@getstrata/core 1.1.9 → 2.0.0

package/dist/entries/audit/exportAuditLogs.js

@@ -101,6 +101,80 @@ var init_eventBus = __esm(() => {
   eventBus = readSharedEventBus();
 });
 
+// ../../src/core/database/transactionControl.ts
+function unwrapTransactionRollback(error, depth = 0) {
+  if (error instanceof TransactionRollback) {
+    return error;
+  }
+  if (depth >= 5 || !(error instanceof Error) || error.cause === undefined) {
+    return null;
+  }
+  return unwrapTransactionRollback(error.cause, depth + 1);
+}
+function requestTransactionRollback() {
+  const state = transactionScopes.getStore();
+  const index = state ? state.rollback.length - 1 : -1;
+  if (!state || index < 0) {
+    return;
+  }
+  const flags = state.rollback;
+  const current = flags[index];
+  if (current === undefined) {
+    return;
+  }
+  flags[index] = true;
+}
+function scopeRequestsRollback() {
+  const state = transactionScopes.getStore();
+  if (!state || state.rollback.length === 0) {
+    return false;
+  }
+  return state.rollback[state.rollback.length - 1] === true;
+}
+async function commitOrRollbackScope(result) {
+  if (scopeRequestsRollback()) {
+    throw new TransactionRollback(result);
+  }
+  return result;
+}
+async function settleTransaction(work) {
+  try {
+    return await work();
+  } catch (error) {
+    const rollback = unwrapTransactionRollback(error);
+    if (rollback) {
+      return rollback.result;
+    }
+    throw error;
+  }
+}
+async function runWithTransactionScope(callback) {
+  const existing = transactionScopes.getStore();
+  if (existing) {
+    existing.rollback.push(false);
+    try {
+      return await callback();
+    } finally {
+      existing.rollback.pop();
+    }
+  }
+  const state = { rollback: [false] };
+  return await transactionScopes.run(state, callback);
+}
+var TransactionRollback, transactionScopes;
+var init_transactionControl = __esm(() => {
+  init_asyncContextStore();
+  TransactionRollback = class TransactionRollback extends Error {
+    result;
+    constructor(result) {
+      super("Transaction rolled back");
+      this.name = "TransactionRollback";
+      this.result = result;
+    }
+  };
+  transactionScopes = createAsyncContextStore("@getstrata/transactionScopes");
+});
+
 // ../../src/core/tenant/tenancyConfig.ts
 function readTenancyDriver(env = process.env) {
   const raw = env.TENANCY_DRIVER?.trim();
@@ -130,34 +204,39 @@ async function applyTenantContextToTransaction(transaction, tenantId) {
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
 }
 async function runWithTenantDatabase(tenant, callback) {
+  const outerTenant = currentTenant();
+  if (hasActiveDatabaseConnection() && outerTenant && outerTenant.id !== tenant.id) {
+    throw new Error("Cannot switch tenants inside an active database transaction.");
+  }
   if (!isTenancyEnabled() || !isRlsTenancy()) {
     return await runWithTenant(tenant, callback);
   }
   if (hasActiveDatabaseConnection()) {
     const activeConnection = getActiveDatabaseConnection(getDefaultDatabasePool());
-    await applyTenantContextToTransaction(activeConnection, tenant.id);
-    return await runWithTenant(tenant, callback);
+    return await runWithScopedTenantTransaction(() => applyTenantContextToTransaction(activeConnection, tenant.id), () => runWithTenant(tenant, callback));
   }
   const pool = getDefaultDatabasePool();
   const begin = pool.begin;
   if (typeof begin !== "function") {
     throw new Error("RLS tenant scope requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
-  return await runWithDeferredModelEvents(async () => {
-    return await begin(async (transaction) => {
+  return await settleTransaction(() => runWithDeferredModelEvents(async () => {
