@getstrata/core 2.2.36 → 2.2.38

package/dist/index.js

@@ -853,6 +853,17 @@ var init_repositoryConnection = __esm(() => {
 
 // ../../src/core/database/transaction.ts
 import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
+function scopedConnection(source) {
+  const connection = createDatabaseConnection(source);
+  transactionAliases.set(connection, source);
+  return connection;
+}
+function isActiveTransactionConnection(connection) {
+  if (!hasActiveTransaction() || !hasActiveDatabaseConnection())
+    return false;
+  const active = getActiveDatabaseConnection(connection);
+  return connection === active || transactionAliases.get(connection) === active;
+}
 async function runInSavepoint(connection, operation) {
   const inherited = transactionFrame.getStore();
   let parent = inherited?.connection === connection ? inherited : outerFrames.get(connection);
@@ -869,7 +880,7 @@ async function runInSavepoint(connection, operation) {
     return await settleTransaction(() => runWithDeferredModelEvents(async () => {
       await connection.unsafe(`SAVEPOINT ${name}`);
       try {
-        const result = await transactionFrame.run({ connection, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await operation(createDatabaseConnection(connection)))));
+        const result = await transactionFrame.run({ connection, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await operation(scopedConnection(connection)))));
         await connection.unsafe(`RELEASE SAVEPOINT ${name}`);
         return result;
       } catch (error) {
@@ -892,9 +903,12 @@ async function runInTransaction(operation, options = {}) {
     signal?.throwIfAborted();
     return operation(connection);
   };
-  const pool = resolveRepositoryConnection();
+  const pool = options.connection ?? resolveRepositoryConnection();
   if (hasActiveDatabaseConnection()) {
-    return await runInSavepoint(getActiveDatabaseConnection(pool), admittedOperation);
+    const active = getActiveDatabaseConnection(pool);
+    if (options.connection && options.connection !== active && options.connection !== transactionRoots.get(active) && transactionAliases.get(options.connection) !== active)
+      throw new Error("Cannot switch database connections within an active transaction.");
+    return await runInSavepoint(active, admittedOperation);
   }
   if (!supportsTransactions(pool)) {
     throw new Error("Active database connection does not support transactions. Bind a client with begin() via bindDatabaseConnection.");
@@ -913,14 +927,15 @@ async function runInTransaction(operation, options = {}) {
       if (!supportsTransactions(connection))
         throw new Error("Reserved database connection does not support transactions.");
       return await connection.begin(AsyncLocalStorage3.bind(async (transaction) => {
-        return await runWithDatabaseConnection(transaction, () => transactionFrame.run({ connection: transaction, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await admittedOperation(createDatabaseConnection(transaction))))));
+        transactionRoots.set(transaction, pool);
+        return await runWithDatabaseConnection(transaction, () => transactionFrame.run({ connection: transaction, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await admittedOperation(scopedConnection(transaction))))));
       }));
     } finally {
       await reserved?.release();
     }
   }));
 }
-var transactionFrame, outerFrames;
+var transactionFrame, outerFrames, transactionRoots, transactionAliases;
 var init_transaction = __esm(() => {
   init_deferredModelEvents();
   init_asyncContextStore();
@@ -932,6 +947,8 @@ var init_transaction = __esm(() => {
   init_acquisitionMetrics();
   transactionFrame = createAsyncContextStore("@getstrata/transactionFrame");
   outerFrames = new WeakMap;
+  transactionRoots = new WeakMap;
+  transactionAliases = new WeakMap;
 });
 
 // ../../src/core/tenant/databaseTenantContext.ts
@@ -3287,8 +3304,6 @@ function missingOptionalPeer(packageName, reason, error) {
 }
 
 // ../../src/core/auth/saml/samlAssertionReplay.ts
-init_boundConnection();
-init_defaultConnection();
 init_dialect();
 
 // ../../src/core/database/errors.ts
@@ -3404,6 +3419,7 @@ function isUniqueConstraintError(error) {
 }
 
 // ../../src/core/auth/saml/samlAssertionReplay.ts
+init_transaction();
 var REPLAY_RETENTION_MS = 60 * 60 * 1000;
 
 class InMemorySamlAssertionReplayStore {
@@ -3431,17 +3447,18 @@ class InMemorySamlAssertionReplayStore {
 
 class SqlSamlAssertionReplayStore {
   async consume(assertionId) {
-    const sql = getBoundDatabaseConnection() ?? getDefaultDatabasePool();
     const dialect = currentSqlDialect();
     try {
-      await sql.unsafe(`INSERT INTO auth_saml_assertions (assertion_id, consumed_at) VALUES (${dialect.placeholder(1)}, ${dialect.placeholder(2)})`, [assertionId, new Date().toISOString()]);
+      await runInTransaction(async (connection) => {
+        await connection.unsafe(`INSERT INTO auth_saml_assertions (assertion_id, consumed_at) VALUES (${dialect.placeholder(1)}, ${dialect.placeholder(2)})`, [assertionId, dialect.timestampValue(new Date)]);
+        await connection.unsafe(`DELETE FROM auth_saml_assertions WHERE consumed_at < ${dialect.placeholder(1)}`, [dialect.timestampValue(new Date(Date.now() - REPLAY_RETENTION_MS))]);
+      });
     } catch (error) {
       if (isUniqueConstraintError(error)) {
         throw new Error("SAML assertion replay detected.");
       }
       throw error;
     }
-    await sql.unsafe(`DELETE FROM auth_saml_assertions WHERE consumed_at < ${dialect.placeholder(1)}`, [new Date(Date.now() - REPLAY_RETENTION_MS).toISOString()]);
   }
 }
 var sqlReplayStore = new SqlSamlAssertionReplayStore;
@@ -3464,6 +3481,7 @@ async function consumeSamlAssertion(assertionId) {
 }
 
 // ../../src/core/auth/saml/samlServiceProvider.ts
+var CLOCK_SKEW_MS = 5000;
 function readAssertionId(profile) {
