@getstrata/core 0.5.55 → 0.5.56

package/README.md

@@ -26,6 +26,8 @@ import { storage } from "@getstrata/core/facades";
 import { EtaViewEngine } from "@getstrata/core/view";
 ```
 
+`.eta` files are **HTML + Eta tags** (`<% %>`, `<%= %>`, `<%~ include() %>`), not Pug. Class/attribute shorthand such as `section.section` or `a href=` fails at render time with the template name.
+
 **Dependency:** `eta` is bundled as a direct dependency of `@getstrata/core`. Apps do not need to list it separately. The database driver is your app's choice. WorkHub and getstrata use **Bun's built-in `Bun.sql`** client; bind it with `bindDatabaseConnection()`.
 
 `orderBy` accepts explicit `{ column, direction }` objects or column shorthand such as `{ published_at: "desc" }`.

package/dist/core/media/imageTransform.d.ts

@@ -0,0 +1,13 @@
+declare const IMAGE_MIME_TYPES: Set<string>;
+declare function normalizeMimeType(mimeType: string): string;
+declare function isImageMimeType(mimeType: string): boolean;
+declare function parseThumbnailWidth(raw: string | null | undefined, options?: {
+    defaultWidth?: number;
+    minWidth?: number;
+    maxWidth?: number;
+}): number;
+declare function resizeImageContents(contents: Uint8Array, width: number, mimeType: string): Promise<{
+    body: Uint8Array;
+    contentType: string;
+}>;
+export { IMAGE_MIME_TYPES, isImageMimeType, normalizeMimeType, parseThumbnailWidth, resizeImageContents, };

package/dist/core/scheduler/osCron.d.ts

@@ -0,0 +1,14 @@
+declare const DEFAULT_SCHEDULE_RUN_EXPRESSION = "* * * * *";
+declare const OS_CRON_JOB_TITLE = "getstrata-schedule-run";
+interface InProcessCronJob {
+    readonly cron: string;
+    stop(): InProcessCronJob;
+    ref(): InProcessCronJob;
+    unref(): InProcessCronJob;
+}
+declare function parseScheduleExpression(expression: string, from?: Date): Date | null;
+declare function registerInProcessScheduleRunner(run: () => void | Promise<void>, expression?: string): InProcessCronJob;
+declare function installOsScheduleRunner(workerScriptPath: string, expression?: string, title?: string): Promise<void>;
+declare function uninstallOsScheduleRunner(title?: string): Promise<void>;
+export type { InProcessCronJob };
+export { DEFAULT_SCHEDULE_RUN_EXPRESSION, installOsScheduleRunner, OS_CRON_JOB_TITLE, parseScheduleExpression, registerInProcessScheduleRunner, uninstallOsScheduleRunner, };

package/dist/core/terminal/runShell.d.ts

@@ -0,0 +1,6 @@
+declare function runInteractiveShell(command: string[], options?: {
+    cwd?: string;
+    cols?: number;
+    rows?: number;
+}): Promise<number>;
+export { runInteractiveShell };

package/dist/core/view/assertEtaHtmlSource.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Throws when an .eta source still uses Pug shorthand instead of HTML + Eta tags.
+ */
+declare function assertEtaHtmlSource(templateName: string, source: string): void;
+export { assertEtaHtmlSource };

package/dist/core/view/etaViewEngine.d.ts

@@ -5,6 +5,10 @@ interface RenderOptions {
     layout?: string | false;
 }
 type LayoutDataResolver = () => Promise<Record<string, unknown>>;
+/**
+ * Renders `.eta` files as HTML + Eta tags (`<% %>`, `<%= %>`, `<%~ include() %>`).
+ * Pug class/attribute shorthand is rejected at render time.
