@getstrata/core 2.2.21 → 2.2.22

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # @getstrata/core changelog
 
+## 2.2.22
+
+Preserve caller auth, credential sources, request metadata and application async stores through cold/queued native transaction callbacks. Serialize Postgres privilege grants with full provisioning using atomic database-scoped batches, retaining delegated-admin permissions and rollback/retry safety. Add real constrained-pool JSON/HTML bearer/session-CSRF and concurrent grant/atomicity regressions; no automatic workers, auth bypass or production runtime provisioning.
+
 ## 2.2.21
 
 Make registered queue/outbox workers discoverable in CLI help and generated startup guidance. Announce polling after boot and when it stops without claiming dependency health, printing secrets, or starting workers automatically. Preserve explicit process ownership, delivery semantics and graceful lifecycle; cover idle, boot/runtime/cleanup failures and real SIGTERM draining.

package/dist/entries/audit/exportAuditLogs.js

@@ -221,6 +221,7 @@ var init_tenancyConfig = __esm(() => {
 
 // ../../src/core/tenant/tenantDatabaseScope.ts
 import { getDefaultDatabasePool } from "@getstrata/core/database/defaultConnection";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 async function applyTenantContextToTransaction(transaction, tenantId) {
   await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
@@ -243,12 +244,12 @@ async function runWithTenantDatabase(tenant, callback) {
     throw new Error("RLS tenant scope requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
   return await settleTransaction(() => runWithDeferredModelEvents(async () => {
-    return await begin.bind(pool)(async (transaction) => {
+    return await begin.bind(pool)(AsyncLocalStorage2.bind(async (transaction) => {
       await applyTenantContextToTransaction(transaction, tenant.id);
       return await runWithDatabaseConnection(transaction, async () => {
         return await runWithTransactionScope(async () => commitOrRollbackScope(await runWithTenant(tenant, callback)));
       });
-    });
+    }));
   }));
 }
 function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {
@@ -717,6 +718,7 @@ var init_repositoryConnection = __esm(() => {
 });
 
 // ../../src/core/database/transaction.ts
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
 async function runInSavepoint(connection, operation) {
   const inherited = transactionFrame.getStore();
   let parent = inherited?.connection === connection ? inherited : outerFrames.get(connection);
@@ -776,9 +778,9 @@ async function runInTransaction(operation, options = {}) {
       signal?.throwIfAborted();
       if (!supportsTransactions(connection))
         throw new Error("Reserved database connection does not support transactions.");
-      return await connection.begin(async (transaction) => {
+      return await connection.begin(AsyncLocalStorage3.bind(async (transaction) => {
         return await runWithDatabaseConnection(transaction, () => transactionFrame.run({ connection: transaction, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await admittedOperation(createDatabaseConnection(transaction))))));
-      });
+      }));
     } finally {
       await reserved?.release();
     }
@@ -800,6 +802,7 @@ var init_transaction = __esm(() => {
 
 // ../../src/core/tenant/databaseTenantContext.ts
 import { getDefaultDatabasePool as getDefaultDatabasePool3 } from "@getstrata/core/database/defaultConnection";
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
 async function applyBypassToTransaction(transaction, bypass) {
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, [
     bypass ? "true" : "false"
@@ -851,10 +854,10 @@ async function runWithScopedTenantTransaction(apply, callback) {
     throw new Error("RLS migration bypass requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
   return await settleTransaction(() => runWithDeferredModelEvents(async () => {
-    return await begin.bind(pool)(async (transaction) => {
+    return await begin.bind(pool)(AsyncLocalStorage4.bind(async (transaction) => {
       await apply(transaction);
       return await runWithDatabaseConnection(transaction, () => runWithTransactionScope(async () => commitOrRollbackScope(await callback())));
-    });
+    }));
   }));
 }
 async function runWithMigrationBypass(callback) {

package/dist/entries/auth/scimAuthMiddleware.js

@@ -673,6 +673,7 @@ var init_repositoryConnection = __esm(() => {
 });
 
