@getstrata/core 2.2.37 → 2.2.39

package/dist/entries/auth/oauth/samlProvider.js

@@ -11,25 +11,6 @@ var __esm = (fn, res, err) => () => {
   return res;
 };
 
-// ../../src/core/database/boundConnection.ts
-function boundConnectionState() {
-  const globalRecord = globalThis;
-  const existing = globalRecord[BOUND_CONNECTION_KEY];
-  if (existing) {
-    return existing;
-  }
-  const created = { connection: null };
-  globalRecord[BOUND_CONNECTION_KEY] = created;
-  return created;
-}
-function getBoundDatabaseConnection() {
-  return boundConnectionState().connection;
-}
-var BOUND_CONNECTION_KEY;
-var init_boundConnection = __esm(() => {
-  BOUND_CONNECTION_KEY = Symbol.for("@getstrata/boundDatabaseConnection");
-});
-
 // ../../src/core/runtime/asyncContextStore.ts
 import { AsyncLocalStorage } from "async_hooks";
 function createAsyncContextStore(key) {
@@ -45,60 +26,6 @@ function createAsyncContextStore(key) {
 }
 var init_asyncContextStore = () => {};
 
-// ../../src/core/database/connectionContext.ts
-function runWithDatabaseConnection(connection, callback) {
-  return activeConnection.run(connection, callback);
-}
-function getActiveDatabaseConnection(fallback) {
-  return activeConnection.getStore() ?? fallback;
-}
-function hasActiveDatabaseConnection() {
-  return activeConnection.getStore() !== undefined;
-}
-var activeConnection;
-var init_connectionContext = __esm(() => {
-  init_asyncContextStore();
-  activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
-});
-
-// ../../src/core/database/queryProxy.ts
-var POOL_CONNECTION_METHODS;
-var init_queryProxy = __esm(() => {
-  init_connectionContext();
-  POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
-});
-
-// ../../src/core/database/defaultConnection.ts
-function defaultConnectionState() {
-  const globalRecord = globalThis;
-  const existing = globalRecord[DEFAULT_CONNECTION_KEY];
-  if (existing) {
-    return existing;
-  }
-  const created = { pool: null, query: null };
-  globalRecord[DEFAULT_CONNECTION_KEY] = created;
-  return created;
-}
-function getDefaultDatabasePool() {
-  const pool = defaultConnectionState().pool;
-  if (!pool) {
-    throw new Error("Default database pool is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
-  }
-  return pool;
-}
-function getDefaultDatabaseQuery() {
-  const query = defaultConnectionState().query;
-  if (!query) {
-    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
-  }
-  return query;
-}
-var DEFAULT_CONNECTION_KEY;
-var init_defaultConnection = __esm(() => {
-  init_queryProxy();
-  DEFAULT_CONNECTION_KEY = Symbol.for("@getstrata/defaultDatabaseConnection");
-});
-
 // ../../src/core/database/schema/driver.ts
 function normalizeConnectionName(connection) {
   const normalized = connection.trim().toLowerCase();
@@ -300,6 +227,685 @@ var init_dialect = __esm(() => {
   dialectContext = createAsyncContextStore("@getstrata/sqlDialect");
 });
 
+// ../../src/core/tenant/tenantContext.ts
+function runWithTenant(tenant, callback) {
+  return tenantContext.run(tenant, callback);
+}
+function currentTenant() {
+  return tenantContext.getStore() ?? null;
+}
+var tenantContext;
+var init_tenantContext = __esm(() => {
+  init_asyncContextStore();
+  tenantContext = createAsyncContextStore("@getstrata/tenantContext");
+});
+
+// ../../src/core/events/eventBus.ts
+class EventBus {
+  constructor() {}
+  transactionalListeners = new Map;
+  listenTransactional(event, listener) {
+    const handlers = this.transactionalListeners.get(event) ?? new Set;
+    handlers.add(listener);
+    this.transactionalListeners.set(event, handlers);
+    return () => {
+      handlers.delete(listener);
+      if (!handlers.size)
+        this.transactionalListeners.delete(event);
+    };
+  }
+  hasTransactionalListeners(event) {
