@getstrata/core 0.5.100 → 0.7.3

package/dist/core/database/relationQuery.d.ts

@@ -1,5 +1,5 @@
 import type BaseRepository from "./baseRepository.ts";
-import type { BelongsToManyRelation, BelongsToRelation, HasManyRelation, HasOneRelation, MorphManyRelation, MorphOneRelation, MorphToRelation } from "./relationships.ts";
+import type { BelongsToManyRelation, BelongsToRelation, HasManyRelation, HasManyThroughRelation, HasOneRelation, MorphManyRelation, MorphOneRelation, MorphToRelation } from "./relationships.ts";
 import type { RepositoryQuery } from "./repositoryQuery.ts";
 import type { QueryOptions, QueryWhere } from "./types.ts";
 type RelatedRecord = {
@@ -17,7 +17,7 @@ interface RelationHost<TEntity extends object, PrimaryKey extends keyof TEntity
     get<K extends keyof TEntity>(key: K): TEntity[K];
     getRepository(): BaseRepository<TEntity, PrimaryKey>;
 }
-type RelationKind = "hasMany" | "hasOne" | "belongsTo" | "belongsToMany" | "morphMany" | "morphOne" | "morphTo";
+type RelationKind = "hasMany" | "hasOne" | "belongsTo" | "belongsToMany" | "hasManyThrough" | "morphMany" | "morphOne" | "morphTo";
 type ExistsClause = {
     sql: string;
     params: unknown[];
@@ -159,6 +159,25 @@ declare class MorphToRelationQuery<TChild extends object, ChildKey extends keyof
     get(): Promise<RelatedRecord | null>;
     then(onfulfilled?: ((value: RelatedRecord | null) => unknown) | null, onrejected?: ((reason: unknown) => unknown) | null): Promise<unknown>;
 }
+declare class HasManyThroughRelationQuery<TParent extends object, ParentKey extends keyof TParent & string, TFar extends object, FarKey extends keyof TFar & string> {
+    private readonly parent;
+    private readonly related;
+    readonly relation: HasManyThroughRelation<TParent, TFar, ParentKey, string, string, keyof TFar & string>;
+    readonly kind: RelationKind;
+    private extraWhere;
+    private extraOptions;
+    constructor(parent: RelationHost<TParent, ParentKey>, related: RelatedModelClass<TFar, FarKey>, relation: HasManyThroughRelation<TParent, TFar, ParentKey, string, string, keyof TFar & string>);
+    where(where: QueryWhere<TFar>): this;
+    orderBy(orderBy: QueryOptions<TFar>["orderBy"]): this;
+    limit(limit: number): this;
+    applyEagerLoad(query: RepositoryQuery<TParent, ParentKey>, alias: string): void;
+    hydrateEager(row: Record<string, unknown>, alias: string): unknown;
+    toExistsClause(parentTable: string): ExistsClause;
+    get(): Promise<RelatedRecord[]>;
+    first(): Promise<RelatedRecord | null>;
+    count(): Promise<number>;
+    then(onfulfilled?: ((value: RelatedRecord[]) => unknown) | null, onrejected?: ((reason: unknown) => unknown) | null): Promise<unknown>;
+}
 type AnyRelationQuery = {
     kind: RelationKind;
     applyEagerLoad(query: unknown, alias: string): void;
@@ -169,4 +188,4 @@ type AnyRelationQuery = {
     then?: (onfulfilled?: ((value: unknown) => unknown) | null, onrejected?: ((reason: unknown) => unknown) | null) => Promise<unknown>;
 };
 export type { AnyRelationQuery, RelatedModelClass, RelatedRecord, RelationHost };
-export { BelongsToManyRelationQuery, BelongsToRelationQuery, HasManyRelationQuery, HasOneRelationQuery, MorphManyRelationQuery, MorphOneRelationQuery, MorphToRelationQuery, };
+export { BelongsToManyRelationQuery, BelongsToRelationQuery, HasManyRelationQuery, HasManyThroughRelationQuery, HasOneRelationQuery, MorphManyRelationQuery, MorphOneRelationQuery, MorphToRelationQuery, };

