@getstrata/core 1.0.2 → 1.0.4

package/dist/index.js

@@ -490,6 +490,26 @@ class AuthManager {
 // ../../src/core/auth/jwt.ts
 import { createHmac, timingSafeEqual } from "crypto";
 
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/runtime/appKeyPrefix.ts
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "strata";
@@ -500,6 +520,18 @@ function appCookieName(kind) {
 function appDevSecret(kind) {
   return `${appKeyPrefix()}-dev-${kind}`;
 }
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
@@ -508,16 +540,48 @@ function smtpEhloHost() {
   const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
   return safe || "strata.local";
 }
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "Strata";
+}
 function appEnv() {
   return process.env.APP_ENV?.trim() || "local";
 }
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/auth/jwt.ts
 function resolveJwtSecret(secret) {
-  return secret?.trim() || process.env.JWT_SECRET?.trim() || process.env.SESSION_SECRET?.trim() || appDevSecret("jwt-secret");
+  if (secret?.trim()) {
+    return secret.trim();
+  }
+  return requireConfiguredSecret(["JWT_SECRET", "SESSION_SECRET"], "jwt-secret");
 }
 function jwtTtlSeconds(override) {
   if (typeof override === "number" && Number.isInteger(override) && override > 0) {
@@ -642,6 +706,9 @@ function configureMembershipLookup(lookup) {
 function resolveMembershipLookup() {
   return membershipRepository;
 }
+function resetMembershipLookupForTests() {
+  membershipRepository = uninitializedMembershipLookup;
+}
 async function runWithMembershipContext(callback) {
   const user = currentAuthUser();
   if (!user || isGlobalAdmin(user)) {
@@ -1101,6 +1168,11 @@ function getDefaultDatabaseQuery() {
   }
   return query;
 }
+function resetDefaultDatabasePoolForTests() {
+  const holder = defaultConnectionState();
+  holder.pool = null;
+  holder.query = null;
+}
 
 // ../../src/core/security/timingSafeCompare.ts
 import { timingSafeEqual as timingSafeEqual2 } from "crypto";
@@ -2215,6 +2287,14 @@ function appendWhereParts(tableName, where, params) {
   }
   return clauses.join(" AND ");
 }
+function buildWhereClause(tableName, where = {}) {
+  const params = [];
+  const body = appendWhereParts(tableName, where, params);
+  return {
+    clause: body.length > 0 ? ` WHERE ${body}` : "",
+    params
+  };
+}
 function remapExistsSql(sql, existsParams, params) {
   const offset = params.length;
   params.push(...existsParams);
@@ -5211,8 +5291,55 @@ function registerModelRepository(model, repository) {
   ensureBooted(model);
   return model;
 }
+// ../../src/core/runtime/optionalPeer.ts
+function missingOptionalPeer(packageName, reason, error) {
+  return new Error(`Install ${packageName} ${reason} (\`bun add ${packageName}\`).`, {
+    cause: error
+  });
+}
+
 // ../../src/core/database/mysqlConnection.ts
-import mysql from "mysql2/promise";
+var MYSQL_SESSION_UTC = "SET time_zone = '+00:00'";
+var mysqlModule;
+var mysqlPending;
+var importMysql = defaultImportMysql;
+async function defaultImportMysql() {
+  return import("mysql2/promise");
+}
+function mysqlApi(mod) {
+  if (typeof mod.createPool === "function") {
+    return mod;
+  }
+  const withDefault = mod;
+  if (typeof withDefault.default?.createPool === "function") {
+    return withDefault.default;
+  }
+  throw new Error("mysql2/promise did not export createPool.");
+}
+async function loadMysql() {
+  if (mysqlModule) {
+    return mysqlModule;
+  }
+  if (!mysqlPending) {
+    mysqlPending = (async () => {
+      let mod;
+      try {
+        mod = await importMysql();
+      } catch (error) {
+        mysqlPending = undefined;
+        throw missingOptionalPeer("mysql2", "to open a MySQL connection", error);
