@getstrata/core 0.5.34 → 0.5.37

package/dist/entries/audit/exportAuditLogs.js

@@ -0,0 +1,415 @@
+// @bun
+// ../../src/config/app.ts
+var appConfig = {
+  name: "WorkHub",
+  env: process.env.APP_ENV ?? "local",
+  debug: (process.env.APP_DEBUG ?? "true") !== "false",
+  url: process.env.APP_URL ?? "http://localhost:3000",
+  apiPrefix: process.env.API_PREFIX ?? "/api/v1"
+};
+
+// ../../src/core/database/boundConnection.ts
+var boundConnectionHolder = {
+  connection: null
+};
+function getBoundDatabaseConnection() {
+  return boundConnectionHolder.connection;
+}
+
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+
+// ../../src/core/database/connectionContext.ts
+var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
+function getActiveDatabaseConnection(fallback) {
+  return activeConnection.getStore() ?? fallback;
+}
+
+// ../../src/core/database/queryProxy.ts
+var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+function createDatabaseQueryProxy(pool) {
+  function resolveDatabase() {
+    return getActiveDatabaseConnection(pool);
+  }
+  function resolveDatabaseForProperty(property) {
+    if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
+      return pool;
+    }
+    return resolveDatabase();
+  }
+  return new Proxy(function database() {}, {
+    apply(_target, _thisArg, args) {
+      return resolveDatabase()(...args);
+    },
+    get(_target, property) {
+      const connection = resolveDatabaseForProperty(property);
+      const value = connection[property];
+      return typeof value === "function" ? value.bind(connection) : value;
+    }
+  });
+}
+
+// ../../src/core/database/defaultConnection.ts
+var defaultPool = {
+  connection: null
+};
+var defaultQuery = {
+  connection: null
+};
+function registerDefaultDatabasePool(connection) {
+  defaultPool.connection = connection;
+  defaultQuery.connection = createDatabaseQueryProxy(connection);
+}
+function getDefaultDatabaseQuery() {
+  if (!defaultQuery.connection) {
+    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
+  }
+  return defaultQuery.connection;
+}
+
+// ../../src/core/database/repositoryConnection.ts
+function resolveRepositoryConnection() {
+  return getBoundDatabaseConnection() ?? getDefaultDatabaseQuery();
+}
+var repositoryConnection = new Proxy(function repositoryConnection2() {}, {
+  apply(_target, _thisArg, args) {
+    return resolveRepositoryConnection()(...args);
+  },
+  get(_target, property) {
+    const connection = resolveRepositoryConnection();
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
+  }
+});
+
+// ../../src/core/security/safeUrl.ts
+import { lookup as dnsLookupImpl } from "dns/promises";
+
+// ../../src/core/errors/http.ts
+class HttpError extends Error {
+  status;
+  details;
+  constructor(status, message, details) {
+    super(message);
+    this.name = new.target.name;
+    this.status = status;
+    this.details = details;
+  }
+}
+
+class BadRequestError extends HttpError {
+  constructor(message = "Bad Request", details) {
+    super(400, message, details);
+  }
+}
+
+class NotFoundError extends HttpError {
+  constructor(message = "Not Found", details) {
+    super(404, message, details);
+  }
+}
+
+class ConflictError extends HttpError {
+  constructor(message = "Conflict", details) {
+    super(409, message, details);
+  }
+}
+
+class UnprocessableEntityError extends HttpError {
+  constructor(message = "Unprocessable Entity", details) {
+    super(422, message, details);
+  }
+}
+
+class ValidationError extends HttpError {
+  constructor(message = "Validation failed", details) {
+    super(422, message, details);
+  }
+}
+
+class ForbiddenError extends HttpError {
+  constructor(message = "Forbidden", details) {
+    super(403, message, details);
+  }
+}
+
+class UnauthorizedError extends HttpError {
+  constructor(message = "Unauthorized", details) {
+    super(401, message, details);
+  }
+}
+
+class PayloadTooLargeError extends HttpError {
+  constructor(message = "Payload Too Large", details) {
+    super(413, message, details);
+  }
+}
+
+class PreconditionFailedError extends HttpError {
+  constructor(message = "Precondition Failed", details) {
+    super(412, message, details);
+  }
+}
+
+// ../../src/core/security/safeUrl.ts
+var dnsLookup = dnsLookupImpl;
+var BLOCKED_HOSTNAMES = new Set([
+  "localhost",
+  "127.0.0.1",
+  "0.0.0.0",
+  "::1",
+  "metadata.google.internal"
+]);
+function isPrivateIpv4(hostname) {
+  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
+  if (!match) {
+    return false;
+  }
+  const octets = match.slice(1, 5).map((part) => Number.parseInt(part, 10));
+  if (octets.some((octet) => octet < 0 || octet > 255)) {
+    return true;
+  }
+  const [a = 0, b = 0] = octets;
+  if (a === 10) {
+    return true;
+  }
+  if (a === 127) {
+    return true;
+  }
+  if (a === 0) {
+    return true;
+  }
+  if (a === 169 && b === 254) {
+    return true;
+  }
+  if (a === 172 && b >= 16 && b <= 31) {
+    return true;
+  }
+  if (a === 192 && b === 168) {
+    return true;
+  }
+  return false;
+}
+function isBlockedHostname(hostname) {
+  const normalized = hostname.trim().toLowerCase();
+  if (normalized.length === 0) {
+    return true;
+  }
+  if (BLOCKED_HOSTNAMES.has(normalized)) {
+    return true;
+  }
+  if (normalized.endsWith(".local") || normalized.endsWith(".internal")) {
+    return true;
+  }
+  if (normalized.includes(":")) {
+    return true;
+  }
+  return isPrivateIpv4(normalized);
+}
+function assertSafeOutboundUrl(rawUrl, options = {}) {
+  let parsed;
+  try {
+    parsed = new URL(rawUrl);
+  } catch {
+    throw new BadRequestError("Webhook URL is invalid.");
+  }
+  if (parsed.protocol !== "https:" && !(options.allowHttp && parsed.protocol === "http:")) {
+    throw new BadRequestError("Webhook URL must use HTTPS.");
+  }
+  if (parsed.username || parsed.password) {
+    throw new BadRequestError("Webhook URL must not include credentials.");