+    return await begin.bind(pool)(async (transaction) => {
       await applyTenantContextToTransaction(transaction, tenant.id);
       return await runWithDatabaseConnection(transaction, async () => {
-        return await runWithTenant(tenant, callback);
+        return await runWithTransactionScope(async () => commitOrRollbackScope(await runWithTenant(tenant, callback)));
       });
     });
-  });
+  }));
 }
 function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {
   return hasActiveDatabaseConnection() && currentTenant()?.id === tenantId;
 }
 var init_tenantDatabaseScope = __esm(() => {
   init_connectionContext();
+  init_transactionControl();
   init_deferredModelEvents();
+  init_databaseTenantContext();
   init_tenancyConfig();
   init_tenantContext();
 });
@@ -234,6 +313,441 @@ var init_deferredModelEvents = __esm(() => {
   deferredModelEvents = createAsyncContextStore("@getstrata/deferredModelEvents");
 });
 
+// ../../src/core/database/connection.ts
+function createDatabaseConnection(source) {
+  return {
+    async unsafe(query, params = []) {
+      return await source.unsafe(query, params);
+    }
+  };
+}
+var init_connection = () => {};
+
+// ../../src/core/database/boundConnection.ts
+function boundConnectionState() {
+  const globalRecord = globalThis;
+  const existing = globalRecord[BOUND_CONNECTION_KEY];
+  if (existing) {
+    return existing;
+  }
+  const created = { connection: null };
+  globalRecord[BOUND_CONNECTION_KEY] = created;
+  return created;
+}
+function getBoundDatabaseConnection() {
+  return boundConnectionState().connection;
+}
+var BOUND_CONNECTION_KEY;
+var init_boundConnection = __esm(() => {
+  BOUND_CONNECTION_KEY = Symbol.for("@getstrata/boundDatabaseConnection");
+});
+
+// ../../src/core/database/queryProxy.ts
+var POOL_CONNECTION_METHODS;
+var init_queryProxy = __esm(() => {
+  init_connectionContext();
+  POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+});
+
+// ../../src/core/database/defaultConnection.ts
+function defaultConnectionState() {
+  const globalRecord = globalThis;
+  const existing = globalRecord[DEFAULT_CONNECTION_KEY];
+  if (existing) {
+    return existing;
+  }
+  const created = { pool: null, query: null };
+  globalRecord[DEFAULT_CONNECTION_KEY] = created;
+  return created;
+}
+function getDefaultDatabasePool2() {
+  const pool = defaultConnectionState().pool;
+  if (!pool) {
+    throw new Error("Default database pool is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
+  }
+  return pool;
+}
+function getDefaultDatabaseQuery() {
+  const query = defaultConnectionState().query;
+  if (!query) {
+    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
+  }
+  return query;
+}
+var DEFAULT_CONNECTION_KEY;
+var init_defaultConnection = __esm(() => {
+  init_queryProxy();
+  DEFAULT_CONNECTION_KEY = Symbol.for("@getstrata/defaultDatabaseConnection");
+});
+
+// ../../src/core/database/schema/driver.ts
+function normalizeConnectionName(connection) {
+  const normalized = connection.trim().toLowerCase();
+  if (normalized === "pgsql" || normalized === "postgres" || normalized === "postgresql") {
+    return "pgsql";
+  }
+  if (normalized === "mysql" || normalized === "mariadb") {
+    return "mysql";
+  }
+  if (normalized === "sqlite") {
+    return "sqlite";
+  }
+  throw new Error(`Unsupported DB_CONNECTION: ${connection}`);
+}
+function resolveDriverFromUrl(url) {
+  const normalized = url.trim().toLowerCase();
+  if (normalized.startsWith("postgres://") || normalized.startsWith("postgresql://") || normalized.startsWith("postgres:")) {
+    return "pgsql";
+  }
+  if (normalized.startsWith("mysql://") || normalized.startsWith("mysql:")) {
+    return "mysql";
+  }
