 0) {
-      return handler;
+    const wrapped = middleware.length === 0 ? handler : withMiddleware(...middleware)(handler);
+    if (names.includes("api")) {
+      return withJsonErrorHandling(wrapped);
     }
-    return withMiddleware(...middleware)(handler);
+    return wrapped;
   }
   wrapApi(handler) {
-    return withJsonErrorHandling(this.wrap(["api", "authenticated"], handler));
+    return this.wrap(["api", "authenticated"], handler);
   }
   wrapWeb(handler) {
     return withErrorHandling(this.wrap("web", handler));
@@ -279,41 +283,28 @@ class HttpKernel {
     return [createRequireVerifiedMiddleware(auth)];
   }
   wrapThrottle(scope, rateLimit, handler) {
-    const middleware = [];
     const memoryKeyPrefix = scope === "login" ? "login-throttle:" : "register-throttle:";
-    if (this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
-      const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
-      const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
-      if (redisUrl) {
-        const throttle = scope === "login" ? createLoginThrottleMiddleware({
-          redisUrl,
-          maxAttempts: rateLimit.maxAttempts,
-          decaySeconds: rateLimit.decaySeconds
-        }) : createThrottleMiddleware({
-          redisUrl,
-          maxAttempts: rateLimit.maxAttempts,
-          decaySeconds: rateLimit.decaySeconds,
-          keyPrefix: memoryKeyPrefix
-        });
-        middleware.push(throttle);
-      } else {
-        middleware.push(createMemoryThrottleMiddleware({
-          maxAttempts: rateLimit.maxAttempts,
-          decaySeconds: rateLimit.decaySeconds,
-          keyPrefix: memoryKeyPrefix
-        }));
-      }
-    } else {
-      middleware.push(createMemoryThrottleMiddleware({
+    const redisUrl = this.dependencies.container.has(CORE_CONFIG_TOKEN) ? this.dependencies.container.resolve(CORE_CONFIG_TOKEN).get(REDIS_URL_CONFIG_KEY)?.trim() ?? "" : "";
+    if (scope === "login") {
+      return withMiddleware(createLoginThrottleMiddleware({
+        ...redisUrl ? { redisUrl } : {},
+        maxAttempts: rateLimit.maxAttempts,
+        decaySeconds: rateLimit.decaySeconds
+      }))(handler);
+    }
+    if (redisUrl) {
+      return withMiddleware(createThrottleMiddleware({
+        redisUrl,
         maxAttempts: rateLimit.maxAttempts,
         decaySeconds: rateLimit.decaySeconds,
         keyPrefix: memoryKeyPrefix
-      }));
-    }
-    if (middleware.length === 0) {
-      return handler;
+      }))(handler);
     }
-    return withMiddleware(...middleware)(handler);
+    return withMiddleware(createMemoryThrottleMiddleware({
+      maxAttempts: rateLimit.maxAttempts,
+      decaySeconds: rateLimit.decaySeconds,
+      keyPrefix: memoryKeyPrefix
+    }))(handler);
   }
 }
 function createHttpKernel(dependencies) {

package/dist/entries/metricsRoutes.js

@@ -2,6 +2,7 @@
 // ../../src/bootstrap/metricsRoutes.ts
 import { timingSafeEqual } from "crypto";
 import { prometheusRegistry } from "@getstrata/core/metrics/prometheus";
+import { isProductionEnv } from "@getstrata/core/runtime/appEnv";
 function tokensMatch(left, right) {
   const leftBuffer = Buffer.from(left);
   const rightBuffer = Buffer.from(right);
@@ -17,7 +18,7 @@ function authorizeMetrics(request) {
   if (expected) {
     return presented.length > 0 && tokensMatch(presented, expected);
   }
-  if ((process.env.APP_ENV ?? "local") === "production") {
+  if (isProductionEnv()) {
     return false;
   }
   return true;

package/dist/entries/providers.js

@@ -14,7 +14,7 @@ import { SessionGuard } from "@getstrata/core/auth/sessionGuard";
 import { envFlagEnabled } from "@getstrata/core/runtime/appEnv";
 var authConfig = {
   allowDevHeaders: envFlagEnabled(process.env.AUTH_DEV_HEADERS),
-  tokenDefaultAbilities: ["*"]
+  tokenDefaultAbilities: []
 };
 
