@getstrata/core 0.5.55 → 0.5.57

package/dist/entries/jobs/dispatchWebhookJob.js

@@ -1,7 +1,7 @@
 // @bun
 // ../../src/core/jobs/dispatchWebhookJob.ts
 import { createHmac } from "crypto";
-import { repositoryConnection as db } from "@getstrata/core/database/repositoryConnection";
+import { repositoryConnection as db2 } from "@getstrata/core/database/repositoryConnection";
 
 // ../../src/config/app.ts
 var appConfig = {
@@ -169,12 +169,118 @@ async function safeFetch(input, init = {}, options = {}) {
   }
 }
 
+// ../../src/core/tenant/resolveTenant.ts
+import { repositoryConnection as db } from "@getstrata/core/database/repositoryConnection";
+
+// ../../src/core/tenant/tenancyConfig.ts
+function readTenancyDriver(env = process.env) {
+  return env.TENANCY_DRIVER === "none" ? "none" : "rls";
+}
+function isTenancyEnabled(env = process.env) {
+  return readTenancyDriver(env) !== "none";
+}
+
+// ../../src/core/tenant/resolveTenant.ts
+async function resolveTenant(tenantId) {
+  if (!isTenancyEnabled()) {
+    return {
+      id: tenantId,
+      slug: "default",
+      plan: "free",
+      region: "eu"
+    };
+  }
+  const rows = await db`
+    SELECT id, slug, plan, region
+    FROM tenant
+    WHERE id = ${tenantId}
+    LIMIT 1
+  `;
+  const row = rows[0];
+  return row ? { id: row.id, slug: row.slug, plan: row.plan, region: row.region ?? "eu" } : null;
+}
+
+// ../../src/core/tenant/tenantDatabaseScope.ts
+import { getDefaultDatabasePool } from "@getstrata/core/database/defaultConnection";
+
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+
+// ../../src/core/database/connectionContext.ts
+var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
+function runWithDatabaseConnection(connection, callback) {
+  return activeConnection.run(connection, callback);
+}
+function getActiveDatabaseConnection(fallback) {
+  return activeConnection.getStore() ?? fallback;
+}
+function hasActiveDatabaseConnection() {
+  return activeConnection.getStore() !== undefined;
+}
+
+// ../../src/core/tenant/tenantContext.ts
+var tenantContext = createAsyncContextStore("@getstrata/tenantContext");
+function runWithTenant(tenant, callback) {
+  return tenantContext.run(tenant, callback);
+}
+function currentTenant() {
+  return tenantContext.getStore() ?? null;
+}
+
+// ../../src/core/tenant/tenantDatabaseScope.ts
+async function applyTenantContextToTransaction(transaction, tenantId) {
+  await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
+  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
+}
+async function runWithTenantDatabase(tenant, callback) {
+  if (!isTenancyEnabled()) {
+    return await runWithTenant(tenant, callback);
+  }
+  if (hasActiveDatabaseConnection()) {
+    const activeConnection2 = getActiveDatabaseConnection(getDefaultDatabasePool());
+    await applyTenantContextToTransaction(activeConnection2, tenant.id);
+    return await runWithTenant(tenant, callback);
+  }
+  return await getDefaultDatabasePool().begin(async (transaction) => {
+    await applyTenantContextToTransaction(transaction, tenant.id);
+    return await runWithDatabaseConnection(transaction, async () => {
+      return await runWithTenant(tenant, callback);
+    });
+  });
+}
+function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {
+  return hasActiveDatabaseConnection() && currentTenant()?.id === tenantId;
+}
+
 // ../../src/core/jobs/dispatchWebhookJob.ts
 class DispatchWebhookJob extends Job {
   maxAttempts = 3;
   backoffMs = 2000;
   async handle(payload) {
-    const rows = await db`
+    const tenant = await resolveTenant(payload.tenantId) ?? {
+      id: payload.tenantId,
+      slug: "job",
+      plan: "free",
+      region: "eu"
+    };
+    const failure = await runWithTenantDatabase(tenant, async () => await this.deliver(payload));
+    if (failure) {
+      throw failure;
+    }
+  }
+  async deliver(payload) {
+    const rows = await db2`
       SELECT id, url, secret
       FROM webhook
       WHERE id = ${payload.webhookId} AND active = TRUE
@@ -204,7 +310,7 @@ class DispatchWebhookJob extends Job {
       }
     } catch (error) {
       errorMessage = error instanceof Error ? error.message : String(error);
-      await db`
+      await db2`
         INSERT INTO webhook_delivery (webhook_id, event, payload, response_status, error)
         VALUES (
           ${webhook.id},
@@ -214,9 +320,9 @@ class DispatchWebhookJob extends Job {
           ${errorMessage}
         )
       `;
-      throw error instanceof Error ? error : new Error(errorMessage);
+      return error instanceof Error ? error : new Error(errorMessage);
     }
-    await db`
+    await db2`
       INSERT INTO webhook_delivery (webhook_id, event, payload, response_status)
       VALUES (
         ${webhook.id},

