@getstrata/core 0.5.74 → 0.5.76

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @getstrata/core changelog
 
+## 0.5.76
+
+- `createSessionCookie(userId, { remember })` issues a longer HMAC session (default 30 days, `SESSION_REMEMBER_TTL_SECONDS`). Remember cookies embed the TTL in the signed payload so they stay valid after the default 7-day session lifetime. `SESSION_TTL_SECONDS` overrides the short session.
+
+## 0.5.75
+
+- Laravel `password.confirm`: `@getstrata/core/auth/passwordConfirmCookie` (`createPasswordConfirmCookie`, `hasFreshPasswordConfirmation`, `clearPasswordConfirmCookie`) and `createRequirePasswordConfirmMiddleware()` (HTML 302 `/confirm-password`, JSON 423). Cookie name `PASSWORD_CONFIRM_COOKIE_NAME` (default `workhub_password_confirmed`), TTL `PASSWORD_CONFIRM_TIMEOUT` (default 10800s).
+
 ## 0.5.74
 
 - `AuthUser.emailVerifiedAt` and `@getstrata/core/auth/emailVerification` (`isEmailVerificationRequired`, `hasVerifiedEmail`). `null` means unverified; missing is treated as verified (GuestGuard / legacy).

package/README.md

@@ -82,7 +82,7 @@ import type { Migration } from "@getstrata/core/database/migrations/types";
 Package name: **`@getstrata/core`** (npm org [`@getstrata`](https://www.npmjs.com/org/getstrata)).
 
 1. Add `NPM_TOKEN` to GitHub repository secrets.
-2. Tag a release: `git tag v0.5.74 && git push origin v0.5.74`
+2. Tag a release: `git tag v0.5.78 && git push origin v0.5.78`
 3. [Release workflow](../../.github/workflows/release.yml) builds and runs `npm publish --access public`.
 
 Previously published as `@eyk-workhub/framework@0.1.0`, deprecated in favor of this package.

package/dist/core/auth/passwordConfirmCookie.d.ts

@@ -0,0 +1,8 @@
+declare const PASSWORD_CONFIRM_COOKIE = "workhub_password_confirmed";
+declare const DEFAULT_PASSWORD_CONFIRM_TTL_SECONDS: number;
+declare function passwordConfirmCookieName(): string;
+declare function passwordConfirmTtlSeconds(): number;
+declare function hasFreshPasswordConfirmation(request: Request, userId: number): boolean;
+declare function createPasswordConfirmCookie(userId: number): string;
+declare function clearPasswordConfirmCookie(): string;
+export { clearPasswordConfirmCookie, createPasswordConfirmCookie, DEFAULT_PASSWORD_CONFIRM_TTL_SECONDS, hasFreshPasswordConfirmation, PASSWORD_CONFIRM_COOKIE, passwordConfirmCookieName, passwordConfirmTtlSeconds, };

package/dist/core/auth/sessionCookie.d.ts

@@ -1,7 +1,14 @@
 declare const SESSION_COOKIE = "workhub_session";
 declare const SESSION_TTL_SECONDS: number;
+declare const SESSION_REMEMBER_TTL_SECONDS: number;
+interface CreateSessionCookieOptions {
+    remember?: boolean;
+}
 declare function sessionCookieName(): string;
+declare function sessionTtlSeconds(): number;
+declare function sessionRememberTtlSeconds(): number;
 declare function readSessionUserId(request: Request): number | null;
-declare function createSessionCookie(userId: number): string;
+declare function createSessionCookie(userId: number, options?: CreateSessionCookieOptions): string;
 declare function clearSessionCookie(): string;
-export { clearSessionCookie, createSessionCookie, readSessionUserId, SESSION_COOKIE, SESSION_TTL_SECONDS, sessionCookieName, };
+export type { CreateSessionCookieOptions };
+export { clearSessionCookie, createSessionCookie, readSessionUserId, SESSION_COOKIE, SESSION_REMEMBER_TTL_SECONDS, SESSION_TTL_SECONDS, sessionCookieName, sessionRememberTtlSeconds, sessionTtlSeconds, };

package/dist/core/http/requirePasswordConfirmMiddleware.d.ts

@@ -0,0 +1,5 @@
+import type { Middleware } from "./middleware";
+declare const PASSWORD_CONFIRM_MESSAGE = "Password confirmation required.";
+declare const PASSWORD_CONFIRM_PATH = "/confirm-password";
+declare function createRequirePasswordConfirmMiddleware(): Middleware;
+export { createRequirePasswordConfirmMiddleware, PASSWORD_CONFIRM_MESSAGE, PASSWORD_CONFIRM_PATH };

