@getstrata/bootstrap 2.1.0 → 2.2.1

package/dist/entries/providers.js

@@ -25,8 +25,12 @@ import {
   CORE_CACHE_TOKEN,
   CORE_CONFIG_TOKEN,
   CORE_EVENT_BUS_TOKEN,
+  CORE_HTTP_CLEANUP_TOKEN,
   CORE_POLICY_GATE_TOKEN,
+  CORE_PUBLIC_TENANCY_TOKEN,
   CORE_QUEUE_TOKEN,
+  CORE_TENANT_RESOLVER_TOKEN,
+  CORE_THROTTLE_QUOTA_POLICY_TOKEN,
   CORE_TOKEN_SERVICE_TOKEN
 } from "@getstrata/core/contracts/serviceTokens";
 var APP_PORT_CONFIG_KEY = "app.port";
@@ -73,7 +77,7 @@ import { createCacheStore } from "@getstrata/core/cache/createCacheStore";
 import { CacheRepository } from "@getstrata/core/cache/repository";
 var cacheProvider = {
   name: "core.cache",
-  register({ container, config, dependencies }) {
+  register({ container, config, dependencies, onCleanup }) {
     container.singleton(CORE_CACHE_TOKEN, () => {
       const store = createCacheStore({
         driver: config.require(CACHE_DRIVER_CONFIG_KEY),
@@ -81,7 +85,9 @@ var cacheProvider = {
         maxEntries: config.require(CACHE_MAX_ENTRIES_CONFIG_KEY),
         redisUrl: config.get(REDIS_URL_CONFIG_KEY) || undefined
       });
-      return new CacheRepository(store);
+      const cache = new CacheRepository(store);
+      onCleanup(() => cache.close());
+      return cache;
     });
     dependencies.cache = container.resolve(CORE_CACHE_TOKEN);
   }
@@ -278,53 +284,101 @@ var eventsProvider = {
 var events_default = eventsProvider;
 
