@getstrata/bootstrap 2.2.0 → 2.2.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @getstrata/bootstrap changelog
 
+## 2.2.1
+
+F02 — complete queue durability. Queues have leased reservations, recovery and fenced acknowledgement, but still use Redis lists. Persisted retry schedules, execution deadlines, cancellation and the planned Streams migration remain unfinished. Retries currently wait inside the running worker.
+F10 — production public-route tenancy. Separate anonymous access from development tenant headers, support a trusted-host resolver, reject unknown hosts, and accept forwarded hosts only through configured trusted proxies. The shop still lacks the approved-domain mapping.
+F12 — initial administrator provisioning and migration guidance. Automatic demo seeding is fixed. Secure initial-admin provisioning and a consolidated upgrade/operations guide remain.
+Distributed qualification. Cache generations/fill leases, scheduler ownership, OpenTelemetry, body limits and lifecycle controls now exist. Their implementation should no longer be described as entirely pending, but broader failure and capacity qualification is still required.
+
 ## 2.2.0
 
 Consistent model scopes.

package/dist/bootstrap/config.d.ts

@@ -4,7 +4,7 @@ declare const CACHE_MAX_ENTRIES_CONFIG_KEY = "cache.maxEntries";
 declare const CACHE_DRIVER_CONFIG_KEY = "cache.driver";
 declare const REDIS_URL_CONFIG_KEY = "cache.redisUrl";
 declare const DATABASE_URL_CONFIG_KEY = "database.url";
-export { CORE_ABILITY_CHECKER_TOKEN, CORE_AUTH_TOKEN, CORE_AUTH_USER_DIRECTORY_TOKEN, CORE_CACHE_TOKEN, CORE_CONFIG_TOKEN, CORE_EVENT_BUS_TOKEN, CORE_HTTP_CLEANUP_TOKEN, CORE_POLICY_GATE_TOKEN, CORE_QUEUE_TOKEN, CORE_TENANT_RESOLVER_TOKEN, CORE_THROTTLE_QUOTA_POLICY_TOKEN, CORE_TOKEN_SERVICE_TOKEN, } from "@getstrata/core/contracts/serviceTokens";
+export { CORE_ABILITY_CHECKER_TOKEN, CORE_AUTH_TOKEN, CORE_AUTH_USER_DIRECTORY_TOKEN, CORE_CACHE_TOKEN, CORE_CONFIG_TOKEN, CORE_EVENT_BUS_TOKEN, CORE_HTTP_CLEANUP_TOKEN, CORE_POLICY_GATE_TOKEN, CORE_PUBLIC_TENANCY_TOKEN, CORE_QUEUE_TOKEN, CORE_TENANT_RESOLVER_TOKEN, CORE_THROTTLE_QUOTA_POLICY_TOKEN, CORE_TOKEN_SERVICE_TOKEN, } from "@getstrata/core/contracts/serviceTokens";
 declare const AUTH_DEV_HEADERS_CONFIG_KEY = "auth.allowDevHeaders";
 declare const DEFAULT_APP_PORT = 3000;
 declare const DEFAULT_CACHE_TTL_MS = 3600000;

