@getstrata/core 2.2.28 → 2.2.30

package/dist/index.js

@@ -140,220 +140,6 @@ var init_defaultConnection = __esm(() => {
   DEFAULT_CONNECTION_KEY = Symbol.for("@getstrata/defaultDatabaseConnection");
 });
 
-// ../../src/core/database/schema/driver.ts
-function normalizeConnectionName(connection) {
-  const normalized = connection.trim().toLowerCase();
-  if (normalized === "pgsql" || normalized === "postgres" || normalized === "postgresql") {
-    return "pgsql";
-  }
-  if (normalized === "mysql" || normalized === "mariadb") {
-    return "mysql";
-  }
-  if (normalized === "sqlite") {
-    return "sqlite";
-  }
-  throw new Error(`Unsupported DB_CONNECTION: ${connection}`);
-}
-function resolveDriverFromUrl(url) {
-  const normalized = url.trim().toLowerCase();
-  if (normalized.startsWith("postgres://") || normalized.startsWith("postgresql://") || normalized.startsWith("postgres:")) {
-    return "pgsql";
-  }
-  if (normalized.startsWith("mysql://") || normalized.startsWith("mysql:")) {
-    return "mysql";
-  }
-  if (normalized.startsWith("sqlite:")) {
-    return "sqlite";
-  }
-  return null;
-}
-function resolveDatabaseDriver(options = {}) {
-  const connection = options.connection ?? process.env.DB_CONNECTION;
-  if (connection) {
-    return normalizeConnectionName(connection);
-  }
-  const url = options.url ?? process.env.DATABASE_URL ?? "";
-  const fromUrl = resolveDriverFromUrl(url);
-  if (fromUrl) {
-    return fromUrl;
-  }
-  return "pgsql";
-}
-var init_driver = () => {};
-
-// ../../src/core/database/dialect.ts
-function assertSafeIdentifier(identifier) {
-  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
-    throw new Error(`Invalid SQL identifier: ${identifier}`);
-  }
-  return identifier;
-}
-function quoteIdentifierFor(dialect, column) {
-  return dialect.quoteIdentifier(column);
-}
-function dialectFor(driver) {
-  return dialects[driver];
-}
-function currentSqlDialect() {
-  return dialectContext.getStore() ?? dialectOverride ?? dialectFor(resolveDatabaseDriver());
-}
-function useSqlDialect(driver) {
-  dialectOverride = dialectFor(driver);
-  return dialectOverride;
-}
-function sqlTimestamp(value = new Date) {
-  return currentSqlDialect().timestampValue(value);
-}
-function resetSqlDialect() {
-  dialectOverride = null;
-}
-function runWithSqlDialect(driver, callback) {
-  return dialectContext.run(dialectFor(driver), callback);
-}
-var postgresDialect, mysqlDialect, sqliteDialect, dialects, dialectContext, dialectOverride = null;
-var init_dialect = __esm(() => {
-  init_asyncContextStore();
-  init_driver();
-  postgresDialect = {
-    driver: "pgsql",
-    placeholder(index) {
-      return `$${index}`;
-    },
-    quoteIdentifier(identifier) {
-      return `"${assertSafeIdentifier(identifier)}"`;
-    },
-    nowExpression() {
-      return "NOW()";
-    },
-    epochMillisecondsExpression() {
-      return "CAST(EXTRACT(EPOCH FROM clock_timestamp()) * 1000 AS BIGINT)";
-    },
-    rowLockClause(skipLocked = false) {
-      return ` FOR UPDATE${skipLocked ? " SKIP LOCKED" : ""}`;
-    },
-    timestampValue(value) {
-      return value.toISOString();
-    },
-    returningClause(columns) {
-      return ` RETURNING ${columns}`;
-    },
-    ilikeOperator() {
-      return "ILIKE";
-    },
-    nullsLastSuffix() {
-      return " NULLS LAST";
-    },
-    castToText(expression) {
-      return `${expression}::text`;
-    },
-    upsertSuffix(conflictColumns, updateColumns) {
-      const target = conflictColumns.map((column) => quoteIdentifierFor(this, column)).join(", ");
-      if (updateColumns.length === 0) {
-        return ` ON CONFLICT (${target}) DO NOTHING`;
-      }
-      const assignments = updateColumns.map((column) => {
-        const quoted = quoteIdentifierFor(this, column);
-        return `${quoted} = excluded.${quoted}`;
-      }).join(", ");
-      return ` ON CONFLICT (${target}) DO UPDATE SET ${assignments}`;
-    }
-  };
-  mysqlDialect = {
-    driver: "mysql",
-    placeholder() {
-      return "?";
-    },
-    quoteIdentifier(identifier) {
-      return `\`${assertSafeIdentifier(identifier)}\``;
-    },
-    nowExpression() {
-      return "CURRENT_TIMESTAMP";
-    },
-    epochMillisecondsExpression() {
-      return "CAST(UNIX_TIMESTAMP(CURRENT_TIMESTAMP(3)) * 1000 AS UNSIGNED)";
-    },
-    rowLockClause(skipLocked = false) {
-      return ` FOR UPDATE${skipLocked ? " SKIP LOCKED" : ""}`;
-    },
-    timestampValue(value) {
-      return value.toISOString().slice(0, 19).replace("T", " ");
-    },
-    returningClause() {
-      return "";
-    },
-    ilikeOperator() {
-      return "LIKE";
-    },
-    nullsLastSuffix() {
-      return "";
-    },
-    castToText(expression) {
-      return `CAST(${expression} AS CHAR)`;
-    },
-    upsertSuffix(conflictColumns, updateColumns) {
-      if (updateColumns.length === 0) {
-        const anchor = quoteIdentifierFor(this, conflictColumns[0] ?? "");
-        return ` ON DUPLICATE KEY UPDATE ${anchor} = ${anchor}`;
-      }
-      const assignments = updateColumns.map((column) => {
-        const quoted = quoteIdentifierFor(this, column);
-        return `${quoted} = VALUES(${quoted})`;
-      }).join(", ");
-      return ` ON DUPLICATE KEY UPDATE ${assignments}`;
-    }
-  };
-  sqliteDialect = {
-    driver: "sqlite",
-    placeholder() {
-      return "?";
-    },
-    quoteIdentifier(identifier) {
-      return `"${assertSafeIdentifier(identifier)}"`;
-    },
-    nowExpression() {
-      return "strftime('%Y-%m-%dT%H:%M:%fZ', 'now')";
-    },
-    epochMillisecondsExpression() {
-      return "CAST((julianday('now') - 2440587.5) * 86400000 AS INTEGER)";
-    },
-    rowLockClause() {
-      return "";
-    },
-    timestampValue(value) {
-      return value.toISOString();
-    },
-    returningClause(columns) {
-      return ` RETURNING ${columns}`;
-    },
-    ilikeOperator() {
-      return "LIKE";
-    },
-    nullsLastSuffix() {
-      return "";
-    },
-    castToText(expression) {
-      return `CAST(${expression} AS TEXT)`;
-    },
-    upsertSuffix(conflictColumns, updateColumns) {
-      const target = conflictColumns.map((column) => quoteIdentifierFor(this, column)).join(", ");
-      if (updateColumns.length === 0) {
-        return ` ON CONFLICT (${target}) DO NOTHING`;
-      }
-      const assignments = updateColumns.map((column) => {
-        const quoted = quoteIdentifierFor(this, column);
-        return `${quoted} = excluded.${quoted}`;
-      }).join(", ");
-      return ` ON CONFLICT (${target}) DO UPDATE SET ${assignments}`;
-    }
-  };
-  dialects = {
-    pgsql: postgresDialect,
-    mysql: mysqlDialect,
-    sqlite: sqliteDialect
-  };
-  dialectContext = createAsyncContextStore("@getstrata/sqlDialect");
-});
-
 // ../../src/core/tenant/tenantContext.ts
 function runWithTenant(tenant, callback) {
   return tenantContext.run(tenant, callback);
@@ -374,78 +160,68 @@ var init_tenantContext = __esm(() => {
   tenantContext = createAsyncContextStore("@getstrata/tenantContext");
 });
 
