@getstrata/core 0.5.21 → 0.5.25

package/dist/core/auth/membershipService.d.ts

@@ -20,4 +20,4 @@ declare class MembershipService {
 }
 export type { MembershipRepositoryLike };
 export default MembershipService;
-export { resolveMembershipService } from "../../bootstrap/membershipService.ts";
+export { resolveMembershipService } from "./resolveMembershipService.ts";

package/dist/{bootstrap/membershipService.d.ts → core/auth/resolveMembershipService.d.ts}

@@ -1,3 +1,3 @@
-import MembershipService from "../core/auth/membershipService";
+import MembershipService from "./membershipService";
 declare function resolveMembershipService(): MembershipService;
 export { resolveMembershipService };

package/dist/core/http/securedRouteModelBinding.d.ts

@@ -1,2 +1,11 @@
-export type { RouteModelAuthorization } from "../../bootstrap/http/securedRouteModelBinding.ts";
-export { securedBindRouteModel, securedBindRouteModelByKey, } from "../../bootstrap/http/securedRouteModelBinding.ts";
+import type { Policy } from "../auth/policy";
+import type { RouteRequest } from "./route";
+interface RouteModelAuthorization {
+    resource: string;
+    action: keyof Policy;
+    requireIfMatch?: boolean;
+}
+declare function securedBindRouteModel<TParams extends Record<string, string>, TModel, TParam extends keyof TParams & string>(param: TParam, resolver: (id: number, request: RouteRequest<TParams>) => Promise<TModel>, authorization: RouteModelAuthorization, handler: (request: RouteRequest<TParams>, model: TModel) => Response | Promise<Response>): (request: RouteRequest<TParams>) => Promise<Response>;
+declare function securedBindRouteModelByKey<TParams extends Record<string, string>, TModel, TParam extends keyof TParams & string>(param: TParam, resolver: (key: string, request: RouteRequest<TParams>) => Promise<TModel>, authorization: RouteModelAuthorization, handler: (request: RouteRequest<TParams>, model: TModel) => Response | Promise<Response>): (request: RouteRequest<TParams>) => Promise<Response>;
+export type { RouteModelAuthorization };
+export { securedBindRouteModel, securedBindRouteModelByKey };

package/dist/core/queue/createAppQueue.d.ts

@@ -2,5 +2,4 @@ import type { Queue } from "./index";
 import { createFailedJobService, createQueueWorker, createTrackedJob, type FailedJobService } from "./publicQueue";
 declare const FAILED_JOB_SERVICE_TOKEN = "core.failedJobs";
 declare function createAppQueue(driver: "sync" | "async" | "redis", redisUrl?: string, failedJobs?: FailedJobService, registerJobs?: () => void): Queue;
-export { registerDefaultJobs } from "../../bootstrap/queue/defaultJobs.ts";
 export { createAppQueue, createFailedJobService, createQueueWorker, createTrackedJob, FAILED_JOB_SERVICE_TOKEN, };

package/dist/core/queue/jobRegistry.d.ts

@@ -1,7 +1,6 @@
 import type { Job } from "./index";
 type JobFactory = () => Job;
 declare class JobRegistry {
-    constructor();
     private readonly factories;
     private readonly instances;
     register(name: string, factory: JobFactory): void;

package/dist/entries/contracts/serviceTokens.js

@@ -0,0 +1,16 @@
+// @bun
+// ../../src/core/contracts/serviceTokens.ts
+var CORE_CONFIG_TOKEN = "core.config";
+var CORE_CACHE_TOKEN = "core.cache";
+var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_POLICY_GATE_TOKEN = "core.policyGate";
+var CORE_AUTH_TOKEN = "core.auth";
+var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
+export {
+  CORE_TOKEN_SERVICE_TOKEN,
+  CORE_QUEUE_TOKEN,
+  CORE_POLICY_GATE_TOKEN,
+  CORE_CONFIG_TOKEN,
+  CORE_CACHE_TOKEN,
+  CORE_AUTH_TOKEN
+};

package/dist/entries/http/webErrorResponse.js

@@ -183,6 +183,11 @@ function isHtmxRequest(request) {
   return request.headers.get("HX-Request") === "true";
 }
 // ../../src/core/contracts/serviceTokens.ts
+var CORE_CONFIG_TOKEN = "core.config";
+var CORE_CACHE_TOKEN = "core.cache";
+var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_POLICY_GATE_TOKEN = "core.policyGate";
+var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
 // ../../src/bootstrap/config.ts
 var DEFAULT_QUEUE_DRIVER = "sync";

package/dist/entries/jobs/dispatchWebhookJob.js

@@ -1,7 +1,4 @@
 // @bun
-// ../../src/core/jobs/dispatchWebhookJob.ts
-import { createHmac } from "crypto";
-
 // ../../src/config/app.ts
 var appConfig = {
   name: "WorkHub",
@@ -96,13 +93,6 @@ var repositoryConnection = new Proxy(function repositoryConnection2() {}, {
   }
 });
 
-// ../../src/core/queue/index.ts
-class Job {
-  maxAttempts;
-  backoffMs;
-  priority;
-}
-
 // ../../src/core/security/safeUrl.ts
 import { lookup as dnsLookupImpl } from "dns/promises";
 
