@getstrata/core 1.0.3 → 1.0.5

package/dist/index.js

@@ -490,6 +490,26 @@ class AuthManager {
 // ../../src/core/auth/jwt.ts
 import { createHmac, timingSafeEqual } from "crypto";
 
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/runtime/appKeyPrefix.ts
 function appKeyPrefix() {
   return process.env.APP_KEY_PREFIX?.trim() || "strata";
@@ -500,6 +520,18 @@ function appCookieName(kind) {
 function appDevSecret(kind) {
   return `${appKeyPrefix()}-dev-${kind}`;
 }
+function requireConfiguredSecret(names, devKind, env = process.env) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  if (isProductionEnv(env)) {
+    throw new Error(`${names[0]} must be set outside development. Do not derive secrets from the app name.`);
+  }
+  return appDevSecret(devKind);
+}
 function namespacedRedisKey(kind) {
   return `${appKeyPrefix()}:${kind}`;
 }
@@ -508,16 +540,48 @@ function smtpEhloHost() {
   const safe = raw.replace(/[^a-zA-Z0-9.-]/g, "");
   return safe || "strata.local";
 }
+function siemEventType() {
+  return process.env.SIEM_EVENT_TYPE?.trim() || `${appKeyPrefix()}.audit`;
+}
+function appUserAgent() {
+  return process.env.APP_USER_AGENT?.trim() || appKeyPrefix();
+}
 function otelServiceName() {
   return process.env.OTEL_SERVICE_NAME?.trim() || `${appKeyPrefix()}-api`;
 }
+function webhookSignatureHeader() {
+  return process.env.WEBHOOK_SIGNATURE_HEADER?.trim() || `x-${appKeyPrefix()}-signature`;
+}
+function appDisplayName() {
+  return process.env.APP_NAME?.trim() || "Strata";
+}
 function appEnv() {
   return process.env.APP_ENV?.trim() || "local";
 }
+function appUrl() {
+  return (process.env.APP_URL?.trim() || "http://localhost:3000").replace(/\/$/, "");
+}
+function apiPrefix() {
+  const raw = process.env.API_PREFIX?.trim() || "/api/v1";
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  return trimmed || "/api/v1";
+}
+function sdkClientClassName() {
+  const override = process.env.APP_SDK_CLASS?.trim();
+  if (override && /^[A-Za-z_][A-Za-z0-9_]*$/.test(override)) {
+    return override;
+  }
+  const fromName = appDisplayName().replace(/[^A-Za-z0-9]/g, "");
+  return fromName ? `${fromName}Client` : "AppClient";
+}
 
 // ../../src/core/auth/jwt.ts
 function resolveJwtSecret(secret) {
-  return secret?.trim() || process.env.JWT_SECRET?.trim() || process.env.SESSION_SECRET?.trim() || appDevSecret("jwt-secret");
+  if (secret?.trim()) {
+    return secret.trim();
+  }
+  return requireConfiguredSecret(["JWT_SECRET", "SESSION_SECRET"], "jwt-secret");
 }
 function jwtTtlSeconds(override) {
   if (typeof override === "number" && Number.isInteger(override) && override > 0) {
@@ -642,6 +706,9 @@ function configureMembershipLookup(lookup) {
 function resolveMembershipLookup() {
   return membershipRepository;
 }
+function resetMembershipLookupForTests() {
+  membershipRepository = uninitializedMembershipLookup;
+}
 async function runWithMembershipContext(callback) {
   const user = currentAuthUser();
   if (!user || isGlobalAdmin(user)) {
@@ -1101,6 +1168,11 @@ function getDefaultDatabaseQuery() {
   }
   return query;
 }
+function resetDefaultDatabasePoolForTests() {
+  const holder = defaultConnectionState();
+  holder.pool = null;
+  holder.query = null;
+}
 
 // ../../src/core/security/timingSafeCompare.ts
 import { timingSafeEqual as timingSafeEqual2 } from "crypto";
@@ -2215,6 +2287,14 @@ function appendWhereParts(tableName, where, params) {
   }
   return clauses.join(" AND ");
 }
+function buildWhereClause(tableName, where = {}) {
+  const params = [];
+  const body = appendWhereParts(tableName, where, params);
+  return {
+    clause: body.length > 0 ? ` WHERE ${body}` : "",
