@getstrata/core 2.2.33 → 2.2.34

package/dist/entries/auth/sessionGuard.js

@@ -147,9 +147,54 @@ function resolveAbilitiesForRole(role) {
   return [...MEMBER_ABILITIES];
 }
 
+// ../../src/core/auth/accountState.ts
+function isAccountActive(record) {
+  return record.is_active === undefined || record.is_active === true;
+}
+function isAuthUserActive(user) {
+  return user.isActive === undefined || user.isActive === true;
+}
+function matchesAuthVersion(issued, current) {
+  if (current === undefined)
+    return true;
+  return Number.isSafeInteger(current) && current >= 0 && typeof issued === "number" && Number.isSafeInteger(issued) && issued >= 0 && issued === current;
+}
+
 // ../../src/core/auth/sessionCookie.ts
 import { createHmac, timingSafeEqual } from "crypto";
 
+// ../../src/core/http/cookies.ts
+function readRequestCookie(request, name) {
+  const cookies = request.cookies;
+  if (cookies && typeof cookies.get === "function") {
+    const value = cookies.get(name);
+    if (value) {
+      return value;
+    }
+  }
+  const header = request.headers.get("cookie");
+  if (!header) {
+    return null;
+  }
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx === -1)
+      continue;
+    const cookieName = part.slice(0, idx).trim();
+    if (cookieName !== name)
+      continue;
+    try {
+      return decodeURIComponent(part.slice(idx + 1).trim());
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function readBunRequestCookie(request, name) {
+  return request.cookies.get(name) ?? readRequestCookie(request, name);
+}
+
 // ../../src/core/runtime/appEnv.ts
 var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
 function normalizeEnvValue(value) {
@@ -256,25 +301,12 @@ function sessionRememberTtlSeconds() {
 function resolveSessionSecret() {
   return requireConfiguredSecret(["SESSION_SECRET"], "session-secret");
 }
-function signSession(userId, issuedAt, ttlSeconds) {
-  const payload = ttlSeconds === undefined ? `${userId}.${issuedAt}` : `${userId}.${issuedAt}.${ttlSeconds}`;
+function signSession(userId, issuedAt, ttlSeconds, authVersion) {
+  const payload = authVersion !== undefined ? `v2.${userId}.${issuedAt}.${ttlSeconds}.${authVersion}` : ttlSeconds === undefined ? `${userId}.${issuedAt}` : `${userId}.${issuedAt}.${ttlSeconds}`;
   const signature = createHmac("sha256", resolveSessionSecret()).update(payload).digest("hex");
   return `${payload}.${signature}`;
 }
-function readCookieValue(request, cookieName) {
-  const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) {
-    return null;
-  }
-  for (const part of cookieHeader.split(";")) {
-    const [name, ...rest] = part.trim().split("=");
-    if (name === cookieName) {
-      return decodeURIComponent(rest.join("="));
-    }
-  }
-  return null;
-}
-function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds, remember) {
+function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds, remember, authVersion) {
   const userId = Number.parseInt(userIdRaw, 10);
   const issuedAt = Number.parseInt(issuedAtRaw, 10);
   if (!Number.isInteger(userId) || userId <= 0 || !Number.isFinite(issuedAt)) {
@@ -286,7 +318,7 @@ function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds,
   if (Date.now() - issuedAt > ttlSeconds * 1000) {
     return null;
   }
-  const expectedSignature = (remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt)).split(".").pop();
+  const expectedSignature = (authVersion !== undefined ? signSession(userId, issuedAt, ttlSeconds, authVersion) : remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt)).split(".").pop();
   if (!expectedSignature || !cookieSignature) {
     return null;
   }
@@ -298,14 +330,20 @@ function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds,
   if (!timingSafeEqual(expectedBuffer, actualBuffer)) {
     return null;
   }
-  return { userId, issuedAt };
+  return { userId, issuedAt, ...authVersion !== undefined ? { authVersion } : {} };
 }
 function readSession(request) {
-  const cookieValue = readCookieValue(request, sessionCookieName());
+  const cookieValue = readRequestCookie(request, sessionCookieName());
   if (!cookieValue) {
     return null;
   }
   const parts = cookieValue.split(".");
+  if (parts.length === 6 && parts[0] === "v2") {
+    const fields = parts.slice(1, 5);
+    if (fields.some((value) => !/^(0|[1-9][0-9]*)$/.test(value) || !Number.isSafeInteger(Number(value))))
+      return null;
+    return readSignedSession(String(parts[1]), String(parts[2]), parts[5], Number(parts[3]), true, Number(parts[4]));
+  }
   if (parts.length === 4) {
     const [userIdRaw, issuedAtRaw, ttlRaw, cookieSignature] = parts;
     return readSignedSession(String(userIdRaw), String(issuedAtRaw), cookieSignature, Number.parseInt(String(ttlRaw), 10), true);
@@ -330,15 +368,18 @@ function isSessionInvalidated(issuedAt, validAfter) {
   return issuedAt < timestamp;
 }
 function createSessionCookieDetails(userId, options = {}) {
+  if (options.authVersion !== undefined && (!Number.isSafeInteger(options.authVersion) || options.authVersion < 0))
+    throw new RangeError("authVersion must be a non-negative safe integer.");
   const issuedAt = Date.now();
   const ttlSeconds = options.remember ? sessionRememberTtlSeconds() : sessionTtlSeconds();
-  const value = options.remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt);
+  const value = options.authVersion !== undefined ? signSession(userId, issuedAt, ttlSeconds, options.authVersion) : options.remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt);
   const secure = isProductionEnv() ? "; Secure" : "";
   return {
     header: `${sessionCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${ttlSeconds}${secure}`,
     userId,
     issuedAt,
-    ttlSeconds
+    ttlSeconds,
+    ...options.authVersion !== undefined ? { authVersion: options.authVersion } : {}
   };
 }
 function createSessionCookie(userId, options = {}) {
@@ -366,7 +407,9 @@ class SessionGuard {
     }
     try {
       const user = await tokenService.findByIdOrThrow(session.userId);
-      if (isSessionInvalidated(session.issuedAt, user.session_valid_after)) {
+      if (!isAccountActive(user) || !matchesAuthVersion(session.authVersion, user.auth_version))
+        return null;
+      if (user.auth_version === undefined && isSessionInvalidated(session.issuedAt, user.session_valid_after)) {
         return null;
       }
       if (typeof tokenService.hasActiveBrowserSession === "function") {
@@ -378,6 +421,7 @@ class SessionGuard {
       return {
         id: user.id,
         role: user.role,
+        ...user.auth_version !== undefined ? { authVersion: user.auth_version } : {},
         abilities: resolveAbilitiesForRole(user.role),
         emailVerifiedAt: user.email_verified_at ?? null
       };