-// ../../src/core/database/repositoryConnection.ts
-function resolveRepositoryConnection() {
-  return getActiveDatabaseConnection(getBoundDatabaseConnection() ?? getDefaultDatabaseQuery());
-}
-function compileTaggedSql(strings, values) {
-  const dialect = currentSqlDialect();
-  let query = strings[0] ?? "";
-  const params = [];
-  for (let index = 0;index < values.length; index += 1) {
-    params.push(values[index]);
-    query += `${dialect.placeholder(params.length)}${strings[index + 1] ?? ""}`;
-  }
-  return { query, params };
-}
-function isTaggedStrings(value) {
-  if (!Array.isArray(value) || typeof value[0] !== "string") {
-    return false;
+// ../../src/core/events/eventBus.ts
+class EventBus {
+  constructor() {}
+  transactionalListeners = new Map;
+  listenTransactional(event, listener) {
+    const handlers = this.transactionalListeners.get(event) ?? new Set;
+    handlers.add(listener);
+    this.transactionalListeners.set(event, handlers);
+    return () => {
+      handlers.delete(listener);
+      if (!handlers.size)
+        this.transactionalListeners.delete(event);
+    };
   }
-  return typeof value.raw !== "undefined";
-}
-function runOnConnection(connection, args) {
-  if (typeof connection === "function") {
-    return connection(...args);
+  hasTransactionalListeners(event) {
+    return (this.transactionalListeners.get(event)?.size ?? 0) > 0;
   }
-  if (typeof connection.unsafe !== "function") {
-    throw new Error("Database connection cannot run SQL.");
+  async dispatchTransactional(event, payload) {
+    for (const listener of this.transactionalListeners.get(event) ?? [])
+      await listener(payload);
   }
-  const strings = args[0];
-  if (!isTaggedStrings(strings)) {
-    throw new Error("Database connection cannot run tagged SQL.");
+  listeners = new Map;
+  on(event, listener) {
+    return this.listen(event, listener);
   }
-  const compiled = compileTaggedSql(strings, args.slice(1));
-  return connection.unsafe(compiled.query, compiled.params);
-}
-var repositoryConnection;
-var init_repositoryConnection = __esm(() => {
-  init_boundConnection();
-  init_connectionContext();
-  init_defaultConnection();
-  init_dialect();
-  repositoryConnection = new Proxy(function repositoryConnection() {}, {
-    apply(_target, _thisArg, args) {
-      return runOnConnection(resolveRepositoryConnection(), args);
-    },
-    get(_target, property) {
-      const connection = resolveRepositoryConnection();
-      const value = connection[property];
-      return typeof value === "function" ? value.bind(connection) : value;
-    }
-  });
-});
-
-// ../../src/core/tenant/tenancyConfig.ts
-function readTenancyDriver(env = process.env) {
-  const raw = env.TENANCY_DRIVER?.trim();
-  if (raw === undefined || raw === "") {
-    return "rls";
+  listen(event, listener) {
+    const handlers = this.listeners.get(event) ?? new Set;
+    handlers.add(listener);
+    this.listeners.set(event, handlers);
+    return () => {
+      handlers.delete(listener);
+      if (handlers.size === 0) {
+        this.listeners.delete(event);
+      }
+    };
   }
-  if (TENANCY_DRIVERS.includes(raw)) {
-    return raw;
+  async emit(event, payload) {
+    await this.dispatch(event, payload);
+  }
+  async dispatch(event, payload) {
+    const handlers = this.listeners.get(event);
+    if (!handlers || handlers.size === 0) {
+      return;
+    }
+    for (const handler of handlers) {
+      await handler(payload);
+    }
   }
-  throw new Error(`TENANCY_DRIVER must be one of ${TENANCY_DRIVERS.join(", ")}; received "${raw}".`);
-}
-function isTenancyEnabled(env = process.env) {
-  return readTenancyDriver(env) !== "none";
 }
-function isRlsTenancy(env = process.env) {
-  return readTenancyDriver(env) === "rls";
+function readSharedEventBus() {
+  const globalBus = globalThis[EVENT_BUS_KEY];
+  if (globalBus) {
+    return globalBus;
+  }
+  const bus = new EventBus;
+  globalThis[EVENT_BUS_KEY] = bus;
+  return bus;
 }
-var TENANCY_DRIVERS;
-var init_tenancyConfig = __esm(() => {
-  TENANCY_DRIVERS = ["rls", "column", "none"];
+var EVENT_BUS_KEY, eventBus;
+var init_eventBus = __esm(() => {
+  EVENT_BUS_KEY = Symbol.for("@getstrata/eventBus");
+  eventBus = readSharedEventBus();
 });
 