+  }
+  if (isBlockedHostname(parsed.hostname)) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  return parsed;
+}
+function isBlockedIpAddress(address) {
+  return isBlockedHostname(address.trim().toLowerCase());
+}
+async function assertSafeOutboundUrlResolved(rawUrl, options = {}) {
+  const parsed = assertSafeOutboundUrl(rawUrl, options);
+  if (options.resolveDns === false) {
+    return parsed;
+  }
+  const hostname = parsed.hostname.trim().toLowerCase();
+  const results = await dnsLookup(hostname, { all: true, verbatim: true });
+  if (results.some((result) => isBlockedIpAddress(result.address))) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  return parsed;
+}
+function setDnsLookupForTests(lookupFn) {
+  dnsLookup = lookupFn;
+}
+function resetDnsLookupForTests() {
+  dnsLookup = dnsLookupImpl;
+}
+
+// ../../src/core/security/safeFetch.ts
+var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
+async function safeFetch(input, init = {}, options = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const maxRedirects = options.maxRedirects ?? 0;
+  const resolveDns = options.resolveDns ?? appConfig.env === "production";
+  const urlOptions = { allowHttp: options.allowHttp, resolveDns };
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    let currentUrl = (await assertSafeOutboundUrlResolved(input, urlOptions)).toString();
+    let redirectCount = 0;
+    while (true) {
+      const response = await fetch(currentUrl, {
+        ...init,
+        signal: controller.signal,
+        redirect: "manual"
+      });
+      if (response.status >= 300 && response.status < 400) {
+        const location = response.headers.get("location");
+        if (!location || redirectCount >= maxRedirects) {
+          return response;
+        }
+        currentUrl = (await assertSafeOutboundUrlResolved(new URL(location, currentUrl).toString(), urlOptions)).toString();
+        redirectCount += 1;
+        continue;
+      }
+      return response;
+    }
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+// ../../src/core/tenant/databaseTenantContext.ts
+async function runWithMigrationBypass(callback) {
+  await repositoryConnection`SELECT set_config('app.bypass_rls', 'true', false)`;
+  try {
+    return await callback();
+  } finally {
+    await repositoryConnection`SELECT set_config('app.bypass_rls', 'false', false)`;
+  }
+}
+
+// ../../src/core/audit/siemFormatter.ts
+function formatSiemAuditEvent(input) {
+  return {
+    timestamp: input.created_at.toISOString(),
+    event_type: "workhub.audit",
+    actor_user_id: input.user_id,
+    tenant_id: input.tenant_id ?? null,
+    trace_id: input.trace_id ?? null,
+    action: input.action,
+    subject_type: input.subject_type,
+    subject_id: input.subject_id,
+    ip_address: input.ip_address ?? null,
+    user_agent: input.user_agent ?? null,
+    checksum: input.checksum ?? null,
+    payload: input.payload ?? {}
+  };
+}
+function formatCefLine(event) {
+  const extension = [
+    `rt=${event.timestamp}`,
+    `suid=${event.actor_user_id ?? "unknown"}`,
+    `cs1=${event.action}`,
+    `cs1Label=Action`,
+    `cs2=${event.subject_type}`,
+    `cs2Label=SubjectType`,
+    `cs3=${event.subject_id ?? ""}`,
+    `cs3Label=SubjectId`,
+    `src=${event.ip_address ?? ""}`,
+    `request=${event.trace_id ?? ""}`
+  ].join(" ");
+  return `CEF:0|WorkHub|API|1.0|${event.action}|${event.subject_type}|5|${extension}`;
+}
+
+// ../../src/core/audit/exportAuditLogs.ts
+function resolveAuditExportConfig() {
+  const endpoint = process.env.SIEM_EXPORT_URL?.trim();
+  if (!endpoint) {
+    return null;
+  }
+  assertSafeOutboundUrl(endpoint, { allowHttp: appConfig.env !== "production" });
+  const batchSize = Number(process.env.SIEM_EXPORT_BATCH_SIZE ?? "100");
+  return {
+    endpoint,
+    format: process.env.SIEM_EXPORT_FORMAT === "cef" ? "cef" : "json",
+    batchSize: Number.isFinite(batchSize) ? batchSize : 100
+  };
+}
+async function exportPendingAuditLogs() {
+  const config = resolveAuditExportConfig();
+  if (!config) {
+    return 0;
+  }
+  return await runWithMigrationBypass(async () => {
+    const rows = await repositoryConnection`
+      SELECT
+        id,
+        user_id,
+        action,
+        subject_type,
+        subject_id,
+        payload,
+        ip_address,
+        user_agent,
+        checksum,
+        tenant_id,
+        trace_id,
+        created_at
+      FROM audit_log
+      WHERE exported_at IS NULL
+      ORDER BY id
+      LIMIT ${config.batchSize}
+    `;
+    if (rows.length === 0) {
+      return 0;
+    }
+    const events = rows.map((row) => formatSiemAuditEvent({
+      action: row.action,
+      subject_type: row.subject_type,
+      subject_id: row.subject_id,
+      user_id: row.user_id,
+      tenant_id: row.tenant_id,
+      trace_id: row.trace_id,
+      ip_address: row.ip_address,
+      user_agent: row.user_agent,
+      checksum: row.checksum,
+      payload: row.payload,
+      created_at: row.created_at
+    }));
+    const body = config.format === "cef" ? events.map((event) => formatCefLine(event)).join(`
+`) : JSON.stringify({ events });
+    const response = await safeFetch(config.endpoint, {
+      method: "POST",
+      headers: {
+        "content-type": config.format === "cef" ? "text/plain" : "application/json",
+        ...process.env.SIEM_EXPORT_TOKEN ? { authorization: `Bearer ${process.env.SIEM_EXPORT_TOKEN}` } : {}
+      },
+      body
+    }, { allowHttp: appConfig.env !== "production" });
+    if (!response.ok) {
+      throw new Error(`SIEM export failed with status ${response.status}.`);
+    }
+    const ids = rows.map((row) => row.id);
+    for (const id of ids) {
+      await repositoryConnection`UPDATE audit_log SET exported_at = NOW() WHERE id = ${id}`;
+    }
+    return rows.length;
+  });
+}
+export {
+  resolveAuditExportConfig,
+  exportPendingAuditLogs
+};

