@getstrata/core 1.0.9 → 1.1.0

package/CHANGELOG.md

@@ -1,5 +1,53 @@
 # @getstrata/core changelog
 
+## 1.1.0
+
+Breaking security hardening. Claims below match the code.
+
+### Migration
+
+- JWT without `exp` is rejected.
+- Non-expiring `signedUrl()` is now invalid on verify. `signedUrl()` without `expires` always fails verification.
+- Existing API tokens hashed with unpeppered SHA256 will not match HMAC pepper hashes. Re-issue tokens after setting `TOKEN_HASH_PEPPER`.
+- CSRF and session secret fallbacks are gone. `ADMIN_API_TOKEN` is no longer a session or CSRF secret.
+- CORS no longer defaults to `*` outside production. Unset CORS is `APP_URL` locally and same-origin in production.
+- CSRF cookie is HttpOnly. JavaScript cannot read it.
+- Missing `emailVerifiedAt` now means unverified. This is a break for JWT and tokens that omitted the field.
+- Failed Bearer no longer authenticates via the session cookie.
+- `/ready` no longer returns checks unless `APP_DEBUG=true`.
+- Staging `/metrics` requires a token or returns 404.
+- Seed password is `StrataDemo!ChangeMe`.
+- SAML `saml:email:name` stub is gone.
+- MFA is when enrolled. Password login does not force enrollment.
+- `signedUrl()` without `expires` always fails verification.
+- SAML requires `SAML_IDP_ISSUER`. ACS compares assertion issuer to that value. Signed responses are required; production boot rejects `SAML_WANT_RESPONSE_SIGNED=false`.
+- OIDC ID tokens must be RS256 with JWKS. HS256 ID tokens are rejected.
+- Generated login tokens and JWTs mint `[]` abilities. SQL `api_tokens.abilities` default stays `[]`.
+- `--tenancy=rls` FORCE RLS is on `notes` and `users`. Auth directory lookups and cookie session loads use `runWithMigrationBypassForIdentifier`, which sets `app.bypass_identifier`. The helper does not rewrite SQL.
+- `GET /health`: `createHealthRoutes` without `pingOnHealth` is always 200 JSON and does not read notes. HiroApp `/health` is `schemaReady` (empty notes 200, unreadable not 200). Docker HEALTHCHECK fetches `/health`.
+
+### Controls
+
+- SAML ACS verifies HMAC RelayState (no SameSite cookie). Replay defaults to SQL `auth_saml_assertions.assertion_id` (unique insert). Tests may use an in-memory store. Both drop IDs after 1 hour (longer than typical assertion lifetime plus `acceptedClockSkewMs` 5000). ACS rejects a signed assertion whose issuer does not match `SAML_IDP_ISSUER`. Signed assertions and signed responses are required. AuthnContext is requested. JIT uses `currentTenantId()` and is skipped when `FEATURE_REGISTRATION=false`. `GET /auth/saml` does not set an unused OAuth state cookie. Enrolled MFA still challenges after SAML ACS.
+- `completePasswordLogin` runs on HTML password POST, HTML MFA POST, API token, JWT, and Basic mint paths, and cookie JSON password login. Recovery-code consumption is persisted on those paths. `verifyCredentials` returns null when `mfa_enabled` is true. Basic `verifyCredentials` fallback still runs TOTP when the directory record is enrolled. MFA is when enrolled, not on every password login. JwtGuard does not run TOTP on each request; it requires a directory and rejects `iat` before `session_valid_after`. SAML ACS redirects enrolled users to `/login/mfa`. MFA enroll revokes sessions and API tokens.
+- Password reset and email verify consume one-time tokens with `UPDATE ... consumed_at IS NULL`. Cookie sessions compare aliased `sessions.created_at` (`session_created_at`) to `session_valid_after`. Reset deletes `sessions` and `api_tokens` (missing tables only are swallowed). JwtGuard looks up the user and rejects tokens whose `iat` is before `session_valid_after`. Verify GET does not sign the visitor in.
+- `--tenancy=rls` ENABLE+FORCE RLS is on `notes` and `users`. `sessions`, `api_tokens`, and `auth_one_time_tokens` get a user-join policy plus an `app.bypass_identifier` pin on the real key columns. Session create/destroy, token mint, password/email/MFA user writes, and one-time token insert/consume wrap `runWithMigrationBypassForIdentifier()`, which `SET LOCAL app.bypass_identifier` and does not rewrite SQL. `ForIdentifier(user id)` may see that user's sessions and tokens; that is the session-create pin, not a one-row-only policy. Consume passes `hashOneTimeToken(token)`. Notes honour unbounded `app.bypass_rls()` or tenant id only. SCIM isolation is tenant GUC plus `WHERE tenant_id`. `currentTenantId()` and generated SCIM `tenantId()` throw if ALS is missing. `createHealthRoutes` without `pingOnHealth` is always 200 JSON. HiroApp `/health` is `schemaReady` (empty notes 200, unreadable not 200). `runWithMigrationBypass()` always opens its own transaction and remains for migrate/seed/audit. Generated Compose still creates a `postgres` superuser for volume init, GRANT, migrate, and `migrate:fresh` DROP (tables are owned by that superuser). Runtime `DATABASE_URL` / HiroApp `APP_DATABASE_URL` use `strata_app` (`NOBYPASSRLS`), including `--no-docker` and host e2e via `with-host-env.sh`. `db/ensure-postgres-app-role.sql` is repeatable on an existing volume. Live `pg_roles` runs on every rls runtime pool after it is open. Username `postgres`/`root` is the URL denylist fast path. Named superuser (`deploy`) is the live inspect. The HiroApp e2e denylist test is the postgres URL fast path. The live inspect e2e is `assertRlsLiveDatabaseRole()` on the `strata_app` pool. `assertProductionSecrets()` stays production-only.
