easy-ping 0.2.0 → 0.4.0

package/dist/index.cjs

@@ -53,18 +53,27 @@ var consoleLogger = {
 
 // src/core/tokens.ts
 var encoder = new TextEncoder();
-async function hmacKey(secret) {
-  return crypto.subtle.importKey(
-    "raw",
-    encoder.encode(secret),
-    { name: "HMAC", hash: "SHA-256" },
+var KEY_SALT = encoder.encode("easy-ping/tokens/v1");
+async function hmacKey(secret, purpose) {
+  const master = await crypto.subtle.importKey("raw", encoder.encode(secret), "HKDF", false, [
+    "deriveKey"
+  ]);
+  return crypto.subtle.deriveKey(
+    { name: "HKDF", hash: "SHA-256", salt: KEY_SALT, info: encoder.encode(purpose) },
+    master,
+    { name: "HMAC", hash: "SHA-256", length: 256 },
     false,
     ["sign", "verify"]
   );
 }
-async function signToken(secret, claims) {
-  const body = encodeBase64Url(JSON.stringify(claims));
-  const signature = await crypto.subtle.sign("HMAC", await hmacKey(secret), encoder.encode(body));
+async function signToken(secret, claims, now = /* @__PURE__ */ new Date()) {
+  const stamped = { ...claims, iat: claims.iat ?? Math.floor(now.getTime() / 1e3) };
+  const body = encodeBase64Url(JSON.stringify(stamped));
+  const signature = await crypto.subtle.sign(
+    "HMAC",
+    await hmacKey(secret, claims.purpose),
+    encoder.encode(body)
+  );
   return `${body}.${encodeBase64Url(new Uint8Array(signature))}`;
 }
 async function verifyToken(secret, token, purpose, now = /* @__PURE__ */ new Date()) {
@@ -75,7 +84,7 @@ async function verifyToken(secret, token, purpose, now = /* @__PURE__ */ new Dat
   if (!signature) return null;
   const valid = await crypto.subtle.verify(
     "HMAC",
-    await hmacKey(secret),
+    await hmacKey(secret, purpose),
     signature,
     encoder.encode(body)
   );
@@ -91,43 +100,138 @@ async function verifyToken(secret, token, purpose, now = /* @__PURE__ */ new Dat
   if (typeof claims?.uid !== "string" || typeof claims.exp !== "number") return null;
   if (claims.purpose !== purpose) return null;
   if (claims.exp * 1e3 <= now.getTime()) return null;
+  if (claims.iat !== void 0 && typeof claims.iat !== "number") return null;
+  if (claims.data !== void 0) {
+    if (typeof claims.data !== "object" || claims.data === null || Array.isArray(claims.data)) {
+      return null;
+    }
+    for (const value of Object.values(claims.data)) {
+      if (typeof value !== "string") return null;
+    }
+  }
   return claims;
 }
 var DEFAULT_TOKEN_TTL_SECONDS = 30 * 24 * 60 * 60;
-var expiresIn = (seconds, now = /* @__PURE__ */ new Date()) => Math.floor(now.getTime() / 1e3) + seconds;
+var MAX_TOKEN_TTL_SECONDS = 90 * 24 * 60 * 60;
+var expiresIn = (seconds, now = /* @__PURE__ */ new Date()) => Math.floor(now.getTime() / 1e3) + Math.min(Math.max(seconds, 0), MAX_TOKEN_TTL_SECONDS);
+function createScopedSigner(secret, pluginId, purposes, onViolation) {
+  return (request) => {
+    if (!purposes.has(request.purpose)) {
+      throw onViolation(
+        `plugin "${pluginId}" tried to sign a token for purpose "${request.purpose}", which none of its signed routes declare.`
+      );
+    }
+    return signToken(secret, {
+      uid: request.uid,
+      purpose: request.purpose,
+      exp: expiresIn(request.ttlSeconds ?? DEFAULT_TOKEN_TTL_SECONDS),
+      ...request.data ? { data: request.data } : {}
+    });
+  };
+}
 
 // src/core/handler.ts
+var MAX_BODY_BYTES = 64 * 1024;
+var MAX_READ_IDS = 200;
+var PRIVATE_HEADERS = {
+  "cache-control": "private, no-store",
+  "x-content-type-options": "nosniff"
+};
 var json = (body, status = 200) => new Response(JSON.stringify(body), {
   status,
-  headers: { "content-type": "application/json" }
+  headers: { "content-type": "application/json", ...PRIVATE_HEADERS }
 });
-var empty = (status) => new Response(null, { status });
-var MAX_READ_IDS = 200;