+    return (this.transactionalListeners.get(event)?.size ?? 0) > 0;
+  }
+  async dispatchTransactional(event, payload) {
+    for (const listener of this.transactionalListeners.get(event) ?? [])
+      await listener(payload);
+  }
+  listeners = new Map;
+  on(event, listener) {
+    return this.listen(event, listener);
+  }
+  listen(event, listener) {
+    const handlers = this.listeners.get(event) ?? new Set;
+    handlers.add(listener);
+    this.listeners.set(event, handlers);
+    return () => {
+      handlers.delete(listener);
+      if (handlers.size === 0) {
+        this.listeners.delete(event);
+      }
+    };
+  }
+  async emit(event, payload) {
+    await this.dispatch(event, payload);
+  }
+  async dispatch(event, payload) {
+    const handlers = this.listeners.get(event);
+    if (!handlers || handlers.size === 0) {
+      return;
+    }
+    for (const handler of handlers) {
+      await handler(payload);
+    }
+  }
+}
+function readSharedEventBus() {
+  const globalBus = globalThis[EVENT_BUS_KEY];
+  if (globalBus) {
+    return globalBus;
+  }
+  const bus = new EventBus;
+  globalThis[EVENT_BUS_KEY] = bus;
+  return bus;
+}
+var EVENT_BUS_KEY, eventBus;
+var init_eventBus = __esm(() => {
+  EVENT_BUS_KEY = Symbol.for("@getstrata/eventBus");
+  eventBus = readSharedEventBus();
+});
+
+// ../../src/core/database/connectionContext.ts
+function runWithDatabaseConnection(connection, callback) {
+  return activeConnection.run(connection, callback);
+}
+function getActiveDatabaseConnection(fallback) {
+  return activeConnection.getStore() ?? fallback;
+}
+function hasActiveDatabaseConnection() {
+  return activeConnection.getStore() !== undefined;
+}
+var activeConnection;
+var init_connectionContext = __esm(() => {
+  init_asyncContextStore();
+  activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
+});
+
+// ../../src/core/database/transactionControl.ts
+function unwrapTransactionRollback(error, depth = 0) {
+  if (error instanceof TransactionRollback) {
+    return error;
+  }
+  if (depth >= 5 || !(error instanceof Error) || error.cause === undefined) {
+    return null;
+  }
+  return unwrapTransactionRollback(error.cause, depth + 1);
+}
+function hasActiveTransaction() {
+  return hasActiveDatabaseConnection() && (transactionScopes.getStore()?.rollback.length ?? 0) > 0;
+}
+function requestTransactionRollback() {
+  const state = transactionScopes.getStore();
+  const index = state ? state.rollback.length - 1 : -1;
+  if (!state || index < 0) {
+    return;
+  }
+  const flags = state.rollback;
+  const current = flags[index];
+  if (current === undefined) {
+    return;
+  }
+  flags[index] = true;
+}
+function scopeRequestsRollback() {
+  const state = transactionScopes.getStore();
+  if (!state || state.rollback.length === 0) {
+    return false;
+  }
+  return state.rollback[state.rollback.length - 1] === true;
+}
+async function commitOrRollbackScope(result) {
+  if (scopeRequestsRollback()) {
+    throw new TransactionRollback(result);
+  }
+  return result;
+}
+async function settleTransaction(work) {
+  try {
+    return await work();
+  } catch (error) {
+    const rollback = unwrapTransactionRollback(error);
+    if (rollback) {
+      return rollback.result;
+    }
+    throw error;
+  }
+}
+async function runWithTransactionScope(callback) {
+  const existing = transactionScopes.getStore();
+  if (existing) {
+    existing.rollback.push(false);
+    try {
+      return await callback();
+    } finally {
+      existing.rollback.pop();
+    }
+  }
+  const state = { rollback: [false] };
+  return await transactionScopes.run(state, callback);
+}
+var TransactionRollback, transactionScopes;
+var init_transactionControl = __esm(() => {
+  init_asyncContextStore();
+  init_connectionContext();