+- SMTP rejects CR/LF. Envelope `MAIL FROM` / `RCPT TO` use the bare address. Display names stay on headers only. `MAIL_USERNAME` and `MAIL_PASSWORD` are checked before AUTH LOGIN writes. There is no SMTP e2e (`MAIL_DRIVER=log` in HiroApp e2e).
+- SSRF blocks non-canonical IPv4 (including leading-zero / octal / hex forms), integer hosts, and mapped IPv6. DNS resolve defaults on. `safeFetch` then connects to a resolved public IP and sends the original Host plus TLS server name. `allowPrivate: true` skips DNS only outside production.
+- API CSRF middleware runs on guest and session mutating requests. `POST /api/v1/auth/login` and `POST /api/auth/token` require double-submit CSRF. Session-mutating API (logout after cookie login) requires CSRF. `GET /api/v1/auth/csrf` Set-Cookies the HttpOnly CSRF cookie and returns that same token in JSON (it does not mint a second cookie). Nested API CSRF (`buildModuleRoutes` plus `wrap("api")`) reuses the first issued token. CSRF failures on the API group are JSON 403. Failed Bearer does not skip CSRF when `credentialSource` is null (`tests/unit/csrf.test.ts` `failed Bearer header does not skip CSRF when credentialSource is null`). Failed Bearer does not resolve a session or guest user (`tests/unit/authGuard.test.ts` `failed bearer does not fall back to a session or guest guard`). HiroApp e2e `cookie login requires CSRF and ignores garbage Bearer` is garbage Bearer still requiring CSRF on POST `/login`. Successful skip is `successful bearer or basic skips CSRF`. SCIM and SAML ACS skip CSRF by path. CORS allowlists `X-CSRF-Token` and, when reflecting a specific origin, sets `Access-Control-Allow-Credentials`. CSRF and session cookies stay `SameSite=Lax`. A foreign or missing `Origin` on a cookie mutating request is rejected even if the CSRF header matches. Cross-site SPAs stay on Bearer.
+- OIDC `getAuthorizationUrl()` throws. Use `createAuthorization()` and pass the handshake to `exchangeCode()`. Authorization, token, and JWKS URLs come from discovery. Inbound OIDC ID tokens are verified RS256 via discovery JWKS (`iss` / `aud` / `azp` / `at_hash` / `exp` / `nbf` / `nonce`). App JWTs stay HS256 (`signJwt`). Multi-valued `aud` requires `azp` equal to the client id. `at_hash` is verified when present; omitted `access_token` plus `at_hash` throws. Missing or unverified email throws. JWKS is refetched once when the token `kid` is missing from the cache. GitHub OAuth uses `safeFetch`, always reads `/user/emails`, and throws when no verified address exists (no `{login}@users.noreply.github.com`; unverified `profile.email` is ignored).
+- `protectMfaSecret` always encrypts and requires `KMS_ENCRYPTION_KEY`. Local and dogfood with `FEATURE_MFA=true` must set the key. When a KMS key is set, `revealMfaSecret` never returns plaintext. Production still refuses non-`enc:v1:`. Local without a key may still return plaintext. `verifyTotp` compares every window slot with `timingSafeCompareString`.
+- Safer defaults: `FEATURE_PUBLIC_READS`, `FEATURE_SIEM_EXPORT`, and `APP_DEBUG` default off. `DEFAULT_TENANT.plan` is `free`. SQL token-ability default is `[]`. Generated token login and JWT mint insert `[]`.
+- Token hashes are HMAC-peppered. Recovery codes are 16 bytes. bcrypt cost is 12.
+- Identity **response** headers `x-authenticated-user-id`, `x-tenant-id`, and `x-tenant-region` are never set. CORS still allowlists `X-Authenticated-User-Id`, `X-Authenticated-User-Role`, and `X-Tenant-Id`.
+- `GuestGuard`: production (`isProductionEnv`, including staging) is always null even when `AUTH_DEV_HEADERS=true`. Local `AUTH_DEV_HEADERS=true` still reads request headers.
+- Postgres unique-violation `detail` is logged, not returned. Client JSON is a generic conflict message with no constraint name.
+- Local disk paths go through `assertPathUnderRoot`.
+- Client `x-trace-id` is ignored unless `APP_DEBUG=true` and the value is 32 hex characters.
+- OpenAPI documents registered routes only. Generated `docs/API.md` lists the layer's live paths and does not include leftover `/webhooks` or `/billing` strings.
+- Root Compose Redis requires `dev-redis-change-me`. Root Compose Postgres uses `dev-postgres-change-me`. Root Compose MySQL uses `dev-mysql-change-me`. Host helper `scripts/with-host-env.sh` uses those passwords and points HiroApp `APP_DATABASE_URL` at `strata_app` / `dev-strata-app-change-me`. Fixture `DATABASE_URL` stays fixture admin for `bun_testing_test`. Production Compose Redis requires `REDIS_PASSWORD` and requires `APP_ENV` to be set. Production Compose `app`/`worker` runtime `DATABASE_URL` and `APP_DATABASE_URL` are `strata_app` after the split. `MIGRATION_DATABASE_URL` stays `${POSTGRES_USER}` for migrate. `STRATA_APP_PASSWORD` is required the same way `REDIS_PASSWORD` is. Bind stays `127.0.0.1:3000`. `127.0.0.1:54329` / `6379` / `33061` stay published. Adminer is debug-profile only. Prod compose file test plus HiroApp live-role e2e. This CI does not compose-up `docker-compose.prod.yml`.
+
+
 ## 1.0.9
 