   if (typeof profile.ID === "string" && profile.ID.trim()) {
     return profile.ID.trim();
@@ -3472,6 +3490,43 @@ function readAssertionId(profile) {
   const assertionId = parsed?.Assertion?.$?.ID;
   return typeof assertionId === "string" ? assertionId.trim() : "";
 }
+function assertBearerRecipient(profile, acsUrl) {
+  const subjects = profile.getAssertion?.()?.Assertion?.Subject;
+  const confirmations = Array.isArray(subjects) && subjects.length === 1 ? subjects[0]?.SubjectConfirmation : undefined;
+  const now = Date.now();
+  const matches = Array.isArray(confirmations) && confirmations.some((confirmation) => {
+    if (confirmation?.$?.Method !== "urn:oasis:names:tc:SAML:2.0:cm:bearer")
+      return false;
+    const data = confirmation.SubjectConfirmationData;
+    if (!Array.isArray(data) || data.length !== 1)
+      return false;
+    const attributes = data[0]?.$;
+    if (attributes?.Recipient !== acsUrl || attributes.NotBefore !== undefined)
+      return false;
+    if (typeof attributes.NotOnOrAfter !== "string")
+      return false;
+    const expires = Date.parse(attributes.NotOnOrAfter);
+    return Number.isFinite(expires) && now < expires + CLOCK_SKEW_MS;
+  });
+  if (!matches)
+    throw new Error("SAML assertion bearer recipient is invalid.");
+}
+async function assertResponseDestination(profile, acsUrl) {
+  const xml = profile.getSamlResponseXml?.();
+  const invalid = () => new Error("SAML response destination is invalid.");
+  if (typeof xml !== "string" || !xml.trim())
+    throw invalid();
+  const parserModule = "@xmldom/xmldom";
+  const { DOMParser } = await import(parserModule);
+  const document = new DOMParser({
+    errorHandler: () => {
+      throw invalid();
+    }
+  }).parseFromString(xml, "application/xml");
+  const response = document.documentElement;
+  if (document.doctype || response?.localName !== "Response" || response.namespaceURI !== "urn:oasis:names:tc:SAML:2.0:protocol" || response.getAttribute("Destination") !== acsUrl)
+    throw invalid();
+}
 function requireSamlOption(value, name) {
   const trimmed = value?.trim() ?? "";
   if (!trimmed) {
@@ -3536,7 +3591,7 @@ class SamlServiceProvider {
       idpCert: this.options.idpCert,
       audience: this.options.spEntityId,
       idpIssuer: this.options.idpIssuer,
-      acceptedClockSkewMs: 5000,
+      acceptedClockSkewMs: CLOCK_SKEW_MS,
       wantAssertionsSigned: this.options.wantAssertionsSigned ?? true,
       wantAuthnResponseSigned: this.options.wantAuthnResponseSigned ?? true,
       disableRequestedAuthnContext: this.options.disableRequestedAuthnContext ?? false
@@ -3567,6 +3622,8 @@ class SamlServiceProvider {
     if (!assertionId) {
       throw new Error("SAML assertion did not include an ID.");
     }
+    assertBearerRecipient(profile, this.options.acsUrl);
+    await assertResponseDestination(profile, this.options.acsUrl);
     await consumeSamlAssertion(assertionId);
     const email = profile.email || (typeof profile["urn:oid:0.9.2342.19200300.100.1.3"] === "string" ? profile["urn:oid:0.9.2342.19200300.100.1.3"] : "") || "";
     if (!email) {
@@ -3743,7 +3800,6 @@ function buildPaginationMeta(input) {
 }
 
 // ../../src/core/database/baseRepository.ts
-init_connectionContext();
 init_dialect();
 
 // ../../src/core/database/keyset.ts
@@ -5171,7 +5227,7 @@ class BaseRepository {
   assertTransactionalEvent(action) {
     if (!eventBus.hasTransactionalListeners(modelEventName(this.table.name, action)))
       return;
-    if (!hasActiveTransaction() || this.connection !== repositoryConnection && this.connection !== getActiveDatabaseConnection(repositoryConnection))
+    if (!hasActiveTransaction() || this.connection !== repositoryConnection && !isActiveTransactionConnection(this.connection))
       throw new Error("Transactional model listeners require runInTransaction and the framework-bound repository connection before writing.");
   }
   async runModelMutation(action, operation) {
@@ -5179,6 +5235,32 @@ class BaseRepository {
       return operation();
     return runInTransaction(operation);
   }
+  mysqlMutation(operation) {
+    return runInTransaction((db) => operation(this.withConnection(db)), this.connection === repositoryConnection ? {} : { connection: this.connection });
+  }
+  mysqlRow(id, onlyTrashed = false) {
+    if (id === undefined || id === null)
+      throw new Error(`MySQL write to ${this.table.name} did not identify its persisted primary key.`);
+    return this.firstOrNull({ [this.table.primaryKey]: id }, {
+      withTrashed: true,
+      ...onlyTrashed ? { onlyTrashed: true } : {}
+    });
+  }
+  mysqlAffected(row) {
+    const count = row?.affectedRows;
+    if (count === undefined || !Number.isSafeInteger(count) || count < 0)
+      throw new Error("MySQL mutations require affectedRows metadata from the framework adapter.");
+    return count;
+  }
+  async mysqlWriteById(query, id, onlyTrashed = false, allowUnchanged = false) {
+    const [row] = await this.connection.unsafe(query.text, query.params);
+    if (!this.mysqlAffected(row)) {
+      if (!allowUnchanged)
+        return null;
+      return this.findById(id);
+    }
+    return this.mysqlRow(id, onlyTrashed);
+  }
   async count(options = {}) {
     if (options.lock)
       throw new Error("Row locks require a row selection, not count().");
@@ -5187,7 +5269,7 @@ class BaseRepository {
   }
   async findAll(options = {}) {
     return await withDatabaseErrorHandling(async () => {
-      if (options.lock && (!hasActiveTransaction() || this.connection !== repositoryConnection && this.connection !== getActiveDatabaseConnection(repositoryConnection))) {
+      if (options.lock && (!hasActiveTransaction() || this.connection !== repositoryConnection && !isActiveTransactionConnection(this.connection))) {
         throw new Error("Row locks require the framework active transaction connection.");
       }
