@getstrata/core 1.0.6 → 1.0.8

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @getstrata/core changelog
 
+## 1.0.8
+
+- Container image starts and ships production dependencies only.
+
+## 1.0.7
+
 ## 1.0.6
 
 - Query `pluck` and `value` on `RepositoryQuery`, `ModelQuery`, and relation queries. `pluck(column)` returns `T[]`; `pluck(column, keyBy)` returns a `Map`. Models apply `$casts` and skip hydration/observers. Generated apps and lockstep packages move to `^1.0.6`.

package/dist/core/database/baseRepository.d.ts

@@ -28,6 +28,7 @@ declare class BaseRepository<TEntity extends object, PrimaryKey extends keyof TE
         perPage: number;
     } & Omit<ExtendedQueryOptions<TEntity>, "limit" | "offset">): Promise<PaginatedResult<TEntity>>;
     chunk(count: number, callback: (rows: TEntity[]) => Promise<boolean | void>, options?: Omit<ExtendedQueryOptions<TEntity>, "limit" | "offset">): Promise<void>;
+    chunkById(count: number, callback: (rows: TEntity[]) => Promise<boolean | undefined>, options?: Omit<ExtendedQueryOptions<TEntity>, "limit" | "offset" | "orderBy">): Promise<void>;
     cursorPaginate(options: {
         perPage: number;
         cursor?: TEntity[PrimaryKey];
@@ -38,6 +39,9 @@ declare class BaseRepository<TEntity extends object, PrimaryKey extends keyof TE
     findByIdOrThrow(id: TEntity[PrimaryKey], errorFactory?: ErrorFactory<TEntity[PrimaryKey]>): Promise<TEntity>;
     findByIds(ids: readonly TEntity[PrimaryKey][]): Promise<TEntity[]>;
     firstOrNull(where: QueryWhere<TEntity>, options?: Omit<QueryOptions<TEntity>, "where" | "limit">): Promise<TEntity | null>;
+    upsert(values: MutationValues<TEntity>, conflictColumns: readonly (keyof TEntity & string)[], updateColumns?: readonly (keyof TEntity & string)[]): Promise<TEntity | null>;
+    incrementById(id: TEntity[PrimaryKey], column: keyof TEntity & string, amount?: number, extra?: UpdateValues<TEntity, PrimaryKey>): Promise<TEntity | null>;
+    decrementById(id: TEntity[PrimaryKey], column: keyof TEntity & string, amount?: number, extra?: UpdateValues<TEntity, PrimaryKey>): Promise<TEntity | null>;
     create(values: MutationValues<TEntity>): Promise<TEntity>;
     updateById(id: TEntity[PrimaryKey], changes: UpdateValues<TEntity, PrimaryKey>): Promise<TEntity | null>;
     updateByIdOrThrow(id: TEntity[PrimaryKey], changes: UpdateValues<TEntity, PrimaryKey>, errorFactory?: ErrorFactory<TEntity[PrimaryKey]>): Promise<TEntity>;
@@ -53,6 +57,11 @@ declare class BaseRepository<TEntity extends object, PrimaryKey extends keyof TE
     protected countWhere(where?: QueryWhere<TEntity>, options?: Pick<QueryOptions<TEntity>, "withTrashed" | "onlyTrashed" | "joins" | "groupBy">, whereNodes?: readonly WhereNode<TEntity>[]): Promise<number>;
     protected averageColumn(column: keyof TEntity & string, where?: QueryWhere<TEntity>): Promise<number>;
     protected averageExpression(expression: string, alias: string, where?: QueryWhere<TEntity>): Promise<number>;
+    sum(column: keyof TEntity & string, where?: QueryWhere<TEntity>): Promise<number>;
+    avg(column: keyof TEntity & string, where?: QueryWhere<TEntity>): Promise<number>;
+    min(column: keyof TEntity & string, where?: QueryWhere<TEntity>): Promise<number>;
+    max(column: keyof TEntity & string, where?: QueryWhere<TEntity>): Promise<number>;
+    private aggregateColumn;
     protected pluckNumberValues(expression: string, alias: string, options?: QueryOptions<TEntity>): Promise<number[]>;
     protected countGroupedBy<K extends keyof TEntity & string>(column: K, where?: QueryWhere<TEntity>): Promise<Array<{
         value: TEntity[K] | null;

package/dist/core/database/dialect.d.ts

@@ -10,6 +10,8 @@ interface SqlDialect {
     ilikeOperator(): "ILIKE" | "LIKE";
     nullsLastSuffix(): string;
     castToText(expression: string): string;
+    /** Conflict handling appended to an INSERT. Empty updates mean "do nothing". */
+    upsertSuffix(conflictColumns: readonly string[], updateColumns: readonly string[]): string;
 }
 declare function dialectFor(driver: DatabaseDriver): SqlDialect;
 declare function currentSqlDialect(): SqlDialect;

package/dist/core/database/model.d.ts

@@ -43,7 +43,20 @@ declare class ModelQuery {
     limit(limit: number): this;
     offset(offset: number): this;
     whereNull(column: string): this;
+    whereNotNull(column: string): this;
     whereIn(column: string, values: readonly unknown[]): this;
+    whereNotIn(column: string, values: readonly unknown[]): this;
+    groupBy(groupBy: QueryOptions<object>["groupBy"]): this;
+    having(having: QueryWhere<object>): this;
+    join(left: `${string}.${string}`, right: `${string}.${string}`): this;
+    leftJoin(left: `${string}.${string}`, right: `${string}.${string}`): this;
+    paginate(options: {
+        page: number;
+        perPage: number;
+    }): Promise<{
+        data: Array<Model<Record<string, unknown>, "id">>;
+        meta: Awaited<ReturnType<RepositoryQuery<Record<string, unknown>, "id">["paginate"]>>["meta"];
+    }>;
     whereExists(sql: string, params?: readonly unknown[]): this;
     whereNotExists(sql: string, params?: readonly unknown[]): this;
     whereHas(name: string, constrain?: (query: AnyRelationQuery) => void): this;
@@ -60,6 +73,7 @@ declare class ModelQuery {
     withTrashed(): this;
     onlyTrashed(): this;
     get(): Promise<Array<Model<Record<string, unknown>, "id">>>;
+    private hydrateRows;
     first(): Promise<Model<Record<string, unknown>, "id"> | null>;
     count(): Promise<number>;
     pluck(column: string): Promise<unknown[]>;
@@ -68,6 +82,7 @@ declare class ModelQuery {
     find(id: unknown): Promise<Model<Record<string, unknown>, "id"> | null>;
     findOrFail(id: unknown, errorFactory?: (id: unknown) => Error): Promise<Model<Record<string, unknown>, "id">>;
     then(onfulfilled?: ((value: Array<Model<Record<string, unknown>, "id">>) => unknown) | null, onrejected?: ((reason: unknown) => unknown) | null): Promise<unknown>;
+    withCount(name: string, alias?: string): this;
     private constrainExists;
 }
 declare class Model<TEntity extends object, PrimaryKey extends keyof TEntity & string> {