package/dist/entries/events.js

@@ -0,0 +1 @@
+export * from "../index.js";

package/dist/entries/http/cookies.js

@@ -0,0 +1,32 @@
+// @bun
+// ../../src/core/http/cookies.ts
+function readRequestCookie(request, name) {
+  const cookies = request.cookies;
+  if (cookies && typeof cookies.get === "function") {
+    const value = cookies.get(name);
+    if (value) {
+      return value;
+    }
+  }
+  const header = request.headers.get("cookie");
+  if (!header) {
+    return null;
+  }
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx === -1)
+      continue;
+    const cookieName = part.slice(0, idx).trim();
+    if (cookieName !== name)
+      continue;
+    return decodeURIComponent(part.slice(idx + 1).trim());
+  }
+  return null;
+}
+function readBunRequestCookie(request, name) {
+  return request.cookies.get(name) ?? readRequestCookie(request, name);
+}
+export {
+  readRequestCookie,
+  readBunRequestCookie
+};

package/dist/entries/http/csrfProtection.js

@@ -0,0 +1,23 @@
+// @bun
+// ../../src/core/http/csrfProtection.ts
+var DEFAULT_CSRF_TTL_MS = 60 * 60 * 1000;
+function createCsrfProtection(secret, options = {}) {
+  const expiresIn = options.expiresIn ?? DEFAULT_CSRF_TTL_MS;
+  const maxAge = options.maxAge ?? expiresIn;
+  return {
+    generate(_sessionKey) {
+      return Bun.CSRF.generate(secret, { expiresIn });
+    },
+    verify(token, _sessionKey) {
+      if (!token) {
+        return false;
+      }
+      return Bun.CSRF.verify(token, { secret, maxAge });
+    },
+    secret
+  };
+}
+export {
+  createCsrfProtection,
+  DEFAULT_CSRF_TTL_MS
+};

package/dist/entries/http/csrfToken.js

@@ -26,6 +26,9 @@ function readRequestCookie(request, name) {
   }
   return null;
 }
+function readBunRequestCookie(request, name) {
+  return request.cookies.get(name) ?? readRequestCookie(request, name);
+}
 