+      }
+      try {
+        mysqlModule = mysqlApi(mod);
+        return mysqlModule;
+      } catch (error) {
+        mysqlPending = undefined;
+        throw error;
+      }
+    })();
+  }
+  return mysqlPending;
+}
 function rowsFromResult(result) {
   if (Array.isArray(result)) {
     return result;
@@ -5235,7 +5362,6 @@ function createMysqlConnectionFromPool(pool) {
     }
   };
 }
-var MYSQL_SESSION_UTC = "SET time_zone = '+00:00'";
 function pinSessionToUtc(connection) {
   connection.query(MYSQL_SESSION_UTC, (error) => {
     if (error) {
@@ -5243,18 +5369,47 @@ function pinSessionToUtc(connection) {
     }
   });
 }
-function createMysqlPool(url) {
+function createPoolFromModule(mysql, url) {
   const pool = mysql.createPool({ uri: url, timezone: "Z" });
   pool.on("connection", (connection) => {
     pinSessionToUtc(connection);
   });
   return pool;
 }
+async function createMysqlPool(url) {
+  return createPoolFromModule(await loadMysql(), url);
+}
 function createMysqlConnection(url) {
   if (!url.trim()) {
     throw new Error("MYSQL_URL is not configured. Set url before creating a MySQL pool.");
   }
-  return createMysqlConnectionFromPool(createMysqlPool(url));
+  let poolPending;
+  function ensurePool() {
+    if (!poolPending) {
+      poolPending = createMysqlPool(url).catch((error) => {
+        poolPending = undefined;
+        throw error;
+      });
+    }
+    return poolPending;
+  }
+  return {
+    async unsafe(query, params = []) {
+      const [result] = await (await ensurePool()).execute(query, [...params]);
+      return rowsFromResult(result);
+    },
+    async close() {
+      if (!poolPending) {
+        return;
+      }
+      const pending = poolPending;
+      poolPending = undefined;
+      const pool = await pending.catch(() => {
+        return;
+      });
+      await pool?.end();
+    }
+  };
 }
 // ../../src/core/database/namedConnections.ts
 var REGISTRY_KEY = Symbol.for("@getstrata/namedConnections");
@@ -6568,6 +6723,9 @@ function generateCspNonce() {
 function configureContentSecurityPolicy(options) {
   configuredHtmlOptions = { ...options };
 }
+function resetContentSecurityPolicyForTests() {
+  configuredHtmlOptions = {};
+}
 function cloneDirectives(source) {
   const copy = {};
   for (const [directive, values] of Object.entries(source)) {
@@ -6678,11 +6836,6 @@ function readRequestCookie(request, name) {
 function readBunRequestCookie(request, name) {
   return request.cookies.get(name) ?? readRequestCookie(request, name);
 }
-// ../../src/core/runtime/appEnv.ts
-function isProductionEnv(env = process.env) {
-  return env.APP_ENV === "production" || env.NODE_ENV === "production";
-}
-
 // ../../src/core/http/corsMiddleware.ts
 function defaultAllowedOrigins() {
   return isProductionEnv() ? "" : "*";
@@ -6748,7 +6901,7 @@ function csrfCookieName() {
   return process.env.CSRF_COOKIE_NAME?.trim() || appCookieName("csrf");
 }
 function resolveCsrfSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || appDevSecret("csrf-secret");
+  return requireConfiguredSecret(["SESSION_SECRET", "OAUTH_STATE_SECRET", "ADMIN_API_TOKEN"], "csrf-secret");
 }
 function csrfVerifyOptions() {
   return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
@@ -6763,7 +6916,7 @@ function tokensMatch(left, right) {
 }
 function createCsrfTokenCookie() {
   const token = Bun.CSRF.generate(resolveCsrfSecret(), { expiresIn: CSRF_TTL_MS });
-  const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
+  const secure = isProductionEnv() ? "; Secure" : "";
   return {
     token,
     cookie: `${csrfCookieName()}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`