+    params
+  };
+}
 function remapExistsSql(sql, existsParams, params) {
   const offset = params.length;
   params.push(...existsParams);
@@ -5226,6 +5306,11 @@ var importMysql = defaultImportMysql;
 async function defaultImportMysql() {
   return import("mysql2/promise");
 }
+function resetMysqlLoaderForTests(importer) {
+  mysqlModule = undefined;
+  mysqlPending = undefined;
+  importMysql = importer ? async () => await importer() : defaultImportMysql;
+}
 function mysqlApi(mod) {
   if (typeof mod.createPool === "function") {
     return mod;
@@ -6643,6 +6728,9 @@ function generateCspNonce() {
 function configureContentSecurityPolicy(options) {
   configuredHtmlOptions = { ...options };
 }
+function resetContentSecurityPolicyForTests() {
+  configuredHtmlOptions = {};
+}
 function cloneDirectives(source) {
   const copy = {};
   for (const [directive, values] of Object.entries(source)) {
@@ -6753,11 +6841,6 @@ function readRequestCookie(request, name) {
 function readBunRequestCookie(request, name) {
   return request.cookies.get(name) ?? readRequestCookie(request, name);
 }
-// ../../src/core/runtime/appEnv.ts
-function isProductionEnv(env = process.env) {
-  return env.APP_ENV === "production" || env.NODE_ENV === "production";
-}
-
 // ../../src/core/http/corsMiddleware.ts
 function defaultAllowedOrigins() {
   return isProductionEnv() ? "" : "*";
@@ -6823,7 +6906,7 @@ function csrfCookieName() {
   return process.env.CSRF_COOKIE_NAME?.trim() || appCookieName("csrf");
 }
 function resolveCsrfSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || appDevSecret("csrf-secret");
+  return requireConfiguredSecret(["SESSION_SECRET", "OAUTH_STATE_SECRET", "ADMIN_API_TOKEN"], "csrf-secret");
 }
 function csrfVerifyOptions() {
   return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
@@ -6838,7 +6921,7 @@ function tokensMatch(left, right) {
 }
 function createCsrfTokenCookie() {
   const token = Bun.CSRF.generate(resolveCsrfSecret(), { expiresIn: CSRF_TTL_MS });
-  const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
+  const secure = isProductionEnv() ? "; Secure" : "";
   return {
     token,
     cookie: `${csrfCookieName()}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`
@@ -6958,7 +7041,7 @@ function flashCookieName() {
   return process.env.FLASH_COOKIE_NAME?.trim() || appCookieName("flash");
 }
 function resolveFlashSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || appDevSecret("flash-secret");
+  return requireConfiguredSecret(["SESSION_SECRET", "OAUTH_STATE_SECRET"], "flash-secret");
 }
 function signFlashPayload(payload, issuedAt) {
   const signature = createHmac2("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
@@ -7068,6 +7151,49 @@ function getQueryParams(request) {
   }
   return new URL(request.url).searchParams;
 }
+function parseOptionalPositiveIntQueryParam(params, name) {
+  const value = params.get(name);
+  if (value === null || value.trim() === "") {
+    return;
+  }
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new BadRequestError(`Invalid query parameter "${name}". Expected a positive integer.`);
+  }
+  return parsed;
+}
+function parseOptionalBooleanQueryParam(params, name) {
+  const value = params.get(name);
+  if (value === null || value.trim() === "") {
+    return;
+  }
+  switch (value.toLowerCase()) {
+    case "true":
+    case "1":
+      return true;
+    case "false":
+    case "0":
+      return false;
+    default:
+      throw new BadRequestError(`Invalid query parameter "${name}". Expected a boolean.`);
+  }
+}
+function parseOptionalEnumQueryParam(params, name, allowedValues) {
+  const value = params.get(name);
