@getstrata/core 0.7.4 → 1.0.0

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @getstrata/core changelog
 
+## 1.0.0
+
+- First stable release of the public `@getstrata/core` API.
+
+## 0.7.5
+
+- `TENANCY_DRIVER=column`: tenant ALS without Postgres `SET LOCAL` / `set_config`. `isRlsTenancy()` is the RLS-only check.
+- `AuthUserRecord` may include `name` and optional MFA columns used by generated starters.
+
 ## 0.7.4
 
 - Default database pool and query handles live on `globalThis`, so the published `@getstrata/core` bundle and `src/core` share one pool in the same process.

package/README.md

@@ -23,7 +23,7 @@ import { EtaViewEngine } from "@getstrata/core/view";
 
 `.eta` files are **HTML + Eta tags** (`<% %>`, `<%= %>`, `<%~ include() %>`), not another template language. Class/attribute shorthand such as `section.section` or `a href=` fails at render time with the template name.
 
-**Dependency:** `eta` is a direct dependency of `@getstrata/core`. Apps do not need to list it separately. The database **engine** is your choice. HiroApp uses **Bun's built-in `Bun.sql`** (Postgres). Create and bind it with `createBunSqlPool()` / `bindBunSql()`, or call `bindDatabaseConnection()` yourself. Extra engines register with `registerNamedConnection` (`database/namedConnections`, `database/sqliteConnection`, `database/mysqlConnection`).
+**Dependency:** `eta` is a direct dependency of `@getstrata/core`. Apps do not need to list it separately. The database **engine** is your choice. Generated HiroApp uses **Bun's built-in `Bun.sql`** (Postgres): `createBunSqlPool()`, then `registerDefaultDatabasePool()` and `bindDatabaseConnection()`. `bindBunSql()` is a helper that registers both. Extra engines register with `registerNamedConnection` (`database/namedConnections`, `database/sqliteConnection`, `database/mysqlConnection`).
 
 `orderBy` accepts `{ column, direction }` objects or column shorthand such as `{ published_at: "desc" }`. `{ ilike }` uses the value as-is. Pass `%term%` yourself.
 
@@ -33,7 +33,7 @@ import { EtaViewEngine } from "@getstrata/core/view";
 - `createFailedJobService`, `FailedJobService.delete()`: failed job persistence and cleanup
 - `runQueueJob`, `jobRegistry`: dispatch retried jobs from admin UIs
 
-HiroApp uses failed-job recovery in the staff dashboard. You do not have to use the admin registry.
+Core ships failed-job helpers and an optional admin resource registry. Generated HiroApp does not include an admin dashboard. You do not have to use the registry.
 
 ## Build and verify (monorepo root)
 
@@ -65,7 +65,7 @@ import type { Migration } from "@getstrata/core/database/migrations/types";
 Package name: **`@getstrata/core`** (npm org [`@getstrata`](https://www.npmjs.com/org/getstrata)).
 
 1. Add `NPM_TOKEN` to GitHub repository secrets.
-2. Tag a release: `git tag v0.7.4 && git push origin v0.7.4`
+2. Tag a release: `git tag v1.0.0 && git push origin v1.0.0`
 3. [Release workflow](../../.github/workflows/release.yml) builds and runs `npm publish --access public`.
 
 See [docs/PACKAGING.md](../../docs/PACKAGING.md).

package/dist/core/contracts/authUserDirectory.d.ts

@@ -1,10 +1,14 @@
 import type { AuthUser } from "../auth/authContext";
 interface AuthUserRecord {
     id: number;
+    name?: string | null;
     email?: string | null;
     role: string;
     email_verified_at?: Date | string | null;
     session_valid_after?: Date | string | null;
+    mfa_enabled?: boolean;
+    mfa_secret?: string | null;
+    mfa_recovery_codes?: string | null;
 }
 interface AuthUserDirectory {
     resolveUserFromToken(token: string): Promise<AuthUser | null>;

package/dist/core/tenant/tenancyConfig.d.ts

@@ -1,5 +1,7 @@
-type TenancyDriver = "rls" | "none";
+type TenancyDriver = "rls" | "column" | "none";
 declare function readTenancyDriver(env?: Record<string, string | undefined>): TenancyDriver;
 declare function isTenancyEnabled(env?: Record<string, string | undefined>): boolean;
+/** Postgres `SET LOCAL` / `set_config` for row-level security. SQLite and MySQL cannot do this. */
+declare function isRlsTenancy(env?: Record<string, string | undefined>): boolean;
 export type { TenancyDriver };
-export { isTenancyEnabled, readTenancyDriver };
+export { isRlsTenancy, isTenancyEnabled, readTenancyDriver };