 // ../../src/bootstrap/config.ts
@@ -50,7 +50,7 @@ var authProvider = {
     config.set("auth.allowDevHeaders", authConfig.allowDevHeaders);
     const apiGuard = new DatabaseTokenGuard(container);
     const sessionGuard = new SessionGuard(container);
-    const jwtGuard = new JwtGuard;
+    const jwtGuard = new JwtGuard(container);
     const basicGuard = new BasicAuthGuard(container);
     const guards = [apiGuard, jwtGuard, basicGuard, sessionGuard];
     if (authConfig.allowDevHeaders) {
@@ -95,7 +95,7 @@ import { validateEnv } from "@getstrata/core/config/envSchema";
 var appConfig = {
   name: process.env.APP_NAME?.trim() || "Strata",
   env: process.env.APP_ENV ?? "local",
-  debug: (process.env.APP_DEBUG ?? "true") !== "false",
+  debug: (process.env.APP_DEBUG ?? "false") === "true",
   url: process.env.APP_URL ?? "http://localhost:3000",
   apiPrefix: process.env.API_PREFIX ?? "/api/v1"
 };
@@ -276,8 +276,19 @@ var events_default = eventsProvider;
 
 // ../../src/bootstrap/discoverListeners.ts
 import { existsSync, readdirSync } from "fs";
+import { createRequire } from "module";
 import { join } from "path";
-import { pathToFileURL } from "url";
+var requireListener = createRequire(import.meta.url);
+var DISCOVER_LISTENERS_STATE_KEY = Symbol.for("@getstrata/discoverListenersState");
+function readDiscoverListenersState() {
+  const existing = globalThis[DISCOVER_LISTENERS_STATE_KEY];
+  if (existing) {
+    return existing;
+  }
+  const state = {};
+  globalThis[DISCOVER_LISTENERS_STATE_KEY] = state;
+  return state;
+}
 function resolveListenersDirectory() {
   const fromCwd = join(process.cwd(), "src", "listeners");
   if (existsSync(fromCwd)) {
@@ -285,7 +296,7 @@ function resolveListenersDirectory() {
   }
   return join(import.meta.dir, "../listeners");
 }
-async function loadDiscoveredListeners() {
+function loadDiscoveredListeners() {
   const listenersDirectory = resolveListenersDirectory();
   let entries;
   try {
@@ -296,16 +307,21 @@ async function loadDiscoveredListeners() {
     }
     throw error;
   }
-  const listeners = await Promise.all(entries.map(async (fileName) => {
-    const moduleUrl = pathToFileURL(join(listenersDirectory, fileName)).href;
-    const loaded = await import(moduleUrl);
+  const listeners = entries.map((fileName) => {
+    const filePath = join(listenersDirectory, fileName);
+    const loaded = requireListener(filePath);
     return loaded.default;
-  }));
+  });
   return listeners.filter((listener) => typeof listener === "function");
 }
-var appListeners = await loadDiscoveredListeners();
 function discoverListeners() {
-  return appListeners;
+  const state = readDiscoverListenersState();
+  state.appListeners ??= loadDiscoveredListeners();
+  return state.appListeners;
+}
+function resetDiscoverListenersForTests() {
+  const state = readDiscoverListenersState();
+  state.appListeners = undefined;
 }
 