package/dist/entries/http/cookies.js

@@ -19,7 +19,11 @@ function readRequestCookie(request, name) {
     const cookieName = part.slice(0, idx).trim();
     if (cookieName !== name)
       continue;
-    return decodeURIComponent(part.slice(idx + 1).trim());
+    try {
+      return decodeURIComponent(part.slice(idx + 1).trim());
+    } catch {
+      return null;
+    }
   }
   return null;
 }

package/dist/entries/http/csrfMiddleware.js

@@ -139,7 +139,11 @@ function readRequestCookie(request, name) {
     const cookieName = part.slice(0, idx).trim();
     if (cookieName !== name)
       continue;
-    return decodeURIComponent(part.slice(idx + 1).trim());
+    try {
+      return decodeURIComponent(part.slice(idx + 1).trim());
+    } catch {
+      return null;
+    }
   }
   return null;
 }

package/dist/entries/http/csrfToken.js

@@ -135,7 +135,11 @@ function readRequestCookie(request, name) {
     const cookieName = part.slice(0, idx).trim();
     if (cookieName !== name)
       continue;
-    return decodeURIComponent(part.slice(idx + 1).trim());
+    try {
+      return decodeURIComponent(part.slice(idx + 1).trim());
+    } catch {
+      return null;
+    }
   }
   return null;
 }

package/dist/entries/http/requirePasswordConfirmMiddleware.js

@@ -106,7 +106,7 @@ function createRequirePasswordConfirmMiddleware() {
       return Response.redirect("/login", 302);
     }
     const userId = resolveUserId(user);
-    if (hasFreshPasswordConfirmation(request, userId)) {
+    if (hasFreshPasswordConfirmation(request, userId, user.authVersion)) {
       return await next();
     }
     if (requestPrefersJson(request)) {

package/dist/index.js

@@ -1348,6 +1348,19 @@ function readBasicCredentials(request) {
 // ../../src/core/auth/basicAuthGuard.ts
 init_databaseTenantContext();
 
+// ../../src/core/auth/accountState.ts
+function isAccountActive(record) {
+  return record.is_active === undefined || record.is_active === true;
+}
+function isAuthUserActive(user) {
+  return user.isActive === undefined || user.isActive === true;
+}
+function matchesAuthVersion(issued, current) {
+  if (current === undefined)
+    return true;
+  return Number.isSafeInteger(current) && current >= 0 && typeof issued === "number" && Number.isSafeInteger(issued) && issued >= 0 && issued === current;
+}
+
 // ../../src/core/auth/password.ts
 async function hashPassword(password) {
   return await Bun.password.hash(password, {
@@ -1741,6 +1754,8 @@ function parseRecoveryHashes(raw) {
   }
 }
 function completePasswordLogin(user, options = {}) {
+  if (!isAccountActive(user))
+    return { ok: false, error: "account_inactive" };
   if (!user.mfa_enabled) {
     return { ok: true };
   }
@@ -1804,6 +1819,8 @@ class BasicAuthGuard {
       return null;
     }
     const record = typeof directory.findByEmail === "function" ? await directory.findByEmail(credentials.username) : null;
+    if (record && !isAccountActive(record))
+      return null;
     if (record?.password) {
       if (!await verifyPassword(credentials.password, record.password)) {
         return null;
@@ -1821,12 +1838,13 @@ class BasicAuthGuard {
       return {
         id: record.id,
         role: record.role,
+        ...record.auth_version !== undefined ? { authVersion: record.auth_version } : {},
         emailVerifiedAt: record.email_verified_at ?? null
       };
     }
     if (typeof directory.verifyCredentials === "function") {
       const user = await directory.verifyCredentials(credentials.username, credentials.password);
-      if (!user) {
+      if (!user || !isAuthUserActive(user)) {
         return null;
       }
       let record = typeof directory.findByEmail === "function" ? await directory.findByEmail(credentials.username) : null;
@@ -1959,6 +1977,38 @@ function verifyJwt(token, secret) {
   return payload;
 }
 
+// ../../src/core/http/cookies.ts
+function readRequestCookie(request, name) {
+  const cookies = request.cookies;
+  if (cookies && typeof cookies.get === "function") {
+    const value = cookies.get(name);
+    if (value) {
+      return value;
+    }
+  }
+  const header = request.headers.get("cookie");
+  if (!header) {
+    return null;
+  }
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx === -1)
+      continue;
+    const cookieName = part.slice(0, idx).trim();
+    if (cookieName !== name)
+      continue;
+    try {
+      return decodeURIComponent(part.slice(idx + 1).trim());
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function readBunRequestCookie(request, name) {
+  return request.cookies.get(name) ?? readRequestCookie(request, name);
+}
+
 // ../../src/core/auth/sessionCookie.ts
 var SESSION_COOKIE = appCookieName("session");
 var SESSION_TTL_SECONDS = 60 * 60 * 24 * 7;
@@ -2025,10 +2075,15 @@ class JwtGuard {
     } catch {
       return null;
     }
-    if (isSessionInvalidated(payload.iat * 1000, record.session_valid_after)) {
+    if (!isAccountActive(record) || !matchesAuthVersion(payload.authVersion, record.auth_version))
+      return null;
+    if (record.auth_version === undefined && isSessionInvalidated(payload.iat * 1000, record.session_valid_after)) {
       return null;
     }
-    return authUserFromJwt(payload);
+    return {
+      ...authUserFromJwt(payload),
+      ...record.auth_version !== undefined ? { authVersion: record.auth_version } : {}
+    };
   }
 }
 