package/dist/bootstrap/httpKernel.d.ts

@@ -19,7 +19,9 @@ declare class HttpKernel {
     wrapWeb<TRequest extends Request = Request>(handler: RouteHandler<TRequest>): RouteHandler<TRequest>;
     /** Signed-in HTML users redirect to `home` instead of seeing guest pages. */
     wrapWebGuest<TRequest extends Request = Request>(handler: RouteHandler<TRequest>, home?: WebGuestHome): RouteHandler<TRequest>;
-    wrapWebPublicRead<TRequest extends Request = Request>(handler: RouteHandler<TRequest>): RouteHandler<TRequest>;
+    wrapWebPublicRead<TRequest extends Request = Request>(handler: RouteHandler<TRequest>, options?: {
+        allowAnonymous?: boolean;
+    }): RouteHandler<TRequest>;
     wrapWebAuthenticated<TRequest extends Request = Request>(handler: RouteHandler<TRequest>): RouteHandler<TRequest>;
     /** Signed-in HTML without the email-verified gate (logout, verification notice). */
     wrapWebAuthenticatedAllowUnverified<TRequest extends Request = Request>(handler: RouteHandler<TRequest>): RouteHandler<TRequest>;
@@ -31,7 +33,9 @@ declare class HttpKernel {
     wrapAuthenticated<TRequest extends Request = Request>(handler: RouteHandler<TRequest>): RouteHandler<TRequest>;
     /** JSON routes that require a verified email. No-op when `FEATURE_EMAIL_VERIFICATION` is off. */
     wrapVerified<TRequest extends Request = Request>(handler: RouteHandler<TRequest>): RouteHandler<TRequest>;
-    wrapPublicRead<TRequest extends Request = Request>(handler: RouteHandler<TRequest>): RouteHandler<TRequest>;
+    wrapPublicRead<TRequest extends Request = Request>(handler: RouteHandler<TRequest>, options?: {
+        allowAnonymous?: boolean;
+    }): RouteHandler<TRequest>;
     wrapGlobalAdmin<TRequest extends Request = Request>(handler: RouteHandler<TRequest>): RouteHandler<TRequest>;
     wrapAbility<TRequest extends Request = Request>(ability: string, handler: RouteHandler<TRequest>): RouteHandler<TRequest>;
     wrapPolicy<TRequest extends Request = Request>(resource: string, action: keyof Policy, handler: RouteHandler<TRequest>): RouteHandler<TRequest>;

package/dist/entries/buildModuleRoutes.js

@@ -52,6 +52,7 @@ import {
   CORE_EVENT_BUS_TOKEN,
   CORE_HTTP_CLEANUP_TOKEN,
   CORE_POLICY_GATE_TOKEN,
+  CORE_PUBLIC_TENANCY_TOKEN,
   CORE_QUEUE_TOKEN,
   CORE_TENANT_RESOLVER_TOKEN,
   CORE_THROTTLE_QUOTA_POLICY_TOKEN,
@@ -168,6 +169,7 @@ class HttpKernel {
       createAuthMiddleware(auth),
       createMembershipMiddleware(),
       createTenantMiddleware({
+        publicTenancy: this.dependencies.container.has(CORE_PUBLIC_TENANCY_TOKEN) ? this.dependencies.container.resolve(CORE_PUBLIC_TENANCY_TOKEN) : undefined,
         resolveTenant: this.dependencies.container.has(CORE_TENANT_RESOLVER_TOKEN) ? this.dependencies.container.resolve(CORE_TENANT_RESOLVER_TOKEN) : undefined
       })
     ];
@@ -242,8 +244,8 @@ class HttpKernel {
       return handler(request);
     });
   }
-  wrapWebPublicRead(handler) {
-    if (isPublicReadsEnabled()) {
+  wrapWebPublicRead(handler, options = {}) {
+    if (options.allowAnonymous ?? isPublicReadsEnabled()) {
       return this.wrapWeb(handler);
     }
     return this.wrapWebAuthenticated(handler);
@@ -289,8 +291,8 @@ class HttpKernel {
     const middleware = [...this.group("authenticated"), ...this.verifiedMiddleware()];
     return withMiddleware(...middleware)(handler);
   }
-  wrapPublicRead(handler) {
-    if (isPublicReadsEnabled()) {
+  wrapPublicRead(handler, options = {}) {
+    if (options.allowAnonymous ?? isPublicReadsEnabled()) {
       return handler;
     }
     return this.wrapAuthenticated(handler);

