@getstrata/core 1.1.9 → 2.0.1

package/dist/index.js

@@ -26,6 +26,31 @@ function createAsyncContextStore(key) {
 }
 var init_asyncContextStore = () => {};
 
+// ../../src/core/database/boundConnection.ts
+function boundConnectionState() {
+  const globalRecord = globalThis;
+  const existing = globalRecord[BOUND_CONNECTION_KEY];
+  if (existing) {
+    return existing;
+  }
+  const created = { connection: null };
+  globalRecord[BOUND_CONNECTION_KEY] = created;
+  return created;
+}
+function bindDatabaseConnection(connection) {
+  boundConnectionState().connection = connection;
+}
+function getBoundDatabaseConnection() {
+  return boundConnectionState().connection;
+}
+function resetBoundDatabaseConnection() {
+  boundConnectionState().connection = null;
+}
+var BOUND_CONNECTION_KEY;
+var init_boundConnection = __esm(() => {
+  BOUND_CONNECTION_KEY = Symbol.for("@getstrata/boundDatabaseConnection");
+});
+
 // ../../src/core/database/connectionContext.ts
 function runWithDatabaseConnection(connection, callback) {
   return activeConnection.run(connection, callback);
@@ -111,6 +136,202 @@ var init_defaultConnection = __esm(() => {
   DEFAULT_CONNECTION_KEY = Symbol.for("@getstrata/defaultDatabaseConnection");
 });
 
+// ../../src/core/database/schema/driver.ts
+function normalizeConnectionName(connection) {
+  const normalized = connection.trim().toLowerCase();
+  if (normalized === "pgsql" || normalized === "postgres" || normalized === "postgresql") {
+    return "pgsql";
+  }
+  if (normalized === "mysql" || normalized === "mariadb") {
+    return "mysql";
+  }
+  if (normalized === "sqlite") {
+    return "sqlite";
+  }
+  throw new Error(`Unsupported DB_CONNECTION: ${connection}`);
+}
+function resolveDriverFromUrl(url) {
+  const normalized = url.trim().toLowerCase();
+  if (normalized.startsWith("postgres://") || normalized.startsWith("postgresql://") || normalized.startsWith("postgres:")) {
+    return "pgsql";
+  }
+  if (normalized.startsWith("mysql://") || normalized.startsWith("mysql:")) {
+    return "mysql";
+  }
+  if (normalized.startsWith("sqlite:")) {
+    return "sqlite";
+  }
+  return null;
+}
+function resolveDatabaseDriver(options = {}) {
+  const connection = options.connection ?? process.env.DB_CONNECTION;
+  if (connection) {
+    return normalizeConnectionName(connection);
+  }
+  const url = options.url ?? process.env.DATABASE_URL ?? "";
+  const fromUrl = resolveDriverFromUrl(url);
+  if (fromUrl) {
+    return fromUrl;
+  }
+  return "pgsql";
+}
+var init_driver = () => {};
+
+// ../../src/core/database/dialect.ts
+function assertSafeIdentifier(identifier) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
+    throw new Error(`Invalid SQL identifier: ${identifier}`);
+  }
+  return identifier;
+}
+function quoteIdentifierFor(dialect, column) {
+  return dialect.quoteIdentifier(column);
+}
+function dialectFor(driver) {
+  return dialects[driver];
+}
+function currentSqlDialect() {
+  return dialectContext.getStore() ?? dialectOverride ?? dialectFor(resolveDatabaseDriver());
+}
+function useSqlDialect(driver) {
+  dialectOverride = dialectFor(driver);
+  return dialectOverride;
+}
+function sqlTimestamp(value = new Date) {
+  return currentSqlDialect().timestampValue(value);
+}
+function resetSqlDialect() {
+  dialectOverride = null;
+}
+function runWithSqlDialect(driver, callback) {
+  return dialectContext.run(dialectFor(driver), callback);
+}
+var postgresDialect, mysqlDialect, sqliteDialect, dialects, dialectContext, dialectOverride = null;
+var init_dialect = __esm(() => {
+  init_asyncContextStore();
+  init_driver();
+  postgresDialect = {
+    driver: "pgsql",
+    placeholder(index) {
+      return `$${index}`;
+    },
+    quoteIdentifier(identifier) {
+      return `"${assertSafeIdentifier(identifier)}"`;
+    },
+    nowExpression() {
+      return "NOW()";
+    },
+    timestampValue(value) {
+      return value.toISOString();
+    },
+    returningClause(columns) {
+      return ` RETURNING ${columns}`;
+    },
+    ilikeOperator() {
+      return "ILIKE";
+    },
+    nullsLastSuffix() {
+      return " NULLS LAST";
+    },
+    castToText(expression) {
+      return `${expression}::text`;
+    },
+    upsertSuffix(conflictColumns, updateColumns) {
+      const target = conflictColumns.map((column) => quoteIdentifierFor(this, column)).join(", ");
+      if (updateColumns.length === 0) {
+        return ` ON CONFLICT (${target}) DO NOTHING`;
+      }
+      const assignments = updateColumns.map((column) => {
+        const quoted = quoteIdentifierFor(this, column);
+        return `${quoted} = excluded.${quoted}`;
+      }).join(", ");
+      return ` ON CONFLICT (${target}) DO UPDATE SET ${assignments}`;
+    }
+  };
+  mysqlDialect = {
+    driver: "mysql",
+    placeholder() {
+      return "?";
+    },
+    quoteIdentifier(identifier) {
+      return `\`${assertSafeIdentifier(identifier)}\``;
+    },
+    nowExpression() {
+      return "CURRENT_TIMESTAMP";
+    },
+    timestampValue(value) {
+      return value.toISOString().slice(0, 19).replace("T", " ");
+    },
+    returningClause() {
+      return "";
+    },
+    ilikeOperator() {
+      return "LIKE";
+    },
+    nullsLastSuffix() {
+      return "";
+    },
+    castToText(expression) {
+      return `CAST(${expression} AS CHAR)`;
+    },
+    upsertSuffix(conflictColumns, updateColumns) {
+      if (updateColumns.length === 0) {
+        const anchor = quoteIdentifierFor(this, conflictColumns[0] ?? "");
+        return ` ON DUPLICATE KEY UPDATE ${anchor} = ${anchor}`;
+      }
+      const assignments = updateColumns.map((column) => {
+        const quoted = quoteIdentifierFor(this, column);
+        return `${quoted} = VALUES(${quoted})`;
+      }).join(", ");
+      return ` ON DUPLICATE KEY UPDATE ${assignments}`;
+    }
+  };
+  sqliteDialect = {
+    driver: "sqlite",
+    placeholder() {
+      return "?";
+    },
+    quoteIdentifier(identifier) {
+      return `"${assertSafeIdentifier(identifier)}"`;
+    },
+    nowExpression() {
+      return "strftime('%Y-%m-%dT%H:%M:%fZ', 'now')";
+    },
+    timestampValue(value) {
+      return value.toISOString();
+    },
+    returningClause(columns) {
+      return ` RETURNING ${columns}`;
+    },
+    ilikeOperator() {
+      return "LIKE";
+    },
+    nullsLastSuffix() {
+      return "";
+    },
+    castToText(expression) {
+      return `CAST(${expression} AS TEXT)`;
+    },
+    upsertSuffix(conflictColumns, updateColumns) {
+      const target = conflictColumns.map((column) => quoteIdentifierFor(this, column)).join(", ");
+      if (updateColumns.length === 0) {
+        return ` ON CONFLICT (${target}) DO NOTHING`;
+      }
+      const assignments = updateColumns.map((column) => {
+        const quoted = quoteIdentifierFor(this, column);
+        return `${quoted} = excluded.${quoted}`;
+      }).join(", ");
+      return ` ON CONFLICT (${target}) DO UPDATE SET ${assignments}`;
+    }
+  };
+  dialects = {
+    pgsql: postgresDialect,
+    mysql: mysqlDialect,
+    sqlite: sqliteDialect
+  };
+  dialectContext = createAsyncContextStore("@getstrata/sqlDialect");
+});
+
 // ../../src/core/tenant/tenantContext.ts
 function runWithTenant(tenant, callback) {
   return tenantContext.run(tenant, callback);
@@ -141,6 +362,58 @@ var init_tenantContext = __esm(() => {
   tenantContext = createAsyncContextStore("@getstrata/tenantContext");
 });
 