 // ../../src/core/database/transaction.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 async function runInSavepoint(connection, operation) {
   const inherited = transactionFrame.getStore();
   let parent = inherited?.connection === connection ? inherited : outerFrames.get(connection);
@@ -732,9 +733,9 @@ async function runInTransaction(operation, options = {}) {
       signal?.throwIfAborted();
       if (!supportsTransactions(connection))
         throw new Error("Reserved database connection does not support transactions.");
-      return await connection.begin(async (transaction) => {
+      return await connection.begin(AsyncLocalStorage2.bind(async (transaction) => {
         return await runWithDatabaseConnection(transaction, () => transactionFrame.run({ connection: transaction, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await admittedOperation(createDatabaseConnection(transaction))))));
-      });
+      }));
     } finally {
       await reserved?.release();
     }
@@ -756,6 +757,7 @@ var init_transaction = __esm(() => {
 
 // ../../src/core/tenant/databaseTenantContext.ts
 import { getDefaultDatabasePool as getDefaultDatabasePool2 } from "@getstrata/core/database/defaultConnection";
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
 async function applyBypassToTransaction(transaction, bypass) {
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, [
     bypass ? "true" : "false"
@@ -807,10 +809,10 @@ async function runWithScopedTenantTransaction(apply, callback) {
     throw new Error("RLS migration bypass requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
   return await settleTransaction(() => runWithDeferredModelEvents(async () => {
-    return await begin.bind(pool)(async (transaction) => {
+    return await begin.bind(pool)(AsyncLocalStorage3.bind(async (transaction) => {
       await apply(transaction);
       return await runWithDatabaseConnection(transaction, () => runWithTransactionScope(async () => commitOrRollbackScope(await callback())));
-    });
+    }));
   }));
 }
 async function runWithMigrationBypass(callback) {
@@ -830,6 +832,7 @@ var init_databaseTenantContext = __esm(() => {
 
 // ../../src/core/tenant/tenantDatabaseScope.ts
 import { getDefaultDatabasePool as getDefaultDatabasePool3 } from "@getstrata/core/database/defaultConnection";
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
 async function applyTenantContextToTransaction(transaction, tenantId) {
   await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
@@ -852,12 +855,12 @@ async function runWithTenantDatabase(tenant, callback) {
     throw new Error("RLS tenant scope requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
   return await settleTransaction(() => runWithDeferredModelEvents(async () => {
-    return await begin.bind(pool)(async (transaction) => {
+    return await begin.bind(pool)(AsyncLocalStorage4.bind(async (transaction) => {
       await applyTenantContextToTransaction(transaction, tenant.id);
       return await runWithDatabaseConnection(transaction, async () => {
         return await runWithTransactionScope(async () => commitOrRollbackScope(await runWithTenant(tenant, callback)));
       });
-    });
+    }));
   }));
 }
 function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {

package/dist/entries/jobs/exportAuditLogsJob.js

@@ -221,6 +221,7 @@ var init_tenancyConfig = __esm(() => {
 
 // ../../src/core/tenant/tenantDatabaseScope.ts
 import { getDefaultDatabasePool } from "@getstrata/core/database/defaultConnection";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 async function applyTenantContextToTransaction(transaction, tenantId) {
   await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
@@ -243,12 +244,12 @@ async function runWithTenantDatabase(tenant, callback) {
     throw new Error("RLS tenant scope requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
   return await settleTransaction(() => runWithDeferredModelEvents(async () => {
-    return await begin.bind(pool)(async (transaction) => {
+    return await begin.bind(pool)(AsyncLocalStorage2.bind(async (transaction) => {
       await applyTenantContextToTransaction(transaction, tenant.id);
       return await runWithDatabaseConnection(transaction, async () => {
         return await runWithTransactionScope(async () => commitOrRollbackScope(await runWithTenant(tenant, callback)));
       });
-    });
+    }));
   }));
 }
 function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {
@@ -717,6 +718,7 @@ var init_repositoryConnection = __esm(() => {
 });
 