@@ -266,97 +256,3 @@ function setDnsLookupForTests(lookupFn) {
 function resetDnsLookupForTests() {
   dnsLookup = dnsLookupImpl;
 }
-
-// ../../src/core/security/safeFetch.ts
-var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
-async function safeFetch(input, init = {}, options = {}) {
-  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
-  const maxRedirects = options.maxRedirects ?? 0;
-  const resolveDns = options.resolveDns ?? appConfig.env === "production";
-  const urlOptions = { allowHttp: options.allowHttp, resolveDns };
-  const controller = new AbortController;
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    let currentUrl = (await assertSafeOutboundUrlResolved(input, urlOptions)).toString();
-    let redirectCount = 0;
-    while (true) {
-      const response = await fetch(currentUrl, {
-        ...init,
-        signal: controller.signal,
-        redirect: "manual"
-      });
-      if (response.status >= 300 && response.status < 400) {
-        const location = response.headers.get("location");
-        if (!location || redirectCount >= maxRedirects) {
-          return response;
-        }
-        currentUrl = (await assertSafeOutboundUrlResolved(new URL(location, currentUrl).toString(), urlOptions)).toString();
-        redirectCount += 1;
-        continue;
-      }
-      return response;
-    }
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-
-// ../../src/core/jobs/dispatchWebhookJob.ts
-class DispatchWebhookJob extends Job {
-  maxAttempts = 3;
-  backoffMs = 2000;
-  async handle(payload) {
-    const rows = await repositoryConnection`
-      SELECT id, url, secret
-      FROM webhook
-      WHERE id = ${payload.webhookId} AND active = TRUE
-      LIMIT 1
-    `;
-    const webhook = rows[0];
-    if (!webhook) {
-      return;
-    }
-    const body = JSON.stringify({ event: payload.event, payload: payload.payload });
-    const signature = createHmac("sha256", webhook.secret).update(body).digest("hex");
-    assertSafeOutboundUrl(webhook.url, { allowHttp: appConfig.env !== "production" });
-    let responseStatus = null;
-    let errorMessage = null;
-    try {
-      const response = await safeFetch(webhook.url, {
-        method: "POST",
-        headers: {
-          "content-type": "application/json",
-          "x-workhub-signature": signature
-        },
-        body
-      }, { allowHttp: appConfig.env !== "production" });
-      responseStatus = response.status;
-      if (!response.ok) {
-        throw new Error(`Webhook delivery failed with status ${response.status}.`);
-      }
-    } catch (error) {
-      errorMessage = error instanceof Error ? error.message : String(error);
-      await repositoryConnection`
-        INSERT INTO webhook_delivery (webhook_id, event, payload, response_status, error)
-        VALUES (
-          ${webhook.id},
-          ${payload.event},
-          ${JSON.stringify(payload.payload)}::jsonb,
-          ${responseStatus},
-          ${errorMessage}
-        )
-      `;
-      throw error instanceof Error ? error : new Error(errorMessage);
-    }
-    await repositoryConnection`
-      INSERT INTO webhook_delivery (webhook_id, event, payload, response_status)
-      VALUES (
-        ${webhook.id},
-        ${payload.event},
-        ${JSON.stringify(payload.payload)}::jsonb,
-        ${responseStatus}
-      )
-    `;
-  }
-}
-var dispatchWebhookJob_default = DispatchWebhookJob;

package/dist/entries/queue/createAppQueue.js

@@ -1911,7 +1911,6 @@ var failedJobService_default = FailedJobService;
 
 // ../../src/core/queue/jobRegistry.ts
 class JobRegistry {
-  constructor() {}
   factories = new Map;
   instances = new WeakMap;
   register(name, factory) {
@@ -1935,9 +1934,24 @@ class JobRegistry {
     return [...this.factories.keys()];
   }
 }
-var jobRegistry = new JobRegistry;
+var JOB_REGISTRY_KEY = Symbol.for("@getstrata/jobRegistry");
+function readSharedJobRegistry() {
+  const globalRegistry = globalThis[JOB_REGISTRY_KEY];
+  if (globalRegistry) {
+    return globalRegistry;
+  }
+  const registry = new JobRegistry;
+  globalThis[JOB_REGISTRY_KEY] = registry;
+  return registry;
+}
+var jobRegistry = readSharedJobRegistry();
 
 // ../../src/core/contracts/serviceTokens.ts
+var CORE_CONFIG_TOKEN = "core.config";
+var CORE_CACHE_TOKEN = "core.cache";
+var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_POLICY_GATE_TOKEN = "core.policyGate";
+var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
 // ../../src/bootstrap/config.ts
 var DEFAULT_QUEUE_DRIVER = "sync";
@@ -2154,304 +2168,6 @@ function createQueueWorker(redisUrl, failedJobs = createFailedJobService()) {
   return new QueueWorker(redisUrl, failedJobs);
 }
 