+  if (value === null || value.trim() === "") {
+    return;
+  }
+  if (!allowedValues.includes(value)) {
+    throw new BadRequestError(`Invalid query parameter "${name}". Expected one of: ${allowedValues.join(", ")}.`);
+  }
+  return value;
+}
+function expectObject(value, label = "request body") {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new BadRequestError(`${label} must be a JSON object.`);
+  }
+  return value;
+}
 async function parseJsonBody(request, validator) {
   let payload;
   try {
@@ -7077,6 +7203,55 @@ async function parseJsonBody(request, validator) {
   }
   return validator(payload);
 }
+function readRequiredString(payload, field, options = {}) {
+  const value = payload[field];
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new BadRequestError(`"${field}" is required and must be a string.`);
+  }
+  const trimmed = value.trim();
+  if (options.minLength !== undefined && trimmed.length < options.minLength) {
+    throw new BadRequestError(`"${field}" must be at least ${options.minLength} characters.`);
+  }
+  if (options.maxLength !== undefined && trimmed.length > options.maxLength) {
+    throw new BadRequestError(`"${field}" must be at most ${options.maxLength} characters.`);
+  }
+  if (options.pattern && !options.pattern.test(trimmed)) {
+    throw new BadRequestError(`"${field}" has an invalid format.`);
+  }
+  return trimmed;
+}
+function readOptionalString(payload, field, options = {}) {
+  if (!(field in payload) || payload[field] === undefined) {
+    return;
+  }
+  return readRequiredString(payload, field, options);
+}
+function readRequiredEnum(payload, field, allowedValues) {
+  const value = readRequiredString(payload, field);
+  if (!allowedValues.includes(value)) {
+    throw new BadRequestError(`"${field}" must be one of: ${allowedValues.join(", ")}.`);
+  }
+  return value;
+}
+function readOptionalEnum(payload, field, allowedValues) {
+  if (!(field in payload) || payload[field] === undefined) {
+    return;
+  }
+  return readRequiredEnum(payload, field, allowedValues);
+}
+function readRequiredPositiveInt(payload, field) {
+  const value = payload[field];
+  if (typeof value !== "number" || !Number.isInteger(value) || value <= 0) {
+    throw new BadRequestError(`"${field}" is required and must be a positive integer.`);
+  }
+  return value;
+}
+function readOptionalPositiveInt(payload, field) {
+  if (!(field in payload) || payload[field] === undefined) {
+    return;
+  }
+  return readRequiredPositiveInt(payload, field);
+}
 function parsePositiveIntParam(value, name = "id") {
   const parsed = Number.parseInt(value, 10);
   if (!Number.isInteger(parsed) || parsed <= 0) {
@@ -7097,6 +7272,12 @@ class FormRequest {
     return await parseJsonBody(request, (payload) => this.parse(payload));
   }
 }
+
+class QueryFormRequest {
+  validate(request) {
+    return this.parseQuery(request);
+  }
+}
 // ../../src/core/http/authMiddleware.ts
 function createAuthMiddleware(auth) {
   return async (request, next) => {
@@ -7659,6 +7840,10 @@ function withErrorHandling(handler) {
     }
   };
 }
+// ../../src/core/http/route.ts
+function getRouteParams(request) {
+  return request.params;
+}
 // ../../src/core/http/routeMiddleware.ts
 function withMiddleware(...middleware) {
   const wrap = composeMiddleware(...middleware);
@@ -7832,6 +8017,9 @@ function createLoginThrottleMiddleware(options) {
   }
   return createMemoryLoginThrottleMiddleware(options);
 }
+function resetMemoryLoginThrottleForTests() {
+  memoryLoginBuckets.clear();
+}
 // ../../src/core/http/memoryThrottleMiddleware.ts
 var throttleBucketRegistries = new Set;