 // ../../src/core/database/transaction.ts
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
 async function runInSavepoint(connection, operation) {
   const inherited = transactionFrame.getStore();
   let parent = inherited?.connection === connection ? inherited : outerFrames.get(connection);
@@ -776,9 +778,9 @@ async function runInTransaction(operation, options = {}) {
       signal?.throwIfAborted();
       if (!supportsTransactions(connection))
         throw new Error("Reserved database connection does not support transactions.");
-      return await connection.begin(async (transaction) => {
+      return await connection.begin(AsyncLocalStorage3.bind(async (transaction) => {
         return await runWithDatabaseConnection(transaction, () => transactionFrame.run({ connection: transaction, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await admittedOperation(createDatabaseConnection(transaction))))));
-      });
+      }));
     } finally {
       await reserved?.release();
     }
@@ -800,6 +802,7 @@ var init_transaction = __esm(() => {
 
 // ../../src/core/tenant/databaseTenantContext.ts
 import { getDefaultDatabasePool as getDefaultDatabasePool3 } from "@getstrata/core/database/defaultConnection";
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
 async function applyBypassToTransaction(transaction, bypass) {
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, [
     bypass ? "true" : "false"
@@ -851,10 +854,10 @@ async function runWithScopedTenantTransaction(apply, callback) {
     throw new Error("RLS migration bypass requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
   return await settleTransaction(() => runWithDeferredModelEvents(async () => {
-    return await begin.bind(pool)(async (transaction) => {
+    return await begin.bind(pool)(AsyncLocalStorage4.bind(async (transaction) => {
       await apply(transaction);
       return await runWithDatabaseConnection(transaction, () => runWithTransactionScope(async () => commitOrRollbackScope(await callback())));
-    });
+    }));
   }));
 }
 async function runWithMigrationBypass(callback) {

package/dist/entries/queue/queueMetrics.js

@@ -531,6 +531,7 @@ var init_tenancyConfig = __esm(() => {
 
 // ../../src/core/tenant/databaseTenantContext.ts
 import { getDefaultDatabasePool as getDefaultDatabasePool2 } from "@getstrata/core/database/defaultConnection";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 async function applyBypassToTransaction(transaction, bypass) {
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, [
     bypass ? "true" : "false"
@@ -582,10 +583,10 @@ async function runWithScopedTenantTransaction(apply, callback) {
     throw new Error("RLS migration bypass requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
   return await settleTransaction(() => runWithDeferredModelEvents(async () => {
-    return await begin.bind(pool)(async (transaction) => {
+    return await begin.bind(pool)(AsyncLocalStorage2.bind(async (transaction) => {
       await apply(transaction);
       return await runWithDatabaseConnection(transaction, () => runWithTransactionScope(async () => commitOrRollbackScope(await callback())));
-    });
+    }));
   }));
 }
 async function runWithMigrationBypass(callback) {
@@ -605,6 +606,7 @@ var init_databaseTenantContext = __esm(() => {
 
 // ../../src/core/tenant/tenantDatabaseScope.ts
 import { getDefaultDatabasePool as getDefaultDatabasePool3 } from "@getstrata/core/database/defaultConnection";
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
 async function applyTenantContextToTransaction(transaction, tenantId) {
   await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
@@ -627,12 +629,12 @@ async function runWithTenantDatabase(tenant, callback) {
     throw new Error("RLS tenant scope requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
   return await settleTransaction(() => runWithDeferredModelEvents(async () => {
-    return await begin.bind(pool)(async (transaction) => {
+    return await begin.bind(pool)(AsyncLocalStorage3.bind(async (transaction) => {
       await applyTenantContextToTransaction(transaction, tenant.id);
       return await runWithDatabaseConnection(transaction, async () => {
         return await runWithTransactionScope(async () => commitOrRollbackScope(await runWithTenant(tenant, callback)));
       });
-    });
+    }));
   }));
 }
 function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {
@@ -791,6 +793,7 @@ function createDatabaseConnection(source) {
 var init_connection = () => {};
 