+ */
 declare class EtaViewEngine implements ViewEngine {
     private readonly eta;
     private readonly resolveLayoutData?;

package/dist/entries/audit/exportAuditLogs.js

@@ -262,6 +262,6 @@ async function exportPendingAuditLogs() {
   });
 }
 export {
-  resolveAuditExportConfig,
-  exportPendingAuditLogs
+  exportPendingAuditLogs,
+  resolveAuditExportConfig
 };

package/dist/entries/audit/siemFormatter.js

@@ -32,6 +32,6 @@ function formatCefLine(event) {
   return `CEF:0|WorkHub|API|1.0|${event.action}|${event.subject_type}|5|${extension}`;
 }
 export {
-  formatSiemAuditEvent,
-  formatCefLine
+  formatCefLine,
+  formatSiemAuditEvent
 };

package/dist/entries/auth/accessControl.js

@@ -52,9 +52,9 @@ function resolveUserId(user) {
   return userId;
 }
 export {
-  resolveUserId,
-  requireAuthenticatedUser,
-  isGlobalAdmin,
+  ROLE_RANK,
   hasMinimumOrgRole,
-  ROLE_RANK
+  isGlobalAdmin,
+  requireAuthenticatedUser,
+  resolveUserId
 };

package/dist/entries/auth/membershipScope.js

@@ -326,11 +326,11 @@ function assertOrganizationReadable(organizationId) {
   }
 }
 export {
-  scopedOrganizationIds,
-  resolveOrganizationScope,
-  emptyPaginateResult,
-  assertResourceInCurrentTenant,
-  assertOrganizationReadable,
+  appendOrganizationScope,
   appendProjectScope,
-  appendOrganizationScope
+  assertOrganizationReadable,
+  assertResourceInCurrentTenant,
+  emptyPaginateResult,
+  resolveOrganizationScope,
+  scopedOrganizationIds
 };

package/dist/entries/auth/oauth/providers.js

@@ -66,6 +66,6 @@ class MockOAuthProvider {
   }
 }
 export {
-  MockOAuthProvider,
-  GitHubOAuthProvider
+  GitHubOAuthProvider,
+  MockOAuthProvider
 };

package/dist/entries/auth/password.js

@@ -10,6 +10,6 @@ async function verifyPassword(password, passwordHash) {
   return await Bun.password.verify(password, passwordHash);
 }
 export {
-  verifyPassword,
-  hashPassword
+  hashPassword,
+  verifyPassword
 };

package/dist/entries/auth/policy.js

@@ -76,6 +76,6 @@ class PolicyGate {
   }
 }
 export {
-  PolicyGate,
-  Policy
+  Policy,
+  PolicyGate
 };

package/dist/entries/auth/sessionCookie.js

@@ -67,9 +67,9 @@ function clearSessionCookie() {
   return `${SESSION_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${secure}`;
 }
 export {
-  readSessionUserId,
-  createSessionCookie,
-  clearSessionCookie,
+  SESSION_COOKIE,
   SESSION_TTL_SECONDS,
-  SESSION_COOKIE
+  clearSessionCookie,
+  createSessionCookie,
+  readSessionUserId
 };

package/dist/entries/auth/sessionGuard.js

@@ -227,97 +227,6 @@ import { logSecurityEvent } from "@getstrata/core/security/securityEvents";
 import { resolveDefaultTokenExpiryDays } from "@getstrata/core/security/tokenExpiry";
 import { verifyTotp } from "@getstrata/core/security/totp";
 import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
-class AuthService {
-  users;
-  tokens;
-  oauthIdentities;
-  oauthProviders = new Map;
-  constructor(users, tokens, oauthIdentities) {
-    this.users = users;
-    this.tokens = tokens;
-    this.oauthIdentities = oauthIdentities;
-  }
-  registerOAuthProvider(provider) {
-    this.oauthProviders.set(provider.name, provider);
-  }