package/dist/core/database/relationships.d.ts

@@ -25,6 +25,16 @@ interface BelongsToManyRelation<TParent, TRelated, Pivot extends object, ParentK
     foreignPivotKey: ForeignPivotKey;
     relatedPivotKey: RelatedPivotKey;
 }
+interface HasManyThroughRelation<TParent, TFar, LocalKey extends keyof TParent & string = keyof TParent & string, FirstKey extends string = string, SecondLocalKey extends string = string, SecondKey extends keyof TFar & string = keyof TFar & string> {
+    type: "hasManyThrough";
+    name: string;
+    throughTable: string;
+    localKey: LocalKey;
+    firstKey: FirstKey;
+    secondLocalKey: SecondLocalKey;
+    secondKey: SecondKey;
+    throughParentKey?: string;
+}
 declare function hasMany<TParent, TChild, LocalKey extends keyof TParent & string = keyof TParent & string, ForeignKey extends keyof TChild & string = keyof TChild & string>(definition: {
     name: string;
     localKey: LocalKey;
@@ -40,6 +50,15 @@ declare function belongsTo<TChild, TParent, ForeignKey extends keyof TChild & st
     foreignKey: ForeignKey;
     ownerKey: OwnerKey;
 }): BelongsToRelation<TChild, TParent, ForeignKey, OwnerKey>;
+declare function hasManyThrough<TParent, TFar, LocalKey extends keyof TParent & string = keyof TParent & string, FirstKey extends string = string, SecondLocalKey extends string = string, SecondKey extends keyof TFar & string = keyof TFar & string>(definition: {
+    name: string;
+    throughTable: string;
+    localKey: LocalKey;
+    firstKey: FirstKey;
+    secondLocalKey: SecondLocalKey;
+    secondKey: SecondKey;
+    throughParentKey?: string;
+}): HasManyThroughRelation<TParent, TFar, LocalKey, FirstKey, SecondLocalKey, SecondKey>;
 declare function belongsToMany<TParent, TRelated, Pivot extends object, ParentKey extends keyof TParent & string = keyof TParent & string, RelatedKey extends keyof TRelated & string = keyof TRelated & string, ForeignPivotKey extends keyof Pivot & string = keyof Pivot & string, RelatedPivotKey extends keyof Pivot & string = keyof Pivot & string>(definition: {
     name: string;
     pivotTable: string;
@@ -97,6 +116,7 @@ declare function morphTo<TChild, MorphTypeKey extends keyof TChild & string = ke
 }): MorphToRelation<TChild, MorphTypeKey, MorphIdKey>;
 declare function indexMorphManyRelation<TParent, TChild, LocalKey extends keyof TParent & string, MorphTypeKey extends keyof TChild & string, MorphIdKey extends keyof TChild & string>(parents: readonly TParent[], children: readonly TChild[], relation: MorphManyRelation<TParent, TChild, LocalKey, MorphTypeKey, MorphIdKey>): Map<TParent[LocalKey], TChild[]>;
 declare function indexMorphOneRelation<TParent, TChild, LocalKey extends keyof TParent & string, MorphTypeKey extends keyof TChild & string, MorphIdKey extends keyof TChild & string>(parents: readonly TParent[], children: readonly TChild[], relation: MorphOneRelation<TParent, TChild, LocalKey, MorphTypeKey, MorphIdKey>): Map<TParent[LocalKey], TChild | undefined>;
+declare function indexHasManyThroughRelation<TParent, TFar, LocalKey extends keyof TParent & string, FirstKey extends string, SecondLocalKey extends string, SecondKey extends keyof TFar & string>(parents: readonly TParent[], children: readonly (TFar & Record<string, unknown>)[], relation: HasManyThroughRelation<TParent, TFar, LocalKey, FirstKey, SecondLocalKey, SecondKey>): Map<TParent[LocalKey], TFar[]>;
 declare function indexMorphToRelation<TChild, TParent extends object, MorphTypeKey extends keyof TChild & string, MorphIdKey extends keyof TChild & string, _OwnerKey extends keyof TParent & string = keyof TParent & string>(children: readonly TChild[], parentsByType: ReadonlyMap<string, ReadonlyMap<unknown, TParent>>, relation: MorphToRelation<TChild, MorphTypeKey, MorphIdKey>): Map<TChild[MorphIdKey], TParent>;
-export type { BelongsToManyRelation, BelongsToRelation, HasManyRelation, HasOneRelation, MorphManyRelation, MorphOneRelation, MorphToRelation, };
-export { belongsTo, belongsToMany, getByRelationKey, hasMany, hasOne, indexBelongsToManyRelation, indexBelongsToRelation, indexHasManyRelation, indexHasOneRelation, indexMorphManyRelation, indexMorphOneRelation, indexMorphToRelation, morphMany, morphOne, morphTo, relationMatchKey, };
+export type { BelongsToManyRelation, BelongsToRelation, HasManyRelation, HasManyThroughRelation, HasOneRelation, MorphManyRelation, MorphOneRelation, MorphToRelation, };
+export { belongsTo, belongsToMany, getByRelationKey, hasMany, hasManyThrough, hasOne, indexBelongsToManyRelation, indexBelongsToRelation, indexHasManyRelation, indexHasManyThroughRelation, indexHasOneRelation, indexMorphManyRelation, indexMorphOneRelation, indexMorphToRelation, morphMany, morphOne, morphTo, relationMatchKey, };

