@lastshotlabs/bunshot 0.0.27 → 0.0.28

package/dist/packages/bunshot-postgres/src/schema.js

@@ -0,0 +1,105 @@
+import { sql } from 'drizzle-orm';
+import { boolean, integer, jsonb, pgTable, primaryKey, text, timestamp } from 'drizzle-orm/pg-core';
+export const users = pgTable('bunshot_users', {
+    id: text('id').primaryKey(),
+    email: text('email').unique(),
+    passwordHash: text('password_hash'),
+    emailVerified: boolean('email_verified').default(false).notNull(),
+    suspended: boolean('suspended').default(false).notNull(),
+    suspendedReason: text('suspended_reason'),
+    suspendedAt: timestamp('suspended_at', { withTimezone: true }),
+    displayName: text('display_name'),
+    firstName: text('first_name'),
+    lastName: text('last_name'),
+    externalId: text('external_id'),
+    userMetadata: jsonb('user_metadata').$type(),
+    appMetadata: jsonb('app_metadata').$type(),
+    // Tier 3 — MFA (added in migration v2)
+    mfaSecret: text('mfa_secret'),
+    mfaEnabled: boolean('mfa_enabled').default(false).notNull(),
+    mfaMethods: text('mfa_methods')
+        .array()
+        .notNull()
+        .default(sql `ARRAY[]::text[]`),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
+});
+// Tier 3 — recovery codes are a separate table so consumeRecoveryCode can be
+// a single atomic DELETE ... RETURNING rather than a read-modify-write cycle.
+export const recoveryCodes = pgTable('bunshot_recovery_codes', {
+    userId: text('user_id')
+        .notNull()
+        .references(() => users.id, { onDelete: 'cascade' }),
+    codeHash: text('code_hash').notNull(),
+}, t => ({
+    pk: primaryKey({ columns: [t.userId, t.codeHash] }),
+}));
+// Tier 4 — WebAuthn credentials (added in migration v2)
+export const webauthnCredentials = pgTable('bunshot_webauthn_credentials', {
+    credentialId: text('credential_id').primaryKey(),
+    userId: text('user_id')
+        .notNull()
+        .references(() => users.id, { onDelete: 'cascade' }),
+    publicKey: text('public_key').notNull(),
+    signCount: integer('sign_count').default(0).notNull(),
+    transports: text('transports').array(), // nullable — not all authenticators report transports
+    name: text('name'),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+});
+export const oauthAccounts = pgTable('bunshot_oauth_accounts', {
+    userId: text('user_id')
+        .notNull()
+        .references(() => users.id, { onDelete: 'cascade' }),
+    provider: text('provider').notNull(),
+    providerUserId: text('provider_user_id').notNull(),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+}, t => ({
+    pk: primaryKey({ columns: [t.provider, t.providerUserId] }),
+}));
+export const userRoles = pgTable('bunshot_user_roles', {
+    userId: text('user_id')
+        .notNull()
+        .references(() => users.id, { onDelete: 'cascade' }),
+    role: text('role').notNull(),
+}, t => ({
+    pk: primaryKey({ columns: [t.userId, t.role] }),
+}));
+export const tenantRoles = pgTable('bunshot_tenant_roles', {
+    userId: text('user_id')
+        .notNull()
+        .references(() => users.id, { onDelete: 'cascade' }),
+    tenantId: text('tenant_id').notNull(),
+    role: text('role').notNull(),
+}, t => ({
+    pk: primaryKey({ columns: [t.userId, t.tenantId, t.role] }),
+}));
+// Tier 6 — Groups (added in migration v2)
+export const groups = pgTable('bunshot_groups', {
+    id: text('id').primaryKey(),
+    name: text('name').notNull(),
+    displayName: text('display_name'),
+    description: text('description'),
+    roles: text('roles')
+        .array()
+        .notNull()
+        .default(sql `ARRAY[]::text[]`),
+    tenantId: text('tenant_id'),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
+});
+export const groupMemberships = pgTable('bunshot_group_memberships', {
+    userId: text('user_id')
+        .notNull()
+        .references(() => users.id, { onDelete: 'cascade' }),
+    groupId: text('group_id')
+        .notNull()
+        .references(() => groups.id, { onDelete: 'cascade' }),
