@getstrata/core 1.1.4 → 1.1.6

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @getstrata/core changelog
 
+## 1.1.6
+
+- Add optional OIDC cookie login and loopback discovery
+
+## Unreleased
+
+- `sealOidcPkceCookie()` / `readOidcPkceCookie()` on `@getstrata/core/security/oauthState` store the OIDC PKCE handshake in the `oidc_pkce` cookie, bound to the signed OAuth state.
+- OIDC discovery, token, and JWKS fetches allow loopback issuers outside production. `OIDC_ALLOW_PRIVATE=true` allows other private hosts and is ignored in production.
+- `OidcProvider.getAuthorizationUrl()` still throws. Call `createAuthorization()`.
+
+## 1.1.5
+
+- Close dogfood gaps: webhook docs, starter extras, signing helper
+
+## Unreleased
+
+- `signWebhookBody(secret, body)` and `signedWebhookHeaders()` on `@getstrata/core/security/webhookSignature` sign outbound JSON using `webhookSignatureHeader()`.
+- CSRF skips `POST /billing/webhooks/*` by path (Stripe-style inbound webhooks), same as SAML ACS and `/scim/`.
+
 ## 1.1.4
 
 - Publish http/uploads, validateUploadFile, migration-adoption docs

package/dist/core/auth/oauth/oidcIdToken.d.ts

@@ -5,6 +5,12 @@ interface OidcDiscovery {
     token_endpoint?: string;
     jwks_uri?: string;
 }
+declare function oidcSafeFetchOptions(url: string): {
+    allowHttp: boolean;
+    allowPrivate: boolean;
+    timeoutMs: number;
+    maxRedirects: number;
+};
 declare function loadOidcDiscovery(issuer: string): Promise<OidcDiscovery>;
 declare function oidcAccessTokenHash(accessToken: string): string;
 declare function verifyOidcIdToken(token: string, options: {
@@ -16,4 +22,4 @@ declare function verifyOidcIdToken(token: string, options: {
 }): Promise<JwtPayload>;
 declare function resetOidcDiscoveryCacheForTests(): void;
 export type { OidcDiscovery };
-export { loadOidcDiscovery, oidcAccessTokenHash, resetOidcDiscoveryCacheForTests, verifyOidcIdToken, };
+export { loadOidcDiscovery, oidcAccessTokenHash, oidcSafeFetchOptions, resetOidcDiscoveryCacheForTests, verifyOidcIdToken, };

package/dist/core/security/oauthState.d.ts

@@ -1,4 +1,10 @@
 declare const OAUTH_STATE_COOKIE = "oauth_state";
+declare const OIDC_PKCE_COOKIE = "oidc_pkce";
+interface OidcPkceSeal {
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+}
 declare function verifySignedOAuthStateValue(value: string): boolean;
 declare function createOAuthState(): {
     state: string;
@@ -9,4 +15,11 @@ declare function createOAuthStateCookie(): {
 };
 declare function verifyOAuthState(_request: Request, returnedState: string | null): boolean;
 declare function clearOAuthStateCookie(): string;
-export { clearOAuthStateCookie, createOAuthState, createOAuthStateCookie, OAUTH_STATE_COOKIE, verifyOAuthState, verifySignedOAuthStateValue, };
+declare function sealOidcPkceCookie(payload: OidcPkceSeal): string;
+declare function clearOidcPkceCookie(): string;
+declare function readOidcPkceCookie(request: Request, returnedState: string | null): {
+    nonce: string;
+    codeVerifier: string;
+} | null;
+export type { OidcPkceSeal };
+export { clearOAuthStateCookie, clearOidcPkceCookie, createOAuthState, createOAuthStateCookie, OAUTH_STATE_COOKIE, OIDC_PKCE_COOKIE, readOidcPkceCookie, sealOidcPkceCookie, verifyOAuthState, verifySignedOAuthStateValue, };

package/dist/core/security/webhookSignature.d.ts

@@ -0,0 +1,3 @@
+declare function signWebhookBody(secret: string, body: string | Buffer): string;
+declare function signedWebhookHeaders(secret: string, body: string | Buffer): Record<string, string>;
+export { signedWebhookHeaders, signWebhookBody };

package/dist/entries/audit/exportAuditLogs.js

@@ -61,6 +61,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/audit/siemFormatter.js

@@ -58,6 +58,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/auth/basicAuthGuard.js

@@ -539,6 +539,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/auth/intendedUrlCookie.js

@@ -121,6 +121,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/auth/jwt.js

@@ -61,6 +61,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/auth/jwtGuard.js

@@ -148,6 +148,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/auth/oauth/oidcProvider.js

@@ -2,6 +2,10 @@
 // ../../src/core/auth/oauth/oidcProvider.ts
 import { createHash as createHash2, randomBytes } from "crypto";
 
+// ../../src/core/security/safeUrl.ts
+import { lookup as dnsLookupImpl } from "dns/promises";
+import { BadRequestError } from "@getstrata/core/errors/http";
+
 // ../../src/core/runtime/appEnv.ts
 var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
 function normalizeEnvValue(value) {
@@ -23,8 +27,6 @@ function envFlagEnabled(value) {
 }
 