 // ../../src/bootstrap/discoverListeners.ts
-import { existsSync, readdirSync } from "fs";
-import { createRequire } from "module";
-import { join } from "path";
-var requireListener = createRequire(import.meta.url);
-var DISCOVER_LISTENERS_STATE_KEY = Symbol.for("@getstrata/discoverListenersState");
-function readDiscoverListenersState() {
-  const existing = globalThis[DISCOVER_LISTENERS_STATE_KEY];
-  if (existing) {
-    return existing;
+import { join as join2, resolve } from "path";
+
+// ../../src/bootstrap/infrastructureDiscovery.ts
+import { readdir } from "fs/promises";
+import { join, relative } from "path";
+import { pathToFileURL } from "url";
+async function infrastructureFiles(directory, exclude = []) {
+  const excluded = new Set([
+    "index.ts",
+    "index.js",
+    "index.mts",
+    "index.mjs",
+    "register.ts",
+    "register.js",
+    "register.mts",
+    "register.mjs",
+    ...exclude
+  ]);
+  const files = [];
+  async function visit(path) {
+    const entries = await readdir(path, { withFileTypes: true });
+    entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+    for (const entry of entries) {
+      const file = join(path, entry.name);
+      const key = relative(directory, file).replaceAll("\\", "/");
+      if (excluded.has(entry.name) || excluded.has(key))
+        continue;
+      if (entry.isDirectory())
+        await visit(file);
+      else if (entry.isFile() && /\.(ts|js|mts|mjs)$/.test(entry.name) && !/\.(d|test|spec)\.[cm]?[jt]s$/.test(entry.name))
+        files.push(file);
+    }
   }
-  const state = {};
-  globalThis[DISCOVER_LISTENERS_STATE_KEY] = state;
-  return state;
-}
-function resolveListenersDirectory() {
-  const fromCwd = join(process.cwd(), "src", "listeners");
-  if (existsSync(fromCwd)) {
-    return fromCwd;
+  try {
+    await visit(directory);
+  } catch (error) {
+    if (error.code !== "ENOENT")
+      throw error;
+    if (error.path !== directory)
+      throw error;
   }
-  return join(import.meta.dir, "../listeners");
+  return files;
 }
-function loadDiscoveredListeners() {
-  const listenersDirectory = resolveListenersDirectory();
-  let entries;
+async function importInfrastructure(file) {
   try {
-    entries = readdirSync(listenersDirectory, { withFileTypes: true }).filter((entry) => entry.isFile() && /\.(ts|js)$/.test(entry.name)).map((entry) => entry.name);
+    return await import(pathToFileURL(file).href);
   } catch (error) {
-    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
-      return [];
+    throw new Error(`Cannot load infrastructure module ${file}`, { cause: error });
+  }
+}
+
+// ../../src/bootstrap/discoverListeners.ts
+var KEY = Symbol.for("@getstrata/discoverListenersState");
+function state() {
+  const globals = globalThis;
+  globals[KEY] ??= { loads: new Map };
+  return globals[KEY];
+}
+async function load(options) {
+  const listeners = new Set;
+  const add = (value, location) => {
+    if (typeof value !== "function")
+      throw new TypeError(`Invalid listener registrar at ${location}: expected a default function.`);
+    listeners.add(value);
+  };
+  if (options.manifest)
+    for (const [index, value] of options.manifest.entries())
+      add(value, `listener manifest[${index}]`);
+  else
+    for (const file of await infrastructureFiles(options.directory ?? join2(process.cwd(), "src", "listeners"), options.exclude)) {
+      const exports = await importInfrastructure(file);
+      const value = exports.default;
+      add(value && typeof value === "object" && "default" in value ? value.default : value, file);
     }
+  return [...listeners];
+}
+function discoverListeners(options = {}) {
+  const cache = state().loads;
+  const key = options.manifest ?? JSON.stringify([
+    resolve(options.directory ?? join2(process.cwd(), "src", "listeners")),
+    [...options.exclude ?? []].sort()
+  ]);
+  const existing = cache.get(key);
+  if (existing)
+    return existing;
+  const pending = load(options).catch((error) => {
+    if (cache.get(key) === pending)
+      cache.delete(key);
     throw error;
-  }
-  const listeners = entries.map((fileName) => {
-    const filePath = join(listenersDirectory, fileName);
-    const loaded = requireListener(filePath);
-    return loaded.default;
   });
-  return listeners.filter((listener) => typeof listener === "function");
-}
-function discoverListeners() {
-  const state = readDiscoverListenersState();
-  state.appListeners ??= loadDiscoveredListeners();
-  return state.appListeners;
+  cache.set(key, pending);
+  return pending;
 }
 function resetDiscoverListenersForTests() {
-  const state = readDiscoverListenersState();
-  state.appListeners = undefined;
+  state().loads = new Map;
 }
 
 // ../../src/bootstrap/listeners/invalidateCacheOnModelWrite.ts
@@ -346,74 +400,129 @@ import {
 } from "@getstrata/core/runtime/applicationRegistry";
 