 Label HiroApp as internal e2e dogfood and seed notes via Model

package/dist/core/auth/authContext.d.ts

@@ -1,3 +1,4 @@
+type CredentialSource = "session" | "bearer" | "basic" | "guest" | null;
 type AuthUser = {
     id: number | string;
     role?: string;
@@ -7,6 +8,8 @@ type AuthUser = {
 };
 declare const authContext: import("node:async_hooks").AsyncLocalStorage<AuthUser | null>;
 declare function runWithAuthUser<T>(user: AuthUser | null, callback: () => T | Promise<T>): T | Promise<T>;
+declare function runWithAuthContext<T>(user: AuthUser | null, credentialSource: CredentialSource, callback: () => T | Promise<T>): T | Promise<T>;
 declare function currentAuthUser(): AuthUser | null;
-export type { AuthUser };
-export { authContext, currentAuthUser, runWithAuthUser };
+declare function currentCredentialSource(): CredentialSource;
+export type { AuthUser, CredentialSource };
+export { authContext, currentAuthUser, currentCredentialSource, runWithAuthContext, runWithAuthUser, };

package/dist/core/auth/emailVerification.d.ts

@@ -1,5 +1,5 @@
 import type { AuthUser } from "./authContext";
 declare function isEmailVerificationRequired(): boolean;
-/** `null` is unverified. Missing/`undefined` (GuestGuard, legacy tokens) is treated as verified. */
+/** Missing, undefined, or null means unverified. */
 declare function hasVerifiedEmail(user: AuthUser): boolean;
 export { hasVerifiedEmail, isEmailVerificationRequired };

package/dist/core/auth/guard.d.ts

@@ -1,5 +1,5 @@
 import type { ServiceContainerLike } from "../contracts/serviceContainer";
-import type { AuthUser } from "./authContext";
+import type { AuthUser, CredentialSource } from "./authContext";
 interface AuthGuard {
     resolve(request: Request): AuthUser | null | Promise<AuthUser | null>;
 }
@@ -32,6 +32,10 @@ declare class AuthManager {
     use(name?: string): AuthGuard;
     guardNames(): string[];
     resolve(request?: Request): Promise<AuthUser | null>;
+    resolveWithSource(request?: Request): Promise<{
+        user: AuthUser | null;
+        credentialSource: CredentialSource;
+    }>;
     user(request?: Request): Promise<AuthUser | null>;
     check(request?: Request): Promise<boolean>;
     requireUser(request?: Request): Promise<AuthUser>;

package/dist/core/auth/jwtGuard.d.ts

@@ -1,14 +1,18 @@
+import type { AuthUserDirectory } from "../contracts/authUserDirectory";
+import type { ServiceContainerLike } from "../contracts/serviceContainer";
 import type { AuthUser } from "./authContext";
 import type { AuthGuard } from "./guard";
 import { type JwtPayload } from "./jwt";
 interface JwtGuardOptions {
     secret?: string;
+    directory?: AuthUserDirectory;
+    container?: ServiceContainerLike;
 }
 declare function authUserFromJwt(payload: JwtPayload): AuthUser;
 declare class JwtGuard implements AuthGuard {
     private readonly options;
-    constructor(options?: JwtGuardOptions);
-    resolve(request: Request): AuthUser | null;
+    constructor(options?: JwtGuardOptions | ServiceContainerLike);
+    resolve(request: Request): Promise<AuthUser | null>;
 }
 export type { JwtGuardOptions };
 export { authUserFromJwt, JwtGuard };