+// ../../src/core/database/repositoryConnection.ts
+function resolveRepositoryConnection() {
+  return getActiveDatabaseConnection(getBoundDatabaseConnection() ?? getDefaultDatabaseQuery());
+}
+function compileTaggedSql(strings, values) {
+  const dialect = currentSqlDialect();
+  let query = strings[0] ?? "";
+  const params = [];
+  for (let index = 0;index < values.length; index += 1) {
+    params.push(values[index]);
+    query += `${dialect.placeholder(params.length)}${strings[index + 1] ?? ""}`;
+  }
+  return { query, params };
+}
+function isTaggedStrings(value) {
+  if (!Array.isArray(value) || typeof value[0] !== "string") {
+    return false;
+  }
+  return typeof value.raw !== "undefined";
+}
+function runOnConnection(connection, args) {
+  if (typeof connection === "function") {
+    return connection(...args);
+  }
+  if (typeof connection.unsafe !== "function") {
+    throw new Error("Database connection cannot run SQL.");
+  }
+  const strings = args[0];
+  if (!isTaggedStrings(strings)) {
+    throw new Error("Database connection cannot run tagged SQL.");
+  }
+  const compiled = compileTaggedSql(strings, args.slice(1));
+  return connection.unsafe(compiled.query, compiled.params);
+}
+var repositoryConnection;
+var init_repositoryConnection = __esm(() => {
+  init_boundConnection();
+  init_connectionContext();
+  init_defaultConnection();
+  init_dialect();
+  repositoryConnection = new Proxy(function repositoryConnection() {}, {
+    apply(_target, _thisArg, args) {
+      return runOnConnection(resolveRepositoryConnection(), args);
+    },
+    get(_target, property) {
+      const connection = resolveRepositoryConnection();
+      const value = connection[property];
+      return typeof value === "function" ? value.bind(connection) : value;
+    }
+  });
+});
+
 // ../../src/core/tenant/tenancyConfig.ts
 function readTenancyDriver(env = process.env) {
   const raw = env.TENANCY_DRIVER?.trim();
@@ -163,6 +436,80 @@ var init_tenancyConfig = __esm(() => {
   TENANCY_DRIVERS = ["rls", "column", "none"];
 });
 
+// ../../src/core/database/transactionControl.ts
+function unwrapTransactionRollback(error, depth = 0) {
+  if (error instanceof TransactionRollback) {
+    return error;
+  }
+  if (depth >= 5 || !(error instanceof Error) || error.cause === undefined) {
+    return null;
+  }
+  return unwrapTransactionRollback(error.cause, depth + 1);
+}
+function requestTransactionRollback() {
+  const state = transactionScopes.getStore();
+  const index = state ? state.rollback.length - 1 : -1;
+  if (!state || index < 0) {
+    return;
+  }
+  const flags = state.rollback;
+  const current = flags[index];
+  if (current === undefined) {
+    return;
+  }
+  flags[index] = true;
+}
+function scopeRequestsRollback() {
+  const state = transactionScopes.getStore();
+  if (!state || state.rollback.length === 0) {
+    return false;
+  }
+  return state.rollback[state.rollback.length - 1] === true;
+}
+async function commitOrRollbackScope(result) {
+  if (scopeRequestsRollback()) {
+    throw new TransactionRollback(result);
+  }
+  return result;
+}
+async function settleTransaction(work) {
+  try {
+    return await work();
+  } catch (error) {
+    const rollback = unwrapTransactionRollback(error);
+    if (rollback) {
+      return rollback.result;
+    }
+    throw error;
+  }
+}
+async function runWithTransactionScope(callback) {
+  const existing = transactionScopes.getStore();
+  if (existing) {
+    existing.rollback.push(false);
+    try {
+      return await callback();
+    } finally {
+      existing.rollback.pop();
+    }
+  }
+  const state = { rollback: [false] };
+  return await transactionScopes.run(state, callback);
+}
+var TransactionRollback, transactionScopes;
+var init_transactionControl = __esm(() => {
+  init_asyncContextStore();
+  TransactionRollback = class TransactionRollback extends Error {
+    result;
+    constructor(result) {
+      super("Transaction rolled back");
+      this.name = "TransactionRollback";
+      this.result = result;
+    }
+  };
+  transactionScopes = createAsyncContextStore("@getstrata/transactionScopes");
+});
+
 // ../../src/core/events/eventBus.ts
 class EventBus {
   constructor() {}
@@ -294,33 +641,171 @@ var init_deferredModelEvents = __esm(() => {
   deferredModelEvents = createAsyncContextStore("@getstrata/deferredModelEvents");
 });
 
+// ../../src/core/database/connection.ts
+function createDatabaseConnection(source) {
+  return {
+    async unsafe(query, params = []) {
+      return await source.unsafe(query, params);
+    }
+  };
+}
+var init_connection = () => {};
+
+// ../../src/core/database/transaction.ts
+async function runInSavepoint(connection, operation) {
+  const inherited = transactionFrame.getStore();
+  let parent = inherited?.connection === connection ? inherited : outerFrames.get(connection);
+  if (!parent) {
+    parent = { connection, childActive: false };
+    outerFrames.set(connection, parent);
+  }
+  if (parent.childActive) {
+    throw new Error("Concurrent nested transactions on one connection are not supported. Await each transaction before starting the next.");
+  }
+  parent.childActive = true;
+  const name = `strata_${crypto.randomUUID().replaceAll("-", "")}`;
+  try {
+    return await settleTransaction(() => runWithDeferredModelEvents(async () => {
+      await connection.unsafe(`SAVEPOINT ${name}`);
+      try {
+        const result = await transactionFrame.run({ connection, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await operation(createDatabaseConnection(connection)))));
+        await connection.unsafe(`RELEASE SAVEPOINT ${name}`);
+        return result;
+      } catch (error) {
+        await connection.unsafe(`ROLLBACK TO SAVEPOINT ${name}`);
+        await connection.unsafe(`RELEASE SAVEPOINT ${name}`);
+        throw error;
+      }
+    }));
+  } finally {
+    parent.childActive = false;
+  }
+}
+function supportsTransactions(connection) {
+  return typeof connection.begin === "function";
+}
+async function runInTransaction(operation) {
+  const pool = resolveRepositoryConnection();
+  if (hasActiveDatabaseConnection()) {
+    return await runInSavepoint(getActiveDatabaseConnection(pool), operation);
+  }
+  if (!supportsTransactions(pool)) {
+    throw new Error("Active database connection does not support transactions. Bind a client with begin() via bindDatabaseConnection.");
+  }
+  return await settleTransaction(() => runWithDeferredModelEvents(async () => {
+    return await pool.begin(async (transaction) => {
+      return await runWithDatabaseConnection(transaction, () => transactionFrame.run({ connection: transaction, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await operation(createDatabaseConnection(transaction))))));
+    });
+  }));
+}
+var transactionFrame, outerFrames;
+var init_transaction = __esm(() => {
+  init_deferredModelEvents();
+  init_asyncContextStore();
+  init_connection();
+  init_connectionContext();
+  init_repositoryConnection();
+  init_transactionControl();
+  transactionFrame = createAsyncContextStore("@getstrata/transactionFrame");
+  outerFrames = new WeakMap;
+});
+
+// ../../src/core/tenant/databaseTenantContext.ts
+function stringifyBypassIdentifier(identifier) {
+  if (typeof identifier === "number") {
+    return String(identifier);
+  }
+  return identifier.trim();
+}
+async function applyIdentifierToTransaction(transaction, identifier) {
+  await transaction.unsafe(`SELECT set_config('app.bypass_identifier', $1, true)`, [
+    stringifyBypassIdentifier(identifier)
+  ]);
+}
+function assertBypassIdentifier(identifier) {
+  if (typeof identifier === "number") {
+    if (!Number.isInteger(identifier) || identifier <= 0) {
+      throw new Error("RLS bypass requires a caller-supplied identifier that pins the row.");
+    }
+    return;
+  }
+  if (typeof identifier === "string" && identifier.trim() !== "") {
+    return;
+  }
+  throw new Error("RLS bypass requires a caller-supplied identifier that pins the row.");
+}
+async function runWithScopedTenantTransaction(apply, callback) {
+  if (!isRlsTenancy()) {
+    return await callback();
+  }
+  if (hasActiveDatabaseConnection()) {
+    const connection = getActiveDatabaseConnection(getDefaultDatabasePool());
+    return await runInTransaction(async () => {
+      const [previous] = await connection.unsafe(`SELECT current_setting('app.tenant_id', true) AS tenant_id,
+        current_setting('app.bypass_rls', true) AS bypass_rls,
+        current_setting('app.bypass_identifier', true) AS bypass_identifier`);
+      await apply(connection);
+      const result = await callback();
+      await connection.unsafe(`SELECT set_config('app.tenant_id', $1, true),
+        set_config('app.bypass_rls', $2, true), set_config('app.bypass_identifier', $3, true)`, [previous?.tenant_id ?? "", previous?.bypass_rls ?? "", previous?.bypass_identifier ?? ""]);
+      return result;
+    });
+  }
+  const pool = getDefaultDatabasePool();
+  const begin = pool.begin;
+  if (typeof begin !== "function") {
+    throw new Error("RLS migration bypass requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
+  }
+  return await settleTransaction(() => runWithDeferredModelEvents(async () => {
+    return await begin.bind(pool)(async (transaction) => {
+      await apply(transaction);
+      return await runWithDatabaseConnection(transaction, () => runWithTransactionScope(async () => commitOrRollbackScope(await callback())));
+    });
+  }));
+}
+async function runWithMigrationBypassForIdentifier(identifier, callback) {
+  assertBypassIdentifier(identifier);
+  return await runWithScopedTenantTransaction((transaction) => applyIdentifierToTransaction(transaction, identifier), callback);
+}
+var init_databaseTenantContext = __esm(() => {
+  init_defaultConnection();
+  init_connectionContext();
+  init_transaction();
+  init_transactionControl();
+  init_deferredModelEvents();
+  init_tenancyConfig();
+});
+
 // ../../src/core/tenant/tenantDatabaseScope.ts
 async function applyTenantContextToTransaction(transaction, tenantId) {
   await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
 }
 async function runWithTenantDatabase(tenant, callback) {
+  const outerTenant = currentTenant();
+  if (hasActiveDatabaseConnection() && outerTenant && outerTenant.id !== tenant.id) {
+    throw new Error("Cannot switch tenants inside an active database transaction.");
+  }
   if (!isTenancyEnabled() || !isRlsTenancy()) {
     return await runWithTenant(tenant, callback);
   }
   if (hasActiveDatabaseConnection()) {
     const activeConnection = getActiveDatabaseConnection(getDefaultDatabasePool());
-    await applyTenantContextToTransaction(activeConnection, tenant.id);
-    return await runWithTenant(tenant, callback);
+    return await runWithScopedTenantTransaction(() => applyTenantContextToTransaction(activeConnection, tenant.id), () => runWithTenant(tenant, callback));
   }
   const pool = getDefaultDatabasePool();
   const begin = pool.begin;
   if (typeof begin !== "function") {
     throw new Error("RLS tenant scope requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
-  return await runWithDeferredModelEvents(async () => {
-    return await begin(async (transaction) => {
+  return await settleTransaction(() => runWithDeferredModelEvents(async () => {
+    return await begin.bind(pool)(async (transaction) => {
       await applyTenantContextToTransaction(transaction, tenant.id);
       return await runWithDatabaseConnection(transaction, async () => {
-        return await runWithTenant(tenant, callback);
+        return await runWithTransactionScope(async () => commitOrRollbackScope(await runWithTenant(tenant, callback)));
       });
     });
-  });
+  }));
 }
 function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {
   return hasActiveDatabaseConnection() && currentTenant()?.id === tenantId;
@@ -328,7 +813,9 @@ function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {
 var init_tenantDatabaseScope = __esm(() => {
   init_defaultConnection();
   init_connectionContext();
+  init_transactionControl();
   init_deferredModelEvents();
+  init_databaseTenantContext();
   init_tenancyConfig();
   init_tenantContext();
 });
@@ -545,29 +1032,8 @@ function resolveAuthUserDirectory(container) {
   return null;
 }
 