+    roles: text('roles')
+        .array()
+        .notNull()
+        .default(sql `ARRAY[]::text[]`),
+    tenantId: text('tenant_id'),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+}, t => ({
+    pk: primaryKey({ columns: [t.userId, t.groupId] }),
+}));

package/dist/src/app.d.ts

@@ -0,0 +1,230 @@
+import type { AuthCookieConfig, ConcealRegistrationConfig, CsrfCookieConfig, EmailVerificationConfig, JwtConfig, MagicLinkConfig, MfaConfig, MfaEmailOtpConfig, MfaWebAuthnConfig, OidcConfig, PasswordResetConfig, PrimaryField, RefreshTokenConfig, SamlConfig, ScimConfig, StepUpConfig } from '../packages/bunshot-auth/src/config/authConfig';
+import type { CaptchaConfig, CaptchaProvider } from './framework/lib/captcha';
+import type { LogLevel, RequestLogEntry } from './framework/middleware/requestLogger';
+import { MetricsConfig } from './framework/mountMiddleware';
+import { JobsConfig, UploadConfig } from './framework/mountOptionalEndpoints';
+import { VersioningConfig } from './framework/mountRoutes';
+import { ModelSchemasConfig } from './framework/preloadSchemas';
+import type { RegisteredSecretRepository, SecretStoreConfig } from './framework/secrets';
+import { OpenAPIHono } from '@hono/zod-openapi';
+import type { SigningConfig } from './lib/signingConfig';
+import type { MiddlewareHandler } from 'hono';
+import type { AuthConfig, OAuthConfig } from '../packages/bunshot-auth/src/index.js';
+import type { AppEnv, BunshotContext, BunshotEventBus, BunshotPlugin, CsrfConfig, ISecretRepository, StoreType, ValidationErrorFormatter } from '../packages/bunshot-core/src/index.js';
+export type { BreachedPasswordConfig } from '../packages/bunshot-auth/src/config/authConfig';
+export type { AuthRateLimitConfig } from '../packages/bunshot-auth/src/config/authConfig';
+export type { AuthConfig, OAuthConfig };
+export type { AccountDeletionConfig, AuthSessionPolicyConfig } from '../packages/bunshot-auth/src/config/authConfig';
+export type { PrimaryField, EmailVerificationConfig, PasswordResetConfig, RefreshTokenConfig, MfaConfig, MfaEmailOtpConfig, MfaWebAuthnConfig, SigningConfig, JwtConfig, StepUpConfig, OidcConfig, SamlConfig, ScimConfig, AuthCookieConfig, CsrfCookieConfig, ConcealRegistrationConfig, MagicLinkConfig, };
+export type { OrganizationConfig } from '../packages/bunshot-auth/src/lib/organization';
+export type { CaptchaConfig, CaptchaProvider };
+export type { CsrfConfig };
+export type { ModelSchemasConfig } from './framework/preloadSchemas';
+export type { JobsConfig } from './framework/mountOptionalEndpoints';
+export type { PresignedUrlConfig, UploadConfig } from './framework/mountOptionalEndpoints';
+export type { MetricsConfig } from './framework/mountMiddleware';
+export type { VersioningConfig } from './framework/mountRoutes';
+export interface DbConfig {
+    /**
+     * Absolute path to the SQLite database file.
+     * Required when any store is "sqlite".
+     * Example: import.meta.dir + "/../data.db"
+     */
+    sqlite?: string;
+    /**
+     * MongoDB auto-connect mode.
+     * - "single" (default): calls connectMongo() — auth and app share one server (MONGO_* env vars)
+     * - "separate": calls connectAuthMongo() + connectAppMongo() — auth on MONGO_AUTH_* server, app on MONGO_* server
+     * - false: skip auto-connect (call connectMongo / connectAuthMongo / connectAppMongo yourself)
+     */
+    mongo?: 'single' | 'separate' | false;
+    /**
+     * Auto-connect Redis before starting. Defaults to true.
+     * Set false to skip (e.g. when using sqlite or memory stores only).
+     */
+    redis?: boolean;
+    /**
+     * Where to store JWT sessions. Default: "redis".
+     * Sessions are stored on appConnection (not authConnection) so they are isolated per-app
+     * in "separate" mongo mode.
+     */
+    sessions?: StoreType;
+    /**
+     * Where to store OAuth state (PKCE code verifier, link user ID). Default: follows `sessions`.
+     */
+    oauthState?: StoreType;
+    /**
+     * Global default store for cacheResponse middleware. Default: "redis".