 // ../../src/bootstrap/listeners/invalidateCacheOnModelWrite.ts
@@ -329,7 +345,7 @@ import {
 // ../../src/bootstrap/discoverModules.ts
 import { readdirSync as readdirSync2 } from "fs";
 import { join as join2 } from "path";
-import { pathToFileURL as pathToFileURL2 } from "url";
+import { pathToFileURL } from "url";
 var DISCOVER_MODULES_STATE_KEY = Symbol.for("@getstrata/discoverModulesState");
 function readDiscoverModulesState() {
   const existing = globalThis[DISCOVER_MODULES_STATE_KEY];
@@ -370,7 +386,7 @@ async function loadDiscoveredModules(options) {
     throw error;
   }
   const modules = await Promise.all(moduleNames.map(async (moduleName) => {
-    const moduleUrl = pathToFileURL2(join2(modulesDirectory, moduleName, "index.ts")).href;
+    const moduleUrl = pathToFileURL(join2(modulesDirectory, moduleName, "index.ts")).href;
     const loaded = await import(moduleUrl);
     return loaded.default;
   }));

package/dist/entries/schedule.js

@@ -14,8 +14,8 @@ function readFeatureFlags() {
     samlLogin: (process.env.FEATURE_SAML ?? "false") === "true",
     scim: (process.env.FEATURE_SCIM ?? "true") !== "false",
     billing: (process.env.FEATURE_BILLING ?? "true") !== "false",
-    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "true") !== "false",
-    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "true") !== "false",
+    siemExport: (process.env.FEATURE_SIEM_EXPORT ?? "false") === "true",
+    publicReads: (process.env.FEATURE_PUBLIC_READS ?? "false") === "true",
     emailVerification: (process.env.FEATURE_EMAIL_VERIFICATION ?? "false") === "true",
     mfa: (process.env.FEATURE_MFA ?? "false") === "true",
     registration: (process.env.FEATURE_REGISTRATION ?? "true") !== "false"