package/dist/entries/audit/exportAuditLogs.js

@@ -189,7 +189,29 @@ async function safeFetch(input, init = {}, options = {}) {
 
 // ../../src/core/tenant/databaseTenantContext.ts
 import { repositoryConnection as db } from "@getstrata/core/database/repositoryConnection";
+
+// ../../src/core/tenant/tenancyConfig.ts
+function readTenancyDriver(env = process.env) {
+  if (env.TENANCY_DRIVER === "none") {
+    return "none";
+  }
+  if (env.TENANCY_DRIVER === "column") {
+    return "column";
+  }
+  return "rls";
+}
+function isTenancyEnabled(env = process.env) {
+  return readTenancyDriver(env) !== "none";
+}
+function isRlsTenancy(env = process.env) {
+  return readTenancyDriver(env) === "rls";
+}
+
+// ../../src/core/tenant/databaseTenantContext.ts
 async function runWithMigrationBypass(callback) {
+  if (!isRlsTenancy()) {
+    return await callback();
+  }
   await db`SELECT set_config('app.bypass_rls', 'true', false)`;
   try {
     return await callback();

package/dist/entries/auth/scimAuthMiddleware.js

@@ -79,11 +79,20 @@ import { repositoryConnection as db } from "@getstrata/core/database/repositoryC
 
 // ../../src/core/tenant/tenancyConfig.ts
 function readTenancyDriver(env = process.env) {
-  return env.TENANCY_DRIVER === "none" ? "none" : "rls";
+  if (env.TENANCY_DRIVER === "none") {
+    return "none";
+  }
+  if (env.TENANCY_DRIVER === "column") {
+    return "column";
+  }
+  return "rls";
 }
 function isTenancyEnabled(env = process.env) {
   return readTenancyDriver(env) !== "none";
 }
+function isRlsTenancy(env = process.env) {
+  return readTenancyDriver(env) === "rls";
+}
 
 // ../../src/core/tenant/resolveTenant.ts
 async function resolveTenant(tenantId) {
@@ -123,12 +132,12 @@ async function applyTenantContextToTransaction(transaction, tenantId) {
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
 }
 async function runWithTenantDatabase(tenant, callback) {
-  if (!isTenancyEnabled()) {
+  if (!isTenancyEnabled() || !isRlsTenancy()) {
     return await runWithTenant(tenant, callback);
   }
   if (hasActiveDatabaseConnection()) {
-    const activeConnection2 = getActiveDatabaseConnection(getDefaultDatabasePool());
-    await applyTenantContextToTransaction(activeConnection2, tenant.id);
+    const activeConnection = getActiveDatabaseConnection(getDefaultDatabasePool());
+    await applyTenantContextToTransaction(activeConnection, tenant.id);
     return await runWithTenant(tenant, callback);
   }
   return await getDefaultDatabasePool().begin(async (transaction) => {

package/dist/entries/auth/sessionCookie.js

@@ -127,8 +127,8 @@ function readSession(request) {
   }
   const parts = cookieValue.split(".");
   if (parts.length === 4) {
-    const [userIdRaw2, issuedAtRaw2, ttlRaw, cookieSignature2] = parts;
-    return readSignedSession(String(userIdRaw2), String(issuedAtRaw2), cookieSignature2, Number.parseInt(String(ttlRaw), 10), true);
+    const [userIdRaw, issuedAtRaw, ttlRaw, cookieSignature] = parts;
+    return readSignedSession(String(userIdRaw), String(issuedAtRaw), cookieSignature, Number.parseInt(String(ttlRaw), 10), true);
   }
   if (parts.length !== 3) {
     return null;

package/dist/entries/auth/sessionGuard.js

@@ -194,8 +194,8 @@ function readSession(request) {
   }
   const parts = cookieValue.split(".");
   if (parts.length === 4) {
-    const [userIdRaw2, issuedAtRaw2, ttlRaw, cookieSignature2] = parts;
-    return readSignedSession(String(userIdRaw2), String(issuedAtRaw2), cookieSignature2, Number.parseInt(String(ttlRaw), 10), true);
+    const [userIdRaw, issuedAtRaw, ttlRaw, cookieSignature] = parts;
+    return readSignedSession(String(userIdRaw), String(issuedAtRaw), cookieSignature, Number.parseInt(String(ttlRaw), 10), true);
   }
   if (parts.length !== 3) {
     return null;