package/dist/entries/lifecycle/gracefulShutdown.js

@@ -43,8 +43,8 @@ function resetGracefulShutdownForTests() {
   shuttingDown = false;
 }
 export {
-  runGracefulShutdown,
-  resetGracefulShutdownForTests,
+  installGracefulShutdownSignals,
   registerShutdownHandler,
-  installGracefulShutdownSignals
+  resetGracefulShutdownForTests,
+  runGracefulShutdown
 };

package/dist/entries/logging/logger.js

@@ -35,6 +35,6 @@ class Logger {
 }
 var appLogger = new Logger("app");
 export {
-  appLogger,
-  Logger
+  Logger,
+  appLogger
 };

package/dist/entries/logging/requestLoggingMiddleware.js

@@ -2,6 +2,21 @@
 // ../../src/core/logging/requestLoggingMiddleware.ts
 import { runWithRequestMeta } from "@getstrata/core/http/requestMetaContext";
 
+// ../../src/core/http/clientIp.ts
+function trustForwardedFor(env = process.env) {
+  return (env.TRUST_FORWARDED_FOR ?? "false") === "true";
+}
+function readClientIp(request, env = process.env) {
+  if (!trustForwardedFor(env)) {
+    return;
+  }
+  const forwarded = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
+  if (forwarded) {
+    return forwarded;
+  }
+  return request.headers.get("x-real-ip")?.trim() || undefined;
+}
+
 // ../../src/core/logging/logger.ts
 class Logger {
   channel;
@@ -42,7 +57,7 @@ var appLogger = new Logger("app");
 function createRequestLoggingMiddleware() {
   return async (request, next) => {
     return await runWithRequestMeta({
-      ipAddress: request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? request.headers.get("x-real-ip"),
+      ipAddress: readClientIp(request) ?? null,
       userAgent: request.headers.get("user-agent"),
       request
     }, async () => {

package/dist/entries/mail/mailer.js

@@ -198,11 +198,11 @@ function mailer() {
   return appMailer;
 }
 export {
-  resolveSmtpConfig,
-  mailer,
-  createMailDriver,
-  buildSmtpPayload,
-  SmtpMailDriver,
+  LogMailDriver,
   Mailer,
-  LogMailDriver
+  SmtpMailDriver,
+  buildSmtpPayload,
+  createMailDriver,
+  mailer,
+  resolveSmtpConfig
 };

package/dist/entries/mail/markdownMail.js

@@ -56,8 +56,8 @@ function renderMarkdownMail(markdown, options = {}) {
   return { html, text };
 }
 export {
-  wrapMarkdownMailLayout,
-  stripMarkdown,
+  markdownToHtml,
   renderMarkdownMail,
-  markdownToHtml
+  stripMarkdown,
+  wrapMarkdownMailLayout
 };

package/dist/entries/mail/markdownMailable.js

@@ -73,6 +73,6 @@ async function sendMarkdownMail(mailer, input) {
   await mailer.send(buildMarkdownMailMessage(input));
 }
 export {
-  sendMarkdownMail,
-  buildMarkdownMailMessage
+  buildMarkdownMailMessage,
+  sendMarkdownMail
 };