package/dist/core/database/query.d.ts

@@ -44,6 +44,14 @@ declare function buildInsertQuery<TEntity extends object, PrimaryKey extends key
     text: string;
     params: unknown[];
 };
+declare function buildUpsertQuery<TEntity extends object, PrimaryKey extends keyof TEntity & string>(table: TableDefinition<TEntity, PrimaryKey>, values: MutationValues<TEntity>, conflictColumns: readonly string[], updateColumns?: readonly string[]): {
+    text: string;
+    params: unknown[];
+};
+declare function buildIncrementQuery<TEntity extends object, PrimaryKey extends keyof TEntity & string>(table: TableDefinition<TEntity, PrimaryKey>, id: TEntity[PrimaryKey], column: keyof TEntity & string, amount: number, extra?: UpdateValues<TEntity, PrimaryKey>): {
+    text: string;
+    params: unknown[];
+};
 declare function buildUpdateQuery<TEntity extends object, PrimaryKey extends keyof TEntity & string>(table: TableDefinition<TEntity, PrimaryKey>, id: TEntity[PrimaryKey], changes: UpdateValues<TEntity, PrimaryKey>): {
     text: string;
     params: unknown[];
@@ -60,4 +68,4 @@ declare function buildDeleteByIdQuery<TEntity extends object, PrimaryKey extends
     text: string;
     params: unknown[];
 };
-export { assertSafeProjectionExpression, buildAdvancedWhereClause, buildCountQuery, buildDeleteByIdQuery, buildGroupedCountQuery, buildInsertQuery, buildJoinClause, buildOrderByClause, buildProjectionQuery, buildQueryWhereClause, buildRestoreByIdQuery, buildSelectQuery, buildSoftDeleteByIdQuery, buildUpdateQuery, buildWhereClause, parseQualifiedColumn, qualifyColumn, quoteIdentifier, resolveQualifiedColumn, resolveSoftDeleteColumn, };
+export { assertSafeProjectionExpression, buildAdvancedWhereClause, buildCountQuery, buildDeleteByIdQuery, buildGroupedCountQuery, buildIncrementQuery, buildInsertQuery, buildJoinClause, buildOrderByClause, buildProjectionQuery, buildQueryWhereClause, buildRestoreByIdQuery, buildSelectQuery, buildSoftDeleteByIdQuery, buildUpdateQuery, buildUpsertQuery, buildWhereClause, parseQualifiedColumn, qualifyColumn, quoteIdentifier, resolveQualifiedColumn, resolveSoftDeleteColumn, };

package/dist/core/database/repositoryQuery.d.ts

@@ -17,6 +17,8 @@ declare class RepositoryQuery<TEntity extends object, PrimaryKey extends keyof T
     limit(limit: number): this;
     whereNull(column: keyof TEntity & string): this;
     whereNotNull(column: keyof TEntity & string): this;
+    whereNotIn(column: keyof TEntity & string, values: readonly unknown[]): this;
+    withSubqueryCount(alias: string, sql: string, params?: readonly unknown[]): this;
     whereIn(column: keyof TEntity & string, values: readonly unknown[]): this;
     whereExists(sql: string, params?: readonly unknown[]): this;
     whereNotExists(sql: string, params?: readonly unknown[]): this;

package/dist/core/database/types.d.ts

@@ -2,7 +2,9 @@ type DatabaseComparable = string | number | Date;
 type DatabaseScalar = DatabaseComparable | boolean | null;
 type QueryOperator = {
     eq?: DatabaseScalar;
+    ne?: DatabaseScalar;
     in?: readonly DatabaseScalar[];
+    notIn?: readonly DatabaseScalar[];
     gt?: DatabaseComparable;
     gte?: DatabaseComparable;
     lt?: DatabaseComparable;
@@ -42,6 +44,11 @@ type QuerySelectItem = {
     kind: "literalText";
     value: string;
     as: string;
+} | {
+    kind: "subqueryCount";
+    sql: string;
+    params: readonly unknown[];
+    as: string;
 } | {
     kind: "tsRank";
     table: string;

package/dist/entries/database/model.js

@@ -1,6 +1,6 @@
 // @bun
 // ../../src/core/database/model.ts
-import { NotFoundError } from "@getstrata/core/errors/http";
+import { ConflictError, NotFoundError } from "@getstrata/core/errors/http";
 