 // ../../src/core/security/safeUrl.ts
-import { lookup as dnsLookupImpl } from "dns/promises";
-import { BadRequestError } from "@getstrata/core/errors/http";
 var dnsLookup = dnsLookupImpl;
 var BLOCKED_HOSTNAMES = new Set([
   "localhost",
@@ -330,8 +332,33 @@ var jwksCache = new Map;
 function issuerOrigin(issuer) {
   return issuer.replace(/\/$/, "");
 }
+function oidcLoopbackHost(hostname) {
+  const host = hostname.trim().toLowerCase().replace(/^\[|\]$/gu, "");
+  return host === "localhost" || host === "127.0.0.1" || host === "::1";
+}
+function oidcOutboundAllowsPrivate(url) {
+  if (isProductionEnv()) {
+    return false;
+  }
+  if (process.env.OIDC_ALLOW_PRIVATE === "true") {
+    return true;
+  }
+  try {
+    return oidcLoopbackHost(new URL(url).hostname);
+  } catch {
+    return false;
+  }
+}
+function oidcSafeFetchOptions(url) {
+  return {
+    allowHttp: !isProductionEnv(),
+    allowPrivate: oidcOutboundAllowsPrivate(url),
+    timeoutMs: 1e4,
+    maxRedirects: 0
+  };
+}
 async function fetchJson(url) {
-  const response = await safeFetch(url, { headers: { accept: "application/json" } }, { allowHttp: !isProductionEnv(), timeoutMs: 1e4, maxRedirects: 0 });
+  const response = await safeFetch(url, { headers: { accept: "application/json" } }, oidcSafeFetchOptions(url));
   return await response.json();
 }
 async function loadOidcDiscovery(issuer) {
@@ -532,11 +559,12 @@ class OidcProvider {
       client_secret: this.options.clientSecret,
       code_verifier: handshake.codeVerifier
     });
-    const tokenResponse = await safeFetch(requireOidcEndpoint(discovery.token_endpoint, "token_endpoint"), {
+    const tokenEndpoint = requireOidcEndpoint(discovery.token_endpoint, "token_endpoint");
+    const tokenResponse = await safeFetch(tokenEndpoint, {
       method: "POST",
       headers: { "content-type": "application/x-www-form-urlencoded" },
       body
-    }, { allowHttp: !isProductionEnv(), timeoutMs: 1e4, maxRedirects: 0 });
+    }, oidcSafeFetchOptions(tokenEndpoint));
     const tokenBody = await tokenResponse.json();
     if (!tokenBody.access_token) {
       throw new Error("OIDC token exchange failed.");

package/dist/entries/auth/oauth/providers.js

@@ -58,6 +58,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/auth/oneTimeToken.js

@@ -256,6 +256,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/auth/passwordConfirmCookie.js

@@ -61,6 +61,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/auth/passwordLogin.js

@@ -390,6 +390,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/auth/sessionCookie.js

@@ -61,6 +61,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/auth/sessionGuard.js

@@ -128,6 +128,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/auth/tokenHash.js

@@ -61,6 +61,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/cache/createCacheStore.js

@@ -61,6 +61,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/facades.js

@@ -70,6 +70,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/http/corsMiddleware.js

@@ -58,6 +58,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/http/csrfMiddleware.js

@@ -65,6 +65,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }
@@ -239,7 +242,7 @@ function samlAcsPathname() {
   }
 }
 function skipsCsrfPath(pathname) {
-  return pathname === samlAcsPathname() || pathname.startsWith("/scim/");
+  return pathname === samlAcsPathname() || pathname.startsWith("/scim/") || pathname.startsWith("/billing/webhooks/");
 }
 function appendSetCookie(response, cookie) {
   const headers = new Headers(response.headers);

package/dist/entries/http/csrfToken.js

@@ -61,6 +61,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/http/flashMiddleware.js

@@ -61,6 +61,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/http/flashSession.js

@@ -61,6 +61,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/http/memoryThrottleMiddleware.js

@@ -58,6 +58,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/http/scimThrottleMiddleware.js

@@ -62,6 +62,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/http/signedUrl.js

@@ -63,6 +63,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/http/throttleMiddleware.js

@@ -63,6 +63,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/jobs/exportAuditLogsJob.js

@@ -61,6 +61,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/mail/mailer.js

@@ -58,6 +58,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/openapi/generator.js

@@ -58,6 +58,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/queue/createAppQueue.js

@@ -215,6 +215,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/queue/publicQueue.js

@@ -215,6 +215,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/queue/queueMetrics.js

@@ -218,6 +218,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/queue/redisQueue.js

@@ -61,6 +61,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/security/oauthState.js

@@ -61,6 +61,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }
@@ -87,6 +90,7 @@ function sdkClientClassName() {
 
 // ../../src/core/security/oauthState.ts
 var OAUTH_STATE_COOKIE = "oauth_state";
+var OIDC_PKCE_COOKIE = "oidc_pkce";
 var OAUTH_STATE_TTL_MS = 10 * 60 * 1000;
 function resolveOAuthStateSecret() {
   return requireConfiguredSecret(["OAUTH_STATE_SECRET", "SESSION_SECRET"], "oauth-state-secret");
@@ -141,11 +145,85 @@ function verifyOAuthState(_request, returnedState) {
 function clearOAuthStateCookie() {
   return `${OAUTH_STATE_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${isProductionEnv() ? "; Secure" : ""}`;
 }
+function oauthCookieSuffix() {
+  return `Path=/; HttpOnly; SameSite=Lax${isProductionEnv() ? "; Secure" : ""}`;
+}
+function sealOidcPkceCookie(payload) {
+  const body = Buffer.from(JSON.stringify({
+    state: payload.state,
+    nonce: payload.nonce,
+    codeVerifier: payload.codeVerifier,
+    iat: Date.now()
+  })).toString("base64url");
+  const signature = createHmac("sha256", resolveOAuthStateSecret()).update(body).digest("base64url");
+  const value = encodeURIComponent(`${body}.${signature}`);
+  return `${OIDC_PKCE_COOKIE}=${value}; ${oauthCookieSuffix()}; Max-Age=600`;
+}
+function clearOidcPkceCookie() {
+  return `${OIDC_PKCE_COOKIE}=; ${oauthCookieSuffix()}; Max-Age=0`;
+}
+function readOidcPkceCookie(request, returnedState) {
+  const state = returnedState?.trim() ?? "";
+  if (!state) {
+    return null;
+  }
+  const header = request.headers.get("cookie") ?? "";
+  for (const part of header.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name !== OIDC_PKCE_COOKIE) {
+      continue;
+    }
+    return unsealOidcPkceValue(rest.join("="), state);
+  }
+  return null;
+}
+function unsealOidcPkceValue(rawValue, returnedState) {
+  let decoded = rawValue;
+  try {
+    decoded = decodeURIComponent(rawValue);
+  } catch {
+    return null;
+  }
+  const splitAt = decoded.lastIndexOf(".");
+  if (splitAt <= 0) {
+    return null;
+  }
+  const body = decoded.slice(0, splitAt);
+  const signature = decoded.slice(splitAt + 1);
+  const expected = createHmac("sha256", resolveOAuthStateSecret()).update(body).digest("base64url");
+  const expectedBuffer = Buffer.from(expected);
+  const actualBuffer = Buffer.from(signature);
+  if (expectedBuffer.length !== actualBuffer.length || !timingSafeEqual(expectedBuffer, actualBuffer)) {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+  } catch {
+    return null;
+  }
+  if (typeof parsed.state !== "string" || typeof parsed.nonce !== "string" || typeof parsed.codeVerifier !== "string" || typeof parsed.iat !== "number" || !parsed.nonce.trim() || !parsed.codeVerifier.trim()) {
+    return null;
+  }
+  if (Date.now() - parsed.iat > OAUTH_STATE_TTL_MS) {
+    return null;
+  }
+  const left = Buffer.from(parsed.state);
+  const right = Buffer.from(returnedState);
+  if (left.length !== right.length || !timingSafeEqual(left, right)) {
+    return null;
+  }
+  return { nonce: parsed.nonce, codeVerifier: parsed.codeVerifier };
+}
 export {
   OAUTH_STATE_COOKIE,
+  OIDC_PKCE_COOKIE,
   clearOAuthStateCookie,
+  clearOidcPkceCookie,
   createOAuthState,
   createOAuthStateCookie,
+  readOidcPkceCookie,
+  sealOidcPkceCookie,
   verifyOAuthState,
   verifySignedOAuthStateValue
 };