 // ../../src/bootstrap/discoverModules.ts
-import { readdirSync as readdirSync2 } from "fs";
-import { join as join2 } from "path";
-import { pathToFileURL } from "url";
-var DISCOVER_MODULES_STATE_KEY = Symbol.for("@getstrata/discoverModulesState");
-function readDiscoverModulesState() {
-  const existing = globalThis[DISCOVER_MODULES_STATE_KEY];
-  if (existing) {
-    return existing;
-  }
-  const state = { appModules: [] };
-  globalThis[DISCOVER_MODULES_STATE_KEY] = state;
-  return state;
+import { readdir as readdir2 } from "fs/promises";
+import { join as join3, resolve as resolve2 } from "path";
+var KEY2 = Symbol.for("@getstrata/discoverModulesState");
+function state2() {
+  const globals = globalThis;
+  globals[KEY2] ??= { appModules: [] };
+  return globals[KEY2];
 }
 function configureModulesDirectory(modulesDir) {
-  const state = readDiscoverModulesState();
-  if (state.configuredModulesDir !== modulesDir) {
-    state.appModules.length = 0;
-    state.modulesReady = undefined;
+  const current = state2();
+  const directory = resolve2(modulesDir);
+  if (current.configuredModulesDir !== directory || current.configuredManifest) {
+    current.appModules.length = 0;
+    current.modulesReady = undefined;
+    current.source = undefined;
   }
-  state.configuredModulesDir = modulesDir;
+  current.configuredManifest = undefined;
+  current.configuredModulesDir = directory;
 }
-function resolveModulesDirectory(options) {
-  const state = readDiscoverModulesState();
-  if (options?.modulesDir) {
-    return options.modulesDir;
+function configureModulesManifest(manifest) {
+  const current = state2();
+  if (current.configuredManifest !== manifest) {
+    current.appModules.length = 0;
+    current.modulesReady = undefined;
+    current.source = undefined;
   }
-  if (state.configuredModulesDir) {
-    return state.configuredModulesDir;
-  }
-  throw new Error("configureModulesDirectory() must be called before discovering modules. The app preload (or starter) should call it.");
+  current.configuredManifest = manifest;
 }
-async function loadDiscoveredModules(options) {
-  const modulesDirectory = resolveModulesDirectory(options);
-  let moduleNames;
-  try {
-    moduleNames = readdirSync2(modulesDirectory, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
-  } catch (error) {
-    if (error.code === "ENOENT") {
-      return [];
+function validateModule(value, location) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new TypeError(`Invalid application module at ${location}.`);
+  const module = value;
+  if (typeof module.name !== "string" || !module.name.trim())
+    throw new TypeError(`Invalid module name at ${location}.`);
+  if (module.order !== undefined && (typeof module.order !== "number" || !Number.isFinite(module.order)))
+    throw new TypeError(`Invalid module order at ${location}.`);
+  for (const hook of ["routes", "webRoutes"])
+    if (module[hook] !== undefined && typeof module[hook] !== "function")
+      throw new TypeError(`Invalid ${hook} at ${location}.`);
+  if (module.providers !== undefined) {
+    if (!Array.isArray(module.providers))
+      throw new TypeError(`Invalid providers at ${location}.`);
+    for (const provider of module.providers) {
+      if (!provider || typeof provider.name !== "string" || !provider.name.trim() || provider.register !== undefined && typeof provider.register !== "function" || provider.boot !== undefined && typeof provider.boot !== "function")
+        throw new TypeError(`Invalid provider at ${location}.`);
     }
-    throw error;
   }
-  const modules = await Promise.all(moduleNames.map(async (moduleName) => {
-    const moduleUrl = pathToFileURL(join2(modulesDirectory, moduleName, "index.ts")).href;
-    const loaded = await import(moduleUrl);
-    return loaded.default;
-  }));