@@ -6883,7 +7036,7 @@ function flashCookieName() {
   return process.env.FLASH_COOKIE_NAME?.trim() || appCookieName("flash");
 }
 function resolveFlashSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || appDevSecret("flash-secret");
+  return requireConfiguredSecret(["SESSION_SECRET", "OAUTH_STATE_SECRET"], "flash-secret");
 }
 function signFlashPayload(payload, issuedAt) {
   const signature = createHmac2("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
@@ -6993,6 +7146,49 @@ function getQueryParams(request) {
   }
   return new URL(request.url).searchParams;
 }
+function parseOptionalPositiveIntQueryParam(params, name) {
+  const value = params.get(name);
+  if (value === null || value.trim() === "") {
+    return;
+  }
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new BadRequestError(`Invalid query parameter "${name}". Expected a positive integer.`);
+  }
+  return parsed;
+}
+function parseOptionalBooleanQueryParam(params, name) {
+  const value = params.get(name);
+  if (value === null || value.trim() === "") {
+    return;
+  }
+  switch (value.toLowerCase()) {
+    case "true":
+    case "1":
+      return true;
+    case "false":
+    case "0":
+      return false;
+    default:
+      throw new BadRequestError(`Invalid query parameter "${name}". Expected a boolean.`);
+  }
+}
+function parseOptionalEnumQueryParam(params, name, allowedValues) {
+  const value = params.get(name);
+  if (value === null || value.trim() === "") {
+    return;
+  }
+  if (!allowedValues.includes(value)) {
+    throw new BadRequestError(`Invalid query parameter "${name}". Expected one of: ${allowedValues.join(", ")}.`);
+  }
+  return value;
+}
+function expectObject(value, label = "request body") {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new BadRequestError(`${label} must be a JSON object.`);
+  }
+  return value;
+}
 async function parseJsonBody(request, validator) {
   let payload;
   try {
@@ -7002,6 +7198,55 @@ async function parseJsonBody(request, validator) {
   }
   return validator(payload);
 }
+function readRequiredString(payload, field, options = {}) {
+  const value = payload[field];
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new BadRequestError(`"${field}" is required and must be a string.`);
+  }
+  const trimmed = value.trim();
+  if (options.minLength !== undefined && trimmed.length < options.minLength) {
+    throw new BadRequestError(`"${field}" must be at least ${options.minLength} characters.`);
+  }
+  if (options.maxLength !== undefined && trimmed.length > options.maxLength) {
+    throw new BadRequestError(`"${field}" must be at most ${options.maxLength} characters.`);
+  }
+  if (options.pattern && !options.pattern.test(trimmed)) {
+    throw new BadRequestError(`"${field}" has an invalid format.`);
+  }
+  return trimmed;
+}
+function readOptionalString(payload, field, options = {}) {
+  if (!(field in payload) || payload[field] === undefined) {
+    return;
+  }
+  return readRequiredString(payload, field, options);
+}
+function readRequiredEnum(payload, field, allowedValues) {
+  const value = readRequiredString(payload, field);
+  if (!allowedValues.includes(value)) {
+    throw new BadRequestError(`"${field}" must be one of: ${allowedValues.join(", ")}.`);
+  }
+  return value;
+}
+function readOptionalEnum(payload, field, allowedValues) {
+  if (!(field in payload) || payload[field] === undefined) {
+    return;
+  }
+  return readRequiredEnum(payload, field, allowedValues);
+}
+function readRequiredPositiveInt(payload, field) {
+  const value = payload[field];
+  if (typeof value !== "number" || !Number.isInteger(value) || value <= 0) {
+    throw new BadRequestError(`"${field}" is required and must be a positive integer.`);