       const { whereNodes, ...queryOptions } = options;
@@ -5399,6 +5481,32 @@ class BaseRepository {
     return record ?? null;
   }
   async upsert(values, conflictColumns, updateColumns) {
+    if (currentSqlDialect().driver === "mysql")
+      return this.mysqlMutation((repository) => withDatabaseErrorHandling(async () => {
+        const where = {};
+        for (const column of conflictColumns) {
+          if (!this.table.columns.includes(column) || values[column] === undefined || values[column] === null)
+            throw new Error("MySQL upsert requires non-null supplied conflict-column values.");
+          where[column] = values[column];
+        }
+        const query = buildUpsertQuery(this.table, values, conflictColumns, updateColumns);
+        const supplied = this.table.columns.filter((column) => values[column] !== undefined);
+        const updates = updateColumns ?? supplied.filter((column) => !conflictColumns.includes(column));
+        const doNothing = !updates.some((column) => supplied.includes(column));
+        const existing = doNothing ? await repository.firstOrNull(where, {
+          withTrashed: true,
+          lock: { mode: "update" }
+        }) : null;
+        const [result] = await repository.connection.unsafe(query.text, query.params);
+        repository.mysqlAffected(result);
+        if (doNothing && existing)
+          return null;
+        const generated = result?.insertId;
+        const row = generated !== undefined && String(generated) !== "0" ? await repository.mysqlRow(generated) : await repository.firstOrNull(where, { withTrashed: true });
+        if (!row)
+          throw new Error("MySQL upsert could not resolve the persisted row; transaction rolled back.");
+        return row;
+      }));
     return await withDatabaseErrorHandling(async () => {
       const { text, params } = buildUpsertQuery(this.table, values, conflictColumns, updateColumns);
       const [record] = await this.connection.unsafe(text, params);
@@ -5406,6 +5514,8 @@ class BaseRepository {
     });
   }
   async incrementById(id, column, amount = 1, extra = {}) {
+    if (currentSqlDialect().driver === "mysql")
+      return this.mysqlMutation((repository) => withDatabaseErrorHandling(() => repository.mysqlWriteById(buildIncrementQuery(this.table, id, column, amount, extra), id, false, true)));
     return await withDatabaseErrorHandling(async () => {
       const { text, params } = buildIncrementQuery(this.table, id, column, amount, extra);
       const [record] = await this.connection.unsafe(text, params);
@@ -5417,6 +5527,18 @@ class BaseRepository {
   }
   async create(values) {
     this.assertTransactionalEvent("created");
+    if (currentSqlDialect().driver === "mysql")
+      return this.mysqlMutation((repository) => withDatabaseErrorHandling(async () => {
+        const query = buildInsertQuery(this.table, values);
+        const [result] = await repository.connection.unsafe(query.text, query.params);
+        repository.mysqlAffected(result);
+        const key = String(result?.insertId ?? "0") !== "0" ? result?.insertId : values[this.table.primaryKey];
+        const row = await repository.mysqlRow(key);
+        if (!row)
+          throw new Error(`Insert into ${this.table.name} did not return a record.`);
+        await dispatchModelEvent(modelEventName(this.table.name, "created"), row);
+        return row;
+      }));
     return await this.runModelMutation("created", () => withDatabaseErrorHandling(async () => {
       const { text, params } = buildInsertQuery(this.table, values);
       const [record] = await this.connection.unsafe(text, params);
@@ -5452,6 +5574,13 @@ class BaseRepository {
   }
   async updateById(id, changes) {
     this.assertTransactionalEvent("updated");
+    if (currentSqlDialect().driver === "mysql")
+      return this.mysqlMutation((repository) => withDatabaseErrorHandling(async () => {
+        const row = await repository.mysqlWriteById(buildUpdateQuery(this.table, id, changes), id, false, true);
+        if (row)
+          await dispatchModelEvent(modelEventName(this.table.name, "updated"), row);
+        return row;
+      }));
     return await this.runModelMutation("updated", () => withDatabaseErrorHandling(async () => {
       const { text, params } = buildUpdateQuery(this.table, id, changes);
       const [record] = await this.connection.unsafe(text, params);
@@ -5477,6 +5606,14 @@ class BaseRepository {
   }
   async softDeleteById(id) {
     this.assertTransactionalEvent("deleted");
+    if (currentSqlDialect().driver === "mysql")
+      return this.mysqlMutation((repository) => withDatabaseErrorHandling(async () => {
+        const row = await repository.mysqlWriteById(buildSoftDeleteByIdQuery(this.table, id, new Date), id, true);
+        if (!row)
+          return false;
+        await dispatchModelEvent(modelEventName(this.table.name, "deleted"), row);
+        return true;
+      }));
     return await this.runModelMutation("deleted", () => withDatabaseErrorHandling(async () => {
       const { text, params } = buildSoftDeleteByIdQuery(this.table, id, new Date);
       const [record] = await this.connection.unsafe(text, params);
@@ -5489,6 +5626,15 @@ class BaseRepository {
   }
   async forceDeleteById(id) {
     this.assertTransactionalEvent("force-deleted");
+    if (currentSqlDialect().driver === "mysql")
+      return this.mysqlMutation((repository) => withDatabaseErrorHandling(async () => {
+        const query = buildDeleteByIdQuery(this.table, id);
+        const [result] = await repository.connection.unsafe(query.text, query.params);
+        if (!repository.mysqlAffected(result))
+          return false;
+        await dispatchModelEvent(modelEventName(this.table.name, "force-deleted"), { id });
+        return true;
+      }));
     return await this.runModelMutation("force-deleted", () => withDatabaseErrorHandling(async () => {