-  return modules.filter((module) => module?.name !== undefined).sort((left, right) => (left.order ?? 100) - (right.order ?? 100));
 }
-async function ensureModulesLoaded(options) {
-  const state = readDiscoverModulesState();
-  if (state.appModules.length > 0) {
-    return state.appModules;
+async function load2(options) {
+  const manifest = options.manifest ?? (options.modulesDir === undefined ? state2().configuredManifest : undefined);
+  const entries = [];
+  if (manifest)
+    for (const [index, value] of manifest.entries())
+      entries.push({ value, location: `module manifest[${index}]` });
+  else {
+    const directory = options.modulesDir ?? state2().configuredModulesDir;
+    if (!directory)
+      throw new Error("configureModulesDirectory() or configureModulesManifest() must be called before discovering modules.");
+    let folders;
+    try {
+      folders = await readdir2(directory, { withFileTypes: true });
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return [];
+      throw error;
+    }
+    const excluded = new Set(options.exclude ?? []);
+    for (const folder of folders.filter((entry) => entry.isDirectory() && !excluded.has(entry.name)).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0)) {
+      const path = join3(directory, folder.name);
+      const files = await readdir2(path);
+      const candidates = files.filter((file) => /^index\.(ts|js|mts|mjs)$/.test(file));
+      if (candidates.length !== 1)
+        throw new Error(`Expected one module entrypoint at ${path}; found ${candidates.length}.`);
+      const file = join3(path, candidates[0]);
+      const exports = await importInfrastructure(file);
+      entries.push({ value: exports.default, location: file });
+    }
   }
-  state.modulesReady ??= loadDiscoveredModules(options).then((modules) => {
-    state.appModules.splice(0, state.appModules.length, ...modules);
-    return state.appModules;
+  const names = new Map;
+  const modules = [];
+  for (const { value, location } of entries) {
+    validateModule(value, location);
+    const previous = names.get(value.name);
+    if (previous)
+      throw new Error(`Duplicate module "${value.name}" at ${location}; first declared at ${previous}.`);
+    names.set(value.name, location);
+    modules.push(value);
+  }
+  return modules.sort((left, right) => (left.order ?? 100) - (right.order ?? 100));
+}
+function ensureModulesLoaded(options = {}) {
+  const current = state2();
+  const key = options.manifest ?? (options.modulesDir === undefined ? current.configuredManifest : undefined) ?? JSON.stringify([
+    options.modulesDir ? resolve2(options.modulesDir) : current.configuredModulesDir,
+    [...options.exclude ?? []].sort()
+  ]);
+  if (current.modulesReady && current.source === key)
+    return current.modulesReady;
+  current.appModules.length = 0;
+  current.source = key;
+  const pending = load2(options).then((modules) => {
+    if (current.modulesReady !== pending)
+      return modules;
+    current.appModules.splice(0, current.appModules.length, ...modules);
+    return current.appModules;
+  }).catch((error) => {
+    if (current.modulesReady === pending)
+      current.modulesReady = undefined;
+    throw error;
   });
-  return state.modulesReady;
+  current.modulesReady = pending;
+  return pending;
 }
 function discoverModules() {
-  return readDiscoverModulesState().appModules;
+  return state2().appModules;
 }
 function resetDiscoverModulesForTests() {
-  const state = readDiscoverModulesState();
-  state.configuredModulesDir = undefined;
-  state.appModules.length = 0;
-  state.modulesReady = undefined;
+  const current = state2();
+  current.configuredModulesDir = undefined;
+  current.configuredManifest = undefined;
+  current.appModules.length = 0;
+  current.modulesReady = undefined;
+  current.source = undefined;
 }
 