 // ../../src/core/database/transaction.ts
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
 async function runInSavepoint(connection, operation) {
   const inherited = transactionFrame.getStore();
   let parent = inherited?.connection === connection ? inherited : outerFrames.get(connection);
@@ -850,9 +853,9 @@ async function runInTransaction(operation, options = {}) {
       signal?.throwIfAborted();
       if (!supportsTransactions(connection))
         throw new Error("Reserved database connection does not support transactions.");
-      return await connection.begin(async (transaction) => {
+      return await connection.begin(AsyncLocalStorage4.bind(async (transaction) => {
         return await runWithDatabaseConnection(transaction, () => transactionFrame.run({ connection: transaction, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await admittedOperation(createDatabaseConnection(transaction))))));
-      });
+      }));
     } finally {
       await reserved?.release();
     }

package/dist/entries/tenant/databaseTenantContext.js

@@ -221,6 +221,7 @@ var init_tenancyConfig = __esm(() => {
 
 // ../../src/core/tenant/tenantDatabaseScope.ts
 import { getDefaultDatabasePool } from "@getstrata/core/database/defaultConnection";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 async function applyTenantContextToTransaction(transaction, tenantId) {
   await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
@@ -243,12 +244,12 @@ async function runWithTenantDatabase(tenant, callback) {
     throw new Error("RLS tenant scope requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
   return await settleTransaction(() => runWithDeferredModelEvents(async () => {
-    return await begin.bind(pool)(async (transaction) => {
+    return await begin.bind(pool)(AsyncLocalStorage2.bind(async (transaction) => {
       await applyTenantContextToTransaction(transaction, tenant.id);
       return await runWithDatabaseConnection(transaction, async () => {
         return await runWithTransactionScope(async () => commitOrRollbackScope(await runWithTenant(tenant, callback)));
       });
-    });
+    }));
   }));
 }
 function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {
@@ -717,6 +718,7 @@ var init_repositoryConnection = __esm(() => {
 });
 
 // ../../src/core/database/transaction.ts
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
 async function runInSavepoint(connection, operation) {
   const inherited = transactionFrame.getStore();
   let parent = inherited?.connection === connection ? inherited : outerFrames.get(connection);
@@ -776,9 +778,9 @@ async function runInTransaction(operation, options = {}) {
       signal?.throwIfAborted();
       if (!supportsTransactions(connection))
         throw new Error("Reserved database connection does not support transactions.");
-      return await connection.begin(async (transaction) => {
+      return await connection.begin(AsyncLocalStorage3.bind(async (transaction) => {
         return await runWithDatabaseConnection(transaction, () => transactionFrame.run({ connection: transaction, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await admittedOperation(createDatabaseConnection(transaction))))));
-      });
+      }));
     } finally {
       await reserved?.release();
     }
@@ -800,6 +802,7 @@ var init_transaction = __esm(() => {
 
 // ../../src/core/tenant/databaseTenantContext.ts
 import { getDefaultDatabasePool as getDefaultDatabasePool3 } from "@getstrata/core/database/defaultConnection";
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
 async function applyBypassToTransaction(transaction, bypass) {
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, [
     bypass ? "true" : "false"
@@ -851,10 +854,10 @@ async function runWithScopedTenantTransaction(apply, callback) {
     throw new Error("RLS migration bypass requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
   return await settleTransaction(() => runWithDeferredModelEvents(async () => {
-    return await begin.bind(pool)(async (transaction) => {
+    return await begin.bind(pool)(AsyncLocalStorage4.bind(async (transaction) => {
       await apply(transaction);
       return await runWithDatabaseConnection(transaction, () => runWithTransactionScope(async () => commitOrRollbackScope(await callback())));
-    });
+    }));
   }));
 }
 async function runWithMigrationBypass(callback) {