package/dist/entries/database/model.js

@@ -298,8 +298,8 @@ function buildSelectList(table, select, params = []) {
   }
   return select.map((item) => {
     if (item.kind === "column") {
-      const column2 = qualifyColumn(item.table, item.column);
-      return item.as ? `${column2} AS ${quoteIdentifier(item.as)}` : column2;
+      const column = qualifyColumn(item.table, item.column);
+      return item.as ? `${column} AS ${quoteIdentifier(item.as)}` : column;
     }
     if (item.kind === "literalText") {
       return `${currentSqlDialect().castToText(pushParam(params, item.value))} AS ${quoteIdentifier(item.as)}`;
@@ -1919,8 +1919,8 @@ class Model {
     }
     if (updating) {
       const changes = applyTimestampsOnUpdate(table.columns, applyCasts(this.attributes, casts, "dehydrate"), timestamps);
-      const record2 = await this.repository.updateByIdOrThrow(this.id, changes);
-      this.attributes = ModelClass.hydrateAttributes(record2);
+      const record = await this.repository.updateByIdOrThrow(this.id, changes);
+      this.attributes = ModelClass.hydrateAttributes(record);
       await runObservers(this, "updated");
       await runObservers(this, "saved");
       return this;

package/dist/entries/database/query.js

@@ -275,8 +275,8 @@ function buildSelectList(table, select, params = []) {
   }
   return select.map((item) => {
     if (item.kind === "column") {
-      const column2 = qualifyColumn(item.table, item.column);
-      return item.as ? `${column2} AS ${quoteIdentifier(item.as)}` : column2;
+      const column = qualifyColumn(item.table, item.column);
+      return item.as ? `${column} AS ${quoteIdentifier(item.as)}` : column;
     }
     if (item.kind === "literalText") {
       return `${currentSqlDialect().castToText(pushParam(params, item.value))} AS ${quoteIdentifier(item.as)}`;

package/dist/entries/database/repositoryQuery.js

@@ -275,8 +275,8 @@ function buildSelectList(table, select, params = []) {
   }
   return select.map((item) => {
     if (item.kind === "column") {
-      const column2 = qualifyColumn(item.table, item.column);
-      return item.as ? `${column2} AS ${quoteIdentifier(item.as)}` : column2;
+      const column = qualifyColumn(item.table, item.column);
+      return item.as ? `${column} AS ${quoteIdentifier(item.as)}` : column;
     }
     if (item.kind === "literalText") {
       return `${currentSqlDialect().castToText(pushParam(params, item.value))} AS ${quoteIdentifier(item.as)}`;
@@ -925,50 +925,50 @@ class RepositoryQuery {
   }
   async hydrateEagerLoad(rows, result, load) {
     if (load.kind === "hasMany") {
-      const relation2 = load.relation;
-      const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadHasManyForParents(rows, relation2, load.options);
+      const relation = load.relation;
+      const grouped = await load.repository.withConnection(this.repository.getConnection()).loadHasManyForParents(rows, relation, load.options);
       for (const row of result) {
-        row[load.as] = getByRelationKey(grouped2, row[relation2.localKey]) ?? [];
+        row[load.as] = getByRelationKey(grouped, row[relation.localKey]) ?? [];
       }
       return;
     }
     if (load.kind === "morphMany") {
-      const relation2 = load.relation;
-      const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadMorphManyForParents(rows, relation2, load.options);
+      const relation = load.relation;
+      const grouped = await load.repository.withConnection(this.repository.getConnection()).loadMorphManyForParents(rows, relation, load.options);
       for (const row of result) {
-        row[load.as] = getByRelationKey(grouped2, row[relation2.localKey]) ?? [];
+        row[load.as] = getByRelationKey(grouped, row[relation.localKey]) ?? [];
       }
       return;
     }
     if (load.kind === "morphOne") {
-      const relation2 = load.relation;
-      const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadMorphOneForParents(rows, relation2, load.options);
+      const relation = load.relation;
+      const grouped = await load.repository.withConnection(this.repository.getConnection()).loadMorphOneForParents(rows, relation, load.options);
       for (const row of result) {
-        row[load.as] = getByRelationKey(grouped2, row[relation2.localKey]);
+        row[load.as] = getByRelationKey(grouped, row[relation.localKey]);
       }
       return;
     }
     if (load.kind === "hasManyThrough") {
-      const relation2 = load.relation;
-      const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadHasManyThroughForParents(rows, relation2, load.options);
+      const relation = load.relation;
+      const grouped = await load.repository.withConnection(this.repository.getConnection()).loadHasManyThroughForParents(rows, relation, load.options);
       for (const row of result) {
-        row[load.as] = getByRelationKey(grouped2, row[relation2.localKey]) ?? [];
+        row[load.as] = getByRelationKey(grouped, row[relation.localKey]) ?? [];
       }
       return;
     }
     if (load.kind === "belongsToMany") {
-      const relation2 = load.relation;
-      const grouped2 = await this.repository.loadBelongsToManyForParents(rows, relation2, load.repository, load.options);
+      const relation = load.relation;
+      const grouped = await this.repository.loadBelongsToManyForParents(rows, relation, load.repository, load.options);
       for (const row of result) {
-        row[load.as] = getByRelationKey(grouped2, row[relation2.parentKey]) ?? [];
+        row[load.as] = getByRelationKey(grouped, row[relation.parentKey]) ?? [];
       }
       return;
     }
     if (load.kind === "morphTo") {
-      const relation2 = load.relation;
-      const grouped2 = await this.repository.loadMorphToForChildren(rows, relation2, load.morphRepositories ?? new Map, load.options);
+      const relation = load.relation;
+      const grouped = await this.repository.loadMorphToForChildren(rows, relation, load.morphRepositories ?? new Map, load.options);
       for (const row of result) {
-        row[load.as] = getByRelationKey(grouped2, row[relation2.morphIdKey]);
+        row[load.as] = getByRelationKey(grouped, row[relation.morphIdKey]);
       }
       return;
     }