package/dist/entries/auth/passwordConfirmCookie.js

@@ -0,0 +1,81 @@
+// @bun
+// ../../src/core/auth/passwordConfirmCookie.ts
+import { createHmac, timingSafeEqual } from "crypto";
+var PASSWORD_CONFIRM_COOKIE = "workhub_password_confirmed";
+var DEFAULT_PASSWORD_CONFIRM_TTL_SECONDS = 3 * 60 * 60;
+function passwordConfirmCookieName() {
+  return process.env.PASSWORD_CONFIRM_COOKIE_NAME?.trim() || PASSWORD_CONFIRM_COOKIE;
+}
+function passwordConfirmTtlSeconds() {
+  const parsed = Number.parseInt(process.env.PASSWORD_CONFIRM_TIMEOUT ?? "", 10);
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : DEFAULT_PASSWORD_CONFIRM_TTL_SECONDS;
+}
+function resolvePasswordConfirmSecret() {
+  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-session-secret";
+}
+function signPasswordConfirm(userId, confirmedAt) {
+  const payload = `${userId}.${confirmedAt}`;
+  const signature = createHmac("sha256", resolvePasswordConfirmSecret()).update(payload).digest("hex");
+  return `${payload}.${signature}`;
+}
+function readCookieValue(request, cookieName) {
+  const cookieHeader = request.headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
+  }
+  for (const part of cookieHeader.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name === cookieName) {
+      return decodeURIComponent(rest.join("="));
+    }
+  }
+  return null;
+}
+function hasFreshPasswordConfirmation(request, userId) {
+  const cookieValue = readCookieValue(request, passwordConfirmCookieName());
+  if (!cookieValue) {
+    return false;
+  }
+  const parts = cookieValue.split(".");
+  if (parts.length !== 3) {
+    return false;
+  }
+  const [userIdRaw, confirmedAtRaw, cookieSignature] = parts;
+  const cookieUserId = Number.parseInt(String(userIdRaw), 10);
+  const confirmedAt = Number.parseInt(String(confirmedAtRaw), 10);
+  if (cookieUserId !== userId || !Number.isInteger(cookieUserId) || cookieUserId <= 0 || !Number.isFinite(confirmedAt)) {
+    return false;
+  }
+  if (Date.now() - confirmedAt > passwordConfirmTtlSeconds() * 1000) {
+    return false;
+  }
+  const expectedSignature = signPasswordConfirm(cookieUserId, confirmedAt).split(".").pop();
+  if (!expectedSignature || !cookieSignature) {
+    return false;
+  }
+  const expectedBuffer = Buffer.from(expectedSignature);
+  const actualBuffer = Buffer.from(cookieSignature);
+  if (expectedBuffer.length !== actualBuffer.length) {
+    return false;
+  }
+  return timingSafeEqual(expectedBuffer, actualBuffer);
+}
+function createPasswordConfirmCookie(userId) {
+  const confirmedAt = Date.now();
+  const value = signPasswordConfirm(userId, confirmedAt);
+  const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
+  return `${passwordConfirmCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${passwordConfirmTtlSeconds()}${secure}`;
+}
+function clearPasswordConfirmCookie() {
+  const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
+  return `${passwordConfirmCookieName()}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${secure}`;
+}
+export {
+  DEFAULT_PASSWORD_CONFIRM_TTL_SECONDS,
+  PASSWORD_CONFIRM_COOKIE,
+  clearPasswordConfirmCookie,
+  createPasswordConfirmCookie,
+  hasFreshPasswordConfirmation,
+  passwordConfirmCookieName,
+  passwordConfirmTtlSeconds
+};

package/dist/entries/auth/sessionCookie.js

@@ -3,14 +3,25 @@
 import { createHmac, timingSafeEqual } from "crypto";
 var SESSION_COOKIE = "workhub_session";
 var SESSION_TTL_SECONDS = 60 * 60 * 24 * 7;
+var SESSION_REMEMBER_TTL_SECONDS = 60 * 60 * 24 * 30;
 function sessionCookieName() {
   return process.env.SESSION_COOKIE_NAME?.trim() || SESSION_COOKIE;
 }
+function parsePositiveSeconds(raw, fallback) {
+  const parsed = Number.parseInt(raw ?? "", 10);
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback;
+}
+function sessionTtlSeconds() {
+  return parsePositiveSeconds(process.env.SESSION_TTL_SECONDS, SESSION_TTL_SECONDS);
+}
+function sessionRememberTtlSeconds() {
+  return parsePositiveSeconds(process.env.SESSION_REMEMBER_TTL_SECONDS, SESSION_REMEMBER_TTL_SECONDS);
+}
 function resolveSessionSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-session-secret";
 }
-function signSession(userId, issuedAt) {
-  const payload = `${userId}.${issuedAt}`;
+function signSession(userId, issuedAt, ttlSeconds) {
+  const payload = ttlSeconds === undefined ? `${userId}.${issuedAt}` : `${userId}.${issuedAt}.${ttlSeconds}`;
   const signature = createHmac("sha256", resolveSessionSecret()).update(payload).digest("hex");
   return `${payload}.${signature}`;
 }
@@ -27,25 +38,19 @@ function readCookieValue(request, cookieName) {
   }
   return null;
 }
-function readSessionUserId(request) {
-  const cookieValue = readCookieValue(request, sessionCookieName());
-  if (!cookieValue) {
-    return null;
-  }
-  const parts = cookieValue.split(".");
-  if (parts.length !== 3) {
+function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds, remember) {
+  const userId = Number.parseInt(userIdRaw, 10);
+  const issuedAt = Number.parseInt(issuedAtRaw, 10);
+  if (!Number.isInteger(userId) || userId <= 0 || !Number.isFinite(issuedAt)) {
     return null;
   }
-  const [userIdRaw, issuedAtRaw, cookieSignature] = parts;
-  const userId = Number.parseInt(String(userIdRaw), 10);
-  const issuedAt = Number.parseInt(String(issuedAtRaw), 10);
-  if (!Number.isInteger(userId) || userId <= 0 || !Number.isFinite(issuedAt)) {
+  if (!Number.isInteger(ttlSeconds) || ttlSeconds <= 0) {
     return null;
   }
-  if (Date.now() - issuedAt > SESSION_TTL_SECONDS * 1000) {
+  if (Date.now() - issuedAt > ttlSeconds * 1000) {
     return null;
   }
-  const expectedSignature = signSession(userId, issuedAt).split(".").pop();
+  const expectedSignature = (remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt)).split(".").pop();
   if (!expectedSignature || !cookieSignature) {
     return null;
   }
@@ -59,11 +64,28 @@ function readSessionUserId(request) {
   }
   return userId;
 }
-function createSessionCookie(userId) {
+function readSessionUserId(request) {
+  const cookieValue = readCookieValue(request, sessionCookieName());
+  if (!cookieValue) {
+    return null;
+  }
+  const parts = cookieValue.split(".");
+  if (parts.length === 4) {
+    const [userIdRaw2, issuedAtRaw2, ttlRaw, cookieSignature2] = parts;
+    return readSignedSession(String(userIdRaw2), String(issuedAtRaw2), cookieSignature2, Number.parseInt(String(ttlRaw), 10), true);
+  }
+  if (parts.length !== 3) {
+    return null;
+  }
+  const [userIdRaw, issuedAtRaw, cookieSignature] = parts;
+  return readSignedSession(String(userIdRaw), String(issuedAtRaw), cookieSignature, sessionTtlSeconds(), false);
+}
+function createSessionCookie(userId, options = {}) {
   const issuedAt = Date.now();
-  const value = signSession(userId, issuedAt);
+  const ttlSeconds = options.remember ? sessionRememberTtlSeconds() : sessionTtlSeconds();
+  const value = options.remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt);
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
-  return `${sessionCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${SESSION_TTL_SECONDS}${secure}`;
+  return `${sessionCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${ttlSeconds}${secure}`;
 }
 function clearSessionCookie() {
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
@@ -71,9 +93,12 @@ function clearSessionCookie() {
 }
 export {
   SESSION_COOKIE,
+  SESSION_REMEMBER_TTL_SECONDS,
   SESSION_TTL_SECONDS,
   clearSessionCookie,
   createSessionCookie,
   readSessionUserId,
-  sessionCookieName
+  sessionCookieName,
+  sessionRememberTtlSeconds,
+  sessionTtlSeconds
 };