@@ -2074,7 +2129,7 @@ class ApiTokenGuard {
     if (!token || !timingSafeCompareString(token, this.options.token)) {
       return null;
     }
-    return this.options.user;
+    return isAuthUserActive(this.options.user) ? this.options.user : null;
   }
 }
 
@@ -2092,7 +2147,8 @@ class DatabaseTokenGuard {
     if (!tokenService || typeof tokenService.resolveUserFromToken !== "function") {
       return null;
     }
-    return await tokenService.resolveUserFromToken(token);
+    const user = await tokenService.resolveUserFromToken(token);
+    return user && isAuthUserActive(user) ? user : null;
   }
 }
 
@@ -2104,7 +2160,7 @@ class CompositeGuard {
   async resolve(request) {
     for (const guard of this.guards) {
       const user = await Promise.resolve(guard.resolve(request));
-      if (user) {
+      if (user && isAuthUserActive(user)) {
         return user;
       }
     }
@@ -2148,7 +2204,8 @@ class AuthManager {
   }
   async resolveWithSource(request) {
     if (!request) {
-      return { user: currentAuthUser(), credentialSource: null };
+      const user = currentAuthUser();
+      return { user: user && isAuthUserActive(user) ? user : null, credentialSource: null };
     }
     if (authorizationScheme(request) !== "basic") {
       this.basicResolutions.delete(request);
@@ -2183,6 +2240,10 @@ class AuthManager {
     }
     return user;
   }
+  async resolveGuard(guard, request) {
+    const user = await guard.resolve(request);
+    return user && isAuthUserActive(user) ? user : null;
+  }
   async authenticateRequest(request) {
     const scheme = authorizationScheme(request);
     if (scheme === "bearer") {
@@ -2191,7 +2252,7 @@ class AuthManager {
         return { user: fromNamed, credentialSource: "bearer" };
       }
       if (isBearerCapableGuard(this.guard)) {
-        const fromDefault = await Promise.resolve(this.guard.resolve(request));
+        const fromDefault = await this.resolveGuard(this.guard, request);
         return { user: fromDefault, credentialSource: fromDefault ? "bearer" : null };
       }
       return { user: null, credentialSource: null };
@@ -2202,7 +2263,7 @@ class AuthManager {
         return { user: fromNamed, credentialSource: "basic" };
       }
       if (this.guard instanceof BasicAuthGuard) {
-        const fromDefault = await this.guard.resolve(request);
+        const fromDefault = await this.resolveGuard(this.guard, request);
         return { user: fromDefault, credentialSource: fromDefault ? "basic" : null };
       }
       return { user: null, credentialSource: null };
@@ -2211,7 +2272,7 @@ class AuthManager {
     if (fromSession) {
       return { user: fromSession, credentialSource: "session" };
     }
-    const fromDefault = await Promise.resolve(this.guard.resolve(request));
+    const fromDefault = await this.resolveGuard(this.guard, request);
     if (!fromDefault) {
       return { user: null, credentialSource: null };
     }
@@ -2226,7 +2287,7 @@ class AuthManager {
         continue;
       }
       seen.add(named);
-      const user = await Promise.resolve(named.resolve(request));
+      const user = await this.resolveGuard(named, request);
       if (user) {
         return user;
       }
@@ -11743,33 +11804,6 @@ function resolveContentSecurityPolicy(response, options = {}) {
   }
   return resolveHtmlContentSecurityPolicy(options);
 }
-// ../../src/core/http/cookies.ts
-function readRequestCookie(request, name) {
-  const cookies = request.cookies;
-  if (cookies && typeof cookies.get === "function") {
-    const value = cookies.get(name);
-    if (value) {
-      return value;
-    }
-  }
-  const header = request.headers.get("cookie");
-  if (!header) {
-    return null;
-  }
-  for (const part of header.split(";")) {
-    const idx = part.indexOf("=");
-    if (idx === -1)
-      continue;
-    const cookieName = part.slice(0, idx).trim();
-    if (cookieName !== name)
-      continue;
-    return decodeURIComponent(part.slice(idx + 1).trim());
-  }
-  return null;
-}
-function readBunRequestCookie(request, name) {
-  return request.cookies.get(name) ?? readRequestCookie(request, name);
-}
 // ../../src/core/http/corsMiddleware.ts
 function additionalHeaders(options) {
   const configured = process.env.CORS_ADDITIONAL_ALLOWED_HEADERS?.trim();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "2.2.33",
+  "version": "2.2.34",
   "description": "Strata Bun framework public API",
   "type": "module",
   "license": "MIT",
@@ -15,6 +15,16 @@
       "import": "./dist/index.js",
       "default": "./dist/index.js"
     },
+    "./auth/accountState": {
+      "types": "./dist/core/auth/accountState.d.ts",
+      "import": "./dist/entries/auth/accountState.js",
+      "default": "./dist/entries/auth/accountState.js"
+    },
+    "./auth/accountStateMigration": {
+      "types": "./dist/core/auth/accountStateMigration.d.ts",
+      "import": "./dist/entries/auth/accountStateMigration.js",
+      "default": "./dist/entries/auth/accountStateMigration.js"
+    },
     "./auth/accessControl": {
       "types": "./dist/core/auth/accessControl.d.ts",
       "import": "./dist/entries/auth/accessControl.js",
@@ -115,6 +125,11 @@
       "import": "./dist/entries/auth/passwordLogin.js",
       "default": "./dist/entries/auth/passwordLogin.js"
     },
+    "./auth/pendingMfaCookie": {
+      "types": "./dist/core/auth/pendingMfaCookie.d.ts",
+      "import": "./dist/entries/auth/pendingMfaCookie.js",
+      "default": "./dist/entries/auth/pendingMfaCookie.js"