-// ../../src/core/database/boundConnection.ts
-var BOUND_CONNECTION_KEY = Symbol.for("@getstrata/boundDatabaseConnection");
-function boundConnectionState() {
-  const globalRecord = globalThis;
-  const existing = globalRecord[BOUND_CONNECTION_KEY];
-  if (existing) {
-    return existing;
-  }
-  const created = { connection: null };
-  globalRecord[BOUND_CONNECTION_KEY] = created;
-  return created;
-}
-function bindDatabaseConnection(connection) {
-  boundConnectionState().connection = connection;
-}
-function getBoundDatabaseConnection() {
-  return boundConnectionState().connection;
-}
-function resetBoundDatabaseConnection() {
-  boundConnectionState().connection = null;
-}
-
 // ../../src/core/auth/basicAuthGuard.ts
+init_boundConnection();
 init_defaultConnection();
 
 // ../../src/core/http/statelessAuth.ts
@@ -683,199 +1149,8 @@ function revealMfaSecret(stored) {
   return decryptField(stored, key);
 }
 
-// ../../src/core/database/dialect.ts
-init_asyncContextStore();
-
-// ../../src/core/database/schema/driver.ts
-function normalizeConnectionName(connection) {
-  const normalized = connection.trim().toLowerCase();
-  if (normalized === "pgsql" || normalized === "postgres" || normalized === "postgresql") {
-    return "pgsql";
-  }
-  if (normalized === "mysql" || normalized === "mariadb") {
-    return "mysql";
-  }
-  if (normalized === "sqlite") {
-    return "sqlite";
-  }
-  throw new Error(`Unsupported DB_CONNECTION: ${connection}`);
-}
-function resolveDriverFromUrl(url) {
-  const normalized = url.trim().toLowerCase();
-  if (normalized.startsWith("postgres://") || normalized.startsWith("postgresql://") || normalized.startsWith("postgres:")) {
-    return "pgsql";
-  }
-  if (normalized.startsWith("mysql://") || normalized.startsWith("mysql:")) {
-    return "mysql";
-  }
-  if (normalized.startsWith("sqlite:")) {
-    return "sqlite";
-  }
-  return null;
-}
-function resolveDatabaseDriver(options = {}) {
-  const connection = options.connection ?? process.env.DB_CONNECTION;
-  if (connection) {
-    return normalizeConnectionName(connection);
-  }
-  const url = options.url ?? process.env.DATABASE_URL ?? "";
-  const fromUrl = resolveDriverFromUrl(url);
-  if (fromUrl) {
-    return fromUrl;
-  }
-  return "pgsql";
-}
-
-// ../../src/core/database/dialect.ts
-function assertSafeIdentifier(identifier) {
-  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
-    throw new Error(`Invalid SQL identifier: ${identifier}`);
-  }
-  return identifier;
-}
-function quoteIdentifierFor(dialect, column) {
-  return dialect.quoteIdentifier(column);
-}
-var postgresDialect = {
-  driver: "pgsql",
-  placeholder(index) {
-    return `$${index}`;
-  },
-  quoteIdentifier(identifier) {
-    return `"${assertSafeIdentifier(identifier)}"`;
-  },
-  nowExpression() {
-    return "NOW()";
-  },
-  timestampValue(value) {
-    return value.toISOString();
-  },
-  returningClause(columns) {
-    return ` RETURNING ${columns}`;
-  },
-  ilikeOperator() {
-    return "ILIKE";
-  },
-  nullsLastSuffix() {
-    return " NULLS LAST";
-  },
-  castToText(expression) {
-    return `${expression}::text`;
-  },
-  upsertSuffix(conflictColumns, updateColumns) {
-    const target = conflictColumns.map((column) => quoteIdentifierFor(this, column)).join(", ");
-    if (updateColumns.length === 0) {
-      return ` ON CONFLICT (${target}) DO NOTHING`;
-    }
-    const assignments = updateColumns.map((column) => {
-      const quoted = quoteIdentifierFor(this, column);
-      return `${quoted} = excluded.${quoted}`;
-    }).join(", ");
-    return ` ON CONFLICT (${target}) DO UPDATE SET ${assignments}`;
-  }
-};
-var mysqlDialect = {
-  driver: "mysql",
-  placeholder() {
-    return "?";
-  },
-  quoteIdentifier(identifier) {
-    return `\`${assertSafeIdentifier(identifier)}\``;
-  },
-  nowExpression() {
-    return "CURRENT_TIMESTAMP";
-  },
-  timestampValue(value) {
-    return value.toISOString().slice(0, 19).replace("T", " ");
-  },
-  returningClause() {
-    return "";
-  },
-  ilikeOperator() {
-    return "LIKE";
-  },
-  nullsLastSuffix() {
-    return "";
-  },
-  castToText(expression) {
-    return `CAST(${expression} AS CHAR)`;
-  },
-  upsertSuffix(conflictColumns, updateColumns) {
-    if (updateColumns.length === 0) {
-      const anchor = quoteIdentifierFor(this, conflictColumns[0] ?? "");
-      return ` ON DUPLICATE KEY UPDATE ${anchor} = ${anchor}`;
-    }
-    const assignments = updateColumns.map((column) => {
-      const quoted = quoteIdentifierFor(this, column);
-      return `${quoted} = VALUES(${quoted})`;
-    }).join(", ");
-    return ` ON DUPLICATE KEY UPDATE ${assignments}`;
-  }
-};
-var sqliteDialect = {
-  driver: "sqlite",
-  placeholder() {
-    return "?";
-  },
-  quoteIdentifier(identifier) {
-    return `"${assertSafeIdentifier(identifier)}"`;
-  },
-  nowExpression() {
-    return "strftime('%Y-%m-%dT%H:%M:%fZ', 'now')";
-  },
-  timestampValue(value) {
-    return value.toISOString();
-  },
-  returningClause(columns) {
-    return ` RETURNING ${columns}`;
-  },
-  ilikeOperator() {
-    return "LIKE";
-  },
-  nullsLastSuffix() {
-    return "";
-  },
-  castToText(expression) {
-    return `CAST(${expression} AS TEXT)`;
-  },
-  upsertSuffix(conflictColumns, updateColumns) {
-    const target = conflictColumns.map((column) => quoteIdentifierFor(this, column)).join(", ");
-    if (updateColumns.length === 0) {
-      return ` ON CONFLICT (${target}) DO NOTHING`;
-    }
-    const assignments = updateColumns.map((column) => {
-      const quoted = quoteIdentifierFor(this, column);
-      return `${quoted} = excluded.${quoted}`;
-    }).join(", ");
-    return ` ON CONFLICT (${target}) DO UPDATE SET ${assignments}`;
-  }
-};
-var dialects = {
-  pgsql: postgresDialect,
-  mysql: mysqlDialect,
-  sqlite: sqliteDialect
-};
-var dialectContext = createAsyncContextStore("@getstrata/sqlDialect");
-var dialectOverride = null;
-function dialectFor(driver) {
-  return dialects[driver];
-}
-function currentSqlDialect() {
-  return dialectContext.getStore() ?? dialectOverride ?? dialectFor(resolveDatabaseDriver());
-}
-function useSqlDialect(driver) {
-  dialectOverride = dialectFor(driver);
-  return dialectOverride;
-}
-function sqlTimestamp(value = new Date) {
-  return currentSqlDialect().timestampValue(value);
-}
-function resetSqlDialect() {
-  dialectOverride = null;
-}
-function runWithSqlDialect(driver, callback) {
-  return dialectContext.run(dialectFor(driver), callback);
-}
+// ../../src/core/auth/passwordLogin.ts
+init_dialect();
 