 // ../../src/core/database/inflection.ts
 function singularize(word) {
@@ -60,15 +60,32 @@ function pushParam(values, value) {
   values.push(value);
   return currentSqlDialect().placeholder(values.length);
 }
-function buildInClause(column, values, params) {
+var SUPPORTED_OPERATORS = new Set([
+  "eq",
+  "ne",
+  "in",
+  "notIn",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "isNull",
+  "ilike",
+  "tsMatch"
+]);
+function buildInClause(column, values, params, negated = false) {
   if (values.length === 0) {
-    return "1 = 0";
+    return negated ? "1 = 1" : "1 = 0";
   }
   const placeholders = values.map((value) => pushParam(params, value)).join(", ");
-  return `${column} IN (${placeholders})`;
+  return `${column}${negated ? " NOT" : ""} IN (${placeholders})`;
 }
 function buildOperatorClauses(column, operator, params) {
   const clauses = [];
+  const unsupported = Object.keys(operator).filter((key) => !SUPPORTED_OPERATORS.has(key));
+  if (unsupported.length > 0) {
+    throw new Error(`Unsupported query operator(s) for ${column}: ${unsupported.join(", ")}. Supported: ${[...SUPPORTED_OPERATORS].join(", ")}.`);
+  }
   if (operator.isNull === true) {
     clauses.push(`${column} IS NULL`);
   }
@@ -82,9 +99,19 @@ function buildOperatorClauses(column, operator, params) {
       clauses.push(`${column} = ${pushParam(params, operator.eq)}`);
     }
   }
+  if (operator.ne !== undefined) {
+    if (operator.ne === null) {
+      clauses.push(`${column} IS NOT NULL`);
+    } else {
+      clauses.push(`${column} <> ${pushParam(params, operator.ne)}`);
+    }
+  }
   if (operator.in !== undefined) {
     clauses.push(buildInClause(column, operator.in, params));
   }
+  if (operator.notIn !== undefined) {
+    clauses.push(buildInClause(column, operator.notIn, params, true));
+  }
   if (operator.gt !== undefined) {
     clauses.push(`${column} > ${pushParam(params, operator.gt)}`);
   }
@@ -304,6 +331,10 @@ function buildSelectList(table, select, params = []) {
     if (item.kind === "literalText") {
       return `${currentSqlDialect().castToText(pushParam(params, item.value))} AS ${quoteIdentifier(item.as)}`;
     }
+    if (item.kind === "subqueryCount") {
+      const body = remapExistsSql(item.sql, item.params, params);
+      return `(${body}) AS ${quoteIdentifier(item.as)}`;
+    }
     const column = qualifyColumn(item.table, item.column);
     const placeholder = pushParam(params, item.query);
     return `ts_rank(${column}, plainto_tsquery('english', ${placeholder})) AS ${quoteIdentifier(item.as)}`;
@@ -398,6 +429,52 @@ function buildInsertQuery(table, values) {
     params
   };
 }
+function buildUpsertQuery(table, values, conflictColumns, updateColumns) {
+  const entries = getDefinedColumnEntries(table, values);
+  if (entries.length === 0) {
+    throw new Error(`Cannot upsert into ${table.name} without any column values.`);
+  }
+  if (conflictColumns.length === 0) {
+    throw new Error(`Cannot upsert into ${table.name} without any conflict columns.`);
+  }
+  const insertable = new Set(entries.map(([column]) => column));
+  const conflict = new Set(conflictColumns);
+  const updatable = (updateColumns ?? entries.map(([column]) => column).filter((c) => !conflict.has(c))).filter((column) => insertable.has(column));
+  const params = [];
+  const columns = entries.map(([column]) => quoteIdentifier(column)).join(", ");
+  const placeholders = entries.map(([, value]) => pushParam(params, value)).join(", ");
+  const returningColumns = buildReturningColumns(table);
+  const suffix = currentSqlDialect().upsertSuffix(conflictColumns, updatable);
+  return {
+    text: `INSERT INTO ${quoteIdentifier(table.name)} (${columns}) VALUES (${placeholders})${suffix}${returningSuffix(returningColumns)}`,
+    params
+  };
+}
+function buildIncrementQuery(table, id, column, amount, extra = {}) {
+  if (!Number.isFinite(amount)) {
+    throw new Error("Increment amount must be a finite number.");
+  }
+  if (!table.columns.includes(column)) {
+    throw new Error(`Unknown column ${String(column)} on ${table.name}.`);
+  }
+  const params = [];
+  const target = quoteIdentifier(column);
+  const assignments = [`${target} = ${target} + ${pushParam(params, amount)}`];
+  for (const [name, value] of getDefinedColumnEntries(table, extra, {
+    exclude: [table.primaryKey, column]
+  })) {
+    assignments.push(`${quoteIdentifier(name)} = ${pushParam(params, value)}`);
+  }
+  const primaryKeyPlaceholder = pushParam(params, id);
+  const returningColumns = buildReturningColumns(table);
+  const scopeClauses = [];
+  appendSoftDeleteScope(table, {}, scopeClauses);
+  const scopeSuffix = scopeClauses.length > 0 ? ` AND ${scopeClauses.join(" AND ")}` : "";
+  return {
+    text: `UPDATE ${quoteIdentifier(table.name)} SET ${assignments.join(", ")} WHERE ${quoteIdentifier(table.primaryKey)} = ${primaryKeyPlaceholder}${scopeSuffix}${returningSuffix(returningColumns)}`,
+    params
+  };
+}
 function buildUpdateQuery(table, id, changes) {
   const entries = getDefinedColumnEntries(table, changes, {
     exclude: [table.primaryKey]
@@ -1524,6 +1601,17 @@ function ensureBooted(model) {
 function getGlobalScopes(model) {
   return modelGlobalScopes.get(model) ?? [];
 }
+var PASSWORD_HASH_PATTERN = /^\$(?:2[aby]?|argon2(?:i|d|id)?)\$/;
+function isAlreadyHashed(value) {
+  return PASSWORD_HASH_PATTERN.test(value);
+}
+function hashCastValue(value) {
+  const plain = String(value);
+  if (isAlreadyHashed(plain)) {
+    return plain;
+  }
+  return Bun.password.hashSync(plain, { algorithm: "bcrypt", cost: 10 });
+}
 function hydrateValue(value, cast) {
   if (value === null || value === undefined) {
     return value;
@@ -1563,12 +1651,15 @@ function dehydrateValue(value, cast) {
     case "int":
       return value === "" ? null : Number(value);
     case "hashed":
-      return value;
+      return hashCastValue(value);
     default:
       return value;
   }
 }
 function filterMassAssignable(fillable, guarded, input) {
+  if (fillable === undefined && guarded === undefined && Object.keys(input).length > 0) {
+    throw new Error("Mass assignment is not configured for this model. Declare static $fillable = [...] to allow specific columns, or static $guarded = [] to allow all of them.");
+  }
   const resolvedGuarded = guarded ?? true;
   if (fillable && fillable.length > 0) {
     const allowed = new Set(fillable);
@@ -1670,10 +1761,38 @@ class ModelQuery {
     this.query.whereNull(column);
     return this;
   }
+  whereNotNull(column) {
+    this.query.whereNotNull(column);
+    return this;
+  }
   whereIn(column, values) {
     this.query.whereIn(column, values);
     return this;
   }
+  whereNotIn(column, values) {
+    this.query.whereNotIn(column, values);
+    return this;
+  }
+  groupBy(groupBy) {
+    this.query.groupBy(groupBy);
+    return this;
+  }
+  having(having) {
+    this.query.having(having);
+    return this;
+  }
+  join(left, right) {
+    this.query.join(left, right);
+    return this;
+  }
+  leftJoin(left, right) {
+    this.query.leftJoin(left, right);
+    return this;
+  }
+  async paginate(options) {
+    const { data, meta } = await this.query.paginate(options);
+    return { data: await this.hydrateRows(data), meta };
+  }
   whereExists(sql, params = []) {
     this.query.whereExists(sql, params);
     return this;
@@ -1731,8 +1850,10 @@ class ModelQuery {
     return this;
   }
   async get() {
+    return await this.hydrateRows(await this.query.get());
+  }
+  async hydrateRows(rows) {
     const statics = modelStatics(this.modelClass);
-    const rows = await this.query.get();
     const models = [];
     for (const row of rows) {
       const model = statics.newFromRecord(row, true);
@@ -1784,6 +1905,23 @@ class ModelQuery {
   then(onfulfilled, onrejected) {
     return this.get().then(onfulfilled ?? undefined, onrejected ?? undefined);
   }
+  withCount(name, alias = `${name}_count`) {
+    const statics = modelStatics(this.modelClass);
+    ensureBooted(this.modelClass);
+    const repository = resolveModelRepository(this.modelClass);
+    const dummy = statics.newFromRecord({});
+    const method = dummy[name];
+    if (typeof method !== "function") {
+      throw new Error(`${this.modelClass.name} has no relation method ${name}().`);
+    }
+    const relationQuery = method.call(dummy);
+    const exists = relationQuery.toExistsClause(repository.getTable().name);
+    if (!exists.sql.startsWith("SELECT 1 ")) {
+      throw new Error(`Cannot count relation ${name}: unexpected subquery shape.`);
+    }
+    this.query.withSubqueryCount(alias, `SELECT COUNT(*) ${exists.sql.slice("SELECT 1 ".length)}`, exists.params);
+    return this;
+  }
   constrainExists(name, constrain, not) {
     const statics = modelStatics(this.modelClass);
     ensureBooted(this.modelClass);
@@ -2042,11 +2180,23 @@ class Model {
     return modelStatics(this).newFromRecord({ ...where, ...values }, false);
   }
   static async firstOrCreate(where, values = {}) {
-    const existing = await Model.firstWhere.call(this, where);
+    const findExisting = () => Model.firstWhere.call(this, where);
+    const existing = await findExisting();
     if (existing) {
       return existing;
     }
-    return Model.create.call(this, { ...where, ...values });
+    try {
+      return await Model.create.call(this, { ...where, ...values });
+    } catch (error) {
+      if (!(error instanceof ConflictError)) {
+        throw error;
+      }
+      const raced = await findExisting();
+      if (!raced) {
+        throw error;
+      }
+      return raced;
+    }
   }
   static async updateOrCreate(where, values = {}) {
     const existing = await Model.firstWhere.call(this, where);