 function createMemoryThrottleMiddleware(options) {
@@ -8019,7 +8207,7 @@ function intendedUrlTtlSeconds() {
   return Number.isInteger(parsed) && parsed > 0 ? parsed : DEFAULT_INTENDED_URL_TTL_SECONDS;
 }
 function cookieSecureFlag() {
-  return process.env.APP_ENV === "production" ? "; Secure" : "";
+  return isProductionEnv() ? "; Secure" : "";
 }
 function pathnameOf(path) {
   const pathname = path.split("?")[0] ?? path;
@@ -8140,7 +8328,7 @@ function createSecurityHeadersMiddleware(options = {}) {
 // ../../src/core/http/signedUrl.ts
 import { createHmac as createHmac3 } from "crypto";
 function resolveSignedUrlSecret() {
-  return process.env.SIGNED_URL_SECRET?.trim() || process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || appDevSecret("signed-url-secret");
+  return requireConfiguredSecret(["SIGNED_URL_SECRET", "SESSION_SECRET", "OAUTH_STATE_SECRET"], "signed-url-secret");
 }
 function resolveSignedUrlOrigin() {
   return (process.env.APP_URL ?? "http://localhost:3000").replace(/\/$/, "");
@@ -8339,6 +8527,11 @@ function installGracefulShutdownSignals(signals = ["SIGINT", "SIGTERM"]) {
     });
   }
 }
+function resetGracefulShutdownForTests() {
+  shutdownHandlers.clear();
+  shutdownInstalled = false;
+  shuttingDown = false;
+}
 // ../../src/core/logging/requestLoggingMiddleware.ts
 function createRequestLoggingMiddleware() {
   return async (request, next) => {
@@ -8584,6 +8777,42 @@ class AsyncQueue {
 function createQueue(driver) {
   return driver === "async" ? new AsyncQueue : new SyncQueue;
 }
+// ../../src/core/queue/jobRegistry.ts
+class JobRegistry {
+  factories = new Map;
+  instances = new WeakMap;
+  register(name, factory) {
+    this.factories.set(name, factory);
+  }
+  resolveName(job) {
+    return this.instances.get(job);
+  }
+  track(name, job) {
+    this.instances.set(job, name);
+    return job;
+  }
+  create(name) {
+    const factory = this.factories.get(name);
+    if (!factory) {
+      return;
+    }
+    return factory();
+  }
+  names() {
+    return [...this.factories.keys()];
+  }
+}
+var JOB_REGISTRY_KEY = Symbol.for("@getstrata/jobRegistry");
+function readSharedJobRegistry() {
+  const globalRegistry = globalThis[JOB_REGISTRY_KEY];
+  if (globalRegistry) {
+    return globalRegistry;
+  }
+  const registry = new JobRegistry;
+  globalThis[JOB_REGISTRY_KEY] = registry;
+  return registry;
+}
+var jobRegistry = readSharedJobRegistry();
 // ../../src/core/queue/failedJobTable.ts
 var failedJobTable = defineTable({
   name: "failed_job",
@@ -8644,43 +8873,6 @@ class FailedJobService {
 }
 var failedJobService_default = FailedJobService;
 
-// ../../src/core/queue/jobRegistry.ts
-class JobRegistry {
-  factories = new Map;
-  instances = new WeakMap;
-  register(name, factory) {
-    this.factories.set(name, factory);
-  }
-  resolveName(job) {
-    return this.instances.get(job);
-  }
-  track(name, job) {
-    this.instances.set(job, name);
-    return job;
-  }
-  create(name) {
-    const factory = this.factories.get(name);
-    if (!factory) {
-      return;
-    }
-    return factory();
-  }
-  names() {
-    return [...this.factories.keys()];
-  }
-}
-var JOB_REGISTRY_KEY = Symbol.for("@getstrata/jobRegistry");
-function readSharedJobRegistry() {
-  const globalRegistry = globalThis[JOB_REGISTRY_KEY];
-  if (globalRegistry) {
-    return globalRegistry;
-  }
-  const registry = new JobRegistry;
-  globalThis[JOB_REGISTRY_KEY] = registry;
-  return registry;
-}
-var jobRegistry = readSharedJobRegistry();
-
 // ../../src/core/queue/queueConfig.ts
 function resolveQueueConfig() {
   const driver = process.env.QUEUE_DRIVER;
@@ -9027,20 +9219,131 @@ function isPublicReadsEnabled() {