package/dist/entries/buildWebModuleRoutes.js

@@ -55,6 +55,7 @@ import {
   CORE_EVENT_BUS_TOKEN,
   CORE_HTTP_CLEANUP_TOKEN,
   CORE_POLICY_GATE_TOKEN,
+  CORE_PUBLIC_TENANCY_TOKEN,
   CORE_QUEUE_TOKEN,
   CORE_TENANT_RESOLVER_TOKEN,
   CORE_THROTTLE_QUOTA_POLICY_TOKEN,
@@ -171,6 +172,7 @@ class HttpKernel {
       createAuthMiddleware(auth),
       createMembershipMiddleware(),
       createTenantMiddleware({
+        publicTenancy: this.dependencies.container.has(CORE_PUBLIC_TENANCY_TOKEN) ? this.dependencies.container.resolve(CORE_PUBLIC_TENANCY_TOKEN) : undefined,
         resolveTenant: this.dependencies.container.has(CORE_TENANT_RESOLVER_TOKEN) ? this.dependencies.container.resolve(CORE_TENANT_RESOLVER_TOKEN) : undefined
       })
     ];
@@ -245,8 +247,8 @@ class HttpKernel {
       return handler(request);
     });
   }
-  wrapWebPublicRead(handler) {
-    if (isPublicReadsEnabled()) {
+  wrapWebPublicRead(handler, options = {}) {
+    if (options.allowAnonymous ?? isPublicReadsEnabled()) {
       return this.wrapWeb(handler);
     }
     return this.wrapWebAuthenticated(handler);
@@ -292,8 +294,8 @@ class HttpKernel {
     const middleware = [...this.group("authenticated"), ...this.verifiedMiddleware()];
     return withMiddleware(...middleware)(handler);
   }
-  wrapPublicRead(handler) {
-    if (isPublicReadsEnabled()) {
+  wrapPublicRead(handler, options = {}) {
+    if (options.allowAnonymous ?? isPublicReadsEnabled()) {
       return handler;
     }
     return this.wrapAuthenticated(handler);

package/dist/entries/config.js

@@ -9,6 +9,7 @@ import {
   CORE_EVENT_BUS_TOKEN,
   CORE_HTTP_CLEANUP_TOKEN,
   CORE_POLICY_GATE_TOKEN,
+  CORE_PUBLIC_TENANCY_TOKEN,
   CORE_QUEUE_TOKEN,
   CORE_TENANT_RESOLVER_TOKEN,
   CORE_THROTTLE_QUOTA_POLICY_TOKEN,
@@ -41,6 +42,7 @@ export {
   CORE_EVENT_BUS_TOKEN,
   CORE_HTTP_CLEANUP_TOKEN,
   CORE_POLICY_GATE_TOKEN,
+  CORE_PUBLIC_TENANCY_TOKEN,
   CORE_QUEUE_TOKEN,
   CORE_TENANT_RESOLVER_TOKEN,
   CORE_THROTTLE_QUOTA_POLICY_TOKEN,

package/dist/entries/context.js

@@ -232,6 +232,7 @@ import {
   CORE_EVENT_BUS_TOKEN,
   CORE_HTTP_CLEANUP_TOKEN,
   CORE_POLICY_GATE_TOKEN,
+  CORE_PUBLIC_TENANCY_TOKEN,
   CORE_QUEUE_TOKEN,
   CORE_TENANT_RESOLVER_TOKEN,
   CORE_THROTTLE_QUOTA_POLICY_TOKEN,

