@getstrata/core 1.0.9 → 1.1.0

package/dist/entries/auth/saml/samlServiceProvider.js

@@ -0,0 +1,571 @@
+// @bun
+// ../../src/core/runtime/optionalPeer.ts
+function missingOptionalPeer(packageName, reason, error) {
+  return new Error(`Install ${packageName} ${reason} (\`bun add ${packageName}\`).`, {
+    cause: error
+  });
+}
+
+// ../../src/core/security/timingSafeCompare.ts
+import { timingSafeEqual } from "crypto";
+function timingSafeCompareString(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  if (leftBuffer.length !== rightBuffer.length) {
+    return false;
+  }
+  return timingSafeEqual(leftBuffer, rightBuffer);
+}
+
+// ../../src/core/database/boundConnection.ts
+var BOUND_CONNECTION_KEY = Symbol.for("@getstrata/boundDatabaseConnection");
+function boundConnectionState() {
+  const globalRecord = globalThis;
+  const existing = globalRecord[BOUND_CONNECTION_KEY];
+  if (existing) {
+    return existing;
+  }
+  const created = { connection: null };
+  globalRecord[BOUND_CONNECTION_KEY] = created;
+  return created;
+}
+function getBoundDatabaseConnection() {
+  return boundConnectionState().connection;
+}
+
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+
+// ../../src/core/database/connectionContext.ts
+var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
+function runWithDatabaseConnection(connection, callback) {
+  return activeConnection.run(connection, callback);
+}
+function getActiveDatabaseConnection(fallback) {
+  return activeConnection.getStore() ?? fallback;
+}
+function hasActiveDatabaseConnection() {
+  return activeConnection.getStore() !== undefined;
+}
+
+// ../../src/core/database/queryProxy.ts
+var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+
+// ../../src/core/database/defaultConnection.ts
+var DEFAULT_CONNECTION_KEY = Symbol.for("@getstrata/defaultDatabaseConnection");
+function defaultConnectionState() {
+  const globalRecord = globalThis;
+  const existing = globalRecord[DEFAULT_CONNECTION_KEY];
+  if (existing) {
+    return existing;
+  }
+  const created = { pool: null, query: null };
+  globalRecord[DEFAULT_CONNECTION_KEY] = created;
+  return created;
+}
+function getDefaultDatabasePool() {
+  const pool = defaultConnectionState().pool;
+  if (!pool) {
+    throw new Error("Default database pool is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
+  }
+  return pool;
+}
+
+// ../../src/core/database/schema/driver.ts
+function normalizeConnectionName(connection) {
+  const normalized = connection.trim().toLowerCase();
+  if (normalized === "pgsql" || normalized === "postgres" || normalized === "postgresql") {
+    return "pgsql";
+  }
+  if (normalized === "mysql" || normalized === "mariadb") {
+    return "mysql";
+  }
+  if (normalized === "sqlite") {
+    return "sqlite";
+  }
+  throw new Error(`Unsupported DB_CONNECTION: ${connection}`);
+}
+function resolveDriverFromUrl(url) {
+  const normalized = url.trim().toLowerCase();
+  if (normalized.startsWith("postgres://") || normalized.startsWith("postgresql://") || normalized.startsWith("postgres:")) {
+    return "pgsql";
+  }
+  if (normalized.startsWith("mysql://") || normalized.startsWith("mysql:")) {
+    return "mysql";
+  }
+  if (normalized.startsWith("sqlite:")) {
+    return "sqlite";
+  }
+  return null;
+}
+function resolveDatabaseDriver(options = {}) {
+  const connection = options.connection ?? process.env.DB_CONNECTION;
+  if (connection) {
+    return normalizeConnectionName(connection);
+  }
+  const url = options.url ?? process.env.DATABASE_URL ?? "";
+  const fromUrl = resolveDriverFromUrl(url);
+  if (fromUrl) {
+    return fromUrl;
+  }
+  return "pgsql";
+}
+
+// ../../src/core/database/dialect.ts