+  }
+  return value;
+}
+function readOptionalPositiveInt(payload, field) {
+  if (!(field in payload) || payload[field] === undefined) {
+    return;
+  }
+  return readRequiredPositiveInt(payload, field);
+}
 function parsePositiveIntParam(value, name = "id") {
   const parsed = Number.parseInt(value, 10);
   if (!Number.isInteger(parsed) || parsed <= 0) {
@@ -7022,6 +7267,12 @@ class FormRequest {
     return await parseJsonBody(request, (payload) => this.parse(payload));
   }
 }
+
+class QueryFormRequest {
+  validate(request) {
+    return this.parseQuery(request);
+  }
+}
 // ../../src/core/http/authMiddleware.ts
 function createAuthMiddleware(auth) {
   return async (request, next) => {
@@ -7584,6 +7835,10 @@ function withErrorHandling(handler) {
     }
   };
 }
+// ../../src/core/http/route.ts
+function getRouteParams(request) {
+  return request.params;
+}
 // ../../src/core/http/routeMiddleware.ts
 function withMiddleware(...middleware) {
   const wrap = composeMiddleware(...middleware);
@@ -7757,6 +8012,9 @@ function createLoginThrottleMiddleware(options) {
   }
   return createMemoryLoginThrottleMiddleware(options);
 }
+function resetMemoryLoginThrottleForTests() {
+  memoryLoginBuckets.clear();
+}
 // ../../src/core/http/memoryThrottleMiddleware.ts
 var throttleBucketRegistries = new Set;
 function createMemoryThrottleMiddleware(options) {
@@ -7944,7 +8202,7 @@ function intendedUrlTtlSeconds() {
   return Number.isInteger(parsed) && parsed > 0 ? parsed : DEFAULT_INTENDED_URL_TTL_SECONDS;
 }
 function cookieSecureFlag() {
-  return process.env.APP_ENV === "production" ? "; Secure" : "";
+  return isProductionEnv() ? "; Secure" : "";
 }
 function pathnameOf(path) {
   const pathname = path.split("?")[0] ?? path;
@@ -8065,7 +8323,7 @@ function createSecurityHeadersMiddleware(options = {}) {
 // ../../src/core/http/signedUrl.ts
 import { createHmac as createHmac3 } from "crypto";
 function resolveSignedUrlSecret() {
-  return process.env.SIGNED_URL_SECRET?.trim() || process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || appDevSecret("signed-url-secret");
+  return requireConfiguredSecret(["SIGNED_URL_SECRET", "SESSION_SECRET", "OAUTH_STATE_SECRET"], "signed-url-secret");
 }
 function resolveSignedUrlOrigin() {
   return (process.env.APP_URL ?? "http://localhost:3000").replace(/\/$/, "");
@@ -8264,6 +8522,11 @@ function installGracefulShutdownSignals(signals = ["SIGINT", "SIGTERM"]) {
     });
   }
 }
+function resetGracefulShutdownForTests() {
+  shutdownHandlers.clear();
+  shutdownInstalled = false;
+  shuttingDown = false;
+}
 // ../../src/core/logging/requestLoggingMiddleware.ts
 function createRequestLoggingMiddleware() {
   return async (request, next) => {
@@ -8509,6 +8772,42 @@ class AsyncQueue {
 function createQueue(driver) {
   return driver === "async" ? new AsyncQueue : new SyncQueue;
 }
+// ../../src/core/queue/jobRegistry.ts
+class JobRegistry {
+  factories = new Map;
+  instances = new WeakMap;
+  register(name, factory) {
+    this.factories.set(name, factory);
+  }
+  resolveName(job) {
+    return this.instances.get(job);
+  }
+  track(name, job) {
+    this.instances.set(job, name);
+    return job;
+  }
+  create(name) {
+    const factory = this.factories.get(name);
+    if (!factory) {
+      return;
+    }
+    return factory();
+  }
+  names() {
+    return [...this.factories.keys()];
+  }
+}
+var JOB_REGISTRY_KEY = Symbol.for("@getstrata/jobRegistry");
+function readSharedJobRegistry() {
+  const globalRegistry = globalThis[JOB_REGISTRY_KEY];
+  if (globalRegistry) {
+    return globalRegistry;
+  }
+  const registry = new JobRegistry;
+  globalThis[JOB_REGISTRY_KEY] = registry;
