@getstrata/core 2.2.33 → 2.2.35

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @getstrata/core changelog
 
+## 2.2.35
+
+Retire checked-in HiroApp applications after preserving security, CLI/OpenAPI/HTTP, source, migration and Docker acceptance in generated candidate-package fixtures. Keep all 23 security cases, 40 runtime operations, 22 API/protocol operations, three-engine migration cases and 18 compiler combinations. Make the private root CLI fixture-only, isolate post-commit HTTP databases, and validate the generated production image with restricted runtime credentials, Redis recovery and graceful shutdown. Remove obsolete app regeneration/selectors and update contributor, generator and deployment documentation; retain compatible example preset IDs and explicit application-owned deployment boundaries. Regenerate the sample SDK from the API-only snapshot and verify it against the installed candidate package. Core coverage retains 136 enforced files at 100%; remove only the two deleted private-entrypoint exemptions (272 remaining).
+
+## 2.2.34
+
+Complete opt-in persisted account-state adoption: atomic SCIM suspension/reactivation and credential revocation, serialized generated password/SSO issuance, version-bound session/MFA/confirmation proofs, safe optional credential-table handling and malformed-cookie rejection. Includes explicit schema migration and upgrade instructions; installing packages alone does not rewrite existing apps.
+
+The admission and persistence foundations from #219/#221 are included: optional live status/epoch contracts, guarded additive users/session migrations, atomic epoch advancement, optional-table revocation fixes (#220) and malformed-cookie handling (#218). Legacy directories without metadata keep their admission contract. Epoch-aware revocation requires all custom issuers and security writers to participate in the documented protocol.
+
 ## 2.2.33
 
 Fix shared tenant lookups in generated SQLite column-tenancy apps through typed repositories. Generated SCIM rejects unsupported status/profile mutations before writing and runs mutations in explicit transactions, including immediate observer rollback. Add actual SQLite and restricted Postgres HTTP regressions; full account deactivation remains unsupported and explicit.

package/dist/core/auth/accountState.d.ts

@@ -0,0 +1,9 @@
+import type { AuthUserRecord } from "../contracts/authUserDirectory";
+import type { AuthUser } from "./authContext";
+/** Absence preserves legacy directories; an explicit non-true value fails closed. */
+declare function isAccountActive(record: Pick<AuthUserRecord, "is_active">): boolean;
+/** Custom/token directories must project current account state into their principal. */
+declare function isAuthUserActive(user: AuthUser): boolean;
+/** Opt-in epochs fence stateless credentials independently of wall-clock precision. */
+declare function matchesAuthVersion(issued: unknown, current: number | undefined): boolean;
+export { isAccountActive, isAuthUserActive, matchesAuthVersion };

package/dist/core/auth/accountStateMigration.d.ts

@@ -0,0 +1,7 @@
+import type { Migration } from "../database/migrations/types";
+import type { DatabaseDriver } from "../database/schema/driver";
+/** Explicit additive adoption for the standard users table; never runs during authentication. */
+declare function createAccountStateMigration(name: string, driver: DatabaseDriver, options?: {
+    sessions?: boolean;
+}): Migration;
+export { createAccountStateMigration };

package/dist/core/auth/authContext.d.ts

@@ -2,6 +2,9 @@ type CredentialSource = "session" | "bearer" | "basic" | "guest" | null;
 type AuthUser = {
     id: number | string;
     role?: string;
+    /** Current state from a trusted directory/guard, never an unverified client claim. */
+    isActive?: boolean;
+    authVersion?: number;
     abilities?: string[];
     tokenId?: number;
     emailVerifiedAt?: Date | string | null;

package/dist/core/auth/guard.d.ts

@@ -40,6 +40,7 @@ declare class AuthManager {
     user(request?: Request): Promise<AuthUser | null>;
     check(request?: Request): Promise<boolean>;
     requireUser(request?: Request): Promise<AuthUser>;
+    private resolveGuard;
     private authenticateRequest;
     private tryNamedGuards;
 }

package/dist/core/auth/jwt.d.ts

@@ -3,6 +3,7 @@ interface JwtPayload {
     role?: string;
     abilities?: string[];
     emailVerifiedAt?: Date | string | null;
+    authVersion?: number;
     iat?: number;
     exp?: number;
     [key: string]: unknown;

package/dist/core/auth/oneTimeToken.d.ts

@@ -14,6 +14,8 @@ type SqlClient = {
 declare function consumeOneTimeToken(sql: SqlClient, purpose: string, plain: string, now?: Date): Promise<number | null>;
 declare function revokeUserSessions(sql: SqlClient, userId: number, options?: {
     revokeApiTokens?: boolean;
+    /** Requires the account-state migration. Call within the account mutation transaction. */
+    incrementAuthVersion?: boolean;
 }): Promise<void>;
 export type { AuthOneTimePurpose };
 export { AUTH_ONE_TIME_PURPOSES, consumeOneTimeToken, generateOneTimeToken, hashOneTimeToken, revokeUserSessions, };