-function timingSafeEqual(a, b) {
-  const encoder2 = new TextEncoder();
-  const left = encoder2.encode(a);
-  const right = encoder2.encode(b);
-  let diff = left.length ^ right.length;
-  const length = Math.max(left.length, right.length);
-  for (let i = 0; i < length; i += 1) {
-    diff |= (left[i] ?? 0) ^ (right[i] ?? 0);
+var empty = (status) => new Response(null, { status, headers: PRIVATE_HEADERS });
+function harden(response) {
+  const headers = new Headers(response.headers);
+  for (const [name, value] of Object.entries(PRIVATE_HEADERS)) {
+    if (!headers.has(name)) headers.set(name, value);
   }
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+var encoder2 = new TextEncoder();
+async function timingSafeEqual(a, b) {
+  const [left, right] = await Promise.all(
+    [a, b].map(
+      async (value) => new Uint8Array(await crypto.subtle.digest("SHA-256", encoder2.encode(value)))
+    )
+  );
+  let diff = 0;
+  for (let i = 0; i < 32; i += 1) diff |= (left?.[i] ?? 0) ^ (right?.[i] ?? 0);
   return diff === 0;
 }
 function routePath(url, basePath) {
-  const index = url.pathname.indexOf(basePath);
-  if (index < 0) return url.pathname;
-  return url.pathname.slice(index + basePath.length) || "/";
+  const { pathname } = url;
+  if (pathname === basePath) return "/";
+  if (pathname.startsWith(`${basePath}/`)) return pathname.slice(basePath.length);
+  return pathname;
 }
-async function readJson(request) {
+async function readJsonBody(request, maxBytes = MAX_BODY_BYTES) {
+  const tooLarge = () => ({ error: json({ error: `body exceeds ${maxBytes} bytes` }, 413) });
+  const declared = Number(request.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > maxBytes) return tooLarge();
+  if (!request.body) return { body: {} };
+  const reader = request.body.getReader();
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > maxBytes) {
+      await reader.cancel();
+      return tooLarge();
+    }
+    chunks.push(value);
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  const text = new TextDecoder().decode(bytes);
+  if (text.trim() === "") return { body: {} };
   try {
-    const body = await request.json();
-    return body && typeof body === "object" ? body : {};
+    const parsed = JSON.parse(text);
+    return {
+      body: parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {}
+    };
+  } catch {
+    return { error: json({ error: "body must be a JSON object" }, 400) };
+  }
+}
+var isJsonContentType = (request) => /^application\/json\s*(;|$)/i.test((request.headers.get("content-type") ?? "").trim());
+function originAllowed(origin, url, request, trusted) {
+  let host;
+  try {
+    host = new URL(origin).host;
   } catch {
-    return {};
+    return false;
   }
+  if (host === url.host) return true;
+  const forwarded = request.headers.get("x-forwarded-host")?.split(",")[0]?.trim();
+  if (forwarded && host === forwarded) return true;
+  return trusted.some(
+    (entry) => entry.startsWith("*.") ? host.endsWith(entry.slice(1)) : entry === origin
+  );
+}
+function csrfCheck(request, url, trusted) {
+  if (!isJsonContentType(request)) {
+    return json({ error: "content-type must be application/json" }, 415);
+  }
+  const origin = request.headers.get("origin");
+  if (origin === null) return null;
+  if (origin === "null" || !originAllowed(origin, url, request, trusted)) return empty(403);
+  return null;
 }
 function createHandler(deps) {
+  const trustedOrigins = deps.trustedOrigins ?? [];
+  const maxBodyBytes = deps.maxBodyBytes ?? MAX_BODY_BYTES;
   async function resolveUserId(request) {
     try {
       return await deps.session.getUserId(request);
@@ -136,47 +240,67 @@ function createHandler(deps) {
       return "error";
     }
   }
-  async function handleCron(request) {
-    if (!deps.cronSecret) return empty(404);