-  getOAuthProvider(name) {
-    return this.oauthProviders.get(name);
-  }
-  async loginWithPassword(email, password, options = {}) {
-    const user = await this.users.findByEmail(email);
-    if (!user?.password_hash) {
-      logSecurityEvent("auth_login_failed", { reason: "unknown_user", email });
-      throw new UnauthorizedError("Invalid credentials.");
-    }
-    const valid = await verifyPassword(password, user.password_hash);
-    if (!valid) {
-      logSecurityEvent("auth_login_failed", { reason: "invalid_password", user_id: user.id });
-      throw new UnauthorizedError("Invalid credentials.");
-    }
-    if (isFeatureEnabled("emailVerification") && !user.email_verified_at) {
-      logSecurityEvent("auth_login_blocked", { reason: "email_unverified", user_id: user.id });
-      throw new UnauthorizedError("Email address is not verified.");
-    }
-    if (isFeatureEnabled("mfa") && user.mfa_enabled) {
-      const mfaSecret = revealMfaSecret(user.mfa_secret);
-      if (!mfaSecret || !options.mfaCode || !verifyTotp(mfaSecret, options.mfaCode)) {
-        logSecurityEvent("auth_login_failed", { reason: "invalid_mfa", user_id: user.id });
-        throw new UnauthorizedError("Invalid MFA code.");
-      }
-    }
-    logSecurityEvent("auth_login_success", { user_id: user.id, method: "password" });
-    return await this.tokens.createToken(user.id, {
-      name: "password-login",
-      abilities: resolveAbilitiesForRole(user.role),
-      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
-    });
-  }
-  async loginWithOAuth(providerName, code) {
-    const provider = this.oauthProviders.get(providerName);
-    if (!provider) {
-      throw new UnauthorizedError("Unsupported OAuth provider.");
-    }
-    const profile = await provider.exchangeCode(code);
-    const user = await this.findOrCreateOAuthUser(providerName, profile);
-    logSecurityEvent("auth_login_success", { user_id: user.id, method: `oauth:${providerName}` });
-    return await this.tokens.createToken(user.id, {
-      name: `${providerName}-oauth`,
-      abilities: resolveAbilitiesForRole(user.role),
-      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
-    });
-  }
-  buildOAuthAuthorizationUrl(providerName, state) {
-    const provider = this.oauthProviders.get(providerName);
-    if (!provider) {
-      throw new UnauthorizedError("Unsupported OAuth provider.");
-    }
-    return provider.getAuthorizationUrl(state);
-  }
-  async findOrCreateOAuthUser(providerName, profile) {
-    const existingIdentity = await this.oauthIdentities.findByProviderUser(providerName, profile.providerUserId);
-    if (existingIdentity) {
-      return await this.users.findByIdOrThrow(existingIdentity.user_id);
-    }
-    const existingUser = await this.users.findByEmail(profile.email);
-    const user = existingUser ?? await this.users.create({
-      name: profile.name,
-      email: profile.email,
-      role: "member",
-      tenant_id: currentTenantId(),
-      email_verified_at: new Date,
-      created_at: new Date,
-      updated_at: new Date
-    });
-    await this.oauthIdentities.create({
-      user_id: user.id,
-      provider: providerName,