 // ../../src/core/auth/tokenHash.ts
 import { createHmac as createHmac2 } from "crypto";
@@ -2393,7 +2668,9 @@ function missingOptionalPeer(packageName, reason, error) {
 }
 
 // ../../src/core/auth/saml/samlAssertionReplay.ts
+init_boundConnection();
 init_defaultConnection();
+init_dialect();
 
 // ../../src/core/database/errors.ts
 function isPostgresError(error) {
@@ -2711,6 +2988,7 @@ class SamlProvider {
   }
 }
 // ../../src/core/auth/oneTimeToken.ts
+init_dialect();
 import { randomBytes as randomBytes4 } from "crypto";
 var AUTH_ONE_TIME_PURPOSES = {
   passwordReset: "password_reset",
@@ -2776,7 +3054,11 @@ class PolicyGate {
     }
   }
 }
+// ../../src/core/database/bindConnection.ts
+init_boundConnection();
+
 // ../../src/core/auth/scimAuthMiddleware.ts
+init_boundConnection();
 init_defaultConnection();
 init_connectionContext();
 
@@ -2795,78 +3077,33 @@ function parseScimTenantTokens(raw) {
     const token = tokenPart.trim();
     if (Number.isInteger(tenantId) && tenantId > 0 && token.length > 0) {
       tokens.set(tenantId, token);
-    }
-  }
-  return tokens;
-}
-function resolveScimTenantFromToken(token) {
-  const presented = token.trim();
-  if (presented.length === 0) {
-    return null;
-  }
-  const tenantTokens = parseScimTenantTokens(process.env.SCIM_TENANT_TOKENS);
-  for (const [tenantId, expectedToken] of tenantTokens) {
-    if (timingSafeCompareString(presented, expectedToken)) {
-      return tenantId;
-    }
-  }
-  const fallbackToken = process.env.SCIM_BEARER_TOKEN?.trim() ?? "";
-  if (fallbackToken.length === 0) {
-    return null;
-  }
-  if (timingSafeCompareString(presented, fallbackToken)) {
-    return 1;
-  }
-  return null;
-}
-
-// ../../src/core/database/repositoryConnection.ts
-init_defaultConnection();
-function resolveRepositoryConnection() {
-  return getBoundDatabaseConnection() ?? getDefaultDatabaseQuery();
-}
-function compileTaggedSql(strings, values) {
-  const dialect = currentSqlDialect();
-  let query = strings[0] ?? "";
-  const params = [];
-  for (let index = 0;index < values.length; index += 1) {
-    params.push(values[index]);
-    query += `${dialect.placeholder(params.length)}${strings[index + 1] ?? ""}`;
-  }
-  return { query, params };
-}
-function isTaggedStrings(value) {
-  if (!Array.isArray(value) || typeof value[0] !== "string") {
-    return false;
+    }
   }
-  return typeof value.raw !== "undefined";
+  return tokens;
 }
-function runOnConnection(connection, args) {
-  if (typeof connection === "function") {
-    return connection(...args);
+function resolveScimTenantFromToken(token) {
+  const presented = token.trim();
+  if (presented.length === 0) {
+    return null;
   }
-  if (typeof connection.unsafe !== "function") {
-    throw new Error("Database connection cannot run SQL.");
+  const tenantTokens = parseScimTenantTokens(process.env.SCIM_TENANT_TOKENS);
+  for (const [tenantId, expectedToken] of tenantTokens) {
+    if (timingSafeCompareString(presented, expectedToken)) {
+      return tenantId;
+    }
   }
-  const strings = args[0];
-  if (!isTaggedStrings(strings)) {
-    throw new Error("Database connection cannot run tagged SQL.");
+  const fallbackToken = process.env.SCIM_BEARER_TOKEN?.trim() ?? "";
+  if (fallbackToken.length === 0) {
+    return null;
   }
-  const compiled = compileTaggedSql(strings, args.slice(1));
-  return connection.unsafe(compiled.query, compiled.params);
-}
-var repositoryConnection = new Proxy(function repositoryConnection() {}, {
-  apply(_target, _thisArg, args) {
-    return runOnConnection(resolveRepositoryConnection(), args);
-  },
-  get(_target, property) {
-    const connection = resolveRepositoryConnection();
-    const value = connection[property];
-    return typeof value === "function" ? value.bind(connection) : value;
+  if (timingSafeCompareString(presented, fallbackToken)) {
+    return 1;
   }
-});
+  return null;
+}
 
 // ../../src/core/tenant/resolveTenant.ts
+init_repositoryConnection();
 init_tenancyConfig();
 async function resolveTenant(tenantId) {
   if (!isTenancyEnabled()) {
@@ -3479,6 +3716,7 @@ function buildPaginationMeta(input) {
 }
 
 // ../../src/core/database/query.ts
+init_dialect();
 function quoteIdentifier(identifier) {
   return currentSqlDialect().quoteIdentifier(identifier);
 }
@@ -4233,6 +4471,9 @@ function indexMorphToRelation(children, parentsByType, relation) {
   return result;
 }
 
+// ../../src/core/database/baseRepository.ts
+init_repositoryConnection();
+
 // ../../src/core/database/pluck.ts
 function uniqueColumnSelect(table, columns) {
   const seen = new Set;
@@ -5042,8 +5283,9 @@ class BaseRepository {
 }
 var baseRepository_default = BaseRepository;
 // ../../src/core/database/bunSql.ts
-var {SQL } = globalThis.Bun;
+init_boundConnection();
 init_defaultConnection();
+var {SQL } = globalThis.Bun;
 function createBunSqlPool(options) {
   if (!options.url) {
     throw new Error("DATABASE_URL is not configured. Set url before creating a Bun SQL pool.");
@@ -5061,18 +5303,12 @@ function bindBunSql(sql) {
   registerDefaultDatabasePool(sql);
   return sql;
 }
-// ../../src/core/database/connection.ts
-function createDatabaseConnection(source) {
-  return {
-    async unsafe(query, params = []) {
-      return await source.unsafe(query, params);
-    }
-  };
-}
 
 // ../../src/framework/public-api.ts
+init_connection();
 init_connectionContext();
 init_defaultConnection();
+init_dialect();
 