+     * Can be overridden per-route via cacheResponse({ store: "..." }).
+     */
+    cache?: StoreType;
+    /**
+     * Which built-in auth adapter to use for /auth/* routes.
+     * - "mongo" (default when mongo is enabled): Mongoose adapter (requires connectMongo)
+     * - "sqlite": bun:sqlite adapter (requires sqlite path)
+     * - "memory": in-memory Maps (ephemeral, great for tests)
+     * When `mongo: false`, defaults to the same store as `sessions`.
+     * Ignored when `auth.adapter` is explicitly passed in CreateAppConfig.
+     */
+    auth?: 'mongo' | 'sqlite' | 'memory';
+}
+export interface AppMeta {
+    /** App name shown in the root endpoint and OpenAPI docs title. Defaults to "Bun Core API" */
+    name?: string;
+    /** Version shown in OpenAPI docs. Defaults to "1.0.0" */
+    version?: string;
+}
+export interface BotProtectionConfig {
+    /**
+     * List of IPv4 CIDRs (e.g. "198.51.100.0/24"), IPv4 addresses, or IPv6 addresses to block outright.
+     * Matched requests receive a 403 before any other processing.
+     * Example: ["198.51.100.0/24", "203.0.113.42"]
+     */
+    blockList?: string[];
+    /**
+     * Also rate-limit by HTTP fingerprint (User-Agent, Accept-*, Connection, browser header presence)
+     * in addition to IP. Bots that rotate IPs but use the same HTTP client share a bucket.
+     * Uses the same store as auth rate limiting (Redis or memory).
+     * Default: false
+     */
+    fingerprintRateLimit?: boolean;
+}
+export interface SecurityConfig {
+    /** CORS origins. Defaults to "*" */
+    cors?: string | string[];
+    /** Additional security headers to set via Hono's secureHeaders middleware.
+     *  Pass a Content-Security-Policy, Permissions-Policy, etc. */
+    headers?: {
+        contentSecurityPolicy?: string;
+        permissionsPolicy?: string;
+    };
+    /** Global rate limit. Defaults to 100 req / 60s */
+    rateLimit?: {
+        windowMs: number;
+        max: number;
+    };
+    /**
+     * Bot protection: CIDR blocklist and fingerprint-based rate limiting.
+     * Runs before IP rate limiting so blocked IPs are rejected immediately.
+     */
+    botProtection?: BotProtectionConfig;
+    /**
+     * Trusted proxy configuration for IP extraction.
+     * - `false` (default): use socket-level IP only, ignore X-Forwarded-For entirely.
+     * - A number N: trust N proxy hops — take the Nth-from-right IP in the X-Forwarded-For chain.
+     */
+    trustProxy?: false | number;
+    /**
+     * Unified HMAC signing for cookies, cursors, presigned URLs, request signing,
+     * idempotency key hashing, and session binding. All features are opt-in.
+     */
+    signing?: SigningConfig;
+    /**
+     * Global CAPTCHA configuration. When set, use requireCaptcha() middleware on specific routes,
+     * or enable adaptive mode to auto-require CAPTCHA after rate limit thresholds.
+     */
+    captcha?: CaptchaConfig;
+}
+export interface TenantConfig {
+    [key: string]: unknown;
+}
+export interface TenancyConfig {
+    /** How tenant is identified. */
+    resolution: 'header' | 'subdomain' | 'path';
+    /** Header name when resolution is "header". Default: "x-tenant-id". */
+    headerName?: string;
+    /** Path segment index when resolution is "path". Default: 0. */
+    pathSegment?: number;
+    /** Callback to validate/load tenant. Return null to reject. */
+    onResolve?: (tenantId: string) => Promise<TenantConfig | null>;
+    /** TTL in ms for caching onResolve results (LRU cache). Default: 60_000. Set 0 to disable. */
+    cacheTtlMs?: number;
+    /** Max entries in tenant resolution cache. Default: 500. */
+    cacheMaxSize?: number;
+    /** Paths that skip tenant resolution. Uses startsWith matching. Default: ["/health", "/docs", "/openapi.json"]. */
+    exemptPaths?: string[];
+    /** HTTP status when onResolve returns null. Default: 403. */
+    rejectionStatus?: 403 | 404;
+}
+export interface LoggingConfig {
+    /** Enable structured request logging. Default: true. When false, no logger is registered at all. */
+    enabled?: boolean;
+    /** Custom log handler. Default: `console.log(JSON.stringify(entry))`. */
+    onLog?: (entry: RequestLogEntry) => void | Promise<void>;
+    /** Minimum log level to emit. Entries below this level are dropped. */
+    level?: LogLevel;
+    /**
+     * Paths to exclude from logging. Strings use **prefix matching**.