-      provider_user_id: profile.providerUserId,
-      email: profile.email,
-      created_at: new Date
-    });
-    return user;
-  }
-}
 
 // ../../src/modules/user/notificationRepository.ts
 import { BaseRepository as BaseRepository2 } from "@getstrata/core/database/baseRepository";

package/dist/entries/auth/tokenHash.js

@@ -12,6 +12,6 @@ function hashApiToken(token) {
   return createHash("sha256").update(token).digest("hex");
 }
 export {
-  resolveTokenPepper,
-  hashApiToken
+  hashApiToken,
+  resolveTokenPepper
 };

package/dist/entries/config/envSchema.js

@@ -30,6 +30,6 @@ function validateEnv(schema, env = process.env) {
   return resolved;
 }
 export {
-  validateEnv,
-  defineEnvSchema
+  defineEnvSchema,
+  validateEnv
 };

package/dist/entries/contracts/container.js

@@ -64,6 +64,6 @@ class ConfigStore {
   }
 }
 export {
-  ServiceContainer,
-  ConfigStore
+  ConfigStore,
+  ServiceContainer
 };

package/dist/entries/contracts/di.js

@@ -21,7 +21,7 @@ function resolveService(dependencies, token) {
   return dependencies.container.resolve(token);
 }
 export {
-  resolveService,
+  assertAppDependenciesComplete,
   getRequiredDependency,
-  assertAppDependenciesComplete
+  resolveService
 };

package/dist/entries/contracts/serviceTokens.js

@@ -8,11 +8,11 @@ var CORE_POLICY_GATE_TOKEN = "core.policyGate";
 var CORE_AUTH_TOKEN = "core.auth";
 var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
 export {
-  CORE_TOKEN_SERVICE_TOKEN,
-  CORE_QUEUE_TOKEN,
-  CORE_POLICY_GATE_TOKEN,
-  CORE_EVENT_BUS_TOKEN,
-  CORE_CONFIG_TOKEN,
+  CORE_AUTH_TOKEN,
   CORE_CACHE_TOKEN,
-  CORE_AUTH_TOKEN
+  CORE_CONFIG_TOKEN,
+  CORE_EVENT_BUS_TOKEN,
+  CORE_POLICY_GATE_TOKEN,
+  CORE_QUEUE_TOKEN,
+  CORE_TOKEN_SERVICE_TOKEN
 };

package/dist/entries/crypto/fieldEncryption.js

@@ -81,13 +81,13 @@ function emailLookupForQuery(email) {
   return hashLookupValue(normalized, key);
 }
 export {
-  revealEmail,
-  resolveEncryptionKey,
-  protectEmail,
-  normalizeEmail,
-  isFieldEncryptionEnabled,
-  hashLookupValue,
-  encryptField,
+  decryptField,
   emailLookupForQuery,
-  decryptField
+  encryptField,
+  hashLookupValue,
+  isFieldEncryptionEnabled,
+  normalizeEmail,
+  protectEmail,
+  resolveEncryptionKey,
+  revealEmail
 };

package/dist/entries/crypto/mfaSecret.js

@@ -100,6 +100,6 @@ function revealMfaSecret(stored) {
   return decryptField(stored, key);
 }
 export {
-  revealMfaSecret,
-  protectMfaSecret
+  protectMfaSecret,
+  revealMfaSecret
 };

package/dist/entries/database/errors.js

@@ -62,7 +62,7 @@ async function withDatabaseErrorHandling(operation) {
   }
 }
 export {
-  withDatabaseErrorHandling,
+  isPostgresError,
   mapDatabaseError,
-  isPostgresError
+  withDatabaseErrorHandling
 };

package/dist/entries/database/migrations.js

@@ -115,13 +115,13 @@ async function freshDatabase(db, migrations, options = {}) {
   await runFresh();
 }
 export {
-  withMigrationLock,
-  runPendingMigrations,
-  rollbackDatabase,
-  migrateDatabase,
-  loadMigrationsFromDirectory,
-  getMigrationStatus,
-  getAppliedMigrations,
+  ensureMigrationsTable,
   freshDatabase,
-  ensureMigrationsTable
+  getAppliedMigrations,