 // ../../src/core/database/transactionControl.ts
@@ -526,68 +302,71 @@ var init_transactionControl = __esm(() => {
   transactionScopes = createAsyncContextStore("@getstrata/transactionScopes");
 });
 
-// ../../src/core/events/eventBus.ts
-class EventBus {
-  constructor() {}
-  transactionalListeners = new Map;
-  listenTransactional(event, listener) {
-    const handlers = this.transactionalListeners.get(event) ?? new Set;
-    handlers.add(listener);
-    this.transactionalListeners.set(event, handlers);
-    return () => {
-      handlers.delete(listener);
-      if (!handlers.size)
-        this.transactionalListeners.delete(event);
-    };
-  }
-  hasTransactionalListeners(event) {
-    return (this.transactionalListeners.get(event)?.size ?? 0) > 0;
+// ../../src/core/tenant/tenancyConfig.ts
+function readTenancyDriver(env = process.env) {
+  const raw = env.TENANCY_DRIVER?.trim();
+  if (raw === undefined || raw === "") {
+    return "rls";
   }
-  async dispatchTransactional(event, payload) {
-    for (const listener of this.transactionalListeners.get(event) ?? [])
-      await listener(payload);
+  if (TENANCY_DRIVERS.includes(raw)) {
+    return raw;
   }
-  listeners = new Map;
-  on(event, listener) {
-    return this.listen(event, listener);
+  throw new Error(`TENANCY_DRIVER must be one of ${TENANCY_DRIVERS.join(", ")}; received "${raw}".`);
+}
+function isTenancyEnabled(env = process.env) {
+  return readTenancyDriver(env) !== "none";
+}
+function isRlsTenancy(env = process.env) {
+  return readTenancyDriver(env) === "rls";
+}
+var TENANCY_DRIVERS;
+var init_tenancyConfig = __esm(() => {
+  TENANCY_DRIVERS = ["rls", "column", "none"];
+});
+
+// ../../src/core/tenant/tenantDatabaseScope.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+async function applyTenantContextToTransaction(transaction, tenantId) {
+  await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
+  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
+}
+async function runWithTenantDatabase(tenant, callback) {
+  const outerTenant = currentTenant();
+  if (hasActiveDatabaseConnection() && outerTenant && outerTenant.id !== tenant.id) {
+    throw new Error("Cannot switch tenants inside an active database transaction.");
   }
-  listen(event, listener) {
-    const handlers = this.listeners.get(event) ?? new Set;
-    handlers.add(listener);
-    this.listeners.set(event, handlers);
-    return () => {
-      handlers.delete(listener);
-      if (handlers.size === 0) {
-        this.listeners.delete(event);
-      }
-    };
+  if (!isTenancyEnabled() || !isRlsTenancy()) {
+    return await runWithTenant(tenant, callback);
   }
-  async emit(event, payload) {
-    await this.dispatch(event, payload);
+  if (hasActiveDatabaseConnection()) {
+    const activeConnection = getActiveDatabaseConnection(getDefaultDatabasePool());
+    return await runWithScopedTenantTransaction(() => applyTenantContextToTransaction(activeConnection, tenant.id), () => runWithTenant(tenant, callback));
   }
-  async dispatch(event, payload) {
-    const handlers = this.listeners.get(event);
-    if (!handlers || handlers.size === 0) {
-      return;
-    }
-    for (const handler of handlers) {
-      await handler(payload);
-    }
+  const pool = getDefaultDatabasePool();
+  const begin = pool.begin;
+  if (typeof begin !== "function") {
+    throw new Error("RLS tenant scope requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
+  return await settleTransaction(() => runWithDeferredModelEvents(async () => {
+    return await begin.bind(pool)(AsyncLocalStorage2.bind(async (transaction) => {
+      await applyTenantContextToTransaction(transaction, tenant.id);
+      return await runWithDatabaseConnection(transaction, async () => {
+        return await runWithTransactionScope(async () => commitOrRollbackScope(await runWithTenant(tenant, callback)));
+      });
+    }));
+  }));
 }
-function readSharedEventBus() {
-  const globalBus = globalThis[EVENT_BUS_KEY];
-  if (globalBus) {
-    return globalBus;
-  }
-  const bus = new EventBus;
-  globalThis[EVENT_BUS_KEY] = bus;
-  return bus;
+function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {
+  return hasActiveDatabaseConnection() && currentTenant()?.id === tenantId;
 }
-var EVENT_BUS_KEY, eventBus;
-var init_eventBus = __esm(() => {
-  EVENT_BUS_KEY = Symbol.for("@getstrata/eventBus");
-  eventBus = readSharedEventBus();
+var init_tenantDatabaseScope = __esm(() => {
+  init_defaultConnection();
+  init_connectionContext();
+  init_transactionControl();
+  init_deferredModelEvents();
+  init_databaseTenantContext();
+  init_tenancyConfig();
+  init_tenantContext();
 });
 