package/dist/entries/auth/sessionGuard.js

@@ -86,14 +86,25 @@ function resolveAbilitiesForRole(role) {
 import { createHmac, timingSafeEqual } from "crypto";
 var SESSION_COOKIE = "workhub_session";
 var SESSION_TTL_SECONDS = 60 * 60 * 24 * 7;
+var SESSION_REMEMBER_TTL_SECONDS = 60 * 60 * 24 * 30;
 function sessionCookieName() {
   return process.env.SESSION_COOKIE_NAME?.trim() || SESSION_COOKIE;
 }
+function parsePositiveSeconds(raw, fallback) {
+  const parsed = Number.parseInt(raw ?? "", 10);
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback;
+}
+function sessionTtlSeconds() {
+  return parsePositiveSeconds(process.env.SESSION_TTL_SECONDS, SESSION_TTL_SECONDS);
+}
+function sessionRememberTtlSeconds() {
+  return parsePositiveSeconds(process.env.SESSION_REMEMBER_TTL_SECONDS, SESSION_REMEMBER_TTL_SECONDS);
+}
 function resolveSessionSecret() {
   return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-session-secret";
 }
-function signSession(userId, issuedAt) {
-  const payload = `${userId}.${issuedAt}`;
+function signSession(userId, issuedAt, ttlSeconds) {
+  const payload = ttlSeconds === undefined ? `${userId}.${issuedAt}` : `${userId}.${issuedAt}.${ttlSeconds}`;
   const signature = createHmac("sha256", resolveSessionSecret()).update(payload).digest("hex");
   return `${payload}.${signature}`;
 }
@@ -110,25 +121,19 @@ function readCookieValue(request, cookieName) {
   }
   return null;
 }
-function readSessionUserId(request) {
-  const cookieValue = readCookieValue(request, sessionCookieName());
-  if (!cookieValue) {
-    return null;
-  }
-  const parts = cookieValue.split(".");
-  if (parts.length !== 3) {
+function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds, remember) {
+  const userId = Number.parseInt(userIdRaw, 10);
+  const issuedAt = Number.parseInt(issuedAtRaw, 10);
+  if (!Number.isInteger(userId) || userId <= 0 || !Number.isFinite(issuedAt)) {
     return null;
   }
-  const [userIdRaw, issuedAtRaw, cookieSignature] = parts;
-  const userId = Number.parseInt(String(userIdRaw), 10);
-  const issuedAt = Number.parseInt(String(issuedAtRaw), 10);
-  if (!Number.isInteger(userId) || userId <= 0 || !Number.isFinite(issuedAt)) {
+  if (!Number.isInteger(ttlSeconds) || ttlSeconds <= 0) {
     return null;
   }
-  if (Date.now() - issuedAt > SESSION_TTL_SECONDS * 1000) {
+  if (Date.now() - issuedAt > ttlSeconds * 1000) {
     return null;
   }
-  const expectedSignature = signSession(userId, issuedAt).split(".").pop();
+  const expectedSignature = (remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt)).split(".").pop();
   if (!expectedSignature || !cookieSignature) {
     return null;
   }
@@ -142,11 +147,28 @@ function readSessionUserId(request) {
   }
   return userId;
 }
-function createSessionCookie(userId) {
+function readSessionUserId(request) {
+  const cookieValue = readCookieValue(request, sessionCookieName());
+  if (!cookieValue) {
+    return null;
+  }
+  const parts = cookieValue.split(".");
+  if (parts.length === 4) {
+    const [userIdRaw2, issuedAtRaw2, ttlRaw, cookieSignature2] = parts;
+    return readSignedSession(String(userIdRaw2), String(issuedAtRaw2), cookieSignature2, Number.parseInt(String(ttlRaw), 10), true);
+  }
+  if (parts.length !== 3) {
+    return null;
+  }
+  const [userIdRaw, issuedAtRaw, cookieSignature] = parts;
+  return readSignedSession(String(userIdRaw), String(issuedAtRaw), cookieSignature, sessionTtlSeconds(), false);
+}
+function createSessionCookie(userId, options = {}) {
   const issuedAt = Date.now();
-  const value = signSession(userId, issuedAt);
+  const ttlSeconds = options.remember ? sessionRememberTtlSeconds() : sessionTtlSeconds();
+  const value = options.remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt);
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
-  return `${sessionCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${SESSION_TTL_SECONDS}${secure}`;
+  return `${sessionCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${ttlSeconds}${secure}`;
 }
 function clearSessionCookie() {
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";