package/dist/entries/media/imageTransform.js

@@ -0,0 +1,40 @@
+// @bun
+// ../../src/core/media/imageTransform.ts
+var IMAGE_MIME_TYPES = new Set(["image/jpeg", "image/png", "image/gif", "image/webp"]);
+function normalizeMimeType(mimeType) {
+  return mimeType.split(";")[0]?.trim().toLowerCase() ?? "";
+}
+function isImageMimeType(mimeType) {
+  return IMAGE_MIME_TYPES.has(normalizeMimeType(mimeType));
+}
+function parseThumbnailWidth(raw, options = {}) {
+  const defaultWidth = options.defaultWidth ?? 200;
+  const minWidth = options.minWidth ?? 16;
+  const maxWidth = options.maxWidth ?? 800;
+  if (!raw?.trim()) {
+    return defaultWidth;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isInteger(parsed)) {
+    return defaultWidth;
+  }
+  return Math.min(maxWidth, Math.max(minWidth, parsed));
+}
+async function resizeImageContents(contents, width, mimeType) {
+  const normalized = normalizeMimeType(mimeType);
+  const pipeline = new Bun.Image(contents).resize(width);
+  if (normalized === "image/png") {
+    return { body: await pipeline.png().bytes(), contentType: "image/png" };
+  }
+  if (normalized === "image/webp") {
+    return { body: await pipeline.webp().bytes(), contentType: "image/webp" };
+  }
+  return { body: await pipeline.jpeg().bytes(), contentType: "image/jpeg" };
+}
+export {
+  IMAGE_MIME_TYPES,
+  isImageMimeType,
+  normalizeMimeType,
+  parseThumbnailWidth,
+  resizeImageContents
+};

package/dist/entries/metrics/prometheus.js

@@ -65,6 +65,6 @@ class PrometheusRegistry {
 }
 var prometheusRegistry = new PrometheusRegistry;
 export {
-  prometheusRegistry,
-  PrometheusRegistry
+  PrometheusRegistry,
+  prometheusRegistry
 };

package/dist/entries/openapi/generator.js

@@ -172,7 +172,7 @@ function renderTypeScriptSdk(spec, apiPrefix = "/api/v1") {
 `);
 }
 export {
-  renderTypeScriptSdk,
+  generateOpenApiSpec,
   renderOpenApiDocument,
-  generateOpenApiSpec
+  renderTypeScriptSdk
 };

package/dist/entries/queue/createAppQueue.js

@@ -346,9 +346,9 @@ function createAppQueue(driver, redisUrl, failedJobs = createFailedJobService(),
   });
 }
 export {
-  createTrackedJob,
-  createQueueWorker,
-  createFailedJobService,
+  FAILED_JOB_SERVICE_TOKEN,
   createAppQueue,
-  FAILED_JOB_SERVICE_TOKEN
+  createFailedJobService,
+  createQueueWorker,
+  createTrackedJob
 };

package/dist/entries/queue/publicQueue.js

@@ -336,15 +336,15 @@ function createQueueWorker(redisUrl, failedJobs = createFailedJobService()) {
   return new QueueWorker(redisUrl, failedJobs);
 }
 export {
-  runQueueJob,
-  jobRegistry,
-  createTrackedJob,
-  createQueueWorker,
-  createProductionQueue,
-  createFailedJobService,
-  ResilientQueue,
-  RedisQueue,
-  QueueWorker,
+  failedJobRepository_default as FailedJobRepository,
   failedJobService_default as FailedJobService,
-  failedJobRepository_default as FailedJobRepository
+  QueueWorker,
+  RedisQueue,
+  ResilientQueue,
+  createFailedJobService,
+  createProductionQueue,
+  createQueueWorker,
+  createTrackedJob,
+  jobRegistry,
+  runQueueJob
 };

package/dist/entries/queue/queueMetrics.js

@@ -400,6 +400,6 @@ async function collectQueueMetrics() {
   };
 }
 export {
-  readRedisQueueDepth,
-  collectQueueMetrics
+  collectQueueMetrics,
+  readRedisQueueDepth
 };

package/dist/entries/queue/redisQueue.js

@@ -222,12 +222,12 @@ async function countPendingQueueJobs(redisUrl) {
   }
 }
 export {
-  queueKeyForPriority,
-  parseQueueJobEnvelope,
-  countPendingQueueJobs,
-  RedisQueue,
-  QueueWorker,
-  QUEUE_LOW_KEY,
+  QUEUE_HIGH_KEY,
   QUEUE_LIST_KEY,
-  QUEUE_HIGH_KEY
+  QUEUE_LOW_KEY,
+  QueueWorker,
+  RedisQueue,
+  countPendingQueueJobs,
+  parseQueueJobEnvelope,
+  queueKeyForPriority
 };