+  TransactionRollback = class TransactionRollback extends Error {
+    result;
+    constructor(result) {
+      super("Transaction rolled back");
+      this.name = "TransactionRollback";
+      this.result = result;
+    }
+  };
+  transactionScopes = createAsyncContextStore("@getstrata/transactionScopes");
+});
+
+// ../../src/core/tenant/tenancyConfig.ts
+function readTenancyDriver(env = process.env) {
+  const raw = env.TENANCY_DRIVER?.trim();
+  if (raw === undefined || raw === "") {
+    return "rls";
+  }
+  if (TENANCY_DRIVERS.includes(raw)) {
+    return raw;
+  }
+  throw new Error(`TENANCY_DRIVER must be one of ${TENANCY_DRIVERS.join(", ")}; received "${raw}".`);
+}
+function isTenancyEnabled(env = process.env) {
+  return readTenancyDriver(env) !== "none";
+}
+function isRlsTenancy(env = process.env) {
+  return readTenancyDriver(env) === "rls";
+}
+var TENANCY_DRIVERS;
+var init_tenancyConfig = __esm(() => {
+  TENANCY_DRIVERS = ["rls", "column", "none"];
+});
+
+// ../../src/core/tenant/databaseTenantContext.ts
+import { getDefaultDatabasePool } from "@getstrata/core/database/defaultConnection";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+async function applyBypassToTransaction(transaction, bypass) {
+  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, [
+    bypass ? "true" : "false"
+  ]);
+}
+function stringifyBypassIdentifier(identifier) {
+  if (typeof identifier === "number") {
+    return String(identifier);
+  }
+  return identifier.trim();
+}
+async function applyIdentifierToTransaction(transaction, identifier) {
+  await transaction.unsafe(`SELECT set_config('app.bypass_identifier', $1, true)`, [
+    stringifyBypassIdentifier(identifier)
+  ]);
+}
+function assertBypassIdentifier(identifier) {
+  if (typeof identifier === "number") {
+    if (!Number.isInteger(identifier) || identifier <= 0) {
+      throw new Error("RLS bypass requires a caller-supplied identifier that pins the row.");
+    }
+    return;
+  }
+  if (typeof identifier === "string" && identifier.trim() !== "") {
+    return;
+  }
+  throw new Error("RLS bypass requires a caller-supplied identifier that pins the row.");
+}
+async function runWithScopedTenantTransaction(apply, callback) {
+  if (!isRlsTenancy()) {
+    return await callback();
+  }
+  if (hasActiveDatabaseConnection()) {
+    const connection = getActiveDatabaseConnection(getDefaultDatabasePool());
+    return await runInTransaction(async () => {
+      const [previous] = await connection.unsafe(`SELECT current_setting('app.tenant_id', true) AS tenant_id,
+        current_setting('app.bypass_rls', true) AS bypass_rls,
+        current_setting('app.bypass_identifier', true) AS bypass_identifier`);
+      await apply(connection);
+      const result = await callback();
+      await connection.unsafe(`SELECT set_config('app.tenant_id', $1, true),
+        set_config('app.bypass_rls', $2, true), set_config('app.bypass_identifier', $3, true)`, [previous?.tenant_id ?? "", previous?.bypass_rls ?? "", previous?.bypass_identifier ?? ""]);
+      return result;
+    });
+  }
+  const pool = getDefaultDatabasePool();
+  const begin = pool.begin;
+  if (typeof begin !== "function") {
+    throw new Error("RLS migration bypass requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
+  }
+  return await settleTransaction(() => runWithDeferredModelEvents(async () => {
+    return await begin.bind(pool)(AsyncLocalStorage2.bind(async (transaction) => {
+      await apply(transaction);
+      return await runWithDatabaseConnection(transaction, () => runWithTransactionScope(async () => commitOrRollbackScope(await callback())));
+    }));
+  }));
+}
+async function runWithMigrationBypass(callback) {
+  return await runWithScopedTenantTransaction((transaction) => applyBypassToTransaction(transaction, true), callback);