package/dist/entries/database/query.js

@@ -37,15 +37,32 @@ function pushParam(values, value) {
   values.push(value);
   return currentSqlDialect().placeholder(values.length);
 }
-function buildInClause(column, values, params) {
+var SUPPORTED_OPERATORS = new Set([
+  "eq",
+  "ne",
+  "in",
+  "notIn",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "isNull",
+  "ilike",
+  "tsMatch"
+]);
+function buildInClause(column, values, params, negated = false) {
   if (values.length === 0) {
-    return "1 = 0";
+    return negated ? "1 = 1" : "1 = 0";
   }
   const placeholders = values.map((value) => pushParam(params, value)).join(", ");
-  return `${column} IN (${placeholders})`;
+  return `${column}${negated ? " NOT" : ""} IN (${placeholders})`;
 }
 function buildOperatorClauses(column, operator, params) {
   const clauses = [];
+  const unsupported = Object.keys(operator).filter((key) => !SUPPORTED_OPERATORS.has(key));
+  if (unsupported.length > 0) {
+    throw new Error(`Unsupported query operator(s) for ${column}: ${unsupported.join(", ")}. Supported: ${[...SUPPORTED_OPERATORS].join(", ")}.`);
+  }
   if (operator.isNull === true) {
     clauses.push(`${column} IS NULL`);
   }
@@ -59,9 +76,19 @@ function buildOperatorClauses(column, operator, params) {
       clauses.push(`${column} = ${pushParam(params, operator.eq)}`);
     }
   }
+  if (operator.ne !== undefined) {
+    if (operator.ne === null) {
+      clauses.push(`${column} IS NOT NULL`);
+    } else {
+      clauses.push(`${column} <> ${pushParam(params, operator.ne)}`);
+    }
+  }
   if (operator.in !== undefined) {
     clauses.push(buildInClause(column, operator.in, params));
   }
+  if (operator.notIn !== undefined) {
+    clauses.push(buildInClause(column, operator.notIn, params, true));
+  }
   if (operator.gt !== undefined) {
     clauses.push(`${column} > ${pushParam(params, operator.gt)}`);
   }
@@ -281,6 +308,10 @@ function buildSelectList(table, select, params = []) {
     if (item.kind === "literalText") {
       return `${currentSqlDialect().castToText(pushParam(params, item.value))} AS ${quoteIdentifier(item.as)}`;
     }
+    if (item.kind === "subqueryCount") {
+      const body = remapExistsSql(item.sql, item.params, params);
+      return `(${body}) AS ${quoteIdentifier(item.as)}`;
+    }
     const column = qualifyColumn(item.table, item.column);
     const placeholder = pushParam(params, item.query);
     return `ts_rank(${column}, plainto_tsquery('english', ${placeholder})) AS ${quoteIdentifier(item.as)}`;
@@ -375,6 +406,52 @@ function buildInsertQuery(table, values) {
     params
   };
 }
+function buildUpsertQuery(table, values, conflictColumns, updateColumns) {
+  const entries = getDefinedColumnEntries(table, values);
+  if (entries.length === 0) {
+    throw new Error(`Cannot upsert into ${table.name} without any column values.`);
+  }
+  if (conflictColumns.length === 0) {
+    throw new Error(`Cannot upsert into ${table.name} without any conflict columns.`);
+  }
+  const insertable = new Set(entries.map(([column]) => column));
+  const conflict = new Set(conflictColumns);
+  const updatable = (updateColumns ?? entries.map(([column]) => column).filter((c) => !conflict.has(c))).filter((column) => insertable.has(column));
+  const params = [];
+  const columns = entries.map(([column]) => quoteIdentifier(column)).join(", ");
+  const placeholders = entries.map(([, value]) => pushParam(params, value)).join(", ");
+  const returningColumns = buildReturningColumns(table);
+  const suffix = currentSqlDialect().upsertSuffix(conflictColumns, updatable);
+  return {
+    text: `INSERT INTO ${quoteIdentifier(table.name)} (${columns}) VALUES (${placeholders})${suffix}${returningSuffix(returningColumns)}`,
+    params
+  };
+}
+function buildIncrementQuery(table, id, column, amount, extra = {}) {
+  if (!Number.isFinite(amount)) {
+    throw new Error("Increment amount must be a finite number.");
+  }
+  if (!table.columns.includes(column)) {
+    throw new Error(`Unknown column ${String(column)} on ${table.name}.`);
+  }
+  const params = [];
+  const target = quoteIdentifier(column);
+  const assignments = [`${target} = ${target} + ${pushParam(params, amount)}`];
+  for (const [name, value] of getDefinedColumnEntries(table, extra, {
+    exclude: [table.primaryKey, column]
+  })) {
+    assignments.push(`${quoteIdentifier(name)} = ${pushParam(params, value)}`);
+  }
+  const primaryKeyPlaceholder = pushParam(params, id);
+  const returningColumns = buildReturningColumns(table);
+  const scopeClauses = [];
+  appendSoftDeleteScope(table, {}, scopeClauses);
+  const scopeSuffix = scopeClauses.length > 0 ? ` AND ${scopeClauses.join(" AND ")}` : "";
+  return {
+    text: `UPDATE ${quoteIdentifier(table.name)} SET ${assignments.join(", ")} WHERE ${quoteIdentifier(table.primaryKey)} = ${primaryKeyPlaceholder}${scopeSuffix}${returningSuffix(returningColumns)}`,
+    params
+  };
+}
 function buildUpdateQuery(table, id, changes) {
   const entries = getDefinedColumnEntries(table, changes, {
     exclude: [table.primaryKey]
@@ -440,6 +517,7 @@ export {
   buildCountQuery,
   buildDeleteByIdQuery,
   buildGroupedCountQuery,
+  buildIncrementQuery,
   buildInsertQuery,
   buildJoinClause,
   buildOrderByClause,
@@ -449,6 +527,7 @@ export {
   buildSelectQuery,
   buildSoftDeleteByIdQuery,
   buildUpdateQuery,
+  buildUpsertQuery,
   buildWhereClause,
   parseQualifiedColumn,
   qualifyColumn,