package/dist/core/auth/oauth/oidcIdToken.d.ts

@@ -0,0 +1,19 @@
+import type { JwtPayload } from "../jwt";
+interface OidcDiscovery {
+    issuer?: string;
+    authorization_endpoint?: string;
+    token_endpoint?: string;
+    jwks_uri?: string;
+}
+declare function loadOidcDiscovery(issuer: string): Promise<OidcDiscovery>;
+declare function oidcAccessTokenHash(accessToken: string): string;
+declare function verifyOidcIdToken(token: string, options: {
+    issuer: string;
+    clientId: string;
+    nonce: string;
+    jwksUri: string;
+    accessToken?: string;
+}): Promise<JwtPayload>;
+declare function resetOidcDiscoveryCacheForTests(): void;
+export type { OidcDiscovery };
+export { loadOidcDiscovery, oidcAccessTokenHash, resetOidcDiscoveryCacheForTests, verifyOidcIdToken, };

package/dist/core/auth/oauth/oidcProvider.d.ts

@@ -1,3 +1,4 @@
+import { resetOidcDiscoveryCacheForTests } from "./oidcIdToken";
 import type { OAuthProfile, OAuthProvider } from "./types";
 interface OidcProviderOptions {
     name: string;
@@ -7,12 +8,23 @@ interface OidcProviderOptions {
     redirectUri: string;
     scopes?: string[];
 }
+interface OidcHandshake {
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+}
+declare function createOidcHandshake(): OidcHandshake;
 declare class OidcProvider implements OAuthProvider {
     private readonly options;
     readonly name: string;
     constructor(options: OidcProviderOptions);
-    getAuthorizationUrl(state: string, redirectUri?: string): string;
-    exchangeCode(code: string, redirectUri?: string): Promise<OAuthProfile>;
+    getAuthorizationUrl(_state: string, _redirectUri?: string): string;
+    createAuthorization(state?: string, redirectUri?: string): Promise<{
+        url: string;
+        handshake: OidcHandshake;
+    }>;
+    private buildAuthorizationUrl;
+    exchangeCode(code: string, redirectUri?: string, handshake?: Pick<OidcHandshake, "nonce" | "codeVerifier">): Promise<OAuthProfile>;
 }
-export type { OidcProviderOptions };
-export { OidcProvider };
+export type { OidcHandshake, OidcProviderOptions };
+export { createOidcHandshake, OidcProvider, resetOidcDiscoveryCacheForTests };

package/dist/core/auth/oauth/samlProvider.d.ts

@@ -1,9 +1,12 @@
+import { type SamlServiceProviderOptions } from "../saml/samlServiceProvider";
 import type { OAuthProfile, OAuthProvider } from "./types";
 declare class SamlProvider implements OAuthProvider {
-    private readonly loginUrl;
     readonly name = "saml";
-    constructor(loginUrl: string);
-    getAuthorizationUrl(state: string): string;
-    exchangeCode(code: string): Promise<OAuthProfile>;
+    private readonly provider;
+    constructor(options: SamlServiceProviderOptions | string);
+    getAuthorizationUrl(_state: string): string;
+    exchangeCode(_code: string): Promise<OAuthProfile>;
+    authorizationUrl(relayState: string): Promise<string>;
+    consumePost(samlResponse: string, relayState?: string): Promise<OAuthProfile>;
 }
 export { SamlProvider };

package/dist/core/auth/oneTimeToken.d.ts

@@ -0,0 +1,19 @@
+declare const AUTH_ONE_TIME_PURPOSES: {
+    readonly passwordReset: "password_reset";
+    readonly emailVerify: "email_verify";
+};
+type AuthOneTimePurpose = (typeof AUTH_ONE_TIME_PURPOSES)[keyof typeof AUTH_ONE_TIME_PURPOSES];
+declare function generateOneTimeToken(): {
+    plain: string;
+    hash: string;
+};
+declare function hashOneTimeToken(plain: string): string;
+type SqlClient = {
+    unsafe<T>(query: string, params?: readonly unknown[]): Promise<T[]>;
+};
+declare function consumeOneTimeToken(sql: SqlClient, purpose: string, plain: string, now?: Date): Promise<number | null>;
+declare function revokeUserSessions(sql: SqlClient, userId: number, options?: {
+    revokeApiTokens?: boolean;
+}): Promise<void>;
+export type { AuthOneTimePurpose };
+export { AUTH_ONE_TIME_PURPOSES, consumeOneTimeToken, generateOneTimeToken, hashOneTimeToken, revokeUserSessions, };

