@getstrata/bootstrap 0.2.6 → 0.2.7

package/dist/framework/public-api.d.ts

@@ -8,10 +8,17 @@ export { ConfigStore, resolveService, ServiceContainer, } from "../bootstrap/con
 export type { AdminColumn, AdminColumnType, AdminResource, AdminResourceDefinition, AdminResourceHandlers, } from "../core/admin/index.ts";
 export { AdminResourceRegistry, formatAdminValue, } from "../core/admin/index.ts";
 export type { AbilityChecker } from "../core/auth/abilityChecker.ts";
+export { isGlobalAdmin, resolveUserId } from "../core/auth/accessControl.ts";
 export type { AuthUser } from "../core/auth/authContext.ts";
-export { currentAuthUser, runWithAuthUser } from "../core/auth/authContext.ts";
+export { authContext, currentAuthUser, runWithAuthUser } from "../core/auth/authContext.ts";
+export type { AuthGuard } from "../core/auth/guard.ts";
+export { ApiTokenGuard, AuthManager, CompositeGuard, DatabaseTokenGuard, GuestGuard, } from "../core/auth/guard.ts";
+export { currentOrganizationIds, currentOrgRole, hasMinimumOrgRole, hasOrgMembership, } from "../core/auth/membershipContext.ts";
 export { createMembershipMiddleware } from "../core/auth/membershipMiddleware.ts";
+export { appendOrganizationScope, appendProjectScope, assertOrganizationReadable, assertResourceInCurrentTenant, emptyPaginateResult, resolveOrganizationScope, scopedOrganizationIds, } from "../core/auth/membershipScope.ts";
+export { default as MembershipService, resolveMembershipService, } from "../core/auth/membershipService.ts";
 export { Policy, PolicyGate } from "../core/auth/policy.ts";
+export { createScimAuthMiddleware } from "../core/auth/scimAuthMiddleware.ts";
 export { default as CacheRepository } from "../core/cache/repository.ts";
 export { CACHE_TAGS } from "../core/cache/tags.ts";
 export type { DatabaseConnection } from "../core/database/baseRepository.ts";
@@ -19,13 +26,16 @@ export { default as BaseRepository } from "../core/database/baseRepository.ts";
 export { bindDatabaseConnection } from "../core/database/bindConnection.ts";
 export { createDatabaseConnection } from "../core/database/connection.ts";
 export { getActiveDatabaseConnection, runWithDatabaseConnection, } from "../core/database/connectionContext.ts";
+export { getDefaultDatabasePool, getDefaultDatabaseQuery, registerDefaultDatabasePool, } from "../core/database/defaultConnection.ts";
 export { withMigrationLock } from "../core/database/migrations/advisoryLock.ts";
 export { freshDatabase, getMigrationStatus, loadMigrationsFromDirectory, migrateDatabase, rollbackDatabase, } from "../core/database/migrations/runner.ts";
 export type { Migration, MigrationDatabase, MigrationStatus, } from "../core/database/migrations/types.ts";
 export type { CastType, GlobalScopeFn, ModelConstructor } from "../core/database/model.ts";
 export { applyCasts, dehydrateValue, filterMassAssignable, hydrateValue, Model, registerModelRepository, } from "../core/database/model.ts";
+export { createDatabaseQueryProxy } from "../core/database/queryProxy.ts";
 export type { BelongsToManyRelation, BelongsToRelation, HasManyRelation, HasOneRelation, MorphManyRelation, MorphOneRelation, MorphToRelation, } from "../core/database/relationships.ts";
 export { belongsTo, belongsToMany, hasMany, hasOne, indexBelongsToManyRelation, indexBelongsToRelation, indexHasManyRelation, indexHasOneRelation, indexMorphManyRelation, indexMorphOneRelation, indexMorphToRelation, morphMany, morphOne, morphTo, } from "../core/database/relationships.ts";
+export { repositoryConnection, resolveRepositoryConnection, } from "../core/database/repositoryConnection.ts";
 export { RepositoryQuery } from "../core/database/repositoryQuery.ts";
 export type { BlueprintAction, BlueprintCallback, ColumnKind, DatabaseDriver, ForeignKeyOptions, Grammar, IndexDefinition, IndexKind, ResolveDatabaseDriverOptions, SchemaBuilder, } from "../core/database/schema/index.ts";
 export { Blueprint, ColumnDefinition, compileBlueprint, createSchemaBuilder, ForeignIdColumnDefinition, grammarForDriver, inferReferencedTable, MySqlGrammar, PostgresGrammar, resolveDatabaseDriver, Schema, SqliteGrammar, UnsupportedSchemaFeatureError, } from "../core/database/schema/index.ts";
@@ -40,24 +50,29 @@ export { BadRequestError, ConflictError, ForbiddenError, NotFoundError, Precondi
 export { EventBus } from "../core/events/eventBus.ts";
 export { auth, cache, config, events, log, mail, policyGate, queue, storage, } from "../core/facades/index.ts";
 export { createBodySizeLimitMiddleware } from "../core/http/bodySizeLimitMiddleware.ts";
+export { conditionalJsonResponse } from "../core/http/conditionalResponse.ts";
 export { readBunRequestCookie, readRequestCookie } from "../core/http/cookies.ts";
 export { createCorsMiddleware } from "../core/http/corsMiddleware.ts";
 export { createCsrfMiddleware } from "../core/http/csrfMiddleware.ts";
 export { createCsrfProtection } from "../core/http/csrfProtection.ts";