 // ../../src/bootstrap/cache/modelCacheTags.ts
@@ -530,22 +639,12 @@ function registerInvalidateCacheOnModelWriteListeners(bus = eventBus2, options =
 }
 
 // ../../src/bootstrap/providers/listeners.ts
-var registeredListenerGroups = new Set;
-function registerListenerGroup(name, register) {
-  if (registeredListenerGroups.has(name)) {
-    return;
-  }
-  registeredListenerGroups.add(name);
-  register();
-}
 var listenersProvider = {
   name: "core.listeners",
-  boot() {
-    registerListenerGroup("cache.invalidate-on-model-write", () => {
-      registerInvalidateCacheOnModelWriteListeners();
-    });
-    for (const registerListener of discoverListeners()) {
-      registerListener();
+  async boot({ onCleanup }) {
+    onCleanup(registerInvalidateCacheOnModelWriteListeners());
+    for (const registerListener of await discoverListeners()) {
+      await registerListener();
     }
   }
 };
@@ -569,68 +668,99 @@ import {
 } from "@getstrata/core/queue/createAppQueue";
 
 // ../../src/bootstrap/discoverJobs.ts
-import { existsSync as existsSync2, readdirSync as readdirSync3 } from "fs";
-import { createRequire as createRequire2 } from "module";
-import { join as join3 } from "path";
+import { join as join4, resolve as resolve3 } from "path";
+import { Job } from "@getstrata/core/queue";
 import { jobRegistry } from "@getstrata/core/queue/jobRegistry";
-var requireJob = createRequire2(import.meta.url);
-var DISCOVER_JOBS_STATE_KEY = Symbol.for("@getstrata/discoverJobsState");
-function readDiscoverJobsState() {
-  const existing = globalThis[DISCOVER_JOBS_STATE_KEY];
-  if (existing) {
-    return existing;
-  }
-  const state = {};
-  globalThis[DISCOVER_JOBS_STATE_KEY] = state;
-  return state;
-}
-function resolveJobsDirectory() {
-  const fromCwd = join3(process.cwd(), "src", "jobs");
-  if (existsSync2(fromCwd)) {
-    return fromCwd;
-  }
-  return join3(import.meta.dir, "../jobs");
+var KEY3 = Symbol.for("@getstrata/discoverJobsState");
+function state3() {
+  const globals = globalThis;
+  globals[KEY3] ??= { loads: new Map, registered: new Map };
+  return globals[KEY3];
 }
-function isDiscoveredJobClass(value) {
-  if (typeof value !== "function") {
-    return false;
-  }
-  const jobName = value.jobName;
-  return typeof jobName === "string" && jobName.length > 0;
+function validateClass(value, location) {
+  if (typeof value !== "function" || typeof value.jobName !== "string" || !value.jobName.trim() || !(value.prototype instanceof Job) && typeof value.prototype?.handle !== "function")
+    throw new TypeError(`Invalid job at ${location}: expected a class with nonempty static jobName and handle().`);
 }
-function loadDiscoveredJobClasses() {
-  const jobsDirectory = resolveJobsDirectory();
-  let entries;
-  try {
-    entries = readdirSync3(jobsDirectory, { withFileTypes: true }).filter((entry) => entry.isFile() && /\.(ts|js)$/.test(entry.name)).map((entry) => entry.name);
-  } catch (error) {
-    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
-      return [];
+async function load3(options, current) {
+  const jobs = new Map;
+  const add = (name, identity, create, location) => {
+    const previous = jobs.get(name);
+    if (previous && previous.identity !== identity)
+      throw new Error(`Duplicate job "${name}" at ${location}; first declared at ${previous.location}.`);
+    if (!previous)
+      jobs.set(name, { identity, create, location });
+  };
+  if (options.manifest) {
+    for (const [index, entry] of options.manifest.entries()) {
+      const location = `job manifest[${index}]`;
+      if (typeof entry === "function") {
+        validateClass(entry, location);
+        add(entry.jobName, entry, () => new entry, location);
+      } else {
+        if (!entry || typeof entry.name !== "string" || !entry.name.trim() || typeof entry.create !== "function")
+          throw new TypeError(`Invalid job factory at ${location}.`);
+        add(entry.name, entry.create, entry.create, location);
+      }
+    }
+  } else {
+    for (const file of await infrastructureFiles(options.directory ?? join4(process.cwd(), "src", "jobs"), options.exclude)) {
+      const exports = await importInfrastructure(file);
+      const defaultValue = exports.default;
+      const legacy = defaultValue && typeof defaultValue === "object" && "default" in defaultValue ? defaultValue.default : defaultValue;
+      if (legacy !== undefined)
+        validateClass(legacy, `${file}:default`);
+      let found = false;
+      for (const [name, value] of Object.entries({
+        ...exports,
+        ...legacy === undefined ? {} : { default: legacy }
+      })) {
+        if (name !== "default" && !(typeof value === "function" && ("jobName" in value)))
+          continue;
+        validateClass(value, `${file}:${name}`);
+        found = true;
+        add(value.jobName, value, () => new value, `${file}:${name}`);
+      }
+      if (!found)
+        throw new TypeError(`No job exports at ${file}; exclude helper modules explicitly.`);
     }
-    throw error;
   }
-  return entries.flatMap((fileName) => {
-    const filePath = join3(jobsDirectory, fileName);
-    const loaded = requireJob(filePath);
-    return isDiscoveredJobClass(loaded.default) ? [loaded.default] : [];
-  });
-}
-function discoverJobs() {
-  const state = readDiscoverJobsState();
-  if (state.names) {
-    return state.names;
+  if (!current())
+    return [...jobs.keys()];
+  const registered = state3().registered;
+  for (const [name, entry] of jobs) {
+    const previous = registered.get(name);
+    if (previous && previous.identity !== entry.identity)
+      throw new Error(`Duplicate discovered job "${name}" at ${entry.location}; first declared at ${previous.location}.`);
   }
-  const names = [];
-  for (const JobClass of loadDiscoveredJobClasses()) {
-    jobRegistry.register(JobClass.jobName, () => new JobClass);
-    names.push(JobClass.jobName);
+  const existing = new Set(jobRegistry.names());
+  for (const [name, entry] of jobs) {
+    if (!existing.has(name)) {
+      jobRegistry.register(name, entry.create);
+      registered.set(name, entry);
+    }
   }
-  state.names = names;
-  return names;
+  return [...jobs.keys()];
+}
+function discoverJobs(options = {}) {
+  const cache = state3().loads;
+  const key = options.manifest ?? JSON.stringify([
+    resolve3(options.directory ?? join4(process.cwd(), "src", "jobs")),
+    [...options.exclude ?? []].sort()
+  ]);
+  const existing = cache.get(key);
+  if (existing)
+    return existing;
+  const pending = load3(options, () => state3().loads === cache).catch((error) => {
+    if (cache.get(key) === pending)
+      cache.delete(key);
+    throw error;
+  });
+  cache.set(key, pending);
+  return pending;
 }
 function resetDiscoverJobsForTests() {
-  const state = readDiscoverJobsState();
-  state.names = undefined;
+  state3().loads = new Map;
+  state3().registered = new Map;
 }
 
