@getstrata/core 0.5.55 → 0.5.57

package/README.md

@@ -26,6 +26,8 @@ import { storage } from "@getstrata/core/facades";
 import { EtaViewEngine } from "@getstrata/core/view";
 ```
 
+`.eta` files are **HTML + Eta tags** (`<% %>`, `<%= %>`, `<%~ include() %>`), not Pug. Class/attribute shorthand such as `section.section` or `a href=` fails at render time with the template name.
+
 **Dependency:** `eta` is bundled as a direct dependency of `@getstrata/core`. Apps do not need to list it separately. The database driver is your app's choice. WorkHub and getstrata use **Bun's built-in `Bun.sql`** client; bind it with `bindDatabaseConnection()`.
 
 `orderBy` accepts explicit `{ column, direction }` objects or column shorthand such as `{ published_at: "desc" }`.
@@ -80,7 +82,7 @@ import type { Migration } from "@getstrata/core/database/migrations/types";
 Package name: **`@getstrata/core`** (npm org [`@getstrata`](https://www.npmjs.com/org/getstrata)).
 
 1. Add `NPM_TOKEN` to GitHub repository secrets.
-2. Tag a release: `git tag v0.5.13 && git push origin v0.5.13`
+2. Tag a release: `git tag v0.5.57 && git push origin v0.5.57`
 3. [Release workflow](../../.github/workflows/release.yml) builds and runs `npm publish --access public`.
 
 Previously published as `@eyk-workhub/framework@0.1.0`, deprecated in favor of this package.

package/dist/{domain/abilities.d.ts → core/auth/abilityCatalog.d.ts}

@@ -1,5 +1,13 @@
 declare const MEMBER_ABILITIES: readonly ["organizations:read", "projects:read", "projects:create", "tasks:read", "tasks:create", "comments:read", "comments:create", "attachments:read", "attachments:create", "auth:tokens:read", "auth:tokens:write"];
 declare const ADMIN_ABILITIES: readonly ["organizations:read", "projects:read", "projects:create", "tasks:read", "tasks:create", "comments:read", "comments:create", "attachments:read", "attachments:create", "auth:tokens:read", "auth:tokens:write", "organizations:create", "organizations:update", "organizations:delete", "projects:update", "projects:delete", "tasks:update", "tasks:delete", "comments:update", "comments:delete", "attachments:delete", "webhooks:read", "webhooks:write", "audit:read"];
 declare const PLATFORM_ADMIN_ABILITIES: readonly ["*"];
+interface AbilityCatalog {
+    member: readonly string[];
+    admin: readonly string[];
+    resolveForRole(role: string | null | undefined): string[];
+}
 declare function resolveAbilitiesForRole(role: string | null | undefined): string[];
-export { ADMIN_ABILITIES, MEMBER_ABILITIES, PLATFORM_ADMIN_ABILITIES, resolveAbilitiesForRole };
+declare function configureAbilityCatalog(next: AbilityCatalog): void;
+declare function abilityCatalog(): AbilityCatalog;
+export type { AbilityCatalog };
+export { ADMIN_ABILITIES, abilityCatalog, configureAbilityCatalog, MEMBER_ABILITIES, PLATFORM_ADMIN_ABILITIES, resolveAbilitiesForRole, };

package/dist/core/auth/accessControl.d.ts

@@ -1,4 +1,4 @@
-import type { OrganizationMemberRole } from "../../modules/organization/memberTypes";
+import type { OrganizationMemberRole } from "../contracts/membership";
 import { type AuthUser } from "./authContext";
 declare const ROLE_RANK: Record<OrganizationMemberRole, number>;
 declare function isGlobalAdmin(user: AuthUser | null): boolean;

package/dist/core/auth/membershipContext.d.ts

@@ -1,15 +1,17 @@
-import OrganizationMemberRepository from "../../modules/organization/memberRepository";
-import type { OrganizationMemberRole } from "../../modules/organization/memberTypes";
+import type { MembershipLookup, OrganizationMemberRole } from "../contracts/membership";
 type MembershipContext = {
     organizationIds: number[];
     rolesByOrganizationId: Map<number, OrganizationMemberRole>;
 };
 declare const membershipContext: import("node:async_hooks").AsyncLocalStorage<MembershipContext>;
-declare const membershipRepository: OrganizationMemberRepository;
+declare let membershipRepository: MembershipLookup;