+function assertSafeIdentifier(identifier) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
+    throw new Error(`Invalid SQL identifier: ${identifier}`);
+  }
+  return identifier;
+}
+function quoteIdentifierFor(dialect, column) {
+  return dialect.quoteIdentifier(column);
+}
+var postgresDialect = {
+  driver: "pgsql",
+  placeholder(index) {
+    return `$${index}`;
+  },
+  quoteIdentifier(identifier) {
+    return `"${assertSafeIdentifier(identifier)}"`;
+  },
+  nowExpression() {
+    return "NOW()";
+  },
+  timestampValue(value) {
+    return value.toISOString();
+  },
+  returningClause(columns) {
+    return ` RETURNING ${columns}`;
+  },
+  ilikeOperator() {
+    return "ILIKE";
+  },
+  nullsLastSuffix() {
+    return " NULLS LAST";
+  },
+  castToText(expression) {
+    return `${expression}::text`;
+  },
+  upsertSuffix(conflictColumns, updateColumns) {
+    const target = conflictColumns.map((column) => quoteIdentifierFor(this, column)).join(", ");
+    if (updateColumns.length === 0) {
+      return ` ON CONFLICT (${target}) DO NOTHING`;
+    }
+    const assignments = updateColumns.map((column) => {
+      const quoted = quoteIdentifierFor(this, column);
+      return `${quoted} = excluded.${quoted}`;
+    }).join(", ");
+    return ` ON CONFLICT (${target}) DO UPDATE SET ${assignments}`;
+  }
+};
+var mysqlDialect = {
+  driver: "mysql",
+  placeholder() {
+    return "?";
+  },
+  quoteIdentifier(identifier) {
+    return `\`${assertSafeIdentifier(identifier)}\``;
+  },
+  nowExpression() {
+    return "CURRENT_TIMESTAMP";
+  },
+  timestampValue(value) {
+    return value.toISOString().slice(0, 19).replace("T", " ");
+  },
+  returningClause() {
+    return "";
+  },
+  ilikeOperator() {
+    return "LIKE";
+  },
+  nullsLastSuffix() {
+    return "";
+  },
+  castToText(expression) {
+    return `CAST(${expression} AS CHAR)`;
+  },
+  upsertSuffix(conflictColumns, updateColumns) {
+    if (updateColumns.length === 0) {
+      const anchor = quoteIdentifierFor(this, conflictColumns[0] ?? "");
+      return ` ON DUPLICATE KEY UPDATE ${anchor} = ${anchor}`;
+    }
+    const assignments = updateColumns.map((column) => {
+      const quoted = quoteIdentifierFor(this, column);
+      return `${quoted} = VALUES(${quoted})`;
+    }).join(", ");
+    return ` ON DUPLICATE KEY UPDATE ${assignments}`;
+  }
+};
+var sqliteDialect = {
+  driver: "sqlite",
+  placeholder() {
+    return "?";
+  },
+  quoteIdentifier(identifier) {
+    return `"${assertSafeIdentifier(identifier)}"`;
+  },
+  nowExpression() {
+    return "strftime('%Y-%m-%dT%H:%M:%fZ', 'now')";
+  },
+  timestampValue(value) {
+    return value.toISOString();
+  },
+  returningClause(columns) {
+    return ` RETURNING ${columns}`;
+  },
+  ilikeOperator() {
+    return "LIKE";
+  },
+  nullsLastSuffix() {
+    return "";
+  },
+  castToText(expression) {
+    return `CAST(${expression} AS TEXT)`;
+  },
+  upsertSuffix(conflictColumns, updateColumns) {
+    const target = conflictColumns.map((column) => quoteIdentifierFor(this, column)).join(", ");
+    if (updateColumns.length === 0) {
+      return ` ON CONFLICT (${target}) DO NOTHING`;
+    }
+    const assignments = updateColumns.map((column) => {
+      const quoted = quoteIdentifierFor(this, column);
+      return `${quoted} = excluded.${quoted}`;
+    }).join(", ");
+    return ` ON CONFLICT (${target}) DO UPDATE SET ${assignments}`;
+  }
+};
+var dialects = {
+  pgsql: postgresDialect,
+  mysql: mysqlDialect,
+  sqlite: sqliteDialect
+};
+var dialectContext = createAsyncContextStore("@getstrata/sqlDialect");
+var dialectOverride = null;
+function dialectFor(driver) {