       const { text, params } = buildDeleteByIdQuery(this.table, id);
       const [row] = await this.connection.unsafe(text, params);
@@ -5503,6 +5649,13 @@ class BaseRepository {
   }
   async restoreById(id) {
     this.assertTransactionalEvent("restored");
+    if (currentSqlDialect().driver === "mysql")
+      return this.mysqlMutation((repository) => withDatabaseErrorHandling(async () => {
+        const row = await repository.mysqlWriteById(buildRestoreByIdQuery(this.table, id), id);
+        if (row)
+          await dispatchModelEvent(modelEventName(this.table.name, "restored"), row);
+        return row;
+      }));
     return await this.runModelMutation("restored", () => withDatabaseErrorHandling(async () => {
       const { text, params } = buildRestoreByIdQuery(this.table, id);
       const [record] = await this.connection.unsafe(text, params);
@@ -17204,6 +17357,7 @@ export {
   indexMorphToRelation,
   inferReferencedTable,
   installGracefulShutdownSignals,
+  isActiveTransactionConnection,
   isBlockedHostname,
   isBlockedIpAddress,
   isDefaultDatabaseConnection,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "2.2.36",
+  "version": "2.2.38",
   "description": "Strata Bun framework public API",
   "type": "module",
   "license": "MIT",
@@ -955,10 +955,10 @@
   ],
   "scripts": {
     "build": "rm -rf dist && bun run build:bundle && bun run build:shims && bun run build:subpaths && bun run build:types",
-    "build:bundle": "bun build index.ts --outdir dist --target bun --external bun --external '@opentelemetry/*' --external eta --external mysql2 --external @node-saml/node-saml",
+    "build:bundle": "bun build index.ts --outdir dist --target bun --external bun --external '@opentelemetry/*' --external eta --external mysql2 --external @node-saml/node-saml --external @xmldom/xmldom",
     "build:types": "tsc -p tsconfig.types.json",
     "prepublishOnly": "bun run build && bun ../../scripts/prepare-core-package-publish.ts",
-    "build:subpaths": "bun build entries/auth/accountState.ts entries/auth/accountStateMigration.ts entries/auth/accessControl.ts entries/auth/abilityChecker.ts entries/auth/emailVerification.ts entries/auth/jwt.ts entries/auth/jwtGuard.ts entries/auth/basicAuthGuard.ts entries/auth/tokenAbilityChecker.ts entries/auth/membershipMiddleware.ts entries/auth/membershipScope.ts entries/auth/membershipService.ts entries/auth/oauth/oidcProvider.ts entries/auth/oauth/providers.ts entries/auth/oauth/samlProvider.ts entries/auth/oauth/types.ts entries/auth/saml/samlServiceProvider.ts entries/auth/password.ts entries/auth/passwordLogin.ts entries/auth/pendingMfaCookie.ts entries/auth/oneTimeToken.ts entries/auth/intendedUrlCookie.ts entries/auth/passwordConfirmCookie.ts entries/auth/policy.ts entries/auth/scimAuthMiddleware.ts entries/auth/sessionCookie.ts entries/auth/sessionGuard.ts entries/auth/tokenHash.ts entries/audit/exportAuditLogs.ts entries/audit/siemFormatter.ts entries/admin/formatValue.ts entries/admin/registry.ts entries/admin/types.ts entries/cache/tags.ts entries/cache/createCacheStore.ts entries/cache/repository.ts entries/cache/simpleCache.ts entries/cache/simpleCacheStore.ts entries/config/envSchema.ts entries/contracts/serviceTokens.ts entries/contracts/authUserDirectory.ts entries/contracts/container.ts entries/contracts/di.ts entries/crypto/fieldEncryption.ts entries/crypto/mfaSecret.ts entries/database/errors.ts entries/database/factory.ts entries/database/migrations.ts entries/database/migrations/types.ts entries/database/query.ts entries/database/relationships.ts entries/database/repositoryQuery.ts entries/database/seeders.ts entries/database/seeders/types.ts entries/database/schema.ts entries/database/sqliteConnection.ts entries/database/table.ts entries/database/types.ts entries/database/whereBuilder.ts entries/facades.ts entries/http/authMiddleware.ts entries/http/authorizeMiddleware.ts entries/http/bodySizeLimitMiddleware.ts entries/http/clientIp.ts entries/http/cookies.ts entries/http/contentNegotiation.ts entries/http/conditionalResponse.ts entries/http/corsMiddleware.ts entries/http/csrfMiddleware.ts entries/http/csrfProtection.ts entries/http/csrfToken.ts entries/http/etag.ts entries/http/flashSession.ts entries/http/flashMiddleware.ts entries/http/formRequest.ts entries/http/metricsMiddleware.ts entries/http/memoryThrottleMiddleware.ts entries/http/pagination.ts entries/http/parseFormBody.ts entries/http/parseMultipartUpload.ts entries/http/requireAbilityMiddleware.ts entries/http/requireAuthMiddleware.ts entries/http/requireGlobalAdminMiddleware.ts entries/http/requireWebAuthMiddleware.ts entries/http/requireVerifiedMiddleware.ts entries/http/requirePasswordConfirmMiddleware.ts entries/http/resources.ts entries/http/response.ts entries/http/route.ts entries/http/routeMiddleware.ts entries/http/routeModelBinding.ts entries/http/safeInternalPath.ts entries/http/signedUrl.ts entries/http/statelessAuth.ts entries/http/scimThrottleMiddleware.ts entries/http/securityHeadersMiddleware.ts entries/http/securedRouteModelBinding.ts entries/http/webFormRequest.ts entries/http/throttleMiddleware.ts entries/http/uploads.ts entries/http/validation.ts entries/jobs/exportAuditLogsJob.ts entries/jobs/invalidateCacheTagsJob.ts entries/logging/logger.ts entries/logging/requestLoggingMiddleware.ts entries/mail/mailer.ts entries/mail/markdownMail.ts entries/mail/markdownMailable.ts entries/mail/sanitizeMailHtml.ts entries/media/imageTransform.ts entries/metrics/prometheus.ts entries/openapi/generator.ts entries/openapi/registeredRoute.ts entries/openapi/validate.ts entries/pagination.ts entries/queue.ts entries/queue/createAppQueue.ts entries/queue/failedJobRepository.ts entries/queue/failedJobService.ts entries/queue/jobRunner.ts entries/queue/queueMetrics.ts entries/queue/publicQueue.ts entries/queue/redisQueue.ts entries/queue/types.ts entries/runtime/appEnv.ts entries/runtime/frontendMode.ts