+  async function bearerMatches(request, secret) {
+    if (!secret) return false;
     const header = request.headers.get("authorization") ?? "";
     const presented = header.startsWith("Bearer ") ? header.slice(7) : header;
-    if (!timingSafeEqual(presented, deps.cronSecret)) return empty(401);
-    const result = await deps.runner.drain();
+    return timingSafeEqual(presented, secret);
+  }
+  async function handleCron(request) {
+    if (!deps.cronSecret) return empty(404);
+    if (!await bearerMatches(request, deps.cronSecret)) return empty(401);
+    const result = await deps.runner.drain(
+      deps.cronMaxSweeps === void 0 ? {} : { maxSweeps: deps.cronMaxSweeps }
+    );
     return json(result);
   }
-  async function handlePluginRoute(route, request, url) {
-    if (route.scope.type === "user") {
+  async function handlePluginRoute(route2, request, url) {
+    if (route2.scope.type === "user") {
+      if (request.method === "POST") {
+        const rejected = csrfCheck(request, url, trustedOrigins);
+        if (rejected) return rejected;
+      }
       const userId = await resolveUserId(request);
       if (userId === "error") return empty(500);
       if (userId === null) return empty(401);
-      return route.handler({ request, userId, claims: null, params: {} });
+      return harden(await route2.handler({ request, userId, claims: null, params: {} }));
     }
-    if (route.scope.type === "machine") {
-      if (!deps.cronSecret) return empty(404);
-      const header = request.headers.get("authorization") ?? "";
-      const presented = header.startsWith("Bearer ") ? header.slice(7) : header;
-      if (!timingSafeEqual(presented, deps.cronSecret)) return empty(401);
-      return route.handler({ request, userId: null, claims: null, params: {} });
+    if (route2.scope.type === "machine") {
+      if (!deps.machineSecret) return empty(404);
+      if (!await bearerMatches(request, deps.machineSecret)) return empty(401);
+      return harden(await route2.handler({ request, userId: null, claims: null, params: {} }));
     }
-    if (route.scope.type === "signed") {
+    if (route2.scope.type === "signed") {
       const token = url.searchParams.get("token") ?? (request.headers.get("authorization") ?? "").replace(/^Bearer /, "");
-      const claims = await verifyToken(deps.secret, token, route.scope.purpose);
+      const claims = await verifyToken(deps.secret, token, route2.scope.purpose);
       if (!claims) return empty(400);
-      return route.handler({ request, userId: claims.uid, claims, params: {} });
+      return harden(await route2.handler({ request, userId: claims.uid, claims, params: {} }));
     }
-    return route.handler({ request, userId: null, claims: null, params: {} });
+    return harden(await route2.handler({ request, userId: null, claims: null, params: {} }));
   }
-  async function handle(request) {
+  async function route(request) {
     const url = new URL(request.url);
     const path = routePath(url, deps.basePath);
+    if (deps.onRequest) {
+      const early = await deps.onRequest(request);
+      if (early instanceof Response) return early;
+    }
+    if (deps.rateLimit) {
+      const limited = deps.rateLimit(request);
+      if (limited) return limited;
+    }
     if (path === "/cron") {
       if (request.method !== "POST") return empty(405);
       return handleCron(request);
     }
     const pluginRoute = deps.pluginRoutes?.find(
-      (route) => route.path === path && route.method === request.method
+      (candidate) => candidate.path === path && candidate.method === request.method
     );
     if (pluginRoute) return handlePluginRoute(pluginRoute, request, url);
+    if (request.method === "POST") {
+      const rejected = csrfCheck(request, url, trustedOrigins);
+      if (rejected) return rejected;