 // ../../src/bootstrap/queue/defaultJobs.ts
@@ -648,16 +778,17 @@ function registerDefaultJobs() {
 // ../../src/bootstrap/providers/queue.ts
 var queueProvider = {
   name: "core.queue",
-  register({ container, config }) {
+  async register({ container, config, onCleanup }) {
     const configuredDriver = process.env.QUEUE_DRIVER ?? DEFAULT_QUEUE_DRIVER;
     const driver = configuredDriver === "async" || configuredDriver === "redis" || configuredDriver === "sync" ? configuredDriver : DEFAULT_QUEUE_DRIVER;
     config.set("queue.driver", driver);
     const failedJobs = createFailedJobService();
     container.set(FAILED_JOB_SERVICE_TOKEN, failedJobs);
-    container.set(CORE_QUEUE_TOKEN, createAppQueue(driver, config.get(REDIS_URL_CONFIG_KEY) ?? process.env.REDIS_URL, failedJobs, () => {
-      registerDefaultJobs();
-      discoverJobs();
-    }));
+    registerDefaultJobs();
+    await discoverJobs();
+    const queue = createAppQueue(driver, config.get(REDIS_URL_CONFIG_KEY) ?? process.env.REDIS_URL, failedJobs);
+    onCleanup(() => queue.close?.(), driver === "async" ? "drain" : "close");
+    container.set(CORE_QUEUE_TOKEN, queue);
   }
 };
 var queue_default = queueProvider;
@@ -672,6 +803,18 @@ var storageProvider = {
 };
 var storage_default = storageProvider;
 
+// ../../src/bootstrap/providers/tracing.ts
+import { acquireTracingRuntime } from "@getstrata/core/tracing/tracingMiddleware";
+var tracingProvider = {
+  name: "core.tracing",
+  register({ onCleanup }) {
+    const ownership = acquireTracingRuntime();
+    onCleanup(() => ownership.flush(), "flush");
+    onCleanup(() => ownership.release(), "close");
+  }
+};
+var tracing_default = tracingProvider;
+
 // ../../src/bootstrap/providers/view.ts
 import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
 import { appDisplayName } from "@getstrata/core/runtime/appKeyPrefix";
@@ -716,6 +859,7 @@ var viewProvider = {
 // ../../src/bootstrap/providers/index.ts
 var coreProviders = [
   config_default,
+  tracing_default,
   cache_default,
   storage_default,
   auth_default,

package/dist/entries/secretsGuard.js

@@ -126,8 +126,8 @@ function assertFeatureProductionSecrets(env) {
       throw new Error("Production startup blocked: set explicit CORS_ALLOWED_ORIGINS instead of wildcard.");
     }
   }
-  if (envFlagEnabled(env.FEATURE_PUBLIC_READS)) {
-    throw new Error("Production startup blocked: set FEATURE_PUBLIC_READS=false for authenticated-only reads.");
+  if (envFlagEnabled(env.TENANT_DEV_HEADERS)) {
+    throw new Error("Production startup blocked: set TENANT_DEV_HEADERS=false.");
   }
   if (!env.SIEM_EXPORT_URL?.trim() && envFlagEnabled(env.FEATURE_SIEM_EXPORT)) {
     console.warn("[secrets] SIEM_EXPORT_URL is not configured; audit logs remain database-only.");