+     * Default: `["/health", "/docs", "/openapi.json"]`.
+     */
+    excludePaths?: (string | RegExp)[];
+    /** HTTP methods to exclude from logging (e.g. `["OPTIONS"]`). */
+    excludeMethods?: string[];
+}
+export interface ValidationConfig {
+    /** Custom formatter for Zod validation errors. Receives issues + requestId, returns the JSON body. */
+    formatError?: ValidationErrorFormatter;
+}
+export interface CreateAppConfig {
+    /** Absolute path to the service's routes directory (use import.meta.dir + "/routes") */
+    routesDir: string;
+    /**
+     * Shared Zod schema sources. Files are imported before route discovery so schemas
+     * are registered before any route references them.
+     * Accepts a directory path, an array of paths/globs, or a full ModelSchemasConfig object.
+     * Shorthand string/array defaults to registration: "auto".
+     */
+    modelSchemas?: string | string[] | ModelSchemasConfig;
+    /** App name and version for the root endpoint and OpenAPI docs */
+    app?: AppMeta;
+    /** Security: CORS, rate limiting, trust-proxy, signing, captcha */
+    security?: SecurityConfig;
+    /** Extra middleware injected after plugin middleware, before route matching */
+    middleware?: MiddlewareHandler<AppEnv>[];
+    /** Database connection and store routing configuration */
+    db?: DbConfig;
+    /** Job status endpoint configuration. Requires BullMQ + Redis. */
+    jobs?: JobsConfig;
+    /** Multi-tenancy configuration. When set, tenant middleware resolves tenant on each request. */
+    tenancy?: TenancyConfig;
+    /** Structured request logging configuration. Replaces Hono's built-in text logger. */
+    logging?: LoggingConfig;
+    /** Prometheus-compatible /metrics endpoint. Opt-in. */
+    metrics?: MetricsConfig;
+    /** Zod validation error formatting configuration. */
+    validation?: ValidationConfig;
+    /** File upload configuration. When set, registers storage adapter and upload settings. */
+    upload?: UploadConfig;
+    /**
+     * API versioning configuration. When set, routes are discovered per-version from
+     * subdirectories of `routesDir` (e.g. `routes/v1/`, `routes/v2/`). Each version
+     * gets its own OpenAPI spec at `/{version}/openapi.json` and Scalar docs at
+     * `/{version}/docs`. Root `/docs` becomes a version selector.
+     */
+    versioning?: VersioningConfig | string[];
+    /**
+     * Optional plugins to mount alongside the framework. Each plugin's setup() is called
+     * after all framework middleware is registered, in dependency order.
+     */
+    plugins?: BunshotPlugin[];
+    /**
+     * Event bus for cross-plugin communication. Defaults to an in-process EventEmitter adapter.
+     */
+    eventBus?: BunshotEventBus;
+    /**
+     * Secret provider for resolving credentials, API keys, and signing secrets.