 // ../../src/core/database/inflection.ts
 function singularize(word) {
@@ -5265,6 +5501,7 @@ async function withMigrationLock(db, callback, lockKey = MIGRATION_LOCK_KEY) {
   }
 }
 // ../../src/core/database/migrations/runner.ts
+init_dialect();
 import { readdir } from "fs/promises";
 import { join } from "path";
 import { pathToFileURL } from "url";
@@ -7151,6 +7388,7 @@ function createMysqlConnection(url) {
 }
 // ../../src/core/database/namedConnections.ts
 init_connectionContext();
+init_dialect();
 var REGISTRY_KEY = Symbol.for("@getstrata/namedConnections");
 function registry() {
   const globalRecord = globalThis;
@@ -7191,6 +7429,7 @@ function runOnNamedConnection(name, callback) {
 
 // ../../src/framework/public-api.ts
 init_queryProxy();
+init_repositoryConnection();
 
 // ../../src/core/database/schema/columnDefinition.ts
 class ColumnDefinition {
@@ -7413,6 +7652,10 @@ class Blueprint {
     });
   }
 }
+
+// ../../src/core/database/schema/index.ts
+init_driver();
+
 // ../../src/core/database/schema/errors.ts
 class UnsupportedSchemaFeatureError extends Error {
   constructor(feature, driver) {
@@ -7725,6 +7968,7 @@ function grammarForDriver(driver) {
   }
 }
 // ../../src/core/database/schema/schema.ts
+init_driver();
 class SchemaBuilder {
   #driver;
   #statements = [];
@@ -7840,25 +8084,9 @@ function createSqliteConnection(filename) {
 function defineTable(definition) {
   return definition;
 }
-// ../../src/core/database/transaction.ts
-init_deferredModelEvents();
-function supportsTransactions(connection) {
-  return typeof connection.begin === "function";
-}
-async function runInTransaction(operation) {
-  const pool = resolveRepositoryConnection();
-  if (!supportsTransactions(pool)) {
-    throw new Error("Active database connection does not support transactions. Bind a client with begin() via bindDatabaseConnection.");
-  }
-  const begin = pool.begin;
-  return await runWithDeferredModelEvents(async () => {
-    return await begin(async (transaction) => {
-      return await operation(createDatabaseConnection(transaction));
-    });
-  });
-}
 
 // ../../src/framework/public-api.ts
+init_transaction();
 init_eventBus();
 
 // ../../src/core/mail/mailer.ts
@@ -9202,7 +9430,8 @@ function wrapRouteHandler(handler, middleware) {
 function applyMiddlewareToRoutes(routes, middleware) {
   const wrapped = {};
   for (const [path, routeHandler] of Object.entries(routes)) {
-    wrapped[path] = wrapRouteHandler(routeHandler, middleware);
+    const identity = async (_request, next) => await runWithRequestMeta({ ...currentRequestMeta(), routeTemplate: path }, next);
+    wrapped[path] = wrapRouteHandler(routeHandler, [identity, ...middleware]);
   }
   return wrapped;
 }
@@ -9406,6 +9635,9 @@ function toPaginatedResourceCollection(items, meta, transformer) {
     meta
   };
 }
+// ../../src/core/http/response.ts
+init_transactionControl();
+
 // ../../src/core/http/safeInternalPath.ts
 var NESTED_REDIRECT_KEYS = new Set(["redirect", "next", "return", "returnTo", "return_to"]);
 function looksLikeExternalTarget(value) {
@@ -9707,6 +9939,7 @@ function withErrorHandling(handler) {
     try {
       return await handler(...args);
     } catch (error) {
+      requestTransactionRollback();
       const request = args.find((arg) => arg instanceof Request);
       const webResponse = await webErrorResponse(error, request);
       if (webResponse) {
@@ -9804,7 +10037,9 @@ function securedBindRouteModelByKey(param, resolver, authorization, handler) {
     return response;
   };
 }
-// ../../src/core/http/loginThrottleMiddleware.ts
+// ../../src/core/http/throttleMiddleware.ts
+import { createHash as createHash3 } from "crypto";
+init_tenantContext();
 var {RedisClient: RedisClient2 } = globalThis.Bun;
 
 // ../../src/core/http/throttleResponse.ts
@@ -9827,6 +10062,104 @@ async function tooManyRequestsResponse(request, message, decaySeconds) {
   return new Response(html.body, { status: 429, headers });
 }
 