package/dist/core/auth/passwordConfirmCookie.d.ts

@@ -2,7 +2,7 @@ declare const PASSWORD_CONFIRM_COOKIE: string;
 declare const DEFAULT_PASSWORD_CONFIRM_TTL_SECONDS: number;
 declare function passwordConfirmCookieName(): string;
 declare function passwordConfirmTtlSeconds(): number;
-declare function hasFreshPasswordConfirmation(request: Request, userId: number): boolean;
-declare function createPasswordConfirmCookie(userId: number): string;
+declare function hasFreshPasswordConfirmation(request: Request, userId: number, authVersion?: number): boolean;
+declare function createPasswordConfirmCookie(userId: number, authVersion?: number): string;
 declare function clearPasswordConfirmCookie(): string;
 export { clearPasswordConfirmCookie, createPasswordConfirmCookie, DEFAULT_PASSWORD_CONFIRM_TTL_SECONDS, hasFreshPasswordConfirmation, PASSWORD_CONFIRM_COOKIE, passwordConfirmCookieName, passwordConfirmTtlSeconds, };

package/dist/core/auth/passwordLogin.d.ts

@@ -1,5 +1,5 @@
 import type { AuthUserRecord } from "../contracts/authUserDirectory";
-type PasswordLoginFailure = "mfa_required" | "mfa_invalid";
+type PasswordLoginFailure = "mfa_required" | "mfa_invalid" | "account_inactive";
 type PasswordLoginSuccess = {
     ok: true;
     consumedRecoveryHash?: string;
@@ -10,7 +10,7 @@ type PasswordLoginDenied = {
 };
 type PasswordLoginResult = PasswordLoginSuccess | PasswordLoginDenied;
 declare function parseRecoveryHashes(raw: string | null | undefined): string[];
-declare function completePasswordLogin(user: Pick<AuthUserRecord, "mfa_enabled" | "mfa_secret" | "mfa_recovery_codes">, options?: {
+declare function completePasswordLogin(user: Pick<AuthUserRecord, "is_active" | "mfa_enabled" | "mfa_secret" | "mfa_recovery_codes">, options?: {
     mfaCode?: string | null;
 }): PasswordLoginResult;
 declare function persistConsumedRecoveryHash(sql: {

package/dist/core/auth/pendingMfaCookie.d.ts

@@ -0,0 +1,9 @@
+interface PendingMfaChallenge {
+    userId: number;
+    authVersion: number;
+}
+declare function createPendingMfaCookie(userId: number, authVersion: number, secret: string): string;
+declare function readPendingMfaCookie(request: Request, secret: string): PendingMfaChallenge | null;
+declare function clearPendingMfaCookie(): string;
+export type { PendingMfaChallenge };
+export { clearPendingMfaCookie, createPendingMfaCookie, readPendingMfaCookie };

package/dist/core/auth/sessionCookie.d.ts

@@ -3,10 +3,12 @@ declare const SESSION_TTL_SECONDS: number;
 declare const SESSION_REMEMBER_TTL_SECONDS: number;
 interface CreateSessionCookieOptions {
     remember?: boolean;
+    authVersion?: number;
 }
 interface SignedSession {
     userId: number;
     issuedAt: number;
+    authVersion?: number;
 }
 declare function sessionCookieName(): string;
 declare function sessionTtlSeconds(): number;
@@ -15,6 +17,7 @@ declare function readSession(request: Request): SignedSession | null;
 declare function readSessionUserId(request: Request): number | null;
 declare function isSessionInvalidated(issuedAt: number, validAfter: Date | string | null | undefined): boolean;
 interface SessionCookieDetails {
+    authVersion?: number;
     header: string;
     userId: number;
     issuedAt: number;

package/dist/core/contracts/authUserDirectory.d.ts

@@ -4,6 +4,10 @@ interface AuthUserRecord {
     name?: string | null;
     email?: string | null;
     role: string;
+    /** Optional account-status contract; missing preserves legacy behavior. */
+    is_active?: boolean;
+    /** Optional non-negative safe-integer credential epoch; never reset on reactivation. */
+    auth_version?: number;
     email_verified_at?: Date | string | null;
     session_valid_after?: Date | string | null;
     password?: string | null;
@@ -12,6 +16,7 @@ interface AuthUserRecord {
     mfa_recovery_codes?: string | null;
 }
 interface AuthUserDirectory {
+    /** Participating directories must project fresh account status as AuthUser.isActive. */
     resolveUserFromToken(token: string): Promise<AuthUser | null>;
     findByIdOrThrow(id: number): Promise<AuthUserRecord>;
     hasActiveBrowserSession?(userId: number, issuedAt: number): Promise<boolean>;

package/dist/entries/auth/accountState.js

@@ -0,0 +1,18 @@
+// @bun
+// ../../src/core/auth/accountState.ts
+function isAccountActive(record) {
+  return record.is_active === undefined || record.is_active === true;
+}
+function isAuthUserActive(user) {
+  return user.isActive === undefined || user.isActive === true;
+}
+function matchesAuthVersion(issued, current) {
+  if (current === undefined)
+    return true;
+  return Number.isSafeInteger(current) && current >= 0 && typeof issued === "number" && Number.isSafeInteger(issued) && issued >= 0 && issued === current;
+}
+export {
+  isAccountActive,
+  isAuthUserActive,
+  matchesAuthVersion
+};