package/dist/core/database/repositoryQuery.d.ts

@@ -1,6 +1,6 @@
 import type { PaginatedResult } from "../pagination/index.ts";
 import type BaseRepository from "./baseRepository.ts";
-import type { BelongsToManyRelation, BelongsToRelation, HasManyRelation, MorphManyRelation, MorphOneRelation, MorphToRelation } from "./relationships.ts";
+import type { BelongsToManyRelation, BelongsToRelation, HasManyRelation, HasManyThroughRelation, MorphManyRelation, MorphOneRelation, MorphToRelation } from "./relationships.ts";
 import type { QueryOptions, QueryWhere } from "./types.ts";
 import { WhereBuilder } from "./whereBuilder.ts";
 type LoadedRow = Record<string, unknown>;
@@ -31,6 +31,9 @@ declare class RepositoryQuery<TEntity extends object, PrimaryKey extends keyof T
     withMorphOne<TChild extends object, LocalKey extends keyof TEntity & string, MorphTypeKey extends keyof TChild & string, MorphIdKey extends keyof TChild & string, Alias extends string>(as: Alias, relation: MorphOneRelation<TEntity, TChild, LocalKey, MorphTypeKey, MorphIdKey>, childRepository: BaseRepository<TChild, keyof TChild & string>, options?: Omit<QueryOptions<TChild>, "where">): this;
     withMorphTo<TParent extends object, MorphTypeKey extends keyof TEntity & string, MorphIdKey extends keyof TEntity & string, Alias extends string>(as: Alias, relation: MorphToRelation<TEntity, MorphTypeKey, MorphIdKey>, repositoriesByType: ReadonlyMap<string, BaseRepository<TParent, keyof TParent & string>>, options?: Omit<QueryOptions<TParent>, "where">): this;
     withBelongsToMany<TRelated extends object, Pivot extends object, ParentKey extends keyof TEntity & string, RelatedKey extends keyof TRelated & string, ForeignPivotKey extends keyof Pivot & string, RelatedPivotKey extends keyof Pivot & string, Alias extends string>(as: Alias, relation: BelongsToManyRelation<TEntity, TRelated, Pivot, ParentKey, RelatedKey, ForeignPivotKey, RelatedPivotKey>, relatedRepository: BaseRepository<TRelated, RelatedKey>, options?: Omit<QueryOptions<TRelated>, "where">): this;
+    withHasManyThrough<TFar extends object, LocalKey extends keyof TEntity & string, SecondKey extends keyof TFar & string, Alias extends string>(as: Alias, relation: HasManyThroughRelation<TEntity, TFar, LocalKey, string, string, SecondKey>, farRepository: BaseRepository<TFar, keyof TFar & string>, options?: Omit<QueryOptions<TFar>, "where">): this;
+    withTrashed(): this;
+    onlyTrashed(): this;
     get(): Promise<Array<TEntity & LoadedRow>>;
     first(): Promise<(TEntity & LoadedRow) | null>;
     count(): Promise<number>;
@@ -42,5 +45,6 @@ declare class RepositoryQuery<TEntity extends object, PrimaryKey extends keyof T
     private buildOptions;
     private addJoin;
     private attach;
+    private hydrateEagerLoad;
 }
 export { RepositoryQuery };