 function guestCanViewResource() {
   return isPublicReadsEnabled();
 }
+// ../../src/core/security/safeUrl.ts
+import { lookup as dnsLookupImpl } from "dns/promises";
+var dnsLookup = dnsLookupImpl;
+var BLOCKED_HOSTNAMES = new Set([
+  "localhost",
+  "127.0.0.1",
+  "0.0.0.0",
+  "::1",
+  "metadata.google.internal"
+]);
+function isPrivateIpv4(hostname) {
+  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
+  if (!match) {
+    return false;
+  }
+  const octets = match.slice(1, 5).map((part) => Number.parseInt(part, 10));
+  if (octets.some((octet) => octet < 0 || octet > 255)) {
+    return true;
+  }
+  const [a = 0, b = 0] = octets;
+  if (a === 10) {
+    return true;
+  }
+  if (a === 127) {
+    return true;
+  }
+  if (a === 0) {
+    return true;
+  }
+  if (a === 169 && b === 254) {
+    return true;
+  }
+  if (a === 172 && b >= 16 && b <= 31) {
+    return true;
+  }
+  if (a === 192 && b === 168) {
+    return true;
+  }
+  return false;
+}
+function isBlockedHostname(hostname) {
+  const normalized = hostname.trim().toLowerCase();
+  if (normalized.length === 0) {
+    return true;
+  }
+  if (BLOCKED_HOSTNAMES.has(normalized)) {
+    return true;
+  }
+  if (normalized.endsWith(".local") || normalized.endsWith(".internal")) {
+    return true;
+  }
+  if (normalized.includes(":")) {
+    return true;
+  }
+  return isPrivateIpv4(normalized);
+}
+function assertSafeOutboundUrl(rawUrl, options = {}) {
+  let parsed;
+  try {
+    parsed = new URL(rawUrl);
+  } catch {
+    throw new BadRequestError("Webhook URL is invalid.");
+  }
+  if (parsed.protocol !== "https:" && !(options.allowHttp && parsed.protocol === "http:")) {
+    throw new BadRequestError("Webhook URL must use HTTPS.");
+  }
+  if (parsed.username || parsed.password) {
+    throw new BadRequestError("Webhook URL must not include credentials.");
+  }
+  if (isBlockedHostname(parsed.hostname)) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  return parsed;
+}
+function isBlockedIpAddress(address) {
+  return isBlockedHostname(address.trim().toLowerCase());
+}
+async function assertSafeOutboundUrlResolved(rawUrl, options = {}) {
+  const parsed = assertSafeOutboundUrl(rawUrl, options);
+  if (options.resolveDns === false) {
+    return parsed;
+  }
+  const hostname = parsed.hostname.trim().toLowerCase();
+  const results = await dnsLookup(hostname, { all: true, verbatim: true });
+  if (results.some((result) => isBlockedIpAddress(result.address))) {
+    throw new BadRequestError("Webhook URL targets a blocked host.");
+  }
+  return parsed;
+}
+function setDnsLookupForTests(lookupFn) {
+  dnsLookup = lookupFn;
+}
+function resetDnsLookupForTests() {
+  dnsLookup = dnsLookupImpl;
+}
 // ../../src/core/tenant/tenantMiddleware.ts
 import { createHash } from "crypto";
 
 // ../../src/core/tenant/databaseTenantContext.ts
+async function applyBypassToTransaction(transaction, bypass) {
+  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, [
+    bypass ? "true" : "false"
+  ]);
+}
 async function runWithMigrationBypass(callback) {
   if (!isRlsTenancy()) {
     return await callback();
   }
-  await repositoryConnection`SELECT set_config('app.bypass_rls', 'true', false)`;
-  try {
-    return await callback();
-  } finally {
-    await repositoryConnection`SELECT set_config('app.bypass_rls', 'false', false)`;
+  if (hasActiveDatabaseConnection()) {
+    const activeConnection = getActiveDatabaseConnection(getDefaultDatabasePool());
+    await applyBypassToTransaction(activeConnection, true);
+    try {
+      return await callback();
+    } finally {
+      await applyBypassToTransaction(activeConnection, false);