+  return registry;
+}
+var jobRegistry = readSharedJobRegistry();
 // ../../src/core/queue/failedJobTable.ts
 var failedJobTable = defineTable({
   name: "failed_job",
@@ -8569,43 +8868,6 @@ class FailedJobService {
 }
 var failedJobService_default = FailedJobService;
 
-// ../../src/core/queue/jobRegistry.ts
-class JobRegistry {
-  factories = new Map;
-  instances = new WeakMap;
-  register(name, factory) {
-    this.factories.set(name, factory);
-  }
-  resolveName(job) {
-    return this.instances.get(job);
-  }
-  track(name, job) {
-    this.instances.set(job, name);
-    return job;
-  }
-  create(name) {
-    const factory = this.factories.get(name);
-    if (!factory) {
-      return;
-    }
-    return factory();
-  }
-  names() {
-    return [...this.factories.keys()];
-  }
-}
-var JOB_REGISTRY_KEY = Symbol.for("@getstrata/jobRegistry");
-function readSharedJobRegistry() {
-  const globalRegistry = globalThis[JOB_REGISTRY_KEY];
-  if (globalRegistry) {
-    return globalRegistry;
-  }
-  const registry = new JobRegistry;
-  globalThis[JOB_REGISTRY_KEY] = registry;
-  return registry;
-}
-var jobRegistry = readSharedJobRegistry();
-
 // ../../src/core/queue/queueConfig.ts
 function resolveQueueConfig() {
   const driver = process.env.QUEUE_DRIVER;
@@ -8952,20 +9214,131 @@ function isPublicReadsEnabled() {
 function guestCanViewResource() {
   return isPublicReadsEnabled();
 }
+// ../../src/core/security/safeUrl.ts
+import { lookup as dnsLookupImpl } from "dns/promises";
+var dnsLookup = dnsLookupImpl;
+var BLOCKED_HOSTNAMES = new Set([
+  "localhost",
+  "127.0.0.1",
+  "0.0.0.0",
+  "::1",
+  "metadata.google.internal"
+]);
+function isPrivateIpv4(hostname) {
+  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
+  if (!match) {
+    return false;
+  }
+  const octets = match.slice(1, 5).map((part) => Number.parseInt(part, 10));
+  if (octets.some((octet) => octet < 0 || octet > 255)) {
+    return true;
+  }
+  const [a = 0, b = 0] = octets;
+  if (a === 10) {
+    return true;
+  }
+  if (a === 127) {
+    return true;
+  }
+  if (a === 0) {
+    return true;
+  }
+  if (a === 169 && b === 254) {
+    return true;
+  }
+  if (a === 172 && b >= 16 && b <= 31) {
+    return true;
+  }
+  if (a === 192 && b === 168) {
+    return true;
+  }
+  return false;
+}
+function isBlockedHostname(hostname) {
+  const normalized = hostname.trim().toLowerCase();
+  if (normalized.length === 0) {
+    return true;
+  }
+  if (BLOCKED_HOSTNAMES.has(normalized)) {
+    return true;
+  }
+  if (normalized.endsWith(".local") || normalized.endsWith(".internal")) {
+    return true;
+  }
+  if (normalized.includes(":")) {
+    return true;
+  }
+  return isPrivateIpv4(normalized);
+}
+function assertSafeOutboundUrl(rawUrl, options = {}) {
+  let parsed;
+  try {
+    parsed = new URL(rawUrl);
+  } catch {
+    throw new BadRequestError("Webhook URL is invalid.");
+  }
+  if (parsed.protocol !== "https:" && !(options.allowHttp && parsed.protocol === "http:")) {
+    throw new BadRequestError("Webhook URL must use HTTPS.");
+  }
+  if (parsed.username || parsed.password) {
+    throw new BadRequestError("Webhook URL must not include credentials.");
+  }
+  if (isBlockedHostname(parsed.hostname)) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  return parsed;
+}
+function isBlockedIpAddress(address) {
+  return isBlockedHostname(address.trim().toLowerCase());
+}
+async function assertSafeOutboundUrlResolved(rawUrl, options = {}) {
+  const parsed = assertSafeOutboundUrl(rawUrl, options);
+  if (options.resolveDns === false) {
+    return parsed;
+  }
+  const hostname = parsed.hostname.trim().toLowerCase();