+  if (normalized.startsWith("sqlite:")) {
+    return "sqlite";
+  }
+  return null;
+}
+function resolveDatabaseDriver(options = {}) {
+  const connection = options.connection ?? process.env.DB_CONNECTION;
+  if (connection) {
+    return normalizeConnectionName(connection);
+  }
+  const url = options.url ?? process.env.DATABASE_URL ?? "";
+  const fromUrl = resolveDriverFromUrl(url);
+  if (fromUrl) {
+    return fromUrl;
+  }
+  return "pgsql";
+}
+var init_driver = () => {};
+
+// ../../src/core/database/dialect.ts
+function assertSafeIdentifier(identifier) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
+    throw new Error(`Invalid SQL identifier: ${identifier}`);
+  }
+  return identifier;
+}
+function quoteIdentifierFor(dialect, column) {
+  return dialect.quoteIdentifier(column);
+}
+function dialectFor(driver) {
+  return dialects[driver];
+}
+function currentSqlDialect() {
+  return dialectContext.getStore() ?? dialectOverride ?? dialectFor(resolveDatabaseDriver());
+}
+var postgresDialect, mysqlDialect, sqliteDialect, dialects, dialectContext, dialectOverride = null;
+var init_dialect = __esm(() => {
+  init_asyncContextStore();
+  init_driver();
+  postgresDialect = {
+    driver: "pgsql",
+    placeholder(index) {
+      return `$${index}`;
+    },
+    quoteIdentifier(identifier) {
+      return `"${assertSafeIdentifier(identifier)}"`;
+    },
+    nowExpression() {
+      return "NOW()";
+    },
+    timestampValue(value) {
+      return value.toISOString();
+    },
+    returningClause(columns) {
+      return ` RETURNING ${columns}`;
+    },
+    ilikeOperator() {
+      return "ILIKE";
+    },
+    nullsLastSuffix() {
+      return " NULLS LAST";
+    },
+    castToText(expression) {
+      return `${expression}::text`;
+    },
+    upsertSuffix(conflictColumns, updateColumns) {
+      const target = conflictColumns.map((column) => quoteIdentifierFor(this, column)).join(", ");
+      if (updateColumns.length === 0) {
+        return ` ON CONFLICT (${target}) DO NOTHING`;
+      }
+      const assignments = updateColumns.map((column) => {
+        const quoted = quoteIdentifierFor(this, column);
+        return `${quoted} = excluded.${quoted}`;
+      }).join(", ");
+      return ` ON CONFLICT (${target}) DO UPDATE SET ${assignments}`;
+    }
+  };
+  mysqlDialect = {
+    driver: "mysql",
+    placeholder() {
+      return "?";
+    },
+    quoteIdentifier(identifier) {
+      return `\`${assertSafeIdentifier(identifier)}\``;
+    },
+    nowExpression() {
+      return "CURRENT_TIMESTAMP";
+    },
+    timestampValue(value) {
+      return value.toISOString().slice(0, 19).replace("T", " ");
+    },
+    returningClause() {
+      return "";
+    },
+    ilikeOperator() {
+      return "LIKE";
+    },
+    nullsLastSuffix() {
+      return "";
+    },
+    castToText(expression) {
+      return `CAST(${expression} AS CHAR)`;
+    },
+    upsertSuffix(conflictColumns, updateColumns) {
+      if (updateColumns.length === 0) {
+        const anchor = quoteIdentifierFor(this, conflictColumns[0] ?? "");
+        return ` ON DUPLICATE KEY UPDATE ${anchor} = ${anchor}`;
+      }
+      const assignments = updateColumns.map((column) => {
+        const quoted = quoteIdentifierFor(this, column);
+        return `${quoted} = VALUES(${quoted})`;
+      }).join(", ");
+      return ` ON DUPLICATE KEY UPDATE ${assignments}`;
+    }
+  };
+  sqliteDialect = {
+    driver: "sqlite",
+    placeholder() {
+      return "?";
+    },
+    quoteIdentifier(identifier) {
+      return `"${assertSafeIdentifier(identifier)}"`;
+    },
+    nowExpression() {
+      return "strftime('%Y-%m-%dT%H:%M:%fZ', 'now')";
+    },
+    timestampValue(value) {
+      return value.toISOString();