package/dist/entries/createWebRoutes.js

@@ -61,6 +61,7 @@ import {
   CORE_EVENT_BUS_TOKEN,
   CORE_HTTP_CLEANUP_TOKEN,
   CORE_POLICY_GATE_TOKEN,
+  CORE_PUBLIC_TENANCY_TOKEN,
   CORE_QUEUE_TOKEN,
   CORE_TENANT_RESOLVER_TOKEN,
   CORE_THROTTLE_QUOTA_POLICY_TOKEN,
@@ -177,6 +178,7 @@ class HttpKernel {
       createAuthMiddleware(auth),
       createMembershipMiddleware(),
       createTenantMiddleware({
+        publicTenancy: this.dependencies.container.has(CORE_PUBLIC_TENANCY_TOKEN) ? this.dependencies.container.resolve(CORE_PUBLIC_TENANCY_TOKEN) : undefined,
         resolveTenant: this.dependencies.container.has(CORE_TENANT_RESOLVER_TOKEN) ? this.dependencies.container.resolve(CORE_TENANT_RESOLVER_TOKEN) : undefined
       })
     ];
@@ -251,8 +253,8 @@ class HttpKernel {
       return handler(request);
     });
   }
-  wrapWebPublicRead(handler) {
-    if (isPublicReadsEnabled()) {
+  wrapWebPublicRead(handler, options = {}) {
+    if (options.allowAnonymous ?? isPublicReadsEnabled()) {
       return this.wrapWeb(handler);
     }
     return this.wrapWebAuthenticated(handler);
@@ -298,8 +300,8 @@ class HttpKernel {
     const middleware = [...this.group("authenticated"), ...this.verifiedMiddleware()];
     return withMiddleware(...middleware)(handler);
   }
-  wrapPublicRead(handler) {
-    if (isPublicReadsEnabled()) {
+  wrapPublicRead(handler, options = {}) {
+    if (options.allowAnonymous ?? isPublicReadsEnabled()) {
       return handler;
     }
     return this.wrapAuthenticated(handler);

package/dist/entries/dependencies.js

@@ -232,6 +232,7 @@ import {
   CORE_EVENT_BUS_TOKEN,
   CORE_HTTP_CLEANUP_TOKEN,
   CORE_POLICY_GATE_TOKEN,
+  CORE_PUBLIC_TENANCY_TOKEN,
   CORE_QUEUE_TOKEN,
   CORE_TENANT_RESOLVER_TOKEN,
   CORE_THROTTLE_QUOTA_POLICY_TOKEN,

package/dist/entries/health.js

@@ -16,6 +16,7 @@ import {
   CORE_EVENT_BUS_TOKEN,
   CORE_HTTP_CLEANUP_TOKEN,
   CORE_POLICY_GATE_TOKEN,
+  CORE_PUBLIC_TENANCY_TOKEN,
   CORE_QUEUE_TOKEN,
   CORE_TENANT_RESOLVER_TOKEN,
   CORE_THROTTLE_QUOTA_POLICY_TOKEN,

package/dist/entries/httpKernel.js

@@ -48,6 +48,7 @@ import {
   CORE_EVENT_BUS_TOKEN,
   CORE_HTTP_CLEANUP_TOKEN,
   CORE_POLICY_GATE_TOKEN,
+  CORE_PUBLIC_TENANCY_TOKEN,
   CORE_QUEUE_TOKEN,
   CORE_TENANT_RESOLVER_TOKEN,
   CORE_THROTTLE_QUOTA_POLICY_TOKEN,
@@ -164,6 +165,7 @@ class HttpKernel {
       createAuthMiddleware(auth),
       createMembershipMiddleware(),
       createTenantMiddleware({
+        publicTenancy: this.dependencies.container.has(CORE_PUBLIC_TENANCY_TOKEN) ? this.dependencies.container.resolve(CORE_PUBLIC_TENANCY_TOKEN) : undefined,
         resolveTenant: this.dependencies.container.has(CORE_TENANT_RESOLVER_TOKEN) ? this.dependencies.container.resolve(CORE_TENANT_RESOLVER_TOKEN) : undefined
       })
     ];
@@ -238,8 +240,8 @@ class HttpKernel {
       return handler(request);
     });
   }
-  wrapWebPublicRead(handler) {
-    if (isPublicReadsEnabled()) {
+  wrapWebPublicRead(handler, options = {}) {
+    if (options.allowAnonymous ?? isPublicReadsEnabled()) {
       return this.wrapWeb(handler);
     }
     return this.wrapWebAuthenticated(handler);
@@ -285,8 +287,8 @@ class HttpKernel {
     const middleware = [...this.group("authenticated"), ...this.verifiedMiddleware()];
     return withMiddleware(...middleware)(handler);
   }
-  wrapPublicRead(handler) {
-    if (isPublicReadsEnabled()) {
+  wrapPublicRead(handler, options = {}) {
+    if (options.allowAnonymous ?? isPublicReadsEnabled()) {
       return handler;
     }
     return this.wrapAuthenticated(handler);