-// ../../src/core/jobs/dispatchWebhookJob.ts
-import { createHmac } from "crypto";
-
-// ../../src/config/app.ts
-var appConfig = {
-  name: "WorkHub",
-  env: process.env.APP_ENV ?? "local",
-  debug: (process.env.APP_DEBUG ?? "true") !== "false",
-  url: process.env.APP_URL ?? "http://localhost:3000",
-  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
-};
-
-// ../../src/core/queue/index.ts
-class Job {
-  maxAttempts;
-  backoffMs;
-  priority;
-}
-
-// ../../src/core/security/safeUrl.ts
-import { lookup as dnsLookupImpl } from "dns/promises";
-var dnsLookup = dnsLookupImpl;
-var BLOCKED_HOSTNAMES = new Set([
-  "localhost",
-  "127.0.0.1",
-  "0.0.0.0",
-  "::1",
-  "metadata.google.internal"
-]);
-function isPrivateIpv4(hostname) {
-  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
-  if (!match) {
-    return false;
-  }
-  const octets = match.slice(1, 5).map((part) => Number.parseInt(part, 10));
-  if (octets.some((octet) => octet < 0 || octet > 255)) {
-    return true;
-  }
-  const [a = 0, b = 0] = octets;
-  if (a === 10) {
-    return true;
-  }
-  if (a === 127) {
-    return true;
-  }
-  if (a === 0) {
-    return true;
-  }
-  if (a === 169 && b === 254) {
-    return true;
-  }
-  if (a === 172 && b >= 16 && b <= 31) {
-    return true;
-  }
-  if (a === 192 && b === 168) {
-    return true;
-  }
-  return false;
-}
-function isBlockedHostname(hostname) {
-  const normalized = hostname.trim().toLowerCase();
-  if (normalized.length === 0) {
-    return true;
-  }
-  if (BLOCKED_HOSTNAMES.has(normalized)) {
-    return true;
-  }
-  if (normalized.endsWith(".local") || normalized.endsWith(".internal")) {
-    return true;
-  }
-  if (normalized.includes(":")) {
-    return true;
-  }
-  return isPrivateIpv4(normalized);
-}
-function assertSafeOutboundUrl(rawUrl, options = {}) {
-  let parsed;
-  try {
-    parsed = new URL(rawUrl);
-  } catch {
-    throw new BadRequestError("Webhook URL is invalid.");
-  }
-  if (parsed.protocol !== "https:" && !(options.allowHttp && parsed.protocol === "http:")) {
-    throw new BadRequestError("Webhook URL must use HTTPS.");
-  }
-  if (parsed.username || parsed.password) {
-    throw new BadRequestError("Webhook URL must not include credentials.");
-  }
-  if (isBlockedHostname(parsed.hostname)) {
-    throw new BadRequestError("Webhook URL targets a blocked host.");
-  }
-  return parsed;
-}
-function isBlockedIpAddress(address) {
-  return isBlockedHostname(address.trim().toLowerCase());
-}
-async function assertSafeOutboundUrlResolved(rawUrl, options = {}) {
-  const parsed = assertSafeOutboundUrl(rawUrl, options);
-  if (options.resolveDns === false) {
-    return parsed;
-  }
-  const hostname = parsed.hostname.trim().toLowerCase();
-  const results = await dnsLookup(hostname, { all: true, verbatim: true });
-  if (results.some((result) => isBlockedIpAddress(result.address))) {
-    throw new BadRequestError("Webhook URL targets a blocked host.");
-  }
-  return parsed;
-}
-function setDnsLookupForTests(lookupFn) {
-  dnsLookup = lookupFn;
-}
-function resetDnsLookupForTests() {
-  dnsLookup = dnsLookupImpl;
-}
-
-// ../../src/core/security/safeFetch.ts
-var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
-async function safeFetch(input, init = {}, options = {}) {
-  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
-  const maxRedirects = options.maxRedirects ?? 0;
-  const resolveDns = options.resolveDns ?? appConfig.env === "production";
-  const urlOptions = { allowHttp: options.allowHttp, resolveDns };
-  const controller = new AbortController;
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    let currentUrl = (await assertSafeOutboundUrlResolved(input, urlOptions)).toString();
-    let redirectCount = 0;
-    while (true) {
-      const response = await fetch(currentUrl, {
-        ...init,
-        signal: controller.signal,
-        redirect: "manual"
-      });
-      if (response.status >= 300 && response.status < 400) {
-        const location = response.headers.get("location");
-        if (!location || redirectCount >= maxRedirects) {
-          return response;
-        }
-        currentUrl = (await assertSafeOutboundUrlResolved(new URL(location, currentUrl).toString(), urlOptions)).toString();
-        redirectCount += 1;
-        continue;
-      }
-      return response;
-    }
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-
-// ../../src/core/jobs/dispatchWebhookJob.ts
-class DispatchWebhookJob extends Job {
-  maxAttempts = 3;
-  backoffMs = 2000;
-  async handle(payload) {
-    const rows = await repositoryConnection`
-      SELECT id, url, secret
-      FROM webhook
-      WHERE id = ${payload.webhookId} AND active = TRUE
-      LIMIT 1
-    `;
-    const webhook = rows[0];
-    if (!webhook) {
-      return;
-    }
-    const body = JSON.stringify({ event: payload.event, payload: payload.payload });
-    const signature = createHmac("sha256", webhook.secret).update(body).digest("hex");
-    assertSafeOutboundUrl(webhook.url, { allowHttp: appConfig.env !== "production" });
-    let responseStatus = null;
-    let errorMessage = null;
-    try {
-      const response = await safeFetch(webhook.url, {
-        method: "POST",
-        headers: {
-          "content-type": "application/json",
-          "x-workhub-signature": signature
-        },
-        body
-      }, { allowHttp: appConfig.env !== "production" });
-      responseStatus = response.status;
-      if (!response.ok) {
-        throw new Error(`Webhook delivery failed with status ${response.status}.`);
-      }
-    } catch (error) {
-      errorMessage = error instanceof Error ? error.message : String(error);
-      await repositoryConnection`
-        INSERT INTO webhook_delivery (webhook_id, event, payload, response_status, error)
-        VALUES (
-          ${webhook.id},
-          ${payload.event},
-          ${JSON.stringify(payload.payload)}::jsonb,
-          ${responseStatus},
-          ${errorMessage}
-        )
-      `;
-      throw error instanceof Error ? error : new Error(errorMessage);
-    }
-    await repositoryConnection`
-      INSERT INTO webhook_delivery (webhook_id, event, payload, response_status)
-      VALUES (
-        ${webhook.id},
-        ${payload.event},
-        ${JSON.stringify(payload.payload)}::jsonb,
-        ${responseStatus}
-      )
-    `;
-  }
-}
-var dispatchWebhookJob_default = DispatchWebhookJob;
-
-// ../../src/core/jobs/invalidateCacheTagsJob.ts
-class InvalidateCacheTagsJob extends Job {
-  cache;
-  constructor(cache) {
-    super();
-    this.cache = cache;
-  }
-  async handle(payload) {
-    await this.cache.tags(...payload.tags).flush();
-  }
-}
-var invalidateCacheTagsJob_default = InvalidateCacheTagsJob;
-
-// ../../src/core/contracts/applicationContext.ts
-function getRequiredDependency(dependencies, key) {
-  const dependency = dependencies[key];
-  if (dependency === undefined) {
-    throw new Error(`Required dependency "${String(key)}" is not registered.`);
-  }
-  return dependency;
-}
-
-// ../../src/core/logging/logger.ts
-class Logger {
-  channel;
-  constructor(channel = "app") {
-    this.channel = channel;
-  }
-  write(level, message, context = {}) {
-    const entry = {
-      level,
-      channel: this.channel,
-      message,
-      timestamp: new Date().toISOString(),
-      ...context
-    };
-    const line = JSON.stringify(entry);
-    if (level === "error") {
-      console.error(line);
-      return;
-    }
-    console.log(line);
-  }
-  debug(message, context) {
-    this.write("debug", message, context);
-  }
-  info(message, context) {
-    this.write("info", message, context);
-  }
-  warn(message, context) {
-    this.write("warn", message, context);
-  }
-  error(message, context) {
-    this.write("error", message, context);
-  }
-}
-var appLogger = new Logger("app");
-
-// ../../src/core/runtime/applicationRegistry.ts
-var APPLICATION_CONTEXT_KEY = Symbol.for("@getstrata/applicationContext");
-var activeContext;
-function readStoredApplicationContext() {
-  if (activeContext) {
-    return activeContext;
-  }
-  const globalContext = globalThis[APPLICATION_CONTEXT_KEY];
-  if (globalContext) {
-    activeContext = globalContext;
-  }
-  return activeContext;
-}
-function requireActiveApplicationContext() {
-  const context = readStoredApplicationContext();
-  if (!context) {
-    throw new Error("The application context has not been bootstrapped.");
-  }
-  return context;
-}
-function resolveApplicationCache() {
-  return getRequiredDependency(requireActiveApplicationContext().dependencies, "cache");
-}
-// ../../src/bootstrap/queue/defaultJobs.ts
-function registerDefaultJobs() {
-  jobRegistry.register("cache.invalidate-tags", () => {
-    return new invalidateCacheTagsJob_default(resolveApplicationCache());
-  });
-  jobRegistry.register("webhook.dispatch", () => new dispatchWebhookJob_default);
-}
-
 // ../../src/core/queue/createAppQueue.ts
 var FAILED_JOB_SERVICE_TOKEN = "core.failedJobs";
 function createAppQueue(driver, redisUrl, failedJobs = createFailedJobService(), registerJobs) {
@@ -2462,7 +2178,6 @@ function createAppQueue(driver, redisUrl, failedJobs = createFailedJobService(),
   });
 }
 export {
-  registerDefaultJobs,
   createTrackedJob,
   createQueueWorker,
   createFailedJobService,