+     *
+     * - Omit or pass nothing: defaults to env provider (reads process.env / .env)
+     * - Pass an ISecretRepository instance directly for full control
+     * - Pass a config object to let the framework create the repository:
+     *   - `{ provider: 'env', prefix?: string }` — environment variables
+     *   - `{ provider: 'ssm', pathPrefix: string, region?: string }` — AWS SSM Parameter Store
+     *   - `{ provider: 'file', directory: string }` — file-based (Docker/K8s secrets)
+     */
+    secrets?: ISecretRepository | SecretStoreConfig | RegisteredSecretRepository;
+}
+export interface CreateAppResult {
+    app: OpenAPIHono<AppEnv>;
+    ctx: BunshotContext;
+}
+export declare const createApp: (config: CreateAppConfig) => Promise<CreateAppResult>;

package/dist/src/app.js

@@ -0,0 +1,182 @@
+import { buildContext, finalizeContext } from './framework/buildContext';
+import { validateAppConfig } from './framework/config/schema';
+import { createInfrastructure } from './framework/createInfrastructure';
+import { createMetricsState } from './framework/lib/metrics';
+import { mountFrameworkMiddleware, mountTenantMiddleware, } from './framework/mountMiddleware';
+import { mountOptionalEndpoints, } from './framework/mountOptionalEndpoints';
+import { mountRoutes } from './framework/mountRoutes';
+import { preloadModelSchemas } from './framework/preloadSchemas';
+import { registerBoundaryAdapters } from './framework/registerBoundaryAdapters';
+import { runPluginMiddleware, runPluginPost, runPluginRoutes, validateAndSortPlugins, } from './framework/runPluginLifecycle';
+import { resolveSecretBundle } from './framework/secrets';
+import { OpenAPIHono } from '@hono/zod-openapi';
+import { HttpError, ValidationError, attachContext, createCoreRegistrar, defaultValidationErrorFormatter, getContext, } from '../packages/bunshot-core/src/index.js';
+import { createInProcessAdapter } from '../packages/bunshot-core/src/index.js';
+// ---------------------------------------------------------------------------
+// Phase 1: validate config, resolve secrets, connect infrastructure
+// ---------------------------------------------------------------------------
+async function prepareBootstrap(config) {
+    const { warnings } = validateAppConfig(config);
+    for (const w of warnings)
+        console.warn(w);
+    const { app: appConfig = {}, security: securityInput = {}, db = {} } = config;
+    const securityConfig = {
+        ...securityInput,
+        signing: securityInput.signing ? { ...securityInput.signing } : undefined,
+    };
+    const plugins = config.plugins ?? [];
+    const bus = config.eventBus ?? createInProcessAdapter();
+    const { registrar, drain } = createCoreRegistrar();
+    const sortedPlugins = validateAndSortPlugins(plugins);
+    const appName = appConfig.name ?? 'Bun Core API';
+    const openApiVersion = appConfig.version ?? '1.0.0';
+    const secretBundle = await resolveSecretBundle(config.secrets);
+    const resolvedSecrets = secretBundle.framework;
+    if (resolvedSecrets.jwtSecret && !securityConfig.signing?.secret) {
+        securityConfig.signing = { ...securityConfig.signing, secret: resolvedSecrets.jwtSecret };
+    }
+    const infra = await createInfrastructure({
+        db,
+        securitySigning: securityConfig.signing,
+        cors: securityConfig.cors,
+        captcha: securityConfig.captcha,
+        trustProxy: securityConfig.trustProxy,
+        registrar,
+        secrets: resolvedSecrets,
+        uploadRegistryTtlSeconds: config.upload?.registryTtlSeconds,
+    });
+    return {
+        bus,
+        registrar,
+        drain,
+        sortedPlugins,
+        appName,
+        openApiVersion,
+        securityConfig,
+        secretBundle,
+        infra,
+    };
+}
+// ---------------------------------------------------------------------------
+// Phase 2: create Hono app + context, mount framework and plugin middleware
+// ---------------------------------------------------------------------------
+async function assembleApp(bootstrap, config) {
+    const { bus, registrar, sortedPlugins, appName, securityConfig, secretBundle, infra } = bootstrap;
+    const { middleware = [] } = config;
+    const app = new OpenAPIHono();
+    const metricsState = createMetricsState();
+    const tenantCacheCarrier = {
+        cache: null,
+    };
+    const ctx = buildContext({
+        app,
+        appName,
+        infra,
+        signing: securityConfig.signing,
+        captcha: securityConfig.captcha,
+        upload: config.upload,
+        metricsState,
+        plugins: bootstrap.sortedPlugins,
+        bus,
+        secretBundle,
+    });
+    attachContext(app, ctx);
+    // Context middleware — registered first so all downstream handlers can access the context.
+    app.use(async (c, next) => {
+        c.set('bunshotCtx', getContext(app));
+        await next();
+    });
+    await mountFrameworkMiddleware(app, {
+        security: securityConfig,
+        logging: config.logging,
+        metrics: config.metrics,
+        metricsState,
+        validation: config.validation,
+    });
+    // Register default boundary adapters (plugins may override during setupMiddleware)
+    await registerBoundaryAdapters(registrar, {
+        redisEnabled: infra.redisEnabled,
+        mongoMode: infra.mongoMode,
+        redis: infra.redis,
+        appConnection: infra.mongo?.app ?? null,
+        sqliteDb: infra.sqliteDb,
+    });
+    // Plugin middleware phase — after framework rate limiting, before tenant + user middleware.