+    },
+    returningClause(columns) {
+      return ` RETURNING ${columns}`;
+    },
+    ilikeOperator() {
+      return "LIKE";
+    },
+    nullsLastSuffix() {
+      return "";
+    },
+    castToText(expression) {
+      return `CAST(${expression} AS TEXT)`;
+    },
+    upsertSuffix(conflictColumns, updateColumns) {
+      const target = conflictColumns.map((column) => quoteIdentifierFor(this, column)).join(", ");
+      if (updateColumns.length === 0) {
+        return ` ON CONFLICT (${target}) DO NOTHING`;
+      }
+      const assignments = updateColumns.map((column) => {
+        const quoted = quoteIdentifierFor(this, column);
+        return `${quoted} = excluded.${quoted}`;
+      }).join(", ");
+      return ` ON CONFLICT (${target}) DO UPDATE SET ${assignments}`;
+    }
+  };
+  dialects = {
+    pgsql: postgresDialect,
+    mysql: mysqlDialect,
+    sqlite: sqliteDialect
+  };
+  dialectContext = createAsyncContextStore("@getstrata/sqlDialect");
+});
+
+// ../../src/core/database/repositoryConnection.ts
+function resolveRepositoryConnection() {
+  return getActiveDatabaseConnection(getBoundDatabaseConnection() ?? getDefaultDatabaseQuery());
+}
+function compileTaggedSql(strings, values) {
+  const dialect = currentSqlDialect();
+  let query = strings[0] ?? "";
+  const params = [];
+  for (let index = 0;index < values.length; index += 1) {
+    params.push(values[index]);
+    query += `${dialect.placeholder(params.length)}${strings[index + 1] ?? ""}`;
+  }
+  return { query, params };
+}
+function isTaggedStrings(value) {
+  if (!Array.isArray(value) || typeof value[0] !== "string") {
+    return false;
+  }
+  return typeof value.raw !== "undefined";
+}
+function runOnConnection(connection, args) {
+  if (typeof connection === "function") {
+    return connection(...args);
+  }
+  if (typeof connection.unsafe !== "function") {
+    throw new Error("Database connection cannot run SQL.");
+  }
+  const strings = args[0];
+  if (!isTaggedStrings(strings)) {
+    throw new Error("Database connection cannot run tagged SQL.");
+  }
+  const compiled = compileTaggedSql(strings, args.slice(1));
+  return connection.unsafe(compiled.query, compiled.params);
+}
+var repositoryConnection;
+var init_repositoryConnection = __esm(() => {
+  init_boundConnection();
+  init_connectionContext();
+  init_defaultConnection();
+  init_dialect();
+  repositoryConnection = new Proxy(function repositoryConnection() {}, {
+    apply(_target, _thisArg, args) {
+      return runOnConnection(resolveRepositoryConnection(), args);
+    },
+    get(_target, property) {
+      const connection = resolveRepositoryConnection();
+      const value = connection[property];
+      return typeof value === "function" ? value.bind(connection) : value;
+    }
+  });
+});
+
+// ../../src/core/database/transaction.ts
+async function runInSavepoint(connection, operation) {
+  const inherited = transactionFrame.getStore();
+  let parent = inherited?.connection === connection ? inherited : outerFrames.get(connection);
+  if (!parent) {
+    parent = { connection, childActive: false };
+    outerFrames.set(connection, parent);
+  }
+  if (parent.childActive) {
+    throw new Error("Concurrent nested transactions on one connection are not supported. Await each transaction before starting the next.");
+  }
+  parent.childActive = true;
+  const name = `strata_${crypto.randomUUID().replaceAll("-", "")}`;
+  try {
+    return await settleTransaction(() => runWithDeferredModelEvents(async () => {
+      await connection.unsafe(`SAVEPOINT ${name}`);
+      try {
+        const result = await transactionFrame.run({ connection, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await operation(createDatabaseConnection(connection)))));
