@getstrata/core 0.5.55 → 0.5.56

package/dist/entries/http/webErrorResponse.js

@@ -81,8 +81,183 @@ async function withDatabaseErrorHandling(operation) {
 }
 
 // ../../src/core/view/etaViewEngine.ts
-import { join } from "path";
+import { join, relative } from "path";
 import { Eta } from "eta";
+
+// ../../src/core/view/assertEtaHtmlSource.ts
+var HTML_TAGS = new Set([
+  "a",
+  "abbr",
+  "address",
+  "article",
+  "aside",
+  "audio",
+  "b",
+  "blockquote",
+  "body",
+  "button",
+  "canvas",
+  "caption",
+  "cite",
+  "code",
+  "col",
+  "colgroup",
+  "data",
+  "datalist",
+  "dd",
+  "del",
+  "details",
+  "dfn",
+  "dialog",
+  "div",
+  "dl",
+  "dt",
+  "em",
+  "fieldset",
+  "figcaption",
+  "figure",
+  "footer",
+  "form",
+  "h1",
+  "h2",
+  "h3",
+  "h4",
+  "h5",
+  "h6",
+  "header",
+  "hgroup",
+  "hr",
+  "html",
+  "i",
+  "iframe",
+  "img",
+  "input",
+  "ins",
+  "kbd",
+  "label",
+  "legend",
+  "li",
+  "main",
+  "map",
+  "mark",
+  "menu",
+  "meter",
+  "nav",
+  "object",
+  "ol",
+  "optgroup",
+  "option",
+  "output",
+  "p",
+  "picture",
+  "pre",
+  "progress",
+  "q",
+  "rp",
+  "rt",
+  "ruby",
+  "s",
+  "samp",
+  "script",
+  "search",
+  "section",
+  "select",
+  "slot",
+  "small",
+  "source",
+  "span",
+  "strong",
+  "style",
+  "sub",
+  "summary",
+  "sup",
+  "table",
+  "tbody",
+  "td",
+  "template",
+  "textarea",
+  "tfoot",
+  "th",
+  "thead",
+  "time",
+  "title",
+  "tr",
+  "track",
+  "u",
+  "ul",
+  "var",
+  "video",
+  "wbr"
+]);
+var TAG_PATTERN = "([a-z][a-z0-9]*)";
+var CLASS_OR_ID_PATTERN = "[.#][\\w-]+";
+var CLASS_ID_SHORTHAND = new RegExp(`^${TAG_PATTERN}(?:${CLASS_OR_ID_PATTERN})+`);
+var ATTRIBUTE_SHORTHAND = new RegExp(`^${TAG_PATTERN}(?:${CLASS_OR_ID_PATTERN})*\\s+[\\w:-]+=`);
+var TAG_SHORTHAND = new RegExp(`^${TAG_PATTERN}(?:>|\\s+\\S|$)`);
+function htmlTagName(match) {
+  const tag = match?.[1];
+  return tag && HTML_TAGS.has(tag) ? tag : undefined;
+}
+function describePugLikeLine(line) {
+  if (/^\|(?:\s|$)/.test(line)) {
+    return "piped text";
+  }
+  if (htmlTagName(line.match(CLASS_ID_SHORTHAND))) {
+    return "class/id shorthand";
+  }
+  if (htmlTagName(line.match(ATTRIBUTE_SHORTHAND))) {
+    return "attribute shorthand";
+  }
+  if (htmlTagName(line.match(TAG_SHORTHAND))) {
+    return "tag shorthand";
+  }
+  return;
+}
+function updateSkipBlock(lower, skipBlock) {
+  if (skipBlock) {
+    if (skipBlock === "comment" && lower.includes("-->")) {
+      return null;
+    }
+    if (skipBlock !== "comment" && lower.includes(`</${skipBlock}`)) {
+      return null;
+    }
+    return skipBlock;
+  }
+  if (lower.startsWith("<!--") && !lower.includes("-->")) {
+    return "comment";
+  }
+  if (lower.startsWith("<script") && !lower.includes("</script")) {
+    return "script";
+  }
+  if (lower.startsWith("<style") && !lower.includes("</style")) {
+    return "style";
+  }
+  return null;
+}
+function assertEtaHtmlSource(templateName, source) {
+  let skipBlock = null;
+  for (const rawLine of source.split(/\r?\n/)) {
+    const trimmed = rawLine.trim();
+    if (!trimmed) {
+      continue;
+    }
+    const lower = trimmed.toLowerCase();
+    const nextSkipBlock = updateSkipBlock(lower, skipBlock);
+    if (skipBlock || nextSkipBlock) {
+      skipBlock = nextSkipBlock;
+      continue;
+    }
+    if (trimmed.startsWith("<") || trimmed.startsWith("<%")) {
+      continue;
+    }
+    const kind = describePugLikeLine(trimmed);
+    if (kind) {
+      throw new Error(`Eta view "${templateName}" contains Pug-like markup (${kind}: ${trimmed}). Eta views must be HTML + <% %> tags, not Pug.`);
+    }
+  }
+}
+
+// ../../src/core/view/etaViewEngine.ts
 var DEFAULT_VIEWS_DIRECTORY = join(process.cwd(), "resources/views");
 var DEFAULT_LAYOUT = "layouts/app.eta";
 