package/dist/entries/database/schema.js

@@ -542,8 +542,8 @@ function buildSelectList(table, select, params = []) {
   }
   return select.map((item) => {
     if (item.kind === "column") {
-      const column2 = qualifyColumn(item.table, item.column);
-      return item.as ? `${column2} AS ${quoteIdentifier(item.as)}` : column2;
+      const column = qualifyColumn(item.table, item.column);
+      return item.as ? `${column} AS ${quoteIdentifier(item.as)}` : column;
     }
     if (item.kind === "literalText") {
       return `${currentSqlDialect().castToText(pushParam(params, item.value))} AS ${quoteIdentifier(item.as)}`;

package/dist/entries/jobs/exportAuditLogsJob.js

@@ -189,7 +189,29 @@ async function safeFetch(input, init = {}, options = {}) {
 
 // ../../src/core/tenant/databaseTenantContext.ts
 import { repositoryConnection as db } from "@getstrata/core/database/repositoryConnection";
+
+// ../../src/core/tenant/tenancyConfig.ts
+function readTenancyDriver(env = process.env) {
+  if (env.TENANCY_DRIVER === "none") {
+    return "none";
+  }
+  if (env.TENANCY_DRIVER === "column") {
+    return "column";
+  }
+  return "rls";
+}
+function isTenancyEnabled(env = process.env) {
+  return readTenancyDriver(env) !== "none";
+}
+function isRlsTenancy(env = process.env) {
+  return readTenancyDriver(env) === "rls";
+}
+
+// ../../src/core/tenant/databaseTenantContext.ts
 async function runWithMigrationBypass(callback) {
+  if (!isRlsTenancy()) {
+    return await callback();
+  }
   await db`SELECT set_config('app.bypass_rls', 'true', false)`;
   try {
     return await callback();

package/dist/entries/openapi/generator.js

@@ -254,13 +254,13 @@ function renderOpenApiDocument(spec) {
   return `${JSON.stringify(spec, null, 2)}
 `;
 }
-function toMethodName(method, path, apiPrefix2) {
-  const relativePath = path.startsWith(apiPrefix2) ? path.slice(apiPrefix2.length) || "/" : path;
+function toMethodName(method, path, apiPrefix) {
+  const relativePath = path.startsWith(apiPrefix) ? path.slice(apiPrefix.length) || "/" : path;
   const segments = relativePath.replace(/\{|\}/g, "").split("/").filter(Boolean).flatMap((segment) => segment.split("-")).map((segment) => segment.replace(/[^a-zA-Z0-9]/g, "")).filter(Boolean).map((segment) => segment.charAt(0).toUpperCase() + segment.slice(1));
   return `${method.toLowerCase()}${segments.join("")}`;
 }
-function toRequestPath(path, apiPrefix2) {
-  return path.startsWith(apiPrefix2) ? path.slice(apiPrefix2.length) || "/" : path;
+function toRequestPath(path, apiPrefix) {
+  return path.startsWith(apiPrefix) ? path.slice(apiPrefix.length) || "/" : path;
 }
 function renderTypeScriptSdk(spec, prefix = apiPrefix()) {
   const lines = [