+}
+async function runWithMigrationBypassForIdentifier(identifier, callback) {
+  assertBypassIdentifier(identifier);
+  return await runWithScopedTenantTransaction((transaction) => applyIdentifierToTransaction(transaction, identifier), callback);
+}
+var init_databaseTenantContext = __esm(() => {
+  init_connectionContext();
+  init_transaction();
+  init_transactionControl();
+  init_deferredModelEvents();
+  init_tenancyConfig();
+});
+
+// ../../src/core/tenant/tenantDatabaseScope.ts
+import { getDefaultDatabasePool as getDefaultDatabasePool2 } from "@getstrata/core/database/defaultConnection";
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
+async function applyTenantContextToTransaction(transaction, tenantId) {
+  await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
+  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
+}
+async function runWithTenantDatabase(tenant, callback) {
+  const outerTenant = currentTenant();
+  if (hasActiveDatabaseConnection() && outerTenant && outerTenant.id !== tenant.id) {
+    throw new Error("Cannot switch tenants inside an active database transaction.");
+  }
+  if (!isTenancyEnabled() || !isRlsTenancy()) {
+    return await runWithTenant(tenant, callback);
+  }
+  if (hasActiveDatabaseConnection()) {
+    const activeConnection = getActiveDatabaseConnection(getDefaultDatabasePool2());
+    return await runWithScopedTenantTransaction(() => applyTenantContextToTransaction(activeConnection, tenant.id), () => runWithTenant(tenant, callback));
+  }
+  const pool = getDefaultDatabasePool2();
+  const begin = pool.begin;
+  if (typeof begin !== "function") {
+    throw new Error("RLS tenant scope requires a pool that supports begin(). Session-scoped set_config is not used on pooled connections.");
+  }
+  return await settleTransaction(() => runWithDeferredModelEvents(async () => {
+    return await begin.bind(pool)(AsyncLocalStorage3.bind(async (transaction) => {
+      await applyTenantContextToTransaction(transaction, tenant.id);
+      return await runWithDatabaseConnection(transaction, async () => {
+        return await runWithTransactionScope(async () => commitOrRollbackScope(await runWithTenant(tenant, callback)));
+      });
+    }));
+  }));
+}
+function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {
+  return hasActiveDatabaseConnection() && currentTenant()?.id === tenantId;
+}
+var init_tenantDatabaseScope = __esm(() => {
+  init_connectionContext();
+  init_transactionControl();
+  init_deferredModelEvents();
+  init_databaseTenantContext();
+  init_tenancyConfig();
+  init_tenantContext();
+});
+
+// ../../src/core/events/deferredModelEvents.ts
+function sameTenant(left, right) {
+  if (left === null && right === null) {
+    return true;
+  }
+  if (left === null || right === null) {
+    return false;
+  }
+  return left.id === right.id;
+}
+function groupQueuedModelEvents(queued) {
+  const groups = [];
+  for (const item of queued) {
+    const lastGroup = groups[groups.length - 1];
+    const last = lastGroup?.[lastGroup.length - 1];
+    if (!lastGroup || !last || !sameTenant(last.tenant, item.tenant)) {
+      groups.push([item]);
+    } else {
+      lastGroup.push(item);
+    }
+  }
+  return groups;
+}
+async function dispatchEventBatch(batch) {
+  for (const item of batch) {
+    await eventBus.dispatch(item.event, item.payload);
+  }
+}
+async function dispatchQueuedModelEvents(queued) {
+  if (queued.length === 0) {
+    return;
+  }
+  await Promise.resolve().then(() => init_tenantDatabaseScope());
+  for (const batch of groupQueuedModelEvents(queued)) {
+    const tenant = batch[0]?.tenant ?? null;
+    if (tenant) {
+      await runWithTenantDatabase(tenant, () => dispatchEventBatch(batch));
+    } else {