@@ -95,6 +270,12 @@ class EtaViewEngine {
       autoTrim: false
     });
     this.resolveLayoutData = resolveLayoutData;
+    const readFile = this.eta.readFile?.bind(this.eta);
+    this.eta.readFile = (path) => {
+      const source = readFile ? readFile(path) : "";
+      assertEtaHtmlSource(relative(viewsDirectory, path) || path, source);
+      return source;
+    };
   }
   async render(name, data = {}, options = {}) {
     const template = name.endsWith(".eta") ? name : `${name}.eta`;
@@ -358,99 +539,6 @@ function resolveAbilitiesForRole(role) {
   return [...MEMBER_ABILITIES];
 }
 
-// ../../src/modules/user/authService.ts
-class AuthService {
-  users;
-  tokens;
-  oauthIdentities;
-  oauthProviders = new Map;
-  constructor(users, tokens, oauthIdentities) {
-    this.users = users;
-    this.tokens = tokens;
-    this.oauthIdentities = oauthIdentities;
-  }
-  registerOAuthProvider(provider) {
-    this.oauthProviders.set(provider.name, provider);
-  }
-  getOAuthProvider(name) {
-    return this.oauthProviders.get(name);
-  }
-  async loginWithPassword(email, password, options = {}) {
-    const user = await this.users.findByEmail(email);
-    if (!user?.password_hash) {
-      logSecurityEvent("auth_login_failed", { reason: "unknown_user", email });
-      throw new UnauthorizedError("Invalid credentials.");
-    }
-    const valid = await verifyPassword(password, user.password_hash);
-    if (!valid) {
-      logSecurityEvent("auth_login_failed", { reason: "invalid_password", user_id: user.id });
-      throw new UnauthorizedError("Invalid credentials.");
-    }
-    if (isFeatureEnabled("emailVerification") && !user.email_verified_at) {
-      logSecurityEvent("auth_login_blocked", { reason: "email_unverified", user_id: user.id });
-      throw new UnauthorizedError("Email address is not verified.");
-    }
-    if (isFeatureEnabled("mfa") && user.mfa_enabled) {
-      const mfaSecret = revealMfaSecret(user.mfa_secret);
-      if (!mfaSecret || !options.mfaCode || !verifyTotp(mfaSecret, options.mfaCode)) {
-        logSecurityEvent("auth_login_failed", { reason: "invalid_mfa", user_id: user.id });
-        throw new UnauthorizedError("Invalid MFA code.");
-      }
-    }
-    logSecurityEvent("auth_login_success", { user_id: user.id, method: "password" });
-    return await this.tokens.createToken(user.id, {
-      name: "password-login",
-      abilities: resolveAbilitiesForRole(user.role),
-      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
-    });
-  }
-  async loginWithOAuth(providerName, code) {
-    const provider = this.oauthProviders.get(providerName);
-    if (!provider) {
-      throw new UnauthorizedError("Unsupported OAuth provider.");
-    }
-    const profile = await provider.exchangeCode(code);
-    const user = await this.findOrCreateOAuthUser(providerName, profile);
-    logSecurityEvent("auth_login_success", { user_id: user.id, method: `oauth:${providerName}` });
-    return await this.tokens.createToken(user.id, {
-      name: `${providerName}-oauth`,
-      abilities: resolveAbilitiesForRole(user.role),
-      expiresInDays: resolveDefaultTokenExpiryDays() ?? undefined
-    });
-  }
-  buildOAuthAuthorizationUrl(providerName, state) {
-    const provider = this.oauthProviders.get(providerName);
-    if (!provider) {
-      throw new UnauthorizedError("Unsupported OAuth provider.");
-    }
-    return provider.getAuthorizationUrl(state);
-  }
-  async findOrCreateOAuthUser(providerName, profile) {
-    const existingIdentity = await this.oauthIdentities.findByProviderUser(providerName, profile.providerUserId);
-    if (existingIdentity) {
-      return await this.users.findByIdOrThrow(existingIdentity.user_id);
-    }
-    const existingUser = await this.users.findByEmail(profile.email);
-    const user = existingUser ?? await this.users.create({
-      name: profile.name,
-      email: profile.email,
-      role: "member",
-      tenant_id: currentTenantId(),
-      email_verified_at: new Date,
-      created_at: new Date,
-      updated_at: new Date
-    });
-    await this.oauthIdentities.create({
-      user_id: user.id,
-      provider: providerName,
-      provider_user_id: profile.providerUserId,
-      email: profile.email,
-      created_at: new Date
-    });
-    return user;
-  }
-}
-
 // ../../src/modules/user/notificationRepository.ts
 import { BaseRepository as BaseRepository2 } from "@getstrata/core/database/baseRepository";
 