package/dist/entries/security/totp.js

@@ -61,6 +61,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/entries/security/webhookSignature.js

@@ -0,0 +1,103 @@
+// @bun
+// ../../src/core/security/webhookSignature.ts
+import { createHmac } from "crypto";
+
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "strata";
+}
+function appCookieName(kind) {
+  return `${appKeyPrefix()}_${kind}`;
+}
+function appDevSecret(kind) {
+  return `${appKeyPrefix()}-dev-${kind}`;
+}
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "Strata";
+}
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
+
+// ../../src/core/security/webhookSignature.ts
+function signWebhookBody(secret, body) {
+  return createHmac("sha256", secret).update(body).digest("hex");
+}
+function signedWebhookHeaders(secret, body) {
+  return {
+    [webhookSignatureHeader()]: signWebhookBody(secret, body)
+  };
+}
+export {
+  signWebhookBody,
+  signedWebhookHeaders
+};

package/dist/entries/tracing/tracingMiddleware.js

@@ -61,6 +61,9 @@ function appUserAgent() {
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
 function appDisplayName() {
   return process.env.APP_NAME?.trim() || "Strata";
 }

package/dist/framework/public-api.d.ts

@@ -139,6 +139,7 @@ export { assertPathUnderRoot, assertUrlPathUnderRoot } from "../core/security/sa
 export { assertSafeOutboundUrl, assertSafeOutboundUrlResolved, isBlockedHostname, isBlockedIpAddress, pinUrlToAddress, resetDnsLookupForTests, resolveSafeOutboundTarget, setDnsLookupForTests, } from "../core/security/safeUrl.ts";
 export type { SecurityEventDetails } from "../core/security/securityEvents.ts";
 export { logSecurityEvent } from "../core/security/securityEvents.ts";
+export { signedWebhookHeaders, signWebhookBody } from "../core/security/webhookSignature.ts";
 export type { StorageDriver } from "../core/storage/storage.ts";
 export { createStorageDriver, LocalStorageDriver, resetDefaultStorage, StorageManager, } from "../core/storage/storage.ts";
 export { enableTenantRlsSql, enableUserOwnedRlsSql, generatedRlsBootstrapSql, RLS_HELPER_SQL, } from "../core/tenant/enableTenantRls.ts";