package/dist/entries/database/repositoryQuery.js

@@ -61,15 +61,32 @@ function pushParam(values, value) {
   values.push(value);
   return currentSqlDialect().placeholder(values.length);
 }
-function buildInClause(column, values, params) {
+var SUPPORTED_OPERATORS = new Set([
+  "eq",
+  "ne",
+  "in",
+  "notIn",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "isNull",
+  "ilike",
+  "tsMatch"
+]);
+function buildInClause(column, values, params, negated = false) {
   if (values.length === 0) {
-    return "1 = 0";
+    return negated ? "1 = 1" : "1 = 0";
   }
   const placeholders = values.map((value) => pushParam(params, value)).join(", ");
-  return `${column} IN (${placeholders})`;
+  return `${column}${negated ? " NOT" : ""} IN (${placeholders})`;
 }
 function buildOperatorClauses(column, operator, params) {
   const clauses = [];
+  const unsupported = Object.keys(operator).filter((key) => !SUPPORTED_OPERATORS.has(key));
+  if (unsupported.length > 0) {
+    throw new Error(`Unsupported query operator(s) for ${column}: ${unsupported.join(", ")}. Supported: ${[...SUPPORTED_OPERATORS].join(", ")}.`);
+  }
   if (operator.isNull === true) {
     clauses.push(`${column} IS NULL`);
   }
@@ -83,9 +100,19 @@ function buildOperatorClauses(column, operator, params) {
       clauses.push(`${column} = ${pushParam(params, operator.eq)}`);
     }
   }
+  if (operator.ne !== undefined) {
+    if (operator.ne === null) {
+      clauses.push(`${column} IS NOT NULL`);
+    } else {
+      clauses.push(`${column} <> ${pushParam(params, operator.ne)}`);
+    }
+  }
   if (operator.in !== undefined) {
     clauses.push(buildInClause(column, operator.in, params));
   }
+  if (operator.notIn !== undefined) {
+    clauses.push(buildInClause(column, operator.notIn, params, true));
+  }
   if (operator.gt !== undefined) {
     clauses.push(`${column} > ${pushParam(params, operator.gt)}`);
   }
@@ -305,6 +332,10 @@ function buildSelectList(table, select, params = []) {
     if (item.kind === "literalText") {
       return `${currentSqlDialect().castToText(pushParam(params, item.value))} AS ${quoteIdentifier(item.as)}`;
     }
+    if (item.kind === "subqueryCount") {
+      const body = remapExistsSql(item.sql, item.params, params);
+      return `(${body}) AS ${quoteIdentifier(item.as)}`;
+    }
     const column = qualifyColumn(item.table, item.column);
     const placeholder = pushParam(params, item.query);
     return `ts_rank(${column}, plainto_tsquery('english', ${placeholder})) AS ${quoteIdentifier(item.as)}`;
@@ -399,6 +430,52 @@ function buildInsertQuery(table, values) {
     params
   };
 }
+function buildUpsertQuery(table, values, conflictColumns, updateColumns) {
+  const entries = getDefinedColumnEntries(table, values);
+  if (entries.length === 0) {
+    throw new Error(`Cannot upsert into ${table.name} without any column values.`);
+  }
+  if (conflictColumns.length === 0) {
+    throw new Error(`Cannot upsert into ${table.name} without any conflict columns.`);
+  }
+  const insertable = new Set(entries.map(([column]) => column));
+  const conflict = new Set(conflictColumns);
+  const updatable = (updateColumns ?? entries.map(([column]) => column).filter((c) => !conflict.has(c))).filter((column) => insertable.has(column));
+  const params = [];
+  const columns = entries.map(([column]) => quoteIdentifier(column)).join(", ");
+  const placeholders = entries.map(([, value]) => pushParam(params, value)).join(", ");
+  const returningColumns = buildReturningColumns(table);
+  const suffix = currentSqlDialect().upsertSuffix(conflictColumns, updatable);
+  return {
+    text: `INSERT INTO ${quoteIdentifier(table.name)} (${columns}) VALUES (${placeholders})${suffix}${returningSuffix(returningColumns)}`,
+    params
+  };
+}
+function buildIncrementQuery(table, id, column, amount, extra = {}) {
+  if (!Number.isFinite(amount)) {
+    throw new Error("Increment amount must be a finite number.");
+  }
+  if (!table.columns.includes(column)) {
+    throw new Error(`Unknown column ${String(column)} on ${table.name}.`);
+  }
+  const params = [];
+  const target = quoteIdentifier(column);
+  const assignments = [`${target} = ${target} + ${pushParam(params, amount)}`];
+  for (const [name, value] of getDefinedColumnEntries(table, extra, {
+    exclude: [table.primaryKey, column]
+  })) {
+    assignments.push(`${quoteIdentifier(name)} = ${pushParam(params, value)}`);
+  }
+  const primaryKeyPlaceholder = pushParam(params, id);
+  const returningColumns = buildReturningColumns(table);
+  const scopeClauses = [];
+  appendSoftDeleteScope(table, {}, scopeClauses);
+  const scopeSuffix = scopeClauses.length > 0 ? ` AND ${scopeClauses.join(" AND ")}` : "";
+  return {
+    text: `UPDATE ${quoteIdentifier(table.name)} SET ${assignments.join(", ")} WHERE ${quoteIdentifier(table.primaryKey)} = ${primaryKeyPlaceholder}${scopeSuffix}${returningSuffix(returningColumns)}`,
+    params
+  };
+}
 function buildUpdateQuery(table, id, changes) {
   const entries = getDefinedColumnEntries(table, changes, {
     exclude: [table.primaryKey]
@@ -779,6 +856,22 @@ class RepositoryQuery {
   whereNotNull(column) {
     return this.where({ [column]: { isNull: false } });
   }
+  whereNotIn(column, values) {
+    return this.where({ [column]: { notIn: values } });
+  }
+  withSubqueryCount(alias, sql, params = []) {
+    const table = this.repository.getTable();
+    const existing = this.queryOptions.select ?? table.columns.map((column) => ({
+      kind: "column",
+      table: table.name,
+      column
+    }));
+    this.queryOptions = {
+      ...this.queryOptions,
+      select: [...existing, { kind: "subqueryCount", sql, params, as: alias }]
+    };
+    return this;
+  }
   whereIn(column, values) {
     return this.where({ [column]: values });
   }