@@ -834,6 +922,6 @@ function webErrorResponse(error, request) {
   });
 }
 export {
-  webErrorResponse,
-  normalizeFieldErrors
+  normalizeFieldErrors,
+  webErrorResponse
 };

package/dist/entries/lifecycle/gracefulShutdown.js

@@ -43,8 +43,8 @@ function resetGracefulShutdownForTests() {
   shuttingDown = false;
 }
 export {
-  runGracefulShutdown,
-  resetGracefulShutdownForTests,
+  installGracefulShutdownSignals,
   registerShutdownHandler,
-  installGracefulShutdownSignals
+  resetGracefulShutdownForTests,
+  runGracefulShutdown
 };

package/dist/entries/logging/logger.js

@@ -35,6 +35,6 @@ class Logger {
 }
 var appLogger = new Logger("app");
 export {
-  appLogger,
-  Logger
+  Logger,
+  appLogger
 };

package/dist/entries/mail/mailer.js

@@ -198,11 +198,11 @@ function mailer() {
   return appMailer;
 }
 export {
-  resolveSmtpConfig,
-  mailer,
-  createMailDriver,
-  buildSmtpPayload,
-  SmtpMailDriver,
+  LogMailDriver,
   Mailer,
-  LogMailDriver
+  SmtpMailDriver,
+  buildSmtpPayload,
+  createMailDriver,
+  mailer,
+  resolveSmtpConfig
 };

package/dist/entries/mail/markdownMail.js

@@ -56,8 +56,8 @@ function renderMarkdownMail(markdown, options = {}) {
   return { html, text };
 }
 export {
-  wrapMarkdownMailLayout,
-  stripMarkdown,
+  markdownToHtml,
   renderMarkdownMail,
-  markdownToHtml
+  stripMarkdown,
+  wrapMarkdownMailLayout
 };

package/dist/entries/mail/markdownMailable.js

@@ -73,6 +73,6 @@ async function sendMarkdownMail(mailer, input) {
   await mailer.send(buildMarkdownMailMessage(input));
 }
 export {
-  sendMarkdownMail,
-  buildMarkdownMailMessage
+  buildMarkdownMailMessage,
+  sendMarkdownMail
 };

package/dist/entries/media/imageTransform.js

@@ -0,0 +1,40 @@
+// @bun
+// ../../src/core/media/imageTransform.ts
+var IMAGE_MIME_TYPES = new Set(["image/jpeg", "image/png", "image/gif", "image/webp"]);
+function normalizeMimeType(mimeType) {
+  return mimeType.split(";")[0]?.trim().toLowerCase() ?? "";
+}
+function isImageMimeType(mimeType) {
+  return IMAGE_MIME_TYPES.has(normalizeMimeType(mimeType));
+}
+function parseThumbnailWidth(raw, options = {}) {
+  const defaultWidth = options.defaultWidth ?? 200;
+  const minWidth = options.minWidth ?? 16;
+  const maxWidth = options.maxWidth ?? 800;
+  if (!raw?.trim()) {
+    return defaultWidth;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isInteger(parsed)) {
+    return defaultWidth;
+  }
+  return Math.min(maxWidth, Math.max(minWidth, parsed));
+}
+async function resizeImageContents(contents, width, mimeType) {
+  const normalized = normalizeMimeType(mimeType);
+  const pipeline = new Bun.Image(contents).resize(width);
+  if (normalized === "image/png") {
+    return { body: await pipeline.png().bytes(), contentType: "image/png" };
+  }
+  if (normalized === "image/webp") {
+    return { body: await pipeline.webp().bytes(), contentType: "image/webp" };
+  }
+  return { body: await pipeline.jpeg().bytes(), contentType: "image/jpeg" };
+}
+export {
+  IMAGE_MIME_TYPES,
+  isImageMimeType,
+  normalizeMimeType,
+  parseThumbnailWidth,
+  resizeImageContents
+};