+  getMigrationStatus,
+  loadMigrationsFromDirectory,
+  migrateDatabase,
+  rollbackDatabase,
+  runPendingMigrations,
+  withMigrationLock
 };

package/dist/entries/database/model.js

@@ -876,10 +876,10 @@ function registerModelRepository(model, repository) {
   return model;
 }
 export {
-  registerModelRepository,
-  hydrateValue,
-  filterMassAssignable,
-  dehydrateValue,
+  Model,
   applyCasts,
-  Model
+  dehydrateValue,
+  filterMassAssignable,
+  hydrateValue,
+  registerModelRepository
 };

package/dist/entries/database/query.js

@@ -413,24 +413,24 @@ function buildDeleteByIdQuery(table, id) {
   };
 }
 export {
-  resolveSoftDeleteColumn,
-  resolveQualifiedColumn,
-  quoteIdentifier,
-  qualifyColumn,
-  parseQualifiedColumn,
-  buildWhereClause,
-  buildUpdateQuery,
-  buildSoftDeleteByIdQuery,
-  buildSelectQuery,
-  buildRestoreByIdQuery,
-  buildQueryWhereClause,
-  buildProjectionQuery,
-  buildOrderByClause,
-  buildJoinClause,
-  buildInsertQuery,
-  buildGroupedCountQuery,
-  buildDeleteByIdQuery,
-  buildCountQuery,
+  assertSafeProjectionExpression,
   buildAdvancedWhereClause,
-  assertSafeProjectionExpression
+  buildCountQuery,
+  buildDeleteByIdQuery,
+  buildGroupedCountQuery,
+  buildInsertQuery,
+  buildJoinClause,
+  buildOrderByClause,
+  buildProjectionQuery,
+  buildQueryWhereClause,
+  buildRestoreByIdQuery,
+  buildSelectQuery,
+  buildSoftDeleteByIdQuery,
+  buildUpdateQuery,
+  buildWhereClause,
+  parseQualifiedColumn,
+  qualifyColumn,
+  quoteIdentifier,
+  resolveQualifiedColumn,
+  resolveSoftDeleteColumn
 };

package/dist/entries/database/relationships.js

@@ -145,18 +145,18 @@ function indexMorphToRelation(children, parentsByType, relation) {
   return result;
 }
 export {
-  morphTo,
-  morphOne,
-  morphMany,
-  indexMorphToRelation,
-  indexMorphOneRelation,
-  indexMorphManyRelation,
-  indexHasOneRelation,
-  indexHasManyRelation,
-  indexBelongsToRelation,
-  indexBelongsToManyRelation,
-  hasOne,
-  hasMany,
+  belongsTo,
   belongsToMany,
-  belongsTo
+  hasMany,
+  hasOne,
+  indexBelongsToManyRelation,
+  indexBelongsToRelation,
+  indexHasManyRelation,
+  indexHasOneRelation,
+  indexMorphManyRelation,
+  indexMorphOneRelation,
+  indexMorphToRelation,
+  morphMany,
+  morphOne,
+  morphTo
 };

package/dist/entries/database/schema.js

@@ -1037,18 +1037,18 @@ function createSchemaBuilder(db, driver) {
   });
 }
 export {
-  resolveDatabaseDriver,
-  inferReferencedTable,
-  grammarForDriver,
-  createSchemaBuilder,
-  compileBlueprint,
-  UnsupportedSchemaFeatureError,
-  SqliteGrammar,
-  SchemaBuilder,
-  Schema,
-  PostgresGrammar,
-  MySqlGrammar,
-  ForeignIdColumnDefinition,
+  Blueprint,
   ColumnDefinition,
-  Blueprint
+  ForeignIdColumnDefinition,
+  MySqlGrammar,
+  PostgresGrammar,
+  Schema,
+  SchemaBuilder,
+  SqliteGrammar,
+  UnsupportedSchemaFeatureError,
+  compileBlueprint,
+  createSchemaBuilder,
+  grammarForDriver,
+  inferReferencedTable,
+  resolveDatabaseDriver
 };

package/dist/entries/database/seeders.js

@@ -25,6 +25,6 @@ async function runSeedersFromDirectory(directory, db, options) {
   return seeders.length;
 }
 export {