+        await connection.unsafe(`RELEASE SAVEPOINT ${name}`);
+        return result;
+      } catch (error) {
+        await connection.unsafe(`ROLLBACK TO SAVEPOINT ${name}`);
+        await connection.unsafe(`RELEASE SAVEPOINT ${name}`);
+        throw error;
+      }
+    }));
+  } finally {
+    parent.childActive = false;
+  }
+}
+function supportsTransactions(connection) {
+  return typeof connection.begin === "function";
+}
+async function runInTransaction(operation) {
+  const pool = resolveRepositoryConnection();
+  if (hasActiveDatabaseConnection()) {
+    return await runInSavepoint(getActiveDatabaseConnection(pool), operation);
+  }
+  if (!supportsTransactions(pool)) {
+    throw new Error("Active database connection does not support transactions. Bind a client with begin() via bindDatabaseConnection.");
+  }
+  return await settleTransaction(() => runWithDeferredModelEvents(async () => {
+    return await pool.begin(async (transaction) => {
+      return await runWithDatabaseConnection(transaction, () => transactionFrame.run({ connection: transaction, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await operation(createDatabaseConnection(transaction))))));
+    });
+  }));
+}
+var transactionFrame, outerFrames;
+var init_transaction = __esm(() => {
+  init_deferredModelEvents();
+  init_asyncContextStore();
+  init_connection();
+  init_connectionContext();
+  init_repositoryConnection();
+  init_transactionControl();
+  transactionFrame = createAsyncContextStore("@getstrata/transactionFrame");
+  outerFrames = new WeakMap;
+});
+
+// ../../src/core/tenant/databaseTenantContext.ts
+import { getDefaultDatabasePool as getDefaultDatabasePool3 } from "@getstrata/core/database/defaultConnection";
+async function applyBypassToTransaction(transaction, bypass) {
+  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, [
+    bypass ? "true" : "false"
+  ]);
+}
+function stringifyBypassIdentifier(identifier) {
+  if (typeof identifier === "number") {
+    return String(identifier);
+  }
+  return identifier.trim();
+}
+async function applyIdentifierToTransaction(transaction, identifier) {
+  await transaction.unsafe(`SELECT set_config('app.bypass_identifier', $1, true)`, [
+    stringifyBypassIdentifier(identifier)
+  ]);
+}
+function assertBypassIdentifier(identifier) {
+  if (typeof identifier === "number") {
+    if (!Number.isInteger(identifier) || identifier <= 0) {
+      throw new Error("RLS bypass requires a caller-supplied identifier that pins the row.");
+    }
+    return;
+  }
+  if (typeof identifier === "string" && identifier.trim() !== "") {
+    return;
+  }
+  throw new Error("RLS bypass requires a caller-supplied identifier that pins the row.");
+}
+async function runWithScopedTenantTransaction(apply, callback) {
+  if (!isRlsTenancy()) {
+    return await callback();
+  }
+  if (hasActiveDatabaseConnection()) {
+    const connection = getActiveDatabaseConnection(getDefaultDatabasePool3());
+    return await runInTransaction(async () => {
+      const [previous] = await connection.unsafe(`SELECT current_setting('app.tenant_id', true) AS tenant_id,
+        current_setting('app.bypass_rls', true) AS bypass_rls,
+        current_setting('app.bypass_identifier', true) AS bypass_identifier`);
+      await apply(connection);
+      const result = await callback();
+      await connection.unsafe(`SELECT set_config('app.tenant_id', $1, true),
+        set_config('app.bypass_rls', $2, true), set_config('app.bypass_identifier', $3, true)`, [previous?.tenant_id ?? "", previous?.bypass_rls ?? "", previous?.bypass_identifier ?? ""]);
+      return result;
+    });
+  }
+  const pool = getDefaultDatabasePool3();