package/dist/entries/metrics/prometheus.js

@@ -65,6 +65,6 @@ class PrometheusRegistry {
 }
 var prometheusRegistry = new PrometheusRegistry;
 export {
-  prometheusRegistry,
-  PrometheusRegistry
+  PrometheusRegistry,
+  prometheusRegistry
 };

package/dist/entries/openapi/generator.js

@@ -172,7 +172,7 @@ function renderTypeScriptSdk(spec, apiPrefix = "/api/v1") {
 `);
 }
 export {
-  renderTypeScriptSdk,
+  generateOpenApiSpec,
   renderOpenApiDocument,
-  generateOpenApiSpec
+  renderTypeScriptSdk
 };

package/dist/entries/queue/createAppQueue.js

@@ -346,9 +346,9 @@ function createAppQueue(driver, redisUrl, failedJobs = createFailedJobService(),
   });
 }
 export {
-  createTrackedJob,
-  createQueueWorker,
-  createFailedJobService,
+  FAILED_JOB_SERVICE_TOKEN,
   createAppQueue,
-  FAILED_JOB_SERVICE_TOKEN
+  createFailedJobService,
+  createQueueWorker,
+  createTrackedJob
 };

package/dist/entries/queue/publicQueue.js

@@ -336,15 +336,15 @@ function createQueueWorker(redisUrl, failedJobs = createFailedJobService()) {
   return new QueueWorker(redisUrl, failedJobs);
 }
 export {
-  runQueueJob,
-  jobRegistry,
-  createTrackedJob,
-  createQueueWorker,
-  createProductionQueue,
-  createFailedJobService,
-  ResilientQueue,
-  RedisQueue,
-  QueueWorker,
+  failedJobRepository_default as FailedJobRepository,
   failedJobService_default as FailedJobService,
-  failedJobRepository_default as FailedJobRepository
+  QueueWorker,
+  RedisQueue,
+  ResilientQueue,
+  createFailedJobService,
+  createProductionQueue,
+  createQueueWorker,
+  createTrackedJob,
+  jobRegistry,
+  runQueueJob
 };

package/dist/entries/queue/queueMetrics.js

@@ -400,6 +400,6 @@ async function collectQueueMetrics() {
   };
 }
 export {
-  readRedisQueueDepth,
-  collectQueueMetrics
+  collectQueueMetrics,
+  readRedisQueueDepth
 };

package/dist/entries/queue/redisQueue.js

@@ -222,12 +222,12 @@ async function countPendingQueueJobs(redisUrl) {
   }
 }
 export {
-  queueKeyForPriority,
-  parseQueueJobEnvelope,
-  countPendingQueueJobs,
-  RedisQueue,
-  QueueWorker,
-  QUEUE_LOW_KEY,
+  QUEUE_HIGH_KEY,
   QUEUE_LIST_KEY,
-  QUEUE_HIGH_KEY
+  QUEUE_LOW_KEY,
+  QueueWorker,
+  RedisQueue,
+  countPendingQueueJobs,
+  parseQueueJobEnvelope,
+  queueKeyForPriority
 };

package/dist/entries/queue.js

@@ -25,8 +25,8 @@ function createQueue(driver) {
   return driver === "async" ? new AsyncQueue : new SyncQueue;
 }
 export {
-  createQueue,
-  SyncQueue,
+  AsyncQueue,
   Job,
-  AsyncQueue
+  SyncQueue,
+  createQueue
 };

package/dist/entries/scheduler/osCron.js

@@ -0,0 +1,27 @@
+// @bun
+// ../../src/core/scheduler/osCron.ts
+var DEFAULT_SCHEDULE_RUN_EXPRESSION = "* * * * *";
+var OS_CRON_JOB_TITLE = "getstrata-schedule-run";
+function parseScheduleExpression(expression, from = new Date) {
+  return Bun.cron.parse(expression, from);
+}
+function registerInProcessScheduleRunner(run, expression = DEFAULT_SCHEDULE_RUN_EXPRESSION) {
+  const register = Bun.cron;
+  return register(expression, async () => {
+    await run();
+  }).unref();
+}
+async function installOsScheduleRunner(workerScriptPath, expression = DEFAULT_SCHEDULE_RUN_EXPRESSION, title = OS_CRON_JOB_TITLE) {
+  await Bun.cron(workerScriptPath, expression, title);
+}
+async function uninstallOsScheduleRunner(title = OS_CRON_JOB_TITLE) {
+  await Bun.cron.remove(title);
+}
+export {
+  DEFAULT_SCHEDULE_RUN_EXPRESSION,
+  OS_CRON_JOB_TITLE,
+  installOsScheduleRunner,
+  parseScheduleExpression,
+  registerInProcessScheduleRunner,
+  uninstallOsScheduleRunner
+};