package/dist/entries/queue.js

@@ -25,8 +25,8 @@ function createQueue(driver) {
   return driver === "async" ? new AsyncQueue : new SyncQueue;
 }
 export {
-  createQueue,
-  SyncQueue,
+  AsyncQueue,
   Job,
-  AsyncQueue
+  SyncQueue,
+  createQueue
 };

package/dist/entries/scheduler/osCron.js

@@ -0,0 +1,27 @@
+// @bun
+// ../../src/core/scheduler/osCron.ts
+var DEFAULT_SCHEDULE_RUN_EXPRESSION = "* * * * *";
+var OS_CRON_JOB_TITLE = "getstrata-schedule-run";
+function parseScheduleExpression(expression, from = new Date) {
+  return Bun.cron.parse(expression, from);
+}
+function registerInProcessScheduleRunner(run, expression = DEFAULT_SCHEDULE_RUN_EXPRESSION) {
+  const register = Bun.cron;
+  return register(expression, async () => {
+    await run();
+  }).unref();
+}
+async function installOsScheduleRunner(workerScriptPath, expression = DEFAULT_SCHEDULE_RUN_EXPRESSION, title = OS_CRON_JOB_TITLE) {
+  await Bun.cron(workerScriptPath, expression, title);
+}
+async function uninstallOsScheduleRunner(title = OS_CRON_JOB_TITLE) {
+  await Bun.cron.remove(title);
+}
+export {
+  DEFAULT_SCHEDULE_RUN_EXPRESSION,
+  OS_CRON_JOB_TITLE,
+  installOsScheduleRunner,
+  parseScheduleExpression,
+  registerInProcessScheduleRunner,
+  uninstallOsScheduleRunner
+};

package/dist/entries/scheduler/schedule.js

@@ -32,7 +32,7 @@ async function runDueScheduledTasks(schedule = appSchedule, now = new Date) {
   return due.length;
 }
 export {
-  runDueScheduledTasks,
+  Schedule,
   appSchedule,
-  Schedule
+  runDueScheduledTasks
 };

package/dist/entries/security/oauthState.js

@@ -68,8 +68,8 @@ function clearOAuthStateCookie() {
   return `${OAUTH_STATE_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
 }
 export {
-  verifyOAuthState,
-  createOAuthStateCookie,
+  OAUTH_STATE_COOKIE,
   clearOAuthStateCookie,
-  OAUTH_STATE_COOKIE
+  createOAuthStateCookie,
+  verifyOAuthState
 };

package/dist/entries/security/publicReads.js

@@ -28,6 +28,6 @@ function guestCanViewResource() {
   return isPublicReadsEnabled();
 }
 export {
-  isPublicReadsEnabled,
-  guestCanViewResource
+  guestCanViewResource,
+  isPublicReadsEnabled
 };

package/dist/entries/security/safeFetch.js

@@ -139,6 +139,6 @@ async function safeFetch(input, init = {}, options = {}) {
   }
 }
 export {
-  safeFetch,
-  DEFAULT_FETCH_TIMEOUT_MS
+  DEFAULT_FETCH_TIMEOUT_MS,
+  safeFetch
 };

package/dist/entries/security/safeUrl.js

@@ -96,10 +96,10 @@ function resetDnsLookupForTests() {
   dnsLookup = dnsLookupImpl;
 }
 export {
-  setDnsLookupForTests,
-  resetDnsLookupForTests,
-  isBlockedIpAddress,
-  isBlockedHostname,
+  assertSafeOutboundUrl,
   assertSafeOutboundUrlResolved,
-  assertSafeOutboundUrl
+  isBlockedHostname,
+  isBlockedIpAddress,
+  resetDnsLookupForTests,
+  setDnsLookupForTests
 };

package/dist/entries/security/scimTenantTokens.js

@@ -1,7 +1,4 @@
 // @bun
-// ../../src/domain/scim.ts
-var TEST_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
-
 // ../../src/core/security/timingSafeCompare.ts
 import { timingSafeEqual } from "crypto";
 function timingSafeCompareString(left, right) {
@@ -39,13 +36,13 @@ function resolveScimTenantFromToken(token) {
       return tenantId;
     }
   }
-  const fallbackToken = process.env.SCIM_BEARER_TOKEN ?? TEST_SCIM_BEARER_TOKEN;
+  const fallbackToken = process.env.SCIM_BEARER_TOKEN ?? "";
   if (timingSafeCompareString(token, fallbackToken)) {
     return 1;
   }
   return null;
 }
 export {
-  resolveScimTenantFromToken,
-  parseScimTenantTokens
+  parseScimTenantTokens,
+  resolveScimTenantFromToken
 };