+    }
     const userId = await resolveUserId(request);
     if (userId === "error") return empty(500);
     if (userId === null) return empty(401);
@@ -184,27 +308,32 @@ function createHandler(deps) {
       const limitParam = Number(url.searchParams.get("limit") ?? 20);
       const limit = Number.isFinite(limitParam) ? Math.min(Math.max(limitParam, 1), 100) : 20;
       const cursor = url.searchParams.get("cursor");
-      const page = await deps.adapter.listNotifications({
-        userId,
-        limit,
-        ...cursor ? { cursor } : {},
-        ...url.searchParams.get("unreadOnly") === "true" ? { unreadOnly: true } : {}
-      });
-      return json(page);
+      const [page, unseenCount] = await Promise.all([
+        deps.adapter.listNotifications({
+          userId,
+          limit,
+          ...cursor ? { cursor } : {},
+          ...url.searchParams.get("unreadOnly") === "true" ? { unreadOnly: true } : {}
+        }),
+        cursor ? Promise.resolve(null) : deps.adapter.countUnseen(userId)
+      ]);
+      return json(unseenCount === null ? page : { ...page, unseenCount });
     }
     if (request.method === "GET" && path === "/count") {
       return json({ unseen: await deps.adapter.countUnseen(userId) });
     }
     if (request.method === "POST" && path === "/seen") {
-      const body = await readJson(request);
-      const before = typeof body.before === "string" ? new Date(body.before) : null;
+      const parsed = await readJsonBody(request, maxBodyBytes);
+      if ("error" in parsed) return parsed.error;
+      const before = typeof parsed.body.before === "string" ? new Date(parsed.body.before) : null;
       const cutoff = before && !Number.isNaN(before.getTime()) ? new Date(before.getTime() + 1) : /* @__PURE__ */ new Date();
       await deps.adapter.markSeen(userId, cutoff);
       return json({ ok: true });
     }
     if (request.method === "POST" && path === "/read") {
-      const body = await readJson(request);
-      const ids = Array.isArray(body.ids) ? body.ids.filter((id) => typeof id === "string") : [];
+      const parsed = await readJsonBody(request, maxBodyBytes);
+      if ("error" in parsed) return parsed.error;
+      const ids = Array.isArray(parsed.body.ids) ? parsed.body.ids.filter((id) => typeof id === "string") : [];
       if (ids.length === 0) return json({ error: "ids must be a non-empty string array" }, 400);
       if (ids.length > MAX_READ_IDS) {
         return json({ error: `at most ${MAX_READ_IDS} ids per request` }, 400);
@@ -217,6 +346,14 @@ function createHandler(deps) {
     }
     return empty(404);
   }
+  async function handle(request) {
+    try {
+      return await route(request);
+    } catch (error) {
+      deps.logger.error("request failed", { url: request.url, error });
+      return empty(500);
+    }
+  }
   return {
     handle,
     GET: handle,
@@ -224,6 +361,50 @@ function createHandler(deps) {
   };
 }
 
+// src/core/html.ts
+var ESCAPES = {
+  "&": "&amp;",
+  "<": "&lt;",
+  ">": "&gt;",
+  '"': "&quot;",
+  "'": "&#39;"
+};
+var escapeHtml = (value) => String(value ?? "").replace(/[&<>"']/g, (char) => ESCAPES[char] ?? char);
+
+// src/core/rate-limit.ts
+var clientAddress = (request) => {
+  const headers = request.headers;
+  return headers.get("cf-connecting-ip") ?? headers.get("x-real-ip") ?? headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? null;
+};
+function createRateLimiter(config) {
+  const keyOf = config.key ?? clientAddress;
+  const buckets = /* @__PURE__ */ new Map();
+  let lastSweep = 0;
+  return (request) => {
+    const key = keyOf(request);
+    if (key === null) return null;
+    const now = Date.now();
+    if (now - lastSweep > config.windowMs) {
+      for (const [id, bucket2] of buckets) if (bucket2.resetAt <= now) buckets.delete(id);