package/dist/core/auth/passwordLogin.d.ts

@@ -0,0 +1,20 @@
+import type { AuthUserRecord } from "../contracts/authUserDirectory";
+type PasswordLoginFailure = "mfa_required" | "mfa_invalid";
+type PasswordLoginSuccess = {
+    ok: true;
+    consumedRecoveryHash?: string;
+};
+type PasswordLoginDenied = {
+    ok: false;
+    error: PasswordLoginFailure;
+};
+type PasswordLoginResult = PasswordLoginSuccess | PasswordLoginDenied;
+declare function parseRecoveryHashes(raw: string | null | undefined): string[];
+declare function completePasswordLogin(user: Pick<AuthUserRecord, "mfa_enabled" | "mfa_secret" | "mfa_recovery_codes">, options?: {
+    mfaCode?: string | null;
+}): PasswordLoginResult;
+declare function persistConsumedRecoveryHash(sql: {
+    unsafe(query: string, params?: readonly unknown[]): Promise<unknown[]>;
+}, userId: number, currentRaw: string | null | undefined, consumedHash: string | undefined): Promise<void>;
+export type { PasswordLoginResult };
+export { completePasswordLogin, parseRecoveryHashes, persistConsumedRecoveryHash };

package/dist/core/auth/saml/samlAssertionReplay.d.ts

@@ -0,0 +1,20 @@
+interface SamlAssertionReplayStore {
+    consume(assertionId: string): Promise<void>;
+}
+/**
+ * Drop stored IDs only after SAML NotOnOrAfter would already reject them.
+ * 1 hour is longer than typical assertion lifetimes (minutes) plus
+ * SamlServiceProvider acceptedClockSkewMs (5000).
+ */
+declare const REPLAY_RETENTION_MS: number;
+declare class InMemorySamlAssertionReplayStore implements SamlAssertionReplayStore {
+    private readonly seen;
+    consume(assertionId: string): Promise<void>;
+    clear(): void;
+    private gc;
+}
+declare function setSamlAssertionReplayStoreForTests(store: SamlAssertionReplayStore | null): void;
+declare function resetSamlReplayCacheForTests(): void;
+declare function consumeSamlAssertion(assertionId: string): Promise<void>;
+export type { SamlAssertionReplayStore };
+export { consumeSamlAssertion, InMemorySamlAssertionReplayStore, REPLAY_RETENTION_MS, resetSamlReplayCacheForTests, setSamlAssertionReplayStoreForTests, };

package/dist/core/auth/saml/samlServiceProvider.d.ts

@@ -0,0 +1,51 @@
+import type { OAuthProfile } from "../oauth/types";
+import { consumeSamlAssertion, InMemorySamlAssertionReplayStore, REPLAY_RETENTION_MS, resetSamlReplayCacheForTests, setSamlAssertionReplayStoreForTests } from "./samlAssertionReplay";
+interface SamlServiceProviderOptions {
+    idpSsoUrl: string;
+    idpCert: string;
+    spEntityId: string;
+    acsUrl: string;
+    idpIssuer: string;
+    wantAssertionsSigned?: boolean;
+    wantAuthnResponseSigned?: boolean;
+    disableRequestedAuthnContext?: boolean;
+}
+interface NodeSamlProfile {
+    ID?: string;
+    nameID?: string;
+    email?: string;
+    name?: string;
+    issuer?: string;
+    sessionIndex?: string | string[];
+    getAssertion?: () => {
+        Assertion?: {
+            $?: {
+                ID?: string;
+            };
+        };
+    };
+    [key: string]: unknown;
+}
+type NodeSamlClient = {
+    getAuthorizeUrlAsync(relayState: string, host: string | undefined, options: object): Promise<string>;
+    validatePostResponseAsync(container: Record<string, string>): Promise<{
+        profile: NodeSamlProfile | null;
+        loggedOut: boolean;
+    }>;
+};
+declare function readSamlEnvOptions(): SamlServiceProviderOptions;
+type NodeSamlModule = {
+    SAML: new (options: Record<string, unknown>) => NodeSamlClient;
+};
+declare function setNodeSamlLoaderForTests(loader: (() => Promise<NodeSamlModule>) | null): void;
+declare class SamlServiceProvider {
+    private readonly options;
+    private client;
+    constructor(options: SamlServiceProviderOptions);
+    private getClient;
+    authorizationUrl(relayState: string): Promise<string>;
+    consumePost(samlResponse: string, relayState?: string): Promise<OAuthProfile>;
+}
+declare function createSamlServiceProvider(options?: SamlServiceProviderOptions): SamlServiceProvider;
+export type { SamlServiceProviderOptions };
+export { consumeSamlAssertion, createSamlServiceProvider, InMemorySamlAssertionReplayStore, REPLAY_RETENTION_MS, readSamlEnvOptions, resetSamlReplayCacheForTests, SamlServiceProvider, setNodeSamlLoaderForTests, setSamlAssertionReplayStoreForTests, };