+declare function configureMembershipLookup(lookup: MembershipLookup): void;
+declare function resolveMembershipLookup(): MembershipLookup;
+declare function resetMembershipLookupForTests(): void;
 declare function runWithMembershipContext<T>(callback: () => T | Promise<T>): Promise<T | Promise<T>>;
 declare function currentOrgRole(organizationId: number): OrganizationMemberRole | null;
 declare function hasOrgMembership(organizationId: number): boolean;
 declare function currentOrganizationIds(): number[];
 declare function hasMinimumOrgRole(organizationId: number, minimum: OrganizationMemberRole): boolean;
 export type { MembershipContext };
-export { currentOrganizationIds, currentOrgRole, hasMinimumOrgRole, hasOrgMembership, membershipContext, membershipRepository, runWithMembershipContext, };
+export { configureMembershipLookup, currentOrganizationIds, currentOrgRole, hasMinimumOrgRole, hasOrgMembership, membershipContext, membershipRepository, resetMembershipLookupForTests, resolveMembershipLookup, runWithMembershipContext, };

package/dist/core/auth/membershipService.d.ts

@@ -1,7 +1,6 @@
-import type { OrganizationMemberRole } from "../../modules/organization/memberTypes";
+import type { MembershipLookup, OrganizationMemberRole } from "../contracts/membership";
 import { type AuthUser } from "./authContext";
-import { membershipRepository as defaultMembershipRepository } from "./membershipContext";
-type MembershipRepositoryLike = Pick<typeof defaultMembershipRepository, "listForUser" | "findMembership" | "listForOrganization" | "addMember" | "removeMember">;
+type MembershipRepositoryLike = MembershipLookup;
 declare class MembershipService {
     private readonly members;
     constructor(members?: MembershipRepositoryLike);
@@ -10,13 +9,13 @@ declare class MembershipService {
     requireOrgAccess(organizationId: number, minimumRole?: OrganizationMemberRole, user?: AuthUser | null): Promise<OrganizationMemberRole>;
     filterAccessibleOrganizationIds(organizationIds: number[], user?: AuthUser | null): Promise<number[]>;
     addOwnerOnOrganizationCreate(organizationId: number, userId: number): Promise<void>;
-    listMembersForOrganization(organizationId: number): Promise<import("../../modules/organization/memberTypes").OrganizationMemberRecord[]>;
+    listMembersForOrganization(organizationId: number): Promise<import("../contracts/membership").MembershipRecord[]>;
     addMember(input: {
         organizationId: number;
         userId: number;
         role?: OrganizationMemberRole;
-    }): Promise<import("../../modules/organization/memberTypes").OrganizationMemberRecord>;
-    removeMember(organizationId: number, userId: number): Promise<boolean>;
+    }): Promise<import("../contracts/membership").MembershipRecord>;
+    removeMember(organizationId: number, userId: number): Promise<unknown>;
 }
 export type { MembershipRepositoryLike };
 export default MembershipService;

package/dist/core/contracts/authUserDirectory.d.ts

@@ -0,0 +1,11 @@
+import type { AuthUser } from "../auth/authContext";
+interface AuthUserRecord {
+    id: number;
+    email?: string | null;
+    role: string;
+}
+interface AuthUserDirectory {
+    resolveUserFromToken(token: string): Promise<AuthUser | null>;
+    findByIdOrThrow(id: number): Promise<AuthUserRecord>;
+}
+export type { AuthUserDirectory, AuthUserRecord };

package/dist/core/contracts/membership.d.ts

@@ -0,0 +1,20 @@
+type OrganizationMemberRole = "owner" | "admin" | "member";
+interface MembershipRecord {
+    id: number;
+    organization_id: number;
+    user_id: number;
+    role: OrganizationMemberRole;
+    created_at: Date;
+}
+interface MembershipLookup {
+    listForUser(userId: number): Promise<MembershipRecord[]>;
+    findMembership(userId: number, organizationId: number): Promise<MembershipRecord | null>;
+    listForOrganization(organizationId: number): Promise<MembershipRecord[]>;