+      lastSweep = now;
+    }
+    let bucket = buckets.get(key);
+    if (!bucket || bucket.resetAt <= now) {
+      bucket = { count: 0, resetAt: now + config.windowMs };
+      buckets.set(key, bucket);
+    }
+    bucket.count += 1;
+    if (bucket.count <= config.max) return null;
+    return new Response(null, {
+      status: 429,
+      headers: {
+        "retry-after": String(Math.max(1, Math.ceil((bucket.resetAt - now) / 1e3))),
+        "cache-control": "private, no-store"
+      }
+    });
+  };
+}
+
 // src/core/backoff.ts
 var SCHEDULE_MS = [3e4, 12e4, 48e4, 192e4];
 function backoffMs(attempt, strategy = "exponential") {
@@ -251,7 +432,8 @@ async function withTimeout(run, ms, label) {
     clearTimeout(timer);
   }
 }
-var message = (error) => error instanceof Error ? error.message : String(error);
+var redactErrorMessage = (text) => text.replace(/[^\s"'<>()[\]{},;]+@[^\s"'<>()[\]{},;]+/g, "[redacted-email]");
+var message = (error) => redactErrorMessage(error instanceof Error ? error.message : String(error));
 function createRunner(deps) {
   async function deliverOne(delivery, recipient) {
     if (!recipient) {
@@ -337,7 +519,7 @@ function createRunner(deps) {
     }
   }
   async function notifyAfterDeliver(delivery, outcome) {
-    const isTerminal = outcome.result === "sent" || !outcome.retryable || delivery.attempts + 1 >= delivery.maxAttempts;
+    const isTerminal = outcome.result !== "failed" || !outcome.retryable || delivery.attempts + 1 >= delivery.maxAttempts;
     for (const plugin of deps.plugins) {
       const hook = plugin.hooks?.afterDeliver;
       if (!hook) continue;
@@ -368,16 +550,18 @@ function createRunner(deps) {
       ...options.channels ? { channels: options.channels } : {},
       ...options.ids ? { ids: options.ids } : {}
     });
-    if (claimed.length === 0) return { claimed: 0, sent: 0, failed: 0 };
+    if (claimed.length === 0) return { claimed: 0, sent: 0, failed: 0, skipped: 0 };
     const userIds = [...new Set(claimed.map((row) => row.notification.userId))];
     const recipients = await deps.getRecipients(userIds);
     const byUserId = new Map(recipients.map((recipient) => [recipient.userId, recipient]));
     const releases = [];
     let sent = 0;
     let failed = 0;
+    let skipped = 0;
     for (const delivery of claimed) {
       const outcome = await deliverOne(delivery, byUserId.get(delivery.notification.userId));
       if (outcome.result === "sent") sent += 1;
+      else if (outcome.result === "skipped") skipped += 1;
       else failed += 1;
       releases.push({
         id: delivery.id,
@@ -388,16 +572,17 @@ function createRunner(deps) {
       await notifyAfterDeliver(delivery, outcome);
     }
     await deps.adapter.releaseDeliveries(releases);
-    return { claimed: claimed.length, sent, failed };
+    return { claimed: claimed.length, sent, failed, skipped };
   }
   async function drain(options = {}) {
     const maxSweeps = options.maxSweeps ?? 50;
-    const total = { claimed: 0, sent: 0, failed: 0 };
+    const total = { claimed: 0, sent: 0, failed: 0, skipped: 0 };
     for (let sweep = 0; sweep < maxSweeps; sweep += 1) {
       const result = await runOnce(options.ids ? { ids: options.ids } : {});
       total.claimed += result.claimed;
       total.sent += result.sent;
       total.failed += result.failed;
+      total.skipped += result.skipped;
       if (result.claimed === 0) break;
     }
     return total;
@@ -637,6 +822,33 @@ async function runSend(type, input, deps) {
 var toSnakeCase = (value) => value.replace(/[A-Z]/g, (c) => `_${c.toLowerCase()}`);
 
 // src/core/store.ts
+var OPERATORS = ["in", "lt", "lte", "gt", "gte", "not"];
+var isOperator = (value) => typeof value === "object" && value !== null && !(value instanceof Date) && OPERATORS.some((op) => Object.hasOwn(value, op));