 export { createCsrfTokenCookie, readSubmittedCsrfToken, readSubmittedCsrfTokenFromBody, resolveCsrfToken, resolveCsrfTokenForRequest, verifyCsrfToken, } from "../core/http/csrfToken.ts";
-export { assertIfMatch, etagFromResource, isEtagEnabled, } from "../core/http/etag.ts";
+export { applyConditionalGet, assertIfMatch, type EtagVersioned, etagFromResource, isEtagEnabled, } from "../core/http/etag.ts";
 export { createFlashMiddleware } from "../core/http/flashMiddleware.ts";
 export { FormRequest } from "../core/http/formRequest.ts";
-export { applyMiddlewareToRoutes, composeMiddleware, createAuthMiddleware, createAuthorizeMiddleware, createdResponse, createRequireAuthMiddleware, jsonResponse, noContentResponse, paginatedResponse, parsePaginationQuery, requestIdMiddleware, securedBindRouteModel, securedBindRouteModelByKey, withErrorHandling, withMiddleware, } from "../core/http/index.ts";
+export { applyMiddlewareToRoutes, bindRouteModel, buildRequestCacheKey, composeMiddleware, createAuthMiddleware, createAuthorizeMiddleware, createdResponse, createRequireAuthMiddleware, jsonResponse, noContentResponse, paginatedResponse, parsePaginationQuery, parsePositiveIntParam, requestIdMiddleware, securedBindRouteModel, securedBindRouteModelByKey, withErrorHandling, withMiddleware, wrapRouteHandler, } from "../core/http/index.ts";
 export { createLoginThrottleMiddleware } from "../core/http/loginThrottleMiddleware.ts";
 export { createMemoryThrottleMiddleware } from "../core/http/memoryThrottleMiddleware.ts";
 export { createMetricsMiddleware, normalizeMetricPath } from "../core/http/metricsMiddleware.ts";
 export type { Middleware, RouteHandler } from "../core/http/middleware.ts";
+export { type ParsedUpload, parseMultipartUpload } from "../core/http/parseMultipartUpload.ts";
+export type { RequestMeta } from "../core/http/requestMetaContext.ts";
+export { currentRequestMeta, runWithRequestMeta } from "../core/http/requestMetaContext.ts";
 export { createRequireAbilityMiddleware } from "../core/http/requireAbilityMiddleware.ts";
 export { createRequireGlobalAdminMiddleware } from "../core/http/requireGlobalAdminMiddleware.ts";
 export { createRequireWebAuthMiddleware } from "../core/http/requireWebAuthMiddleware.ts";
 export { serializeDate, toPaginatedResourceCollection, toResourceCollection, } from "../core/http/resources.ts";
 export type { RouteRequest } from "../core/http/route.ts";
+export { createScimThrottleMiddleware } from "../core/http/scimThrottleMiddleware.ts";
 export { createSecurityHeadersMiddleware } from "../core/http/securityHeadersMiddleware.ts";
 export { createThrottleMiddleware } from "../core/http/throttleMiddleware.ts";
 export { WebFormRequest } from "../core/http/webFormRequest.ts";
@@ -77,12 +92,20 @@ export type { CursorPaginatedResult, PaginatedResult, PaginationMeta, } from "..
 export type { Queue, QueuePriority } from "../core/queue/index.ts";
 export { AsyncQueue, createQueue, Job, SyncQueue } from "../core/queue/index.ts";
 export { createFailedJobService, createProductionQueue, createQueueWorker, createTrackedJob, FailedJobRepository, FailedJobService, jobRegistry, QueueWorker, RedisQueue, ResilientQueue, runQueueJob, } from "../core/queue/publicQueue.ts";
+export type { QueueMetricsSnapshot } from "../core/queue/queueMetrics.ts";
+export { collectQueueMetrics } from "../core/queue/queueMetrics.ts";
 export type { ScheduledTask } from "../core/scheduler/schedule.ts";
 export { appSchedule, runDueScheduledTasks, Schedule } from "../core/scheduler/schedule.ts";
-export { isPublicReadsEnabled } from "../core/security/publicReads.ts";
+export { guestCanViewResource, isPublicReadsEnabled } from "../core/security/publicReads.ts";
+export type { SecurityEventDetails } from "../core/security/securityEvents.ts";
+export { logSecurityEvent } from "../core/security/securityEvents.ts";
 export type { StorageDriver } from "../core/storage/storage.ts";
-export { LocalStorageDriver, resetDefaultStorage, StorageManager, } from "../core/storage/storage.ts";
-export { createTenantMiddleware } from "../core/tenant/tenantMiddleware.ts";
+export { createStorageDriver, LocalStorageDriver, resetDefaultStorage, StorageManager, } from "../core/storage/storage.ts";
+export { currentTenant, currentTenantId, runWithTenant } from "../core/tenant/tenantContext.ts";
+export { isInsideTenantDatabaseScope, runWithTenantDatabase, } from "../core/tenant/tenantDatabaseScope.ts";
+export { auditChecksum, createTenantMiddleware, DEFAULT_TENANT, resolveUserTenantId, } from "../core/tenant/tenantMiddleware.ts";
+export type { TraceContext } from "../core/tracing/traceContext.ts";
+export { currentTraceId, runWithTraceContext } from "../core/tracing/traceContext.ts";
 export { createTracingMiddleware } from "../core/tracing/tracingMiddleware.ts";
 export type { ValidationRule, ValidationSchema } from "../core/validation/rules.ts";
 export { emailRule, maxLength, minLength, required, stringRule, validateObject, } from "../core/validation/rules.ts";