package/dist/entries/queue/jobRegistry.js

@@ -1,32 +1 @@
-// @bun
-// ../../src/core/queue/jobRegistry.ts
-class JobRegistry {
-  constructor() {}
-  factories = new Map;
-  instances = new WeakMap;
-  register(name, factory) {
-    this.factories.set(name, factory);
-  }
-  resolveName(job) {
-    return this.instances.get(job);
-  }
-  track(name, job) {
-    this.instances.set(job, name);
-    return job;
-  }
-  create(name) {
-    const factory = this.factories.get(name);
-    if (!factory) {
-      return;
-    }
-    return factory();
-  }
-  names() {
-    return [...this.factories.keys()];
-  }
-}
-var jobRegistry = new JobRegistry;
-export {
-  jobRegistry,
-  JobRegistry
-};
+export * from "../../index.js";

package/dist/entries/queue/jobRunner.js

@@ -1,5 +1,10 @@
 // @bun
 // ../../src/core/contracts/serviceTokens.ts
+var CORE_CONFIG_TOKEN = "core.config";
+var CORE_CACHE_TOKEN = "core.cache";
+var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_POLICY_GATE_TOKEN = "core.policyGate";
+var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
 // ../../src/bootstrap/config.ts
 var DEFAULT_QUEUE_DRIVER = "sync";
@@ -13,7 +18,6 @@ var queueConfig = {
 
 // ../../src/core/queue/jobRegistry.ts
 class JobRegistry {
-  constructor() {}
   factories = new Map;
   instances = new WeakMap;
   register(name, factory) {
@@ -37,7 +41,17 @@ class JobRegistry {
     return [...this.factories.keys()];
   }
 }
-var jobRegistry = new JobRegistry;
+var JOB_REGISTRY_KEY = Symbol.for("@getstrata/jobRegistry");
+function readSharedJobRegistry() {
+  const globalRegistry = globalThis[JOB_REGISTRY_KEY];
+  if (globalRegistry) {
+    return globalRegistry;
+  }
+  const registry = new JobRegistry;
+  globalThis[JOB_REGISTRY_KEY] = registry;
+  return registry;
+}
+var jobRegistry = readSharedJobRegistry();
 
 // ../../src/core/queue/jobRunner.ts
 async function runQueueJob(envelope, failedJobs) {

package/dist/entries/queue/publicQueue.js

@@ -1911,7 +1911,6 @@ var failedJobService_default = FailedJobService;
 
 // ../../src/core/queue/jobRegistry.ts
 class JobRegistry {
-  constructor() {}
   factories = new Map;
   instances = new WeakMap;
   register(name, factory) {
@@ -1935,9 +1934,24 @@ class JobRegistry {
     return [...this.factories.keys()];
   }
 }
-var jobRegistry = new JobRegistry;
+var JOB_REGISTRY_KEY = Symbol.for("@getstrata/jobRegistry");
+function readSharedJobRegistry() {
+  const globalRegistry = globalThis[JOB_REGISTRY_KEY];
+  if (globalRegistry) {
+    return globalRegistry;
+  }
+  const registry = new JobRegistry;
+  globalThis[JOB_REGISTRY_KEY] = registry;
+  return registry;
+}
+var jobRegistry = readSharedJobRegistry();
 
 // ../../src/core/contracts/serviceTokens.ts
+var CORE_CONFIG_TOKEN = "core.config";
+var CORE_CACHE_TOKEN = "core.cache";
+var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_POLICY_GATE_TOKEN = "core.policyGate";
+var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
 // ../../src/bootstrap/config.ts
 var DEFAULT_QUEUE_DRIVER = "sync";

package/dist/entries/queue/queueMetrics.js

@@ -3,6 +3,11 @@
 var {RedisClient: RedisClient2 } = globalThis.Bun;
 