package/dist/core/database/sqliteConnection.d.ts

@@ -0,0 +1,7 @@
+import type { ActiveDatabaseHandle } from "./connectionContext.ts";
+type SqliteConnection = ActiveDatabaseHandle & {
+    close(): void;
+};
+declare function createSqliteConnection(filename: string): SqliteConnection;
+export type { SqliteConnection };
+export { createSqliteConnection };

package/dist/core/http/loginThrottleMiddleware.d.ts

@@ -1,11 +1,14 @@
 import type { Middleware } from "./middleware";
 interface LoginThrottleOptions {
-    redisUrl: string;
+    redisUrl?: string;
     maxAttempts: number;
     decaySeconds: number;
     keyPrefix?: string;
 }
 declare function resolveLoginIdentity(request: Request): string;
+declare function resolveLoginEmail(request: Request): Promise<string>;
+declare function createMemoryLoginThrottleMiddleware(options: LoginThrottleOptions): Middleware;
 declare function createLoginThrottleMiddleware(options: LoginThrottleOptions): Middleware;
+declare function resetMemoryLoginThrottleForTests(): void;
 export type { LoginThrottleOptions };
-export { createLoginThrottleMiddleware, resolveLoginIdentity };
+export { createLoginThrottleMiddleware, createMemoryLoginThrottleMiddleware, resetMemoryLoginThrottleForTests, resolveLoginEmail, resolveLoginIdentity, };

package/dist/core/http/resources.d.ts

@@ -1,7 +1,7 @@
 declare function serializeDate(value: Date | string): string;
 declare function whenLoaded<T>(model: {
     loaded: (name: string) => unknown;
-}, relation: string, transform?: (value: unknown) => T): T | undefined;
+}, relation: string, transform?: (value: unknown) => T): T | undefined | null;
 declare class JsonResource<T = unknown> {
     protected readonly resource: T;
     static wrap: string | null;
@@ -11,7 +11,7 @@ declare class JsonResource<T = unknown> {
     static collection<TResource>(items: readonly TResource[]): ResourceCollection<TResource>;
     additional(data: Record<string, unknown>): this;
     when<TValue>(condition: boolean, value: TValue): TValue | undefined;
-    whenLoaded<TValue = unknown>(relation: string, transform?: (value: unknown) => TValue): TValue | undefined;
+    whenLoaded<TValue = unknown>(relation: string, transform?: (value: unknown) => TValue): TValue | undefined | null;
     toArray(): Record<string, unknown>;
     toResponse(): Record<string, unknown>;
 }

package/dist/core/http/response.d.ts

@@ -3,4 +3,5 @@ declare function createdResponse(data: unknown, init?: ResponseInit): Response;
 declare function noContentResponse(): Response;
 declare function errorResponse(error: unknown): Response;
 declare function withErrorHandling<TArgs extends unknown[]>(handler: (...args: TArgs) => Response | Promise<Response>): (...args: TArgs) => Promise<Response>;
-export { createdResponse, errorResponse, jsonResponse, noContentResponse, withErrorHandling };
+declare function withJsonErrorHandling<TArgs extends unknown[]>(handler: (...args: TArgs) => Response | Promise<Response>): (...args: TArgs) => Promise<Response>;
+export { createdResponse, errorResponse, jsonResponse, noContentResponse, withErrorHandling, withJsonErrorHandling, };

package/dist/core/http/statelessAuth.d.ts

@@ -0,0 +1,8 @@
+declare function authorizationScheme(request: Request): string;
+declare function requestUsesHeaderCredentials(request: Request): boolean;
+declare function readBearerToken(request: Request): string | null;
+declare function readBasicCredentials(request: Request): {
+    username: string;
+    password: string;
+} | null;
+export { authorizationScheme, readBasicCredentials, readBearerToken, requestUsesHeaderCredentials };

package/dist/core/http/throttleResponse.d.ts

@@ -0,0 +1,2 @@
+declare function tooManyRequestsResponse(request: Request, message: string, decaySeconds: number): Promise<Response>;
+export { tooManyRequestsResponse };