package/dist/index.js

@@ -1899,8 +1899,33 @@ var jwksCache = new Map;
 function issuerOrigin(issuer) {
   return issuer.replace(/\/$/, "");
 }
+function oidcLoopbackHost(hostname) {
+  const host = hostname.trim().toLowerCase().replace(/^\[|\]$/gu, "");
+  return host === "localhost" || host === "127.0.0.1" || host === "::1";
+}
+function oidcOutboundAllowsPrivate(url) {
+  if (isProductionEnv()) {
+    return false;
+  }
+  if (process.env.OIDC_ALLOW_PRIVATE === "true") {
+    return true;
+  }
+  try {
+    return oidcLoopbackHost(new URL(url).hostname);
+  } catch {
+    return false;
+  }
+}
+function oidcSafeFetchOptions(url) {
+  return {
+    allowHttp: !isProductionEnv(),
+    allowPrivate: oidcOutboundAllowsPrivate(url),
+    timeoutMs: 1e4,
+    maxRedirects: 0
+  };
+}
 async function fetchJson(url) {
-  const response = await safeFetch(url, { headers: { accept: "application/json" } }, { allowHttp: !isProductionEnv(), timeoutMs: 1e4, maxRedirects: 0 });
+  const response = await safeFetch(url, { headers: { accept: "application/json" } }, oidcSafeFetchOptions(url));
   return await response.json();
 }
 async function loadOidcDiscovery(issuer) {
@@ -2097,11 +2122,12 @@ class OidcProvider {
       client_secret: this.options.clientSecret,
       code_verifier: handshake.codeVerifier
     });
-    const tokenResponse = await safeFetch(requireOidcEndpoint(discovery.token_endpoint, "token_endpoint"), {
+    const tokenEndpoint = requireOidcEndpoint(discovery.token_endpoint, "token_endpoint");
+    const tokenResponse = await safeFetch(tokenEndpoint, {
       method: "POST",
       headers: { "content-type": "application/x-www-form-urlencoded" },
       body
-    }, { allowHttp: !isProductionEnv(), timeoutMs: 1e4, maxRedirects: 0 });
+    }, oidcSafeFetchOptions(tokenEndpoint));
     const tokenBody = await tokenResponse.json();
     if (!tokenBody.access_token) {
       throw new Error("OIDC token exchange failed.");
@@ -8608,7 +8634,7 @@ function samlAcsPathname() {
   }
 }
 function skipsCsrfPath(pathname) {
-  return pathname === samlAcsPathname() || pathname.startsWith("/scim/");
+  return pathname === samlAcsPathname() || pathname.startsWith("/scim/") || pathname.startsWith("/billing/webhooks/");
 }
 function appendSetCookie(response, cookie) {
   const headers = new Headers(response.headers);
@@ -10909,6 +10935,16 @@ function isPublicReadsEnabled() {
 function guestCanViewResource() {
   return isPublicReadsEnabled();
 }
+// ../../src/core/security/webhookSignature.ts
+import { createHmac as createHmac7 } from "crypto";
+function signWebhookBody(secret, body) {
+  return createHmac7("sha256", secret).update(body).digest("hex");
+}
+function signedWebhookHeaders(secret, body) {
+  return {
+    [webhookSignatureHeader()]: signWebhookBody(secret, body)
+  };
+}
 // ../../src/core/tenant/enableTenantRls.ts
 function assertSafeIdentifier2(identifier) {
   if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
@@ -12021,7 +12057,9 @@ export {
   setSamlAssertionReplayStoreForTests,
   siemEventType,
   signJwt,
+  signWebhookBody,
   signedUrl,
+  signedWebhookHeaders,
   singularize,
   smtpEhloHost,
   spaContentSecurityPolicy,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "1.1.4",
+  "version": "1.1.6",
   "description": "Strata Bun framework public API",
   "type": "module",
   "license": "MIT",
@@ -840,6 +840,11 @@
       "import": "./dist/entries/security/stripeWebhook.js",
       "default": "./dist/entries/security/stripeWebhook.js"
     },
+    "./security/webhookSignature": {
+      "types": "./dist/core/security/webhookSignature.d.ts",
+      "import": "./dist/entries/security/webhookSignature.js",
+      "default": "./dist/entries/security/webhookSignature.js"
+    },
     "./security/timingSafeCompare": {
       "types": "./dist/core/security/timingSafeCompare.d.ts",
       "import": "./dist/entries/security/timingSafeCompare.js",
@@ -928,7 +933,7 @@
     "build:bundle": "bun build index.ts --outdir dist --target bun --external bun --external eta --external mysql2 --external @node-saml/node-saml",
     "build:types": "tsc -p tsconfig.types.json",
     "prepublishOnly": "bun run build && bun ../../scripts/prepare-core-package-publish.ts",
-    "build:subpaths": "bun build entries/auth/accessControl.ts entries/auth/abilityChecker.ts entries/auth/emailVerification.ts entries/auth/jwt.ts entries/auth/jwtGuard.ts entries/auth/basicAuthGuard.ts entries/auth/tokenAbilityChecker.ts entries/auth/membershipMiddleware.ts entries/auth/membershipScope.ts entries/auth/membershipService.ts entries/auth/oauth/oidcProvider.ts entries/auth/oauth/providers.ts entries/auth/oauth/samlProvider.ts entries/auth/oauth/types.ts entries/auth/saml/samlServiceProvider.ts entries/auth/password.ts entries/auth/passwordLogin.ts entries/auth/oneTimeToken.ts entries/auth/intendedUrlCookie.ts entries/auth/passwordConfirmCookie.ts entries/auth/policy.ts entries/auth/scimAuthMiddleware.ts entries/auth/sessionCookie.ts entries/auth/sessionGuard.ts entries/auth/tokenHash.ts entries/audit/exportAuditLogs.ts entries/audit/siemFormatter.ts entries/admin/formatValue.ts entries/admin/registry.ts entries/admin/types.ts entries/cache/tags.ts entries/cache/createCacheStore.ts entries/cache/repository.ts entries/cache/simpleCache.ts entries/cache/simpleCacheStore.ts entries/config/envSchema.ts entries/contracts/serviceTokens.ts entries/contracts/authUserDirectory.ts entries/contracts/container.ts entries/contracts/di.ts entries/crypto/fieldEncryption.ts entries/crypto/mfaSecret.ts entries/database/errors.ts entries/database/factory.ts entries/database/migrations.ts entries/database/migrations/types.ts entries/database/model.ts entries/database/query.ts entries/database/relationships.ts entries/database/repositoryQuery.ts entries/database/seeders.ts entries/database/seeders/types.ts entries/database/schema.ts entries/database/sqliteConnection.ts entries/database/table.ts entries/database/types.ts entries/database/whereBuilder.ts entries/facades.ts entries/http/authMiddleware.ts entries/http/authorizeMiddleware.ts entries/http/bodySizeLimitMiddleware.ts entries/http/clientIp.ts