+    addMember(input: {
+        organizationId: number;
+        userId: number;
+        role?: OrganizationMemberRole;
+    }): Promise<MembershipRecord>;
+    removeMember(organizationId: number, userId: number): Promise<unknown>;
+}
+export type { MembershipLookup, MembershipRecord, OrganizationMemberRole };

package/dist/core/http/clientIp.d.ts

@@ -0,0 +1,3 @@
+declare function trustForwardedFor(env?: Record<string, string | undefined>): boolean;
+declare function readClientIp(request: Request, env?: Record<string, string | undefined>): string | undefined;
+export { readClientIp, trustForwardedFor };

package/dist/core/jobs/dispatchWebhookJob.d.ts

@@ -1,6 +1,7 @@
 import { Job } from "../queue";
 interface DispatchWebhookPayload {
     webhookId: number;
+    tenantId: number;
     event: string;
     payload: Record<string, unknown>;
 }
@@ -8,6 +9,7 @@ declare class DispatchWebhookJob extends Job<DispatchWebhookPayload> {
     readonly maxAttempts = 3;
     readonly backoffMs = 2000;
     handle(payload: DispatchWebhookPayload): Promise<void>;
+    private deliver;
 }
 export { DispatchWebhookJob };
 export default DispatchWebhookJob;

package/dist/core/media/imageTransform.d.ts

@@ -0,0 +1,13 @@
+declare const IMAGE_MIME_TYPES: Set<string>;
+declare function normalizeMimeType(mimeType: string): string;
+declare function isImageMimeType(mimeType: string): boolean;
+declare function parseThumbnailWidth(raw: string | null | undefined, options?: {
+    defaultWidth?: number;
+    minWidth?: number;
+    maxWidth?: number;
+}): number;
+declare function resizeImageContents(contents: Uint8Array, width: number, mimeType: string): Promise<{
+    body: Uint8Array;
+    contentType: string;
+}>;
+export { IMAGE_MIME_TYPES, isImageMimeType, normalizeMimeType, parseThumbnailWidth, resizeImageContents, };

package/dist/core/scheduler/osCron.d.ts

@@ -0,0 +1,14 @@
+declare const DEFAULT_SCHEDULE_RUN_EXPRESSION = "* * * * *";
+declare const OS_CRON_JOB_TITLE = "getstrata-schedule-run";
+interface InProcessCronJob {
+    readonly cron: string;
+    stop(): InProcessCronJob;
+    ref(): InProcessCronJob;
+    unref(): InProcessCronJob;
+}
+declare function parseScheduleExpression(expression: string, from?: Date): Date | null;
+declare function registerInProcessScheduleRunner(run: () => void | Promise<void>, expression?: string): InProcessCronJob;
+declare function installOsScheduleRunner(workerScriptPath: string, expression?: string, title?: string): Promise<void>;
+declare function uninstallOsScheduleRunner(title?: string): Promise<void>;
+export type { InProcessCronJob };
+export { DEFAULT_SCHEDULE_RUN_EXPRESSION, installOsScheduleRunner, OS_CRON_JOB_TITLE, parseScheduleExpression, registerInProcessScheduleRunner, uninstallOsScheduleRunner, };

package/dist/core/tenant/tenancyConfig.d.ts

@@ -0,0 +1,5 @@
+type TenancyDriver = "rls" | "none";
+declare function readTenancyDriver(env?: Record<string, string | undefined>): TenancyDriver;
+declare function isTenancyEnabled(env?: Record<string, string | undefined>): boolean;
+export type { TenancyDriver };
+export { isTenancyEnabled, readTenancyDriver };

package/dist/core/tenant/tenantMiddleware.d.ts

@@ -1,4 +1,4 @@
-import type { TenantContext } from "./tenantContext";
+import { type TenantContext } from "./tenantContext";
 declare const DEFAULT_TENANT: TenantContext;
 declare function resolveUserTenantId(userId: number): Promise<number>;
 declare function auditChecksum(payload: Record<string, unknown>): string;

package/dist/core/terminal/runShell.d.ts

@@ -0,0 +1,6 @@
+declare function runInteractiveShell(command: string[], options?: {
+    cwd?: string;
+    cols?: number;
+    rows?: number;
+}): Promise<number>;
+export { runInteractiveShell };

package/dist/core/view/assertEtaHtmlSource.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Throws when an .eta source still uses Pug shorthand instead of HTML + Eta tags.