package/dist/entries/tenant/databaseTenantContext.js

@@ -1,7 +1,29 @@
 // @bun
 // ../../src/core/tenant/databaseTenantContext.ts
 import { repositoryConnection as db } from "@getstrata/core/database/repositoryConnection";
+
+// ../../src/core/tenant/tenancyConfig.ts
+function readTenancyDriver(env = process.env) {
+  if (env.TENANCY_DRIVER === "none") {
+    return "none";
+  }
+  if (env.TENANCY_DRIVER === "column") {
+    return "column";
+  }
+  return "rls";
+}
+function isTenancyEnabled(env = process.env) {
+  return readTenancyDriver(env) !== "none";
+}
+function isRlsTenancy(env = process.env) {
+  return readTenancyDriver(env) === "rls";
+}
+
+// ../../src/core/tenant/databaseTenantContext.ts
 async function runWithMigrationBypass(callback) {
+  if (!isRlsTenancy()) {
+    return await callback();
+  }
   await db`SELECT set_config('app.bypass_rls', 'true', false)`;
   try {
     return await callback();

package/dist/entries/tenant/tenancyConfig.js

@@ -1,12 +1,22 @@
 // @bun
 // ../../src/core/tenant/tenancyConfig.ts
 function readTenancyDriver(env = process.env) {
-  return env.TENANCY_DRIVER === "none" ? "none" : "rls";
+  if (env.TENANCY_DRIVER === "none") {
+    return "none";
+  }
+  if (env.TENANCY_DRIVER === "column") {
+    return "column";
+  }
+  return "rls";
 }
 function isTenancyEnabled(env = process.env) {
   return readTenancyDriver(env) !== "none";
 }
+function isRlsTenancy(env = process.env) {
+  return readTenancyDriver(env) === "rls";
+}
 export {
+  isRlsTenancy,
   isTenancyEnabled,
   readTenancyDriver
 };

package/dist/entries/tenant/tenantDatabaseScope.js

@@ -30,11 +30,20 @@ function hasActiveDatabaseConnection() {
 
 // ../../src/core/tenant/tenancyConfig.ts
 function readTenancyDriver(env = process.env) {
-  return env.TENANCY_DRIVER === "none" ? "none" : "rls";
+  if (env.TENANCY_DRIVER === "none") {
+    return "none";
+  }
+  if (env.TENANCY_DRIVER === "column") {
+    return "column";
+  }
+  return "rls";
 }
 function isTenancyEnabled(env = process.env) {
   return readTenancyDriver(env) !== "none";
 }
+function isRlsTenancy(env = process.env) {
+  return readTenancyDriver(env) === "rls";
+}
 
 // ../../src/core/tenant/tenantContext.ts
 var tenantContext = createAsyncContextStore("@getstrata/tenantContext");
@@ -51,12 +60,12 @@ async function applyTenantContextToTransaction(transaction, tenantId) {
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
 }
 async function runWithTenantDatabase(tenant, callback) {
-  if (!isTenancyEnabled()) {
+  if (!isTenancyEnabled() || !isRlsTenancy()) {
     return await runWithTenant(tenant, callback);
   }
   if (hasActiveDatabaseConnection()) {
-    const activeConnection2 = getActiveDatabaseConnection(getDefaultDatabasePool());
-    await applyTenantContextToTransaction(activeConnection2, tenant.id);
+    const activeConnection = getActiveDatabaseConnection(getDefaultDatabasePool());
+    await applyTenantContextToTransaction(activeConnection, tenant.id);
     return await runWithTenant(tenant, callback);
   }
   return await getDefaultDatabasePool().begin(async (transaction) => {

package/dist/framework/public-api.d.ts

@@ -126,7 +126,7 @@ export { logSecurityEvent } from "../core/security/securityEvents.ts";
 export type { StorageDriver } from "../core/storage/storage.ts";
 export { createStorageDriver, LocalStorageDriver, resetDefaultStorage, StorageManager, } from "../core/storage/storage.ts";
 export type { TenancyDriver } from "../core/tenant/tenancyConfig.ts";
-export { isTenancyEnabled, readTenancyDriver } from "../core/tenant/tenancyConfig.ts";
+export { isRlsTenancy, isTenancyEnabled, readTenancyDriver, } from "../core/tenant/tenancyConfig.ts";
 export type { TenantContext } from "../core/tenant/tenantContext.ts";
 export { currentTenant, currentTenantId, rateLimitMultiplierForPlan, runWithTenant, } from "../core/tenant/tenantContext.ts";
 export { isInsideTenantDatabaseScope, runWithTenantDatabase, } from "../core/tenant/tenantDatabaseScope.ts";