package/dist/entries/tenant/enableTenantRls.js

@@ -191,15 +191,11 @@ BEGIN
 END
 $$`;
 }
-function postgresAppRoleSql(options) {
+var POSTGRES_PRIVILEGE_LOCK_SQL = "SELECT pg_advisory_xact_lock(hashtext('strata:postgres-privileges'), hashtext(current_database()))";
+function postgresAppRolePrivilegeSql(options) {
   const database = assertSafeSqlIdentifier(options.database, "database name");
   const role = assertSafeSqlIdentifier(options.role ?? POSTGRES_APP_ROLE, "role name");
-  return `-- Application login role. FORCE RLS applies because this role is NOSUPERUSER and NOBYPASSRLS.
--- Superuser remains for CREATE ROLE / CREATE DATABASE / GRANT / migrate / migrate:fresh DROP.
--- This script is repeatable on an already-existing volume (not only docker-entrypoint-initdb.d).
-${postgresAppRoleCreateSql(options)};
-
-GRANT CONNECT ON DATABASE ${database} TO ${role};
+  return `GRANT CONNECT ON DATABASE ${database} TO ${role};
 GRANT USAGE, CREATE ON SCHEMA public TO ${role};
 GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO ${role};
 GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO ${role};
@@ -209,17 +205,21 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO ${role};
 ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT EXECUTE ON FUNCTIONS TO ${role};
 `;
 }
+function postgresAppRoleSql(options) {
+  const privileges = postgresAppRolePrivilegeSql(options);
+  return `-- Application login role. FORCE RLS applies because this role is NOSUPERUSER and NOBYPASSRLS.
+-- Superuser remains for CREATE ROLE / CREATE DATABASE / GRANT / migrate / migrate:fresh DROP.
+-- This script is repeatable on an already-existing volume (not only docker-entrypoint-initdb.d).
+${POSTGRES_PRIVILEGE_LOCK_SQL};
+${postgresAppRoleCreateSql(options)};
+
+${privileges}
+`;
+}
 async function grantPostgresAppRolePrivileges(sql, options) {
-  const database = assertSafeSqlIdentifier(options.database, "database name");
-  const role = assertSafeSqlIdentifier(options.role ?? POSTGRES_APP_ROLE, "role name");
-  await sql.unsafe(`GRANT CONNECT ON DATABASE ${database} TO ${role}`);
-  await sql.unsafe(`GRANT USAGE, CREATE ON SCHEMA public TO ${role}`);
-  await sql.unsafe(`GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO ${role}`);
-  await sql.unsafe(`GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO ${role}`);
-  await sql.unsafe(`GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO ${role}`);
-  await sql.unsafe(`ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO ${role}`);
-  await sql.unsafe(`ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO ${role}`);
-  await sql.unsafe(`ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT EXECUTE ON FUNCTIONS TO ${role}`);
+  const privileges = postgresAppRolePrivilegeSql(options);
+  await sql.unsafe(`${POSTGRES_PRIVILEGE_LOCK_SQL};
+${privileges}`);
 }
 async function ensurePostgresAppRole(sql, options) {
   await sql.unsafe(postgresAppRoleSql(options));

package/dist/entries/tenant/tenantDatabaseScope.js

@@ -651,6 +651,7 @@ var init_repositoryConnection = __esm(() => {
 });
 
 // ../../src/core/database/transaction.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 async function runInSavepoint(connection, operation) {
   const inherited = transactionFrame.getStore();
   let parent = inherited?.connection === connection ? inherited : outerFrames.get(connection);
@@ -710,9 +711,9 @@ async function runInTransaction(operation, options = {}) {
       signal?.throwIfAborted();
       if (!supportsTransactions(connection))
         throw new Error("Reserved database connection does not support transactions.");
-      return await connection.begin(async (transaction) => {
+      return await connection.begin(AsyncLocalStorage2.bind(async (transaction) => {
         return await runWithDatabaseConnection(transaction, () => transactionFrame.run({ connection: transaction, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await admittedOperation(createDatabaseConnection(transaction))))));
-      });
+      }));
     } finally {
       await reserved?.release();
     }
@@ -756,6 +757,7 @@ var init_tenancyConfig = __esm(() => {
 
 // ../../src/core/tenant/databaseTenantContext.ts
 import { getDefaultDatabasePool as getDefaultDatabasePool2 } from "@getstrata/core/database/defaultConnection";
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
 async function applyBypassToTransaction(transaction, bypass) {
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, [
     bypass ? "true" : "false"
@@ -807,10 +809,10 @@ async function runWithScopedTenantTransaction(apply, callback) {
     throw new Error("RLS migration bypass requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
   return await settleTransaction(() => runWithDeferredModelEvents(async () => {
-    return await begin.bind(pool)(async (transaction) => {
+    return await begin.bind(pool)(AsyncLocalStorage3.bind(async (transaction) => {
       await apply(transaction);
       return await runWithDatabaseConnection(transaction, () => runWithTransactionScope(async () => commitOrRollbackScope(await callback())));
-    });
+    }));
   }));
 }
 async function runWithMigrationBypass(callback) {
@@ -830,6 +832,7 @@ var init_databaseTenantContext = __esm(() => {
 