+    }
   }
+  const pool = getDefaultDatabasePool();
+  if (typeof pool.begin !== "function") {
+    throw new Error("RLS migration bypass requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
+  }
+  return await pool.begin(async (transaction) => {
+    await applyBypassToTransaction(transaction, true);
+    return await runWithDatabaseConnection(transaction, callback);
+  });
 }
 
 // ../../src/core/tenant/tenantMiddleware.ts
@@ -9608,6 +9911,7 @@ export {
   CompositeGuard,
   ConfigStore,
   ConflictError,
+  DEFAULT_PER_PAGE,
   DEFAULT_TENANT,
   DEFAULT_VIEWS_DIRECTORY,
   DatabaseTokenGuard,
@@ -9620,15 +9924,19 @@ export {
   ForeignIdColumnDefinition,
   FormRequest,
   GuestGuard,
+  HTMX_2_0_4_INDICATOR_STYLE_HASH,
   HasManyRelationQuery,
+  HasManyThroughRelationQuery,
   HasOneRelationQuery,
   HttpError,
   InternalServerError,
   Job,
+  JobRegistry,
   JsonResource,
   JwtGuard,
   LocalStorageDriver,
   LogMailDriver,
+  MAX_PER_PAGE,
   Mailer,
   membershipService_default as MembershipService,
   Model,
@@ -9646,6 +9954,7 @@ export {
   PostgresGrammar,
   PreconditionFailedError,
   PrometheusRegistry,
+  QueryFormRequest,
   QueueWorker,
   RedisQueue,
   RepositoryQuery,
@@ -9664,7 +9973,15 @@ export {
   WebFormRequest,
   WhereBuilder,
   absoluteTemporarySignedUrl,
+  apiPrefix,
+  appCookieName,
+  appDevSecret,
+  appDisplayName,
+  appEnv,
+  appKeyPrefix,
   appSchedule,
+  appUrl,
+  appUserAgent,
   appendOrganizationScope,
   appendProjectScope,
   applyCasts,
@@ -9673,6 +9990,8 @@ export {
   assertIfMatch,
   assertOrganizationReadable,
   assertResourceInCurrentTenant,
+  assertSafeOutboundUrl,
+  assertSafeOutboundUrlResolved,
   assertValidSignature,
   auditChecksum,
   auth,
@@ -9682,13 +10001,29 @@ export {
   bindBunSql,
   bindDatabaseConnection,
   bindRouteModel,
+  buildAdvancedWhereClause,
+  buildCountQuery,
+  buildDeleteByIdQuery,
+  buildGroupedCountQuery,
+  buildInsertQuery,
+  buildJoinClause,
   buildMarkdownMailMessage,
+  buildOrderByClause,
+  buildPaginationMeta,
+  buildProjectionQuery,
+  buildQueryWhereClause,
   buildRequestCacheKey,
+  buildRestoreByIdQuery,
+  buildSelectQuery,
   buildSmtpPayload,
+  buildSoftDeleteByIdQuery,
+  buildUpdateQuery,
+  buildWhereClause,
   cache,
   collectQueueMetrics,
   compileBlueprint,
   composeMiddleware,
+  computeEtagFromJson,
   conditionalJsonResponse,
   config,
   configureContentSecurityPolicy,
@@ -9710,6 +10045,7 @@ export {
   createFlashMiddleware,
   createLoginThrottleMiddleware,
   createMembershipMiddleware,
+  createMemoryLoginThrottleMiddleware,
   createMemoryThrottleMiddleware,
   createMetricsMiddleware,
   createMysqlConnection,
@@ -9750,10 +10086,14 @@ export {
   dialectFor,
   emailRule,
   emptyPaginateResult,
+  envFlagEnabled,
+  errorResponse,
   errorTemplateName,
   etagFromResource,
+  etagValuesMatch,
   eventBus,
   events,
+  expectObject,
   filterMassAssignable,
   foreignKeyFromTable,
   formatAdminValue,
@@ -9765,10 +10105,13 @@ export {
   getDefaultDatabaseQuery,
   getMigrationStatus,
   getNamedConnection,
+  getQueryParams,
+  getRouteParams,
   grammarForDriver,
   guestCanViewResource,
   hasActiveDatabaseConnection,
   hasMany,
+  hasManyThrough,
   hasMinimumOrgRole2 as hasMinimumOrgRole,
   hasNamedConnection,
   hasOne,
@@ -9777,20 +10120,26 @@ export {
   htmlErrorResponse,
   htmlResponse,
   hydrateValue,
+  ifMatchSatisfied,
+  ifNoneMatchSatisfied,
   indexBelongsToManyRelation,
   indexBelongsToRelation,
   indexHasManyRelation,
+  indexHasManyThroughRelation,
   indexHasOneRelation,
   indexMorphManyRelation,