package/dist/index.js

@@ -65,18 +65,13 @@ var appConfig = {
   apiPrefix: process.env.API_PREFIX ?? "/api/v1"
 };
 
-// ../../src/config/database.ts
-function readInteger(name, fallback) {
-  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
-  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
-}
-var databaseConfig = {
-  url: process.env.DATABASE_URL ?? "",
-  poolMax: readInteger("DB_POOL_MAX", 10),
-  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
-  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
-  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
+// ../../src/core/database/boundConnection.ts
+var boundConnectionHolder = {
+  connection: null
 };
+function getBoundDatabaseConnection() {
+  return boundConnectionHolder.connection;
+}
 
 // ../../src/core/database/connectionContext.ts
 import { AsyncLocalStorage } from "async_hooks";
@@ -85,84 +80,65 @@ function getActiveDatabaseConnection(fallback) {
   return activeConnection.getStore() ?? fallback;
 }
 
-// ../../src/db/connection/createConnection.ts
-var {SQL } = globalThis.Bun;
-function createDatabaseConnection(config) {
-  if (!config.url) {
-    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
+// ../../src/core/database/queryProxy.ts
+var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+function createDatabaseQueryProxy(pool) {
+  function resolveDatabase() {
+    return getActiveDatabaseConnection(pool);
   }
-  return new SQL({
-    url: config.url,
-    max: config.poolMax,
-    idleTimeout: config.idleTimeoutSeconds,
-    maxLifetime: config.maxLifetimeSeconds,
-    connectionTimeout: config.connectionTimeoutSeconds
+  function resolveDatabaseForProperty(property) {
+    if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
+      return pool;
+    }
+    return resolveDatabase();
+  }
+  return new Proxy(function database() {}, {
+    apply(_target, _thisArg, args) {
+      return resolveDatabase()(...args);
+    },
+    get(_target, property) {
+      const connection = resolveDatabaseForProperty(property);
+      const value = connection[property];
+      return typeof value === "function" ? value.bind(connection) : value;
+    }
   });
 }
 