+  const results = await dnsLookup(hostname, { all: true, verbatim: true });
+  if (results.some((result) => isBlockedIpAddress(result.address))) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  return parsed;
+}
+function setDnsLookupForTests(lookupFn) {
+  dnsLookup = lookupFn;
+}
+function resetDnsLookupForTests() {
+  dnsLookup = dnsLookupImpl;
+}
 // ../../src/core/tenant/tenantMiddleware.ts
 import { createHash } from "crypto";
 
 // ../../src/core/tenant/databaseTenantContext.ts
+async function applyBypassToTransaction(transaction, bypass) {
+  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, [
+    bypass ? "true" : "false"
+  ]);
+}
 async function runWithMigrationBypass(callback) {
   if (!isRlsTenancy()) {
     return await callback();
   }
-  await repositoryConnection`SELECT set_config('app.bypass_rls', 'true', false)`;
-  try {
-    return await callback();
-  } finally {
-    await repositoryConnection`SELECT set_config('app.bypass_rls', 'false', false)`;
+  if (hasActiveDatabaseConnection()) {
+    const activeConnection = getActiveDatabaseConnection(getDefaultDatabasePool());
+    await applyBypassToTransaction(activeConnection, true);
+    try {
+      return await callback();
+    } finally {
+      await applyBypassToTransaction(activeConnection, false);
+    }
   }
+  const pool = getDefaultDatabasePool();
+  if (typeof pool.begin !== "function") {
+    throw new Error("RLS migration bypass requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
+  }
+  return await pool.begin(async (transaction) => {
+    await applyBypassToTransaction(transaction, true);
+    return await runWithDatabaseConnection(transaction, callback);
+  });
 }
 
 // ../../src/core/tenant/tenantMiddleware.ts
@@ -9229,7 +9602,6 @@ function validateObject(payload, schema) {
 }
 // ../../src/core/view/etaViewEngine.ts
 import { join as join4, relative } from "path";
-import { Eta } from "eta";
 
 // ../../src/core/view/assertEtaHtmlSource.ts
 var HTML_TAGS = new Set([
@@ -9409,33 +9781,57 @@ var DEFAULT_VIEWS_DIRECTORY = join4(process.cwd(), "resources/views");
 var DEFAULT_LAYOUT = "layouts/app.eta";
 
 class EtaViewEngine {
-  eta;
+  eta = null;
+  etaPending = null;
+  viewsDirectory;
   resolveLayoutData;
   constructor(viewsDirectory = DEFAULT_VIEWS_DIRECTORY, resolveLayoutData) {
-    this.eta = new Eta({
-      views: viewsDirectory,
-      autoTrim: false
-    });
+    this.viewsDirectory = viewsDirectory;
     this.resolveLayoutData = resolveLayoutData;
-    const readFile = this.eta.readFile?.bind(this.eta);
-    this.eta.readFile = (path) => {
+  }
+  async getEta() {
+    if (this.eta) {
+      return this.eta;
+    }
+    if (!this.etaPending) {
+      this.etaPending = this.createEta();
+    }
+    return this.etaPending;
+  }
+  async createEta() {
+    let eta;
+    try {
+      const mod = await import("eta");
+      eta = new mod.Eta({
+        views: this.viewsDirectory,
+        autoTrim: false
+      });
+    } catch (error) {
+      this.etaPending = null;
+      throw missingOptionalPeer("eta", "to render HTML views", error);
+    }
+    const readFile = eta.readFile?.bind(eta);
+    eta.readFile = (path) => {
       const source = readFile ? readFile(path) : "";
-      assertEtaHtmlSource(relative(viewsDirectory, path) || path, source);
+      assertEtaHtmlSource(relative(this.viewsDirectory, path) || path, source);
       return source;
     };
+    this.eta = eta;
+    return eta;
   }
   async render(name, data = {}, options = {}) {
     const template = name.endsWith(".eta") ? name : `${name}.eta`;
     const request = options.request ?? currentRequestMeta().request;
     const layoutData = this.resolveLayoutData ? await this.resolveLayoutData(request) : {};