 // ../../src/core/events/deferredModelEvents.ts
@@ -667,147 +446,413 @@ async function runWithDeferredModelEvents(callback) {
         rollback();
       throw error;
     }
-  }
-  const state = { frames: [[]], rollbackFrames: [[]] };
-  let result;
-  try {
-    result = await deferredModelEvents.run(state, callback);
-  } catch (error) {
-    for (const rollback of (state.rollbackFrames[0] ?? []).reverse())
-      rollback();
-    throw error;
-  }
-  await dispatchQueuedModelEvents(state.frames[0] ?? []);
-  return result;
-}
-function onDeferredModelRollback(callback) {
-  deferredModelEvents.getStore()?.rollbackFrames.at(-1)?.push(callback);
-}
-var deferredModelEvents;
-var init_deferredModelEvents = __esm(() => {
-  init_asyncContextStore();
-  init_tenantContext();
-  init_eventBus();
-  deferredModelEvents = createAsyncContextStore("@getstrata/deferredModelEvents");
-});
-
-// ../../src/core/database/acquisitionMetrics.ts
-function createTransactionAcquisitionMetrics() {
-  const state = {
-    inflight: 0,
-    outcomes: outcomes.map((outcome) => ({
-      outcome,
-      count: 0,
-      sumSeconds: 0,
-      buckets: ACQUISITION_BUCKETS_SECONDS.map(() => 0)
-    }))
+  }
+  const state = { frames: [[]], rollbackFrames: [[]] };
+  let result;
+  try {
+    result = await deferredModelEvents.run(state, callback);
+  } catch (error) {
+    for (const rollback of (state.rollbackFrames[0] ?? []).reverse())
+      rollback();
+    throw error;
+  }
+  await dispatchQueuedModelEvents(state.frames[0] ?? []);
+  return result;
+}
+function onDeferredModelRollback(callback) {
+  deferredModelEvents.getStore()?.rollbackFrames.at(-1)?.push(callback);
+}
+var deferredModelEvents;
+var init_deferredModelEvents = __esm(() => {
+  init_asyncContextStore();
+  init_tenantContext();
+  init_eventBus();
+  deferredModelEvents = createAsyncContextStore("@getstrata/deferredModelEvents");
+});
+
+// ../../src/core/database/acquisitionMetrics.ts
+function createTransactionAcquisitionMetrics() {
+  const state = {
+    inflight: 0,
+    outcomes: outcomes.map((outcome) => ({
+      outcome,
+      count: 0,
+      sumSeconds: 0,
+      buckets: ACQUISITION_BUCKETS_SECONDS.map(() => 0)
+    }))
+  };
+  const metrics = {
+    [metricsBrand]: true,
+    snapshot: () => ({
+      inflight: state.inflight,
+      outcomes: state.outcomes.map((histogram) => ({
+        ...histogram,
+        buckets: [...histogram.buckets]
+      }))
+    })
+  };
+  states.set(metrics, state);
+  return metrics;
+}
+async function observeTransactionAcquisition(metrics, acquire, signal) {
+  const state = states.get(metrics);
+  if (!state)
+    throw new TypeError("Transaction acquisition metrics must be created by the framework factory.");
+  const started = performance.now();
+  state.inflight++;
+  let outcome = "acquired";
+  try {
+    return await acquire();
+  } catch (error) {
+    outcome = signal?.aborted ? "aborted" : "failed";
+    throw error;
+  } finally {
+    state.inflight--;
+    const elapsed = Math.max(0, performance.now() - started) / 1000;
+    const histogram = state.outcomes[outcomes.indexOf(outcome)];
+    if (histogram) {
+      histogram.count++;
+      histogram.sumSeconds += elapsed;
+      for (let index = 0;index < ACQUISITION_BUCKETS_SECONDS.length; index++) {
+        const bound = ACQUISITION_BUCKETS_SECONDS[index];
+        if (bound !== undefined && elapsed <= bound)
+          histogram.buckets[index] = (histogram.buckets[index] ?? 0) + 1;
+      }
+    }
+  }
+}
+function renderTransactionAcquisitionMetrics(snapshot) {
+  const invalid = () => new TypeError("Invalid transaction acquisition metrics.");
+  if (!Number.isSafeInteger(snapshot.inflight) || snapshot.inflight < 0 || snapshot.outcomes.length !== outcomes.length)
+    throw invalid();
+  const name = "strata_database_transaction_acquisition_duration_seconds";
+  const lines = [
+    "# HELP strata_database_acquisition_collector_success Whether transaction acquisition observation succeeded.",
+    "# TYPE strata_database_acquisition_collector_success gauge",
+    "strata_database_acquisition_collector_success 1",
+    "# HELP strata_database_transaction_acquisition_inflight Native transaction checkouts awaiting settlement in this process.",
+    "# TYPE strata_database_transaction_acquisition_inflight gauge",
+    `strata_database_transaction_acquisition_inflight ${snapshot.inflight}`,
+    `# HELP ${name} Native checkout duration, including pool wait and connection establishment, for explicitly observed transactions.`,
+    `# TYPE ${name} histogram`
+  ];
+  for (let i = 0;i < outcomes.length; i++) {
+    const histogram = snapshot.outcomes[i];
+    if (!histogram || histogram.outcome !== outcomes[i] || !Number.isSafeInteger(histogram.count) || histogram.count < 0 || !Number.isFinite(histogram.sumSeconds) || histogram.sumSeconds < 0 || histogram.buckets.length !== ACQUISITION_BUCKETS_SECONDS.length)
+      throw invalid();
+    let previous = 0;
+    for (let index = 0;index < ACQUISITION_BUCKETS_SECONDS.length; index++) {
+      const value = histogram.buckets[index];
+      if (value === undefined || !Number.isSafeInteger(value) || value < previous || value > histogram.count)
+        throw invalid();
+      previous = value;
+      lines.push(`${name}_bucket{outcome="${histogram.outcome}",le="${ACQUISITION_BUCKETS_SECONDS[index]}"} ${value}`);
+    }
+    lines.push(`${name}_bucket{outcome="${histogram.outcome}",le="+Inf"} ${histogram.count}`, `${name}_count{outcome="${histogram.outcome}"} ${histogram.count}`, `${name}_sum{outcome="${histogram.outcome}"} ${histogram.sumSeconds}`);
+  }
+  return `${lines.join(`
+`)}
+`;
+}
+var ACQUISITION_BUCKETS_SECONDS, outcomes, metricsBrand, states;
+var init_acquisitionMetrics = __esm(() => {
+  ACQUISITION_BUCKETS_SECONDS = [
+    0.001,
+    0.005,
+    0.01,
+    0.025,
+    0.05,
+    0.1,
+    0.25,
+    0.5,
+    1,
+    2.5,
+    5,
+    10
+  ];
+  outcomes = ["acquired", "failed", "aborted"];
+  metricsBrand = Symbol("transaction acquisition metrics");
+  states = new WeakMap;
+});
+
+// ../../src/core/database/connection.ts
+function createDatabaseConnection(source) {
+  return {
+    async unsafe(query, params = []) {
+      return await source.unsafe(query, params);
+    }
+  };
+}
+var init_connection = () => {};
+
+// ../../src/core/database/schema/driver.ts
+function normalizeConnectionName(connection) {
+  const normalized = connection.trim().toLowerCase();
+  if (normalized === "pgsql" || normalized === "postgres" || normalized === "postgresql") {
+    return "pgsql";
+  }
+  if (normalized === "mysql" || normalized === "mariadb") {
+    return "mysql";
+  }
+  if (normalized === "sqlite") {
+    return "sqlite";
+  }
+  throw new Error(`Unsupported DB_CONNECTION: ${connection}`);
+}
+function resolveDriverFromUrl(url) {
+  const normalized = url.trim().toLowerCase();
+  if (normalized.startsWith("postgres://") || normalized.startsWith("postgresql://") || normalized.startsWith("postgres:")) {
+    return "pgsql";
+  }
+  if (normalized.startsWith("mysql://") || normalized.startsWith("mysql:")) {
+    return "mysql";
+  }
+  if (normalized.startsWith("sqlite:")) {
+    return "sqlite";
+  }
+  return null;
+}
+function resolveDatabaseDriver(options = {}) {
+  const connection = options.connection ?? process.env.DB_CONNECTION;
+  if (connection) {
+    return normalizeConnectionName(connection);
+  }
+  const url = options.url ?? process.env.DATABASE_URL ?? "";
+  const fromUrl = resolveDriverFromUrl(url);
+  if (fromUrl) {
+    return fromUrl;
+  }
+  return "pgsql";
+}
+var init_driver = () => {};
+
+// ../../src/core/database/dialect.ts
+function assertSafeIdentifier(identifier) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
+    throw new Error(`Invalid SQL identifier: ${identifier}`);
+  }
+  return identifier;
+}
+function quoteIdentifierFor(dialect, column) {
+  return dialect.quoteIdentifier(column);
+}
+function dialectFor(driver) {
+  return dialects[driver];
+}
+function currentSqlDialect() {
+  return dialectContext.getStore() ?? dialectOverride ?? dialectFor(resolveDatabaseDriver());
+}
+function useSqlDialect(driver) {
+  dialectOverride = dialectFor(driver);
+  return dialectOverride;
+}
+function sqlTimestamp(value = new Date) {
+  return currentSqlDialect().timestampValue(value);
+}
+function resetSqlDialect() {
+  dialectOverride = null;
+}
+function runWithSqlDialect(driver, callback) {
+  return dialectContext.run(dialectFor(driver), callback);
+}
+var postgresDialect, mysqlDialect, sqliteDialect, dialects, dialectContext, dialectOverride = null;
+var init_dialect = __esm(() => {
+  init_asyncContextStore();
+  init_driver();
+  postgresDialect = {
+    driver: "pgsql",
+    placeholder(index) {
+      return `$${index}`;
+    },
+    quoteIdentifier(identifier) {
+      return `"${assertSafeIdentifier(identifier)}"`;
+    },
+    nowExpression() {
+      return "NOW()";
+    },
+    epochMillisecondsExpression() {
+      return "CAST(EXTRACT(EPOCH FROM clock_timestamp()) * 1000 AS BIGINT)";
+    },
+    rowLockClause(skipLocked = false) {
+      return ` FOR UPDATE${skipLocked ? " SKIP LOCKED" : ""}`;
+    },
+    timestampValue(value) {
+      return value.toISOString();
+    },
+    returningClause(columns) {
+      return ` RETURNING ${columns}`;
+    },
+    ilikeOperator() {
+      return "ILIKE";