+// ../../src/core/http/throttleMiddleware.ts
+function resolveThrottleIdentity(request) {
+  const user = currentAuthUser();
+  if (user?.tokenId !== undefined) {
+    return `token:${user.tokenId}`;
+  }
+  if (user) {
+    return `user:${user.id}`;
+  }
+  return readClientIp(request) ?? "unknown";
+}
+var CONSUME_THROTTLE = `
+local count = redis.call('INCR', KEYS[1])
+local ttl = redis.call('PTTL', KEYS[1])
+if ttl < 0 then
+  redis.call('PEXPIRE', KEYS[1], ARGV[1])
+end
+return count
+`;
+function redisThrottleKey(request, prefix, identity) {
+  const bucket = JSON.stringify([
+    currentTenant()?.id ?? null,
+    request.method,
+    currentRequestMeta().routeTemplate ?? "__unmatched__",
+    identity
+  ]);
+  return namespacedRedisKey(`${prefix}:${createHash3("sha256").update(bucket).digest("hex")}`);
+}
+async function consumeRedisThrottle(client, key, decaySeconds, timeoutMs = 1000) {
+  if (!Number.isFinite(decaySeconds) || decaySeconds < 0 || !Number.isSafeInteger(timeoutMs) || timeoutMs < 1) {
+    throw new Error("Invalid throttle expiry or command timeout.");
+  }
+  let timer;
+  try {
+    const result = await Promise.race([
+      client.send("EVAL", [
+        CONSUME_THROTTLE,
+        "1",
+        key,
+        String(Math.max(1, Math.ceil(decaySeconds * 1000)))
+      ]),
+      new Promise((_resolve, reject) => {
+        timer = setTimeout(() => reject(new Error("Throttle store deadline exceeded.")), timeoutMs);
+      })
+    ]);
+    const count = Number(result);
+    if (!Number.isSafeInteger(count) || count < 1)
+      throw new Error("Invalid throttle store response.");
+    return count;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function createRedisThrottleConsumer(options) {
+  let ownedClient;
+  return async (key, decaySeconds) => {
+    if (!options.redisClient && !ownedClient) {
+      ownedClient = new RedisClient2(options.redisUrl, { autoReconnect: false, maxRetries: 0 });
+    }
+    const client = options.redisClient ?? ownedClient;
+    if (!client)
+      throw new Error("Throttle client is required.");
+    try {
+      return await consumeRedisThrottle(client, key, decaySeconds, options.commandTimeoutMs);
+    } catch (error) {
+      if (client === ownedClient) {
+        ownedClient.close();
+        ownedClient = undefined;
+      }
+      throw error;
+    }
+  };
+}
+function throttleUnavailableResponse() {
+  return Response.json({ error: "Rate limiting is temporarily unavailable." }, {
+    status: 503,
+    headers: { "retry-after": "1" }
+  });
+}
+function createThrottleMiddleware(options) {
+  const consume = createRedisThrottleConsumer(options);
+  const prefix = options.keyPrefix ?? "throttle";
+  return async (request, next) => {
+    const key = redisThrottleKey(request, prefix, resolveThrottleIdentity(request));
+    let attempts;
+    try {
+      attempts = await consume(key, options.decaySeconds);
+    } catch {
+      return throttleUnavailableResponse();
+    }
+    const maxAttempts = options.maxAttempts * rateLimitMultiplierForPlan(currentTenant()?.plan ?? "free");
+    if (attempts > maxAttempts) {
+      return await tooManyRequestsResponse(request, "Too many requests.", options.decaySeconds);
+    }
+    return await next();
+  };
+}
+
 // ../../src/core/http/loginThrottleMiddleware.ts
 var memoryLoginBuckets = new Map;
 function resolveLoginIdentity(request) {
@@ -9870,15 +10203,17 @@ function createMemoryLoginThrottleMiddleware(options) {
   };
 }
 function createRedisLoginThrottleMiddleware(options) {
-  const client = new RedisClient2(options.redisUrl);
-  const prefix = options.keyPrefix ?? namespacedRedisKey("login-throttle:");
+  const consume = createRedisThrottleConsumer(options);
+  const prefix = options.keyPrefix ?? "login-throttle";
   return async (request, next) => {
     const identity = resolveLoginIdentity(request);
     const email = await resolveLoginEmail(request);
-    const throttleKey = `${prefix}${identity}:${email}`;
-    const attempts = Number(await client.incr(throttleKey));
-    if (attempts === 1) {
-      await client.expire(throttleKey, options.decaySeconds);
+    const throttleKey = redisThrottleKey(request, prefix, JSON.stringify([identity, email]));
+    let attempts;
+    try {
+      attempts = await consume(throttleKey, options.decaySeconds);
+    } catch {
+      return throttleUnavailableResponse();
     }
     if (attempts > options.maxAttempts) {
       return await tooManyRequestsResponse(request, "Too many login attempts. Try again later.", options.decaySeconds);
@@ -9925,7 +10260,24 @@ function resetMemoryThrottleForTests() {
   }
 }
 // ../../src/core/metrics/prometheus.ts
+var HTTP_DURATION_BUCKETS_MS = [5, 10, 25, 50, 100, 250, 500, 1000, 2500, 5000, 1e4];
+function emptyHistogram() {
+  return {
+    cumulative: HTTP_DURATION_BUCKETS_MS.map(() => 0),
+    sum: 0,
+    count: 0
+  };
+}
+
 class PrometheusRegistry {
+  maxSeries;
+  seriesLabels = new Map;
+  constructor(maxSeries = 4096) {
+    this.maxSeries = maxSeries;
+    if (!Number.isSafeInteger(maxSeries) || maxSeries < 1) {
+      throw new Error("Metrics maxSeries must be a positive safe integer.");
+    }
+  }
   httpRequestsTotal = new Map;
   httpRequestDurationMs = new Map;
   incrementHttpRequest(labels) {
@@ -9933,10 +10285,20 @@ class PrometheusRegistry {
     this.httpRequestsTotal.set(key, (this.httpRequestsTotal.get(key) ?? 0) + 1);
   }
   observeHttpDuration(labels, durationMs) {
+    if (!Number.isFinite(durationMs) || durationMs < 0)
+      return;
     const key = this.metricKey(labels);
-    const samples = this.httpRequestDurationMs.get(key) ?? [];
-    samples.push(durationMs);
-    this.httpRequestDurationMs.set(key, samples);
+    const histogram = this.httpRequestDurationMs.get(key) ?? emptyHistogram();
+    histogram.count += 1;
+    histogram.sum += durationMs;
+    for (let index = 0;index < HTTP_DURATION_BUCKETS_MS.length; index += 1) {
+      const bound = HTTP_DURATION_BUCKETS_MS[index];
+      if (bound !== undefined && durationMs <= bound) {
+        const count = histogram.cumulative[index] ?? 0;
+        histogram.cumulative[index] = count + 1;
+      }
+    }
+    this.httpRequestDurationMs.set(key, histogram);
   }
   renderMetrics() {
     const lines = [
@@ -9946,16 +10308,22 @@ class PrometheusRegistry {
     for (const [key, value] of this.httpRequestsTotal) {
       lines.push(`http_requests_total{${key}} ${value}`);
     }
-    lines.push("# HELP http_request_duration_ms_sum Sum of HTTP request durations in milliseconds.", "# TYPE http_request_duration_ms_sum counter");
-    for (const [key, samples] of this.httpRequestDurationMs) {
-      const sum = samples.reduce((total, sample) => total + sample, 0);
-      lines.push(`http_request_duration_ms_sum{${key}} ${sum}`);
+    lines.push("# HELP http_request_duration_ms HTTP request duration in milliseconds.", "# TYPE http_request_duration_ms histogram");
+    for (const [key, histogram] of this.httpRequestDurationMs) {
+      for (let index = 0;index < HTTP_DURATION_BUCKETS_MS.length; index += 1) {
+        const bound = HTTP_DURATION_BUCKETS_MS[index];
+        lines.push(`http_request_duration_ms_bucket{${key},le="${bound}"} ${histogram.cumulative[index] ?? 0}`);
+      }
+      lines.push(`http_request_duration_ms_bucket{${key},le="+Inf"} ${histogram.count}`);
+      lines.push(`http_request_duration_ms_sum{${key}} ${histogram.sum}`);
+      lines.push(`http_request_duration_ms_count{${key}} ${histogram.count}`);
     }
     return `${lines.join(`
 `)}
 `;
   }
   resetForTests() {
+    this.seriesLabels.clear();
     this.httpRequestsTotal.clear();
     this.httpRequestDurationMs.clear();
   }
@@ -9965,9 +10333,10 @@ class PrometheusRegistry {
     let totalRequests = 0;
     for (const [key, count] of this.httpRequestsTotal) {
       totalRequests += count;
-      const method = key.match(/method="([^"]+)"/)?.[1] ?? "GET";
-      const path = key.match(/path="([^"]+)"/)?.[1] ?? "/";
-      const status = key.match(/status="([^"]+)"/)?.[1] ?? "200";
+      const labels = this.seriesLabels.get(key);
+      if (!labels)
+        continue;
+      const { method, path, status } = labels;
       byStatus[status] = (byStatus[status] ?? 0) + count;
       const pathKey = `${method} ${path}`;
       const existing = pathCounts.get(pathKey);
@@ -9984,30 +10353,54 @@ class PrometheusRegistry {
       topPaths
     };
   }
+  getStorageStats() {
+    return {
+      series: this.seriesLabels.size,
+      histograms: this.httpRequestDurationMs.size,
+      bucketCounters: this.httpRequestDurationMs.size * HTTP_DURATION_BUCKETS_MS.length
+    };
+  }
   metricKey(labels) {
-    return `method="${labels.method}",path="${labels.path}",status="${labels.status}"`;
+    const normalized = {
+      method: /^(GET|HEAD|POST|PUT|PATCH|DELETE|CONNECT|OPTIONS|TRACE)$/.test(labels.method) ? labels.method : "OTHER",
+      path: labels.path.length <= 512 ? labels.path : "__overflow__",
+      status: /^[1-5][0-9]{2}$/.test(labels.status) ? labels.status : "000"
+    };
+    const escapeLabel = (value) => value.replaceAll("\\", "\\\\").replaceAll(`
+`, "\\n").replaceAll('"', "\\\"");
+    const encode = (value) => `method="${value.method}",path="${escapeLabel(value.path)}",status="${value.status}"`;
+    let key = encode(normalized);
+    if (!this.seriesLabels.has(key)) {
+      if (this.seriesLabels.size >= this.maxSeries) {
+        const overflow = { method: "OTHER", path: "__overflow__", status: "000" };
+        key = encode(overflow);
+        this.seriesLabels.set(key, overflow);
+      } else {
+        this.seriesLabels.set(key, normalized);
+      }
+    }
+    return key;
   }
 }
 var prometheusRegistry = new PrometheusRegistry;
 
 // ../../src/core/http/metricsMiddleware.ts
-function normalizeMetricPath(pathname) {
-  return pathname.replace(/\/\d+/g, "/:id").replace(/\/[0-9a-f-]{36}/gi, "/:id");
-}
 function createMetricsMiddleware() {
   return async (request, next) => {
     const startedAt = performance.now();
-    const response = await next();
-    const durationMs = performance.now() - startedAt;
-    const path = normalizeMetricPath(new URL(request.url).pathname);
-    const labels = {
-      method: request.method,
-      path,
-      status: String(response.status)
-    };
-    prometheusRegistry.incrementHttpRequest(labels);
-    prometheusRegistry.observeHttpDuration(labels, durationMs);
-    return response;
+    let response;
+    try {
+      response = await next();
+      return response;
+    } finally {
+      const labels = {
+        method: request.method,
+        path: currentRequestMeta().routeTemplate ?? "__unmatched__",
+        status: String(response?.status ?? 500)
+      };
+      prometheusRegistry.incrementHttpRequest(labels);
+      prometheusRegistry.observeHttpDuration(labels, performance.now() - startedAt);
+    }
   };
 }
 // ../../src/core/http/requireAbilityMiddleware.ts
@@ -10133,14 +10526,14 @@ function createRequireWebAuthMiddleware(auth) {
   };
 }
 // ../../src/core/http/scimThrottleMiddleware.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 var {RedisClient: RedisClient3 } = globalThis.Bun;
 var memoryBuckets = new Map;
 function resolveScimIdentity(request) {
   const authorization = request.headers.get("authorization") ?? "";
   const presented = authorization.startsWith("Bearer ") ? authorization.slice("Bearer ".length).trim() : "";
   if (presented.length > 0) {
-    return createHash3("sha256").update(presented).digest("hex");
+    return createHash4("sha256").update(presented).digest("hex");
   }
   return readClientIp(request) ?? "unknown";
 }
@@ -10303,37 +10696,6 @@ function createValidateSignatureMiddleware() {
     return await next();
   };
 }
-// ../../src/core/http/throttleMiddleware.ts
-init_tenantContext();
-var {RedisClient: RedisClient4 } = globalThis.Bun;
-function resolveThrottleIdentity(request) {
-  const user = currentAuthUser();
-  if (user?.tokenId !== undefined) {
-    return `token:${user.tokenId}`;
-  }
-  if (user) {
-    return `user:${user.id}`;
-  }
-  return readClientIp(request) ?? "unknown";
-}
-function createThrottleMiddleware(options) {
-  const client = new RedisClient4(options.redisUrl);
-  const prefix = options.keyPrefix ?? namespacedRedisKey("throttle:");
-  return async (request, next) => {
-    const identity = resolveThrottleIdentity(request);
-    const path = new URL(request.url).pathname;
-    const throttleKey = `${prefix}${identity}:${path}`;
-    const attempts = Number(await client.incr(throttleKey));
-    if (attempts === 1) {
-      await client.expire(throttleKey, options.decaySeconds);
-    }
-    const maxAttempts = options.maxAttempts * rateLimitMultiplierForPlan(currentTenant()?.plan ?? "free");
-    if (attempts > maxAttempts) {
-      return await tooManyRequestsResponse(request, "Too many requests.", options.decaySeconds);
-    }
-    return await next();
-  };
-}
 // ../../src/core/http/parseFormBody.ts
 async function parseFormBody(request) {
   const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
@@ -10790,7 +11152,7 @@ var queueConfig = {
 };
 