entries/runtime/asyncContextStore.ts entries/scheduler/osCron.ts entries/security/oauthState.ts entries/security/publicReads.ts entries/security/recoveryCodes.ts entries/security/safeFetch.ts entries/security/safePath.ts entries/security/scimTenantTokens.ts entries/security/stripeWebhook.ts entries/security/webhookSignature.ts entries/security/timingSafeCompare.ts entries/security/tokenExpiry.ts entries/security/totp.ts entries/storage/storage.ts entries/tenant/tenancyConfig.ts entries/tenant/tenantDatabaseScope.ts entries/tenant/databaseTenantContext.ts entries/tenant/enableTenantRls.ts entries/terminal/runShell.ts entries/tracing/tracingMiddleware.ts entries/validation/rules.ts --outdir dist --root . --target bun --external bun --external '@opentelemetry/*' --external eta --external mysql2 --external @node-saml/node-saml --external @getstrata/core --external @getstrata/core/auth/accountState --external @getstrata/core/auth/accountStateMigration --external @getstrata/core/auth/accessControl --external @getstrata/core/auth/abilityChecker --external @getstrata/core/auth/authContext --external @getstrata/core/auth/emailVerification --external @getstrata/core/auth/guard --external @getstrata/core/auth/jwt --external @getstrata/core/auth/jwtGuard --external @getstrata/core/auth/basicAuthGuard --external @getstrata/core/auth/tokenAbilityChecker --external @getstrata/core/auth/membershipContext --external @getstrata/core/auth/membershipMiddleware --external @getstrata/core/auth/membershipScope --external @getstrata/core/auth/membershipService --external @getstrata/core/auth/oauth/oidcProvider --external @getstrata/core/auth/oauth/providers --external @getstrata/core/auth/oauth/samlProvider --external @getstrata/core/auth/oauth/types --external @getstrata/core/auth/saml/samlServiceProvider --external @getstrata/core/auth/password --external @getstrata/core/auth/passwordLogin --external @getstrata/core/auth/pendingMfaCookie --external @getstrata/core/auth/oneTimeToken --external @getstrata/core/auth/intendedUrlCookie --external @getstrata/core/auth/passwordConfirmCookie --external @getstrata/core/auth/policy --external @getstrata/core/auth/scimAuthMiddleware --external @getstrata/core/auth/sessionCookie --external @getstrata/core/auth/sessionGuard --external @getstrata/core/auth/tokenHash --external @getstrata/core/audit/exportAuditLogs --external @getstrata/core/audit/siemFormatter --external @getstrata/core/admin/formatValue --external @getstrata/core/admin/registry --external @getstrata/core/admin/types --external @getstrata/core/cache/tags --external @getstrata/core/cache/createCacheStore --external @getstrata/core/cache/repository --external @getstrata/core/cache/simpleCache --external @getstrata/core/cache/simpleCacheStore --external @getstrata/core/config/envSchema --external @getstrata/core/contracts/serviceTokens --external @getstrata/core/contracts/authUserDirectory --external @getstrata/core/contracts/container --external @getstrata/core/contracts/di --external @getstrata/core/crypto/fieldEncryption --external @getstrata/core/crypto/fieldEncryptionRotation --external @getstrata/core/crypto/mfaSecret --external @getstrata/core/database --external @getstrata/core/database/baseRepository --external @getstrata/core/database/bindConnection --external @getstrata/core/database/boundConnection --external @getstrata/core/database/bunSql --external @getstrata/core/database/connection --external @getstrata/core/database/connectionContext --external @getstrata/core/database/defaultConnection --external @getstrata/core/database/dialect --external @getstrata/core/database/mysqlConnection --external @getstrata/core/database/namedConnections --external @getstrata/core/database/errors --external @getstrata/core/database/factory --external @getstrata/core/database/migrations --external @getstrata/core/database/migrations/types --external @getstrata/core/database/model --external @getstrata/core/database/query --external @getstrata/core/database/relationships --external @getstrata/core/database/repositoryConnection --external @getstrata/core/database/repositoryQuery --external @getstrata/core/database/seeders --external @getstrata/core/database/seeders/types --external @getstrata/core/database/schema --external @getstrata/core/database/sqliteConnection --external @getstrata/core/database/table --external @getstrata/core/database/transaction --external @getstrata/core/database/types --external @getstrata/core/database/whereBuilder --external @getstrata/core/errors/http --external @getstrata/core/events --external @getstrata/core/events/outbox --external @getstrata/core/facades --external @getstrata/core/http --external @getstrata/core/http/authMiddleware --external @getstrata/core/http/authorizeMiddleware --external @getstrata/core/http/bodySizeLimitMiddleware --external @getstrata/core/http/clientIp --external @getstrata/core/http/cookies --external @getstrata/core/http/contentNegotiation --external @getstrata/core/http/contentSecurityPolicy --external @getstrata/core/http/conditionalResponse --external @getstrata/core/http/corsMiddleware --external @getstrata/core/http/csrfMiddleware --external @getstrata/core/http/csrfProtection --external @getstrata/core/http/csrfToken --external @getstrata/core/http/etag --external @getstrata/core/http/flashSession --external @getstrata/core/http/flashMiddleware --external @getstrata/core/http/formRequest --external @getstrata/core/http/middleware --external @getstrata/core/http/metricsMiddleware --external @getstrata/core/http/loginThrottleMiddleware --external @getstrata/core/http/memoryThrottleMiddleware --external @getstrata/core/http/pagination --external @getstrata/core/http/parseFormBody --external @getstrata/core/http/parseMultipartUpload --external @getstrata/core/http/requireAbilityMiddleware --external @getstrata/core/http/requireAuthMiddleware --external @getstrata/core/http/requireGlobalAdminMiddleware --external @getstrata/core/http/requireWebAuthMiddleware --external @getstrata/core/http/requireVerifiedMiddleware --external @getstrata/core/http/requirePasswordConfirmMiddleware --external @getstrata/core/http/resources --external @getstrata/core/http/response --external @getstrata/core/http/route --external @getstrata/core/http/routeMiddleware --external @getstrata/core/http/routeModelBinding --external @getstrata/core/http/safeInternalPath --external @getstrata/core/http/signedUrl --external @getstrata/core/http/statelessAuth --external @getstrata/core/http/scimThrottleMiddleware --external @getstrata/core/http/securityHeadersMiddleware --external @getstrata/core/http/securedRouteModelBinding --external @getstrata/core/http/requestMetaContext --external @getstrata/core/http/webErrorResponse --external @getstrata/core/http/webFormRequest --external @getstrata/core/http/throttleMiddleware --external @getstrata/core/http/uploads --external @getstrata/core/http/validation --external @getstrata/core/jobs/exportAuditLogsJob --external @getstrata/core/jobs/invalidateCacheTagsJob --external @getstrata/core/lifecycle/gracefulShutdown --external @getstrata/core/logging/logger --external @getstrata/core/logging/requestLoggingMiddleware --external @getstrata/core/mail/mailer --external @getstrata/core/mail/markdownMail --external @getstrata/core/mail/markdownMailable --external @getstrata/core/mail/sanitizeMailHtml --external @getstrata/core/media/imageTransform --external @getstrata/core/metrics/prometheus --external @getstrata/core/notifications --external @getstrata/core/openapi/generator --external @getstrata/core/openapi/registeredRoute --external @getstrata/core/openapi/validate --external @getstrata/core/pagination --external @getstrata/core/queue --external @getstrata/core/queue/createAppQueue --external @getstrata/core/queue/failedJobRepository --external @getstrata/core/queue/failedJobService --external @getstrata/core/queue/jobRegistry --external @getstrata/core/queue/jobRunner --external @getstrata/core/queue/queueMetrics --external @getstrata/core/queue/publicQueue --external @getstrata/core/queue/redisQueue --external @getstrata/core/queue/types --external @getstrata/core/runtime/appEnv --external @getstrata/core/runtime/appKeyPrefix --external @getstrata/core/runtime/frontendMode --external @getstrata/core/runtime/applicationRegistry --external @getstrata/core/runtime/asyncContextStore --external @getstrata/core/scheduler/schedule --external @getstrata/core/scheduler/osCron --external @getstrata/core/security/oauthState --external @getstrata/core/security/publicReads --external @getstrata/core/security/recoveryCodes --external @getstrata/core/security/safeFetch --external @getstrata/core/security/safePath --external @getstrata/core/security/safeUrl --external @getstrata/core/security/scimTenantTokens --external @getstrata/core/security/securityEvents --external @getstrata/core/security/stripeWebhook --external @getstrata/core/security/webhookSignature --external @getstrata/core/security/timingSafeCompare --external @getstrata/core/security/tokenExpiry --external @getstrata/core/security/totp --external @getstrata/core/storage/storage --external @getstrata/core/tenant/tenancyConfig --external @getstrata/core/tenant/tenantContext --external @getstrata/core/tenant/tenantDatabaseScope --external @getstrata/core/tenant/databaseTenantContext --external @getstrata/core/tenant/tenantMiddleware --external @getstrata/core/tenant/enableTenantRls --external @getstrata/core/terminal/runShell --external @getstrata/core/tracing/traceContext --external @getstrata/core/tracing/tracingMiddleware --external @getstrata/core/validation/rules --external @getstrata/core/view",
+    "build:subpaths": "bun build entries/auth/accountState.ts entries/auth/accountStateMigration.ts entries/auth/accessControl.ts entries/auth/abilityChecker.ts entries/auth/emailVerification.ts entries/auth/jwt.ts entries/auth/jwtGuard.ts entries/auth/basicAuthGuard.ts entries/auth/tokenAbilityChecker.ts entries/auth/membershipMiddleware.ts entries/auth/membershipScope.ts entries/auth/membershipService.ts entries/auth/oauth/oidcProvider.ts entries/auth/oauth/providers.ts entries/auth/oauth/samlProvider.ts entries/auth/oauth/types.ts entries/auth/saml/samlServiceProvider.ts entries/auth/password.ts entries/auth/passwordLogin.ts entries/auth/pendingMfaCookie.ts entries/auth/oneTimeToken.ts entries/auth/intendedUrlCookie.ts entries/auth/passwordConfirmCookie.ts entries/auth/policy.ts entries/auth/scimAuthMiddleware.ts entries/auth/sessionCookie.ts entries/auth/sessionGuard.ts entries/auth/tokenHash.ts entries/audit/exportAuditLogs.ts entries/audit/siemFormatter.ts entries/admin/formatValue.ts entries/admin/registry.ts entries/admin/types.ts entries/cache/tags.ts entries/cache/createCacheStore.ts entries/cache/repository.ts entries/cache/simpleCache.ts entries/cache/simpleCacheStore.ts entries/config/envSchema.ts entries/contracts/serviceTokens.ts entries/contracts/authUserDirectory.ts entries/contracts/container.ts entries/contracts/di.ts entries/crypto/fieldEncryption.ts entries/crypto/mfaSecret.ts entries/database/errors.ts entries/database/factory.ts entries/database/migrations.ts entries/database/migrations/types.ts entries/database/query.ts entries/database/relationships.ts entries/database/repositoryQuery.ts entries/database/seeders.ts entries/database/seeders/types.ts entries/database/schema.ts entries/database/sqliteConnection.ts entries/database/table.ts entries/database/types.ts entries/database/whereBuilder.ts entries/facades.ts entries/http/authMiddleware.ts entries/http/authorizeMiddleware.ts entries/http/bodySizeLimitMiddleware.ts entries/http/clientIp.ts entries/http/cookies.ts entries/http/contentNegotiation.ts entries/http/conditionalResponse.ts entries/http/corsMiddleware.ts entries/http/csrfMiddleware.ts entries/http/csrfProtection.ts