package/dist/entries/database/schema.js

@@ -304,15 +304,32 @@ function pushParam(values, value) {
   values.push(value);
   return currentSqlDialect().placeholder(values.length);
 }
-function buildInClause(column, values, params) {
+var SUPPORTED_OPERATORS = new Set([
+  "eq",
+  "ne",
+  "in",
+  "notIn",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "isNull",
+  "ilike",
+  "tsMatch"
+]);
+function buildInClause(column, values, params, negated = false) {
   if (values.length === 0) {
-    return "1 = 0";
+    return negated ? "1 = 1" : "1 = 0";
   }
   const placeholders = values.map((value) => pushParam(params, value)).join(", ");
-  return `${column} IN (${placeholders})`;
+  return `${column}${negated ? " NOT" : ""} IN (${placeholders})`;
 }
 function buildOperatorClauses(column, operator, params) {
   const clauses = [];
+  const unsupported = Object.keys(operator).filter((key) => !SUPPORTED_OPERATORS.has(key));
+  if (unsupported.length > 0) {
+    throw new Error(`Unsupported query operator(s) for ${column}: ${unsupported.join(", ")}. Supported: ${[...SUPPORTED_OPERATORS].join(", ")}.`);
+  }
   if (operator.isNull === true) {
     clauses.push(`${column} IS NULL`);
   }
@@ -326,9 +343,19 @@ function buildOperatorClauses(column, operator, params) {
       clauses.push(`${column} = ${pushParam(params, operator.eq)}`);
     }
   }
+  if (operator.ne !== undefined) {
+    if (operator.ne === null) {
+      clauses.push(`${column} IS NOT NULL`);
+    } else {
+      clauses.push(`${column} <> ${pushParam(params, operator.ne)}`);
+    }
+  }
   if (operator.in !== undefined) {
     clauses.push(buildInClause(column, operator.in, params));
   }
+  if (operator.notIn !== undefined) {
+    clauses.push(buildInClause(column, operator.notIn, params, true));
+  }
   if (operator.gt !== undefined) {
     clauses.push(`${column} > ${pushParam(params, operator.gt)}`);
   }
@@ -548,6 +575,10 @@ function buildSelectList(table, select, params = []) {
     if (item.kind === "literalText") {
       return `${currentSqlDialect().castToText(pushParam(params, item.value))} AS ${quoteIdentifier(item.as)}`;
     }
+    if (item.kind === "subqueryCount") {
+      const body = remapExistsSql(item.sql, item.params, params);
+      return `(${body}) AS ${quoteIdentifier(item.as)}`;
+    }
     const column = qualifyColumn(item.table, item.column);
     const placeholder = pushParam(params, item.query);
     return `ts_rank(${column}, plainto_tsquery('english', ${placeholder})) AS ${quoteIdentifier(item.as)}`;
@@ -642,6 +673,52 @@ function buildInsertQuery(table, values) {
     params
   };
 }
+function buildUpsertQuery(table, values, conflictColumns, updateColumns) {
+  const entries = getDefinedColumnEntries(table, values);
+  if (entries.length === 0) {
+    throw new Error(`Cannot upsert into ${table.name} without any column values.`);
+  }
+  if (conflictColumns.length === 0) {
+    throw new Error(`Cannot upsert into ${table.name} without any conflict columns.`);
+  }
+  const insertable = new Set(entries.map(([column]) => column));
+  const conflict = new Set(conflictColumns);
+  const updatable = (updateColumns ?? entries.map(([column]) => column).filter((c) => !conflict.has(c))).filter((column) => insertable.has(column));
+  const params = [];
+  const columns = entries.map(([column]) => quoteIdentifier(column)).join(", ");
+  const placeholders = entries.map(([, value]) => pushParam(params, value)).join(", ");
+  const returningColumns = buildReturningColumns(table);
+  const suffix = currentSqlDialect().upsertSuffix(conflictColumns, updatable);
+  return {
+    text: `INSERT INTO ${quoteIdentifier(table.name)} (${columns}) VALUES (${placeholders})${suffix}${returningSuffix(returningColumns)}`,
+    params
+  };
+}
+function buildIncrementQuery(table, id, column, amount, extra = {}) {
+  if (!Number.isFinite(amount)) {
+    throw new Error("Increment amount must be a finite number.");
+  }
+  if (!table.columns.includes(column)) {
+    throw new Error(`Unknown column ${String(column)} on ${table.name}.`);
+  }
+  const params = [];
+  const target = quoteIdentifier(column);
+  const assignments = [`${target} = ${target} + ${pushParam(params, amount)}`];
+  for (const [name, value] of getDefinedColumnEntries(table, extra, {
+    exclude: [table.primaryKey, column]
+  })) {
+    assignments.push(`${quoteIdentifier(name)} = ${pushParam(params, value)}`);
+  }
+  const primaryKeyPlaceholder = pushParam(params, id);
+  const returningColumns = buildReturningColumns(table);
+  const scopeClauses = [];
+  appendSoftDeleteScope(table, {}, scopeClauses);
+  const scopeSuffix = scopeClauses.length > 0 ? ` AND ${scopeClauses.join(" AND ")}` : "";
+  return {
+    text: `UPDATE ${quoteIdentifier(table.name)} SET ${assignments.join(", ")} WHERE ${quoteIdentifier(table.primaryKey)} = ${primaryKeyPlaceholder}${scopeSuffix}${returningSuffix(returningColumns)}`,
+    params
+  };
+}
 function buildUpdateQuery(table, id, changes) {
   const entries = getDefinedColumnEntries(table, changes, {
     exclude: [table.primaryKey]

package/dist/entries/http/parseMultipartUpload.js

@@ -2,6 +2,26 @@
 // ../../src/core/http/parseMultipartUpload.ts
 import { BadRequestError, PayloadTooLargeError } from "@getstrata/core/errors/http";
 
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
 // ../../src/core/http/uploads.ts
 var DEFAULT_MAX_UPLOAD_BYTES = 5 * 1024 * 1024;
 var ALLOWED_UPLOAD_MIME_TYPES = new Set([
@@ -33,7 +53,7 @@ function normalizeMimeType(mimeType) {
 function isAllowedMimeType(mimeType) {
   const normalized = normalizeMimeType(mimeType);
   if (!normalized || normalized === "application/octet-stream") {
-    return true;
+    return envFlagEnabled(process.env.UPLOAD_ALLOW_UNKNOWN_MIME);
   }
   return ALLOWED_UPLOAD_MIME_TYPES.has(normalized);
 }