+ */
+declare function assertEtaHtmlSource(templateName: string, source: string): void;
+export { assertEtaHtmlSource };

package/dist/core/view/etaViewEngine.d.ts

@@ -5,6 +5,10 @@ interface RenderOptions {
     layout?: string | false;
 }
 type LayoutDataResolver = () => Promise<Record<string, unknown>>;
+/**
+ * Renders `.eta` files as HTML + Eta tags (`<% %>`, `<%= %>`, `<%~ include() %>`).
+ * Pug class/attribute shorthand is rejected at render time.
+ */
 declare class EtaViewEngine implements ViewEngine {
     private readonly eta;
     private readonly resolveLayoutData?;

package/dist/entries/audit/exportAuditLogs.js

@@ -262,6 +262,6 @@ async function exportPendingAuditLogs() {
   });
 }
 export {
-  resolveAuditExportConfig,
-  exportPendingAuditLogs
+  exportPendingAuditLogs,
+  resolveAuditExportConfig
 };

package/dist/entries/audit/siemFormatter.js

@@ -32,6 +32,6 @@ function formatCefLine(event) {
   return `CEF:0|WorkHub|API|1.0|${event.action}|${event.subject_type}|5|${extension}`;
 }
 export {
-  formatSiemAuditEvent,
-  formatCefLine
+  formatCefLine,
+  formatSiemAuditEvent
 };

package/dist/entries/auth/accessControl.js

@@ -52,9 +52,9 @@ function resolveUserId(user) {
   return userId;
 }
 export {
-  resolveUserId,
-  requireAuthenticatedUser,
-  isGlobalAdmin,
+  ROLE_RANK,
   hasMinimumOrgRole,
-  ROLE_RANK
+  isGlobalAdmin,
+  requireAuthenticatedUser,
+  resolveUserId
 };

package/dist/entries/auth/membershipMiddleware.js

@@ -1,17 +1,4 @@
 // @bun
-// ../../src/config/database.ts
-function readInteger(name, fallback) {
-  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
-  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
-}
-var databaseConfig = {
-  url: process.env.DATABASE_URL ?? "",
-  poolMax: readInteger("DB_POOL_MAX", 10),
-  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
-  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
-  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
-};
-
 // ../../src/core/runtime/asyncContextStore.ts
 import { AsyncLocalStorage } from "async_hooks";
 function createAsyncContextStore(key) {
@@ -26,153 +13,6 @@ function createAsyncContextStore(key) {
   return store;
 }
 
-// ../../src/core/database/connectionContext.ts
-var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
-function runWithDatabaseConnection(connection, callback) {
-  return activeConnection.run(connection, callback);
-}
-function getActiveDatabaseConnection(fallback) {
-  return activeConnection.getStore() ?? fallback;
-}
-function hasActiveDatabaseConnection() {
-  return activeConnection.getStore() !== undefined;
-}
-
-// ../../src/core/database/queryProxy.ts
-var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
-function createDatabaseQueryProxy(pool) {
-  function resolveDatabase() {
-    return getActiveDatabaseConnection(pool);
-  }
-  function resolveDatabaseForProperty(property) {
-    if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
-      return pool;
-    }
-    return resolveDatabase();
-  }
-  return new Proxy(function database() {}, {
-    apply(_target, _thisArg, args) {
-      return resolveDatabase()(...args);
-    },
-    get(_target, property) {
-      const connection = resolveDatabaseForProperty(property);
-      const value = connection[property];
-      return typeof value === "function" ? value.bind(connection) : value;
-    }
-  });
-}
-
-// ../../src/core/database/defaultConnection.ts
-var defaultPool = {
-  connection: null
-};
-var defaultQuery = {
-  connection: null
-};
-function registerDefaultDatabasePool(connection) {
-  defaultPool.connection = connection;