+      await dispatchEventBatch(batch);
+    }
+  }
+}
+async function dispatchModelEvent(event, payload) {
+  await eventBus.dispatchTransactional(event, payload);
+  const state = deferredModelEvents.getStore();
+  const frame = state?.frames[state.frames.length - 1];
+  if (frame) {
+    frame.push({
+      event,
+      payload,
+      tenant: currentTenant()
+    });
+    return;
+  }
+  await eventBus.dispatch(event, payload);
+}
+async function runWithDeferredModelEvents(callback) {
+  const existing = deferredModelEvents.getStore();
+  if (existing) {
+    existing.frames.push([]);
+    existing.rollbackFrames.push([]);
+    try {
+      const result = await callback();
+      const nested = existing.frames.pop() ?? [];
+      const rollback = existing.rollbackFrames.pop() ?? [];
+      existing.rollbackFrames.at(-1)?.push(...rollback);
+      const parent = existing.frames[existing.frames.length - 1];
+      if (parent) {
+        parent.push(...nested);
+      }
+      return result;
+    } catch (error) {
+      existing.frames.pop();
+      for (const rollback of (existing.rollbackFrames.pop() ?? []).reverse())
+        rollback();
+      throw error;
+    }
+  }
+  const state = { frames: [[]], rollbackFrames: [[]] };
+  let result;
+  try {
+    result = await deferredModelEvents.run(state, callback);
+  } catch (error) {
+    for (const rollback of (state.rollbackFrames[0] ?? []).reverse())
+      rollback();
+    throw error;
+  }
+  await dispatchQueuedModelEvents(state.frames[0] ?? []);
+  return result;
+}
+var deferredModelEvents;
+var init_deferredModelEvents = __esm(() => {
+  init_asyncContextStore();
+  init_tenantContext();
+  init_eventBus();
+  deferredModelEvents = createAsyncContextStore("@getstrata/deferredModelEvents");
+});
+
+// ../../src/core/database/acquisitionMetrics.ts
+async function observeTransactionAcquisition(metrics, acquire, signal) {
+  const state = states.get(metrics);
+  if (!state)
+    throw new TypeError("Transaction acquisition metrics must be created by the framework factory.");
+  const started = performance.now();
+  state.inflight++;
+  let outcome = "acquired";
+  try {
+    return await acquire();
+  } catch (error) {
+    outcome = signal?.aborted ? "aborted" : "failed";
+    throw error;
+  } finally {
+    state.inflight--;
+    const elapsed = Math.max(0, performance.now() - started) / 1000;
+    const histogram = state.outcomes[outcomes.indexOf(outcome)];
+    if (histogram) {
+      histogram.count++;
+      histogram.sumSeconds += elapsed;
+      for (let index = 0;index < ACQUISITION_BUCKETS_SECONDS.length; index++) {
+        const bound = ACQUISITION_BUCKETS_SECONDS[index];
+        if (bound !== undefined && elapsed <= bound)
+          histogram.buckets[index] = (histogram.buckets[index] ?? 0) + 1;
+      }
+    }
+  }
+}
+var ACQUISITION_BUCKETS_SECONDS, outcomes, metricsBrand, states;
+var init_acquisitionMetrics = __esm(() => {
+  ACQUISITION_BUCKETS_SECONDS = [
+    0.001,
+    0.005,
+    0.01,
+    0.025,
+    0.05,
+    0.1,
+    0.25,
+    0.5,
+    1,
+    2.5,
+    5,
+    10
+  ];
+  outcomes = ["acquired", "failed", "aborted"];
+  metricsBrand = Symbol("transaction acquisition metrics");
+  states = new WeakMap;
+});
+
+// ../../src/core/database/connection.ts
+function createDatabaseConnection(source) {
+  return {
+    async unsafe(query, params = []) {
+      return await source.unsafe(query, params);
+    }
+  };
+}
+var init_connection = () => {};
+
+// ../../src/core/database/boundConnection.ts
+function boundConnectionState() {
+  const globalRecord = globalThis;
+  const existing = globalRecord[BOUND_CONNECTION_KEY];
+  if (existing) {
+    return existing;
+  }
+  const created = { connection: null };
+  globalRecord[BOUND_CONNECTION_KEY] = created;
+  return created;