+    await runPluginMiddleware(sortedPlugins, app, infra.frameworkConfig, bus);
+    if (config.tenancy) {
+        await mountTenantMiddleware(app, config.tenancy, tenantCacheCarrier);
+    }
+    for (const mw of middleware)
+        app.use(mw);
+    return { ...bootstrap, app, ctx, tenantCacheCarrier };
+}
+// ---------------------------------------------------------------------------
+// Phase 3: preload schemas, mount plugin + core + service routes, error handlers
+// ---------------------------------------------------------------------------
+async function mountAppRoutes(assembly, config) {
+    const { app, sortedPlugins, appName, openApiVersion, secretBundle, infra, bus } = assembly;
+    // Schema pre-loading before routes so registerSchema calls run first ($ref not inline).
+    await preloadModelSchemas(config.modelSchemas);
+    // Plugin routes — after tenant/user middleware, before framework routes.
+    await runPluginRoutes(sortedPlugins, app, infra.frameworkConfig, bus);
+    // Core framework routes (health, metrics, uploads, etc.)
+    const coreRoutesDir = import.meta.dir + '/framework/routes';
+    const coreGlob = new Bun.Glob('*.ts');
+    for await (const file of coreGlob.scan({ cwd: coreRoutesDir })) {
+        if (file === 'jobs.ts')
+            continue; // mounted separately below
+        const mod = await import(`${coreRoutesDir}/${file}`);
+        if (mod.router)
+            app.route('/', mod.router);
+    }
+    await mountOptionalEndpoints(app, coreRoutesDir, config.jobs, config.metrics, config.upload, assembly.ctx.metrics, secretBundle.framework);
+    await mountRoutes(app, config.routesDir, config.versioning, appName, openApiVersion);
+    app.onError((err, c) => {
+        const reqId = c.get('requestId') ?? 'unknown';
+        // ValidationError extends HttpError — must check first or the details payload is lost
+        if (err instanceof ValidationError) {
+            const fmt = c.get('validationErrorFormatter') ?? defaultValidationErrorFormatter;
+            try {
+                return c.json(fmt(err.issues, reqId), 400);
+            }
+            catch {
+                return c.json(defaultValidationErrorFormatter(err.issues, reqId), 400);
+            }
+        }
+        if (err instanceof HttpError) {
+            const body = { error: err.message, requestId: reqId };
+            if (err.code !== undefined)
+                body.code = err.code;
+            return c.json(body, err.status);
+        }
+        console.error(err);
+        return c.json({ error: 'Internal Server Error', requestId: reqId }, 500);
+    });
+    app.notFound(c => c.json({ error: 'Not Found', requestId: c.get('requestId') ?? 'unknown' }, 404));
+    app.get('/sw.js', c => c.body('', 200, { 'Content-Type': 'application/javascript' }));
+}
+// ---------------------------------------------------------------------------
+// Phase 4: plugin post phase, drain registrar into context, emit ready
+// NOT for routes/middleware — would be invisible to OpenAPI / unreachable by onError.
+// ---------------------------------------------------------------------------
+async function finalizeApp(assembly) {
+    const { app, ctx, sortedPlugins, bus, drain, tenantCacheCarrier, infra } = assembly;
+    await runPluginPost(sortedPlugins, app, infra.frameworkConfig, bus);
+    if (sortedPlugins.length > 0) {
+        bus.emit('app:ready', { plugins: sortedPlugins.map(p => p.name) });
+    }
+    finalizeContext(ctx, drain());
+    if (tenantCacheCarrier.cache) {
+        ctx.pluginState.set('tenantResolutionCache', tenantCacheCarrier.cache);
+    }
+    return { app, ctx };
+}
+// ---------------------------------------------------------------------------
+// Public entry point
+// ---------------------------------------------------------------------------
+export const createApp = async (config) => {
+    const bootstrap = await prepareBootstrap(config);
+    const assembly = await assembleApp(bootstrap, config);
+    await mountAppRoutes(assembly, config);
+    return finalizeApp(assembly);
+};

package/dist/src/cli/commands/init.d.ts

@@ -0,0 +1,10 @@
+import { Command } from '@oclif/core';
+export default class Init extends Command {
+    static description: string;
+    static examples: string[];
+    static args: {
+        name: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+        dir: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    run(): Promise<void>;
+}