 // ../../src/core/contracts/serviceTokens.ts
+var CORE_CONFIG_TOKEN = "core.config";
+var CORE_CACHE_TOKEN = "core.cache";
+var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_POLICY_GATE_TOKEN = "core.policyGate";
+var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
 // ../../src/bootstrap/config.ts
 var DEFAULT_QUEUE_DRIVER = "sync";
@@ -1926,7 +1931,6 @@ var failedJobService_default = FailedJobService;
 
 // ../../src/core/queue/jobRegistry.ts
 class JobRegistry {
-  constructor() {}
   factories = new Map;
   instances = new WeakMap;
   register(name, factory) {
@@ -1950,7 +1954,17 @@ class JobRegistry {
     return [...this.factories.keys()];
   }
 }
-var jobRegistry = new JobRegistry;
+var JOB_REGISTRY_KEY = Symbol.for("@getstrata/jobRegistry");
+function readSharedJobRegistry() {
+  const globalRegistry = globalThis[JOB_REGISTRY_KEY];
+  if (globalRegistry) {
+    return globalRegistry;
+  }
+  const registry = new JobRegistry;
+  globalThis[JOB_REGISTRY_KEY] = registry;
+  return registry;
+}
+var jobRegistry = readSharedJobRegistry();
 
 // ../../src/core/queue/jobRunner.ts
 async function runQueueJob(envelope, failedJobs) {
@@ -2157,304 +2171,6 @@ function createQueueWorker(redisUrl, failedJobs = createFailedJobService()) {
   return new QueueWorker(redisUrl, failedJobs);
 }
 