entries/http/cookies.ts entries/http/contentNegotiation.ts entries/http/conditionalResponse.ts entries/http/corsMiddleware.ts entries/http/csrfMiddleware.ts entries/http/csrfProtection.ts entries/http/csrfToken.ts entries/http/etag.ts entries/http/flashSession.ts entries/http/flashMiddleware.ts entries/http/formRequest.ts entries/http/metricsMiddleware.ts entries/http/memoryThrottleMiddleware.ts entries/http/pagination.ts entries/http/parseFormBody.ts entries/http/parseMultipartUpload.ts entries/http/requireAbilityMiddleware.ts entries/http/requireAuthMiddleware.ts entries/http/requireGlobalAdminMiddleware.ts entries/http/requireWebAuthMiddleware.ts entries/http/requireVerifiedMiddleware.ts entries/http/requirePasswordConfirmMiddleware.ts entries/http/resources.ts entries/http/response.ts entries/http/route.ts entries/http/routeMiddleware.ts entries/http/routeModelBinding.ts entries/http/safeInternalPath.ts entries/http/signedUrl.ts entries/http/statelessAuth.ts entries/http/scimThrottleMiddleware.ts entries/http/securityHeadersMiddleware.ts entries/http/securedRouteModelBinding.ts entries/http/webFormRequest.ts entries/http/throttleMiddleware.ts entries/http/uploads.ts entries/http/validation.ts entries/jobs/exportAuditLogsJob.ts entries/jobs/invalidateCacheTagsJob.ts entries/logging/logger.ts entries/logging/requestLoggingMiddleware.ts entries/mail/mailer.ts entries/mail/markdownMail.ts entries/mail/markdownMailable.ts entries/mail/sanitizeMailHtml.ts entries/media/imageTransform.ts entries/metrics/prometheus.ts entries/openapi/generator.ts entries/openapi/registeredRoute.ts entries/openapi/validate.ts entries/pagination.ts entries/queue.ts entries/queue/createAppQueue.ts entries/queue/failedJobRepository.ts entries/queue/failedJobService.ts entries/queue/jobRunner.ts entries/queue/queueMetrics.ts entries/queue/publicQueue.ts entries/queue/redisQueue.ts entries/queue/types.ts entries/runtime/appEnv.ts entries/runtime/frontendMode.ts entries/runtime/asyncContextStore.ts entries/scheduler/schedule.ts entries/scheduler/osCron.ts entries/security/oauthState.ts entries/security/publicReads.ts entries/security/recoveryCodes.ts entries/security/safeFetch.ts entries/security/safePath.ts entries/security/scimTenantTokens.ts entries/security/stripeWebhook.ts entries/security/timingSafeCompare.ts entries/security/tokenExpiry.ts entries/security/totp.ts entries/storage/storage.ts entries/tenant/tenancyConfig.ts entries/tenant/tenantDatabaseScope.ts entries/tenant/databaseTenantContext.ts entries/tenant/enableTenantRls.ts entries/terminal/runShell.ts entries/tracing/tracingMiddleware.ts entries/validation/rules.ts --outdir dist --root . --target bun --external bun --external eta --external mysql2 --external @node-saml/node-saml --external @getstrata/core --external @getstrata/core/auth/accessControl --external @getstrata/core/auth/abilityChecker --external @getstrata/core/auth/authContext --external @getstrata/core/auth/emailVerification --external @getstrata/core/auth/guard --external @getstrata/core/auth/jwt --external @getstrata/core/auth/jwtGuard --external @getstrata/core/auth/basicAuthGuard --external @getstrata/core/auth/tokenAbilityChecker --external @getstrata/core/auth/membershipContext --external @getstrata/core/auth/membershipMiddleware --external @getstrata/core/auth/membershipScope --external @getstrata/core/auth/membershipService --external @getstrata/core/auth/oauth/oidcProvider --external @getstrata/core/auth/oauth/providers --external @getstrata/core/auth/oauth/samlProvider --external @getstrata/core/auth/oauth/types --external @getstrata/core/auth/saml/samlServiceProvider --external @getstrata/core/auth/password --external @getstrata/core/auth/passwordLogin --external @getstrata/core/auth/oneTimeToken --external @getstrata/core/auth/intendedUrlCookie --external @getstrata/core/auth/passwordConfirmCookie --external @getstrata/core/auth/policy --external @getstrata/core/auth/scimAuthMiddleware --external @getstrata/core/auth/sessionCookie --external @getstrata/core/auth/sessionGuard --external @getstrata/core/auth/tokenHash --external @getstrata/core/audit/exportAuditLogs --external @getstrata/core/audit/siemFormatter --external @getstrata/core/admin/formatValue --external @getstrata/core/admin/registry --external @getstrata/core/admin/types --external @getstrata/core/cache/tags --external @getstrata/core/cache/createCacheStore --external @getstrata/core/cache/repository --external @getstrata/core/cache/simpleCache --external @getstrata/core/cache/simpleCacheStore --external @getstrata/core/config/envSchema --external @getstrata/core/contracts/serviceTokens --external @getstrata/core/contracts/authUserDirectory --external @getstrata/core/contracts/container --external @getstrata/core/contracts/di --external @getstrata/core/crypto/fieldEncryption --external @getstrata/core/crypto/mfaSecret --external @getstrata/core/database --external @getstrata/core/database/baseRepository --external @getstrata/core/database/bindConnection --external @getstrata/core/database/boundConnection --external @getstrata/core/database/bunSql --external @getstrata/core/database/connection --external @getstrata/core/database/connectionContext --external @getstrata/core/database/defaultConnection --external @getstrata/core/database/dialect --external @getstrata/core/database/mysqlConnection --external @getstrata/core/database/namedConnections --external @getstrata/core/database/errors --external @getstrata/core/database/factory --external @getstrata/core/database/migrations --external @getstrata/core/database/migrations/types --external @getstrata/core/database/model --external @getstrata/core/database/query --external @getstrata/core/database/relationships --external @getstrata/core/database/repositoryConnection --external @getstrata/core/database/repositoryQuery --external @getstrata/core/database/seeders --external @getstrata/core/database/seeders/types --external @getstrata/core/database/schema --external @getstrata/core/database/sqliteConnection --external @getstrata/core/database/table --external @getstrata/core/database/transaction --external @getstrata/core/database/types --external @getstrata/core/database/whereBuilder --external @getstrata/core/errors/http --external @getstrata/core/events --external @getstrata/core/facades --external @getstrata/core/http --external @getstrata/core/http/authMiddleware --external @getstrata/core/http/authorizeMiddleware --external @getstrata/core/http/bodySizeLimitMiddleware --external @getstrata/core/http/clientIp --external @getstrata/core/http/cookies --external @getstrata/core/http/contentNegotiation --external @getstrata/core/http/contentSecurityPolicy --external @getstrata/core/http/conditionalResponse --external @getstrata/core/http/corsMiddleware --external @getstrata/core/http/csrfMiddleware --external @getstrata/core/http/csrfProtection --external @getstrata/core/http/csrfToken --external @getstrata/core/http/etag --external @getstrata/core/http/flashSession --external @getstrata/core/http/flashMiddleware --external @getstrata/core/http/formRequest --external @getstrata/core/http/middleware --external @getstrata/core/http/metricsMiddleware --external @getstrata/core/http/loginThrottleMiddleware --external @getstrata/core/http/memoryThrottleMiddleware --external @getstrata/core/http/pagination --external @getstrata/core/http/parseFormBody --external @getstrata/core/http/parseMultipartUpload --external @getstrata/core/http/requireAbilityMiddleware --external @getstrata/core/http/requireAuthMiddleware --external @getstrata/core/http/requireGlobalAdminMiddleware --external @getstrata/core/http/requireWebAuthMiddleware --external @getstrata/core/http/requireVerifiedMiddleware --external @getstrata/core/http/requirePasswordConfirmMiddleware --external @getstrata/core/http/resources --external @getstrata/core/http/response --external @getstrata/core/http/route --external @getstrata/core/http/routeMiddleware --external @getstrata/core/http/routeModelBinding --external @getstrata/core/http/safeInternalPath --external @getstrata/core/http/signedUrl --external @getstrata/core/http/statelessAuth --external @getstrata/core/http/scimThrottleMiddleware --external @getstrata/core/http/securityHeadersMiddleware --external @getstrata/core/http/securedRouteModelBinding --external @getstrata/core/http/requestMetaContext --external @getstrata/core/http/webErrorResponse --external @getstrata/core/http/webFormRequest --external @getstrata/core/http/throttleMiddleware --external @getstrata/core/http/uploads --external @getstrata/core/http/validation --external @getstrata/core/jobs/exportAuditLogsJob --external @getstrata/core/jobs/invalidateCacheTagsJob --external @getstrata/core/lifecycle/gracefulShutdown --external @getstrata/core/logging/logger --external @getstrata/core/logging/requestLoggingMiddleware --external @getstrata/core/mail/mailer --external @getstrata/core/mail/markdownMail --external @getstrata/core/mail/markdownMailable --external @getstrata/core/mail/sanitizeMailHtml --external @getstrata/core/media/imageTransform --external @getstrata/core/metrics/prometheus --external @getstrata/core/notifications --external @getstrata/core/openapi/generator --external @getstrata/core/openapi/registeredRoute --external @getstrata/core/openapi/validate --external @getstrata/core/pagination --external @getstrata/core/queue --external @getstrata/core/queue/createAppQueue --external @getstrata/core/queue/failedJobRepository --external @getstrata/core/queue/failedJobService --external @getstrata/core/queue/jobRegistry --external @getstrata/core/queue/jobRunner --external @getstrata/core/queue/queueMetrics --external @getstrata/core/queue/publicQueue --external @getstrata/core/queue/redisQueue --external @getstrata/core/queue/types --external @getstrata/core/runtime/appEnv --external @getstrata/core/runtime/appKeyPrefix --external @getstrata/core/runtime/frontendMode --external @getstrata/core/runtime/applicationRegistry --external @getstrata/core/runtime/asyncContextStore --external @getstrata/core/scheduler/schedule --external @getstrata/core/scheduler/osCron --external @getstrata/core/security/oauthState --external @getstrata/core/security/publicReads --external @getstrata/core/security/recoveryCodes --external @getstrata/core/security/safeFetch --external @getstrata/core/security/safePath --external @getstrata/core/security/safeUrl --external @getstrata/core/security/scimTenantTokens --external @getstrata/core/security/securityEvents --external @getstrata/core/security/stripeWebhook --external @getstrata/core/security/timingSafeCompare --external @getstrata/core/security/tokenExpiry --external @getstrata/core/security/totp --external @getstrata/core/storage/storage --external @getstrata/core/tenant/tenancyConfig --external @getstrata/core/tenant/tenantContext --external @getstrata/core/tenant/tenantDatabaseScope --external @getstrata/core/tenant/databaseTenantContext --external @getstrata/core/tenant/tenantMiddleware --external @getstrata/core/tenant/enableTenantRls --external @getstrata/core/terminal/runShell --external @getstrata/core/tracing/traceContext --external @getstrata/core/tracing/tracingMiddleware --external @getstrata/core/validation/rules --external @getstrata/core/view",
+    "build:subpaths": "bun build entries/auth/accessControl.ts entries/auth/abilityChecker.ts entries/auth/emailVerification.ts entries/auth/jwt.ts entries/auth/jwtGuard.ts entries/auth/basicAuthGuard.ts entries/auth/tokenAbilityChecker.ts entries/auth/membershipMiddleware.ts entries/auth/membershipScope.ts entries/auth/membershipService.ts entries/auth/oauth/oidcProvider.ts entries/auth/oauth/providers.ts entries/auth/oauth/samlProvider.ts entries/auth/oauth/types.ts entries/auth/saml/samlServiceProvider.ts entries/auth/password.ts entries/auth/passwordLogin.ts entries/auth/oneTimeToken.ts entries/auth/intendedUrlCookie.ts entries/auth/passwordConfirmCookie.ts entries/auth/policy.ts entries/auth/scimAuthMiddleware.ts entries/auth/sessionCookie.ts entries/auth/sessionGuard.ts entries/auth/tokenHash.ts entries/audit/exportAuditLogs.ts entries/audit/siemFormatter.ts entries/admin/formatValue.ts entries/admin/registry.ts entries/admin/types.ts entries/cache/tags.ts entries/cache/createCacheStore.ts entries/cache/repository.ts entries/cache/simpleCache.ts