@getstrata/core 0.5.83 → 0.5.86

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @getstrata/core changelog
 
+## 0.5.86
+
+- `createSessionCookieDetails()` returns the HMAC session header plus `issuedAt` / `ttlSeconds` so apps can persist Jetstream browser-session rows without changing the cookie format.
+
+## 0.5.85
+
+- `applicationRegistry` prefers the latest `Symbol.for("@getstrata/applicationContext")` on `globalThis` so a stale module-local context cannot hide the bootstrapped app after `build:framework`.
+
+## 0.5.84
+
+- `eventBus` is a `Symbol.for("@getstrata/eventBus")` process singleton so model writes from a built `@getstrata/core/database/baseRepository` bundle reach app listeners that imported a different copy of `@getstrata/core/events` (GitHub Actions `build:framework` before tests).
+
 ## 0.5.83
 
 - `MEMBER_ABILITIES` includes `auth:tokens:delete` so Jetstream-style personal access token revoke works for members (`DELETE /auth/tokens/:id`). HTML `/account/tokens/:id/revoke` was already authenticated-only.

package/README.md

@@ -82,7 +82,7 @@ import type { Migration } from "@getstrata/core/database/migrations/types";
 Package name: **`@getstrata/core`** (npm org [`@getstrata`](https://www.npmjs.com/org/getstrata)).
 
 1. Add `NPM_TOKEN` to GitHub repository secrets.
-2. Tag a release: `git tag v0.5.84 && git push origin v0.5.84`
+2. Tag a release: `git tag v0.5.86 && git push origin v0.5.86`
 3. [Release workflow](../../.github/workflows/release.yml) builds and runs `npm publish --access public`.
 
 Previously published as `@eyk-workhub/framework@0.1.0`, deprecated in favor of this package.

package/dist/core/auth/sessionCookie.d.ts

@@ -14,7 +14,14 @@ declare function sessionRememberTtlSeconds(): number;
 declare function readSession(request: Request): SignedSession | null;
 declare function readSessionUserId(request: Request): number | null;
 declare function isSessionInvalidated(issuedAt: number, validAfter: Date | string | null | undefined): boolean;
+interface SessionCookieDetails {
+    header: string;
+    userId: number;
+    issuedAt: number;
+    ttlSeconds: number;
+}
+declare function createSessionCookieDetails(userId: number, options?: CreateSessionCookieOptions): SessionCookieDetails;
 declare function createSessionCookie(userId: number, options?: CreateSessionCookieOptions): string;
 declare function clearSessionCookie(): string;
-export type { CreateSessionCookieOptions, SignedSession };
-export { clearSessionCookie, createSessionCookie, isSessionInvalidated, readSession, readSessionUserId, SESSION_COOKIE, SESSION_REMEMBER_TTL_SECONDS, SESSION_TTL_SECONDS, sessionCookieName, sessionRememberTtlSeconds, sessionTtlSeconds, };
+export type { CreateSessionCookieOptions, SessionCookieDetails, SignedSession };
+export { clearSessionCookie, createSessionCookie, createSessionCookieDetails, isSessionInvalidated, readSession, readSessionUserId, SESSION_COOKIE, SESSION_REMEMBER_TTL_SECONDS, SESSION_TTL_SECONDS, sessionCookieName, sessionRememberTtlSeconds, sessionTtlSeconds, };

package/dist/core/events/eventBus.d.ts

@@ -5,6 +5,7 @@ declare class EventBus {
     listen(event: string, listener: EventListener): () => void;
     dispatch(event: string, payload: unknown): Promise<void>;
 }
+declare function readSharedEventBus(): EventBus;
 declare const eventBus: EventBus;
 export type { EventListener };
-export { EventBus, eventBus };
+export { EventBus, eventBus, readSharedEventBus };

package/dist/core/events/index.d.ts

@@ -1,4 +1,4 @@
 export type { EventListener } from "./eventBus";
-export { EventBus, eventBus } from "./eventBus";
+export { EventBus, eventBus, readSharedEventBus } from "./eventBus";
 declare function modelEventName(tableName: string, action: string): string;
 export { modelEventName };

package/dist/entries/auth/sessionCookie.js

@@ -149,12 +149,20 @@ function isSessionInvalidated(issuedAt, validAfter) {
   }
   return issuedAt < timestamp;
 }
-function createSessionCookie(userId, options = {}) {
+function createSessionCookieDetails(userId, options = {}) {
   const issuedAt = Date.now();
   const ttlSeconds = options.remember ? sessionRememberTtlSeconds() : sessionTtlSeconds();
   const value = options.remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt);
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
-  return `${sessionCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${ttlSeconds}${secure}`;
+  return {
+    header: `${sessionCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${ttlSeconds}${secure}`,
+    userId,
+    issuedAt,
+    ttlSeconds
+  };
+}
+function createSessionCookie(userId, options = {}) {
+  return createSessionCookieDetails(userId, options).header;
 }
 function clearSessionCookie() {
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
@@ -166,6 +174,7 @@ export {
   SESSION_TTL_SECONDS,
   clearSessionCookie,
   createSessionCookie,
+  createSessionCookieDetails,
   isSessionInvalidated,
   readSession,
   readSessionUserId,