-  defaultQuery.connection = createDatabaseQueryProxy(connection);
-}
-function getDefaultDatabaseQuery() {
-  if (!defaultQuery.connection) {
-    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
-  }
-  return defaultQuery.connection;
-}
-
-// ../../src/db/connection/createConnection.ts
-var {SQL } = globalThis.Bun;
-function createDatabaseConnection(config) {
-  if (!config.url) {
-    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
-  }
-  return new SQL({
-    url: config.url,
-    max: config.poolMax,
-    idleTimeout: config.idleTimeoutSeconds,
-    maxLifetime: config.maxLifetimeSeconds,
-    connectionTimeout: config.connectionTimeoutSeconds
-  });
-}
-
-// ../../src/db/connection/index.ts
-var connectionHolder = {
-  connection: null
-};
-function getDatabase() {
-  if (!connectionHolder.connection) {
-    connectionHolder.connection = createDatabaseConnection(databaseConfig);
-    registerDefaultDatabasePool(connectionHolder.connection);
-  }
-  return connectionHolder.connection;
-}
-function getDb() {
-  getDatabase();
-  return getDefaultDatabaseQuery();
-}
-var db = new Proxy(function database() {}, {
-  apply(_target, _thisArg, args) {
-    return getDb()(...args);
-  },
-  get(_target, property) {
-    const connection = getDb();
-    const value = connection[property];
-    return typeof value === "function" ? value.bind(connection) : value;
-  }
-});
-var connection_default = db;
-
-// ../../src/modules/organization/memberRepository.ts
-class OrganizationMemberRepository {
-  constructor() {}
-  async findMembership(userId, organizationId) {
-    const rows = await connection_default`
-      SELECT id, organization_id, user_id, role, created_at
-      FROM organization_member
-      WHERE user_id = ${userId} AND organization_id = ${organizationId}
-      LIMIT 1
-    `;
-    return rows[0] ?? null;
-  }
-  async listForUser(userId) {
-    return await connection_default`
-      SELECT id, organization_id, user_id, role, created_at
-      FROM organization_member
-      WHERE user_id = ${userId}
-      ORDER BY organization_id
-    `;
-  }
-  async listForOrganization(organizationId) {
-    return await connection_default`
-      SELECT id, organization_id, user_id, role, created_at
-      FROM organization_member
-      WHERE organization_id = ${organizationId}
-      ORDER BY id
-    `;
-  }
-  async addMember(input) {
-    const rows = await connection_default`
-      INSERT INTO organization_member (organization_id, user_id, role)
-      VALUES (${input.organizationId}, ${input.userId}, ${input.role ?? "member"})
-      RETURNING id, organization_id, user_id, role, created_at
-    `;
-    const row = rows[0];
-    if (!row) {
-      throw new Error("Organization member insert did not return a row.");
-    }
-    return row;
-  }
-  async removeMember(organizationId, userId) {
-    const rows = await connection_default`
-      DELETE FROM organization_member
-      WHERE organization_id = ${organizationId} AND user_id = ${userId}
-      RETURNING id
-    `;
-    return rows.length > 0;
-  }
-}
-var memberRepository_default = OrganizationMemberRepository;
-
 // ../../src/core/auth/accessControl.ts
 import { ForbiddenError } from "@getstrata/core/errors/http";
 
@@ -214,7 +54,27 @@ function resolveUserId(user) {
 
 // ../../src/core/auth/membershipContext.ts
 var membershipContext = createAsyncContextStore("@getstrata/membershipContext");
-var membershipRepository = new memberRepository_default;
+var uninitializedMembershipLookup = {
+  async listForUser() {
+    return [];
+  },
+  async findMembership() {