+var isScalar = (value) => value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean" || value instanceof Date;
+function assertCondition(pluginId, field, condition) {
+  if (isScalar(condition)) return;
+  if (isOperator(condition)) {
+    const operator = condition;
+    const keys = Object.keys(operator);
+    const [op] = keys;
+    if (keys.length !== 1 || op === void 0) {
+      throw new ConfigError(`plugin "${pluginId}" gave field "${field}" more than one operator.`);
+    }
+    const payload = operator[op];
+    const valid = op === "in" ? Array.isArray(payload) && payload.every((item) => typeof item === "string" || typeof item === "number") : isScalar(payload);
+    if (valid) return;
+  }
+  throw new ConfigError(
+    `plugin "${pluginId}" passed a non-scalar value for field "${field}"; validate request bodies before querying with them.`
+  );
+}
+function assertValue(pluginId, field, spec, value) {
+  if (value === void 0 || isScalar(value)) return;
+  if (spec.type === "json" && typeof value === "object") return;
+  throw new ConfigError(
+    `plugin "${pluginId}" passed a non-scalar value for ${spec.type} field "${field}".`
+  );
+}
 function createPluginStore(pluginId, schema, storage, prefix) {
   const byTableName = /* @__PURE__ */ new Map();
   for (const declaration of Object.values(schema ?? {})) {
@@ -653,7 +865,7 @@ function createPluginStore(pluginId, schema, storage, prefix) {
   }
   function checkFields(table, fields, context) {
     for (const field of fields) {
-      const spec = table.fields[field];
+      const spec = Object.hasOwn(table.fields, field) ? table.fields[field] : void 0;
       if (!spec) {
         throw new ConfigError(
           `plugin "${pluginId}" used unknown field "${field}" on "${table.tableName}" (${context}).`
@@ -666,6 +878,19 @@ function createPluginStore(pluginId, schema, storage, prefix) {
       }
     }
   }
+  function checkWhere(table, where) {
+    checkFields(table, Object.keys(where), "where");
+    for (const [field, condition] of Object.entries(where)) {
+      assertCondition(pluginId, field, condition);
+    }
+  }
+  function checkRow(table, row, context) {
+    checkFields(table, Object.keys(row), context);
+    for (const [field, value] of Object.entries(row)) {
+      const spec = table.fields[field];
+      if (spec) assertValue(pluginId, field, spec, value);
+    }
+  }
   const qualified = (table) => prefix + table.tableName;
   const column = (field) => storage.naming === "preserve" ? field : toSnakeCase(field);
   const serialize = (table, row) => {
@@ -679,21 +904,24 @@ function createPluginStore(pluginId, schema, storage, prefix) {
   return {
     async find(table, where = {}, options = {}) {
       const declaration = resolve(table);
-      checkFields(declaration, Object.keys(where), "where");
+      checkWhere(declaration, where);
       if (options.orderBy) checkFields(declaration, [options.orderBy.field], "orderBy");
       const rows = await storage.queryTable(qualified(declaration), where, options);
       return rows.map((row) => {
         const mapped = {};
         for (const field of Object.keys(declaration.fields)) {
           const value = row[column(field)];
-          mapped[field] = declaration.fields[field]?.type === "json" && typeof value === "string" ? JSON.parse(value) : value;
+          const type = declaration.fields[field]?.type;
+          if (type === "json" && typeof value === "string") mapped[field] = JSON.parse(value);
+          else if (type === "date" && typeof value === "string") mapped[field] = new Date(value);
+          else mapped[field] = value;
         }
         return mapped;
       });
     },
     async insert(table, rows) {
       const declaration = resolve(table);