     const mergedData = { ...layoutData, ...data };
-    const body = await this.eta.renderAsync(template, mergedData);
+    const eta = await this.getEta();
+    const body = await eta.renderAsync(template, mergedData);
     const layout = options.layout ?? DEFAULT_LAYOUT;
     if (layout === false) {
       return body;
     }
     const layoutTemplate = layout.endsWith(".eta") ? layout : `${layout}.eta`;
-    return await this.eta.renderAsync(layoutTemplate, {
+    return await eta.renderAsync(layoutTemplate, {
       ...mergedData,
       body
     });
@@ -9510,6 +9906,7 @@ export {
   CompositeGuard,
   ConfigStore,
   ConflictError,
+  DEFAULT_PER_PAGE,
   DEFAULT_TENANT,
   DEFAULT_VIEWS_DIRECTORY,
   DatabaseTokenGuard,
@@ -9522,15 +9919,19 @@ export {
   ForeignIdColumnDefinition,
   FormRequest,
   GuestGuard,
+  HTMX_2_0_4_INDICATOR_STYLE_HASH,
   HasManyRelationQuery,
+  HasManyThroughRelationQuery,
   HasOneRelationQuery,
   HttpError,
   InternalServerError,
   Job,
+  JobRegistry,
   JsonResource,
   JwtGuard,
   LocalStorageDriver,
   LogMailDriver,
+  MAX_PER_PAGE,
   Mailer,
   membershipService_default as MembershipService,
   Model,
@@ -9548,6 +9949,7 @@ export {
   PostgresGrammar,
   PreconditionFailedError,
   PrometheusRegistry,
+  QueryFormRequest,
   QueueWorker,
   RedisQueue,
   RepositoryQuery,
@@ -9566,7 +9968,15 @@ export {
   WebFormRequest,
   WhereBuilder,
   absoluteTemporarySignedUrl,
+  apiPrefix,
+  appCookieName,
+  appDevSecret,
+  appDisplayName,
+  appEnv,
+  appKeyPrefix,
   appSchedule,
+  appUrl,
+  appUserAgent,
   appendOrganizationScope,
   appendProjectScope,
   applyCasts,
@@ -9575,6 +9985,8 @@ export {
   assertIfMatch,
   assertOrganizationReadable,
   assertResourceInCurrentTenant,
+  assertSafeOutboundUrl,
+  assertSafeOutboundUrlResolved,
   assertValidSignature,
   auditChecksum,
   auth,
@@ -9584,13 +9996,29 @@ export {
   bindBunSql,
   bindDatabaseConnection,
   bindRouteModel,
+  buildAdvancedWhereClause,
+  buildCountQuery,
+  buildDeleteByIdQuery,
+  buildGroupedCountQuery,
+  buildInsertQuery,
+  buildJoinClause,
   buildMarkdownMailMessage,
+  buildOrderByClause,
+  buildPaginationMeta,
+  buildProjectionQuery,
+  buildQueryWhereClause,
   buildRequestCacheKey,
+  buildRestoreByIdQuery,
+  buildSelectQuery,
   buildSmtpPayload,
+  buildSoftDeleteByIdQuery,
+  buildUpdateQuery,
+  buildWhereClause,
   cache,
   collectQueueMetrics,
   compileBlueprint,
   composeMiddleware,
+  computeEtagFromJson,
   conditionalJsonResponse,
   config,
   configureContentSecurityPolicy,
@@ -9612,6 +10040,7 @@ export {
   createFlashMiddleware,
   createLoginThrottleMiddleware,
   createMembershipMiddleware,
+  createMemoryLoginThrottleMiddleware,
   createMemoryThrottleMiddleware,
   createMetricsMiddleware,
   createMysqlConnection,
@@ -9652,10 +10081,14 @@ export {
   dialectFor,
   emailRule,
   emptyPaginateResult,
+  envFlagEnabled,
+  errorResponse,
   errorTemplateName,
   etagFromResource,
+  etagValuesMatch,
   eventBus,
   events,
+  expectObject,
   filterMassAssignable,
   foreignKeyFromTable,
   formatAdminValue,
@@ -9667,10 +10100,13 @@ export {
   getDefaultDatabaseQuery,
   getMigrationStatus,
   getNamedConnection,
+  getQueryParams,
+  getRouteParams,
   grammarForDriver,
   guestCanViewResource,
   hasActiveDatabaseConnection,
   hasMany,
+  hasManyThrough,
   hasMinimumOrgRole2 as hasMinimumOrgRole,
   hasNamedConnection,
   hasOne,
@@ -9679,20 +10115,26 @@ export {
   htmlErrorResponse,
   htmlResponse,
   hydrateValue,
+  ifMatchSatisfied,
+  ifNoneMatchSatisfied,
   indexBelongsToManyRelation,
   indexBelongsToRelation,
   indexHasManyRelation,