package/dist/entries/http/requirePasswordConfirmMiddleware.js

@@ -0,0 +1,89 @@
+// @bun
+// ../../src/core/http/requirePasswordConfirmMiddleware.ts
+import { resolveUserId } from "@getstrata/core/auth/accessControl";
+import { currentAuthUser } from "@getstrata/core/auth/authContext";
+import { hasFreshPasswordConfirmation } from "@getstrata/core/auth/passwordConfirmCookie";
+
+// ../../src/core/http/contentNegotiation.ts
+function requestPrefersJson(request) {
+  if (!request) {
+    return true;
+  }
+  if (request.headers.get("HX-Request") === "true") {
+    return false;
+  }
+  const accept = request.headers.get("accept")?.toLowerCase() ?? "";
+  if (accept.includes("text/html")) {
+    return false;
+  }
+  if (accept.includes("application/json")) {
+    return true;
+  }
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+    return false;
+  }
+  const pathname = new URL(request.url).pathname;
+  return pathname.startsWith("/api/");
+}
+
+// ../../src/core/http/safeInternalPath.ts
+function looksLikeExternalTarget(value) {
+  const trimmed = value.trim();
+  if (!trimmed.startsWith("/") || trimmed.startsWith("//") || trimmed.includes("\\")) {
+    return true;
+  }
+  if (trimmed.includes("://") || trimmed.includes(":/") || trimmed.includes(":\\")) {
+    return true;
+  }
+  try {
+    const decoded = decodeURIComponent(trimmed);
+    if (decoded.startsWith("//") || decoded.includes("\\") || /https?:/i.test(decoded)) {
+      return true;
+    }
+  } catch {
+    return true;
+  }
+  return false;
+}
+function sanitizeInternalPath(raw, fallback = "/") {
+  if (looksLikeExternalTarget(raw)) {
+    return fallback;
+  }
+  return raw;
+}
+function safeInternalRedirectPath(request, fallback = "/") {
+  const url = new URL(request.url);
+  return sanitizeInternalPath(`${url.pathname}${url.search}`, fallback);
+}
+function loginRedirectLocation(request) {
+  return `/login?redirect=${encodeURIComponent(safeInternalRedirectPath(request))}`;
+}
+
+// ../../src/core/http/requirePasswordConfirmMiddleware.ts
+var PASSWORD_CONFIRM_MESSAGE = "Password confirmation required.";
+var PASSWORD_CONFIRM_PATH = "/confirm-password";
+function createRequirePasswordConfirmMiddleware() {
+  return async (request, next) => {
+    const user = currentAuthUser();
+    if (!user) {
+      return await next();
+    }
+    const userId = resolveUserId(user);
+    if (hasFreshPasswordConfirmation(request, userId)) {
+      return await next();
+    }
+    if (requestPrefersJson(request)) {
+      return Response.json({ error: PASSWORD_CONFIRM_MESSAGE }, { status: 423 });
+    }
+    const url = new URL(request.url);
+    const intended = request.method === "GET" ? `${url.pathname}${url.search}` : "/account";
+    const redirect = sanitizeInternalPath(intended, "/account");
+    return Response.redirect(`${PASSWORD_CONFIRM_PATH}?redirect=${encodeURIComponent(redirect)}`, 302);
+  };
+}
+export {
+  PASSWORD_CONFIRM_MESSAGE,
+  PASSWORD_CONFIRM_PATH,
+  createRequirePasswordConfirmMiddleware
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "0.5.74",
+  "version": "0.5.76",
   "description": "Strata — Laravel-inspired Bun framework public API",
   "type": "module",
   "license": "MIT",
@@ -85,6 +85,11 @@
       "import": "./dist/entries/auth/password.js",
       "default": "./dist/entries/auth/password.js"
     },
+    "./auth/passwordConfirmCookie": {
+      "types": "./dist/core/auth/passwordConfirmCookie.d.ts",
+      "import": "./dist/entries/auth/passwordConfirmCookie.js",
+      "default": "./dist/entries/auth/passwordConfirmCookie.js"
+    },
     "./auth/policy": {
       "types": "./dist/core/auth/policy.d.ts",
       "import": "./dist/entries/auth/policy.js",
@@ -465,6 +470,11 @@
       "import": "./dist/entries/http/requireVerifiedMiddleware.js",
       "default": "./dist/entries/http/requireVerifiedMiddleware.js"
     },
+    "./http/requirePasswordConfirmMiddleware": {
+      "types": "./dist/core/http/requirePasswordConfirmMiddleware.d.ts",
+      "import": "./dist/entries/http/requirePasswordConfirmMiddleware.js",
+      "default": "./dist/entries/http/requirePasswordConfirmMiddleware.js"
+    },
     "./http/resources": {
       "types": "./dist/core/http/resources.d.ts",
       "import": "./dist/entries/http/resources.js",
@@ -823,7 +833,7 @@
     "build:bundle": "bun build index.ts --outdir dist --target bun --external bun --external eta",
     "build:types": "tsc -p tsconfig.types.json",
     "prepublishOnly": "bun run build && bun ../../scripts/prepare-core-package-publish.ts",
-    "build:subpaths": "bun build entries/auth/accessControl.ts entries/auth/abilityChecker.ts entries/auth/emailVerification.ts entries/auth/membershipMiddleware.ts entries/auth/membershipScope.ts entries/auth/membershipService.ts entries/auth/oauth/oidcProvider.ts entries/auth/oauth/providers.ts entries/auth/oauth/samlProvider.ts entries/auth/oauth/types.ts entries/auth/password.ts entries/auth/policy.ts entries/auth/scimAuthMiddleware.ts entries/auth/sessionCookie.ts entries/auth/sessionGuard.ts entries/auth/tokenHash.ts entries/audit/exportAuditLogs.ts entries/audit/siemFormatter.ts entries/admin/formatValue.ts entries/admin/registry.ts entries/admin/types.ts entries/cache/tags.ts entries/cache/createCacheStore.ts entries/cache/repository.ts entries/cache/simpleCache.ts entries/cache/simpleCacheStore.ts entries/config/envSchema.ts entries/contracts/serviceTokens.ts entries/contracts/container.ts entries/contracts/di.ts entries/crypto/fieldEncryption.ts entries/crypto/mfaSecret.ts entries/database/errors.ts entries/database/factory.ts entries/database/migrations.ts entries/database/migrations/types.ts