+  return dialects[driver];
+}
+function currentSqlDialect() {
+  return dialectContext.getStore() ?? dialectOverride ?? dialectFor(resolveDatabaseDriver());
+}
+
+// ../../src/core/database/errors.ts
+import {
+  BadRequestError,
+  ConflictError,
+  InternalServerError,
+  toHttpError,
+  UnprocessableEntityError
+} from "@getstrata/core/errors/http";
+function isPostgresError(error) {
+  return typeof error === "object" && error !== null && (("errno" in error) || ("code" in error));
+}
+function getPostgresSqlState(error) {
+  if (typeof error.errno === "string" && /^\d{5}$/.test(error.errno)) {
+    return error.errno;
+  }
+  if (typeof error.errno === "number") {
+    return String(error.errno).padStart(5, "0");
+  }
+  if (typeof error.code === "string" && /^\d{5}$/.test(error.code)) {
+    return error.code;
+  }
+  return;
+}
+var MYSQL_ERRNO_MESSAGES = {
+  1062: () => new ConflictError("A record with these values already exists."),
+  1451: () => new UnprocessableEntityError("Record is still referenced by other records."),
+  1452: () => new UnprocessableEntityError("Referenced record does not exist."),
+  1048: () => new BadRequestError("Required field is missing."),
+  3819: () => new BadRequestError("Value violates a database constraint.")
+};
+function mapSqliteError(error) {
+  const code = typeof error.code === "string" ? error.code : "";
+  if (!code.startsWith("SQLITE_")) {
+    return null;
+  }
+  if (code === "SQLITE_CONSTRAINT_UNIQUE" || code === "SQLITE_CONSTRAINT_PRIMARYKEY") {
+    return new ConflictError("A record with these values already exists.");
+  }
+  if (code === "SQLITE_CONSTRAINT_FOREIGNKEY") {
+    return new UnprocessableEntityError("Referenced record does not exist.");
+  }
+  if (code === "SQLITE_CONSTRAINT_NOTNULL") {
+    return new BadRequestError("Required field is missing.");
+  }
+  if (code.startsWith("SQLITE_CONSTRAINT")) {
+    return new BadRequestError("Value violates a database constraint.");
+  }
+  return new InternalServerError("Database operation failed.");
+}
+function mapMysqlError(error) {
+  const code = typeof error.code === "string" ? error.code : "";
+  if (!code.startsWith("ER_")) {
+    return null;
+  }
+  const factory = typeof error.errno === "number" ? MYSQL_ERRNO_MESSAGES[error.errno] : undefined;
+  return factory ? factory() : new InternalServerError("Database operation failed.");
+}
+function mapDatabaseError(error) {
+  const httpError = toHttpError(error);
+  if (httpError) {
+    return httpError;
+  }
+  if (!isPostgresError(error)) {
+    return new InternalServerError;
+  }
+  const sqlite = mapSqliteError(error);
+  if (sqlite) {
+    return sqlite;
+  }
+  const mysql = mapMysqlError(error);
+  if (mysql) {
+    return mysql;
+  }
+  const sqlState = getPostgresSqlState(error);
+  switch (sqlState) {
+    case "23505":
+      if (error.detail) {
+        console.error("[database] unique violation", error.detail);
+      }
+      return new ConflictError("A record with these values already exists.");
+    case "23503":
+      if (error.detail) {
+        console.error("[database] foreign-key violation", error.detail);
+      }
+      return new UnprocessableEntityError("Referenced record does not exist.");
+    case "23502":
+      if (error.detail) {
+        console.error("[database] not-null violation", error.detail);
+      }
+      return new BadRequestError("Required field is missing.");
+    case "23514":
+      if (error.detail) {
+        console.error("[database] check violation", error.detail);
+      }
+      return new BadRequestError("Value violates a database constraint.");
+    default:
+      return new InternalServerError("Database operation failed.");