package/dist/entries/providers.js

@@ -27,6 +27,7 @@ import {
   CORE_EVENT_BUS_TOKEN,
   CORE_HTTP_CLEANUP_TOKEN,
   CORE_POLICY_GATE_TOKEN,
+  CORE_PUBLIC_TENANCY_TOKEN,
   CORE_QUEUE_TOKEN,
   CORE_TENANT_RESOLVER_TOKEN,
   CORE_THROTTLE_QUOTA_POLICY_TOKEN,

package/dist/entries/secretsGuard.js

@@ -126,8 +126,8 @@ function assertFeatureProductionSecrets(env) {
       throw new Error("Production startup blocked: set explicit CORS_ALLOWED_ORIGINS instead of wildcard.");
     }
   }
-  if (envFlagEnabled(env.FEATURE_PUBLIC_READS)) {
-    throw new Error("Production startup blocked: set FEATURE_PUBLIC_READS=false for authenticated-only reads.");
+  if (envFlagEnabled(env.TENANT_DEV_HEADERS)) {
+    throw new Error("Production startup blocked: set TENANT_DEV_HEADERS=false.");
   }
   if (!env.SIEM_EXPORT_URL?.trim() && envFlagEnabled(env.FEATURE_SIEM_EXPORT)) {
     console.warn("[secrets] SIEM_EXPORT_URL is not configured; audit logs remain database-only.");

package/dist/entries/web/routing.js

@@ -58,6 +58,7 @@ import {
   CORE_EVENT_BUS_TOKEN,
   CORE_HTTP_CLEANUP_TOKEN,
   CORE_POLICY_GATE_TOKEN,
+  CORE_PUBLIC_TENANCY_TOKEN,
   CORE_QUEUE_TOKEN,
   CORE_TENANT_RESOLVER_TOKEN,
   CORE_THROTTLE_QUOTA_POLICY_TOKEN,
@@ -174,6 +175,7 @@ class HttpKernel {
       createAuthMiddleware(auth),
       createMembershipMiddleware(),
       createTenantMiddleware({
+        publicTenancy: this.dependencies.container.has(CORE_PUBLIC_TENANCY_TOKEN) ? this.dependencies.container.resolve(CORE_PUBLIC_TENANCY_TOKEN) : undefined,
         resolveTenant: this.dependencies.container.has(CORE_TENANT_RESOLVER_TOKEN) ? this.dependencies.container.resolve(CORE_TENANT_RESOLVER_TOKEN) : undefined
       })
     ];
@@ -248,8 +250,8 @@ class HttpKernel {
       return handler(request);
     });
   }
-  wrapWebPublicRead(handler) {
-    if (isPublicReadsEnabled()) {
+  wrapWebPublicRead(handler, options = {}) {
+    if (options.allowAnonymous ?? isPublicReadsEnabled()) {
       return this.wrapWeb(handler);
     }
     return this.wrapWebAuthenticated(handler);
@@ -295,8 +297,8 @@ class HttpKernel {
     const middleware = [...this.group("authenticated"), ...this.verifiedMiddleware()];
     return withMiddleware(...middleware)(handler);
   }
-  wrapPublicRead(handler) {
-    if (isPublicReadsEnabled()) {
+  wrapPublicRead(handler, options = {}) {
+    if (options.allowAnonymous ?? isPublicReadsEnabled()) {
       return handler;
     }
     return this.wrapAuthenticated(handler);

package/dist/entries/web/server.js

@@ -19,6 +19,7 @@ function wrapRouteHandler(handler, path, onRequest, track = (work) => work()) {
       request,
       routeTemplate: path,
       ipAddress: socketAddress(server, request),
+      peerAddress: socketAddress(server, request),
       userAgent: request.headers.get("user-agent")
     }, async () => {
       const intercepted = await onRequest?.(request, server);
@@ -94,6 +95,7 @@ function createWebServer(options) {
         ...currentRequestMeta(),
         request,
         ipAddress: socketAddress(server, request),
+        peerAddress: socketAddress(server, request),
         userAgent: request.headers.get("user-agent")
       }, async () => {
         const intercepted = await onRequest(request, server);