+    return null;
+  },
+  async listForOrganization() {
+    return [];
+  },
+  async addMember() {
+    throw new Error("configureMembershipLookup() must be called before mutating memberships.");
+  },
+  async removeMember() {
+    throw new Error("configureMembershipLookup() must be called before mutating memberships.");
+  }
+};
+var membershipRepository = uninitializedMembershipLookup;
+function resolveMembershipLookup() {
+  return membershipRepository;
+}
 async function runWithMembershipContext(callback) {
   const user = currentAuthUser();
   if (!user || isGlobalAdmin(user)) {

package/dist/entries/auth/membershipScope.js

@@ -56,169 +56,29 @@ function resolveUserId(user) {
   return userId;
 }
 
-// ../../src/config/database.ts
-function readInteger(name, fallback) {
-  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
-  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
-}
-var databaseConfig = {
-  url: process.env.DATABASE_URL ?? "",
-  poolMax: readInteger("DB_POOL_MAX", 10),
-  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
-  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
-  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
-};
-
-// ../../src/core/database/connectionContext.ts
-var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
-function runWithDatabaseConnection(connection, callback) {
-  return activeConnection.run(connection, callback);
-}
-function getActiveDatabaseConnection(fallback) {
-  return activeConnection.getStore() ?? fallback;
-}
-function hasActiveDatabaseConnection() {
-  return activeConnection.getStore() !== undefined;
-}
-
-// ../../src/core/database/queryProxy.ts
-var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
-function createDatabaseQueryProxy(pool) {
-  function resolveDatabase() {
-    return getActiveDatabaseConnection(pool);
-  }
-  function resolveDatabaseForProperty(property) {
-    if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
-      return pool;
-    }
-    return resolveDatabase();
-  }
-  return new Proxy(function database() {}, {
-    apply(_target, _thisArg, args) {
-      return resolveDatabase()(...args);
-    },
-    get(_target, property) {
-      const connection = resolveDatabaseForProperty(property);
-      const value = connection[property];
-      return typeof value === "function" ? value.bind(connection) : value;
-    }
-  });
-}
-
-// ../../src/core/database/defaultConnection.ts
-var defaultPool = {
-  connection: null
-};
-var defaultQuery = {
-  connection: null
-};
-function registerDefaultDatabasePool(connection) {
-  defaultPool.connection = connection;
-  defaultQuery.connection = createDatabaseQueryProxy(connection);
-}
-function getDefaultDatabaseQuery() {
-  if (!defaultQuery.connection) {
-    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
-  }
-  return defaultQuery.connection;
-}
-
-// ../../src/db/connection/createConnection.ts
-var {SQL } = globalThis.Bun;
-function createDatabaseConnection(config) {
-  if (!config.url) {
-    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
-  }
-  return new SQL({
-    url: config.url,
-    max: config.poolMax,
-    idleTimeout: config.idleTimeoutSeconds,
-    maxLifetime: config.maxLifetimeSeconds,
-    connectionTimeout: config.connectionTimeoutSeconds
-  });
-}
-
-// ../../src/db/connection/index.ts
-var connectionHolder = {
-  connection: null
-};
-function getDatabase() {
-  if (!connectionHolder.connection) {
-    connectionHolder.connection = createDatabaseConnection(databaseConfig);
-    registerDefaultDatabasePool(connectionHolder.connection);
-  }
-  return connectionHolder.connection;