package/dist/entries/secretsGuard.js

@@ -1,7 +1,15 @@
 // @bun
 // ../../src/bootstrap/secretsGuard.ts
+import { getDefaultDatabasePool } from "@getstrata/core/database/defaultConnection";
 import { envFlagEnabled, isProductionEnv } from "@getstrata/core/runtime/appEnv";
 import { isViewsMode, parseFrontendMode } from "@getstrata/core/runtime/frontendMode";
+import {
+  assertPostgresRoleCannotBypassRls,
+  inspectCurrentPostgresRole,
+  isPostgresUrl,
+  postgresUrlUsername
+} from "@getstrata/core/tenant/enableTenantRls";
+import { isRlsTenancy } from "@getstrata/core/tenant/tenancyConfig";
 var PUBLISHED_TEST_ADMIN_API_TOKEN = "strata-admin-test-token";
 var PUBLISHED_TEST_MEMBER_API_TOKEN = "strata-member-test-token";
 var PUBLISHED_TEST_SCIM_BEARER_TOKEN = "strata-scim-test-token";
@@ -22,8 +30,11 @@ var SECRETS_TO_ROTATE = [
   "KMS_ENCRYPTION_KEY",
   "STRIPE_WEBHOOK_SECRET",
   "ADMIN_API_TOKEN",
-  "MEMBER_API_TOKEN"
+  "MEMBER_API_TOKEN",
+  "DATABASE_URL",
+  "APP_DATABASE_URL"
 ];
+var RLS_BYPASS_DATABASE_USERS = new Set(["postgres", "root"]);
 function assertNoPlaceholderSecrets(env) {
   const unrotated = SECRETS_TO_ROTATE.filter((name) => PLACEHOLDER_SECRET_PATTERN.test(env[name]?.trim() ?? ""));
   if (unrotated.length > 0) {
@@ -34,7 +45,11 @@ function isTokenAuthEnabled(env) {
   return Boolean(env.ADMIN_API_TOKEN?.trim()) || Boolean(env.MEMBER_API_TOKEN?.trim()) || envFlagEnabled(env.FEATURE_API_TOKENS);
 }
 function isOAuthEnabled(env) {
-  return envFlagEnabled(env.FEATURE_OAUTH) || envFlagEnabled(env.FEATURE_SAML) || Boolean(env.GITHUB_CLIENT_ID?.trim()) || Boolean(env.OIDC_ISSUER?.trim()) || Boolean(env.SAML_LOGIN_URL?.trim());
+  return envFlagEnabled(env.FEATURE_OAUTH) || envFlagEnabled(env.FEATURE_SAML) || Boolean(env.GITHUB_CLIENT_ID?.trim()) || Boolean(env.OIDC_ISSUER?.trim()) || Boolean(env.SAML_IDP_SSO_URL?.trim()) || Boolean(env.SAML_LOGIN_URL?.trim());
+}
+function isHeaderOnlyAuth(env) {
+  const frontend = env.FRONTEND_MODE?.trim() ?? "";
+  return env.AUTH_MODE === "headers" || frontend === "api" && env.AUTH_DEV_HEADERS === "true";
 }
 function isCorsConfigured(env) {
   return env.CORS_ALLOWED_ORIGINS !== undefined;
@@ -77,8 +92,27 @@ function assertFeatureProductionSecrets(env) {
       throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from published test defaults.");
     }
   }
-  if (envFlagEnabled(env.FEATURE_FIELD_ENCRYPTION) && !env.KMS_ENCRYPTION_KEY?.trim()) {
-    throw new Error("Production startup blocked: set KMS_ENCRYPTION_KEY when field encryption is enabled.");
+  if ((envFlagEnabled(env.FEATURE_FIELD_ENCRYPTION) || envFlagEnabled(env.FEATURE_MFA)) && !env.KMS_ENCRYPTION_KEY?.trim()) {
+    throw new Error("Production startup blocked: set KMS_ENCRYPTION_KEY when field encryption or MFA is enabled.");
+  }
+  if (envFlagEnabled(env.FEATURE_SAML)) {
+    const required = [
+      "SAML_IDP_CERT",
+      "SAML_IDP_SSO_URL",
+      "SAML_SP_ENTITY_ID",
+      "SAML_ACS_URL",
+      "SAML_IDP_ISSUER"
+    ];
+    const missing = required.filter((name) => !env[name]?.trim());
+    if (missing.length > 0) {
+      throw new Error(`Production startup blocked: set ${missing.join(", ")} when FEATURE_SAML=true.`);
+    }
+    if (env.SAML_WANT_RESPONSE_SIGNED === "false") {
+      throw new Error("Production startup blocked: signed SAML responses are required (do not set SAML_WANT_RESPONSE_SIGNED=false).");