package/dist/core/runtime/frontendMode.d.ts

@@ -1,6 +1,14 @@
-type FrontendMode = "api" | "server-htmx" | "spa-react";
+declare const FRONTEND_MODES: readonly ["api", "server-htmx", "spa-react", "hybrid"];
+declare const DEFAULT_SPA_PREFIX = "/app";
+type FrontendMode = (typeof FRONTEND_MODES)[number];
+declare const FRONTEND_MODE_PATTERN: RegExp;
+declare function parseFrontendMode(value: string | undefined): FrontendMode;
 declare function readFrontendMode(): FrontendMode;
+declare function isViewsMode(mode: FrontendMode): boolean;
+declare function isSpaMode(mode: FrontendMode): boolean;
 declare function isViewsEnabled(): boolean;
 declare function isSpaEnabled(): boolean;
+declare function normalizeSpaPrefix(value: string | undefined): string;
+declare function readSpaPrefix(): string;
 export type { FrontendMode };
-export { isSpaEnabled, isViewsEnabled, readFrontendMode };
+export { DEFAULT_SPA_PREFIX, FRONTEND_MODE_PATTERN, FRONTEND_MODES, isSpaEnabled, isSpaMode, isViewsEnabled, isViewsMode, normalizeSpaPrefix, parseFrontendMode, readFrontendMode, readSpaPrefix, };

package/dist/entries/auth/basicAuthGuard.js

@@ -0,0 +1,137 @@
+// @bun
+// ../../src/core/contracts/serviceTokens.ts
+var CORE_CONFIG_TOKEN = "core.config";
+var CORE_CACHE_TOKEN = "core.cache";
+var CORE_QUEUE_TOKEN = "core.queue";
+var CORE_EVENT_BUS_TOKEN = "core.eventBus";
+var CORE_POLICY_GATE_TOKEN = "core.policyGate";
+var CORE_AUTH_TOKEN = "core.auth";
+var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
+var CORE_ABILITY_CHECKER_TOKEN = "core.abilityChecker";
+var CORE_AUTH_USER_DIRECTORY_TOKEN = "core.authUserDirectory";
+function isAbilityChecker(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  const candidate = value;
+  return typeof candidate.tokenCan === "function" && typeof candidate.requireAbility === "function";
+}
+function isAuthUserDirectory(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  return typeof value.findByIdOrThrow === "function";
+}
+function resolveAbilityChecker(container) {
+  if (container.has(CORE_ABILITY_CHECKER_TOKEN)) {
+    return container.resolve(CORE_ABILITY_CHECKER_TOKEN);
+  }
+  return container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+}
+function resolveAuthUserDirectory(container) {
+  if (container.has(CORE_AUTH_USER_DIRECTORY_TOKEN)) {
+    const directory = container.resolve(CORE_AUTH_USER_DIRECTORY_TOKEN);
+    if (isAuthUserDirectory(directory)) {
+      return directory;
+    }
+  }
+  if (container.has(CORE_TOKEN_SERVICE_TOKEN)) {
+    const tokenService = container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    if (isAuthUserDirectory(tokenService)) {
+      return tokenService;
+    }
+  }
+  return null;
+}
+
+// ../../src/core/http/statelessAuth.ts
+function authorizationScheme(request) {
+  const header = request.headers.get("authorization")?.trim() ?? "";
+  const scheme = header.split(/\s+/, 1)[0];
+  return scheme ? scheme.toLowerCase() : "";
+}
+function requestUsesHeaderCredentials(request) {
+  const scheme = authorizationScheme(request);
+  return scheme === "bearer" || scheme === "basic";
+}
+function readBearerToken(request) {
+  const header = request.headers.get("authorization")?.trim() ?? "";
+  if (!header.toLowerCase().startsWith("bearer ")) {
+    return null;
+  }
+  const token = header.slice("Bearer ".length).trim();
+  return token.length > 0 ? token : null;
+}
+function readBasicCredentials(request) {
+  const header = request.headers.get("authorization")?.trim() ?? "";
+  if (!header.toLowerCase().startsWith("basic ")) {
+    return null;
+  }
+  const encoded = header.slice("Basic ".length).trim();
+  if (!encoded) {
+    return null;
+  }
+  try {
+    const decoded = Buffer.from(encoded, "base64").toString("utf8");
+    const separator = decoded.indexOf(":");
+    if (separator < 0) {
+      return null;
+    }
+    return {
+      username: decoded.slice(0, separator),
+      password: decoded.slice(separator + 1)
+    };
+  } catch {
+    return null;
+  }
+}
+
+// ../../src/core/auth/password.ts
+async function hashPassword(password) {
+  return await Bun.password.hash(password, {
+    algorithm: "bcrypt",
+    cost: 10
+  });
+}
+async function verifyPassword(password, passwordHash) {
+  return await Bun.password.verify(password, passwordHash);
+}
+
+// ../../src/core/auth/basicAuthGuard.ts
+class BasicAuthGuard {
+  container;
+  constructor(container) {
+    this.container = container;
+  }
+  async resolve(request) {
+    const credentials = readBasicCredentials(request);
+    if (!credentials) {
+      return null;
+    }
+    const directory = resolveAuthUserDirectory(this.container);
+    if (!directory) {
+      return null;
+    }
+    if (typeof directory.verifyCredentials === "function") {
+      return await directory.verifyCredentials(credentials.username, credentials.password);
+    }
+    if (typeof directory.findByEmail !== "function") {
+      return null;
+    }
+    const record = await directory.findByEmail(credentials.username);
+    if (!record?.password) {
+      return null;
+    }
+    if (!await verifyPassword(credentials.password, record.password)) {
+      return null;
+    }
+    return {
+      id: record.id,
+      role: record.role,
+      emailVerifiedAt: record.email_verified_at ?? null
+    };
+  }
+}
+export {
+  BasicAuthGuard
+};