-      for (const row of rows) checkFields(declaration, Object.keys(row), "insert");
+      for (const row of rows) checkRow(declaration, row, "insert");
       return storage.insertRows(
         qualified(declaration),
         rows.map((row) => serialize(declaration, row))
@@ -701,7 +929,7 @@ function createPluginStore(pluginId, schema, storage, prefix) {
     },
     async upsert(table, rows, options) {
       const declaration = resolve(table);
-      for (const row of rows) checkFields(declaration, Object.keys(row), "upsert");
+      for (const row of rows) checkRow(declaration, row, "upsert");
       checkFields(declaration, options.onConflict, "onConflict");
       return storage.insertRows(
         qualified(declaration),
@@ -711,19 +939,27 @@ function createPluginStore(pluginId, schema, storage, prefix) {
     },
     async update(table, where, set) {
       const declaration = resolve(table);
-      checkFields(declaration, Object.keys(where), "where");
-      checkFields(declaration, Object.keys(set), "update");
+      checkWhere(declaration, where);
+      checkRow(declaration, set, "update");
       return storage.updateRows(qualified(declaration), where, serialize(declaration, set));
     },
     async remove(table, where) {
       const declaration = resolve(table);
-      checkFields(declaration, Object.keys(where), "where");
+      checkWhere(declaration, where);
       return storage.deleteRows(qualified(declaration), where);
     }
   };
 }
 
 // src/core/instance.ts
+var CORE_ROUTES = [
+  { method: "GET", path: "/", scope: { type: "user" }, owner: "core" },
+  { method: "GET", path: "/count", scope: { type: "user" }, owner: "core" },
+  { method: "POST", path: "/seen", scope: { type: "user" }, owner: "core" },
+  { method: "POST", path: "/read", scope: { type: "user" }, owner: "core" },
+  { method: "POST", path: "/read-all", scope: { type: "user" }, owner: "core" },
+  { method: "POST", path: "/cron", scope: { type: "machine" }, owner: "core" }
+];
 var DEFAULTS = {
   maxAttempts: 5,
   leaseMs: 6e4,
@@ -731,6 +967,24 @@ var DEFAULTS = {
   basePath: "/api/notifications",
   mode: "cron"
 };
+var MIN_SECRET_LENGTH = 16;
+var PLACEHOLDER_SECRETS = /* @__PURE__ */ new Set([
+  "secret",
+  "changeme",
+  "change-me",
+  "replace-me",
+  "replace-me-too",
+  "password",
+  "demo-signing-secret",
+  "demo-cron-secret"
+]);
+function checkSecretStrength(name, value) {
+  if (value.length < MIN_SECRET_LENGTH || PLACEHOLDER_SECRETS.has(value.toLowerCase())) {
+    throw new ConfigError(
+      `\`${name}\` must be at least ${MIN_SECRET_LENGTH} characters and not a placeholder. Generate one with \`openssl rand -base64 32\`.`
+    );
+  }
+}
 function validate(config, plugins) {
   if (!config.database) throw new ConfigError("`database` is required.");
   if (!config.notifications) throw new ConfigError("`notifications` is required.");
@@ -744,6 +998,12 @@ function validate(config, plugins) {
       "`secret` is required \u2014 it signs unsubscribe and other session-less links. Adding it later is a breaking change, so it is mandatory from the start."
     );
   }
+  checkSecretStrength("secret", config.secret);
+  if (config.cron?.secret) checkSecretStrength("cron.secret", config.cron.secret);
+  if (config.machineSecret) checkSecretStrength("machineSecret", config.machineSecret);
+  if (config.rateLimit && (config.rateLimit.max < 1 || config.rateLimit.windowMs < 1)) {
+    throw new ConfigError("`rateLimit.max` and `rateLimit.windowMs` must both be positive.");
+  }
   if (typeof config.getRecipients !== "function") {
     throw new ConfigError("`getRecipients` is required to resolve emails and timezones.");
   }
@@ -812,6 +1072,15 @@ function easyPing(config) {
       "delivery.mode is 'deferred' but no delivery.waitUntil was supplied; delivery will wait for the cron sweep."