 // ../../src/core/runtime/asyncContextStore.ts
 import { AsyncLocalStorage } from "async_hooks";

package/dist/entries/http/securedRouteModelBinding.js

@@ -0,0 +1,354 @@
+// @bun
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+
+// ../../src/core/auth/authContext.ts
+var authContext = createAsyncContextStore("@getstrata/authContext");
+function currentAuthUser() {
+  return authContext.getStore() ?? null;
+}
+
+// ../../src/core/errors/http.ts
+class HttpError extends Error {
+  status;
+  details;
+  constructor(status, message, details) {
+    super(message);
+    this.name = new.target.name;
+    this.status = status;
+    this.details = details;
+  }
+}
+
+class BadRequestError extends HttpError {
+  constructor(message = "Bad Request", details) {
+    super(400, message, details);
+  }
+}
+
+class NotFoundError extends HttpError {
+  constructor(message = "Not Found", details) {
+    super(404, message, details);
+  }
+}
+
+class ConflictError extends HttpError {
+  constructor(message = "Conflict", details) {
+    super(409, message, details);
+  }
+}
+
+class UnprocessableEntityError extends HttpError {
+  constructor(message = "Unprocessable Entity", details) {
+    super(422, message, details);
+  }
+}
+
+class ValidationError extends HttpError {
+  constructor(message = "Validation failed", details) {
+    super(422, message, details);
+  }
+}
+
+class ForbiddenError extends HttpError {
+  constructor(message = "Forbidden", details) {
+    super(403, message, details);
+  }
+}
+
+class UnauthorizedError extends HttpError {
+  constructor(message = "Unauthorized", details) {
+    super(401, message, details);
+  }
+}
+
+class PayloadTooLargeError extends HttpError {
+  constructor(message = "Payload Too Large", details) {
+    super(413, message, details);
+  }
+}
+
+class PreconditionFailedError extends HttpError {
+  constructor(message = "Precondition Failed", details) {
+    super(412, message, details);
+  }
+}
+
+// ../../src/core/contracts/di.ts
+var requiredDependencyKeys = [
+  "container",
+  "cache",
+  "storage"
+];
+function getRequiredDependency(dependencies, key) {
+  const dependency = dependencies[key];
+  if (dependency === undefined) {
+    throw new Error(`Required dependency "${key}" is not registered.`);
+  }
+  return dependency;
+}
+function assertAppDependenciesComplete(dependencies) {
+  for (const key of requiredDependencyKeys) {
+    getRequiredDependency(dependencies, key);
+  }
+}
+function resolveService(dependencies, token) {
+  return dependencies.container.resolve(token);
+}
+
+// ../../src/core/contracts/serviceTokens.ts
+var CORE_CONFIG_TOKEN = "core.config";
+var CORE_CACHE_TOKEN = "core.cache";
+var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_EVENT_BUS_TOKEN = "core.eventBus";
+var CORE_POLICY_GATE_TOKEN = "core.policyGate";
+var CORE_AUTH_TOKEN = "core.auth";
+var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
+
+// ../../src/core/logging/logger.ts
+class Logger {
+  channel;
+  constructor(channel = "app") {
+    this.channel = channel;
+  }
+  write(level, message, context = {}) {
+    const entry = {
+      level,
+      channel: this.channel,
+      message,
+      timestamp: new Date().toISOString(),
+      ...context
+    };
+    const line = JSON.stringify(entry);
+    if (level === "error") {
+      console.error(line);
+      return;
+    }
+    console.log(line);
+  }
+  debug(message, context) {
+    this.write("debug", message, context);
+  }
+  info(message, context) {
+    this.write("info", message, context);
+  }
+  warn(message, context) {
+    this.write("warn", message, context);
+  }
+  error(message, context) {
+    this.write("error", message, context);
+  }
+}
+var appLogger = new Logger("app");
+
+// ../../src/core/runtime/applicationRegistry.ts
+var APPLICATION_CONTEXT_KEY = Symbol.for("@getstrata/applicationContext");
+var activeContext;
+function readStoredApplicationContext() {
+  if (activeContext) {
+    return activeContext;
+  }
+  const globalContext = globalThis[APPLICATION_CONTEXT_KEY];
+  if (globalContext) {
+    activeContext = globalContext;
+  }
+  return activeContext;
+}
+function requireActiveApplicationContext() {
+  const context = readStoredApplicationContext();
+  if (!context) {
+    throw new Error("The application context has not been bootstrapped.");
+  }
+  return context;
+}
+function resolveApplicationAuth() {
+  return requireActiveApplicationContext().container.resolve(CORE_AUTH_TOKEN);
+}
+function resolveApplicationPolicyGate() {
+  return requireActiveApplicationContext().container.resolve(CORE_POLICY_GATE_TOKEN);
+}
+
+// ../../src/core/crypto/nonCryptographicHash.ts
+function nonCryptographicDigest(input) {
+  return Bun.hash(input).toString(16);
+}
+
+// ../../src/core/http/etag.ts
+function isEtagEnabled() {
+  return (process.env.FEATURE_ETAG ?? "true") !== "false";
+}
+function formatWeakEtag(digest) {
+  return `W/"${digest}"`;
+}
+function computeEtagFromJson(data) {
+  const digest = nonCryptographicDigest(JSON.stringify(data)).slice(0, 32);
+  return formatWeakEtag(digest);
+}
+function etagFromResource(resource) {