-// ../../src/db/connection/index.ts
-var connectionHolder = {
+// ../../src/core/database/defaultConnection.ts
+var defaultPool = {
   connection: null
 };
-function getDatabase() {
-  if (!connectionHolder.connection) {
-    connectionHolder.connection = createDatabaseConnection(databaseConfig);
-  }
-  return connectionHolder.connection;
-}
-var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
-function resolveDatabase() {
-  return getActiveDatabaseConnection(getDatabase());
+var defaultQuery = {
+  connection: null
+};
+function registerDefaultDatabasePool(connection) {
+  defaultPool.connection = connection;
+  defaultQuery.connection = createDatabaseQueryProxy(connection);
 }
-function resolveDatabaseForProperty(property) {
-  if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
-    return getDatabase();
+function getDefaultDatabaseQuery() {
+  if (!defaultQuery.connection) {
+    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
   }
-  return resolveDatabase();
+  return defaultQuery.connection;
 }
-var db = new Proxy(function database() {}, {
+
+// ../../src/core/database/repositoryConnection.ts
+function resolveRepositoryConnection() {
+  return getBoundDatabaseConnection() ?? getDefaultDatabaseQuery();
+}
+var repositoryConnection = new Proxy(function repositoryConnection2() {}, {
   apply(_target, _thisArg, args) {
-    return resolveDatabase()(...args);
+    return resolveRepositoryConnection()(...args);
   },
   get(_target, property) {
-    const connection = resolveDatabaseForProperty(property);
+    const connection = resolveRepositoryConnection();
     const value = connection[property];
     return typeof value === "function" ? value.bind(connection) : value;
   }
 });
-var connection_default = db;
 
-// ../../src/core/security/safeFetch.ts
-var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
-async function safeFetch(input, init = {}, options = {}) {
-  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
-  const maxRedirects = options.maxRedirects ?? 0;
-  const controller = new AbortController;
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    let currentUrl = input;
-    let redirectCount = 0;
-    while (true) {
-      const response = await fetch(currentUrl, {
-        ...init,
-        signal: controller.signal,
-        redirect: "manual"
-      });
-      if (response.status >= 300 && response.status < 400) {
-        const location = response.headers.get("location");
-        if (!location || redirectCount >= maxRedirects) {
-          return response;
-        }
-        currentUrl = new URL(location, currentUrl).toString();
-        redirectCount += 1;
-        continue;
-      }
-      return response;
-    }
-  } finally {
-    clearTimeout(timeout);
-  }
-}
+// ../../src/core/security/safeUrl.ts
+import { lookup as dnsLookupImpl } from "dns/promises";
 
 // ../../src/core/errors/http.ts
 class HttpError extends Error {
@@ -205,6 +181,7 @@ class UnauthorizedError extends HttpError {
 }
 
 // ../../src/core/security/safeUrl.ts
+var dnsLookup = dnsLookupImpl;
 var BLOCKED_HOSTNAMES = new Set([
   "localhost",
   "127.0.0.1",
@@ -276,14 +253,63 @@ function assertSafeOutboundUrl(rawUrl, options = {}) {
   }
   return parsed;
 }
+function isBlockedIpAddress(address) {
+  return isBlockedHostname(address.trim().toLowerCase());
+}
+async function assertSafeOutboundUrlResolved(rawUrl, options = {}) {
+  const parsed = assertSafeOutboundUrl(rawUrl, options);
+  if (options.resolveDns === false) {
+    return parsed;
+  }
+  const hostname = parsed.hostname.trim().toLowerCase();
+  const results = await dnsLookup(hostname, { all: true, verbatim: true });
+  if (results.some((result) => isBlockedIpAddress(result.address))) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  return parsed;
+}
+
+// ../../src/core/security/safeFetch.ts
+var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
+async function safeFetch(input, init = {}, options = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const maxRedirects = options.maxRedirects ?? 0;
+  const resolveDns = options.resolveDns ?? appConfig.env === "production";
+  const urlOptions = { allowHttp: options.allowHttp, resolveDns };
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    let currentUrl = (await assertSafeOutboundUrlResolved(input, urlOptions)).toString();
+    let redirectCount = 0;
+    while (true) {
+      const response = await fetch(currentUrl, {
+        ...init,
+        signal: controller.signal,
+        redirect: "manual"
+      });
+      if (response.status >= 300 && response.status < 400) {
+        const location = response.headers.get("location");
+        if (!location || redirectCount >= maxRedirects) {
+          return response;
+        }
+        currentUrl = (await assertSafeOutboundUrlResolved(new URL(location, currentUrl).toString(), urlOptions)).toString();
+        redirectCount += 1;
+        continue;
+      }
+      return response;
+    }
+  } finally {
+    clearTimeout(timeout);
+  }
+}
 