entries/database/model.ts entries/database/query.ts entries/database/relationships.ts entries/database/repositoryQuery.ts entries/database/seeders.ts entries/database/seeders/types.ts entries/database/schema.ts entries/database/table.ts entries/database/types.ts entries/database/whereBuilder.ts entries/facades.ts entries/http/authMiddleware.ts entries/http/authorizeMiddleware.ts entries/http/bodySizeLimitMiddleware.ts entries/http/clientIp.ts entries/http/cookies.ts entries/http/contentNegotiation.ts entries/http/conditionalResponse.ts entries/http/corsMiddleware.ts entries/http/csrfMiddleware.ts entries/http/csrfProtection.ts entries/http/csrfToken.ts entries/http/etag.ts entries/http/flashSession.ts entries/http/flashMiddleware.ts entries/http/formRequest.ts entries/http/metricsMiddleware.ts entries/http/loginThrottleMiddleware.ts entries/http/memoryThrottleMiddleware.ts entries/http/pagination.ts entries/http/parseFormBody.ts entries/http/parseMultipartUpload.ts entries/http/requireAbilityMiddleware.ts entries/http/requireAuthMiddleware.ts entries/http/requireGlobalAdminMiddleware.ts entries/http/requireWebAuthMiddleware.ts entries/http/requireVerifiedMiddleware.ts entries/http/resources.ts entries/http/response.ts entries/http/route.ts entries/http/routeMiddleware.ts entries/http/routeModelBinding.ts entries/http/safeInternalPath.ts entries/http/signedUrl.ts entries/http/scimThrottleMiddleware.ts entries/http/securityHeadersMiddleware.ts entries/http/securedRouteModelBinding.ts entries/http/webErrorResponse.ts entries/http/webFormRequest.ts entries/http/throttleMiddleware.ts entries/http/validation.ts entries/jobs/dispatchWebhookJob.ts entries/jobs/exportAuditLogsJob.ts entries/jobs/invalidateCacheTagsJob.ts entries/lifecycle/gracefulShutdown.ts entries/logging/logger.ts entries/logging/requestLoggingMiddleware.ts entries/mail/mailer.ts entries/mail/markdownMail.ts entries/mail/markdownMailable.ts entries/mail/sanitizeMailHtml.ts entries/media/imageTransform.ts entries/metrics/prometheus.ts entries/openapi/generator.ts entries/openapi/registeredRoute.ts entries/openapi/validate.ts entries/pagination.ts entries/queue.ts entries/queue/createAppQueue.ts entries/queue/failedJobRepository.ts entries/queue/failedJobService.ts entries/queue/jobRunner.ts entries/queue/queueMetrics.ts entries/queue/publicQueue.ts entries/queue/redisQueue.ts entries/queue/types.ts entries/runtime/appKeyPrefix.ts entries/runtime/frontendMode.ts entries/runtime/asyncContextStore.ts entries/scheduler/schedule.ts entries/scheduler/osCron.ts entries/security/oauthState.ts entries/security/publicReads.ts entries/security/safeFetch.ts entries/security/safeUrl.ts entries/security/scimTenantTokens.ts entries/security/stripeWebhook.ts entries/security/timingSafeCompare.ts entries/security/tokenExpiry.ts entries/security/totp.ts entries/storage/storage.ts entries/tenant/tenancyConfig.ts entries/tenant/tenantDatabaseScope.ts entries/tenant/databaseTenantContext.ts entries/terminal/runShell.ts entries/tracing/tracingMiddleware.ts entries/validation/rules.ts entries/view.ts --outdir dist --root . --target bun --external bun --external eta --external @getstrata/core --external @getstrata/core/auth/accessControl --external @getstrata/core/auth/abilityChecker --external @getstrata/core/auth/authContext --external @getstrata/core/auth/emailVerification --external @getstrata/core/auth/guard --external @getstrata/core/auth/membershipContext --external @getstrata/core/auth/membershipMiddleware --external @getstrata/core/auth/membershipScope --external @getstrata/core/auth/membershipService --external @getstrata/core/auth/oauth/oidcProvider --external @getstrata/core/auth/oauth/providers --external @getstrata/core/auth/oauth/samlProvider --external @getstrata/core/auth/oauth/types --external @getstrata/core/auth/password --external @getstrata/core/auth/policy --external @getstrata/core/auth/scimAuthMiddleware --external @getstrata/core/auth/sessionCookie --external @getstrata/core/auth/sessionGuard --external @getstrata/core/auth/tokenHash --external @getstrata/core/audit/exportAuditLogs --external @getstrata/core/audit/siemFormatter --external @getstrata/core/admin/formatValue --external @getstrata/core/admin/registry --external @getstrata/core/admin/types --external @getstrata/core/cache/tags --external @getstrata/core/cache/createCacheStore --external @getstrata/core/cache/repository --external @getstrata/core/cache/simpleCache --external @getstrata/core/cache/simpleCacheStore --external @getstrata/core/config/envSchema --external @getstrata/core/contracts/serviceTokens --external @getstrata/core/contracts/container --external @getstrata/core/contracts/di --external @getstrata/core/crypto/fieldEncryption --external @getstrata/core/crypto/mfaSecret --external @getstrata/core/database --external @getstrata/core/database/baseRepository --external @getstrata/core/database/bindConnection --external @getstrata/core/database/boundConnection --external @getstrata/core/database/bunSql --external @getstrata/core/database/connection --external @getstrata/core/database/defaultConnection --external @getstrata/core/database/errors --external @getstrata/core/database/factory --external @getstrata/core/database/migrations --external @getstrata/core/database/migrations/types --external @getstrata/core/database/model --external @getstrata/core/database/query --external @getstrata/core/database/relationships --external @getstrata/core/database/repositoryConnection --external @getstrata/core/database/repositoryQuery --external @getstrata/core/database/seeders --external @getstrata/core/database/seeders/types --external @getstrata/core/database/schema --external @getstrata/core/database/table --external @getstrata/core/database/transaction --external @getstrata/core/database/types --external @getstrata/core/database/whereBuilder --external @getstrata/core/errors/http --external @getstrata/core/events --external @getstrata/core/facades --external @getstrata/core/http --external @getstrata/core/http/authMiddleware --external @getstrata/core/http/authorizeMiddleware --external @getstrata/core/http/bodySizeLimitMiddleware --external @getstrata/core/http/clientIp --external @getstrata/core/http/cookies --external @getstrata/core/http/contentNegotiation --external @getstrata/core/http/contentSecurityPolicy --external @getstrata/core/http/conditionalResponse --external @getstrata/core/http/corsMiddleware --external @getstrata/core/http/csrfMiddleware --external @getstrata/core/http/csrfProtection --external @getstrata/core/http/csrfToken --external @getstrata/core/http/etag --external @getstrata/core/http/flashSession --external @getstrata/core/http/flashMiddleware --external @getstrata/core/http/formRequest --external @getstrata/core/http/middleware --external @getstrata/core/http/metricsMiddleware --external @getstrata/core/http/loginThrottleMiddleware --external @getstrata/core/http/memoryThrottleMiddleware --external @getstrata/core/http/pagination --external @getstrata/core/http/parseFormBody --external @getstrata/core/http/parseMultipartUpload --external @getstrata/core/http/requireAbilityMiddleware --external @getstrata/core/http/requireAuthMiddleware --external @getstrata/core/http/requireGlobalAdminMiddleware --external @getstrata/core/http/requireWebAuthMiddleware --external @getstrata/core/http/requireVerifiedMiddleware --external @getstrata/core/http/resources --external @getstrata/core/http/response --external @getstrata/core/http/route --external @getstrata/core/http/routeMiddleware --external @getstrata/core/http/routeModelBinding --external @getstrata/core/http/safeInternalPath --external @getstrata/core/http/signedUrl --external @getstrata/core/http/scimThrottleMiddleware --external @getstrata/core/http/securityHeadersMiddleware --external @getstrata/core/http/securedRouteModelBinding --external @getstrata/core/http/requestMetaContext --external @getstrata/core/http/webErrorResponse --external @getstrata/core/http/webFormRequest --external @getstrata/core/http/throttleMiddleware --external @getstrata/core/http/validation --external @getstrata/core/jobs/dispatchWebhookJob --external @getstrata/core/jobs/exportAuditLogsJob --external @getstrata/core/jobs/invalidateCacheTagsJob --external @getstrata/core/lifecycle/gracefulShutdown --external @getstrata/core/logging/logger --external @getstrata/core/logging/requestLoggingMiddleware --external @getstrata/core/mail/mailer --external @getstrata/core/mail/markdownMail --external @getstrata/core/mail/markdownMailable --external @getstrata/core/mail/sanitizeMailHtml --external @getstrata/core/media/imageTransform --external @getstrata/core/metrics/prometheus --external @getstrata/core/notifications --external @getstrata/core/openapi/generator --external @getstrata/core/openapi/registeredRoute --external @getstrata/core/openapi/validate --external @getstrata/core/pagination --external @getstrata/core/queue --external @getstrata/core/queue/createAppQueue --external @getstrata/core/queue/failedJobRepository --external @getstrata/core/queue/failedJobService --external @getstrata/core/queue/jobRegistry --external @getstrata/core/queue/jobRunner --external @getstrata/core/queue/queueMetrics --external @getstrata/core/queue/publicQueue --external @getstrata/core/queue/redisQueue --external @getstrata/core/queue/types --external @getstrata/core/runtime/appKeyPrefix --external @getstrata/core/runtime/frontendMode --external @getstrata/core/runtime/applicationRegistry --external @getstrata/core/runtime/asyncContextStore --external @getstrata/core/scheduler/schedule --external @getstrata/core/scheduler/osCron --external @getstrata/core/security/oauthState --external @getstrata/core/security/publicReads --external @getstrata/core/security/safeFetch --external @getstrata/core/security/safeUrl --external @getstrata/core/security/scimTenantTokens --external @getstrata/core/security/securityEvents --external @getstrata/core/security/stripeWebhook --external @getstrata/core/security/timingSafeCompare --external @getstrata/core/security/tokenExpiry --external @getstrata/core/security/totp --external @getstrata/core/storage/storage --external @getstrata/core/tenant/tenancyConfig --external @getstrata/core/tenant/tenantContext --external @getstrata/core/tenant/tenantDatabaseScope --external @getstrata/core/tenant/databaseTenantContext --external @getstrata/core/tenant/tenantMiddleware --external @getstrata/core/terminal/runShell --external @getstrata/core/tracing/traceContext --external @getstrata/core/tracing/tracingMiddleware --external @getstrata/core/validation/rules --external @getstrata/core/view",