     );
   }
+  for (const plugin of plugins) {
+    for (const route of plugin.routes ?? []) {
+      if (route.scope.type === "custom") {
+        warnings.push(
+          `plugin "${plugin.id}" mounts ${route.method} ${route.path} with custom auth: ` + route.scope.justification
+        );
+      }
+    }
+  }
   for (const warning of warnings) logger.warn(warning);
   const runner = createRunner({
     adapter: config.database,
@@ -833,7 +1102,13 @@ function easyPing(config) {
     secret: config.secret,
     basePath: config.basePath ?? DEFAULTS.basePath,
     pluginRoutes,
-    ...config.cron?.secret ? { cronSecret: config.cron.secret } : {}
+    trustedOrigins: config.trustedOrigins,
+    onRequest: config.onRequest,
+    maxBodyBytes: config.maxBodyBytes,
+    rateLimit: config.rateLimit ? createRateLimiter(config.rateLimit) : void 0,
+    cronMaxSweeps: config.cron?.maxSweeps,
+    ...config.cron?.secret ? { cronSecret: config.cron.secret } : {},
+    ...config.machineSecret ?? config.cron?.secret ? { machineSecret: config.machineSecret ?? config.cron?.secret } : {}
   });
   async function send(type, args) {
     const result = await runSend(
@@ -865,10 +1140,21 @@ function easyPing(config) {
     return result;
   }
   for (const plugin of plugins) {
+    const purposes = new Set(
+      (plugin.routes ?? []).flatMap(
+        (route) => route.scope.type === "signed" ? [route.scope.purpose] : []
+      )
+    );
     plugin.init?.({
       store: createPluginStore(plugin.id, plugin.schema, config.database, tablePrefix),
-      secret: config.secret,
+      sign: createScopedSigner(
+        config.secret,
+        plugin.id,
+        purposes,
+        (message2) => new ConfigError(message2)
+      ),
       logger,
+      notificationTypes: Object.keys(config.notifications),
       getRecipients: config.getRecipients,
       send: (type, args) => send(type, args)
     });
@@ -877,6 +1163,17 @@ function easyPing(config) {
     send,
     handler,
     startWorker: (options) => runner.startWorker(options ?? {}),
+    listRoutes: () => [
+      ...CORE_ROUTES.filter((route) => route.path !== "/cron" || Boolean(config.cron?.secret)),
+      ...plugins.flatMap(
+        (plugin) => (plugin.routes ?? []).map((route) => ({
+          method: route.method,
+          path: route.path,
+          scope: route.scope,
+          owner: plugin.id
+        }))
+      )
+    ],
     getFailedDeliveries: (options = {}) => config.database.getFailedDeliveries({
       since: options.since ?? new Date(Date.now() - 24 * 36e5),
       limit: Math.min(options.limit ?? 100, 1e3)
@@ -904,8 +1201,12 @@ function defineClientPlugin(plugin) {
 exports.ConfigError = ConfigError;
 exports.DEFAULT_TOKEN_TTL_SECONDS = DEFAULT_TOKEN_TTL_SECONDS;
 exports.EasyPingError = EasyPingError;
+exports.MAX_BODY_BYTES = MAX_BODY_BYTES;
+exports.MAX_TOKEN_TTL_SECONDS = MAX_TOKEN_TTL_SECONDS;
+exports.MIN_SECRET_LENGTH = MIN_SECRET_LENGTH;
 exports.ValidationError = ValidationError;
 exports.consoleLogger = consoleLogger;
+exports.createRateLimiter = createRateLimiter;
 exports.createRunner = createRunner;
 exports.decodeBase64Url = decodeBase64Url;
 exports.defineClientPlugin = defineClientPlugin;
@@ -913,7 +1214,10 @@ exports.defineNotification = defineNotification;
 exports.definePlugin = definePlugin;
 exports.easyPing = easyPing;
 exports.encodeBase64Url = encodeBase64Url;
+exports.escapeHtml = escapeHtml;
 exports.expiresIn = expiresIn;
+exports.readJsonBody = readJsonBody;
+exports.redactErrorMessage = redactErrorMessage;
 exports.signToken = signToken;
 exports.verifyToken = verifyToken;
 //# sourceMappingURL=index.cjs.map