+  const begin = pool.begin;
+  if (typeof begin !== "function") {
+    throw new Error("RLS migration bypass requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
+  }
+  return await settleTransaction(() => runWithDeferredModelEvents(async () => {
+    return await begin.bind(pool)(async (transaction) => {
+      await apply(transaction);
+      return await runWithDatabaseConnection(transaction, () => runWithTransactionScope(async () => commitOrRollbackScope(await callback())));
+    });
+  }));
+}
+async function runWithMigrationBypass(callback) {
+  return await runWithScopedTenantTransaction((transaction) => applyBypassToTransaction(transaction, true), callback);
+}
+async function runWithMigrationBypassForIdentifier(identifier, callback) {
+  assertBypassIdentifier(identifier);
+  return await runWithScopedTenantTransaction((transaction) => applyIdentifierToTransaction(transaction, identifier), callback);
+}
+var init_databaseTenantContext = __esm(() => {
+  init_connectionContext();
+  init_transaction();
+  init_transactionControl();
+  init_deferredModelEvents();
+  init_tenancyConfig();
+});
+
 // ../../src/core/audit/exportAuditLogs.ts
 import { repositoryConnection as db } from "@getstrata/core/database/repositoryConnection";
 
@@ -610,62 +1124,8 @@ async function safeFetch(input, init = {}, options = {}) {
   }
 }
 
-// ../../src/core/tenant/databaseTenantContext.ts
-init_connectionContext();
-init_deferredModelEvents();
-init_tenancyConfig();
-import { getDefaultDatabasePool as getDefaultDatabasePool2 } from "@getstrata/core/database/defaultConnection";
-async function applyBypassToTransaction(transaction, bypass) {
-  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, [
-    bypass ? "true" : "false"
-  ]);
-}
-function stringifyBypassIdentifier(identifier) {
-  if (typeof identifier === "number") {
-    return String(identifier);
-  }
-  return identifier.trim();
-}
-async function applyIdentifierToTransaction(transaction, identifier) {
-  await transaction.unsafe(`SELECT set_config('app.bypass_identifier', $1, true)`, [
-    stringifyBypassIdentifier(identifier)
-  ]);
-}
-function assertBypassIdentifier(identifier) {
-  if (typeof identifier === "number") {
-    if (!Number.isInteger(identifier) || identifier <= 0) {
-      throw new Error("RLS bypass requires a caller-supplied identifier that pins the row.");
-    }
-    return;
-  }
-  if (typeof identifier === "string" && identifier.trim() !== "") {
-    return;
-  }
-  throw new Error("RLS bypass requires a caller-supplied identifier that pins the row.");
-}
-async function runWithScopedTenantTransaction(apply, callback) {
-  if (!isRlsTenancy()) {
-    return await callback();
-  }
-  const pool = getDefaultDatabasePool2();
-  const begin = pool.begin;
-  if (typeof begin !== "function") {
-    throw new Error("RLS migration bypass requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
-  }
-  return await runWithDeferredModelEvents(async () => {
-    return await begin(async (transaction) => {
-      await apply(transaction);
-      return await runWithDatabaseConnection(transaction, callback);
-    });
-  });
-}
-async function runWithMigrationBypass(callback) {
-  return await runWithScopedTenantTransaction((transaction) => applyBypassToTransaction(transaction, true), callback);
-}
-async function runWithMigrationBypassForIdentifier(identifier, callback) {
-  assertBypassIdentifier(identifier);
-  return await runWithScopedTenantTransaction((transaction) => applyIdentifierToTransaction(transaction, identifier), callback);
-}
+// ../../src/core/audit/exportAuditLogs.ts
+init_databaseTenantContext();
 
 // ../../src/core/audit/siemFormatter.ts
 function formatSiemAuditEvent(input) {