 // ../../src/core/queue/jobRunner.ts
-async function runQueueJob(envelope, failedJobs) {
+async function runQueueJob(envelope, failedJobs, options = {}) {
   const job = jobRegistry.create(envelope.name);
   if (!job) {
     throw new Error(`Unknown job "${envelope.name}".`);
@@ -10807,7 +11169,7 @@ async function runQueueJob(envelope, failedJobs) {
       await runQueueJob({
         ...envelope,
         attempts: nextAttempt
-      }, failedJobs);
+      }, failedJobs, options);
       return;
     }
     await failedJobs.recordFailure({
@@ -10815,12 +11177,13 @@ async function runQueueJob(envelope, failedJobs) {
       payload: envelope.payload,
       exception: error instanceof Error ? error.stack ?? error.message : String(error)
     });
+    options.onFailureRecorded?.();
     throw error;
   }
 }
 
 // ../../src/core/queue/redisQueue.ts
-var {RedisClient: RedisClient5 } = globalThis.Bun;
+var {RedisClient: RedisClient4 } = globalThis.Bun;
 function queueListKey() {
   return namespacedRedisKey("queue:default");
 }
@@ -10834,6 +11197,20 @@ var QUEUE_LIST_KEY = queueListKey();
 var QUEUE_HIGH_KEY = queueHighKey();
 var QUEUE_LOW_KEY = queueLowKey();
 var QUEUE_KEYS = [QUEUE_HIGH_KEY, QUEUE_LIST_KEY, QUEUE_LOW_KEY];
+var DEFAULT_VISIBILITY_MS = 60000;
+function queueProcessingKey(queueKey) {
+  return `${queueKey}:processing`;
+}
+function queueProcessingLeaseKey(queueKey) {
+  return `${queueKey}:processing:leases`;
+}
+function readVisibilityMs() {
+  const parsed = Number(process.env.QUEUE_VISIBILITY_MS ?? String(DEFAULT_VISIBILITY_MS));
+  if (!Number.isSafeInteger(parsed) || parsed < 30) {
+    throw new Error("QUEUE_VISIBILITY_MS must be an integer of at least 30 milliseconds.");
+  }
+  return parsed;
+}
 function queueKeyForPriority(priority = "default") {
   switch (priority) {
     case "high":
@@ -10875,11 +11252,134 @@ function parseQueueJobEnvelope(rawPayload) {
     attempts: typeof envelope.attempts === "number" ? envelope.attempts : 0
   };
 }
+var SCRIPT_HEADER = `
+local function checkType(key, expected)
+  local actual = redis.call('TYPE', key).ok
+  if actual ~= 'none' and actual ~= expected then
+    return redis.error_reply('Unexpected queue key type: ' .. key)
+  end
+end
+local function nowMs()
+  local time = redis.call('TIME')
+  return tonumber(time[1]) * 1000 + math.floor(tonumber(time[2]) / 1000)
+end
+`;
+var RESERVE_JOB = `${SCRIPT_HEADER}
+local err = checkType(KEYS[1], 'list') or checkType(KEYS[2], 'list') or checkType(KEYS[3], 'hash')
+if err then return err end
+local payload = redis.call('LINDEX', KEYS[1], -1)
+if not payload then return nil end
+local record = cjson.encode({strataReservation=1, id=ARGV[1], owner=ARGV[2], payload=payload})
+local lease = cjson.encode({owner=ARGV[2], expiresAt=nowMs()+tonumber(ARGV[3])})
+redis.call('LPUSH', KEYS[2], record)
+redis.call('HSET', KEYS[3], ARGV[1], lease)
+redis.call('RPOP', KEYS[1])
+return record
+`;
+var RENEW_OR_ACK = `${SCRIPT_HEADER}
+local err = checkType(KEYS[1], 'list') or checkType(KEYS[2], 'hash') or checkType(KEYS[3], 'list')
+if err then return err end
+local raw = redis.call('HGET', KEYS[2], ARGV[1])
+if not raw then return 0 end
+local ok, lease = pcall(cjson.decode, raw)
+local now = nowMs()
+if not ok or type(lease) ~= 'table' or lease.owner ~= ARGV[2] or not tonumber(lease.expiresAt) or tonumber(lease.expiresAt) <= now then
+  return 0
+end
+if ARGV[4] == 'renew' then
+  redis.call('HSET', KEYS[2], ARGV[1], cjson.encode({owner=ARGV[2], expiresAt=now+tonumber(ARGV[5])}))
+  return 1
+end
+if ARGV[4] == 'quarantine' then redis.call('LPUSH', KEYS[3], ARGV[6]) end
+local removed = redis.call('LREM', KEYS[1], 1, ARGV[3])
+redis.call('HDEL', KEYS[2], ARGV[1])
+return removed
+`;
+var RECLAIM_JOBS = `${SCRIPT_HEADER}
+local err = checkType(KEYS[1], 'list') or checkType(KEYS[2], 'list') or checkType(KEYS[3], 'hash')
+if err then return err end
+local now = nowMs()
+local reclaimed = 0
+for _, record in ipairs(redis.call('LRANGE', KEYS[2], 0, -1)) do
+  local payload, field = record, record
+  local modern = false
+  local ok, reservation = pcall(cjson.decode, record)
+  if ok and type(reservation) == 'table' and reservation.strataReservation == 1 then
+    payload, field, modern = reservation.payload, reservation.id, true
+  end
+  local raw = redis.call('HGET', KEYS[3], field)
+  local expired = true
+  if raw then
+    if modern then
+      local leaseOk, lease = pcall(cjson.decode, raw)
+      expired = not leaseOk or type(lease) ~= 'table' or not tonumber(lease.expiresAt) or tonumber(lease.expiresAt) <= now
+    else
+      local reservedAt = tonumber(raw)
+      expired = not reservedAt or now - reservedAt >= tonumber(ARGV[1])
+    end
+  end
+  if expired then
+    redis.call('LPUSH', KEYS[1], payload)
+    redis.call('LREM', KEYS[2], 1, record)
+    redis.call('HDEL', KEYS[3], field)
+    reclaimed = reclaimed + 1
+  end
+end
+return reclaimed
+`;
+function queueInvalidKey(queueKey) {
+  return `${queueKey}:invalid`;
+}
+async function reserveQueueJob(client, queueKey, owner) {
+  const raw = await client.send("EVAL", [
+    RESERVE_JOB,
+    "3",
+    queueKey,
+    queueProcessingKey(queueKey),
+    queueProcessingLeaseKey(queueKey),
+    crypto.randomUUID(),
+    owner,
+    String(readVisibilityMs())
+  ]);
+  if (typeof raw !== "string")
+    return null;
+  const reservation = JSON.parse(raw);
+  return { ...reservation, record: raw };
+}
+async function updateQueueReservation(client, queueKey, reservation, action) {
+  return Number(await client.send("EVAL", [
+    RENEW_OR_ACK,
+    "3",
+    queueProcessingKey(queueKey),
+    queueProcessingLeaseKey(queueKey),
+    queueInvalidKey(queueKey),
+    reservation.id,
+    reservation.owner,
+    reservation.record,
+    action,
+    String(readVisibilityMs()),
+    reservation.payload
+  ])) === 1;
+}
+async function reclaimExpiredQueueReservations(client, queueKeys = QUEUE_KEYS) {
+  let reclaimed = 0;
+  for (const key of queueKeys) {
+    reclaimed += Number(await client.send("EVAL", [
+      RECLAIM_JOBS,
+      "3",
+      key,
+      queueProcessingKey(key),
+      queueProcessingLeaseKey(key),
+      String(readVisibilityMs())
+    ]));
+  }
+  return reclaimed;
+}
 