+    "build:subpaths": "bun build entries/auth/accessControl.ts entries/auth/abilityChecker.ts entries/auth/emailVerification.ts entries/auth/membershipMiddleware.ts entries/auth/membershipScope.ts entries/auth/membershipService.ts entries/auth/oauth/oidcProvider.ts entries/auth/oauth/providers.ts entries/auth/oauth/samlProvider.ts entries/auth/oauth/types.ts entries/auth/password.ts entries/auth/passwordConfirmCookie.ts entries/auth/policy.ts entries/auth/scimAuthMiddleware.ts entries/auth/sessionCookie.ts entries/auth/sessionGuard.ts entries/auth/tokenHash.ts entries/audit/exportAuditLogs.ts entries/audit/siemFormatter.ts entries/admin/formatValue.ts entries/admin/registry.ts entries/admin/types.ts entries/cache/tags.ts entries/cache/createCacheStore.ts entries/cache/repository.ts entries/cache/simpleCache.ts entries/cache/simpleCacheStore.ts entries/config/envSchema.ts entries/contracts/serviceTokens.ts entries/contracts/container.ts entries/contracts/di.ts entries/crypto/fieldEncryption.ts entries/crypto/mfaSecret.ts entries/database/errors.ts entries/database/factory.ts entries/database/migrations.ts entries/database/migrations/types.ts entries/database/model.ts entries/database/query.ts entries/database/relationships.ts entries/database/repositoryQuery.ts entries/database/seeders.ts entries/database/seeders/types.ts entries/database/schema.ts entries/database/table.ts entries/database/types.ts entries/database/whereBuilder.ts entries/facades.ts entries/http/authMiddleware.ts entries/http/authorizeMiddleware.ts entries/http/bodySizeLimitMiddleware.ts entries/http/clientIp.ts entries/http/cookies.ts entries/http/contentNegotiation.ts entries/http/conditionalResponse.ts entries/http/corsMiddleware.ts entries/http/csrfMiddleware.ts entries/http/csrfProtection.ts entries/http/csrfToken.ts entries/http/etag.ts entries/http/flashSession.ts entries/http/flashMiddleware.ts entries/http/formRequest.ts entries/http/metricsMiddleware.ts entries/http/loginThrottleMiddleware.ts entries/http/memoryThrottleMiddleware.ts entries/http/pagination.ts entries/http/parseFormBody.ts entries/http/parseMultipartUpload.ts entries/http/requireAbilityMiddleware.ts entries/http/requireAuthMiddleware.ts entries/http/requireGlobalAdminMiddleware.ts entries/http/requireWebAuthMiddleware.ts entries/http/requireVerifiedMiddleware.ts entries/http/requirePasswordConfirmMiddleware.ts entries/http/resources.ts entries/http/response.ts entries/http/route.ts entries/http/routeMiddleware.ts entries/http/routeModelBinding.ts entries/http/safeInternalPath.ts entries/http/signedUrl.ts entries/http/scimThrottleMiddleware.ts entries/http/securityHeadersMiddleware.ts entries/http/securedRouteModelBinding.ts entries/http/webErrorResponse.ts entries/http/webFormRequest.ts entries/http/throttleMiddleware.ts entries/http/validation.ts entries/jobs/dispatchWebhookJob.ts entries/jobs/exportAuditLogsJob.ts entries/jobs/invalidateCacheTagsJob.ts entries/lifecycle/gracefulShutdown.ts entries/logging/logger.ts entries/logging/requestLoggingMiddleware.ts entries/mail/mailer.ts entries/mail/markdownMail.ts entries/mail/markdownMailable.ts entries/mail/sanitizeMailHtml.ts entries/media/imageTransform.ts entries/metrics/prometheus.ts entries/openapi/generator.ts entries/openapi/registeredRoute.ts entries/openapi/validate.ts entries/pagination.ts entries/queue.ts entries/queue/createAppQueue.ts entries/queue/failedJobRepository.ts entries/queue/failedJobService.ts entries/queue/jobRunner.ts entries/queue/queueMetrics.ts entries/queue/publicQueue.ts entries/queue/redisQueue.ts entries/queue/types.ts entries/runtime/appKeyPrefix.ts entries/runtime/frontendMode.ts entries/runtime/asyncContextStore.ts entries/scheduler/schedule.ts entries/scheduler/osCron.ts entries/security/oauthState.ts entries/security/publicReads.ts entries/security/safeFetch.ts entries/security/safeUrl.ts entries/security/scimTenantTokens.ts entries/security/stripeWebhook.ts entries/security/timingSafeCompare.ts entries/security/tokenExpiry.ts entries/security/totp.ts entries/storage/storage.ts entries/tenant/tenancyConfig.ts entries/tenant/tenantDatabaseScope.ts entries/tenant/databaseTenantContext.ts entries/terminal/runShell.ts entries/tracing/tracingMiddleware.ts entries/validation/rules.ts entries/view.ts --outdir dist --root . --target bun --external bun --external eta --external @getstrata/core --external @getstrata/core/auth/accessControl --external @getstrata/core/auth/abilityChecker --external @getstrata/core/auth/authContext --external @getstrata/core/auth/emailVerification --external @getstrata/core/auth/guard --external @getstrata/core/auth/membershipContext --external @getstrata/core/auth/membershipMiddleware --external @getstrata/core/auth/membershipScope --external @getstrata/core/auth/membershipService --external @getstrata/core/auth/oauth/oidcProvider --external @getstrata/core/auth/oauth/providers --external @getstrata/core/auth/oauth/samlProvider --external @getstrata/core/auth/oauth/types --external @getstrata/core/auth/password --external @getstrata/core/auth/passwordConfirmCookie --external @getstrata/core/auth/policy --external @getstrata/core/auth/scimAuthMiddleware --external @getstrata/core/auth/sessionCookie --external @getstrata/core/auth/sessionGuard --external @getstrata/core/auth/tokenHash --external @getstrata/core/audit/exportAuditLogs --external @getstrata/core/audit/siemFormatter --external @getstrata/core/admin/formatValue --external @getstrata/core/admin/registry --external @getstrata/core/admin/types --external @getstrata/core/cache/tags --external @getstrata/core/cache/createCacheStore --external @getstrata/core/cache/repository --external @getstrata/core/cache/simpleCache --external @getstrata/core/cache/simpleCacheStore --external @getstrata/core/config/envSchema --external @getstrata/core/contracts/serviceTokens --external @getstrata/core/contracts/container --external @getstrata/core/contracts/di --external @getstrata/core/crypto/fieldEncryption --external @getstrata/core/crypto/mfaSecret --external @getstrata/core/database --external @getstrata/core/database/baseRepository --external @getstrata/core/database/bindConnection --external @getstrata/core/database/boundConnection --external @getstrata/core/database/bunSql --external @getstrata/core/database/connection --external @getstrata/core/database/defaultConnection --external @getstrata/core/database/errors --external @getstrata/core/database/factory --external @getstrata/core/database/migrations --external @getstrata/core/database/migrations/types --external @getstrata/core/database/model --external @getstrata/core/database/query --external @getstrata/core/database/relationships --external @getstrata/core/database/repositoryConnection --external @getstrata/core/database/repositoryQuery --external @getstrata/core/database/seeders --external @getstrata/core/database/seeders/types --external @getstrata/core/database/schema --external @getstrata/core/database/table --external @getstrata/core/database/transaction --external @getstrata/core/database/types --external @getstrata/core/database/whereBuilder --external @getstrata/core/errors/http --external @getstrata/core/events --external @getstrata/core/facades --external @getstrata/core/http --external @getstrata/core/http/authMiddleware --external @getstrata/core/http/authorizeMiddleware --external @getstrata/core/http/bodySizeLimitMiddleware --external @getstrata/core/http/clientIp --external @getstrata/core/http/cookies --external @getstrata/core/http/contentNegotiation --external @getstrata/core/http/contentSecurityPolicy --external @getstrata/core/http/conditionalResponse --external @getstrata/core/http/corsMiddleware --external @getstrata/core/http/csrfMiddleware --external @getstrata/core/http/csrfProtection --external @getstrata/core/http/csrfToken --external @getstrata/core/http/etag --external @getstrata/core/http/flashSession --external @getstrata/core/http/flashMiddleware --external @getstrata/core/http/formRequest --external @getstrata/core/http/middleware --external @getstrata/core/http/metricsMiddleware --external @getstrata/core/http/loginThrottleMiddleware --external @getstrata/core/http/memoryThrottleMiddleware --external @getstrata/core/http/pagination --external @getstrata/core/http/parseFormBody --external @getstrata/core/http/parseMultipartUpload --external @getstrata/core/http/requireAbilityMiddleware --external @getstrata/core/http/requireAuthMiddleware --external @getstrata/core/http/requireGlobalAdminMiddleware --external @getstrata/core/http/requireWebAuthMiddleware --external @getstrata/core/http/requireVerifiedMiddleware --external @getstrata/core/http/requirePasswordConfirmMiddleware --external @getstrata/core/http/resources --external @getstrata/core/http/response --external @getstrata/core/http/route --external @getstrata/core/http/routeMiddleware --external @getstrata/core/http/routeModelBinding --external @getstrata/core/http/safeInternalPath --external @getstrata/core/http/signedUrl --external @getstrata/core/http/scimThrottleMiddleware --external @getstrata/core/http/securityHeadersMiddleware --external @getstrata/core/http/securedRouteModelBinding --external @getstrata/core/http/requestMetaContext --external @getstrata/core/http/webErrorResponse --external @getstrata/core/http/webFormRequest --external @getstrata/core/http/throttleMiddleware --external @getstrata/core/http/validation --external @getstrata/core/jobs/dispatchWebhookJob --external @getstrata/core/jobs/exportAuditLogsJob --external @getstrata/core/jobs/invalidateCacheTagsJob --external @getstrata/core/lifecycle/gracefulShutdown --external @getstrata/core/logging/logger --external @getstrata/core/logging/requestLoggingMiddleware --external @getstrata/core/mail/mailer --external @getstrata/core/mail/markdownMail --external @getstrata/core/mail/markdownMailable --external @getstrata/core/mail/sanitizeMailHtml --external @getstrata/core/media/imageTransform --external @getstrata/core/metrics/prometheus --external @getstrata/core/notifications --external @getstrata/core/openapi/generator --external @getstrata/core/openapi/registeredRoute --external @getstrata/core/openapi/validate --external @getstrata/core/pagination --external @getstrata/core/queue --external @getstrata/core/queue/createAppQueue --external @getstrata/core/queue/failedJobRepository --external @getstrata/core/queue/failedJobService --external @getstrata/core/queue/jobRegistry --external @getstrata/core/queue/jobRunner --external @getstrata/core/queue/queueMetrics --external @getstrata/core/queue/publicQueue --external @getstrata/core/queue/redisQueue --external @getstrata/core/queue/types --external @getstrata/core/runtime/appKeyPrefix --external @getstrata/core/runtime/frontendMode --external @getstrata/core/runtime/applicationRegistry --external @getstrata/core/runtime/asyncContextStore --external @getstrata/core/scheduler/schedule --external @getstrata/core/scheduler/osCron --external @getstrata/core/security/oauthState --external @getstrata/core/security/publicReads --external @getstrata/core/security/safeFetch --external @getstrata/core/security/safeUrl --external @getstrata/core/security/scimTenantTokens --external @getstrata/core/security/securityEvents --external @getstrata/core/security/stripeWebhook --external @getstrata/core/security/timingSafeCompare --external @getstrata/core/security/tokenExpiry --external @getstrata/core/security/totp --external @getstrata/core/storage/storage --external @getstrata/core/tenant/tenancyConfig --external @getstrata/core/tenant/tenantContext --external @getstrata/core/tenant/tenantDatabaseScope --external @getstrata/core/tenant/databaseTenantContext --external @getstrata/core/tenant/tenantMiddleware --external @getstrata/core/terminal/runShell --external @getstrata/core/tracing/traceContext --external @getstrata/core/tracing/tracingMiddleware --external @getstrata/core/validation/rules --external @getstrata/core/view",
     "build:shims": "bun ../../scripts/write-core-shared-shims.ts"
   },
   "publishConfig": {