+  const version = resource.updated_at ?? resource.created_at ?? "";
+  const versionText = version instanceof Date ? version.toISOString() : version ? String(version) : "0";
+  const digest = nonCryptographicDigest(`${String(resource.id ?? "0")}:${versionText}`).slice(0, 32);
+  return formatWeakEtag(digest);
+}
+function normalizeEtag(value) {
+  return value.trim();
+}
+function etagValuesMatch(left, right) {
+  return normalizeEtag(left) === normalizeEtag(right);
+}
+function parseEtagList(header) {
+  if (!header) {
+    return [];
+  }
+  return header.split(",").map((value) => normalizeEtag(value)).filter(Boolean);
+}
+function ifNoneMatchSatisfied(request, etag) {
+  const header = request.headers.get("if-none-match");
+  if (!header) {
+    return false;
+  }
+  if (header.trim() === "*") {
+    return true;
+  }
+  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
+}
+function ifMatchSatisfied(request, etag) {
+  const header = request.headers.get("if-match");
+  if (!header) {
+    return false;
+  }
+  if (header.trim() === "*") {
+    return true;
+  }
+  return parseEtagList(header).some((candidate) => etagValuesMatch(candidate, etag));
+}
+function assertIfMatch(request, etag, options = {}) {
+  const header = request.headers.get("if-match");
+  if (!header) {
+    if (options.required) {
+      throw new PreconditionFailedError("If-Match header is required.");
+    }
+    return;
+  }
+  if (!ifMatchSatisfied(request, etag)) {
+    throw new PreconditionFailedError("Resource ETag does not match If-Match.");
+  }
+}
+function applyEtagHeaders(headers, etag) {
+  const next = new Headers(headers);
+  next.set("ETag", etag);
+  next.set("Cache-Control", "private, must-revalidate");
+  next.append("Vary", "Authorization");
+  next.append("Vary", "X-Tenant-Id");
+  return next;
+}
+function notModifiedResponse(etag) {
+  return new Response(null, {
+    status: 304,
+    headers: applyEtagHeaders(new Headers, etag)
+  });
+}
+function applyConditionalGet(request, response, etag) {
+  if (!isEtagEnabled()) {
+    return response;
+  }
+  if (ifNoneMatchSatisfied(request, etag)) {
+    return notModifiedResponse(etag);
+  }
+  const headers = applyEtagHeaders(new Headers(response.headers), etag);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+
+// ../../src/core/tenant/tenantContext.ts
+var tenantContext = createAsyncContextStore("@getstrata/tenantContext");
+function currentTenant() {
+  return tenantContext.getStore() ?? null;
+}
+function currentTenantId() {
+  return currentTenant()?.id ?? 1;
+}
+
+// ../../src/core/http/validation.ts
+async function parseJsonBody(request, validator) {
+  let payload;
+  try {
+    payload = await request.json();
+  } catch {
+    throw new BadRequestError("Request body must be valid JSON.");
+  }
+  return validator(payload);
+}
+function parsePositiveIntParam(value, name = "id") {
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new BadRequestError(`Invalid ${name}. Expected a positive integer.`);
+  }
+  return parsed;
+}
+
+// ../../src/core/http/securedRouteModelBinding.ts
+function isMutatingPolicyAction(action) {
+  return action === "update" || action === "delete";
+}
+function securedBindRouteModel(param, resolver, authorization, handler) {
+  return async (request) => {
+    const id = parsePositiveIntParam(String(request.params[param]), String(param));
+    const model = await resolver(id, request);
+    const gate = resolveApplicationPolicyGate();
+    const auth = resolveApplicationAuth();
+    const user = currentAuthUser() ?? await auth.resolve(request);
+    gate.authorize(authorization.resource, authorization.action, user, model);
+    if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
+      assertIfMatch(request, etagFromResource(model), {
+        required: authorization.requireIfMatch ?? true
+      });
+    }
+    const response = await handler(request, model);
+    if (isEtagEnabled() && authorization.action === "view") {
+      return applyConditionalGet(request, response, etagFromResource(model));
+    }
+    return response;
+  };
+}
+function securedBindRouteModelByKey(param, resolver, authorization, handler) {
+  return async (request) => {
+    const key = String(request.params[param] ?? "").trim();
+    if (!key) {
+      throw new BadRequestError(`Missing route parameter "${String(param)}".`);
+    }
+    const model = await resolver(key, request);
+    const gate = resolveApplicationPolicyGate();
+    const auth = resolveApplicationAuth();
+    const user = currentAuthUser() ?? await auth.resolve(request);
+    gate.authorize(authorization.resource, authorization.action, user, model);
+    if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
+      assertIfMatch(request, etagFromResource(model), {
+        required: authorization.requireIfMatch ?? true
+      });
+    }
+    const response = await handler(request, model);
+    if (isEtagEnabled() && authorization.action === "view") {
+      return applyConditionalGet(request, response, etagFromResource(model));
+    }
+    return response;
+  };
+}
+export {
+  securedBindRouteModelByKey,
+  securedBindRouteModel
+};

