@getstrata/core 2.2.30 → 2.2.32

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @getstrata/core changelog
 
+## 2.2.32
+
+Generated JSON and HTML email verification now atomically consumes the one-time link with the account update and immediate observers, including SQLite/non-RLS apps. Failed verification remains retryable. Adds actual signed HTTP rollback, purpose/expiry/admission, concurrency and replay regressions while preserving existing response contracts.
+
+## 2.2.31
+
+Preserve JWT issuance precision across millisecond revocation cutoffs without changing expiration. Generated MFA setup rejects stale concurrent state changes and atomically commits credential revocation in SQLite/non-RLS as well as Postgres RLS. Adds real HTTP initial/replacement races, revocation rollback and withheld-success recovery regressions; intentional fresh replacement remains supported.
+
 ## 2.2.30
 
 Basic authentication resolution is reused only within the same Request and unchanged credentials, preventing middleware/controller lookups from consuming MFA recovery proofs twice. Adds real HTTP replay/concurrency and credential/guard invalidation regressions.

package/dist/entries/auth/jwt.js

@@ -124,11 +124,11 @@ function signaturesMatch(left, right) {
   return timingSafeEqual(leftBuffer, rightBuffer);
 }
 function signJwt(payload, options = {}) {
-  const now = Math.floor(Date.now() / 1000);
+  const issuedAt = Date.now() / 1000;
   const body = {
     ...payload,
-    iat: now,
-    exp: now + jwtTtlSeconds(options.ttlSeconds)
+    iat: issuedAt,
+    exp: Math.floor(issuedAt) + jwtTtlSeconds(options.ttlSeconds)
   };
   const header = encodeJson({ alg: "HS256", typ: "JWT" });
   const data = encodeJson(body);

package/dist/entries/auth/jwtGuard.js

@@ -292,11 +292,11 @@ function signaturesMatch(left, right) {
   return timingSafeEqual(leftBuffer, rightBuffer);
 }
 function signJwt(payload, options = {}) {
-  const now = Math.floor(Date.now() / 1000);
+  const issuedAt = Date.now() / 1000;
   const body = {
     ...payload,
-    iat: now,
-    exp: now + jwtTtlSeconds(options.ttlSeconds)
+    iat: issuedAt,
+    exp: Math.floor(issuedAt) + jwtTtlSeconds(options.ttlSeconds)
   };
   const header = encodeJson({ alg: "HS256", typ: "JWT" });
   const data = encodeJson(body);

package/dist/index.js

@@ -1920,11 +1920,11 @@ function signaturesMatch(left, right) {
   return timingSafeEqual2(leftBuffer, rightBuffer);
 }
 function signJwt(payload, options = {}) {
-  const now = Math.floor(Date.now() / 1000);
+  const issuedAt = Date.now() / 1000;
   const body = {
     ...payload,
-    iat: now,
-    exp: now + jwtTtlSeconds(options.ttlSeconds)
+    iat: issuedAt,
+    exp: Math.floor(issuedAt) + jwtTtlSeconds(options.ttlSeconds)
   };
   const header = encodeJson({ alg: "HS256", typ: "JWT" });
   const data = encodeJson(body);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "2.2.30",
+  "version": "2.2.32",
   "description": "Strata Bun framework public API",
   "type": "module",
   "license": "MIT",