+    }
+  }
+  if (envFlagEnabled(env.UPLOAD_ALLOW_UNKNOWN_MIME)) {
+    throw new Error("Production startup blocked: set UPLOAD_ALLOW_UNKNOWN_MIME=false (unknown MIME types are not allowed).");
   }
   if (envFlagEnabled(env.FEATURE_BILLING) && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
     throw new Error("Production startup blocked: set STRIPE_WEBHOOK_SECRET when billing webhooks are enabled.");
@@ -100,6 +134,61 @@ function assertFeatureProductionSecrets(env) {
   }
 }
 var LOCAL_HOSTS = new Set(["localhost", "127.0.0.1", "0.0.0.0", "::1", "[::1]"]);
+var livePostgresRoleInspector = null;
+function setLivePostgresRoleInspectorForTests(inspect) {
+  livePostgresRoleInspector = inspect;
+}
+function rlsRuntimeDatabaseUrl(env) {
+  const app = env.APP_DATABASE_URL?.trim();
+  if (app) {
+    return { name: "APP_DATABASE_URL", raw: app };
+  }
+  const database = env.DATABASE_URL?.trim();
+  if (database) {
+    return { name: "DATABASE_URL", raw: database };
+  }
+  return null;
+}
+function assertRlsUsesAppDatabaseRole(env) {
+  if (!isRlsTenancy(env)) {
+    return;
+  }
+  const runtime = rlsRuntimeDatabaseUrl(env);
+  if (!runtime) {
+    return;
+  }
+  const user = postgresUrlUsername(runtime.raw);
+  if (user === null) {
+    return;
+  }
+  if (user === "") {
+    throw new Error(`TENANCY_DRIVER=rls startup blocked: ${runtime.name} must include a NOBYPASSRLS role username.`);
+  }
+  if (RLS_BYPASS_DATABASE_USERS.has(user.toLowerCase())) {
+    throw new Error(`TENANCY_DRIVER=rls startup blocked: ${runtime.name} for TENANCY_DRIVER=rls must use a NOBYPASSRLS role, not ${user}. FORCE RLS does not apply to PostgreSQL superusers.`);
+  }
+}
+async function defaultInspectLivePostgresRole() {
+  return await inspectCurrentPostgresRole(getDefaultDatabasePool());
+}
+async function assertRlsLiveDatabaseRole(env = process.env, inspect) {
+  if (!isRlsTenancy(env)) {
+    return;
+  }
+  const runtime = rlsRuntimeDatabaseUrl(env);
+  if (!runtime || !isPostgresUrl(runtime.raw)) {
+    return;
+  }
+  const source = runtime.name;
+  assertRlsUsesAppDatabaseRole(env);
+  let role;
+  try {
+    role = await (inspect ?? livePostgresRoleInspector ?? defaultInspectLivePostgresRole)();
+  } catch {
+    throw new Error(`TENANCY_DRIVER=rls startup blocked: could not inspect the live Postgres role for ${source}.`);
+  }
+  assertPostgresRoleCannotBypassRls(role, source);
+}
 function assertPublicAppUrl(env) {
   const raw = env.APP_URL?.trim() ?? "";
   let url = null;
@@ -122,6 +211,9 @@ function assertProductionSecrets(env = process.env) {
   assertNoPlaceholderSecrets(env);
   assertAuthDevHeadersDisabled(env);
   assertPublicAppUrl(env);
+  if (isHeaderOnlyAuth(env)) {
+    throw new Error("Production startup blocked: header-only authentication is not allowed. Configure cookie, token, or JWT auth.");
+  }
   if (isTokenAuthEnabled(env)) {
     assertTokenAuthProductionSecrets(env);
   }
@@ -129,7 +221,10 @@ function assertProductionSecrets(env = process.env) {
   if (isViewsMode(parseFrontendMode(env.FRONTEND_MODE))) {
     assertSessionSecret(env);
   }
+  assertRlsUsesAppDatabaseRole(env);
 }
 export {
-  assertProductionSecrets
+  assertProductionSecrets,
+  assertRlsLiveDatabaseRole,
+  setLivePostgresRoleInspectorForTests
 };