package/dist/entries/http/webErrorResponse.js

@@ -2569,6 +2569,9 @@ function readRequestCookie(request, name) {
   }
   return null;
 }
+function readBunRequestCookie(request, name) {
+  return request.cookies.get(name) ?? readRequestCookie(request, name);
+}
 
 // ../../src/core/http/csrfToken.ts
 var CSRF_COOKIE = "workhub_csrf";

package/dist/entries/http/webFormRequest.js

@@ -145,6 +145,13 @@ async function parseJsonBody(request, validator) {
   }
   return validator(payload);
 }
+function parsePositiveIntParam(value, name = "id") {
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new BadRequestError(`Invalid ${name}. Expected a positive integer.`);
+  }
+  return parsed;
+}
 
 // ../../src/core/http/webFormRequest.ts
 class WebFormRequest {

package/dist/entries/jobs/dispatchWebhookJob.js

@@ -93,6 +93,32 @@ var repositoryConnection = new Proxy(function repositoryConnection2() {}, {
   }
 });
 
+// ../../src/core/queue/index.ts
+class Job {
+  maxAttempts;
+  backoffMs;
+  priority;
+}
+
+class SyncQueue {
+  async dispatch(job, payload) {
+    await job.handle(payload);
+  }
+}
+
+class AsyncQueue {
+  async dispatch(job, payload) {
+    setTimeout(() => {
+      job.handle(payload).catch((error) => {
+        console.error("[AsyncQueue] Job failed:", error);
+      });
+    }, 0);
+  }
+}
+function createQueue(driver) {
+  return driver === "async" ? new AsyncQueue : new SyncQueue;
+}
+
 // ../../src/core/security/safeUrl.ts
 import { lookup as dnsLookupImpl } from "dns/promises";
 
@@ -256,3 +282,37 @@ function setDnsLookupForTests(lookupFn) {
 function resetDnsLookupForTests() {
   dnsLookup = dnsLookupImpl;
 }
+
+// ../../src/core/security/safeFetch.ts
+var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
+async function safeFetch(input, init = {}, options = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const maxRedirects = options.maxRedirects ?? 0;
+  const resolveDns = options.resolveDns ?? appConfig.env === "production";
+  const urlOptions = { allowHttp: options.allowHttp, resolveDns };
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    let currentUrl = (await assertSafeOutboundUrlResolved(input, urlOptions)).toString();
+    let redirectCount = 0;
+    while (true) {
+      const response = await fetch(currentUrl, {
+        ...init,
+        signal: controller.signal,
+        redirect: "manual"
+      });
+      if (response.status >= 300 && response.status < 400) {
+        const location = response.headers.get("location");
+        if (!location || redirectCount >= maxRedirects) {
+          return response;
+        }
+        currentUrl = (await assertSafeOutboundUrlResolved(new URL(location, currentUrl).toString(), urlOptions)).toString();
+        redirectCount += 1;
+        continue;
+      }
+      return response;
+    }
+  } finally {
+    clearTimeout(timeout);
+  }
+}

package/dist/entries/jobs/invalidateCacheTagsJob.js

@@ -0,0 +1,26 @@
+// @bun
+// ../../src/core/queue/index.ts
+class Job {
+  maxAttempts;
+  backoffMs;
+  priority;
+}
+
+class SyncQueue {
+  async dispatch(job, payload) {
+    await job.handle(payload);
+  }
+}
+
+class AsyncQueue {
+  async dispatch(job, payload) {
+    setTimeout(() => {
+      job.handle(payload).catch((error) => {
+        console.error("[AsyncQueue] Job failed:", error);
+      });
+    }, 0);
+  }
+}
+function createQueue(driver) {
+  return driver === "async" ? new AsyncQueue : new SyncQueue;
+}

package/dist/entries/logging/logger.js

@@ -0,0 +1,40 @@
+// @bun
+// ../../src/core/logging/logger.ts
+class Logger {
+  channel;
+  constructor(channel = "app") {
+    this.channel = channel;
+  }
+  write(level, message, context = {}) {
+    const entry = {
+      level,
+      channel: this.channel,
+      message,
+      timestamp: new Date().toISOString(),
+      ...context
+    };
+    const line = JSON.stringify(entry);
+    if (level === "error") {
+      console.error(line);
+      return;
+    }
+    console.log(line);
+  }
+  debug(message, context) {
+    this.write("debug", message, context);
+  }
+  info(message, context) {
+    this.write("info", message, context);
+  }
+  warn(message, context) {
+    this.write("warn", message, context);
+  }
+  error(message, context) {
+    this.write("error", message, context);
+  }
+}
+var appLogger = new Logger("app");
+export {
+  appLogger,
+  Logger
+};

package/dist/entries/queue.js

@@ -0,0 +1,32 @@
+// @bun
+// ../../src/core/queue/index.ts
+class Job {
+  maxAttempts;
+  backoffMs;
+  priority;
+}
+
+class SyncQueue {
+  async dispatch(job, payload) {
+    await job.handle(payload);
+  }
+}
+
+class AsyncQueue {
+  async dispatch(job, payload) {
+    setTimeout(() => {
+      job.handle(payload).catch((error) => {
+        console.error("[AsyncQueue] Job failed:", error);
+      });
+    }, 0);
+  }
+}
+function createQueue(driver) {
+  return driver === "async" ? new AsyncQueue : new SyncQueue;
+}
+export {
+  createQueue,
+  SyncQueue,
+  Job,
+  AsyncQueue
+};

package/dist/entries/view.js

@@ -2554,6 +2554,9 @@ function readRequestCookie(request, name) {
   }
   return null;
 }
+function readBunRequestCookie(request, name) {
+  return request.cookies.get(name) ?? readRequestCookie(request, name);
+}
 