package/dist/index.js

@@ -326,11 +326,11 @@ function abilityCatalog() {
 
 // ../../src/core/auth/guard.ts
 function devHeaderAbilities(role) {
-  const catalog2 = abilityCatalog();
+  const catalog = abilityCatalog();
   if (role === "admin") {
-    return [...catalog2.admin];
+    return [...catalog.admin];
   }
-  return [...catalog2.member];
+  return [...catalog.member];
 }
 
 class GuestGuard {
@@ -1144,7 +1144,7 @@ function resolveScimTenantFromToken(token) {
 function resolveRepositoryConnection() {
   return getBoundDatabaseConnection() ?? getDefaultDatabaseQuery();
 }
-var repositoryConnection = new Proxy(function repositoryConnection2() {}, {
+var repositoryConnection = new Proxy(function repositoryConnection() {}, {
   apply(_target, _thisArg, args) {
     return resolveRepositoryConnection()(...args);
   },
@@ -1157,11 +1157,20 @@ var repositoryConnection = new Proxy(function repositoryConnection2() {}, {
 
 // ../../src/core/tenant/tenancyConfig.ts
 function readTenancyDriver(env = process.env) {
-  return env.TENANCY_DRIVER === "none" ? "none" : "rls";
+  if (env.TENANCY_DRIVER === "none") {
+    return "none";
+  }
+  if (env.TENANCY_DRIVER === "column") {
+    return "column";
+  }
+  return "rls";
 }
 function isTenancyEnabled(env = process.env) {
   return readTenancyDriver(env) !== "none";
 }
+function isRlsTenancy(env = process.env) {
+  return readTenancyDriver(env) === "rls";
+}
 