+  }
+}
+async function withDatabaseErrorHandling(operation) {
+  try {
+    return await operation();
+  } catch (error) {
+    throw mapDatabaseError(error);
+  }
+}
+function isUniqueConstraintError(error) {
+  if (!isPostgresError(error)) {
+    return false;
+  }
+  if (error.code === "SQLITE_CONSTRAINT_UNIQUE" || error.code === "SQLITE_CONSTRAINT_PRIMARYKEY") {
+    return true;
+  }
+  if (error.errno === 1062) {
+    return true;
+  }
+  return getPostgresSqlState(error) === "23505";
+}
+
+// ../../src/core/auth/saml/samlAssertionReplay.ts
+var REPLAY_RETENTION_MS = 60 * 60 * 1000;
+
+class InMemorySamlAssertionReplayStore {
+  seen = new Map;
+  async consume(assertionId) {
+    this.gc();
+    const consumedAt = this.seen.get(assertionId);
+    if (consumedAt !== undefined && Date.now() - consumedAt < REPLAY_RETENTION_MS) {
+      throw new Error("SAML assertion replay detected.");
+    }
+    this.seen.set(assertionId, Date.now());
+  }
+  clear() {
+    this.seen.clear();
+  }
+  gc() {
+    const cutoff = Date.now() - REPLAY_RETENTION_MS;
+    for (const [id, at] of this.seen) {
+      if (at < cutoff) {
+        this.seen.delete(id);
+      }
+    }
+  }
+}
+
+class SqlSamlAssertionReplayStore {
+  async consume(assertionId) {
+    const sql = getBoundDatabaseConnection() ?? getDefaultDatabasePool();
+    const dialect = currentSqlDialect();
+    try {
+      await sql.unsafe(`INSERT INTO auth_saml_assertions (assertion_id, consumed_at) VALUES (${dialect.placeholder(1)}, ${dialect.placeholder(2)})`, [assertionId, new Date().toISOString()]);
+    } catch (error) {
+      if (isUniqueConstraintError(error)) {
+        throw new Error("SAML assertion replay detected.");
+      }
+      throw error;
+    }
+    await sql.unsafe(`DELETE FROM auth_saml_assertions WHERE consumed_at < ${dialect.placeholder(1)}`, [new Date(Date.now() - REPLAY_RETENTION_MS).toISOString()]);
+  }
+}
+var sqlReplayStore = new SqlSamlAssertionReplayStore;
+var replayStoreOverride = null;
+function samlAssertionReplayStore() {
+  return replayStoreOverride ?? sqlReplayStore;
+}
+function setSamlAssertionReplayStoreForTests(store) {
+  replayStoreOverride = store;
+}
+function resetSamlReplayCacheForTests() {
+  if (replayStoreOverride instanceof InMemorySamlAssertionReplayStore) {
+    replayStoreOverride.clear();
+    return;
+  }
+  replayStoreOverride = null;
+}
+async function consumeSamlAssertion(assertionId) {
+  await samlAssertionReplayStore().consume(assertionId);
+}
+
+// ../../src/core/auth/saml/samlServiceProvider.ts
+function readAssertionId(profile) {
+  if (typeof profile.ID === "string" && profile.ID.trim()) {
+    return profile.ID.trim();
+  }
+  const parsed = typeof profile.getAssertion === "function" ? profile.getAssertion() : null;
+  const assertionId = parsed?.Assertion?.$?.ID;
+  return typeof assertionId === "string" ? assertionId.trim() : "";
+}
+function requireSamlOption(value, name) {
+  const trimmed = value?.trim() ?? "";
+  if (!trimmed) {
+    throw new Error(`${name} is required.`);
+  }
+  return trimmed;
+}
+function readSamlEnvOptions() {
+  const idpSsoUrl = process.env.SAML_IDP_SSO_URL?.trim() ?? "";
+  const idpCert = process.env.SAML_IDP_CERT?.trim() ?? "";
+  const spEntityId = process.env.SAML_SP_ENTITY_ID?.trim() ?? "";
+  const acsUrl = process.env.SAML_ACS_URL?.trim() ?? "";
+  const idpIssuer = process.env.SAML_IDP_ISSUER?.trim() ?? "";
+  if (!idpSsoUrl || !idpCert || !spEntityId || !acsUrl || !idpIssuer) {
+    throw new Error("SAML requires SAML_IDP_SSO_URL, SAML_IDP_CERT, SAML_SP_ENTITY_ID, SAML_ACS_URL, and SAML_IDP_ISSUER.");
+  }
+  return {
+    idpSsoUrl,