package/dist/entries/auth/sessionGuard.js

@@ -234,12 +234,20 @@ function isSessionInvalidated(issuedAt, validAfter) {
   }
   return issuedAt < timestamp;
 }
-function createSessionCookie(userId, options = {}) {
+function createSessionCookieDetails(userId, options = {}) {
   const issuedAt = Date.now();
   const ttlSeconds = options.remember ? sessionRememberTtlSeconds() : sessionTtlSeconds();
   const value = options.remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt);
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
-  return `${sessionCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${ttlSeconds}${secure}`;
+  return {
+    header: `${sessionCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${ttlSeconds}${secure}`,
+    userId,
+    issuedAt,
+    ttlSeconds
+  };
+}
+function createSessionCookie(userId, options = {}) {
+  return createSessionCookieDetails(userId, options).header;
 }
 function clearSessionCookie() {
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";

package/dist/entries/jobs/dispatchWebhookJob.js

@@ -14,8 +14,9 @@ class DispatchWebhookJob extends Job {
   maxAttempts = 3;
   backoffMs = 2000;
   async handle(payload) {
-    const tenant = await resolveTenant(payload.tenantId) ?? {
-      id: payload.tenantId,
+    const tenantId = Number(payload.tenantId);
+    const tenant = await resolveTenant(tenantId) ?? {
+      id: tenantId,
       slug: "job",
       plan: "free",
       region: "eu"
@@ -26,13 +27,16 @@ class DispatchWebhookJob extends Job {
     }
   }
   async deliver(payload) {
-    const rows = await db`
-      SELECT id, url, secret
-      FROM webhook
-      WHERE id = ${payload.webhookId} AND active = TRUE
-      LIMIT 1
-    `;
-    const webhook = rows[0];
+    const queuedUrl = typeof payload.url === "string" ? payload.url : "";
+    const queuedSecret = typeof payload.secret === "string" ? payload.secret : "";
+    const queued = queuedUrl !== "" && queuedSecret !== "" ? { id: payload.webhookId, url: queuedUrl, secret: queuedSecret } : null;
+    const rows = queued ? [] : await db`
+          SELECT id, url, secret
+          FROM webhook
+          WHERE id = ${payload.webhookId} AND active = TRUE
+          LIMIT 1
+        `;
+    const webhook = queued ?? rows[0];
     if (!webhook) {
       return;
     }

package/dist/entries/openapi/generator.js

@@ -66,10 +66,16 @@ var PUBLIC_ROUTE_DESCRIPTIONS = {
   "POST /auth/tokens": "Create API token",
   "DELETE /auth/tokens/:id": "Revoke API token",
   "GET /users/me/export": "GDPR export of user data",
+  "GET /users/me/current-organization": "Current Jetstream organization",
+  "PUT /users/me/current-organization": "Switch current Jetstream organization",
+  "GET /users/me/invitations": "List pending team invitations for the signed-in email",
+  "POST /users/me/invitations/:id/accept": "Accept a pending team invitation",
+  "DELETE /users/me/invitations/:id": "Decline a pending team invitation",
   "DELETE /users/me": "GDPR account erasure (anonymize user, revoke tokens)",
   "GET /organizations": "List organizations",
   "POST /organizations": "Create organization",
   "GET /organizations/:id/members": "List organization members",
+  "POST /organizations/:id/invitations/:invitationId/resend": "Resend a pending team invitation and rotate its token",
   "GET /projects": "List projects",
   "POST /projects": "Create project",
   "GET /tasks": "List tasks",

package/dist/index.js

@@ -588,12 +588,10 @@ var appLogger = new Logger("app");
 var APPLICATION_CONTEXT_KEY = Symbol.for("@getstrata/applicationContext");
 var activeContext;
 function readStoredApplicationContext() {
-  if (activeContext) {
-    return activeContext;
-  }
   const globalContext = globalThis[APPLICATION_CONTEXT_KEY];
   if (globalContext) {
     activeContext = globalContext;
+    return activeContext;
   }
   return activeContext;
 }
@@ -1532,7 +1530,17 @@ class EventBus {
     }
   }
 }
-var eventBus = new EventBus;
+var EVENT_BUS_KEY = Symbol.for("@getstrata/eventBus");
+function readSharedEventBus() {
+  const globalBus = globalThis[EVENT_BUS_KEY];
+  if (globalBus) {
+    return globalBus;
+  }
+  const bus = new EventBus;
+  globalThis[EVENT_BUS_KEY] = bus;
+  return bus;
+}
+var eventBus = readSharedEventBus();
 
 // ../../src/core/events/index.ts
 function modelEventName(tableName, action) {

package/dist/modules/webhook/dispatchWebhookJob.d.ts

@@ -4,6 +4,8 @@ interface DispatchWebhookPayload {
     tenantId: number;
     event: string;
     payload: Record<string, unknown>;
+    url?: string;
+    secret?: string;
 }
 declare class DispatchWebhookJob extends Job<DispatchWebhookPayload> {
     readonly maxAttempts = 3;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "0.5.83",
+  "version": "0.5.86",
   "description": "Strata — Laravel-inspired Bun framework public API",
   "type": "module",
   "license": "MIT",