package/dist/core/contracts/authUserDirectory.d.ts

@@ -6,6 +6,7 @@ interface AuthUserRecord {
     role: string;
     email_verified_at?: Date | string | null;
     session_valid_after?: Date | string | null;
+    password?: string | null;
     mfa_enabled?: boolean;
     mfa_secret?: string | null;
     mfa_recovery_codes?: string | null;
@@ -14,9 +15,7 @@ interface AuthUserDirectory {
     resolveUserFromToken(token: string): Promise<AuthUser | null>;
     findByIdOrThrow(id: number): Promise<AuthUserRecord>;
     hasActiveBrowserSession?(userId: number, issuedAt: number): Promise<boolean>;
-    findByEmail?(email: string): Promise<(AuthUserRecord & {
-        password?: string | null;
-    }) | null>;
+    findByEmail?(email: string): Promise<AuthUserRecord | null>;
     verifyCredentials?(email: string, password: string): Promise<AuthUser | null>;
 }
 export type { AuthUserDirectory, AuthUserRecord };

package/dist/core/database/errors.d.ts

@@ -13,4 +13,5 @@ declare function isPostgresError(error: unknown): error is PostgresErrorLike;
  */
 declare function mapDatabaseError(error: unknown): HttpError;
 declare function withDatabaseErrorHandling<TValue>(operation: () => Promise<TValue>): Promise<TValue>;
-export { isPostgresError, mapDatabaseError, withDatabaseErrorHandling };
+declare function isUniqueConstraintError(error: unknown): boolean;
+export { isPostgresError, isUniqueConstraintError, mapDatabaseError, withDatabaseErrorHandling };

package/dist/core/http/response.d.ts

@@ -1,7 +1,9 @@
+import type { Middleware } from "./middleware";
 declare function jsonResponse(data: unknown, init?: ResponseInit): Response;
 declare function createdResponse(data: unknown, init?: ResponseInit): Response;
 declare function noContentResponse(): Response;
 declare function errorResponse(error: unknown): Response;
 declare function withErrorHandling<TArgs extends unknown[]>(handler: (...args: TArgs) => Response | Promise<Response>): (...args: TArgs) => Promise<Response>;
 declare function withJsonErrorHandling<TArgs extends unknown[]>(handler: (...args: TArgs) => Response | Promise<Response>): (...args: TArgs) => Promise<Response>;
-export { createdResponse, errorResponse, jsonResponse, noContentResponse, withErrorHandling, withJsonErrorHandling, };
+declare function createJsonErrorMiddleware(): Middleware;
+export { createdResponse, createJsonErrorMiddleware, errorResponse, jsonResponse, noContentResponse, withErrorHandling, withJsonErrorHandling, };

package/dist/core/mail/mailer.d.ts

@@ -17,6 +17,11 @@ interface SmtpConfig {
 }
 type SmtpTransport = (config: SmtpConfig, message: MailMessage) => Promise<void>;
 declare function resolveSmtpConfig(): SmtpConfig;
+declare function assertSafeSmtpField(value: string, field: string): string;
+declare function smtpEnvelopeAddress(value: string, field: string): string;
+declare function assertSafeSmtpAddress(value: string, field: string): string;
+declare function redactMailBody(body: string): string;
+declare function defaultSmtpTransport(config: SmtpConfig, message: MailMessage): Promise<void>;
 declare function buildSmtpPayload(from: string, message: MailMessage): string;
 declare class LogMailDriver implements MailDriver {
     send(message: MailMessage): Promise<void>;
@@ -35,4 +40,4 @@ declare class Mailer {
 declare function createMailDriver(): MailDriver;
 declare function mailer(): Mailer;
 export type { MailDriver, MailMessage, SmtpConfig, SmtpTransport };
-export { buildSmtpPayload, createMailDriver, LogMailDriver, Mailer, mailer, resolveSmtpConfig, SmtpMailDriver, };
+export { assertSafeSmtpAddress, assertSafeSmtpField, buildSmtpPayload, createMailDriver, defaultSmtpTransport, LogMailDriver, Mailer, mailer, redactMailBody, resolveSmtpConfig, SmtpMailDriver, smtpEnvelopeAddress, };

package/dist/core/security/oauthState.d.ts

@@ -1,8 +1,12 @@
 declare const OAUTH_STATE_COOKIE = "oauth_state";
+declare function verifySignedOAuthStateValue(value: string): boolean;
+declare function createOAuthState(): {
+    state: string;
+};
 declare function createOAuthStateCookie(): {
     state: string;
     cookie: string;
 };
-declare function verifyOAuthState(request: Request, returnedState: string | null): boolean;
+declare function verifyOAuthState(_request: Request, returnedState: string | null): boolean;
 declare function clearOAuthStateCookie(): string;
-export { clearOAuthStateCookie, createOAuthStateCookie, OAUTH_STATE_COOKIE, verifyOAuthState };
+export { clearOAuthStateCookie, createOAuthState, createOAuthStateCookie, OAUTH_STATE_COOKIE, verifyOAuthState, verifySignedOAuthStateValue, };