 // ../../src/core/tenant/resolveTenant.ts
 async function resolveTenant(tenantId) {
@@ -1189,12 +1198,12 @@ async function applyTenantContextToTransaction(transaction, tenantId) {
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
 }
 async function runWithTenantDatabase(tenant, callback) {
-  if (!isTenancyEnabled()) {
+  if (!isTenancyEnabled() || !isRlsTenancy()) {
     return await runWithTenant(tenant, callback);
   }
   if (hasActiveDatabaseConnection()) {
-    const activeConnection2 = getActiveDatabaseConnection(getDefaultDatabasePool());
-    await applyTenantContextToTransaction(activeConnection2, tenant.id);
+    const activeConnection = getActiveDatabaseConnection(getDefaultDatabasePool());
+    await applyTenantContextToTransaction(activeConnection, tenant.id);
     return await runWithTenant(tenant, callback);
   }
   return await getDefaultDatabasePool().begin(async (transaction) => {
@@ -2307,8 +2316,8 @@ function buildSelectList(table, select, params = []) {
   }
   return select.map((item) => {
     if (item.kind === "column") {
-      const column2 = qualifyColumn(item.table, item.column);
-      return item.as ? `${column2} AS ${quoteIdentifier(item.as)}` : column2;
+      const column = qualifyColumn(item.table, item.column);
+      return item.as ? `${column} AS ${quoteIdentifier(item.as)}` : column;
     }
     if (item.kind === "literalText") {
       return `${currentSqlDialect().castToText(pushParam(params, item.value))} AS ${quoteIdentifier(item.as)}`;
@@ -2957,50 +2966,50 @@ class RepositoryQuery {
   }
   async hydrateEagerLoad(rows, result, load) {
     if (load.kind === "hasMany") {
-      const relation2 = load.relation;
-      const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadHasManyForParents(rows, relation2, load.options);
+      const relation = load.relation;
+      const grouped = await load.repository.withConnection(this.repository.getConnection()).loadHasManyForParents(rows, relation, load.options);
       for (const row of result) {
-        row[load.as] = getByRelationKey(grouped2, row[relation2.localKey]) ?? [];
+        row[load.as] = getByRelationKey(grouped, row[relation.localKey]) ?? [];
       }
       return;
     }
     if (load.kind === "morphMany") {
-      const relation2 = load.relation;
-      const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadMorphManyForParents(rows, relation2, load.options);
+      const relation = load.relation;
+      const grouped = await load.repository.withConnection(this.repository.getConnection()).loadMorphManyForParents(rows, relation, load.options);
       for (const row of result) {
-        row[load.as] = getByRelationKey(grouped2, row[relation2.localKey]) ?? [];
+        row[load.as] = getByRelationKey(grouped, row[relation.localKey]) ?? [];
       }
       return;
     }
     if (load.kind === "morphOne") {
-      const relation2 = load.relation;
-      const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadMorphOneForParents(rows, relation2, load.options);
+      const relation = load.relation;
+      const grouped = await load.repository.withConnection(this.repository.getConnection()).loadMorphOneForParents(rows, relation, load.options);
       for (const row of result) {
-        row[load.as] = getByRelationKey(grouped2, row[relation2.localKey]);
+        row[load.as] = getByRelationKey(grouped, row[relation.localKey]);
       }
       return;
     }
     if (load.kind === "hasManyThrough") {
-      const relation2 = load.relation;
-      const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadHasManyThroughForParents(rows, relation2, load.options);
+      const relation = load.relation;
+      const grouped = await load.repository.withConnection(this.repository.getConnection()).loadHasManyThroughForParents(rows, relation, load.options);
       for (const row of result) {
-        row[load.as] = getByRelationKey(grouped2, row[relation2.localKey]) ?? [];
+        row[load.as] = getByRelationKey(grouped, row[relation.localKey]) ?? [];
       }
       return;
     }
     if (load.kind === "belongsToMany") {
-      const relation2 = load.relation;
-      const grouped2 = await this.repository.loadBelongsToManyForParents(rows, relation2, load.repository, load.options);
+      const relation = load.relation;
+      const grouped = await this.repository.loadBelongsToManyForParents(rows, relation, load.repository, load.options);
       for (const row of result) {
-        row[load.as] = getByRelationKey(grouped2, row[relation2.parentKey]) ?? [];
+        row[load.as] = getByRelationKey(grouped, row[relation.parentKey]) ?? [];
       }
       return;
     }
     if (load.kind === "morphTo") {
-      const relation2 = load.relation;
-      const grouped2 = await this.repository.loadMorphToForChildren(rows, relation2, load.morphRepositories ?? new Map, load.options);
+      const relation = load.relation;
+      const grouped = await this.repository.loadMorphToForChildren(rows, relation, load.morphRepositories ?? new Map, load.options);
       for (const row of result) {
-        row[load.as] = getByRelationKey(grouped2, row[relation2.morphIdKey]);
+        row[load.as] = getByRelationKey(grouped, row[relation.morphIdKey]);
       }
       return;
     }
@@ -4937,8 +4946,8 @@ class Model {
     }
     if (updating) {
       const changes = applyTimestampsOnUpdate(table.columns, applyCasts(this.attributes, casts, "dehydrate"), timestamps);
-      const record2 = await this.repository.updateByIdOrThrow(this.id, changes);
-      this.attributes = ModelClass.hydrateAttributes(record2);
+      const record = await this.repository.updateByIdOrThrow(this.id, changes);
+      this.attributes = ModelClass.hydrateAttributes(record);
       await runObservers(this, "updated");
       await runObservers(this, "saved");
       return this;
@@ -6911,9 +6920,9 @@ class FormRequest {
   }
 }
 // ../../src/core/http/authMiddleware.ts
-function createAuthMiddleware(auth2) {
+function createAuthMiddleware(auth) {
   return async (request, next) => {
-    const user = await auth2.resolve(request);
+    const user = await auth.resolve(request);
     return await runWithAuthUser(user, async () => {
       const response = await next();
       if (user) {
@@ -6930,9 +6939,9 @@ function createAuthMiddleware(auth2) {
   };
 }
 // ../../src/core/http/authorizeMiddleware.ts
-function createAuthorizeMiddleware(gate, auth2, resource, action) {
+function createAuthorizeMiddleware(gate, auth, resource, action) {
   return async (request, next) => {
-    const user = currentAuthUser() ?? await auth2.resolve(request);
+    const user = currentAuthUser() ?? await auth.resolve(request);
     if (!gate.allows(resource, action, user)) {
       const error = new ForbiddenError;
       return Response.json({ error: error.message }, { status: error.status });
@@ -7106,9 +7115,9 @@ async function parseMultipartUpload(request, fieldName = "file") {
   };
 }
 // ../../src/core/http/requireAuthMiddleware.ts
-function createRequireAuthMiddleware(auth2) {
+function createRequireAuthMiddleware(auth) {
   return async (request, next) => {
-    if (!await auth2.check(request)) {
+    if (!await auth.check(request)) {
       const error = new UnauthorizedError;
       return Response.json({ error: error.message }, { status: error.status });
     }
@@ -7504,8 +7513,8 @@ function securedBindRouteModel(param, resolver, authorization, handler) {
     const id = parsePositiveIntParam(String(request.params[param]), String(param));
     const model = requireResolvedModel(await resolver(id, request));
     const gate = resolveApplicationPolicyGate();
-    const auth2 = resolveApplicationAuth();
-    const user = currentAuthUser() ?? await auth2.resolve(request);
+    const auth = resolveApplicationAuth();
+    const user = currentAuthUser() ?? await auth.resolve(request);
     gate.authorize(authorization.resource, authorization.action, user, model);
     if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
       assertIfMatch(request, etagFromResource(model), {
@@ -7527,8 +7536,8 @@ function securedBindRouteModelByKey(param, resolver, authorization, handler) {
     }
     const model = requireResolvedModel(await resolver(key, request));
     const gate = resolveApplicationPolicyGate();
-    const auth2 = resolveApplicationAuth();
-    const user = currentAuthUser() ?? await auth2.resolve(request);
+    const auth = resolveApplicationAuth();
+    const user = currentAuthUser() ?? await auth.resolve(request);
     gate.authorize(authorization.resource, authorization.action, user, model);
     if (isEtagEnabled() && isMutatingPolicyAction(authorization.action)) {
       assertIfMatch(request, etagFromResource(model), {
@@ -7850,9 +7859,9 @@ function createIntendedUrlCookieFromRequest(request) {
 }
 