package/dist/index.js

@@ -2071,6 +2071,9 @@ function assertSafeIdentifier(identifier) {
   }
   return identifier;
 }
+function quoteIdentifierFor(dialect, column) {
+  return dialect.quoteIdentifier(column);
+}
 var postgresDialect = {
   driver: "pgsql",
   placeholder(index) {
@@ -2096,6 +2099,17 @@ var postgresDialect = {
   },
   castToText(expression) {
     return `${expression}::text`;
+  },
+  upsertSuffix(conflictColumns, updateColumns) {
+    const target = conflictColumns.map((column) => quoteIdentifierFor(this, column)).join(", ");
+    if (updateColumns.length === 0) {
+      return ` ON CONFLICT (${target}) DO NOTHING`;
+    }
+    const assignments = updateColumns.map((column) => {
+      const quoted = quoteIdentifierFor(this, column);
+      return `${quoted} = excluded.${quoted}`;
+    }).join(", ");
+    return ` ON CONFLICT (${target}) DO UPDATE SET ${assignments}`;
   }
 };
 var mysqlDialect = {
@@ -2123,6 +2137,17 @@ var mysqlDialect = {
   },
   castToText(expression) {
     return `CAST(${expression} AS CHAR)`;
+  },
+  upsertSuffix(conflictColumns, updateColumns) {
+    if (updateColumns.length === 0) {
+      const anchor = quoteIdentifierFor(this, conflictColumns[0] ?? "");
+      return ` ON DUPLICATE KEY UPDATE ${anchor} = ${anchor}`;
+    }
+    const assignments = updateColumns.map((column) => {
+      const quoted = quoteIdentifierFor(this, column);
+      return `${quoted} = VALUES(${quoted})`;
+    }).join(", ");
+    return ` ON DUPLICATE KEY UPDATE ${assignments}`;
   }
 };
 var sqliteDialect = {
@@ -2150,6 +2175,17 @@ var sqliteDialect = {
   },
   castToText(expression) {
     return `CAST(${expression} AS TEXT)`;
+  },
+  upsertSuffix(conflictColumns, updateColumns) {
+    const target = conflictColumns.map((column) => quoteIdentifierFor(this, column)).join(", ");
+    if (updateColumns.length === 0) {
+      return ` ON CONFLICT (${target}) DO NOTHING`;
+    }
+    const assignments = updateColumns.map((column) => {
+      const quoted = quoteIdentifierFor(this, column);
+      return `${quoted} = excluded.${quoted}`;
+    }).join(", ");
+    return ` ON CONFLICT (${target}) DO UPDATE SET ${assignments}`;
   }
 };
 var dialects = {
@@ -2216,15 +2252,32 @@ function pushParam(values, value) {
   values.push(value);
   return currentSqlDialect().placeholder(values.length);
 }
-function buildInClause(column, values, params) {
+var SUPPORTED_OPERATORS = new Set([
+  "eq",
+  "ne",
+  "in",
+  "notIn",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "isNull",
+  "ilike",
+  "tsMatch"
+]);
+function buildInClause(column, values, params, negated = false) {
   if (values.length === 0) {
-    return "1 = 0";
+    return negated ? "1 = 1" : "1 = 0";
   }
   const placeholders = values.map((value) => pushParam(params, value)).join(", ");
-  return `${column} IN (${placeholders})`;
+  return `${column}${negated ? " NOT" : ""} IN (${placeholders})`;
 }
 function buildOperatorClauses(column, operator, params) {
   const clauses = [];
+  const unsupported = Object.keys(operator).filter((key) => !SUPPORTED_OPERATORS.has(key));
+  if (unsupported.length > 0) {
+    throw new Error(`Unsupported query operator(s) for ${column}: ${unsupported.join(", ")}. Supported: ${[...SUPPORTED_OPERATORS].join(", ")}.`);
+  }
   if (operator.isNull === true) {
     clauses.push(`${column} IS NULL`);
   }
@@ -2238,9 +2291,19 @@ function buildOperatorClauses(column, operator, params) {
       clauses.push(`${column} = ${pushParam(params, operator.eq)}`);
     }
   }
+  if (operator.ne !== undefined) {
+    if (operator.ne === null) {
+      clauses.push(`${column} IS NOT NULL`);
+    } else {
+      clauses.push(`${column} <> ${pushParam(params, operator.ne)}`);
+    }
+  }
   if (operator.in !== undefined) {
     clauses.push(buildInClause(column, operator.in, params));
   }
+  if (operator.notIn !== undefined) {
+    clauses.push(buildInClause(column, operator.notIn, params, true));
+  }
   if (operator.gt !== undefined) {
     clauses.push(`${column} > ${pushParam(params, operator.gt)}`);
   }
@@ -2460,6 +2523,10 @@ function buildSelectList(table, select, params = []) {
     if (item.kind === "literalText") {
       return `${currentSqlDialect().castToText(pushParam(params, item.value))} AS ${quoteIdentifier(item.as)}`;
     }
+    if (item.kind === "subqueryCount") {
+      const body = remapExistsSql(item.sql, item.params, params);
+      return `(${body}) AS ${quoteIdentifier(item.as)}`;
+    }
     const column = qualifyColumn(item.table, item.column);
     const placeholder = pushParam(params, item.query);
     return `ts_rank(${column}, plainto_tsquery('english', ${placeholder})) AS ${quoteIdentifier(item.as)}`;
@@ -2554,6 +2621,52 @@ function buildInsertQuery(table, values) {
     params
   };
 }
+function buildUpsertQuery(table, values, conflictColumns, updateColumns) {
+  const entries = getDefinedColumnEntries(table, values);
+  if (entries.length === 0) {
+    throw new Error(`Cannot upsert into ${table.name} without any column values.`);
+  }
+  if (conflictColumns.length === 0) {
+    throw new Error(`Cannot upsert into ${table.name} without any conflict columns.`);
+  }
+  const insertable = new Set(entries.map(([column]) => column));
+  const conflict = new Set(conflictColumns);
+  const updatable = (updateColumns ?? entries.map(([column]) => column).filter((c) => !conflict.has(c))).filter((column) => insertable.has(column));
+  const params = [];
+  const columns = entries.map(([column]) => quoteIdentifier(column)).join(", ");
+  const placeholders = entries.map(([, value]) => pushParam(params, value)).join(", ");
+  const returningColumns = buildReturningColumns(table);
+  const suffix = currentSqlDialect().upsertSuffix(conflictColumns, updatable);
+  return {
+    text: `INSERT INTO ${quoteIdentifier(table.name)} (${columns}) VALUES (${placeholders})${suffix}${returningSuffix(returningColumns)}`,
+    params
+  };
+}
+function buildIncrementQuery(table, id, column, amount, extra = {}) {
+  if (!Number.isFinite(amount)) {
+    throw new Error("Increment amount must be a finite number.");
+  }
+  if (!table.columns.includes(column)) {
+    throw new Error(`Unknown column ${String(column)} on ${table.name}.`);
+  }
+  const params = [];
+  const target = quoteIdentifier(column);
+  const assignments = [`${target} = ${target} + ${pushParam(params, amount)}`];
+  for (const [name, value] of getDefinedColumnEntries(table, extra, {
+    exclude: [table.primaryKey, column]
+  })) {
+    assignments.push(`${quoteIdentifier(name)} = ${pushParam(params, value)}`);
+  }
+  const primaryKeyPlaceholder = pushParam(params, id);
+  const returningColumns = buildReturningColumns(table);
+  const scopeClauses = [];
+  appendSoftDeleteScope(table, {}, scopeClauses);
+  const scopeSuffix = scopeClauses.length > 0 ? ` AND ${scopeClauses.join(" AND ")}` : "";
+  return {
+    text: `UPDATE ${quoteIdentifier(table.name)} SET ${assignments.join(", ")} WHERE ${quoteIdentifier(table.primaryKey)} = ${primaryKeyPlaceholder}${scopeSuffix}${returningSuffix(returningColumns)}`,
+    params
+  };
+}
 function buildUpdateQuery(table, id, changes) {
   const entries = getDefinedColumnEntries(table, changes, {
     exclude: [table.primaryKey]
@@ -2958,6 +3071,22 @@ class RepositoryQuery {
   whereNotNull(column) {
     return this.where({ [column]: { isNull: false } });
   }
+  whereNotIn(column, values) {
+    return this.where({ [column]: { notIn: values } });
+  }
+  withSubqueryCount(alias, sql, params = []) {
+    const table = this.repository.getTable();
+    const existing = this.queryOptions.select ?? table.columns.map((column) => ({
+      kind: "column",
+      table: table.name,
+      column
+    }));
+    this.queryOptions = {
+      ...this.queryOptions,
+      select: [...existing, { kind: "subqueryCount", sql, params, as: alias }]
+    };
+    return this;
+  }
   whereIn(column, values) {
     return this.where({ [column]: values });
   }
@@ -3266,6 +3395,29 @@ class BaseRepository {
       offset += count;
     }
   }
