@getstrata/core 0.5.82 → 0.5.85

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @getstrata/core changelog
 
+## 0.5.85
+
+- `applicationRegistry` prefers the latest `Symbol.for("@getstrata/applicationContext")` on `globalThis` so a stale module-local context cannot hide the bootstrapped app after `build:framework`.
+
+## 0.5.84
+
+- `eventBus` is a `Symbol.for("@getstrata/eventBus")` process singleton so model writes from a built `@getstrata/core/database/baseRepository` bundle reach app listeners that imported a different copy of `@getstrata/core/events` (GitHub Actions `build:framework` before tests).
+
+## 0.5.83
+
+- `MEMBER_ABILITIES` includes `auth:tokens:delete` so Jetstream-style personal access token revoke works for members (`DELETE /auth/tokens/:id`). HTML `/account/tokens/:id/revoke` was already authenticated-only.
+- `buildOtpauthUrl()` defaults the issuer through `appDisplayName()` (`APP_NAME`).
+
 ## 0.5.82
 
 - `MEMBER_ABILITIES` includes `organizations:create` so Jetstream-style extra teams work for members (HTML `POST /organizations` and JSON `POST /organizations`). `OrganizationPolicy.create` already allowed any authenticated user.

package/README.md

@@ -82,7 +82,7 @@ import type { Migration } from "@getstrata/core/database/migrations/types";
 Package name: **`@getstrata/core`** (npm org [`@getstrata`](https://www.npmjs.com/org/getstrata)).
 
 1. Add `NPM_TOKEN` to GitHub repository secrets.
-2. Tag a release: `git tag v0.5.84 && git push origin v0.5.84`
+2. Tag a release: `git tag v0.5.85 && git push origin v0.5.85`
 3. [Release workflow](../../.github/workflows/release.yml) builds and runs `npm publish --access public`.
 
 Previously published as `@eyk-workhub/framework@0.1.0`, deprecated in favor of this package.

package/dist/core/auth/abilityCatalog.d.ts

@@ -1,5 +1,5 @@
-declare const MEMBER_ABILITIES: readonly ["organizations:read", "organizations:create", "projects:read", "projects:create", "tasks:read", "tasks:create", "comments:read", "comments:create", "attachments:read", "attachments:create", "auth:tokens:read", "auth:tokens:write"];
-declare const ADMIN_ABILITIES: readonly ["organizations:read", "organizations:create", "projects:read", "projects:create", "tasks:read", "tasks:create", "comments:read", "comments:create", "attachments:read", "attachments:create", "auth:tokens:read", "auth:tokens:write", "organizations:create", "organizations:update", "organizations:delete", "projects:update", "projects:delete", "tasks:update", "tasks:delete", "comments:update", "comments:delete", "attachments:delete", "webhooks:read", "webhooks:write", "audit:read"];
+declare const MEMBER_ABILITIES: readonly ["organizations:read", "organizations:create", "projects:read", "projects:create", "tasks:read", "tasks:create", "comments:read", "comments:create", "attachments:read", "attachments:create", "auth:tokens:read", "auth:tokens:write", "auth:tokens:delete"];
+declare const ADMIN_ABILITIES: readonly ["organizations:read", "organizations:create", "projects:read", "projects:create", "tasks:read", "tasks:create", "comments:read", "comments:create", "attachments:read", "attachments:create", "auth:tokens:read", "auth:tokens:write", "auth:tokens:delete", "organizations:create", "organizations:update", "organizations:delete", "projects:update", "projects:delete", "tasks:update", "tasks:delete", "comments:update", "comments:delete", "attachments:delete", "webhooks:read", "webhooks:write", "audit:read"];
 declare const PLATFORM_ADMIN_ABILITIES: readonly ["*"];
 interface AbilityCatalog {
     member: readonly string[];

package/dist/core/events/eventBus.d.ts

@@ -5,6 +5,7 @@ declare class EventBus {
     listen(event: string, listener: EventListener): () => void;
     dispatch(event: string, payload: unknown): Promise<void>;
 }
+declare function readSharedEventBus(): EventBus;
 declare const eventBus: EventBus;
 export type { EventListener };
-export { EventBus, eventBus };
+export { EventBus, eventBus, readSharedEventBus };

package/dist/core/events/index.d.ts

@@ -1,4 +1,4 @@
 export type { EventListener } from "./eventBus";
-export { EventBus, eventBus } from "./eventBus";
+export { EventBus, eventBus, readSharedEventBus } from "./eventBus";
 declare function modelEventName(tableName: string, action: string): string;
 export { modelEventName };

package/dist/entries/auth/sessionGuard.js

@@ -57,7 +57,8 @@ var MEMBER_ABILITIES = [
   "attachments:read",
   "attachments:create",
   "auth:tokens:read",
-  "auth:tokens:write"
+  "auth:tokens:write",
+  "auth:tokens:delete"
 ];
 var ADMIN_ABILITIES = [
   ...MEMBER_ABILITIES,