package/dist/core/security/safeFetch.d.ts

@@ -4,6 +4,7 @@ interface SafeFetchOptions {
     maxRedirects?: number;
     allowHttp?: boolean;
     resolveDns?: boolean;
+    allowPrivate?: boolean;
 }
 declare function safeFetch(input: string, init?: RequestInit, options?: SafeFetchOptions): Promise<Response>;
 export type { SafeFetchOptions };

package/dist/core/security/safePath.d.ts

@@ -0,0 +1,4 @@
+declare function assertPathUnderRoot(rootDirectory: string, userPath: string): string;
+/** Map a URL pathname onto a document root. Leading slashes are not filesystem-absolute. */
+declare function assertUrlPathUnderRoot(rootDirectory: string, urlPathname: string): string;
+export { assertPathUnderRoot, assertUrlPathUnderRoot };

package/dist/core/security/safeUrl.d.ts

@@ -9,12 +9,25 @@ type DnsLookup = (hostname: string, options: {
 declare function isBlockedHostname(hostname: string): boolean;
 declare function assertSafeOutboundUrl(rawUrl: string, options?: {
     allowHttp?: boolean;
+    allowPrivate?: boolean;
 }): URL;
 declare function isBlockedIpAddress(address: string): boolean;
+declare function pinUrlToAddress(url: URL, address: string): URL;
+interface ResolvedOutboundUrl {
+    url: URL;
+    addresses: string[];
+}
+declare function resolveSafeOutboundTarget(rawUrl: string, options?: {
+    allowHttp?: boolean;
+    resolveDns?: boolean;
+    allowPrivate?: boolean;
+}): Promise<ResolvedOutboundUrl>;
 declare function assertSafeOutboundUrlResolved(rawUrl: string, options?: {
     allowHttp?: boolean;
     resolveDns?: boolean;
+    allowPrivate?: boolean;
 }): Promise<URL>;
 declare function setDnsLookupForTests(lookupFn: DnsLookup): void;
 declare function resetDnsLookupForTests(): void;
-export { assertSafeOutboundUrl, assertSafeOutboundUrlResolved, isBlockedHostname, isBlockedIpAddress, resetDnsLookupForTests, setDnsLookupForTests, };
+export type { ResolvedOutboundUrl };
+export { assertSafeOutboundUrl, assertSafeOutboundUrlResolved, isBlockedHostname, isBlockedIpAddress, pinUrlToAddress, resetDnsLookupForTests, resolveSafeOutboundTarget, setDnsLookupForTests, };

package/dist/core/security/totp.d.ts

@@ -4,6 +4,6 @@ declare function buildOtpauthUrl(options: {
     account: string;
     issuer?: string;
 }): string;
-declare function generateTotp(secret: string, counter: number, digits?: number): string;
+declare function generateTotp(secret: string, counter?: number, digits?: number): string;
 declare function verifyTotp(secret: string, token: string, window?: number): boolean;
 export { buildOtpauthUrl, generateTotp, generateTotpSecret, verifyTotp };

package/dist/core/tenant/databaseTenantContext.d.ts

@@ -1,2 +1,3 @@
 declare function runWithMigrationBypass<T>(callback: () => T | Promise<T>): Promise<T>;
-export { runWithMigrationBypass };
+declare function runWithMigrationBypassForIdentifier<T>(identifier: string | number, callback: () => T | Promise<T>): Promise<T>;
+export { runWithMigrationBypass, runWithMigrationBypassForIdentifier };

package/dist/core/tenant/enableTenantRls.d.ts

@@ -0,0 +1,6 @@
+declare const RLS_HELPER_SQL = "\nCREATE OR REPLACE FUNCTION app_bypass_rls()\nRETURNS BOOLEAN AS $$\nBEGIN\n  RETURN COALESCE(current_setting('app.bypass_rls', true), 'false') = 'true';\nEXCEPTION\n  WHEN others THEN\n    RETURN FALSE;\nEND;\n$$ LANGUAGE plpgsql STABLE;\n\nCREATE OR REPLACE FUNCTION app_bypass_identifier()\nRETURNS TEXT AS $$\nBEGIN\n  RETURN NULLIF(current_setting('app.bypass_identifier', true), '');\nEXCEPTION\n  WHEN others THEN\n    RETURN NULL;\nEND;\n$$ LANGUAGE plpgsql STABLE;\n\nCREATE OR REPLACE FUNCTION app_current_tenant_id()\nRETURNS INTEGER AS $$\nBEGIN\n  RETURN NULLIF(current_setting('app.tenant_id', true), '')::INTEGER;\nEXCEPTION\n  WHEN others THEN\n    RETURN NULL;\nEND;\n$$ LANGUAGE plpgsql STABLE;\n";
+declare function enableTenantRlsSql(tableName: string): string;
+declare function enableUserOwnedRlsSql(tableName: string, userIdColumn?: string): string;
+declare function generatedRlsBootstrapSql(tables: readonly string[], userOwnedTables?: readonly string[]): string;
+export { assertPostgresRoleCannotBypassRls, dropPostgresTablesAsAdmin, ensurePostgresAppRole, ensurePostgresDatabaseAndAppRole, grantPostgresAppRolePrivileges, inspectCurrentPostgresRole, isPostgresUrl, openPostgresAdminConnection, POSTGRES_APP_ROLE, POSTGRES_APP_ROLE_PASSWORD, POSTGRES_SUPERUSER_PASSWORD, postgresAppRoleSql, postgresDatabaseNameFromUrl, postgresUrlUsername, } from "./postgresAppRole";
+export { enableTenantRlsSql, enableUserOwnedRlsSql, generatedRlsBootstrapSql, RLS_HELPER_SQL };