+    },
+    nullsLastSuffix() {
+      return " NULLS LAST";
+    },
+    castToText(expression) {
+      return `${expression}::text`;
+    },
+    upsertSuffix(conflictColumns, updateColumns) {
+      const target = conflictColumns.map((column) => quoteIdentifierFor(this, column)).join(", ");
+      if (updateColumns.length === 0) {
+        return ` ON CONFLICT (${target}) DO NOTHING`;
+      }
+      const assignments = updateColumns.map((column) => {
+        const quoted = quoteIdentifierFor(this, column);
+        return `${quoted} = excluded.${quoted}`;
+      }).join(", ");
+      return ` ON CONFLICT (${target}) DO UPDATE SET ${assignments}`;
+    }
+  };
+  mysqlDialect = {
+    driver: "mysql",
+    placeholder() {
+      return "?";
+    },
+    quoteIdentifier(identifier) {
+      return `\`${assertSafeIdentifier(identifier)}\``;
+    },
+    nowExpression() {
+      return "CURRENT_TIMESTAMP";
+    },
+    epochMillisecondsExpression() {
+      return "CAST(UNIX_TIMESTAMP(CURRENT_TIMESTAMP(3)) * 1000 AS UNSIGNED)";
+    },
+    rowLockClause(skipLocked = false) {
+      return ` FOR UPDATE${skipLocked ? " SKIP LOCKED" : ""}`;
+    },
+    timestampValue(value) {
+      return value.toISOString().slice(0, 19).replace("T", " ");
+    },
+    returningClause() {
+      return "";
+    },
+    ilikeOperator() {
+      return "LIKE";
+    },
+    nullsLastSuffix() {
+      return "";
+    },
+    castToText(expression) {
+      return `CAST(${expression} AS CHAR)`;
+    },
+    upsertSuffix(conflictColumns, updateColumns) {
+      if (updateColumns.length === 0) {
+        const anchor = quoteIdentifierFor(this, conflictColumns[0] ?? "");
+        return ` ON DUPLICATE KEY UPDATE ${anchor} = ${anchor}`;
+      }
+      const assignments = updateColumns.map((column) => {
+        const quoted = quoteIdentifierFor(this, column);
+        return `${quoted} = VALUES(${quoted})`;
+      }).join(", ");
+      return ` ON DUPLICATE KEY UPDATE ${assignments}`;
+    }
+  };
+  sqliteDialect = {
+    driver: "sqlite",
+    placeholder() {
+      return "?";
+    },
+    quoteIdentifier(identifier) {
+      return `"${assertSafeIdentifier(identifier)}"`;
+    },
+    nowExpression() {
+      return "strftime('%Y-%m-%dT%H:%M:%fZ', 'now')";
+    },
+    epochMillisecondsExpression() {
+      return "CAST((julianday('now') - 2440587.5) * 86400000 AS INTEGER)";
+    },
+    rowLockClause() {
+      return "";
+    },
+    timestampValue(value) {
+      return value.toISOString();
+    },
+    returningClause(columns) {
+      return ` RETURNING ${columns}`;
+    },
+    ilikeOperator() {
+      return "LIKE";
+    },
+    nullsLastSuffix() {
+      return "";
+    },
+    castToText(expression) {
+      return `CAST(${expression} AS TEXT)`;
+    },
+    upsertSuffix(conflictColumns, updateColumns) {
+      const target = conflictColumns.map((column) => quoteIdentifierFor(this, column)).join(", ");
+      if (updateColumns.length === 0) {
+        return ` ON CONFLICT (${target}) DO NOTHING`;
+      }
+      const assignments = updateColumns.map((column) => {
+        const quoted = quoteIdentifierFor(this, column);
+        return `${quoted} = excluded.${quoted}`;
+      }).join(", ");
+      return ` ON CONFLICT (${target}) DO UPDATE SET ${assignments}`;
+    }
   };
-  const metrics = {
-    [metricsBrand]: true,
-    snapshot: () => ({
-      inflight: state.inflight,
-      outcomes: state.outcomes.map((histogram) => ({
-        ...histogram,
-        buckets: [...histogram.buckets]
-      }))
-    })
+  dialects = {
+    pgsql: postgresDialect,
+    mysql: mysqlDialect,
+    sqlite: sqliteDialect
   };
-  states.set(metrics, state);
-  return metrics;
+  dialectContext = createAsyncContextStore("@getstrata/sqlDialect");
+});
+
+// ../../src/core/database/repositoryConnection.ts
+function resolveRepositoryConnection() {
+  return getActiveDatabaseConnection(getBoundDatabaseConnection() ?? getDefaultDatabaseQuery());
 }
-async function observeTransactionAcquisition(metrics, acquire, signal) {
-  const state = states.get(metrics);
-  if (!state)
-    throw new TypeError("Transaction acquisition metrics must be created by the framework factory.");
-  const started = performance.now();
-  state.inflight++;
-  let outcome = "acquired";
-  try {
-    return await acquire();
-  } catch (error) {
-    outcome = signal?.aborted ? "aborted" : "failed";
-    throw error;
-  } finally {
-    state.inflight--;
-    const elapsed = Math.max(0, performance.now() - started) / 1000;
-    const histogram = state.outcomes[outcomes.indexOf(outcome)];
-    if (histogram) {
-      histogram.count++;
-      histogram.sumSeconds += elapsed;
-      for (let index = 0;index < ACQUISITION_BUCKETS_SECONDS.length; index++) {
-        const bound = ACQUISITION_BUCKETS_SECONDS[index];
-        if (bound !== undefined && elapsed <= bound)
-          histogram.buckets[index] = (histogram.buckets[index] ?? 0) + 1;
-      }
-    }
+function compileTaggedSql(strings, values) {
+  const dialect = currentSqlDialect();
+  let query = strings[0] ?? "";
+  const params = [];
+  for (let index = 0;index < values.length; index += 1) {
+    params.push(values[index]);
+    query += `${dialect.placeholder(params.length)}${strings[index + 1] ?? ""}`;
   }
+  return { query, params };
 }
-function renderTransactionAcquisitionMetrics(snapshot) {
-  const invalid = () => new TypeError("Invalid transaction acquisition metrics.");
-  if (!Number.isSafeInteger(snapshot.inflight) || snapshot.inflight < 0 || snapshot.outcomes.length !== outcomes.length)
-    throw invalid();
-  const name = "strata_database_transaction_acquisition_duration_seconds";
-  const lines = [
-    "# HELP strata_database_acquisition_collector_success Whether transaction acquisition observation succeeded.",
-    "# TYPE strata_database_acquisition_collector_success gauge",
-    "strata_database_acquisition_collector_success 1",
-    "# HELP strata_database_transaction_acquisition_inflight Native transaction checkouts awaiting settlement in this process.",
-    "# TYPE strata_database_transaction_acquisition_inflight gauge",
-    `strata_database_transaction_acquisition_inflight ${snapshot.inflight}`,
-    `# HELP ${name} Native checkout duration, including pool wait and connection establishment, for explicitly observed transactions.`,
-    `# TYPE ${name} histogram`
-  ];
-  for (let i = 0;i < outcomes.length; i++) {
-    const histogram = snapshot.outcomes[i];
-    if (!histogram || histogram.outcome !== outcomes[i] || !Number.isSafeInteger(histogram.count) || histogram.count < 0 || !Number.isFinite(histogram.sumSeconds) || histogram.sumSeconds < 0 || histogram.buckets.length !== ACQUISITION_BUCKETS_SECONDS.length)
-      throw invalid();
-    let previous = 0;
-    for (let index = 0;index < ACQUISITION_BUCKETS_SECONDS.length; index++) {
-      const value = histogram.buckets[index];
-      if (value === undefined || !Number.isSafeInteger(value) || value < previous || value > histogram.count)
-        throw invalid();
-      previous = value;
-      lines.push(`${name}_bucket{outcome="${histogram.outcome}",le="${ACQUISITION_BUCKETS_SECONDS[index]}"} ${value}`);
-    }
-    lines.push(`${name}_bucket{outcome="${histogram.outcome}",le="+Inf"} ${histogram.count}`, `${name}_count{outcome="${histogram.outcome}"} ${histogram.count}`, `${name}_sum{outcome="${histogram.outcome}"} ${histogram.sumSeconds}`);
+function isTaggedStrings(value) {
+  if (!Array.isArray(value) || typeof value[0] !== "string") {
+    return false;
   }
-  return `${lines.join(`
-`)}
-`;
+  return typeof value.raw !== "undefined";
 }
-var ACQUISITION_BUCKETS_SECONDS, outcomes, metricsBrand, states;
-var init_acquisitionMetrics = __esm(() => {
-  ACQUISITION_BUCKETS_SECONDS = [
-    0.001,
-    0.005,
-    0.01,
-    0.025,
-    0.05,
-    0.1,
-    0.25,
-    0.5,
-    1,
-    2.5,
-    5,
-    10
-  ];
-  outcomes = ["acquired", "failed", "aborted"];
-  metricsBrand = Symbol("transaction acquisition metrics");
-  states = new WeakMap;
-});
-
-// ../../src/core/database/connection.ts
-function createDatabaseConnection(source) {
-  return {
-    async unsafe(query, params = []) {
-      return await source.unsafe(query, params);
-    }
-  };
+function runOnConnection(connection, args) {
+  if (typeof connection === "function") {
+    return connection(...args);
+  }
+  if (typeof connection.unsafe !== "function") {
+    throw new Error("Database connection cannot run SQL.");
+  }
+  const strings = args[0];
+  if (!isTaggedStrings(strings)) {
+    throw new Error("Database connection cannot run tagged SQL.");
+  }
+  const compiled = compileTaggedSql(strings, args.slice(1));
+  return connection.unsafe(compiled.query, compiled.params);
 }
-var init_connection = () => {};
+var repositoryConnection;
+var init_repositoryConnection = __esm(() => {
+  init_boundConnection();
+  init_connectionContext();
+  init_defaultConnection();
+  init_dialect();
+  repositoryConnection = new Proxy(function repositoryConnection() {}, {
+    apply(_target, _thisArg, args) {
+      return runOnConnection(resolveRepositoryConnection(), args);
+    },
+    get(_target, property) {
+      const connection = resolveRepositoryConnection();
+      const value = connection[property];
+      return typeof value === "function" ? value.bind(connection) : value;
+    }
+  });
+});
 