-// ../../src/core/jobs/dispatchWebhookJob.ts
-import { createHmac } from "crypto";
-
-// ../../src/config/app.ts
-var appConfig = {
-  name: "WorkHub",
-  env: process.env.APP_ENV ?? "local",
-  debug: (process.env.APP_DEBUG ?? "true") !== "false",
-  url: process.env.APP_URL ?? "http://localhost:3000",
-  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
-};
-
-// ../../src/core/queue/index.ts
-class Job {
-  maxAttempts;
-  backoffMs;
-  priority;
-}
-
-// ../../src/core/security/safeUrl.ts
-import { lookup as dnsLookupImpl } from "dns/promises";
-var dnsLookup = dnsLookupImpl;
-var BLOCKED_HOSTNAMES = new Set([
-  "localhost",
-  "127.0.0.1",
-  "0.0.0.0",
-  "::1",
-  "metadata.google.internal"
-]);
-function isPrivateIpv4(hostname) {
-  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
-  if (!match) {
-    return false;
-  }
-  const octets = match.slice(1, 5).map((part) => Number.parseInt(part, 10));
-  if (octets.some((octet) => octet < 0 || octet > 255)) {
-    return true;
-  }
-  const [a = 0, b = 0] = octets;
-  if (a === 10) {
-    return true;
-  }
-  if (a === 127) {
-    return true;
-  }
-  if (a === 0) {
-    return true;
-  }
-  if (a === 169 && b === 254) {
-    return true;
-  }
-  if (a === 172 && b >= 16 && b <= 31) {
-    return true;
-  }
-  if (a === 192 && b === 168) {
-    return true;
-  }
-  return false;
-}
-function isBlockedHostname(hostname) {
-  const normalized = hostname.trim().toLowerCase();
-  if (normalized.length === 0) {
-    return true;
-  }
-  if (BLOCKED_HOSTNAMES.has(normalized)) {
-    return true;
-  }
-  if (normalized.endsWith(".local") || normalized.endsWith(".internal")) {
-    return true;
-  }
-  if (normalized.includes(":")) {
-    return true;
-  }
-  return isPrivateIpv4(normalized);
-}
-function assertSafeOutboundUrl(rawUrl, options = {}) {
-  let parsed;
-  try {
-    parsed = new URL(rawUrl);
-  } catch {
-    throw new BadRequestError("Webhook URL is invalid.");
-  }
-  if (parsed.protocol !== "https:" && !(options.allowHttp && parsed.protocol === "http:")) {
-    throw new BadRequestError("Webhook URL must use HTTPS.");
-  }
-  if (parsed.username || parsed.password) {
-    throw new BadRequestError("Webhook URL must not include credentials.");
-  }
-  if (isBlockedHostname(parsed.hostname)) {
-    throw new BadRequestError("Webhook URL targets a blocked host.");
-  }
-  return parsed;
-}
-function isBlockedIpAddress(address) {
-  return isBlockedHostname(address.trim().toLowerCase());
-}
-async function assertSafeOutboundUrlResolved(rawUrl, options = {}) {
-  const parsed = assertSafeOutboundUrl(rawUrl, options);
-  if (options.resolveDns === false) {
-    return parsed;
-  }
-  const hostname = parsed.hostname.trim().toLowerCase();
-  const results = await dnsLookup(hostname, { all: true, verbatim: true });
-  if (results.some((result) => isBlockedIpAddress(result.address))) {
-    throw new BadRequestError("Webhook URL targets a blocked host.");
-  }
-  return parsed;
-}
-function setDnsLookupForTests(lookupFn) {
-  dnsLookup = lookupFn;
-}
-function resetDnsLookupForTests() {
-  dnsLookup = dnsLookupImpl;
-}
-
-// ../../src/core/security/safeFetch.ts
-var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
-async function safeFetch(input, init = {}, options = {}) {
-  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
-  const maxRedirects = options.maxRedirects ?? 0;
-  const resolveDns = options.resolveDns ?? appConfig.env === "production";
-  const urlOptions = { allowHttp: options.allowHttp, resolveDns };
-  const controller = new AbortController;
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    let currentUrl = (await assertSafeOutboundUrlResolved(input, urlOptions)).toString();
-    let redirectCount = 0;
-    while (true) {
-      const response = await fetch(currentUrl, {
-        ...init,
-        signal: controller.signal,
-        redirect: "manual"
-      });
-      if (response.status >= 300 && response.status < 400) {
-        const location = response.headers.get("location");
-        if (!location || redirectCount >= maxRedirects) {
-          return response;
-        }
-        currentUrl = (await assertSafeOutboundUrlResolved(new URL(location, currentUrl).toString(), urlOptions)).toString();
-        redirectCount += 1;
-        continue;
-      }
-      return response;
-    }
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-
-// ../../src/core/jobs/dispatchWebhookJob.ts
-class DispatchWebhookJob extends Job {
-  maxAttempts = 3;
-  backoffMs = 2000;
-  async handle(payload) {
-    const rows = await repositoryConnection`
-      SELECT id, url, secret
-      FROM webhook
-      WHERE id = ${payload.webhookId} AND active = TRUE
-      LIMIT 1
-    `;
-    const webhook = rows[0];
-    if (!webhook) {
-      return;
-    }
-    const body = JSON.stringify({ event: payload.event, payload: payload.payload });
-    const signature = createHmac("sha256", webhook.secret).update(body).digest("hex");
-    assertSafeOutboundUrl(webhook.url, { allowHttp: appConfig.env !== "production" });
-    let responseStatus = null;
-    let errorMessage = null;
-    try {
-      const response = await safeFetch(webhook.url, {
-        method: "POST",
-        headers: {
-          "content-type": "application/json",
-          "x-workhub-signature": signature
-        },
-        body
-      }, { allowHttp: appConfig.env !== "production" });
-      responseStatus = response.status;
-      if (!response.ok) {
-        throw new Error(`Webhook delivery failed with status ${response.status}.`);
-      }
-    } catch (error) {
-      errorMessage = error instanceof Error ? error.message : String(error);
-      await repositoryConnection`
-        INSERT INTO webhook_delivery (webhook_id, event, payload, response_status, error)
-        VALUES (
-          ${webhook.id},
-          ${payload.event},
-          ${JSON.stringify(payload.payload)}::jsonb,
-          ${responseStatus},
-          ${errorMessage}
-        )
-      `;
-      throw error instanceof Error ? error : new Error(errorMessage);
-    }
-    await repositoryConnection`
-      INSERT INTO webhook_delivery (webhook_id, event, payload, response_status)
-      VALUES (
-        ${webhook.id},
-        ${payload.event},
-        ${JSON.stringify(payload.payload)}::jsonb,
-        ${responseStatus}
-      )
-    `;
-  }
-}
-var dispatchWebhookJob_default = DispatchWebhookJob;
-
-// ../../src/core/jobs/invalidateCacheTagsJob.ts
-class InvalidateCacheTagsJob extends Job {
-  cache;
-  constructor(cache) {
-    super();
-    this.cache = cache;
-  }
-  async handle(payload) {
-    await this.cache.tags(...payload.tags).flush();
-  }
-}
-var invalidateCacheTagsJob_default = InvalidateCacheTagsJob;
-
-// ../../src/core/contracts/applicationContext.ts
-function getRequiredDependency(dependencies, key) {
-  const dependency = dependencies[key];
-  if (dependency === undefined) {
-    throw new Error(`Required dependency "${String(key)}" is not registered.`);
-  }
-  return dependency;
-}
-
-// ../../src/core/logging/logger.ts
-class Logger {
-  channel;
-  constructor(channel = "app") {
-    this.channel = channel;
-  }
-  write(level, message, context = {}) {
-    const entry = {
-      level,
-      channel: this.channel,
-      message,
-      timestamp: new Date().toISOString(),
-      ...context
-    };
-    const line = JSON.stringify(entry);
-    if (level === "error") {
-      console.error(line);
-      return;
-    }
-    console.log(line);
-  }
-  debug(message, context) {
-    this.write("debug", message, context);
-  }
-  info(message, context) {
-    this.write("info", message, context);
-  }
-  warn(message, context) {
-    this.write("warn", message, context);
-  }
-  error(message, context) {
-    this.write("error", message, context);
-  }
-}
-var appLogger = new Logger("app");
-
-// ../../src/core/runtime/applicationRegistry.ts
-var APPLICATION_CONTEXT_KEY = Symbol.for("@getstrata/applicationContext");
-var activeContext;
-function readStoredApplicationContext() {
-  if (activeContext) {
-    return activeContext;
-  }
-  const globalContext = globalThis[APPLICATION_CONTEXT_KEY];
-  if (globalContext) {
-    activeContext = globalContext;
-  }
-  return activeContext;
-}
-function requireActiveApplicationContext() {
-  const context = readStoredApplicationContext();
-  if (!context) {
-    throw new Error("The application context has not been bootstrapped.");
-  }
-  return context;
-}
-function resolveApplicationCache() {
-  return getRequiredDependency(requireActiveApplicationContext().dependencies, "cache");
-}
-// ../../src/bootstrap/queue/defaultJobs.ts
-function registerDefaultJobs() {
-  jobRegistry.register("cache.invalidate-tags", () => {
-    return new invalidateCacheTagsJob_default(resolveApplicationCache());
-  });
-  jobRegistry.register("webhook.dispatch", () => new dispatchWebhookJob_default);
-}
-
 // ../../src/core/queue/createAppQueue.ts
 var FAILED_JOB_SERVICE_TOKEN = "core.failedJobs";
 function createAppQueue(driver, redisUrl, failedJobs = createFailedJobService(), registerJobs) {

package/dist/entries/view.js

@@ -45,6 +45,11 @@ function isHtmxRequest(request) {
   return request.headers.get("HX-Request") === "true";
 }
 // ../../src/core/contracts/serviceTokens.ts
+var CORE_CONFIG_TOKEN = "core.config";
+var CORE_CACHE_TOKEN = "core.cache";
+var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_POLICY_GATE_TOKEN = "core.policyGate";
+var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
 // ../../src/bootstrap/config.ts
 var DEFAULT_QUEUE_DRIVER = "sync";