+}
+function getBoundDatabaseConnection() {
+  return boundConnectionState().connection;
+}
+var BOUND_CONNECTION_KEY;
+var init_boundConnection = __esm(() => {
+  BOUND_CONNECTION_KEY = Symbol.for("@getstrata/boundDatabaseConnection");
+});
+
+// ../../src/core/database/queryProxy.ts
+var POOL_CONNECTION_METHODS;
+var init_queryProxy = __esm(() => {
+  init_connectionContext();
+  POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+});
+
+// ../../src/core/database/defaultConnection.ts
+function defaultConnectionState() {
+  const globalRecord = globalThis;
+  const existing = globalRecord[DEFAULT_CONNECTION_KEY];
+  if (existing) {
+    return existing;
+  }
+  const created = { pool: null, query: null };
+  globalRecord[DEFAULT_CONNECTION_KEY] = created;
+  return created;
+}
+function getDefaultDatabasePool3() {
+  const pool = defaultConnectionState().pool;
+  if (!pool) {
+    throw new Error("Default database pool is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
+  }
+  return pool;
+}
+function getDefaultDatabaseQuery() {
+  const query = defaultConnectionState().query;
+  if (!query) {
+    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
+  }
+  return query;
+}
+var DEFAULT_CONNECTION_KEY;
+var init_defaultConnection = __esm(() => {
+  init_queryProxy();
+  DEFAULT_CONNECTION_KEY = Symbol.for("@getstrata/defaultDatabaseConnection");
+});
+
+// ../../src/core/database/repositoryConnection.ts
+function resolveRepositoryConnection() {
+  return getActiveDatabaseConnection(getBoundDatabaseConnection() ?? getDefaultDatabaseQuery());
+}
+function compileTaggedSql(strings, values) {
+  const dialect = currentSqlDialect();
+  let query = strings[0] ?? "";
+  const params = [];
+  for (let index = 0;index < values.length; index += 1) {
+    params.push(values[index]);
+    query += `${dialect.placeholder(params.length)}${strings[index + 1] ?? ""}`;
+  }
+  return { query, params };
+}
+function isTaggedStrings(value) {
+  if (!Array.isArray(value) || typeof value[0] !== "string") {
+    return false;
+  }
+  return typeof value.raw !== "undefined";
+}
+function runOnConnection(connection, args) {
+  if (typeof connection === "function") {
+    return connection(...args);
+  }
+  if (typeof connection.unsafe !== "function") {
+    throw new Error("Database connection cannot run SQL.");
+  }
+  const strings = args[0];
+  if (!isTaggedStrings(strings)) {
+    throw new Error("Database connection cannot run tagged SQL.");
+  }
+  const compiled = compileTaggedSql(strings, args.slice(1));
+  return connection.unsafe(compiled.query, compiled.params);
+}
+var repositoryConnection;
+var init_repositoryConnection = __esm(() => {
+  init_boundConnection();
+  init_connectionContext();
+  init_defaultConnection();
+  init_dialect();
+  repositoryConnection = new Proxy(function repositoryConnection() {}, {
+    apply(_target, _thisArg, args) {
+      return runOnConnection(resolveRepositoryConnection(), args);
+    },
+    get(_target, property) {
+      const connection = resolveRepositoryConnection();
+      const value = connection[property];
+      return typeof value === "function" ? value.bind(connection) : value;
+    }
+  });
+});
+
+// ../../src/core/database/transaction.ts
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
+function scopedConnection(source) {
+  const connection = createDatabaseConnection(source);
+  transactionAliases.set(connection, source);
+  return connection;
+}
+function isActiveTransactionConnection(connection) {
+  if (!hasActiveTransaction() || !hasActiveDatabaseConnection())
+    return false;
+  const active = getActiveDatabaseConnection(connection);
+  return connection === active || transactionAliases.get(connection) === active;
+}
+async function runInSavepoint(connection, operation) {