package/dist/entries/jobs/dispatchWebhookJob.js

@@ -14,8 +14,9 @@ class DispatchWebhookJob extends Job {
   maxAttempts = 3;
   backoffMs = 2000;
   async handle(payload) {
-    const tenant = await resolveTenant(payload.tenantId) ?? {
-      id: payload.tenantId,
+    const tenantId = Number(payload.tenantId);
+    const tenant = await resolveTenant(tenantId) ?? {
+      id: tenantId,
       slug: "job",
       plan: "free",
       region: "eu"
@@ -26,13 +27,16 @@ class DispatchWebhookJob extends Job {
     }
   }
   async deliver(payload) {
-    const rows = await db`
-      SELECT id, url, secret
-      FROM webhook
-      WHERE id = ${payload.webhookId} AND active = TRUE
-      LIMIT 1
-    `;
-    const webhook = rows[0];
+    const queuedUrl = typeof payload.url === "string" ? payload.url : "";
+    const queuedSecret = typeof payload.secret === "string" ? payload.secret : "";
+    const queued = queuedUrl !== "" && queuedSecret !== "" ? { id: payload.webhookId, url: queuedUrl, secret: queuedSecret } : null;
+    const rows = queued ? [] : await db`
+          SELECT id, url, secret
+          FROM webhook
+          WHERE id = ${payload.webhookId} AND active = TRUE
+          LIMIT 1
+        `;
+    const webhook = queued ?? rows[0];
     if (!webhook) {
       return;
     }

package/dist/entries/openapi/generator.js

@@ -66,10 +66,16 @@ var PUBLIC_ROUTE_DESCRIPTIONS = {
   "POST /auth/tokens": "Create API token",
   "DELETE /auth/tokens/:id": "Revoke API token",
   "GET /users/me/export": "GDPR export of user data",
+  "GET /users/me/current-organization": "Current Jetstream organization",
+  "PUT /users/me/current-organization": "Switch current Jetstream organization",
+  "GET /users/me/invitations": "List pending team invitations for the signed-in email",
+  "POST /users/me/invitations/:id/accept": "Accept a pending team invitation",
+  "DELETE /users/me/invitations/:id": "Decline a pending team invitation",
   "DELETE /users/me": "GDPR account erasure (anonymize user, revoke tokens)",
   "GET /organizations": "List organizations",
   "POST /organizations": "Create organization",
   "GET /organizations/:id/members": "List organization members",
+  "POST /organizations/:id/invitations/:invitationId/resend": "Resend a pending team invitation and rotate its token",
   "GET /projects": "List projects",
   "POST /projects": "Create project",
   "GET /tasks": "List tasks",

package/dist/entries/security/totp.js

@@ -1,6 +1,62 @@
 // @bun
 // ../../src/core/security/totp.ts
 import { createHmac, randomBytes } from "crypto";
+
+// ../../src/core/runtime/appKeyPrefix.ts
+function appKeyPrefix() {
+  return process.env.APP_KEY_PREFIX?.trim() || "workhub";
+}
+function appCookieName(kind) {
+  return `${appKeyPrefix()}_${kind}`;
+}
+function appDevSecret(kind) {
+  return `${appKeyPrefix()}-dev-${kind}`;
+}
+function namespacedRedisKey(kind) {
+  return `${appKeyPrefix()}:${kind}`;
+}
+function smtpEhloHost() {
+  const raw = process.env.MAIL_EHLO?.trim() || `${appKeyPrefix()}.local`;
+  const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
+  return safe || "strata.local";
+}
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
+function otelServiceName() {
+  return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
+}
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "WorkHub";
+}
+function appEnv() {
+  return process.env.APP_ENV?.trim() || "local";
+}
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
+
+// ../../src/core/security/totp.ts
 function decodeBase32(input) {
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
   const normalized = input.replace(/=+$/u, "").toUpperCase();
@@ -35,7 +91,7 @@ function generateTotpSecret(byteLength = 20) {
   return encodeBase32(randomBytes(byteLength));
 }
 function buildOtpauthUrl(options) {
-  const issuer = options.issuer?.trim() || process.env.APP_NAME?.trim() || "WorkHub";
+  const issuer = options.issuer?.trim() || appDisplayName();
   const label = `${issuer}:${options.account}`;
   const params = new URLSearchParams({
     secret: options.secret,

package/dist/index.js

@@ -208,7 +208,8 @@ var MEMBER_ABILITIES = [
   "attachments:read",
   "attachments:create",
   "auth:tokens:read",
-  "auth:tokens:write"
+  "auth:tokens:write",
+  "auth:tokens:delete"
 ];
 var ADMIN_ABILITIES = [
   ...MEMBER_ABILITIES,
@@ -587,12 +588,10 @@ var appLogger = new Logger("app");
 var APPLICATION_CONTEXT_KEY = Symbol.for("@getstrata/applicationContext");
 var activeContext;
 function readStoredApplicationContext() {
-  if (activeContext) {
-    return activeContext;
-  }
   const globalContext = globalThis[APPLICATION_CONTEXT_KEY];
   if (globalContext) {
     activeContext = globalContext;
+    return activeContext;
   }
   return activeContext;
 }
@@ -1531,7 +1530,17 @@ class EventBus {
     }
   }
 }
-var eventBus = new EventBus;
+var EVENT_BUS_KEY = Symbol.for("@getstrata/eventBus");
+function readSharedEventBus() {
+  const globalBus = globalThis[EVENT_BUS_KEY];
+  if (globalBus) {
+    return globalBus;
+  }
+  const bus = new EventBus;
+  globalThis[EVENT_BUS_KEY] = bus;
+  return bus;
+}
+var eventBus = readSharedEventBus();
 
 // ../../src/core/events/index.ts
 function modelEventName(tableName, action) {

package/dist/modules/webhook/dispatchWebhookJob.d.ts

@@ -4,6 +4,8 @@ interface DispatchWebhookPayload {
     tenantId: number;
     event: string;
     payload: Record<string, unknown>;
+    url?: string;
+    secret?: string;
 }
 declare class DispatchWebhookJob extends Job<DispatchWebhookPayload> {
     readonly maxAttempts = 3;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "0.5.82",
+  "version": "0.5.85",
   "description": "Strata — Laravel-inspired Bun framework public API",
   "type": "module",
   "license": "MIT",