-}
-function getDb() {
-  getDatabase();
-  return getDefaultDatabaseQuery();
-}
-var db = new Proxy(function database() {}, {
-  apply(_target, _thisArg, args) {
-    return getDb()(...args);
+// ../../src/core/auth/membershipContext.ts
+var membershipContext = createAsyncContextStore("@getstrata/membershipContext");
+var uninitializedMembershipLookup = {
+  async listForUser() {
+    return [];
   },
-  get(_target, property) {
-    const connection = getDb();
-    const value = connection[property];
-    return typeof value === "function" ? value.bind(connection) : value;
-  }
-});
-var connection_default = db;
-
-// ../../src/modules/organization/memberRepository.ts
-class OrganizationMemberRepository {
-  constructor() {}
-  async findMembership(userId, organizationId) {
-    const rows = await connection_default`
-      SELECT id, organization_id, user_id, role, created_at
-      FROM organization_member
-      WHERE user_id = ${userId} AND organization_id = ${organizationId}
-      LIMIT 1
-    `;
-    return rows[0] ?? null;
-  }
-  async listForUser(userId) {
-    return await connection_default`
-      SELECT id, organization_id, user_id, role, created_at
-      FROM organization_member
-      WHERE user_id = ${userId}
-      ORDER BY organization_id
-    `;
-  }
-  async listForOrganization(organizationId) {
-    return await connection_default`
-      SELECT id, organization_id, user_id, role, created_at
-      FROM organization_member
-      WHERE organization_id = ${organizationId}
-      ORDER BY id
-    `;
-  }
-  async addMember(input) {
-    const rows = await connection_default`
-      INSERT INTO organization_member (organization_id, user_id, role)
-      VALUES (${input.organizationId}, ${input.userId}, ${input.role ?? "member"})
-      RETURNING id, organization_id, user_id, role, created_at
-    `;
-    const row = rows[0];
-    if (!row) {
-      throw new Error("Organization member insert did not return a row.");
-    }
-    return row;
-  }
-  async removeMember(organizationId, userId) {
-    const rows = await connection_default`
-      DELETE FROM organization_member
-      WHERE organization_id = ${organizationId} AND user_id = ${userId}
-      RETURNING id
-    `;
-    return rows.length > 0;
+  async findMembership() {
+    return null;
+  },
+  async listForOrganization() {
+    return [];
+  },
+  async addMember() {
+    throw new Error("configureMembershipLookup() must be called before mutating memberships.");
+  },
+  async removeMember() {
+    throw new Error("configureMembershipLookup() must be called before mutating memberships.");
   }
+};
+var membershipRepository = uninitializedMembershipLookup;
+function resolveMembershipLookup() {
+  return membershipRepository;
 }
-var memberRepository_default = OrganizationMemberRepository;
-
-// ../../src/core/auth/membershipContext.ts
-var membershipContext = createAsyncContextStore("@getstrata/membershipContext");
-var membershipRepository = new memberRepository_default;
 async function runWithMembershipContext(callback) {
   const user = currentAuthUser();
   if (!user || isGlobalAdmin(user)) {
@@ -326,11 +186,11 @@ function assertOrganizationReadable(organizationId) {
   }
 }
 export {
-  scopedOrganizationIds,
-  resolveOrganizationScope,
-  emptyPaginateResult,
-  assertResourceInCurrentTenant,
-  assertOrganizationReadable,
+  appendOrganizationScope,
   appendProjectScope,
-  appendOrganizationScope
+  assertOrganizationReadable,
+  assertResourceInCurrentTenant,
+  emptyPaginateResult,
+  resolveOrganizationScope,
+  scopedOrganizationIds
 };