package/dist/index.js

@@ -73,6 +73,7 @@ import {
   CORE_EVENT_BUS_TOKEN,
   CORE_HTTP_CLEANUP_TOKEN,
   CORE_POLICY_GATE_TOKEN,
+  CORE_PUBLIC_TENANCY_TOKEN,
   CORE_QUEUE_TOKEN,
   CORE_TENANT_RESOLVER_TOKEN,
   CORE_THROTTLE_QUOTA_POLICY_TOKEN,
@@ -188,6 +189,7 @@ class HttpKernel {
       createAuthMiddleware(auth),
       createMembershipMiddleware(),
       createTenantMiddleware({
+        publicTenancy: this.dependencies.container.has(CORE_PUBLIC_TENANCY_TOKEN) ? this.dependencies.container.resolve(CORE_PUBLIC_TENANCY_TOKEN) : undefined,
         resolveTenant: this.dependencies.container.has(CORE_TENANT_RESOLVER_TOKEN) ? this.dependencies.container.resolve(CORE_TENANT_RESOLVER_TOKEN) : undefined
       })
     ];
@@ -262,8 +264,8 @@ class HttpKernel {
       return handler(request);
     });
   }
-  wrapWebPublicRead(handler) {
-    if (isPublicReadsEnabled()) {
+  wrapWebPublicRead(handler, options = {}) {
+    if (options.allowAnonymous ?? isPublicReadsEnabled()) {
       return this.wrapWeb(handler);
     }
     return this.wrapWebAuthenticated(handler);
@@ -309,8 +311,8 @@ class HttpKernel {
     const middleware = [...this.group("authenticated"), ...this.verifiedMiddleware()];
     return withMiddleware(...middleware)(handler);
   }
-  wrapPublicRead(handler) {
-    if (isPublicReadsEnabled()) {
+  wrapPublicRead(handler, options = {}) {
+    if (options.allowAnonymous ?? isPublicReadsEnabled()) {
       return handler;
     }
     return this.wrapAuthenticated(handler);
@@ -1743,8 +1745,8 @@ function assertFeatureProductionSecrets(env) {
       throw new Error("Production startup blocked: set explicit CORS_ALLOWED_ORIGINS instead of wildcard.");
     }
   }
-  if (envFlagEnabled3(env.FEATURE_PUBLIC_READS)) {
-    throw new Error("Production startup blocked: set FEATURE_PUBLIC_READS=false for authenticated-only reads.");
+  if (envFlagEnabled3(env.TENANT_DEV_HEADERS)) {
+    throw new Error("Production startup blocked: set TENANT_DEV_HEADERS=false.");
   }
   if (!env.SIEM_EXPORT_URL?.trim() && envFlagEnabled3(env.FEATURE_SIEM_EXPORT)) {
     console.warn("[secrets] SIEM_EXPORT_URL is not configured; audit logs remain database-only.");
@@ -1913,6 +1915,7 @@ function wrapRouteHandler(handler, path, onRequest, track = (work) => work()) {
       request,
       routeTemplate: path,
       ipAddress: socketAddress(server, request),
+      peerAddress: socketAddress(server, request),
       userAgent: request.headers.get("user-agent")
     }, async () => {
       const intercepted = await onRequest?.(request, server);
@@ -1988,6 +1991,7 @@ function createWebServer(options) {
         ...currentRequestMeta2(),
         request,
         ipAddress: socketAddress(server, request),
+        peerAddress: socketAddress(server, request),
         userAgent: request.headers.get("user-agent")
       }, async () => {
         const intercepted = await onRequest(request, server);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/bootstrap",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "description": "Strata application bootstrap: HttpKernel, DI, web session helpers",
   "type": "module",
   "license": "MIT",
@@ -190,7 +190,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@getstrata/core": "^2.2.0",
+    "@getstrata/core": "^2.2.1",
     "typescript": "^5.9.0 || ^6.0.0 || ^7.0.0"
   },
   "engines": {