 // ../../src/core/http/csrfToken.ts
 var CSRF_COOKIE = "workhub_csrf";

package/dist/framework/public-api.d.ts

@@ -48,7 +48,9 @@ export type { QueryJoin, QueryJoinOn, QueryOptions, QueryOrder, QuerySelectItem,
 export type { WhereNode } from "../core/database/whereBuilder.ts";
 export { WhereBuilder } from "../core/database/whereBuilder.ts";
 export { BadRequestError, ConflictError, ForbiddenError, NotFoundError, PreconditionFailedError, UnauthorizedError, UnprocessableEntityError, ValidationError, } from "../core/errors/http.ts";
-export { EventBus } from "../core/events/eventBus.ts";
+export type { EventListener } from "../core/events/eventBus.ts";
+export { EventBus, eventBus } from "../core/events/eventBus.ts";
+export { modelEventName } from "../core/events/index.ts";
 export { auth, cache, config, events, log, mail, policyGate, queue, storage, } from "../core/facades/index.ts";
 export { createBodySizeLimitMiddleware } from "../core/http/bodySizeLimitMiddleware.ts";
 export { conditionalJsonResponse } from "../core/http/conditionalResponse.ts";

package/dist/index.js

@@ -6770,6 +6770,7 @@ export {
   morphTo,
   morphOne,
   morphMany,
+  modelEventName,
   minLength,
   migrateDatabase,
   maxLength,
@@ -6812,6 +6813,7 @@ export {
   formatAdminValue,
   filterMassAssignable,
   events,
+  eventBus,
   etagFromResource,
   emptyPaginateResult,
   emailRule,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "0.5.34",
+  "version": "0.5.37",
   "description": "Strata — Laravel-inspired Bun framework public API",
   "type": "module",
   "license": "MIT",
@@ -85,6 +85,11 @@
       "import": "./dist/entries/auth/tokenHash.js",
       "default": "./dist/entries/auth/tokenHash.js"
     },
+    "./audit/exportAuditLogs": {
+      "types": "./dist/core/audit/exportAuditLogs.d.ts",
+      "import": "./dist/entries/audit/exportAuditLogs.js",
+      "default": "./dist/entries/audit/exportAuditLogs.js"
+    },
     "./cache/tags": {
       "types": "./dist/core/cache/tags.d.ts",
       "import": "./dist/entries/cache/tags.js",
@@ -150,6 +155,11 @@
       "import": "./dist/entries/errors/http.js",
       "default": "./dist/entries/errors/http.js"
     },
+    "./events": {
+      "types": "./dist/core/events/index.d.ts",
+      "import": "./dist/entries/events.js",
+      "default": "./dist/entries/events.js"
+    },
     "./http": {
       "types": "./dist/core/http/index.d.ts",
       "import": "./dist/entries/http.js",
@@ -160,6 +170,16 @@
       "import": "./dist/entries/http/bodySizeLimitMiddleware.js",
       "default": "./dist/entries/http/bodySizeLimitMiddleware.js"
     },
+    "./http/cookies": {
+      "types": "./dist/core/http/cookies.d.ts",
+      "import": "./dist/entries/http/cookies.js",
+      "default": "./dist/entries/http/cookies.js"
+    },
+    "./http/csrfProtection": {
+      "types": "./dist/core/http/csrfProtection.d.ts",
+      "import": "./dist/entries/http/csrfProtection.js",
+      "default": "./dist/entries/http/csrfProtection.js"
+    },
     "./http/contentNegotiation": {
       "types": "./dist/core/http/contentNegotiation.d.ts",
       "import": "./dist/entries/http/contentNegotiation.js",
@@ -195,6 +215,11 @@
       "import": "./dist/entries/http/resources.js",
       "default": "./dist/entries/http/resources.js"
     },
+    "./http/securedRouteModelBinding": {
+      "types": "./dist/core/http/securedRouteModelBinding.d.ts",
+      "import": "./dist/entries/http/securedRouteModelBinding.js",
+      "default": "./dist/entries/http/securedRouteModelBinding.js"
+    },
     "./http/requestMetaContext": {
       "types": "./dist/core/http/requestMetaContext.d.ts",
       "import": "./dist/entries/http/requestMetaContext.js",
@@ -215,11 +240,21 @@
       "import": "./dist/entries/jobs/dispatchWebhookJob.js",
       "default": "./dist/entries/jobs/dispatchWebhookJob.js"
     },
+    "./jobs/invalidateCacheTagsJob": {
+      "types": "./dist/core/jobs/invalidateCacheTagsJob.d.ts",
+      "import": "./dist/entries/jobs/invalidateCacheTagsJob.js",
+      "default": "./dist/entries/jobs/invalidateCacheTagsJob.js"
+    },
     "./lifecycle/gracefulShutdown": {
       "types": "./dist/core/lifecycle/gracefulShutdown.d.ts",
       "import": "./dist/entries/lifecycle/gracefulShutdown.js",
       "default": "./dist/entries/lifecycle/gracefulShutdown.js"
     },
+    "./logging/logger": {