+  async chunkById(count, callback, options = {}) {
+    if (!Number.isInteger(count) || count <= 0) {
+      throw new Error("Chunk size must be a positive integer.");
+    }
+    let cursor;
+    while (true) {
+      const { data, meta } = await this.cursorPaginate({
+        ...options,
+        perPage: count,
+        ...cursor === undefined ? {} : { cursor }
+      });
+      if (data.length === 0) {
+        return;
+      }
+      if (await callback(data) === false) {
+        return;
+      }
+      if (!meta.has_more || meta.next_cursor === null) {
+        return;
+      }
+      cursor = meta.next_cursor;
+    }
+  }
   async cursorPaginate(options) {
     const {
       perPage,
@@ -3329,6 +3481,23 @@ class BaseRepository {
     const [record] = await this.findAll({ ...options, where, limit: 1 });
     return record ?? null;
   }
+  async upsert(values, conflictColumns, updateColumns) {
+    return await withDatabaseErrorHandling(async () => {
+      const { text, params } = buildUpsertQuery(this.table, values, conflictColumns, updateColumns);
+      const [record] = await this.connection.unsafe(text, params);
+      return record ?? null;
+    });
+  }
+  async incrementById(id, column, amount = 1, extra = {}) {
+    return await withDatabaseErrorHandling(async () => {
+      const { text, params } = buildIncrementQuery(this.table, id, column, amount, extra);
+      const [record] = await this.connection.unsafe(text, params);
+      return record ?? null;
+    });
+  }
+  async decrementById(id, column, amount = 1, extra = {}) {
+    return await this.incrementById(id, column, -amount, extra);
+  }
   async create(values) {
     return await withDatabaseErrorHandling(async () => {
       const { text, params } = buildInsertQuery(this.table, values);
@@ -3431,7 +3600,23 @@ class BaseRepository {
   async averageExpression(expression, alias, where = {}) {
     const { text, params } = buildProjectionQuery(this.table, expression, alias, { where });
     const [row] = await this.connection.unsafe(text, params);
-    return Math.round(Number(row?.[alias] ?? 0));
+    return Number(row?.[alias] ?? 0);
+  }
+  async sum(column, where = {}) {
+    return await this.aggregateColumn("SUM", column, where);
+  }
+  async avg(column, where = {}) {
+    return await this.aggregateColumn("AVG", column, where);
+  }
+  async min(column, where = {}) {
+    return await this.aggregateColumn("MIN", column, where);
+  }
+  async max(column, where = {}) {
+    return await this.aggregateColumn("MAX", column, where);
+  }
+  async aggregateColumn(fn, column, where) {
+    const qualifiedColumn = qualifyColumn(this.table.name, column);
+    return await this.averageExpression(`${fn}(${qualifiedColumn})`, "value", where);
   }
   async pluckNumberValues(expression, alias, options = {}) {
     const { text, params } = buildProjectionQuery(this.table, expression, alias, options);
@@ -4711,6 +4896,17 @@ function ensureBooted(model) {
 function getGlobalScopes(model) {
   return modelGlobalScopes.get(model) ?? [];
 }
+var PASSWORD_HASH_PATTERN = /^\$(?:2[aby]?|argon2(?:i|d|id)?)\$/;
+function isAlreadyHashed(value) {
+  return PASSWORD_HASH_PATTERN.test(value);
+}
+function hashCastValue(value) {
+  const plain = String(value);
+  if (isAlreadyHashed(plain)) {
+    return plain;
+  }
+  return Bun.password.hashSync(plain, { algorithm: "bcrypt", cost: 10 });
+}
 function hydrateValue(value, cast) {
   if (value === null || value === undefined) {
     return value;
@@ -4750,12 +4946,15 @@ function dehydrateValue(value, cast) {
     case "int":
       return value === "" ? null : Number(value);
     case "hashed":
-      return value;
+      return hashCastValue(value);
     default:
       return value;
   }
 }
 function filterMassAssignable(fillable, guarded, input) {
+  if (fillable === undefined && guarded === undefined && Object.keys(input).length > 0) {
+    throw new Error("Mass assignment is not configured for this model. Declare static $fillable = [...] to allow specific columns, or static $guarded = [] to allow all of them.");
+  }
   const resolvedGuarded = guarded ?? true;
   if (fillable && fillable.length > 0) {
     const allowed = new Set(fillable);
@@ -4857,10 +5056,38 @@ class ModelQuery {
     this.query.whereNull(column);
     return this;
   }
+  whereNotNull(column) {
+    this.query.whereNotNull(column);
+    return this;
+  }
   whereIn(column, values) {
     this.query.whereIn(column, values);
     return this;
   }
+  whereNotIn(column, values) {
+    this.query.whereNotIn(column, values);
+    return this;
+  }
+  groupBy(groupBy) {
+    this.query.groupBy(groupBy);
+    return this;
+  }
+  having(having) {
+    this.query.having(having);
+    return this;
+  }
+  join(left, right) {
+    this.query.join(left, right);
+    return this;
+  }
+  leftJoin(left, right) {
+    this.query.leftJoin(left, right);
+    return this;
+  }
+  async paginate(options) {
+    const { data, meta } = await this.query.paginate(options);
+    return { data: await this.hydrateRows(data), meta };
+  }
   whereExists(sql, params = []) {
     this.query.whereExists(sql, params);
     return this;
@@ -4918,8 +5145,10 @@ class ModelQuery {
     return this;
   }
   async get() {
+    return await this.hydrateRows(await this.query.get());
+  }
+  async hydrateRows(rows) {
     const statics = modelStatics(this.modelClass);
-    const rows = await this.query.get();
     const models = [];
     for (const row of rows) {
       const model = statics.newFromRecord(row, true);
@@ -4971,6 +5200,23 @@ class ModelQuery {
   then(onfulfilled, onrejected) {
     return this.get().then(onfulfilled ?? undefined, onrejected ?? undefined);
   }
+  withCount(name, alias = `${name}_count`) {
+    const statics = modelStatics(this.modelClass);
+    ensureBooted(this.modelClass);
+    const repository = resolveModelRepository(this.modelClass);
+    const dummy = statics.newFromRecord({});
+    const method = dummy[name];
+    if (typeof method !== "function") {
+      throw new Error(`${this.modelClass.name} has no relation method ${name}().`);
+    }
+    const relationQuery = method.call(dummy);
+    const exists = relationQuery.toExistsClause(repository.getTable().name);
+    if (!exists.sql.startsWith("SELECT 1 ")) {
+      throw new Error(`Cannot count relation ${name}: unexpected subquery shape.`);
+    }
+    this.query.withSubqueryCount(alias, `SELECT COUNT(*) ${exists.sql.slice("SELECT 1 ".length)}`, exists.params);
+    return this;
+  }
   constrainExists(name, constrain, not) {
     const statics = modelStatics(this.modelClass);
     ensureBooted(this.modelClass);
@@ -5229,11 +5475,23 @@ class Model {
     return modelStatics(this).newFromRecord({ ...where, ...values }, false);
   }
   static async firstOrCreate(where, values = {}) {
-    const existing = await Model.firstWhere.call(this, where);
+    const findExisting = () => Model.firstWhere.call(this, where);
+    const existing = await findExisting();
     if (existing) {
       return existing;
     }
-    return Model.create.call(this, { ...where, ...values });
+    try {
+      return await Model.create.call(this, { ...where, ...values });
+    } catch (error) {
+      if (!(error instanceof ConflictError)) {
+        throw error;
+      }
+      const raced = await findExisting();
+      if (!raced) {
+        throw error;
+      }
+      return raced;
+    }
   }
   static async updateOrCreate(where, values = {}) {
     const existing = await Model.firstWhere.call(this, where);
@@ -7603,7 +7861,7 @@ function normalizeMimeType(mimeType) {
 function isAllowedMimeType(mimeType) {
   const normalized = normalizeMimeType(mimeType);
   if (!normalized || normalized === "application/octet-stream") {
-    return true;
+    return envFlagEnabled(process.env.UPLOAD_ALLOW_UNKNOWN_MIME);
   }
   return ALLOWED_UPLOAD_MIME_TYPES.has(normalized);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "1.0.6",
+  "version": "1.0.8",
   "description": "Strata Bun framework public API",
   "type": "module",
   "license": "MIT",