entries/cache/simpleCacheStore.ts entries/config/envSchema.ts entries/contracts/serviceTokens.ts entries/contracts/authUserDirectory.ts entries/contracts/container.ts entries/contracts/di.ts entries/crypto/fieldEncryption.ts entries/crypto/mfaSecret.ts entries/database/errors.ts entries/database/factory.ts entries/database/migrations.ts entries/database/migrations/types.ts entries/database/model.ts entries/database/query.ts entries/database/relationships.ts entries/database/repositoryQuery.ts entries/database/seeders.ts entries/database/seeders/types.ts entries/database/schema.ts entries/database/sqliteConnection.ts entries/database/table.ts entries/database/types.ts entries/database/whereBuilder.ts entries/facades.ts entries/http/authMiddleware.ts entries/http/authorizeMiddleware.ts entries/http/bodySizeLimitMiddleware.ts entries/http/clientIp.ts entries/http/cookies.ts entries/http/contentNegotiation.ts entries/http/conditionalResponse.ts entries/http/corsMiddleware.ts entries/http/csrfMiddleware.ts entries/http/csrfProtection.ts entries/http/csrfToken.ts entries/http/etag.ts entries/http/flashSession.ts entries/http/flashMiddleware.ts entries/http/formRequest.ts entries/http/metricsMiddleware.ts entries/http/memoryThrottleMiddleware.ts entries/http/pagination.ts entries/http/parseFormBody.ts entries/http/parseMultipartUpload.ts entries/http/requireAbilityMiddleware.ts entries/http/requireAuthMiddleware.ts entries/http/requireGlobalAdminMiddleware.ts entries/http/requireWebAuthMiddleware.ts entries/http/requireVerifiedMiddleware.ts entries/http/requirePasswordConfirmMiddleware.ts entries/http/resources.ts entries/http/response.ts entries/http/route.ts entries/http/routeMiddleware.ts entries/http/routeModelBinding.ts entries/http/safeInternalPath.ts entries/http/signedUrl.ts entries/http/statelessAuth.ts entries/http/scimThrottleMiddleware.ts entries/http/securityHeadersMiddleware.ts entries/http/securedRouteModelBinding.ts entries/http/webFormRequest.ts entries/http/throttleMiddleware.ts entries/http/uploads.ts entries/http/validation.ts entries/jobs/exportAuditLogsJob.ts entries/jobs/invalidateCacheTagsJob.ts entries/logging/logger.ts entries/logging/requestLoggingMiddleware.ts entries/mail/mailer.ts entries/mail/markdownMail.ts entries/mail/markdownMailable.ts entries/mail/sanitizeMailHtml.ts entries/media/imageTransform.ts entries/metrics/prometheus.ts entries/openapi/generator.ts entries/openapi/registeredRoute.ts entries/openapi/validate.ts entries/pagination.ts entries/queue.ts entries/queue/createAppQueue.ts entries/queue/failedJobRepository.ts entries/queue/failedJobService.ts entries/queue/jobRunner.ts entries/queue/queueMetrics.ts entries/queue/publicQueue.ts entries/queue/redisQueue.ts entries/queue/types.ts entries/runtime/appEnv.ts entries/runtime/frontendMode.ts entries/runtime/asyncContextStore.ts entries/scheduler/schedule.ts entries/scheduler/osCron.ts entries/security/oauthState.ts entries/security/publicReads.ts entries/security/recoveryCodes.ts entries/security/safeFetch.ts entries/security/safePath.ts entries/security/scimTenantTokens.ts entries/security/stripeWebhook.ts entries/security/webhookSignature.ts entries/security/timingSafeCompare.ts entries/security/tokenExpiry.ts entries/security/totp.ts entries/storage/storage.ts entries/tenant/tenancyConfig.ts entries/tenant/tenantDatabaseScope.ts entries/tenant/databaseTenantContext.ts entries/tenant/enableTenantRls.ts entries/terminal/runShell.ts entries/tracing/tracingMiddleware.ts entries/validation/rules.ts --outdir dist --root . --target bun --external bun --external eta --external mysql2 --external @node-saml/node-saml --external @getstrata/core --external @getstrata/core/auth/accessControl --external @getstrata/core/auth/abilityChecker --external @getstrata/core/auth/authContext --external @getstrata/core/auth/emailVerification --external @getstrata/core/auth/guard --external @getstrata/core/auth/jwt --external @getstrata/core/auth/jwtGuard --external @getstrata/core/auth/basicAuthGuard --external @getstrata/core/auth/tokenAbilityChecker --external @getstrata/core/auth/membershipContext --external @getstrata/core/auth/membershipMiddleware --external @getstrata/core/auth/membershipScope --external @getstrata/core/auth/membershipService --external @getstrata/core/auth/oauth/oidcProvider --external @getstrata/core/auth/oauth/providers --external @getstrata/core/auth/oauth/samlProvider --external @getstrata/core/auth/oauth/types --external @getstrata/core/auth/saml/samlServiceProvider --external @getstrata/core/auth/password --external @getstrata/core/auth/passwordLogin --external @getstrata/core/auth/oneTimeToken --external @getstrata/core/auth/intendedUrlCookie --external @getstrata/core/auth/passwordConfirmCookie --external @getstrata/core/auth/policy --external @getstrata/core/auth/scimAuthMiddleware --external @getstrata/core/auth/sessionCookie --external @getstrata/core/auth/sessionGuard --external @getstrata/core/auth/tokenHash --external @getstrata/core/audit/exportAuditLogs --external @getstrata/core/audit/siemFormatter --external @getstrata/core/admin/formatValue --external @getstrata/core/admin/registry --external @getstrata/core/admin/types --external @getstrata/core/cache/tags --external @getstrata/core/cache/createCacheStore --external @getstrata/core/cache/repository --external @getstrata/core/cache/simpleCache --external @getstrata/core/cache/simpleCacheStore --external @getstrata/core/config/envSchema --external @getstrata/core/contracts/serviceTokens --external @getstrata/core/contracts/authUserDirectory --external @getstrata/core/contracts/container --external @getstrata/core/contracts/di --external @getstrata/core/crypto/fieldEncryption --external @getstrata/core/crypto/mfaSecret --external @getstrata/core/database --external @getstrata/core/database/baseRepository --external @getstrata/core/database/bindConnection --external @getstrata/core/database/boundConnection --external @getstrata/core/database/bunSql --external @getstrata/core/database/connection --external @getstrata/core/database/connectionContext --external @getstrata/core/database/defaultConnection --external @getstrata/core/database/dialect --external @getstrata/core/database/mysqlConnection --external @getstrata/core/database/namedConnections --external @getstrata/core/database/errors --external @getstrata/core/database/factory --external @getstrata/core/database/migrations --external @getstrata/core/database/migrations/types --external @getstrata/core/database/model --external @getstrata/core/database/query --external @getstrata/core/database/relationships --external @getstrata/core/database/repositoryConnection --external @getstrata/core/database/repositoryQuery --external @getstrata/core/database/seeders --external @getstrata/core/database/seeders/types --external @getstrata/core/database/schema --external @getstrata/core/database/sqliteConnection --external @getstrata/core/database/table --external @getstrata/core/database/transaction --external @getstrata/core/database/types --external @getstrata/core/database/whereBuilder --external @getstrata/core/errors/http --external @getstrata/core/events --external @getstrata/core/facades --external @getstrata/core/http --external @getstrata/core/http/authMiddleware --external @getstrata/core/http/authorizeMiddleware --external @getstrata/core/http/bodySizeLimitMiddleware --external @getstrata/core/http/clientIp --external @getstrata/core/http/cookies --external @getstrata/core/http/contentNegotiation --external @getstrata/core/http/contentSecurityPolicy --external @getstrata/core/http/conditionalResponse --external @getstrata/core/http/corsMiddleware --external @getstrata/core/http/csrfMiddleware --external @getstrata/core/http/csrfProtection --external @getstrata/core/http/csrfToken --external @getstrata/core/http/etag --external @getstrata/core/http/flashSession --external @getstrata/core/http/flashMiddleware --external @getstrata/core/http/formRequest --external @getstrata/core/http/middleware --external @getstrata/core/http/metricsMiddleware --external @getstrata/core/http/loginThrottleMiddleware --external @getstrata/core/http/memoryThrottleMiddleware --external @getstrata/core/http/pagination --external @getstrata/core/http/parseFormBody --external @getstrata/core/http/parseMultipartUpload --external @getstrata/core/http/requireAbilityMiddleware --external @getstrata/core/http/requireAuthMiddleware --external @getstrata/core/http/requireGlobalAdminMiddleware --external @getstrata/core/http/requireWebAuthMiddleware --external @getstrata/core/http/requireVerifiedMiddleware --external @getstrata/core/http/requirePasswordConfirmMiddleware --external @getstrata/core/http/resources --external @getstrata/core/http/response --external @getstrata/core/http/route --external @getstrata/core/http/routeMiddleware --external @getstrata/core/http/routeModelBinding --external @getstrata/core/http/safeInternalPath --external @getstrata/core/http/signedUrl --external @getstrata/core/http/statelessAuth --external @getstrata/core/http/scimThrottleMiddleware --external @getstrata/core/http/securityHeadersMiddleware --external @getstrata/core/http/securedRouteModelBinding --external @getstrata/core/http/requestMetaContext --external @getstrata/core/http/webErrorResponse --external @getstrata/core/http/webFormRequest --external @getstrata/core/http/throttleMiddleware --external @getstrata/core/http/uploads --external @getstrata/core/http/validation --external @getstrata/core/jobs/exportAuditLogsJob --external @getstrata/core/jobs/invalidateCacheTagsJob --external @getstrata/core/lifecycle/gracefulShutdown --external @getstrata/core/logging/logger --external @getstrata/core/logging/requestLoggingMiddleware --external @getstrata/core/mail/mailer --external @getstrata/core/mail/markdownMail --external @getstrata/core/mail/markdownMailable --external @getstrata/core/mail/sanitizeMailHtml --external @getstrata/core/media/imageTransform --external @getstrata/core/metrics/prometheus --external @getstrata/core/notifications --external @getstrata/core/openapi/generator --external @getstrata/core/openapi/registeredRoute --external @getstrata/core/openapi/validate --external @getstrata/core/pagination --external @getstrata/core/queue --external @getstrata/core/queue/createAppQueue --external @getstrata/core/queue/failedJobRepository --external @getstrata/core/queue/failedJobService --external @getstrata/core/queue/jobRegistry --external @getstrata/core/queue/jobRunner --external @getstrata/core/queue/queueMetrics --external @getstrata/core/queue/publicQueue --external @getstrata/core/queue/redisQueue --external @getstrata/core/queue/types --external @getstrata/core/runtime/appEnv --external @getstrata/core/runtime/appKeyPrefix --external @getstrata/core/runtime/frontendMode --external @getstrata/core/runtime/applicationRegistry --external @getstrata/core/runtime/asyncContextStore --external @getstrata/core/scheduler/schedule --external @getstrata/core/scheduler/osCron --external @getstrata/core/security/oauthState --external @getstrata/core/security/publicReads --external @getstrata/core/security/recoveryCodes --external @getstrata/core/security/safeFetch --external @getstrata/core/security/safePath --external @getstrata/core/security/safeUrl --external @getstrata/core/security/scimTenantTokens --external @getstrata/core/security/securityEvents --external @getstrata/core/security/stripeWebhook --external @getstrata/core/security/webhookSignature --external @getstrata/core/security/timingSafeCompare --external @getstrata/core/security/tokenExpiry --external @getstrata/core/security/totp --external @getstrata/core/storage/storage --external @getstrata/core/tenant/tenancyConfig --external @getstrata/core/tenant/tenantContext --external @getstrata/core/tenant/tenantDatabaseScope --external @getstrata/core/tenant/databaseTenantContext --external @getstrata/core/tenant/tenantMiddleware --external @getstrata/core/tenant/enableTenantRls --external @getstrata/core/terminal/runShell --external @getstrata/core/tracing/traceContext --external @getstrata/core/tracing/tracingMiddleware --external @getstrata/core/validation/rules --external @getstrata/core/view",
     "build:shims": "bun ../../scripts/write-core-shared-shims.ts"
   },
   "publishConfig": {