+      "types": "./dist/core/logging/logger.d.ts",
+      "import": "./dist/entries/logging/logger.js",
+      "default": "./dist/entries/logging/logger.js"
+    },
     "./metrics/prometheus": {
       "types": "./dist/core/metrics/prometheus.d.ts",
       "import": "./dist/entries/metrics/prometheus.js",
@@ -235,6 +270,11 @@
       "import": "./dist/entries/pagination.js",
       "default": "./dist/entries/pagination.js"
     },
+    "./queue": {
+      "types": "./dist/core/queue/index.d.ts",
+      "import": "./dist/entries/queue.js",
+      "default": "./dist/entries/queue.js"
+    },
     "./queue/createAppQueue": {
       "types": "./dist/core/queue/createAppQueue.d.ts",
       "import": "./dist/entries/queue/createAppQueue.js",
@@ -357,7 +397,7 @@
     "build:bundle": "bun build index.ts --outdir dist --target bun --external bun --external eta",
     "build:types": "tsc -p tsconfig.types.json",
     "prepublishOnly": "bun run build && bun ../../scripts/prepare-core-package-publish.ts",
-    "build:subpaths": "bun build entries/auth/oauth/oidcProvider.ts entries/auth/oauth/providers.ts entries/auth/oauth/samlProvider.ts entries/auth/oauth/types.ts entries/auth/password.ts entries/auth/sessionCookie.ts entries/auth/tokenHash.ts entries/cache/tags.ts entries/cache/createCacheStore.ts entries/config/envSchema.ts entries/contracts/serviceTokens.ts entries/contracts/container.ts entries/contracts/di.ts entries/crypto/fieldEncryption.ts entries/crypto/mfaSecret.ts entries/database/factory.ts entries/database/seeders.ts entries/database/types.ts entries/errors/http.ts entries/http/bodySizeLimitMiddleware.ts entries/http/contentNegotiation.ts entries/http/csrfToken.ts entries/http/etag.ts entries/http/flashSession.ts entries/http/parseFormBody.ts entries/http/resources.ts entries/http/webErrorResponse.ts entries/http/webFormRequest.ts entries/jobs/dispatchWebhookJob.ts entries/lifecycle/gracefulShutdown.ts entries/metrics/prometheus.ts entries/openapi/registeredRoute.ts entries/pagination.ts entries/queue/createAppQueue.ts entries/queue/failedJobService.ts entries/queue/jobRunner.ts entries/queue/queueMetrics.ts entries/queue/publicQueue.ts entries/queue/types.ts entries/scheduler/schedule.ts entries/security/oauthState.ts entries/security/publicReads.ts entries/security/safeUrl.ts entries/security/stripeWebhook.ts entries/security/tokenExpiry.ts entries/security/totp.ts entries/storage/storage.ts entries/validation/rules.ts entries/view.ts --outdir dist --root . --target bun --external bun --external eta",
+    "build:subpaths": "bun build entries/auth/oauth/oidcProvider.ts entries/auth/oauth/providers.ts entries/auth/oauth/samlProvider.ts entries/auth/oauth/types.ts entries/auth/password.ts entries/auth/sessionCookie.ts entries/auth/tokenHash.ts entries/audit/exportAuditLogs.ts entries/cache/tags.ts entries/cache/createCacheStore.ts entries/config/envSchema.ts entries/contracts/serviceTokens.ts entries/contracts/container.ts entries/contracts/di.ts entries/crypto/fieldEncryption.ts entries/crypto/mfaSecret.ts entries/database/factory.ts entries/database/seeders.ts entries/database/types.ts entries/errors/http.ts entries/http/bodySizeLimitMiddleware.ts entries/http/cookies.ts entries/http/csrfProtection.ts entries/http/contentNegotiation.ts entries/http/csrfToken.ts entries/http/etag.ts entries/http/flashSession.ts entries/http/parseFormBody.ts entries/http/resources.ts entries/http/securedRouteModelBinding.ts entries/http/webErrorResponse.ts entries/http/webFormRequest.ts entries/jobs/dispatchWebhookJob.ts entries/jobs/invalidateCacheTagsJob.ts entries/lifecycle/gracefulShutdown.ts entries/logging/logger.ts entries/metrics/prometheus.ts entries/openapi/registeredRoute.ts entries/pagination.ts entries/queue.ts entries/queue/createAppQueue.ts entries/queue/failedJobService.ts entries/queue/jobRunner.ts entries/queue/queueMetrics.ts entries/queue/publicQueue.ts entries/queue/types.ts entries/scheduler/schedule.ts entries/security/oauthState.ts entries/security/publicReads.ts entries/security/safeUrl.ts entries/security/stripeWebhook.ts entries/security/tokenExpiry.ts entries/security/totp.ts entries/storage/storage.ts entries/validation/rules.ts entries/view.ts --outdir dist --root . --target bun --external bun --external eta",
     "build:shims": "bun ../../scripts/write-core-shared-shims.ts"
   },
   "publishConfig": {