 // ../../src/core/http/requireWebAuthMiddleware.ts
-function createRequireWebAuthMiddleware(auth2) {
+function createRequireWebAuthMiddleware(auth) {
   return async (request, next) => {
-    const user = await auth2.resolve(request);
+    const user = await auth.resolve(request);
     if (user) {
       return await runWithAuthUser(user, () => next());
     }
@@ -8281,15 +8290,15 @@ function buildMarkdownMailMessage(input) {
     html: rendered.html
   };
 }
-async function sendMarkdownMail(mailer2, input) {
-  await mailer2.send(buildMarkdownMailMessage(input));
+async function sendMarkdownMail(mailer, input) {
+  await mailer.send(buildMarkdownMailMessage(input));
 }
 // ../../src/core/notifications/dispatcher.ts
 class NotificationDispatcher {
   mailer;
   databaseStore;
-  constructor(mailer2, databaseStore = null) {
-    this.mailer = mailer2;
+  constructor(mailer, databaseStore = null) {
+    this.mailer = mailer;
     this.databaseStore = databaseStore;
   }
   async send(notifiable, notification) {
@@ -8341,8 +8350,8 @@ class NotificationDispatcher {
     });
   }
 }
-function createNotificationDispatcher(mailer2, databaseStore) {
-  return new NotificationDispatcher(mailer2, databaseStore ?? null);
+function createNotificationDispatcher(mailer, databaseStore) {
+  return new NotificationDispatcher(mailer, databaseStore ?? null);
 }
 // ../../src/core/notifications/notification.ts
 class Notification {
@@ -8472,9 +8481,9 @@ function readSharedJobRegistry() {
   if (globalRegistry) {
     return globalRegistry;
   }
-  const registry2 = new JobRegistry;
-  globalThis[JOB_REGISTRY_KEY] = registry2;
-  return registry2;
+  const registry = new JobRegistry;
+  globalThis[JOB_REGISTRY_KEY] = registry;
+  return registry;
 }
 var jobRegistry = readSharedJobRegistry();
 
@@ -8829,6 +8838,9 @@ import { createHash } from "crypto";
 
 // ../../src/core/tenant/databaseTenantContext.ts
 async function runWithMigrationBypass(callback) {
+  if (!isRlsTenancy()) {
+    return await callback();
+  }
   await repositoryConnection`SELECT set_config('app.bypass_rls', 'true', false)`;
   try {
     return await callback();
@@ -9286,9 +9298,9 @@ class EtaViewEngine {
       autoTrim: false
     });
     this.resolveLayoutData = resolveLayoutData;
-    const readFile2 = this.eta.readFile?.bind(this.eta);
+    const readFile = this.eta.readFile?.bind(this.eta);
     this.eta.readFile = (path) => {
-      const source = readFile2 ? readFile2(path) : "";
+      const source = readFile ? readFile(path) : "";
       assertEtaHtmlSource(relative(viewsDirectory, path) || path, source);
       return source;
     };
@@ -9561,6 +9573,7 @@ export {
   isHttpErrorLike,
   isInsideTenantDatabaseScope,
   isPublicReadsEnabled,
+  isRlsTenancy,
   isTenancyEnabled,
   jobRegistry,
   jsonResponse2 as jsonResponse,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "0.7.4",
+  "version": "1.0.0",
   "description": "Strata Bun framework public API",
   "type": "module",
   "license": "MIT",