package/dist/framework/public-api.d.ts

@@ -19,7 +19,6 @@ export { default as MembershipService, resolveMembershipService, } from "../core
 export { Policy, PolicyGate } from "../core/auth/policy.ts";
 export { createScimAuthMiddleware } from "../core/auth/scimAuthMiddleware.ts";
 export { type CacheDriver, type CreateCacheStoreOptions, createCacheStore, } from "../core/cache/createCacheStore.ts";
-export { cacheTagsForModelWrite, discoverModelTableNames } from "../core/cache/modelCacheTags.ts";
 export { default as CacheRepository } from "../core/cache/repository.ts";
 export { CACHE_TAGS } from "../core/cache/tags.ts";
 export type { DatabaseConnection } from "../core/database/baseRepository.ts";

package/dist/index.js

@@ -3311,7 +3311,8 @@ function resolveApplicationLogger() {
 function resolveApplicationDependencies() {
   return requireActiveApplicationContext().dependencies;
 }
-// ../../src/bootstrap/membershipService.ts
+
+// ../../src/core/auth/resolveMembershipService.ts
 function resolveMembershipService() {
   const dependencies = resolveApplicationDependencies();
   if (dependencies.container.has("core.membership")) {
@@ -3922,23 +3923,6 @@ function createCacheStore(options) {
   }
   return new simpleCacheStore_default(new simpleCache_default(options.ttlMs, options.maxEntries));
 }
-// ../../src/bootstrap/discoverModules.ts
-var appModules = [];
-function discoverModules() {
-  return appModules;
-}
-
-// ../../src/bootstrap/cache/modelCacheTags.ts
-function cacheTagsForModelWrite(tableName, action) {
-  const module = discoverModules().find((entry) => entry.tableName === tableName);
-  const baseTags = module?.cacheTags ?? [`${tableName}s`];
-  const isDelete = action === "deleted" || action === "force-deleted";
-  const extraTags = isDelete ? module?.cacheDeleteExtraTags ?? [] : [];
-  return [...new Set([...baseTags, ...extraTags])];
-}
-function discoverModelTableNames() {
-  return discoverModules().map((module) => module.tableName).filter((tableName) => tableName !== undefined);
-}
 // ../../src/core/cache/taggedCache.ts
 class TaggedCache {
   store;
@@ -5307,7 +5291,7 @@ function bindRouteModel(param, resolver, handler) {
     return await handler(request, model);
   };
 }
-// ../../src/bootstrap/http/securedRouteModelBinding.ts
+// ../../src/core/http/securedRouteModelBinding.ts
 function isMutatingPolicyAction(action) {
   return action === "update" || action === "delete";
 }
@@ -6121,7 +6105,6 @@ var failedJobService_default = FailedJobService;
 
 // ../../src/core/queue/jobRegistry.ts
 class JobRegistry {
-  constructor() {}
   factories = new Map;
   instances = new WeakMap;
   register(name, factory) {
@@ -6145,7 +6128,17 @@ class JobRegistry {
     return [...this.factories.keys()];
   }
 }
-var jobRegistry = new JobRegistry;
+var JOB_REGISTRY_KEY = Symbol.for("@getstrata/jobRegistry");
+function readSharedJobRegistry() {
+  const globalRegistry = globalThis[JOB_REGISTRY_KEY];
+  if (globalRegistry) {
+    return globalRegistry;
+  }
+  const registry = new JobRegistry;
+  globalThis[JOB_REGISTRY_KEY] = registry;
+  return registry;
+}
+var jobRegistry = readSharedJobRegistry();
 