+  indexHasManyThroughRelation,
   indexHasOneRelation,
   indexMorphManyRelation,
   indexMorphOneRelation,
   indexMorphToRelation,
   inferReferencedTable,
   installGracefulShutdownSignals,
+  isBlockedHostname,
+  isBlockedIpAddress,
   isEtagEnabled,
   isGlobalAdmin,
   isHtmxRequest,
   isHttpErrorLike,
   isInsideTenantDatabaseScope,
+  isProductionEnv,
   isPublicReadsEnabled,
   isRlsTenancy,
   isTenancyEnabled,
@@ -9703,32 +10145,54 @@ export {
   loadSeedersFromDirectory,
   log,
   logSecurityEvent,
+  logServerError,
   loginRedirectLocation,
   mail,
   mailer,
+  mapDatabaseError,
   markdownToHtml,
   maxLength,
+  membershipContext,
+  membershipRepository,
   migrateDatabase,
   minLength,
   modelEventName,
   morphMany,
   morphOne,
   morphTo,
+  namespacedRedisKey,
   noContentResponse,
+  normalizeFieldErrors,
   normalizeMetricPath,
   notFoundHtmlResponse,
+  notModifiedResponse,
+  otelServiceName,
   paginatedResponse,
+  parseJsonBody,
   parseMultipartUpload,
+  parseOptionalBooleanQueryParam,
+  parseOptionalEnumQueryParam,
+  parseOptionalPositiveIntQueryParam,
   parsePaginationQuery,
   parsePositiveIntParam,
+  parseQualifiedColumn,
   pivotTableName,
   policyGate,
   prometheusRegistry,
+  qualifyColumn,
   queue,
+  quoteIdentifier,
   rateLimitMultiplierForPlan,
   readBunRequestCookie,
   readClientIp,
+  readOptionalEnum,
+  readOptionalPositiveInt,
+  readOptionalString,
   readRequestCookie,
+  readRequiredEnum,
+  readRequiredPositiveInt,
+  readRequiredString,
+  readSharedEventBus,
   readSubmittedCsrfToken,
   readSubmittedCsrfTokenFromBody,
   readTenancyDriver,
@@ -9740,11 +10204,20 @@ export {
   registerShutdownHandler,
   renderKernelErrorChrome,
   renderMarkdownMail,
+  renderWebErrorHtml,
   repositoryConnection,
   requestIdMiddleware,
+  requestMetaContext,
+  requireConfiguredSecret,
   required,
   resetBoundDatabaseConnection,
+  resetContentSecurityPolicyForTests,
+  resetDefaultDatabasePoolForTests,
   resetDefaultStorage,
+  resetDnsLookupForTests,
+  resetGracefulShutdownForTests,
+  resetMembershipLookupForTests,
+  resetMemoryLoginThrottleForTests,
   resetMemoryThrottleForTests,
   resetNamedConnections,
   resetSqlDialect,
@@ -9761,11 +10234,15 @@ export {
   resolveCsrfTokenForRequest,
   resolveDatabaseDriver,
   resolveHtmlContentSecurityPolicy,
+  resolveLoginEmail,
+  resolveLoginIdentity,
   resolveMembershipLookup,
   resolveMembershipService,
   resolveOrganizationScope,
+  resolveQualifiedColumn,
   resolveRepositoryConnection,
   resolveService,
+  resolveSoftDeleteColumn,
   resolveUserId,
   resolveUserTenantId,
   resolveWebLayoutData,
@@ -9788,16 +10265,21 @@ export {
   safeInternalRedirectPath,
   sanitizeInternalPath,
   sanitizeMailHtml,
+  sanitizeUploadFileName,
   scopedOrganizationIds,
+  sdkClientClassName,
   securedBindRouteModel,
   securedBindRouteModelByKey,
   sendMarkdownMail,
   serializeDate,
   serverHtmxContentSecurityPolicy,
   setActiveApplicationContext,
+  setDnsLookupForTests,
+  siemEventType,
   signJwt,
   signedUrl,
   singularize,
+  smtpEhloHost,
   spaContentSecurityPolicy,
   sqlTimestamp,
   storageFacade as storage,
@@ -9805,17 +10287,22 @@ export {
   stringRule,
   stripMarkdown,
   temporarySignedUrl,
+  tenantContext,
   textResponse,
   toHttpError,
   toPaginatedResourceCollection,
   toResourceCollection,
+  traceContextStorage,
   trustForwardedFor,
   unregisterNamedConnection,
   useSqlDialect,
   validateObject,
   verifyCsrfToken,
   verifyJwt,
+  webErrorResponse,
+  webhookSignatureHeader,
   whenLoaded,
+  withDatabaseErrorHandling,
   withErrorHandling,
   withMiddleware,
   withMigrationLock,