+    idpCert,
+    spEntityId,
+    acsUrl,
+    idpIssuer,
+    wantAuthnResponseSigned: process.env.SAML_WANT_RESPONSE_SIGNED !== "false",
+    disableRequestedAuthnContext: process.env.SAML_DISABLE_REQUESTED_AUTHN_CONTEXT === "true"
+  };
+}
+var nodeSamlLoader = null;
+async function defaultLoadNodeSaml() {
+  return await import("@node-saml/node-saml");
+}
+async function loadNodeSaml() {
+  try {
+    return await (nodeSamlLoader ?? defaultLoadNodeSaml)();
+  } catch (error) {
+    throw missingOptionalPeer("@node-saml/node-saml", "to verify SAML assertions", error);
+  }
+}
+function setNodeSamlLoaderForTests(loader) {
+  nodeSamlLoader = loader;
+}
+
+class SamlServiceProvider {
+  options;
+  client = null;
+  constructor(options) {
+    this.options = options;
+    requireSamlOption(options.idpSsoUrl, "idpSsoUrl");
+    requireSamlOption(options.idpCert, "idpCert");
+    requireSamlOption(options.spEntityId, "spEntityId");
+    requireSamlOption(options.acsUrl, "acsUrl");
+    requireSamlOption(options.idpIssuer, "idpIssuer");
+  }
+  async getClient() {
+    if (this.client) {
+      return this.client;
+    }
+    const { SAML } = await loadNodeSaml();
+    this.client = new SAML({
+      callbackUrl: this.options.acsUrl,
+      entryPoint: this.options.idpSsoUrl,
+      issuer: this.options.spEntityId,
+      idpCert: this.options.idpCert,
+      audience: this.options.spEntityId,
+      idpIssuer: this.options.idpIssuer,
+      acceptedClockSkewMs: 5000,
+      wantAssertionsSigned: this.options.wantAssertionsSigned ?? true,
+      wantAuthnResponseSigned: this.options.wantAuthnResponseSigned ?? true,
+      disableRequestedAuthnContext: this.options.disableRequestedAuthnContext ?? false
+    });
+    return this.client;
+  }
+  async authorizationUrl(relayState) {
+    const client = await this.getClient();
+    return await client.getAuthorizeUrlAsync(relayState, undefined, {});
+  }
+  async consumePost(samlResponse, relayState) {
+    if (!samlResponse.trim()) {
+      throw new Error("SAML response is required.");
+    }
+    const client = await this.getClient();
+    const { profile, loggedOut } = await client.validatePostResponseAsync({
+      SAMLResponse: samlResponse,
+      ...relayState ? { RelayState: relayState } : {}
+    });
+    if (loggedOut || !profile) {
+      throw new Error("SAML assertion did not contain a signed user profile.");
+    }
+    const issuer = typeof profile.issuer === "string" ? profile.issuer.trim() : "";
+    if (!issuer || !timingSafeCompareString(issuer, this.options.idpIssuer)) {
+      throw new Error("SAML assertion issuer is invalid.");
+    }
+    const assertionId = readAssertionId(profile);
+    if (!assertionId) {
+      throw new Error("SAML assertion did not include an ID.");
+    }
+    await consumeSamlAssertion(assertionId);
+    const email = profile.email || (typeof profile["urn:oid:0.9.2342.19200300.100.1.3"] === "string" ? profile["urn:oid:0.9.2342.19200300.100.1.3"] : "") || "";
+    if (!email) {
+      throw new Error("SAML assertion did not include an email address.");
+    }
+    return {
+      providerUserId: profile.nameID || email,
+      email,
+      name: typeof profile.name === "string" && profile.name.trim() ? profile.name : email
+    };
+  }
+}
+function createSamlServiceProvider(options = readSamlEnvOptions()) {
+  return new SamlServiceProvider(options);
+}
+export {
+  InMemorySamlAssertionReplayStore,
+  REPLAY_RETENTION_MS,
+  SamlServiceProvider,
+  consumeSamlAssertion,
+  createSamlServiceProvider,
+  readSamlEnvOptions,
+  resetSamlReplayCacheForTests,
+  setNodeSamlLoaderForTests,
+  setSamlAssertionReplayStoreForTests
+};