 // ../../src/core/database/transaction.ts
-import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
 async function runInSavepoint(connection, operation) {
   const inherited = transactionFrame.getStore();
   let parent = inherited?.connection === connection ? inherited : outerFrames.get(connection);
@@ -867,7 +912,7 @@ async function runInTransaction(operation, options = {}) {
       signal?.throwIfAborted();
       if (!supportsTransactions(connection))
         throw new Error("Reserved database connection does not support transactions.");
-      return await connection.begin(AsyncLocalStorage2.bind(async (transaction) => {
+      return await connection.begin(AsyncLocalStorage3.bind(async (transaction) => {
         return await runWithDatabaseConnection(transaction, () => transactionFrame.run({ connection: transaction, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await admittedOperation(createDatabaseConnection(transaction))))));
       }));
     } finally {
@@ -890,7 +935,7 @@ var init_transaction = __esm(() => {
 });
 
 // ../../src/core/tenant/databaseTenantContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
 async function applyBypassToTransaction(transaction, bypass) {
   await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, [
     bypass ? "true" : "false"
@@ -942,7 +987,7 @@ async function runWithScopedTenantTransaction(apply, callback) {
     throw new Error("RLS migration bypass requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
   }
   return await settleTransaction(() => runWithDeferredModelEvents(async () => {
-    return await begin.bind(pool)(AsyncLocalStorage3.bind(async (transaction) => {
+    return await begin.bind(pool)(AsyncLocalStorage4.bind(async (transaction) => {
       await apply(transaction);
       return await runWithDatabaseConnection(transaction, () => runWithTransactionScope(async () => commitOrRollbackScope(await callback())));
     }));
@@ -964,51 +1009,6 @@ var init_databaseTenantContext = __esm(() => {
   init_tenancyConfig();
 });
 