+    },
     "./auth/oneTimeToken": {
       "types": "./dist/core/auth/oneTimeToken.d.ts",
       "import": "./dist/entries/auth/oneTimeToken.js",
@@ -943,7 +958,7 @@
     "build:bundle": "bun build index.ts --outdir dist --target bun --external bun --external '@opentelemetry/*' --external eta --external mysql2 --external @node-saml/node-saml",
     "build:types": "tsc -p tsconfig.types.json",
     "prepublishOnly": "bun run build && bun ../../scripts/prepare-core-package-publish.ts",
-    "build:subpaths": "bun build entries/auth/accessControl.ts entries/auth/abilityChecker.ts entries/auth/emailVerification.ts entries/auth/jwt.ts entries/auth/jwtGuard.ts entries/auth/basicAuthGuard.ts entries/auth/tokenAbilityChecker.ts entries/auth/membershipMiddleware.ts entries/auth/membershipScope.ts entries/auth/membershipService.ts entries/auth/oauth/oidcProvider.ts entries/auth/oauth/providers.ts entries/auth/oauth/samlProvider.ts entries/auth/oauth/types.ts entries/auth/saml/samlServiceProvider.ts entries/auth/password.ts entries/auth/passwordLogin.ts entries/auth/oneTimeToken.ts entries/auth/intendedUrlCookie.ts entries/auth/passwordConfirmCookie.ts entries/auth/policy.ts entries/auth/scimAuthMiddleware.ts entries/auth/sessionCookie.ts entries/auth/sessionGuard.ts entries/auth/tokenHash.ts entries/audit/exportAuditLogs.ts entries/audit/siemFormatter.ts entries/admin/formatValue.ts entries/admin/registry.ts entries/admin/types.ts entries/cache/tags.ts entries/cache/createCacheStore.ts entries/cache/repository.ts entries/cache/simpleCache.ts entries/cache/simpleCacheStore.ts entries/config/envSchema.ts entries/contracts/serviceTokens.ts entries/contracts/authUserDirectory.ts entries/contracts/container.ts entries/contracts/di.ts entries/crypto/fieldEncryption.ts entries/crypto/mfaSecret.ts entries/database/errors.ts entries/database/factory.ts entries/database/migrations.ts entries/database/migrations/types.ts entries/database/query.ts entries/database/relationships.ts entries/database/repositoryQuery.ts entries/database/seeders.ts entries/database/seeders/types.ts entries/database/schema.ts entries/database/sqliteConnection.ts entries/database/table.ts entries/database/types.ts entries/database/whereBuilder.ts entries/facades.ts entries/http/authMiddleware.ts entries/http/authorizeMiddleware.ts entries/http/bodySizeLimitMiddleware.ts entries/http/clientIp.ts entries/http/cookies.ts entries/http/contentNegotiation.ts entries/http/conditionalResponse.ts entries/http/corsMiddleware.ts entries/http/csrfMiddleware.ts entries/http/csrfProtection.ts entries/http/csrfToken.ts entries/http/etag.ts entries/http/flashSession.ts entries/http/flashMiddleware.ts entries/http/formRequest.ts entries/http/metricsMiddleware.ts entries/http/memoryThrottleMiddleware.ts entries/http/pagination.ts entries/http/parseFormBody.ts entries/http/parseMultipartUpload.ts entries/http/requireAbilityMiddleware.ts entries/http/requireAuthMiddleware.ts entries/http/requireGlobalAdminMiddleware.ts entries/http/requireWebAuthMiddleware.ts entries/http/requireVerifiedMiddleware.ts entries/http/requirePasswordConfirmMiddleware.ts entries/http/resources.ts entries/http/response.ts entries/http/route.ts entries/http/routeMiddleware.ts entries/http/routeModelBinding.ts entries/http/safeInternalPath.ts entries/http/signedUrl.ts entries/http/statelessAuth.ts entries/http/scimThrottleMiddleware.ts entries/http/securityHeadersMiddleware.ts entries/http/securedRouteModelBinding.ts entries/http/webFormRequest.ts entries/http/throttleMiddleware.ts entries/http/uploads.ts entries/http/validation.ts entries/jobs/exportAuditLogsJob.ts entries/jobs/invalidateCacheTagsJob.ts entries/logging/logger.ts entries/logging/requestLoggingMiddleware.ts entries/mail/mailer.ts entries/mail/markdownMail.ts entries/mail/markdownMailable.ts entries/mail/sanitizeMailHtml.ts entries/media/imageTransform.ts entries/metrics/prometheus.ts entries/openapi/generator.ts entries/openapi/registeredRoute.ts entries/openapi/validate.ts entries/pagination.ts entries/queue.ts entries/queue/createAppQueue.ts entries/queue/failedJobRepository.ts entries/queue/failedJobService.ts entries/queue/jobRunner.ts entries/queue/queueMetrics.ts entries/queue/publicQueue.ts entries/queue/redisQueue.ts entries/queue/types.ts entries/runtime/appEnv.ts entries/runtime/frontendMode.ts entries/runtime/asyncContextStore.ts entries/scheduler/osCron.ts entries/security/oauthState.ts entries/security/publicReads.ts entries/security/recoveryCodes.ts entries/security/safeFetch.ts entries/security/safePath.ts entries/security/scimTenantTokens.ts entries/security/stripeWebhook.ts entries/security/webhookSignature.ts entries/security/timingSafeCompare.ts entries/security/tokenExpiry.ts entries/security/totp.ts entries/storage/storage.ts entries/tenant/tenancyConfig.ts entries/tenant/tenantDatabaseScope.ts entries/tenant/databaseTenantContext.ts entries/tenant/enableTenantRls.ts entries/terminal/runShell.ts entries/tracing/tracingMiddleware.ts entries/validation/rules.ts --outdir dist --root . --target bun --external bun --external '@opentelemetry/*' --external eta --external mysql2 --external @node-saml/node-saml --external @getstrata/core --external @getstrata/core/auth/accessControl --external @getstrata/core/auth/abilityChecker --external @getstrata/core/auth/authContext --external @getstrata/core/auth/emailVerification --external @getstrata/core/auth/guard --external @getstrata/core/auth/jwt --external @getstrata/core/auth/jwtGuard --external @getstrata/core/auth/basicAuthGuard --external @getstrata/core/auth/tokenAbilityChecker --external @getstrata/core/auth/membershipContext --external @getstrata/core/auth/membershipMiddleware --external @getstrata/core/auth/membershipScope --external @getstrata/core/auth/membershipService --external @getstrata/core/auth/oauth/oidcProvider --external @getstrata/core/auth/oauth/providers --external @getstrata/core/auth/oauth/samlProvider --external @getstrata/core/auth/oauth/types --external @getstrata/core/auth/saml/samlServiceProvider --external @getstrata/core/auth/password --external @getstrata/core/auth/passwordLogin --external @getstrata/core/auth/oneTimeToken --external @getstrata/core/auth/intendedUrlCookie --external @getstrata/core/auth/passwordConfirmCookie --external @getstrata/core/auth/policy --external @getstrata/core/auth/scimAuthMiddleware --external @getstrata/core/auth/sessionCookie --external @getstrata/core/auth/sessionGuard --external @getstrata/core/auth/tokenHash --external @getstrata/core/audit/exportAuditLogs --external @getstrata/core/audit/siemFormatter --external @getstrata/core/admin/formatValue --external @getstrata/core/admin/registry --external @getstrata/core/admin/types --external @getstrata/core/cache/tags --external @getstrata/core/cache/createCacheStore --external @getstrata/core/cache/repository --external @getstrata/core/cache/simpleCache --external @getstrata/core/cache/simpleCacheStore --external @getstrata/core/config/envSchema --external @getstrata/core/contracts/serviceTokens --external @getstrata/core/contracts/authUserDirectory --external @getstrata/core/contracts/container --external @getstrata/core/contracts/di --external @getstrata/core/crypto/fieldEncryption --external @getstrata/core/crypto/fieldEncryptionRotation --external @getstrata/core/crypto/mfaSecret --external @getstrata/core/database --external @getstrata/core/database/baseRepository --external @getstrata/core/database/bindConnection --external @getstrata/core/database/boundConnection --external @getstrata/core/database/bunSql --external @getstrata/core/database/connection --external @getstrata/core/database/connectionContext --external @getstrata/core/database/defaultConnection --external @getstrata/core/database/dialect --external @getstrata/core/database/mysqlConnection --external @getstrata/core/database/namedConnections --external @getstrata/core/database/errors --external @getstrata/core/database/factory --external @getstrata/core/database/migrations --external @getstrata/core/database/migrations/types --external @getstrata/core/database/model --external @getstrata/core/database/query --external @getstrata/core/database/relationships --external @getstrata/core/database/repositoryConnection --external @getstrata/core/database/repositoryQuery --external @getstrata/core/database/seeders --external @getstrata/core/database/seeders/types --external @getstrata/core/database/schema --external @getstrata/core/database/sqliteConnection --external @getstrata/core/database/table --external @getstrata/core/database/transaction --external @getstrata/core/database/types --external @getstrata/core/database/whereBuilder --external @getstrata/core/errors/http --external @getstrata/core/events --external @getstrata/core/events/outbox --external @getstrata/core/facades --external @getstrata/core/http --external @getstrata/core/http/authMiddleware --external @getstrata/core/http/authorizeMiddleware --external @getstrata/core/http/bodySizeLimitMiddleware --external @getstrata/core/http/clientIp --external @getstrata/core/http/cookies --external @getstrata/core/http/contentNegotiation --external @getstrata/core/http/contentSecurityPolicy --external @getstrata/core/http/conditionalResponse --external @getstrata/core/http/corsMiddleware --external @getstrata/core/http/csrfMiddleware --external @getstrata/core/http/csrfProtection --external @getstrata/core/http/csrfToken --external @getstrata/core/http/etag --external @getstrata/core/http/flashSession --external @getstrata/core/http/flashMiddleware --external @getstrata/core/http/formRequest --external @getstrata/core/http/middleware --external @getstrata/core/http/metricsMiddleware --external @getstrata/core/http/loginThrottleMiddleware --external @getstrata/core/http/memoryThrottleMiddleware --external @getstrata/core/http/pagination --external @getstrata/core/http/parseFormBody --external @getstrata/core/http/parseMultipartUpload --external @getstrata/core/http/requireAbilityMiddleware --external @getstrata/core/http/requireAuthMiddleware --external @getstrata/core/http/requireGlobalAdminMiddleware --external @getstrata/core/http/requireWebAuthMiddleware --external @getstrata/core/http/requireVerifiedMiddleware --external @getstrata/core/http/requirePasswordConfirmMiddleware --external @getstrata/core/http/resources --external @getstrata/core/http/response --external @getstrata/core/http/route --external @getstrata/core/http/routeMiddleware --external @getstrata/core/http/routeModelBinding --external @getstrata/core/http/safeInternalPath --external @getstrata/core/http/signedUrl --external @getstrata/core/http/statelessAuth --external @getstrata/core/http/scimThrottleMiddleware --external @getstrata/core/http/securityHeadersMiddleware --external @getstrata/core/http/securedRouteModelBinding --external @getstrata/core/http/requestMetaContext --external @getstrata/core/http/webErrorResponse --external @getstrata/core/http/webFormRequest --external @getstrata/core/http/throttleMiddleware --external @getstrata/core/http/uploads --external @getstrata/core/http/validation --external @getstrata/core/jobs/exportAuditLogsJob --external @getstrata/core/jobs/invalidateCacheTagsJob --external @getstrata/core/lifecycle/gracefulShutdown --external @getstrata/core/logging/logger --external @getstrata/core/logging/requestLoggingMiddleware --external @getstrata/core/mail/mailer --external @getstrata/core/mail/markdownMail --external @getstrata/core/mail/markdownMailable --external @getstrata/core/mail/sanitizeMailHtml --external @getstrata/core/media/imageTransform --external @getstrata/core/metrics/prometheus --external @getstrata/core/notifications --external @getstrata/core/openapi/generator --external @getstrata/core/openapi/registeredRoute --external @getstrata/core/openapi/validate --external @getstrata/core/pagination --external @getstrata/core/queue --external @getstrata/core/queue/createAppQueue --external @getstrata/core/queue/failedJobRepository --external @getstrata/core/queue/failedJobService --external @getstrata/core/queue/jobRegistry --external @getstrata/core/queue/jobRunner --external @getstrata/core/queue/queueMetrics --external @getstrata/core/queue/publicQueue --external @getstrata/core/queue/redisQueue --external @getstrata/core/queue/types --external @getstrata/core/runtime/appEnv --external @getstrata/core/runtime/appKeyPrefix --external @getstrata/core/runtime/frontendMode --external @getstrata/core/runtime/applicationRegistry --external @getstrata/core/runtime/asyncContextStore --external @getstrata/core/scheduler/schedule --external @getstrata/core/scheduler/osCron --external @getstrata/core/security/oauthState --external @getstrata/core/security/publicReads --external @getstrata/core/security/recoveryCodes --external @getstrata/core/security/safeFetch --external @getstrata/core/security/safePath --external @getstrata/core/security/safeUrl --external @getstrata/core/security/scimTenantTokens --external @getstrata/core/security/securityEvents --external @getstrata/core/security/stripeWebhook --external @getstrata/core/security/webhookSignature --external @getstrata/core/security/timingSafeCompare --external @getstrata/core/security/tokenExpiry --external @getstrata/core/security/totp --external @getstrata/core/storage/storage --external @getstrata/core/tenant/tenancyConfig --external @getstrata/core/tenant/tenantContext --external @getstrata/core/tenant/tenantDatabaseScope --external @getstrata/core/tenant/databaseTenantContext --external @getstrata/core/tenant/tenantMiddleware --external @getstrata/core/tenant/enableTenantRls --external @getstrata/core/terminal/runShell --external @getstrata/core/tracing/traceContext --external @getstrata/core/tracing/tracingMiddleware --external @getstrata/core/validation/rules --external @getstrata/core/view",
+    "build:subpaths": "bun build entries/auth/accountState.ts entries/auth/accountStateMigration.ts entries/auth/accessControl.ts entries/auth/abilityChecker.ts entries/auth/emailVerification.ts entries/auth/jwt.ts entries/auth/jwtGuard.ts entries/auth/basicAuthGuard.ts entries/auth/tokenAbilityChecker.ts entries/auth/membershipMiddleware.ts entries/auth/membershipScope.ts entries/auth/membershipService.ts entries/auth/oauth/oidcProvider.ts entries/auth/oauth/providers.ts entries/auth/oauth/samlProvider.ts entries/auth/oauth/types.ts entries/auth/saml/samlServiceProvider.ts entries/auth/password.ts entries/auth/passwordLogin.ts entries/auth/pendingMfaCookie.ts entries/auth/oneTimeToken.ts entries/auth/intendedUrlCookie.ts entries/auth/passwordConfirmCookie.ts entries/auth/policy.ts entries/auth/scimAuthMiddleware.ts entries/auth/sessionCookie.ts entries/auth/sessionGuard.ts entries/auth/tokenHash.ts entries/audit/exportAuditLogs.ts entries/audit/siemFormatter.ts entries/admin/formatValue.ts entries/admin/registry.ts entries/admin/types.ts entries/cache/tags.ts entries/cache/createCacheStore.ts entries/cache/repository.ts entries/cache/simpleCache.ts entries/cache/simpleCacheStore.ts entries/config/envSchema.ts entries/contracts/serviceTokens.ts entries/contracts/authUserDirectory.ts entries/contracts/container.ts entries/contracts/di.ts entries/crypto/fieldEncryption.ts entries/crypto/mfaSecret.ts entries/database/errors.ts entries/database/factory.ts entries/database/migrations.ts entries/database/migrations/types.ts entries/database/query.ts entries/database/relationships.ts entries/database/repositoryQuery.ts entries/database/seeders.ts entries/database/seeders/types.ts entries/database/schema.ts entries/database/sqliteConnection.ts entries/database/table.ts entries/database/types.ts entries/database/whereBuilder.ts entries/facades.ts entries/http/authMiddleware.ts entries/http/authorizeMiddleware.ts entries/http/bodySizeLimitMiddleware.ts entries/http/clientIp.ts entries/http/cookies.ts entries/http/contentNegotiation.ts entries/http/conditionalResponse.ts entries/http/corsMiddleware.ts entries/http/csrfMiddleware.ts entries/http/csrfProtection.ts entries/http/csrfToken.ts entries/http/etag.ts entries/http/flashSession.ts entries/http/flashMiddleware.ts entries/http/formRequest.ts entries/http/metricsMiddleware.ts entries/http/memoryThrottleMiddleware.ts entries/http/pagination.ts entries/http/parseFormBody.ts entries/http/parseMultipartUpload.ts entries/http/requireAbilityMiddleware.ts entries/http/requireAuthMiddleware.ts entries/http/requireGlobalAdminMiddleware.ts entries/http/requireWebAuthMiddleware.ts entries/http/requireVerifiedMiddleware.ts