   indexMorphOneRelation,
   indexMorphToRelation,
   inferReferencedTable,
   installGracefulShutdownSignals,
+  isBlockedHostname,
+  isBlockedIpAddress,
   isEtagEnabled,
   isGlobalAdmin,
   isHtmxRequest,
   isHttpErrorLike,
   isInsideTenantDatabaseScope,
+  isProductionEnv,
   isPublicReadsEnabled,
   isRlsTenancy,
   isTenancyEnabled,
@@ -9801,32 +10150,54 @@ export {
   loadSeedersFromDirectory,
   log,
   logSecurityEvent,
+  logServerError,
   loginRedirectLocation,
   mail,
   mailer,
+  mapDatabaseError,
   markdownToHtml,
   maxLength,
+  membershipContext,
+  membershipRepository,
   migrateDatabase,
   minLength,
   modelEventName,
   morphMany,
   morphOne,
   morphTo,
+  namespacedRedisKey,
   noContentResponse,
+  normalizeFieldErrors,
   normalizeMetricPath,
   notFoundHtmlResponse,
+  notModifiedResponse,
+  otelServiceName,
   paginatedResponse,
+  parseJsonBody,
   parseMultipartUpload,
+  parseOptionalBooleanQueryParam,
+  parseOptionalEnumQueryParam,
+  parseOptionalPositiveIntQueryParam,
   parsePaginationQuery,
   parsePositiveIntParam,
+  parseQualifiedColumn,
   pivotTableName,
   policyGate,
   prometheusRegistry,
+  qualifyColumn,
   queue,
+  quoteIdentifier,
   rateLimitMultiplierForPlan,
   readBunRequestCookie,
   readClientIp,
+  readOptionalEnum,
+  readOptionalPositiveInt,
+  readOptionalString,
   readRequestCookie,
+  readRequiredEnum,
+  readRequiredPositiveInt,
+  readRequiredString,
+  readSharedEventBus,
   readSubmittedCsrfToken,
   readSubmittedCsrfTokenFromBody,
   readTenancyDriver,
@@ -9838,12 +10209,22 @@ export {
   registerShutdownHandler,
   renderKernelErrorChrome,
   renderMarkdownMail,
+  renderWebErrorHtml,
   repositoryConnection,
   requestIdMiddleware,
+  requestMetaContext,
+  requireConfiguredSecret,
   required,
   resetBoundDatabaseConnection,
+  resetContentSecurityPolicyForTests,
+  resetDefaultDatabasePoolForTests,
   resetDefaultStorage,
+  resetDnsLookupForTests,
+  resetGracefulShutdownForTests,
+  resetMembershipLookupForTests,
+  resetMemoryLoginThrottleForTests,
   resetMemoryThrottleForTests,
+  resetMysqlLoaderForTests,
   resetNamedConnections,
   resetSqlDialect,
   resolveApplicationAuth,
@@ -9859,11 +10240,15 @@ export {
   resolveCsrfTokenForRequest,
   resolveDatabaseDriver,
   resolveHtmlContentSecurityPolicy,
+  resolveLoginEmail,
+  resolveLoginIdentity,
   resolveMembershipLookup,
   resolveMembershipService,
   resolveOrganizationScope,
+  resolveQualifiedColumn,
   resolveRepositoryConnection,
   resolveService,
+  resolveSoftDeleteColumn,
   resolveUserId,
   resolveUserTenantId,
   resolveWebLayoutData,
@@ -9886,16 +10271,21 @@ export {
   safeInternalRedirectPath,
   sanitizeInternalPath,
   sanitizeMailHtml,
+  sanitizeUploadFileName,
   scopedOrganizationIds,
+  sdkClientClassName,
   securedBindRouteModel,
   securedBindRouteModelByKey,
   sendMarkdownMail,
   serializeDate,
   serverHtmxContentSecurityPolicy,
   setActiveApplicationContext,
+  setDnsLookupForTests,
+  siemEventType,
   signJwt,
   signedUrl,
   singularize,
+  smtpEhloHost,
   spaContentSecurityPolicy,
   sqlTimestamp,
   storageFacade as storage,
@@ -9903,17 +10293,22 @@ export {
   stringRule,
   stripMarkdown,
   temporarySignedUrl,
+  tenantContext,
   textResponse,
   toHttpError,
   toPaginatedResourceCollection,
   toResourceCollection,
+  traceContextStorage,
   trustForwardedFor,
   unregisterNamedConnection,
   useSqlDialect,
   validateObject,
   verifyCsrfToken,
   verifyJwt,
+  webErrorResponse,
+  webhookSignatureHeader,
   whenLoaded,
+  withDatabaseErrorHandling,
   withErrorHandling,
   withMiddleware,
   withMigrationLock,