-// ../../src/core/tenant/tenantDatabaseScope.ts
-import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
-async function applyTenantContextToTransaction(transaction, tenantId) {
-  await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
-  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
-}
-async function runWithTenantDatabase(tenant, callback) {
-  const outerTenant = currentTenant();
-  if (hasActiveDatabaseConnection() && outerTenant && outerTenant.id !== tenant.id) {
-    throw new Error("Cannot switch tenants inside an active database transaction.");
-  }
-  if (!isTenancyEnabled() || !isRlsTenancy()) {
-    return await runWithTenant(tenant, callback);
-  }
-  if (hasActiveDatabaseConnection()) {
-    const activeConnection = getActiveDatabaseConnection(getDefaultDatabasePool());
-    return await runWithScopedTenantTransaction(() => applyTenantContextToTransaction(activeConnection, tenant.id), () => runWithTenant(tenant, callback));
-  }
-  const pool = getDefaultDatabasePool();
-  const begin = pool.begin;
-  if (typeof begin !== "function") {
-    throw new Error("RLS tenant scope requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
-  }
-  return await settleTransaction(() => runWithDeferredModelEvents(async () => {
-    return await begin.bind(pool)(AsyncLocalStorage4.bind(async (transaction) => {
-      await applyTenantContextToTransaction(transaction, tenant.id);
-      return await runWithDatabaseConnection(transaction, async () => {
-        return await runWithTransactionScope(async () => commitOrRollbackScope(await runWithTenant(tenant, callback)));
-      });
-    }));
-  }));
-}
-function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {
-  return hasActiveDatabaseConnection() && currentTenant()?.id === tenantId;
-}
-var init_tenantDatabaseScope = __esm(() => {
-  init_defaultConnection();
-  init_connectionContext();
-  init_transactionControl();
-  init_deferredModelEvents();
-  init_databaseTenantContext();
-  init_tenancyConfig();
-  init_tenantContext();
-});
-
 // ../../src/core/admin/formatValue.ts
 function formatAdminValue(value, type = "text") {
   if (value === null || value === undefined) {
@@ -1304,6 +1304,7 @@ function resolveAuthUserDirectory(container) {
 