package/dist/entries/auth/scimAuthMiddleware.js

@@ -61,14 +61,21 @@ function parseScimTenantTokens(raw) {
   return tokens;
 }
 function resolveScimTenantFromToken(token) {
+  const presented = token.trim();
+  if (presented.length === 0) {
+    return null;
+  }
   const tenantTokens = parseScimTenantTokens(process.env.SCIM_TENANT_TOKENS);
   for (const [tenantId, expectedToken] of tenantTokens) {
-    if (timingSafeCompareString(token, expectedToken)) {
+    if (timingSafeCompareString(presented, expectedToken)) {
       return tenantId;
     }
   }
-  const fallbackToken = process.env.SCIM_BEARER_TOKEN ?? "";
-  if (timingSafeCompareString(token, fallbackToken)) {
+  const fallbackToken = process.env.SCIM_BEARER_TOKEN?.trim() ?? "";
+  if (fallbackToken.length === 0) {
+    return null;
+  }
+  if (timingSafeCompareString(presented, fallbackToken)) {
     return 1;
   }
   return null;

package/dist/entries/auth/sessionCookie.js

@@ -103,7 +103,7 @@ function sessionRememberTtlSeconds() {
   return parsePositiveSeconds(process.env.SESSION_REMEMBER_TTL_SECONDS, SESSION_REMEMBER_TTL_SECONDS);
 }
 function resolveSessionSecret() {
-  return requireConfiguredSecret(["SESSION_SECRET", "OAUTH_STATE_SECRET", "ADMIN_API_TOKEN"], "session-secret");
+  return requireConfiguredSecret(["SESSION_SECRET"], "session-secret");
 }
 function signSession(userId, issuedAt, ttlSeconds) {
   const payload = ttlSeconds === undefined ? `${userId}.${issuedAt}` : `${userId}.${issuedAt}.${ttlSeconds}`;

package/dist/entries/auth/sessionGuard.js

@@ -170,7 +170,7 @@ function sessionRememberTtlSeconds() {
   return parsePositiveSeconds(process.env.SESSION_REMEMBER_TTL_SECONDS, SESSION_REMEMBER_TTL_SECONDS);
 }
 function resolveSessionSecret() {
-  return requireConfiguredSecret(["SESSION_SECRET", "OAUTH_STATE_SECRET", "ADMIN_API_TOKEN"], "session-secret");
+  return requireConfiguredSecret(["SESSION_SECRET"], "session-secret");
 }
 function signSession(userId, issuedAt, ttlSeconds) {
   const payload = ttlSeconds === undefined ? `${userId}.${issuedAt}` : `${userId}.${issuedAt}.${ttlSeconds}`;

package/dist/entries/auth/tokenHash.js

@@ -1,6 +1,6 @@
 // @bun
 // ../../src/core/auth/tokenHash.ts
-import { createHash, createHmac } from "crypto";
+import { createHmac } from "crypto";
 
 // ../../src/core/runtime/appEnv.ts
 var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
@@ -90,11 +90,7 @@ function resolveTokenPepper() {
   return requireConfiguredSecret(["TOKEN_HASH_PEPPER"], "token-pepper");
 }
 function hashApiToken(token) {
-  const pepper = resolveTokenPepper();
-  if (pepper && pepper !== appDevSecret("token-pepper")) {
-    return createHmac("sha256", pepper).update(token).digest("hex");
-  }
-  return createHash("sha256").update(token).digest("hex");
+  return createHmac("sha256", resolveTokenPepper()).update(token).digest("hex");
 }
 export {
   hashApiToken,

package/dist/entries/crypto/fieldEncryption.js

@@ -26,7 +26,7 @@ function isFieldEncryptionEnabled() {
   if (featureFlag === "true") {
     return true;
   }
-  return (process.env.APP_ENV ?? "local") === "production";
+  return Boolean(resolveEncryptionKey());
 }
 function encryptField(plaintext, key) {
   const iv = randomBytes(IV_LENGTH);