-  runSeedersFromDirectory,
-  loadSeedersFromDirectory
+  loadSeedersFromDirectory,
+  runSeedersFromDirectory
 };

package/dist/entries/facades.js

@@ -366,13 +366,13 @@ function storageFacade() {
   return storage();
 }
 export {
-  storageFacade as storage,
-  queue,
-  policyGate,
-  mail,
-  log,
-  events,
-  config,
+  auth,
   cache,
-  auth
+  config,
+  events,
+  log,
+  mail,
+  policyGate,
+  queue,
+  storageFacade as storage
 };

package/dist/entries/http/authMiddleware.js

@@ -20,6 +20,6 @@ function createAuthMiddleware(auth) {
   };
 }
 export {
-  createAuthMiddleware,
-  authContext
+  authContext,
+  createAuthMiddleware
 };

package/dist/entries/http/bodySizeLimitMiddleware.js

@@ -27,6 +27,6 @@ function createBodySizeLimitMiddleware(maxBytes = resolveMaxBodyBytes()) {
   };
 }
 export {
-  resolveMaxBodyBytes,
-  createBodySizeLimitMiddleware
+  createBodySizeLimitMiddleware,
+  resolveMaxBodyBytes
 };

package/dist/entries/http/cookies.js

@@ -27,6 +27,6 @@ function readBunRequestCookie(request, name) {
   return request.cookies.get(name) ?? readRequestCookie(request, name);
 }
 export {
-  readRequestCookie,
-  readBunRequestCookie
+  readBunRequestCookie,
+  readRequestCookie
 };

package/dist/entries/http/csrfProtection.js

@@ -18,6 +18,6 @@ function createCsrfProtection(secret, options = {}) {
   };
 }
 export {
-  createCsrfProtection,
-  DEFAULT_CSRF_TTL_MS
+  DEFAULT_CSRF_TTL_MS,
+  createCsrfProtection
 };

package/dist/entries/http/csrfToken.js

@@ -134,11 +134,11 @@ function resolveCsrfTokenForRequest(request) {
   return resolveCsrfToken(request).token;
 }
 export {
-  verifyCsrfToken,
-  resolveCsrfTokenForRequest,
-  resolveCsrfToken,
-  readSubmittedCsrfTokenFromBody,
-  readSubmittedCsrfToken,
+  CSRF_COOKIE,
   createCsrfTokenCookie,
-  CSRF_COOKIE
+  readSubmittedCsrfToken,
+  readSubmittedCsrfTokenFromBody,
+  resolveCsrfToken,
+  resolveCsrfTokenForRequest,
+  verifyCsrfToken
 };

package/dist/entries/http/etag.js

@@ -97,13 +97,13 @@ function applyConditionalGet(request, response, etag) {
   });
 }
 export {
-  notModifiedResponse,
-  isEtagEnabled,
-  ifNoneMatchSatisfied,
-  ifMatchSatisfied,
-  etagValuesMatch,
-  etagFromResource,
-  computeEtagFromJson,
+  applyConditionalGet,
   assertIfMatch,
-  applyConditionalGet
+  computeEtagFromJson,
+  etagFromResource,
+  etagValuesMatch,
+  ifMatchSatisfied,
+  ifNoneMatchSatisfied,
+  isEtagEnabled,
+  notModifiedResponse
 };

package/dist/entries/http/flashSession.js

@@ -98,9 +98,9 @@ function withFlashClear(response) {
   });
 }
 export {
-  withFlashClear,
-  pullFlash,
-  flashResponse,
+  clearFlashCookie,
   createFlashCookie,
-  clearFlashCookie
+  flashResponse,
+  pullFlash,
+  withFlashClear
 };

package/dist/entries/http/formRequest.js

@@ -150,6 +150,6 @@ class QueryFormRequest {
   }
 }
 export {
-  QueryFormRequest,
-  FormRequest
+  FormRequest,
+  QueryFormRequest
 };

package/dist/entries/http/loginThrottleMiddleware.js

@@ -41,6 +41,6 @@ function createLoginThrottleMiddleware(options) {
   };
 }
 export {
-  resolveLoginIdentity,
-  createLoginThrottleMiddleware
+  createLoginThrottleMiddleware,
+  resolveLoginIdentity
 };