entries/http/requirePasswordConfirmMiddleware.ts entries/http/resources.ts entries/http/response.ts entries/http/route.ts entries/http/routeMiddleware.ts entries/http/routeModelBinding.ts entries/http/safeInternalPath.ts entries/http/signedUrl.ts entries/http/statelessAuth.ts entries/http/scimThrottleMiddleware.ts entries/http/securityHeadersMiddleware.ts entries/http/securedRouteModelBinding.ts entries/http/webFormRequest.ts entries/http/throttleMiddleware.ts entries/http/uploads.ts entries/http/validation.ts entries/jobs/exportAuditLogsJob.ts entries/jobs/invalidateCacheTagsJob.ts entries/logging/logger.ts entries/logging/requestLoggingMiddleware.ts entries/mail/mailer.ts entries/mail/markdownMail.ts entries/mail/markdownMailable.ts entries/mail/sanitizeMailHtml.ts entries/media/imageTransform.ts entries/metrics/prometheus.ts entries/openapi/generator.ts entries/openapi/registeredRoute.ts entries/openapi/validate.ts entries/pagination.ts entries/queue.ts entries/queue/createAppQueue.ts entries/queue/failedJobRepository.ts entries/queue/failedJobService.ts entries/queue/jobRunner.ts entries/queue/queueMetrics.ts entries/queue/publicQueue.ts entries/queue/redisQueue.ts entries/queue/types.ts entries/runtime/appEnv.ts entries/runtime/frontendMode.ts entries/runtime/asyncContextStore.ts entries/scheduler/osCron.ts entries/security/oauthState.ts entries/security/publicReads.ts entries/security/recoveryCodes.ts entries/security/safeFetch.ts entries/security/safePath.ts entries/security/scimTenantTokens.ts entries/security/stripeWebhook.ts entries/security/webhookSignature.ts entries/security/timingSafeCompare.ts entries/security/tokenExpiry.ts entries/security/totp.ts entries/storage/storage.ts entries/tenant/tenancyConfig.ts entries/tenant/tenantDatabaseScope.ts entries/tenant/databaseTenantContext.ts entries/tenant/enableTenantRls.ts entries/terminal/runShell.ts entries/tracing/tracingMiddleware.ts entries/validation/rules.ts --outdir dist --root . --target bun --external bun --external '@opentelemetry/*' --external eta --external mysql2 --external @node-saml/node-saml --external @getstrata/core --external @getstrata/core/auth/accountState --external @getstrata/core/auth/accountStateMigration --external @getstrata/core/auth/accessControl --external @getstrata/core/auth/abilityChecker --external @getstrata/core/auth/authContext --external @getstrata/core/auth/emailVerification --external @getstrata/core/auth/guard --external @getstrata/core/auth/jwt --external @getstrata/core/auth/jwtGuard --external @getstrata/core/auth/basicAuthGuard --external @getstrata/core/auth/tokenAbilityChecker --external @getstrata/core/auth/membershipContext --external @getstrata/core/auth/membershipMiddleware --external @getstrata/core/auth/membershipScope --external @getstrata/core/auth/membershipService --external @getstrata/core/auth/oauth/oidcProvider --external @getstrata/core/auth/oauth/providers --external @getstrata/core/auth/oauth/samlProvider --external @getstrata/core/auth/oauth/types --external @getstrata/core/auth/saml/samlServiceProvider --external @getstrata/core/auth/password --external @getstrata/core/auth/passwordLogin --external @getstrata/core/auth/pendingMfaCookie --external @getstrata/core/auth/oneTimeToken --external @getstrata/core/auth/intendedUrlCookie --external @getstrata/core/auth/passwordConfirmCookie --external @getstrata/core/auth/policy --external @getstrata/core/auth/scimAuthMiddleware --external @getstrata/core/auth/sessionCookie --external @getstrata/core/auth/sessionGuard --external @getstrata/core/auth/tokenHash --external @getstrata/core/audit/exportAuditLogs --external @getstrata/core/audit/siemFormatter --external @getstrata/core/admin/formatValue --external @getstrata/core/admin/registry --external @getstrata/core/admin/types --external @getstrata/core/cache/tags --external @getstrata/core/cache/createCacheStore --external @getstrata/core/cache/repository --external @getstrata/core/cache/simpleCache --external @getstrata/core/cache/simpleCacheStore --external @getstrata/core/config/envSchema --external @getstrata/core/contracts/serviceTokens --external @getstrata/core/contracts/authUserDirectory --external @getstrata/core/contracts/container --external @getstrata/core/contracts/di --external @getstrata/core/crypto/fieldEncryption --external @getstrata/core/crypto/fieldEncryptionRotation --external @getstrata/core/crypto/mfaSecret --external @getstrata/core/database --external @getstrata/core/database/baseRepository --external @getstrata/core/database/bindConnection --external @getstrata/core/database/boundConnection --external @getstrata/core/database/bunSql --external @getstrata/core/database/connection --external @getstrata/core/database/connectionContext --external @getstrata/core/database/defaultConnection --external @getstrata/core/database/dialect --external @getstrata/core/database/mysqlConnection --external @getstrata/core/database/namedConnections --external @getstrata/core/database/errors --external @getstrata/core/database/factory --external @getstrata/core/database/migrations --external @getstrata/core/database/migrations/types --external @getstrata/core/database/model --external @getstrata/core/database/query --external @getstrata/core/database/relationships --external @getstrata/core/database/repositoryConnection --external @getstrata/core/database/repositoryQuery --external @getstrata/core/database/seeders --external @getstrata/core/database/seeders/types --external @getstrata/core/database/schema --external @getstrata/core/database/sqliteConnection --external @getstrata/core/database/table --external @getstrata/core/database/transaction --external @getstrata/core/database/types --external @getstrata/core/database/whereBuilder --external @getstrata/core/errors/http --external @getstrata/core/events --external @getstrata/core/events/outbox --external @getstrata/core/facades --external @getstrata/core/http --external @getstrata/core/http/authMiddleware --external @getstrata/core/http/authorizeMiddleware --external @getstrata/core/http/bodySizeLimitMiddleware --external @getstrata/core/http/clientIp --external @getstrata/core/http/cookies --external @getstrata/core/http/contentNegotiation --external @getstrata/core/http/contentSecurityPolicy --external @getstrata/core/http/conditionalResponse --external @getstrata/core/http/corsMiddleware --external @getstrata/core/http/csrfMiddleware --external @getstrata/core/http/csrfProtection --external @getstrata/core/http/csrfToken --external @getstrata/core/http/etag --external @getstrata/core/http/flashSession --external @getstrata/core/http/flashMiddleware --external @getstrata/core/http/formRequest --external @getstrata/core/http/middleware --external @getstrata/core/http/metricsMiddleware --external @getstrata/core/http/loginThrottleMiddleware --external @getstrata/core/http/memoryThrottleMiddleware --external @getstrata/core/http/pagination --external @getstrata/core/http/parseFormBody --external @getstrata/core/http/parseMultipartUpload --external @getstrata/core/http/requireAbilityMiddleware --external @getstrata/core/http/requireAuthMiddleware --external @getstrata/core/http/requireGlobalAdminMiddleware --external @getstrata/core/http/requireWebAuthMiddleware --external @getstrata/core/http/requireVerifiedMiddleware --external @getstrata/core/http/requirePasswordConfirmMiddleware --external @getstrata/core/http/resources --external @getstrata/core/http/response --external @getstrata/core/http/route --external @getstrata/core/http/routeMiddleware --external @getstrata/core/http/routeModelBinding --external @getstrata/core/http/safeInternalPath --external @getstrata/core/http/signedUrl --external @getstrata/core/http/statelessAuth --external @getstrata/core/http/scimThrottleMiddleware --external @getstrata/core/http/securityHeadersMiddleware --external @getstrata/core/http/securedRouteModelBinding --external @getstrata/core/http/requestMetaContext --external @getstrata/core/http/webErrorResponse --external @getstrata/core/http/webFormRequest --external @getstrata/core/http/throttleMiddleware --external @getstrata/core/http/uploads --external @getstrata/core/http/validation --external @getstrata/core/jobs/exportAuditLogsJob --external @getstrata/core/jobs/invalidateCacheTagsJob --external @getstrata/core/lifecycle/gracefulShutdown --external @getstrata/core/logging/logger --external @getstrata/core/logging/requestLoggingMiddleware --external @getstrata/core/mail/mailer --external @getstrata/core/mail/markdownMail --external @getstrata/core/mail/markdownMailable --external @getstrata/core/mail/sanitizeMailHtml --external @getstrata/core/media/imageTransform --external @getstrata/core/metrics/prometheus --external @getstrata/core/notifications --external @getstrata/core/openapi/generator --external @getstrata/core/openapi/registeredRoute --external @getstrata/core/openapi/validate --external @getstrata/core/pagination --external @getstrata/core/queue --external @getstrata/core/queue/createAppQueue --external @getstrata/core/queue/failedJobRepository --external @getstrata/core/queue/failedJobService --external @getstrata/core/queue/jobRegistry --external @getstrata/core/queue/jobRunner --external @getstrata/core/queue/queueMetrics --external @getstrata/core/queue/publicQueue --external @getstrata/core/queue/redisQueue --external @getstrata/core/queue/types --external @getstrata/core/runtime/appEnv --external @getstrata/core/runtime/appKeyPrefix --external @getstrata/core/runtime/frontendMode --external @getstrata/core/runtime/applicationRegistry --external @getstrata/core/runtime/asyncContextStore --external @getstrata/core/scheduler/schedule --external @getstrata/core/scheduler/osCron --external @getstrata/core/security/oauthState --external @getstrata/core/security/publicReads --external @getstrata/core/security/recoveryCodes --external @getstrata/core/security/safeFetch --external @getstrata/core/security/safePath --external @getstrata/core/security/safeUrl --external @getstrata/core/security/scimTenantTokens --external @getstrata/core/security/securityEvents --external @getstrata/core/security/stripeWebhook --external @getstrata/core/security/webhookSignature --external @getstrata/core/security/timingSafeCompare --external @getstrata/core/security/tokenExpiry --external @getstrata/core/security/totp --external @getstrata/core/storage/storage --external @getstrata/core/tenant/tenancyConfig --external @getstrata/core/tenant/tenantContext --external @getstrata/core/tenant/tenantDatabaseScope --external @getstrata/core/tenant/databaseTenantContext --external @getstrata/core/tenant/tenantMiddleware --external @getstrata/core/tenant/enableTenantRls --external @getstrata/core/terminal/runShell --external @getstrata/core/tracing/traceContext --external @getstrata/core/tracing/tracingMiddleware --external @getstrata/core/validation/rules --external @getstrata/core/view",
     "build:shims": "bun ../../scripts/write-core-shared-shims.ts"
   },
   "publishConfig": {