 class RedisQueue {
   client;
   constructor(redisUrl) {
-    this.client = new RedisClient5(redisUrl);
+    this.client = new RedisClient4(redisUrl);
   }
   async dispatch(job, payload) {
     const name = jobRegistry.resolveName(job);
@@ -10899,13 +11399,16 @@ class RedisQueue {
 class QueueWorker {
   failedJobs;
   timeoutSeconds;
+  queueKeys;
+  owner = crypto.randomUUID();
   running = false;
   stopping = false;
   client;
-  constructor(redisUrl, failedJobs, timeoutSeconds = 5) {
+  constructor(redisUrl, failedJobs, timeoutSeconds = 5, queueKeys = QUEUE_KEYS) {
     this.failedJobs = failedJobs;
     this.timeoutSeconds = timeoutSeconds;
-    this.client = new RedisClient5(redisUrl);
+    this.queueKeys = queueKeys;
+    this.client = new RedisClient4(redisUrl);
   }
   requestStop() {
     this.stopping = true;
@@ -10913,38 +11416,81 @@ class QueueWorker {
   isRunning() {
     return this.running;
   }
-  async processNext() {
-    let result = null;
-    for (const queueKey of QUEUE_KEYS) {
-      result = await this.client.brpop(queueKey, 1);
-      if (result) {
-        break;
+  async reserve() {
+    const deadline = performance.now() + this.timeoutSeconds * 1000;
+    do {
+      for (const key of this.queueKeys) {
+        if (this.stopping)
+          return null;
+        const reservation = await reserveQueueJob(this.client, key, this.owner);
+        if (reservation)
+          return { queueKey: key, reservation };
       }
-    }
-    if (!result) {
-      result = await this.client.brpop(QUEUE_LIST_KEY, this.timeoutSeconds);
-    }
-    if (!result) {
+      if (this.stopping || performance.now() >= deadline)
+        return null;
+      await Bun.sleep(Math.min(100, Math.max(1, deadline - performance.now())));
+    } while (!this.stopping);
+    return null;
+  }
+  async processNext() {
+    if (this.stopping)
       return false;
-    }
-    const [, rawPayload] = result;
-    const envelope = parseQueueJobEnvelope(rawPayload);
+    await reclaimExpiredQueueReservations(this.client, this.queueKeys);
+    const reserved = await this.reserve();
+    if (!reserved)
+      return false;
+    const { queueKey, reservation } = reserved;
+    const envelope = parseQueueJobEnvelope(reservation.payload);
     if (!envelope) {
+      await updateQueueReservation(this.client, queueKey, reservation, "quarantine");
       return true;
     }
+    let acknowledge = false;
+    let ownershipLost = false;
+    let renewal;
+    const heartbeat = setInterval(() => {
+      if (renewal || ownershipLost)
+        return;
+      renewal = (async () => {
+        try {
+          if (!await updateQueueReservation(this.client, queueKey, reservation, "renew")) {
+            ownershipLost = true;
+          }
+        } catch (error) {
+          ownershipLost = true;
+          console.error("[QueueWorker] Lease renewal failed:", error);
+        }
+      })().finally(() => {
+        renewal = undefined;
+      });
+    }, Math.max(1, Math.floor(readVisibilityMs() / 3)));
     try {
-      await runQueueJob(envelope, this.failedJobs);
+      await runQueueJob(envelope, this.failedJobs, {
+        onFailureRecorded: () => {
+          acknowledge = true;
+        }
+      });
+      acknowledge = true;
     } catch (error) {
       console.error("[QueueWorker] Job failed:", error);
+    } finally {
+      clearInterval(heartbeat);
+      await renewal;
+    }
+    if (acknowledge && !ownershipLost) {
+      await updateQueueReservation(this.client, queueKey, reservation, "ack");
     }
     return true;
   }
   async run() {
     this.running = true;
-    while (!this.stopping) {
-      await this.processNext();
+    try {
+      while (!this.stopping) {
+        await this.processNext();
+      }
+    } finally {
+      this.running = false;
     }
-    this.running = false;
   }
   close() {
     this.client.close();
@@ -11003,9 +11549,9 @@ function createQueueWorker(redisUrl, failedJobs = createFailedJobService()) {
   return new QueueWorker(redisUrl, failedJobs);
 }
 // ../../src/core/queue/queueMetrics.ts
-var {RedisClient: RedisClient6 } = globalThis.Bun;
+var {RedisClient: RedisClient5 } = globalThis.Bun;
 async function readRedisQueueDepth(redisUrl) {
-  const client = new RedisClient6(redisUrl);
+  const client = new RedisClient5(redisUrl);
   const [high, defaultQueue, low] = await Promise.all([
     client.llen(QUEUE_HIGH_KEY),
     client.llen(QUEUE_LIST_KEY),
@@ -11225,58 +11771,9 @@ init_tenantContext();
 init_tenantDatabaseScope();
 
 // ../../src/core/tenant/tenantMiddleware.ts
-import { createHash as createHash4 } from "crypto";
-
-// ../../src/core/tenant/databaseTenantContext.ts
-init_defaultConnection();
-init_connectionContext();
-init_deferredModelEvents();
-init_tenancyConfig();
-function stringifyBypassIdentifier(identifier) {
-  if (typeof identifier === "number") {
-    return String(identifier);
-  }
-  return identifier.trim();
-}
-async function applyIdentifierToTransaction(transaction, identifier) {
-  await transaction.unsafe(`SELECT set_config('app.bypass_identifier', $1, true)`, [
-    stringifyBypassIdentifier(identifier)
-  ]);
-}
-function assertBypassIdentifier(identifier) {
-  if (typeof identifier === "number") {
-    if (!Number.isInteger(identifier) || identifier <= 0) {
-      throw new Error("RLS bypass requires a caller-supplied identifier that pins the row.");
-    }
-    return;
-  }
-  if (typeof identifier === "string" && identifier.trim() !== "") {
-    return;
-  }
-  throw new Error("RLS bypass requires a caller-supplied identifier that pins the row.");
-}
-async function runWithScopedTenantTransaction(apply, callback) {
-  if (!isRlsTenancy()) {
-    return await callback();
-  }
-  const pool = getDefaultDatabasePool();
-  const begin = pool.begin;
-  if (typeof begin !== "function") {
-    throw new Error("RLS migration bypass requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
-  }
-  return await runWithDeferredModelEvents(async () => {
-    return await begin(async (transaction) => {
-      await apply(transaction);
-      return await runWithDatabaseConnection(transaction, callback);
-    });
-  });
-}
-async function runWithMigrationBypassForIdentifier(identifier, callback) {
-  assertBypassIdentifier(identifier);
-  return await runWithScopedTenantTransaction((transaction) => applyIdentifierToTransaction(transaction, identifier), callback);
-}
-
-// ../../src/core/tenant/tenantMiddleware.ts
+import { createHash as createHash5 } from "crypto";
+init_repositoryConnection();
+init_databaseTenantContext();
 init_tenancyConfig();
 init_tenantContext();
 init_tenantDatabaseScope();
@@ -11301,7 +11798,7 @@ async function resolveUserTenantId(userId) {
   });
 }
 function auditChecksum(payload) {
-  return createHash4("sha256").update(JSON.stringify(payload)).digest("hex");
+  return createHash5("sha256").update(JSON.stringify(payload)).digest("hex");
 }
 async function resolveTenantForRequest(request) {
   const user = currentAuthUser();
@@ -12129,7 +12626,6 @@ export {
   namespacedRedisKey,
   noContentResponse,
   normalizeFieldErrors,
-  normalizeMetricPath,
   notFoundHtmlResponse,
   notModifiedResponse,
   otelServiceName,
@@ -12177,6 +12673,7 @@ export {
   repositoryConnection,
   requestIdMiddleware,
   requestMetaContext,
+  requestTransactionRollback,
   requireConfiguredSecret,
   required,
   resetBoundDatabaseConnection,