entries/http/csrfToken.ts entries/http/etag.ts entries/http/flashSession.ts entries/http/flashMiddleware.ts entries/http/formRequest.ts entries/http/metricsMiddleware.ts entries/http/memoryThrottleMiddleware.ts entries/http/pagination.ts entries/http/parseFormBody.ts entries/http/parseMultipartUpload.ts entries/http/requireAbilityMiddleware.ts entries/http/requireAuthMiddleware.ts entries/http/requireGlobalAdminMiddleware.ts entries/http/requireWebAuthMiddleware.ts entries/http/requireVerifiedMiddleware.ts entries/http/requirePasswordConfirmMiddleware.ts entries/http/resources.ts entries/http/response.ts entries/http/route.ts entries/http/routeMiddleware.ts entries/http/routeModelBinding.ts entries/http/safeInternalPath.ts entries/http/signedUrl.ts entries/http/statelessAuth.ts entries/http/scimThrottleMiddleware.ts entries/http/securityHeadersMiddleware.ts entries/http/securedRouteModelBinding.ts entries/http/webFormRequest.ts entries/http/throttleMiddleware.ts entries/http/uploads.ts entries/http/validation.ts entries/jobs/exportAuditLogsJob.ts entries/jobs/invalidateCacheTagsJob.ts entries/logging/logger.ts entries/logging/requestLoggingMiddleware.ts entries/mail/mailer.ts entries/mail/markdownMail.ts entries/mail/markdownMailable.ts entries/mail/sanitizeMailHtml.ts entries/media/imageTransform.ts entries/metrics/prometheus.ts entries/openapi/generator.ts entries/openapi/registeredRoute.ts entries/openapi/validate.ts entries/pagination.ts entries/queue.ts entries/queue/createAppQueue.ts entries/queue/failedJobRepository.ts entries/queue/failedJobService.ts entries/queue/jobRunner.ts entries/queue/queueMetrics.ts entries/queue/publicQueue.ts entries/queue/redisQueue.ts entries/queue/types.ts entries/runtime/appEnv.ts entries/runtime/frontendMode.ts entries/runtime/asyncContextStore.ts entries/scheduler/osCron.ts entries/security/oauthState.ts entries/security/publicReads.ts entries/security/recoveryCodes.ts entries/security/safeFetch.ts entries/security/safePath.ts entries/security/scimTenantTokens.ts entries/security/stripeWebhook.ts entries/security/webhookSignature.ts entries/security/timingSafeCompare.ts entries/security/tokenExpiry.ts entries/security/totp.ts entries/storage/storage.ts entries/tenant/tenancyConfig.ts entries/tenant/tenantDatabaseScope.ts entries/tenant/databaseTenantContext.ts entries/tenant/enableTenantRls.ts entries/terminal/runShell.ts entries/tracing/tracingMiddleware.ts entries/validation/rules.ts --outdir dist --root . --target bun --external bun --external '@opentelemetry/*' --external eta --external mysql2 --external @node-saml/node-saml --external @xmldom/xmldom --external @getstrata/core --external @getstrata/core/auth/accountState --external @getstrata/core/auth/accountStateMigration --external @getstrata/core/auth/accessControl --external @getstrata/core/auth/abilityChecker --external @getstrata/core/auth/authContext --external @getstrata/core/auth/emailVerification --external @getstrata/core/auth/guard --external @getstrata/core/auth/jwt --external @getstrata/core/auth/jwtGuard --external @getstrata/core/auth/basicAuthGuard --external @getstrata/core/auth/tokenAbilityChecker --external @getstrata/core/auth/membershipContext --external @getstrata/core/auth/membershipMiddleware --external @getstrata/core/auth/membershipScope --external @getstrata/core/auth/membershipService --external @getstrata/core/auth/oauth/oidcProvider --external @getstrata/core/auth/oauth/providers --external @getstrata/core/auth/oauth/samlProvider --external @getstrata/core/auth/oauth/types --external @getstrata/core/auth/saml/samlServiceProvider --external @getstrata/core/auth/password --external @getstrata/core/auth/passwordLogin --external @getstrata/core/auth/pendingMfaCookie --external @getstrata/core/auth/oneTimeToken --external @getstrata/core/auth/intendedUrlCookie --external @getstrata/core/auth/passwordConfirmCookie --external @getstrata/core/auth/policy --external @getstrata/core/auth/scimAuthMiddleware --external @getstrata/core/auth/sessionCookie --external @getstrata/core/auth/sessionGuard --external @getstrata/core/auth/tokenHash --external @getstrata/core/audit/exportAuditLogs --external @getstrata/core/audit/siemFormatter --external @getstrata/core/admin/formatValue --external @getstrata/core/admin/registry --external @getstrata/core/admin/types --external @getstrata/core/cache/tags --external @getstrata/core/cache/createCacheStore --external @getstrata/core/cache/repository --external @getstrata/core/cache/simpleCache --external @getstrata/core/cache/simpleCacheStore --external @getstrata/core/config/envSchema --external @getstrata/core/contracts/serviceTokens --external @getstrata/core/contracts/authUserDirectory --external @getstrata/core/contracts/container --external @getstrata/core/contracts/di --external @getstrata/core/crypto/fieldEncryption --external @getstrata/core/crypto/fieldEncryptionRotation --external @getstrata/core/crypto/mfaSecret --external @getstrata/core/database --external @getstrata/core/database/baseRepository --external @getstrata/core/database/bindConnection --external @getstrata/core/database/boundConnection --external @getstrata/core/database/bunSql --external @getstrata/core/database/connection --external @getstrata/core/database/connectionContext --external @getstrata/core/database/defaultConnection --external @getstrata/core/database/dialect --external @getstrata/core/database/mysqlConnection --external @getstrata/core/database/namedConnections --external @getstrata/core/database/errors --external @getstrata/core/database/factory --external @getstrata/core/database/migrations --external @getstrata/core/database/migrations/types --external @getstrata/core/database/model --external @getstrata/core/database/query --external @getstrata/core/database/relationships --external @getstrata/core/database/repositoryConnection --external @getstrata/core/database/repositoryQuery --external @getstrata/core/database/seeders --external @getstrata/core/database/seeders/types --external @getstrata/core/database/schema --external @getstrata/core/database/sqliteConnection --external @getstrata/core/database/table --external @getstrata/core/database/transaction --external @getstrata/core/database/types --external @getstrata/core/database/whereBuilder --external @getstrata/core/errors/http --external @getstrata/core/events --external @getstrata/core/events/outbox --external @getstrata/core/facades --external @getstrata/core/http --external @getstrata/core/http/authMiddleware --external @getstrata/core/http/authorizeMiddleware --external @getstrata/core/http/bodySizeLimitMiddleware --external @getstrata/core/http/clientIp --external @getstrata/core/http/cookies --external @getstrata/core/http/contentNegotiation --external @getstrata/core/http/contentSecurityPolicy --external @getstrata/core/http/conditionalResponse --external @getstrata/core/http/corsMiddleware --external @getstrata/core/http/csrfMiddleware --external @getstrata/core/http/csrfProtection --external @getstrata/core/http/csrfToken --external @getstrata/core/http/etag --external @getstrata/core/http/flashSession --external @getstrata/core/http/flashMiddleware --external @getstrata/core/http/formRequest --external @getstrata/core/http/middleware --external @getstrata/core/http/metricsMiddleware --external @getstrata/core/http/loginThrottleMiddleware --external @getstrata/core/http/memoryThrottleMiddleware --external @getstrata/core/http/pagination --external @getstrata/core/http/parseFormBody --external @getstrata/core/http/parseMultipartUpload --external @getstrata/core/http/requireAbilityMiddleware --external @getstrata/core/http/requireAuthMiddleware --external @getstrata/core/http/requireGlobalAdminMiddleware --external @getstrata/core/http/requireWebAuthMiddleware --external @getstrata/core/http/requireVerifiedMiddleware --external @getstrata/core/http/requirePasswordConfirmMiddleware --external @getstrata/core/http/resources --external @getstrata/core/http/response --external @getstrata/core/http/route --external @getstrata/core/http/routeMiddleware --external @getstrata/core/http/routeModelBinding --external @getstrata/core/http/safeInternalPath --external @getstrata/core/http/signedUrl --external @getstrata/core/http/statelessAuth --external @getstrata/core/http/scimThrottleMiddleware --external @getstrata/core/http/securityHeadersMiddleware --external @getstrata/core/http/securedRouteModelBinding --external @getstrata/core/http/requestMetaContext --external @getstrata/core/http/webErrorResponse --external @getstrata/core/http/webFormRequest --external @getstrata/core/http/throttleMiddleware --external @getstrata/core/http/uploads --external @getstrata/core/http/validation --external @getstrata/core/jobs/exportAuditLogsJob --external @getstrata/core/jobs/invalidateCacheTagsJob --external @getstrata/core/lifecycle/gracefulShutdown --external @getstrata/core/logging/logger --external @getstrata/core/logging/requestLoggingMiddleware --external @getstrata/core/mail/mailer --external @getstrata/core/mail/markdownMail --external @getstrata/core/mail/markdownMailable --external @getstrata/core/mail/sanitizeMailHtml --external @getstrata/core/media/imageTransform --external @getstrata/core/metrics/prometheus --external @getstrata/core/notifications --external @getstrata/core/openapi/generator --external @getstrata/core/openapi/registeredRoute --external @getstrata/core/openapi/validate --external @getstrata/core/pagination --external @getstrata/core/queue --external @getstrata/core/queue/createAppQueue --external @getstrata/core/queue/failedJobRepository --external @getstrata/core/queue/failedJobService --external @getstrata/core/queue/jobRegistry --external @getstrata/core/queue/jobRunner --external @getstrata/core/queue/queueMetrics --external @getstrata/core/queue/publicQueue --external @getstrata/core/queue/redisQueue --external @getstrata/core/queue/types --external @getstrata/core/runtime/appEnv --external @getstrata/core/runtime/appKeyPrefix --external @getstrata/core/runtime/frontendMode --external @getstrata/core/runtime/applicationRegistry --external @getstrata/core/runtime/asyncContextStore --external @getstrata/core/scheduler/schedule --external @getstrata/core/scheduler/osCron --external @getstrata/core/security/oauthState --external @getstrata/core/security/publicReads --external @getstrata/core/security/recoveryCodes --external @getstrata/core/security/safeFetch --external @getstrata/core/security/safePath --external @getstrata/core/security/safeUrl --external @getstrata/core/security/scimTenantTokens --external @getstrata/core/security/securityEvents --external @getstrata/core/security/stripeWebhook --external @getstrata/core/security/webhookSignature --external @getstrata/core/security/timingSafeCompare --external @getstrata/core/security/tokenExpiry --external @getstrata/core/security/totp --external @getstrata/core/storage/storage --external @getstrata/core/tenant/tenancyConfig --external @getstrata/core/tenant/tenantContext --external @getstrata/core/tenant/tenantDatabaseScope --external @getstrata/core/tenant/databaseTenantContext --external @getstrata/core/tenant/tenantMiddleware --external @getstrata/core/tenant/enableTenantRls --external @getstrata/core/terminal/runShell --external @getstrata/core/tracing/traceContext --external @getstrata/core/tracing/tracingMiddleware --external @getstrata/core/validation/rules --external @getstrata/core/view",
     "build:shims": "bun ../../scripts/write-core-shared-shims.ts"
   },
   "publishConfig": {
@@ -992,6 +992,7 @@
     "@opentelemetry/resources": "2.12.0",
     "@opentelemetry/sdk-trace": "2.12.0",
     "@opentelemetry/sdk-trace-base": "2.12.0",
-    "@opentelemetry/sdk-trace-node": "2.12.0"
+    "@opentelemetry/sdk-trace-node": "2.12.0",
+    "@xmldom/xmldom": "^0.8.15"
   }
 }