package/dist/entries/auth/jwt.js

@@ -0,0 +1,135 @@
+// @bun
+// ../../src/core/auth/jwt.ts
+import { createHmac, timingSafeEqual } from "crypto";
+
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "strata";
+}
+function appCookieName(kind) {
+  return `${appKeyPrefix()}_${kind}`;
+}
+function appDevSecret(kind) {
+  return `${appKeyPrefix()}-dev-${kind}`;
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "Strata";
+}
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
+
+// ../../src/core/auth/jwt.ts
+function resolveJwtSecret(secret) {
+  return secret?.trim() || process.env.JWT_SECRET?.trim() || process.env.SESSION_SECRET?.trim() || appDevSecret("jwt-secret");
+}
+function jwtTtlSeconds(override) {
+  if (typeof override === "number" && Number.isInteger(override) && override > 0) {
+    return override;
+  }
+  const parsed = Number.parseInt(process.env.JWT_TTL_SECONDS ?? "", 10);
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : 3600;
+}
+function encodeJson(value) {
+  return Buffer.from(JSON.stringify(value)).toString("base64url");
+}
+function decodeJson(value) {
+  try {
+    return JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
+  } catch {
+    return null;
+  }
+}
+function signPart(headerAndPayload, secret) {
+  return createHmac("sha256", secret).update(headerAndPayload).digest("base64url");
+}
+function signaturesMatch(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  if (leftBuffer.length !== rightBuffer.length) {
+    return false;
+  }
+  return timingSafeEqual(leftBuffer, rightBuffer);
+}
+function signJwt(payload, options = {}) {
+  const now = Math.floor(Date.now() / 1000);
+  const body = {
+    ...payload,
+    iat: now,
+    exp: now + jwtTtlSeconds(options.ttlSeconds)
+  };
+  const header = encodeJson({ alg: "HS256", typ: "JWT" });
+  const data = encodeJson(body);
+  const unsigned = `${header}.${data}`;
+  const signature = signPart(unsigned, resolveJwtSecret(options.secret));
+  return `${unsigned}.${signature}`;
+}
+function verifyJwt(token, secret) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return null;
+  }
+  const [header, data, signature] = parts;
+  if (!header || !data || !signature) {
+    return null;
+  }
+  const expected = signPart(`${header}.${data}`, resolveJwtSecret(secret));
+  if (!signaturesMatch(signature, expected)) {
+    return null;
+  }
+  const parsedHeader = decodeJson(header);
+  if (parsedHeader?.alg !== "HS256") {
+    return null;
+  }
+  const payload = decodeJson(data);
+  if (!payload || payload.sub === undefined || payload.sub === null) {
+    return null;
+  }
+  if (typeof payload.exp === "number" && payload.exp * 1000 <= Date.now()) {
+    return null;
+  }
+  return payload;
+}
+export {
+  jwtTtlSeconds,
+  resolveJwtSecret,
+  signJwt,
+  verifyJwt
+};