 // ../../src/config/queue.ts
 var queueConfig = {
@@ -6360,16 +6353,6 @@ function createQueueWorker(redisUrl, failedJobs = createFailedJobService()) {
 }
 // ../../src/core/queue/queueMetrics.ts
 var {RedisClient: RedisClient6 } = globalThis.Bun;
-
-// ../../src/core/security/safeUrl.ts
-var BLOCKED_HOSTNAMES = new Set([
-  "localhost",
-  "127.0.0.1",
-  "0.0.0.0",
-  "::1",
-  "metadata.google.internal"
-]);
-// ../../src/core/queue/queueMetrics.ts
 async function readRedisQueueDepth(redisUrl) {
   const client = new RedisClient6(redisUrl);
   const [high, defaultQueue, low] = await Promise.all([
@@ -6823,7 +6806,6 @@ export {
   etagFromResource,
   emptyPaginateResult,
   emailRule,
-  discoverModelTableNames,
   dehydrateValue,
   defineTable,
   currentTraceId,
@@ -6873,7 +6855,6 @@ export {
   composeMiddleware,
   compileBlueprint,
   collectQueueMetrics,
-  cacheTagsForModelWrite,
   cache,
   buildSmtpPayload,
   buildRequestCacheKey,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "0.5.21",
+  "version": "0.5.25",
   "description": "Strata — Laravel-inspired Bun framework public API",
   "type": "module",
   "license": "MIT",
@@ -95,6 +95,11 @@
       "import": "./dist/entries/cache/createCacheStore.js",
       "default": "./dist/entries/cache/createCacheStore.js"
     },
+    "./contracts/serviceTokens": {
+      "types": "./dist/core/contracts/serviceTokens.d.ts",
+      "import": "./dist/entries/contracts/serviceTokens.js",
+      "default": "./dist/entries/contracts/serviceTokens.js"
+    },
     "./crypto/fieldEncryption": {
       "types": "./dist/core/crypto/fieldEncryption.d.ts",
       "import": "./dist/entries/crypto/fieldEncryption.js",
@@ -322,7 +327,7 @@
     "build:bundle": "bun build index.ts --outdir dist --target bun --external bun --external eta",
     "build:types": "tsc -p tsconfig.types.json",
     "prepublishOnly": "bun run build && bun ../../scripts/prepare-core-package-publish.ts",
-    "build:subpaths": "bun build entries/auth/oauth/oidcProvider.ts entries/auth/oauth/providers.ts entries/auth/oauth/samlProvider.ts entries/auth/oauth/types.ts entries/auth/password.ts entries/auth/sessionCookie.ts entries/auth/tokenHash.ts entries/cache/tags.ts entries/cache/createCacheStore.ts entries/crypto/fieldEncryption.ts entries/crypto/mfaSecret.ts entries/database/factory.ts entries/database/seeders.ts entries/database/types.ts entries/errors/http.ts entries/http/contentNegotiation.ts entries/http/csrfToken.ts entries/http/etag.ts entries/http/flashSession.ts entries/http/parseFormBody.ts entries/http/resources.ts entries/http/webErrorResponse.ts entries/http/webFormRequest.ts entries/jobs/dispatchWebhookJob.ts entries/lifecycle/gracefulShutdown.ts entries/metrics/prometheus.ts entries/pagination.ts entries/queue/createAppQueue.ts entries/queue/failedJobService.ts entries/queue/jobRegistry.ts entries/queue/jobRunner.ts entries/queue/queueMetrics.ts entries/queue/publicQueue.ts entries/queue/types.ts entries/security/oauthState.ts entries/security/publicReads.ts entries/security/safeUrl.ts entries/security/stripeWebhook.ts entries/security/tokenExpiry.ts entries/security/totp.ts entries/storage/storage.ts entries/validation/rules.ts entries/view.ts --outdir dist --root . --target bun --external bun --external eta",
+    "build:subpaths": "bun build entries/auth/oauth/oidcProvider.ts entries/auth/oauth/providers.ts entries/auth/oauth/samlProvider.ts entries/auth/oauth/types.ts entries/auth/password.ts entries/auth/sessionCookie.ts entries/auth/tokenHash.ts entries/cache/tags.ts entries/cache/createCacheStore.ts entries/contracts/serviceTokens.ts entries/crypto/fieldEncryption.ts entries/crypto/mfaSecret.ts entries/database/factory.ts entries/database/seeders.ts entries/database/types.ts entries/errors/http.ts entries/http/contentNegotiation.ts entries/http/csrfToken.ts entries/http/etag.ts entries/http/flashSession.ts entries/http/parseFormBody.ts entries/http/resources.ts entries/http/webErrorResponse.ts entries/http/webFormRequest.ts entries/jobs/dispatchWebhookJob.ts entries/lifecycle/gracefulShutdown.ts entries/metrics/prometheus.ts entries/pagination.ts entries/queue/createAppQueue.ts entries/queue/failedJobService.ts entries/queue/jobRunner.ts entries/queue/queueMetrics.ts entries/queue/publicQueue.ts entries/queue/types.ts entries/security/oauthState.ts entries/security/publicReads.ts entries/security/safeUrl.ts entries/security/stripeWebhook.ts entries/security/tokenExpiry.ts entries/security/totp.ts entries/storage/storage.ts entries/validation/rules.ts entries/view.ts --outdir dist --root . --target bun --external bun --external eta",
     "build:shims": "bun ../../scripts/write-core-shared-shims.ts"
   },
   "publishConfig": {

package/dist/bootstrap/applicationRegistry.d.ts

@@ -1 +0,0 @@
-export { resolveApplicationAuth, resolveApplicationCache, resolveApplicationConfig, resolveApplicationDependencies, resolveApplicationLogger, resolveApplicationPolicyGate, resolveApplicationQueue, setActiveApplicationContext, } from "../core/runtime/applicationRegistry.ts";

package/dist/bootstrap/cache/modelCacheTags.d.ts

@@ -1,3 +0,0 @@
-declare function cacheTagsForModelWrite(tableName: string, action: string): string[];
-declare function discoverModelTableNames(): string[];
-export { cacheTagsForModelWrite, discoverModelTableNames };

package/dist/bootstrap/discoverModules.d.ts

@@ -1,5 +0,0 @@
-import type { AppModule } from "./contracts";
-declare let appModules: AppModule[];
-declare function ensureModulesLoaded(): Promise<AppModule[]>;
-declare function discoverModules(): AppModule[];
-export { appModules, discoverModules, ensureModulesLoaded };

package/dist/bootstrap/http/securedRouteModelBinding.d.ts

@@ -1,11 +0,0 @@
-import type { Policy } from "../../core/auth/policy";
-import type { RouteRequest } from "../../core/http/route";
-interface RouteModelAuthorization {
-    resource: string;
-    action: keyof Policy;
-    requireIfMatch?: boolean;
-}
-declare function securedBindRouteModel<TParams extends Record<string, string>, TModel, TParam extends keyof TParams & string>(param: TParam, resolver: (id: number, request: RouteRequest<TParams>) => Promise<TModel>, authorization: RouteModelAuthorization, handler: (request: RouteRequest<TParams>, model: TModel) => Response | Promise<Response>): (request: RouteRequest<TParams>) => Promise<Response>;
-declare function securedBindRouteModelByKey<TParams extends Record<string, string>, TModel, TParam extends keyof TParams & string>(param: TParam, resolver: (key: string, request: RouteRequest<TParams>) => Promise<TModel>, authorization: RouteModelAuthorization, handler: (request: RouteRequest<TParams>, model: TModel) => Response | Promise<Response>): (request: RouteRequest<TParams>) => Promise<Response>;
-export type { RouteModelAuthorization };
-export { securedBindRouteModel, securedBindRouteModelByKey };

package/dist/bootstrap/queue/defaultJobs.d.ts

@@ -1,2 +0,0 @@
-declare function registerDefaultJobs(): void;
-export { registerDefaultJobs };

package/dist/core/cache/modelCacheTags.d.ts

@@ -1 +0,0 @@
-export { cacheTagsForModelWrite, discoverModelTableNames, } from "../../bootstrap/cache/modelCacheTags.ts";