 // ../../src/core/tenant/databaseTenantContext.ts
 async function runWithMigrationBypass(callback) {
-  await connection_default`SELECT set_config('app.bypass_rls', 'true', false)`;
+  await repositoryConnection`SELECT set_config('app.bypass_rls', 'true', false)`;
   try {
     return await callback();
   } finally {
-    await connection_default`SELECT set_config('app.bypass_rls', 'false', false)`;
+    await repositoryConnection`SELECT set_config('app.bypass_rls', 'false', false)`;
   }
 }
 
@@ -340,7 +366,7 @@ async function exportPendingAuditLogs() {
     return 0;
   }
   return await runWithMigrationBypass(async () => {
-    const rows = await connection_default`
+    const rows = await repositoryConnection`
       SELECT
         id,
         user_id,
@@ -384,13 +410,13 @@ async function exportPendingAuditLogs() {
         ...process.env.SIEM_EXPORT_TOKEN ? { authorization: `Bearer ${process.env.SIEM_EXPORT_TOKEN}` } : {}
       },
       body
-    });
+    }, { allowHttp: appConfig.env !== "production" });
     if (!response.ok) {
       throw new Error(`SIEM export failed with status ${response.status}.`);
     }
     const ids = rows.map((row) => row.id);
     for (const id of ids) {
-      await connection_default`UPDATE audit_log SET exported_at = NOW() WHERE id = ${id}`;
+      await repositoryConnection`UPDATE audit_log SET exported_at = NOW() WHERE id = ${id}`;
     }
     return rows.length;
   });
@@ -550,7 +576,8 @@ class ConfigStore {
 }
 var requiredDependencyKeys = [
   "container",
-  "cache"
+  "cache",
+  "storage"
 ];
 function getRequiredDependency(dependencies, key) {
   const dependency = dependencies[key];
@@ -643,6 +670,60 @@ import { SamlProvider } from "@getstrata/core/auth/oauth/samlProvider";
 // ../../src/modules/user/apiTokenRepository.ts
 import { BaseRepository } from "@getstrata/core/database";
 
+// ../../src/config/database.ts
+function readInteger(name, fallback) {
+  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
+  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
+}
+var databaseConfig = {
+  url: process.env.DATABASE_URL ?? "",
+  poolMax: readInteger("DB_POOL_MAX", 10),
+  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
+  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
+  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
+};
+
+// ../../src/db/connection/createConnection.ts
+var {SQL } = globalThis.Bun;
+function createDatabaseConnection(config) {
+  if (!config.url) {
+    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
+  }
+  return new SQL({
+    url: config.url,
+    max: config.poolMax,
+    idleTimeout: config.idleTimeoutSeconds,
+    maxLifetime: config.maxLifetimeSeconds,
+    connectionTimeout: config.connectionTimeoutSeconds
+  });
+}
+
+// ../../src/db/connection/index.ts
+var connectionHolder = {
+  connection: null
+};
+function getDatabase() {
+  if (!connectionHolder.connection) {
+    connectionHolder.connection = createDatabaseConnection(databaseConfig);
+    registerDefaultDatabasePool(connectionHolder.connection);
+  }
+  return connectionHolder.connection;
+}
+function getDb() {
+  getDatabase();
+  return getDefaultDatabaseQuery();
+}
+var db = new Proxy(function database() {}, {
+  apply(_target, _thisArg, args) {
+    return getDb()(...args);
+  },
+  get(_target, property) {
+    const connection = getDb();
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
+  }
+});
+
 // ../../src/modules/user/apiTokenTable.ts
 import { defineTable } from "@getstrata/core/database";
 var apiTokenTable = defineTable({
@@ -1741,13 +1822,10 @@ function resolveApplicationQueue() {
 // ../../src/core/jobs/dispatchWebhookJob.ts
 import { createHmac as createHmac2 } from "crypto";
 class DispatchWebhookJob extends Job {
-  constructor() {
-    super();
-  }
   maxAttempts = 3;
   backoffMs = 2000;
   async handle(payload) {
-    const rows = await connection_default`
+    const rows = await repositoryConnection`
       SELECT id, url, secret
       FROM webhook
       WHERE id = ${payload.webhookId} AND active = TRUE
@@ -1770,14 +1848,14 @@ class DispatchWebhookJob extends Job {
           "x-workhub-signature": signature
         },
         body
-      });
+      }, { allowHttp: appConfig.env !== "production" });
       responseStatus = response.status;
       if (!response.ok) {
         throw new Error(`Webhook delivery failed with status ${response.status}.`);
       }
     } catch (error) {
       errorMessage = error instanceof Error ? error.message : String(error);
-      await connection_default`
+      await repositoryConnection`
         INSERT INTO webhook_delivery (webhook_id, event, payload, response_status, error)
         VALUES (
           ${webhook.id},
@@ -1789,7 +1867,7 @@ class DispatchWebhookJob extends Job {
       `;
       throw error instanceof Error ? error : new Error(errorMessage);
     }
-    await connection_default`
+    await repositoryConnection`
       INSERT INTO webhook_delivery (webhook_id, event, payload, response_status)
       VALUES (
         ${webhook.id},
@@ -2369,26 +2447,6 @@ function indexMorphToRelation(children, parentsByType, relation) {
   return result;
 }
 