package/dist/entries/web/routing.js

@@ -144,8 +144,9 @@ class HttpKernel {
       case "web":
         return isViewsEnabled() ? [createFlashMiddleware(), createCsrfMiddleware()] : [];
       case "api": {
+        const csrf = createCsrfMiddleware();
         if (!this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
-          return [];
+          return [csrf];
         }
         const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
         const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
@@ -155,7 +156,8 @@ class HttpKernel {
             createMemoryThrottleMiddleware({
               maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
               decaySeconds: 60
-            })
+            }),
+            csrf
           ];
         }
         const maxAttempts = Number(process.env.RATE_LIMIT_PER_MINUTE ?? "120");
@@ -164,7 +166,8 @@ class HttpKernel {
             redisUrl,
             maxAttempts: Number.isFinite(maxAttempts) ? maxAttempts : 120,
             decaySeconds: 60
-          })
+          }),
+          csrf
         ];
       }
       default:
@@ -174,13 +177,14 @@ class HttpKernel {
   wrap(groups, handler) {
     const names = Array.isArray(groups) ? groups : [groups];
     const middleware = names.flatMap((name) => this.group(name));
-    if (middleware.length === 0) {
-      return handler;
+    const wrapped = middleware.length === 0 ? handler : withMiddleware(...middleware)(handler);
+    if (names.includes("api")) {
+      return withJsonErrorHandling(wrapped);
     }
-    return withMiddleware(...middleware)(handler);
+    return wrapped;
   }
   wrapApi(handler) {
-    return withJsonErrorHandling(this.wrap(["api", "authenticated"], handler));
+    return this.wrap(["api", "authenticated"], handler);
   }
   wrapWeb(handler) {
     return withErrorHandling(this.wrap("web", handler));
@@ -289,41 +293,28 @@ class HttpKernel {
     return [createRequireVerifiedMiddleware(auth)];
   }
   wrapThrottle(scope, rateLimit, handler) {
-    const middleware = [];
     const memoryKeyPrefix = scope === "login" ? "login-throttle:" : "register-throttle:";
-    if (this.dependencies.container.has(CORE_CONFIG_TOKEN)) {
-      const config = this.dependencies.container.resolve(CORE_CONFIG_TOKEN);
-      const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim() ?? "";
-      if (redisUrl) {
-        const throttle = scope === "login" ? createLoginThrottleMiddleware({
-          redisUrl,
-          maxAttempts: rateLimit.maxAttempts,
-          decaySeconds: rateLimit.decaySeconds
-        }) : createThrottleMiddleware({
-          redisUrl,
-          maxAttempts: rateLimit.maxAttempts,
-          decaySeconds: rateLimit.decaySeconds,
-          keyPrefix: memoryKeyPrefix
-        });
-        middleware.push(throttle);
-      } else {
-        middleware.push(createMemoryThrottleMiddleware({
-          maxAttempts: rateLimit.maxAttempts,
-          decaySeconds: rateLimit.decaySeconds,
-          keyPrefix: memoryKeyPrefix
-        }));
-      }
-    } else {
-      middleware.push(createMemoryThrottleMiddleware({
+    const redisUrl = this.dependencies.container.has(CORE_CONFIG_TOKEN) ? this.dependencies.container.resolve(CORE_CONFIG_TOKEN).get(REDIS_URL_CONFIG_KEY)?.trim() ?? "" : "";
+    if (scope === "login") {
+      return withMiddleware(createLoginThrottleMiddleware({
+        ...redisUrl ? { redisUrl } : {},
+        maxAttempts: rateLimit.maxAttempts,
+        decaySeconds: rateLimit.decaySeconds
+      }))(handler);
+    }
+    if (redisUrl) {
+      return withMiddleware(createThrottleMiddleware({
+        redisUrl,
         maxAttempts: rateLimit.maxAttempts,
         decaySeconds: rateLimit.decaySeconds,
         keyPrefix: memoryKeyPrefix
-      }));
-    }
-    if (middleware.length === 0) {
-      return handler;
+      }))(handler);
     }
-    return withMiddleware(...middleware)(handler);
+    return withMiddleware(createMemoryThrottleMiddleware({
+      maxAttempts: rateLimit.maxAttempts,
+      decaySeconds: rateLimit.decaySeconds,
+      keyPrefix: memoryKeyPrefix
+    }))(handler);
   }
 }
 function createHttpKernel(dependencies) {

package/dist/entries/web/server.js

@@ -1,6 +1,7 @@
 // @bun
 // ../../src/bootstrap/web/server.ts
 import { currentRequestMeta, runWithRequestMeta } from "@getstrata/core/http/requestMetaContext";
+import { assertUrlPathUnderRoot } from "@getstrata/core/security/safePath";
 import { notFoundHtmlResponse } from "@getstrata/core/view";
 function socketAddress(server, request) {
   const address = server?.requestIP(request)?.address;
@@ -60,9 +61,14 @@ function createWebServer(options) {
         await options.onRequest?.(request);
         const url = new URL(request.url);
         if (url.pathname.startsWith("/assets/")) {
-          const file = Bun.file(`${publicDir}${url.pathname}`);
-          if (await file.exists()) {
-            return new Response(file);
+          try {
+            const filePath = assertUrlPathUnderRoot(publicDir, url.pathname);
+            const file = Bun.file(filePath);
+            if (await file.exists()) {
+              return new Response(file);
+            }
+          } catch {
+            return await missingHtmlResponse();
           }
         }
         if (options.handle) {