package/dist/entries/scheduler/schedule.js

@@ -32,7 +32,7 @@ async function runDueScheduledTasks(schedule = appSchedule, now = new Date) {
   return due.length;
 }
 export {
-  runDueScheduledTasks,
+  Schedule,
   appSchedule,
-  Schedule
+  runDueScheduledTasks
 };

package/dist/entries/security/oauthState.js

@@ -68,8 +68,8 @@ function clearOAuthStateCookie() {
   return `${OAUTH_STATE_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
 }
 export {
-  verifyOAuthState,
-  createOAuthStateCookie,
+  OAUTH_STATE_COOKIE,
   clearOAuthStateCookie,
-  OAUTH_STATE_COOKIE
+  createOAuthStateCookie,
+  verifyOAuthState
 };

package/dist/entries/security/publicReads.js

@@ -28,6 +28,6 @@ function guestCanViewResource() {
   return isPublicReadsEnabled();
 }
 export {
-  isPublicReadsEnabled,
-  guestCanViewResource
+  guestCanViewResource,
+  isPublicReadsEnabled
 };

package/dist/entries/security/safeFetch.js

@@ -139,6 +139,6 @@ async function safeFetch(input, init = {}, options = {}) {
   }
 }
 export {
-  safeFetch,
-  DEFAULT_FETCH_TIMEOUT_MS
+  DEFAULT_FETCH_TIMEOUT_MS,
+  safeFetch
 };

package/dist/entries/security/safeUrl.js

@@ -96,10 +96,10 @@ function resetDnsLookupForTests() {
   dnsLookup = dnsLookupImpl;
 }
 export {
-  setDnsLookupForTests,
-  resetDnsLookupForTests,
-  isBlockedIpAddress,
-  isBlockedHostname,
+  assertSafeOutboundUrl,
   assertSafeOutboundUrlResolved,
-  assertSafeOutboundUrl
+  isBlockedHostname,
+  isBlockedIpAddress,
+  resetDnsLookupForTests,
+  setDnsLookupForTests
 };

package/dist/entries/security/scimTenantTokens.js

@@ -46,6 +46,6 @@ function resolveScimTenantFromToken(token) {
   return null;
 }
 export {
-  resolveScimTenantFromToken,
-  parseScimTenantTokens
+  parseScimTenantTokens,
+  resolveScimTenantFromToken
 };

package/dist/entries/security/totp.js

@@ -46,6 +46,6 @@ function verifyTotp(secret, token, window = 1) {
   return false;
 }
 export {
-  verifyTotp,
-  generateTotp
+  generateTotp,
+  verifyTotp
 };

package/dist/entries/storage/storage.js

@@ -122,12 +122,12 @@ function resetDefaultStorage() {
   defaultStorage.current = null;
 }
 export {
-  storage,
-  resolveS3Config,
-  resetDefaultStorage,
-  createStorageDriver,
-  createS3Client,
-  StorageManager,
+  LocalStorageDriver,
   S3StorageDriver,
-  LocalStorageDriver
+  StorageManager,
+  createS3Client,
+  createStorageDriver,
+  resetDefaultStorage,
+  resolveS3Config,
+  storage
 };

package/dist/entries/tenant/tenantDatabaseScope.js

@@ -59,7 +59,7 @@ function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {
   return hasActiveDatabaseConnection() && currentTenant()?.id === tenantId;
 }
 export {
-  runWithTenantDatabase,
+  applyTenantContextToTransaction,
   isInsideTenantDatabaseScope,
-  applyTenantContextToTransaction
+  runWithTenantDatabase
 };

package/dist/entries/terminal/runShell.js

@@ -0,0 +1,18 @@
+// @bun
+// ../../src/core/terminal/runShell.ts
+async function runInteractiveShell(command, options = {}) {
+  await using terminal = new Bun.Terminal({
+    cols: options.cols ?? 120,
+    rows: options.rows ?? 30
+  });
+  const proc = Bun.spawn(command, {
+    terminal,
+    cwd: options.cwd,
+    stdin: "inherit"
+  });
+  await proc.exited;
+  return proc.exitCode ?? 1;
+}
+export {
+  runInteractiveShell
+};