package/dist/entries/security/totp.js

@@ -46,6 +46,6 @@ function verifyTotp(secret, token, window = 1) {
   return false;
 }
 export {
-  verifyTotp,
-  generateTotp
+  generateTotp,
+  verifyTotp
 };

package/dist/entries/storage/storage.js

@@ -122,12 +122,12 @@ function resetDefaultStorage() {
   defaultStorage.current = null;
 }
 export {
-  storage,
-  resolveS3Config,
-  resetDefaultStorage,
-  createStorageDriver,
-  createS3Client,
-  StorageManager,
+  LocalStorageDriver,
   S3StorageDriver,
-  LocalStorageDriver
+  StorageManager,
+  createS3Client,
+  createStorageDriver,
+  resetDefaultStorage,
+  resolveS3Config,
+  storage
 };

package/dist/entries/tenant/tenancyConfig.js

@@ -0,0 +1,12 @@
+// @bun
+// ../../src/core/tenant/tenancyConfig.ts
+function readTenancyDriver(env = process.env) {
+  return env.TENANCY_DRIVER === "none" ? "none" : "rls";
+}
+function isTenancyEnabled(env = process.env) {
+  return readTenancyDriver(env) !== "none";
+}
+export {
+  isTenancyEnabled,
+  readTenancyDriver
+};

package/dist/entries/tenant/tenantDatabaseScope.js

@@ -28,6 +28,14 @@ function hasActiveDatabaseConnection() {
   return activeConnection.getStore() !== undefined;
 }
 
+// ../../src/core/tenant/tenancyConfig.ts
+function readTenancyDriver(env = process.env) {
+  return env.TENANCY_DRIVER === "none" ? "none" : "rls";
+}
+function isTenancyEnabled(env = process.env) {
+  return readTenancyDriver(env) !== "none";
+}
+
 // ../../src/core/tenant/tenantContext.ts
 var tenantContext = createAsyncContextStore("@getstrata/tenantContext");
 function runWithTenant(tenant, callback) {
@@ -43,6 +51,9 @@ async function applyTenantContextToTransaction(transaction, tenantId) {
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
 }
 async function runWithTenantDatabase(tenant, callback) {
+  if (!isTenancyEnabled()) {
+    return await runWithTenant(tenant, callback);
+  }
   if (hasActiveDatabaseConnection()) {
     const activeConnection2 = getActiveDatabaseConnection(getDefaultDatabasePool());
     await applyTenantContextToTransaction(activeConnection2, tenant.id);
@@ -59,7 +70,7 @@ function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {
   return hasActiveDatabaseConnection() && currentTenant()?.id === tenantId;
 }
 export {
-  runWithTenantDatabase,
+  applyTenantContextToTransaction,
   isInsideTenantDatabaseScope,
-  applyTenantContextToTransaction
+  runWithTenantDatabase
 };

package/dist/entries/terminal/runShell.js

@@ -0,0 +1,18 @@
+// @bun
+// ../../src/core/terminal/runShell.ts
+async function runInteractiveShell(command, options = {}) {
+  await using terminal = new Bun.Terminal({
+    cols: options.cols ?? 120,
+    rows: options.rows ?? 30
+  });
+  const proc = Bun.spawn(command, {
+    terminal,
+    cwd: options.cwd,
+    stdin: "inherit"
+  });
+  await proc.exited;
+  return proc.exitCode ?? 1;
+}
+export {
+  runInteractiveShell
+};

package/dist/entries/validation/rules.js

@@ -151,17 +151,17 @@ function validateObject(payload, schema) {
   return output;
 }
 export {
-  validateObject,
-  stringRule,
-  required,
-  positiveIntegerRule,
-  pattern,
-  optional,
-  minLength,
-  maxLength,
-  integerRule,
-  integerRange,
-  enumRule,
+  confirmed,
   emailRule,
-  confirmed
+  enumRule,
+  integerRange,
+  integerRule,
+  maxLength,
+  minLength,
+  optional,
+  pattern,
+  positiveIntegerRule,
+  required,
+  stringRule,
+  validateObject
 };