package/dist/core/tenant/postgresAppRole.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Application Postgres login role for FORCE RLS.
+ *
+ * Superuser (typically `postgres`) may CREATE ROLE, CREATE DATABASE, GRANT,
+ * migrate, and migrate:fresh DROP TABLE. Tables are owned by the role that ran
+ * CREATE TABLE, so the NOBYPASSRLS runtime role cannot drop them. Runtime
+ * DATABASE_URL / APP_DATABASE_URL must be this NOBYPASSRLS role.
+ * docker-entrypoint-initdb.d only runs on an empty volume; call
+ * ensurePostgresDatabaseAndAppRole() on every boot so existing volumes get the
+ * same role and table GRANTs after migrate:fresh.
+ *
+ * Admin DDL (GRANT ALL TABLES, CREATE TABLE, DROP TABLE) must run on the
+ * application database. postgres/template1 are only for CREATE DATABASE.
+ */
+declare const POSTGRES_APP_ROLE = "strata_app";
+declare const POSTGRES_APP_ROLE_PASSWORD = "dev-strata-app-change-me";
+declare const POSTGRES_SUPERUSER_PASSWORD = "dev-postgres-change-me";
+declare const LEGACY_POSTGRES_SUPERUSER_PASSWORD = "postgres";
+type PostgresSql = {
+    unsafe<T>(query: string, params?: readonly unknown[]): Promise<T[]>;
+    close?: () => Promise<void> | void;
+};
+type ConnectPostgres = (url: string) => PostgresSql;
+type LivePostgresRole = {
+    rolname: string;
+    rolsuper: boolean;
+    rolbypassrls: boolean;
+};
+type PostgresAdminOptions = {
+    runtimeUrl: string;
+    migrationUrl?: string;
+    superuserPassword?: string;
+    connect?: ConnectPostgres;
+};
+declare function assertSafeSqlIdentifier(identifier: string, label: string): string;
+declare function quoteSqlLiteral(value: string): string;
+declare function isPostgresUrl(raw: string | undefined): boolean;
+declare function postgresUrlUsername(raw: string): string | null;
+declare function postgresDatabaseNameFromUrl(raw: string): string;
+declare function postgresAdminUrls(options: {
+    runtimeUrl: string;
+    migrationUrl?: string;
+    superuserPassword?: string;
+}): string[];
+declare function openPostgresAdminConnection(options: PostgresAdminOptions): Promise<PostgresSql>;
+declare function postgresAppRoleCreateSql(options?: {
+    role?: string;
+    password?: string;
+}): string;
+declare function postgresAppRoleSql(options: {
+    database: string;
+    role?: string;
+    password?: string;
+}): string;
+declare function grantPostgresAppRolePrivileges(sql: PostgresSql, options: {
+    database: string;
+    role?: string;
+}): Promise<void>;
+declare function ensurePostgresAppRole(sql: PostgresSql, options: {
+    database: string;
+    role?: string;
+    password?: string;
+}): Promise<void>;
+declare function ensurePostgresDatabaseAndAppRole(options: {
+    runtimeUrl: string;
+    migrationUrl?: string;
+    role?: string;
+    password?: string;
+    connect?: ConnectPostgres;
+}): Promise<string>;
+declare function dropPostgresTablesAsAdmin(tables: readonly string[], options: PostgresAdminOptions): Promise<void>;
+declare function inspectCurrentPostgresRole(sql: PostgresSql): Promise<LivePostgresRole | null>;
+declare function assertPostgresRoleCannotBypassRls(role: LivePostgresRole | null, source?: string): void;
+export type { ConnectPostgres, LivePostgresRole, PostgresSql };
+export { assertPostgresRoleCannotBypassRls, assertSafeSqlIdentifier, dropPostgresTablesAsAdmin, ensurePostgresAppRole, ensurePostgresDatabaseAndAppRole, grantPostgresAppRolePrivileges, inspectCurrentPostgresRole, isPostgresUrl, LEGACY_POSTGRES_SUPERUSER_PASSWORD, openPostgresAdminConnection, POSTGRES_APP_ROLE, POSTGRES_APP_ROLE_PASSWORD, POSTGRES_SUPERUSER_PASSWORD, postgresAdminUrls, postgresAppRoleCreateSql, postgresAppRoleSql, postgresDatabaseNameFromUrl, postgresUrlUsername, quoteSqlLiteral, };