-// ../../src/core/database/boundConnection.ts
-var boundConnectionHolder = {
-  connection: null
-};
-function getBoundDatabaseConnection() {
-  return boundConnectionHolder.connection;
-}
-
-// ../../src/core/database/repositoryConnection.ts
-function resolveRepositoryConnection() {
-  return getBoundDatabaseConnection() ?? connection_default;
-}
-var repositoryConnection = new Proxy({}, {
-  get(_target, property) {
-    const connection = resolveRepositoryConnection();
-    const value = connection[property];
-    return typeof value === "function" ? value.bind(connection) : value;
-  }
-});
-
 // ../../src/core/database/whereBuilder.ts
 class WhereBuilder {
   nodes = [];
@@ -3816,6 +3874,128 @@ var queueProvider = {
 };
 var queue_default = queueProvider;
 
+// ../../src/core/storage/storage.ts
+import { mkdir, readFile, unlink, writeFile } from "fs/promises";
+import { dirname, join as join3 } from "path";
+var {S3Client } = globalThis.Bun;
+
+class LocalStorageDriver {
+  rootDirectory;
+  constructor(rootDirectory) {
+    this.rootDirectory = rootDirectory;
+  }
+  resolveRootDirectory() {
+    return this.rootDirectory ?? process.env.STORAGE_PATH ?? "storage";
+  }
+  resolvePath(path) {
+    return join3(this.resolveRootDirectory(), path.replace(/^\/+/, ""));
+  }
+  async put(path, contents) {
+    const absolutePath = this.resolvePath(path);
+    await mkdir(dirname(absolutePath), { recursive: true });
+    await writeFile(absolutePath, contents);
+    return path;
+  }
+  async get(path) {
+    try {
+      return await readFile(this.resolvePath(path));
+    } catch {
+      return null;
+    }
+  }
+  async delete(path) {
+    try {
+      await unlink(this.resolvePath(path));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}
+
+class S3StorageDriver {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async put(path, contents) {
+    await this.client.write(path.replace(/^\/+/, ""), contents);
+    return path;
+  }
+  async get(path) {
+    const normalizedPath = path.replace(/^\/+/, "");
+    const file = this.client.file(normalizedPath);
+    if (!await file.exists()) {
+      return null;
+    }
+    return new Uint8Array(await file.arrayBuffer());
+  }
+  async delete(path) {
+    try {
+      await this.client.unlink(path.replace(/^\/+/, ""));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}
+
+class StorageManager {
+  driver;
+  constructor(driver) {
+    this.driver = driver;
+  }
+  put(path, contents) {
+    return this.driver.put(path, contents);
+  }
+  get(path) {
+    return this.driver.get(path);
+  }
+  delete(path) {
+    return this.driver.delete(path);
+  }
+}
+function resolveS3Config() {
+  const accessKeyId = process.env.AWS_ACCESS_KEY_ID?.trim();
+  const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY?.trim();
+  const bucket = process.env.AWS_BUCKET?.trim();
+  if (!accessKeyId || !secretAccessKey || !bucket) {
+    throw new Error('STORAGE_DRIVER="s3" requires AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_BUCKET.');
+  }
+  return {
+    accessKeyId,
+    secretAccessKey,
+    bucket,
+    ...process.env.AWS_REGION?.trim() ? { region: process.env.AWS_REGION.trim() } : {},
+    ...process.env.AWS_ENDPOINT?.trim() ? { endpoint: process.env.AWS_ENDPOINT.trim() } : {}
+  };
+}
+function createS3Client(config = resolveS3Config()) {
+  return new S3Client({
+    accessKeyId: config.accessKeyId,
+    secretAccessKey: config.secretAccessKey,
+    bucket: config.bucket,
+    ...config.region ? { region: config.region } : {},
+    ...config.endpoint ? { endpoint: config.endpoint } : {}
+  });
+}
+function createStorageDriver() {
+  const driver = process.env.STORAGE_DRIVER ?? "local";
+  if (driver === "s3") {
+    return new S3StorageDriver(createS3Client());
+  }
+  return new LocalStorageDriver;
+}
+
+// ../../src/bootstrap/providers/storage.ts
+var storageProvider = {
+  name: "core.storage",
+  register({ dependencies }) {
+    dependencies.storage = new StorageManager(createStorageDriver());
+  }
+};
+var storage_default = storageProvider;
+
 // ../../src/config/frontend.ts
 function readFrontendMode() {
   const mode = (process.env.FRONTEND_MODE ?? "api").trim();
@@ -3842,9 +4022,9 @@ function currentRequestMeta() {
 }
 