 // ../../src/core/tenant/tenantDatabaseScope.ts
 import { getDefaultDatabasePool as getDefaultDatabasePool3 } from "@getstrata/core/database/defaultConnection";
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
 async function applyTenantContextToTransaction(transaction, tenantId) {
   await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
@@ -852,12 +855,12 @@ async function runWithTenantDatabase(tenant, callback) {
     throw new Error("RLS tenant scope requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
   return await settleTransaction(() => runWithDeferredModelEvents(async () => {
-    return await begin.bind(pool)(async (transaction) => {
+    return await begin.bind(pool)(AsyncLocalStorage4.bind(async (transaction) => {
       await applyTenantContextToTransaction(transaction, tenant.id);
       return await runWithDatabaseConnection(transaction, async () => {
         return await runWithTransactionScope(async () => commitOrRollbackScope(await runWithTenant(tenant, callback)));
       });
-    });
+    }));
   }));
 }
 function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {

package/dist/index.js

@@ -807,6 +807,7 @@ function createDatabaseConnection(source) {
 var init_connection = () => {};
 
 // ../../src/core/database/transaction.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 async function runInSavepoint(connection, operation) {
   const inherited = transactionFrame.getStore();
   let parent = inherited?.connection === connection ? inherited : outerFrames.get(connection);
@@ -866,9 +867,9 @@ async function runInTransaction(operation, options = {}) {
       signal?.throwIfAborted();
       if (!supportsTransactions(connection))
         throw new Error("Reserved database connection does not support transactions.");
-      return await connection.begin(async (transaction) => {
+      return await connection.begin(AsyncLocalStorage2.bind(async (transaction) => {
         return await runWithDatabaseConnection(transaction, () => transactionFrame.run({ connection: transaction, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await admittedOperation(createDatabaseConnection(transaction))))));
-      });
+      }));
     } finally {
       await reserved?.release();
     }
@@ -889,6 +890,7 @@ var init_transaction = __esm(() => {
 });
 
 // ../../src/core/tenant/databaseTenantContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
 async function applyBypassToTransaction(transaction, bypass) {
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, [
     bypass ? "true" : "false"
@@ -940,10 +942,10 @@ async function runWithScopedTenantTransaction(apply, callback) {
     throw new Error("RLS migration bypass requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
   return await settleTransaction(() => runWithDeferredModelEvents(async () => {
-    return await begin.bind(pool)(async (transaction) => {
+    return await begin.bind(pool)(AsyncLocalStorage3.bind(async (transaction) => {
       await apply(transaction);
       return await runWithDatabaseConnection(transaction, () => runWithTransactionScope(async () => commitOrRollbackScope(await callback())));
-    });
+    }));
   }));
 }
 async function runWithMigrationBypass(callback) {
@@ -963,6 +965,7 @@ var init_databaseTenantContext = __esm(() => {
 });
 
 // ../../src/core/tenant/tenantDatabaseScope.ts
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
 async function applyTenantContextToTransaction(transaction, tenantId) {
   await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
@@ -985,12 +988,12 @@ async function runWithTenantDatabase(tenant, callback) {
     throw new Error("RLS tenant scope requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
   return await settleTransaction(() => runWithDeferredModelEvents(async () => {
-    return await begin.bind(pool)(async (transaction) => {
+    return await begin.bind(pool)(AsyncLocalStorage4.bind(async (transaction) => {
       await applyTenantContextToTransaction(transaction, tenant.id);
       return await runWithDatabaseConnection(transaction, async () => {
         return await runWithTransactionScope(async () => commitOrRollbackScope(await runWithTenant(tenant, callback)));
       });
-    });
+    }));
   }));
 }
 function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "2.2.21",
+  "version": "2.2.22",
   "description": "Strata Bun framework public API",
   "type": "module",
   "license": "MIT",