 // ../../src/core/auth/basicAuthGuard.ts
 init_boundConnection();
+init_connectionContext();
 init_defaultConnection();
 
 // ../../src/core/http/statelessAuth.ts
@@ -1344,6 +1345,9 @@ function readBasicCredentials(request) {
   }
 }
 
+// ../../src/core/auth/basicAuthGuard.ts
+init_databaseTenantContext();
+
 // ../../src/core/auth/password.ts
 async function hashPassword(password) {
   return await Bun.password.hash(password, {
@@ -1759,11 +1763,17 @@ async function persistConsumedRecoveryHash(sql, userId, currentRaw, consumedHash
   if (!consumedHash) {
     return;
   }
+  const hashes = parseRecoveryHashes(currentRaw);
+  if (typeof currentRaw !== "string" || !hashes.includes(consumedHash)) {
+    throw new UnprocessableEntityError("mfa_invalid");
+  }
   const dialect = currentSqlDialect();
-  await sql.unsafe(`UPDATE users SET mfa_recovery_codes = ${dialect.placeholder(1)} WHERE id = ${dialect.placeholder(2)}`, [
-    JSON.stringify(parseRecoveryHashes(currentRaw).filter((hash) => hash !== consumedHash)),
-    userId
-  ]);
+  const returning = dialect.returningClause("id");
+  const rows = await sql.unsafe(`UPDATE users SET mfa_recovery_codes = ${dialect.placeholder(1)} WHERE id = ${dialect.placeholder(2)} AND mfa_recovery_codes = ${dialect.placeholder(3)}${returning}`, [JSON.stringify(hashes.filter((hash) => hash !== consumedHash)), userId, currentRaw]);
+  const header = rows[0];
+  const affected = returning ? rows.length : typeof header === "object" && header !== null && ("affectedRows" in header) ? Number(header.affectedRows) : 0;
+  if (affected !== 1)
+    throw new UnprocessableEntityError("mfa_invalid");
 }
 
 // ../../src/core/auth/basicAuthGuard.ts
@@ -1772,6 +1782,18 @@ class BasicAuthGuard {
   constructor(container) {
     this.container = container;
   }
+  async persistRecovery(record, hash) {
+    try {
+      await runWithMigrationBypassForIdentifier(record.id, async () => {
+        await persistConsumedRecoveryHash(getActiveDatabaseConnection(getBoundDatabaseConnection() ?? getDefaultDatabasePool()), record.id, record.mfa_recovery_codes, hash);
+      });
+      return true;
+    } catch (error) {
+      if (error instanceof UnprocessableEntityError && error.message === "mfa_invalid")
+        return false;
+      throw error;
+    }
+  }
   async resolve(request) {
     const credentials = readBasicCredentials(request);
     if (!credentials) {
@@ -1793,7 +1815,8 @@ class BasicAuthGuard {
         return null;
       }
       if (mfa.consumedRecoveryHash) {
-        await persistConsumedRecoveryHash(getBoundDatabaseConnection() ?? getDefaultDatabasePool(), record.id, record.mfa_recovery_codes, mfa.consumedRecoveryHash);
+        if (!await this.persistRecovery(record, mfa.consumedRecoveryHash))
+          return null;
       }
       return {
         id: record.id,
@@ -1821,7 +1844,8 @@ class BasicAuthGuard {
         return null;
       }
       if (mfa.consumedRecoveryHash) {
-        await persistConsumedRecoveryHash(getBoundDatabaseConnection() ?? getDefaultDatabasePool(), record.id, record.mfa_recovery_codes, mfa.consumedRecoveryHash);
+        if (!await this.persistRecovery(record, mfa.consumedRecoveryHash))
+          return null;
       }
       return user;
     }
@@ -2093,6 +2117,7 @@ var SESSION_GUARD_NAMES = ["web", "session", "default"];
 
 class AuthManager {
   guard;
+  basicResolutions = new WeakMap;
   namedGuards = new Map;
   constructor(guard) {
     this.guard = guard;
@@ -2104,6 +2129,7 @@ class AuthManager {
       throw new Error("Auth guard name must not be empty.");
     }
     this.namedGuards.set(trimmed, next);
+    this.basicResolutions = new WeakMap;
     return this;
   }
   use(name = "default") {
@@ -2124,7 +2150,25 @@ class AuthManager {
     if (!request) {
       return { user: currentAuthUser(), credentialSource: null };
     }
-    return await this.authenticateRequest(request);
+    if (authorizationScheme(request) !== "basic") {
+      this.basicResolutions.delete(request);
+      return await this.authenticateRequest(request);
+    }
+    const authorization = request.headers.get("authorization");
+    const mfaCode = request.headers.get("x-mfa-code");
+    const cached = this.basicResolutions.get(request);
+    if (cached && cached.authorization === authorization && cached.mfaCode === mfaCode) {
+      return await cached.result;
+    }
+    const entry = { authorization, mfaCode, result: this.authenticateRequest(request) };
+    this.basicResolutions.set(request, entry);
+    try {
+      return await entry.result;
+    } catch (error) {
+      if (this.basicResolutions.get(request) === entry)
+        this.basicResolutions.delete(request);
+      throw error;
+    }
   }
   user(request) {
     return this.resolve(request);