 // ../../src/core/view/etaViewEngine.ts
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 import { Eta } from "eta";
-var DEFAULT_VIEWS_DIRECTORY = join3(process.cwd(), "resources/views");
+var DEFAULT_VIEWS_DIRECTORY = join4(process.cwd(), "resources/views");
 var DEFAULT_LAYOUT = "layouts/app.eta";
 
 class EtaViewEngine {
@@ -4069,6 +4249,7 @@ var viewProvider = {
 var coreProviders = [
   config_default,
   cache_default,
+  storage_default,
   auth_default,
   events_default,
   policy_default,
@@ -4169,7 +4350,7 @@ function createAppContext() {
   return appContext;
 }
 // ../../src/bootstrap/createWebRoutes.ts
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 
 // ../../src/core/http/middleware.ts
 function isRouteHandler(value) {
@@ -4503,7 +4684,7 @@ function createWebRoutes(dependencies) {
     registerRoute("GET", "/assets/*", ["global", "web"]);
     const pathname = new URL(request.url).pathname;
     const relativePath = pathname.replace(/^\//, "");
-    const file = Bun.file(join4(process.cwd(), "public", relativePath));
+    const file = Bun.file(join5(process.cwd(), "public", relativePath));
     if (!await file.exists()) {
       return htmlResponse("Not Found", { status: 404 });
     }

package/dist/modules/organization/repository.d.ts

@@ -0,0 +1,14 @@
+import { BaseRepository } from "@getstrata/core/database";
+import type { OrganizationRecord } from "./types";
+declare class OrganizationRepository extends BaseRepository<OrganizationRecord, "id"> {
+    constructor();
+    findBySlug(slug: string): Promise<OrganizationRecord | null>;
+    listForTenant(options: {
+        limit: number;
+        offset: number;
+        tenantId?: number;
+    }): Promise<OrganizationRecord[]>;
+    countForTenant(tenantId?: number): Promise<number>;
+    findForTenantOrThrow(id: number, tenantId?: number): Promise<OrganizationRecord>;
+}
+export default OrganizationRepository;

package/dist/modules/organization/table.d.ts

@@ -0,0 +1,3 @@
+import type { OrganizationRecord } from "./types";
+declare const organizationTable: import("@getstrata/core/database").TableDefinition<OrganizationRecord, "id">;
+export { organizationTable };

package/dist/modules/organization/types.d.ts

@@ -0,0 +1,10 @@
+interface OrganizationRecord {
+    id: number;
+    tenant_id: number;
+    name: string;
+    slug: string;
+    created_at: Date;
+    updated_at: Date;
+    deleted_at: Date | null;
+}
+export type { OrganizationRecord };