+  const inherited = transactionFrame.getStore();
+  let parent = inherited?.connection === connection ? inherited : outerFrames.get(connection);
+  if (!parent) {
+    parent = { connection, childActive: false };
+    outerFrames.set(connection, parent);
+  }
+  if (parent.childActive) {
+    throw new Error("Concurrent nested transactions on one connection are not supported. Await each transaction before starting the next.");
+  }
+  parent.childActive = true;
+  const name = `strata_${crypto.randomUUID().replaceAll("-", "")}`;
+  try {
+    return await settleTransaction(() => runWithDeferredModelEvents(async () => {
+      await connection.unsafe(`SAVEPOINT ${name}`);
+      try {
+        const result = await transactionFrame.run({ connection, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await operation(scopedConnection(connection)))));
+        await connection.unsafe(`RELEASE SAVEPOINT ${name}`);
+        return result;
+      } catch (error) {
+        await connection.unsafe(`ROLLBACK TO SAVEPOINT ${name}`);
+        await connection.unsafe(`RELEASE SAVEPOINT ${name}`);
+        throw error;
+      }
+    }));
+  } finally {
+    parent.childActive = false;
+  }
+}
+function supportsTransactions(connection) {
+  return typeof connection.begin === "function";
+}
+async function runInTransaction(operation, options = {}) {
+  const signal = options.acquisitionSignal;
+  signal?.throwIfAborted();
+  const admittedOperation = (connection) => {
+    signal?.throwIfAborted();
+    return operation(connection);
+  };
+  const pool = options.connection ?? resolveRepositoryConnection();
+  if (hasActiveDatabaseConnection()) {
+    const active = getActiveDatabaseConnection(pool);
+    if (options.connection && options.connection !== active && options.connection !== transactionRoots.get(active) && transactionAliases.get(options.connection) !== active)
+      throw new Error("Cannot switch database connections within an active transaction.");
+    return await runInSavepoint(active, admittedOperation);
+  }
+  if (!supportsTransactions(pool)) {
+    throw new Error("Active database connection does not support transactions. Bind a client with begin() via bindDatabaseConnection.");
+  }
+  return await settleTransaction(() => runWithDeferredModelEvents(async () => {
+    let reserved;
+    if (signal || options.acquisitionMetrics) {
+      if (!pool.reserve)
+        throw new Error(signal ? "Active database connection does not support cancellable transaction acquisition." : "Active database connection does not support observable transaction acquisition.");
+      const reserve = pool.reserve.bind(pool);
+      reserved = options.acquisitionMetrics ? await observeTransactionAcquisition(options.acquisitionMetrics, () => reserve({ signal }), signal) : await reserve({ signal });
+    }
+    const connection = reserved ?? pool;
+    try {
+      signal?.throwIfAborted();
+      if (!supportsTransactions(connection))
+        throw new Error("Reserved database connection does not support transactions.");
+      return await connection.begin(AsyncLocalStorage4.bind(async (transaction) => {
+        transactionRoots.set(transaction, pool);
+        return await runWithDatabaseConnection(transaction, () => transactionFrame.run({ connection: transaction, childActive: false }, () => runWithTransactionScope(async () => commitOrRollbackScope(await admittedOperation(scopedConnection(transaction))))));
+      }));
+    } finally {
+      await reserved?.release();
+    }
+  }));
+}
+var transactionFrame, outerFrames, transactionRoots, transactionAliases;
+var init_transaction = __esm(() => {
+  init_deferredModelEvents();
+  init_asyncContextStore();
+  init_acquisitionMetrics();
+  init_connection();
+  init_connectionContext();
+  init_repositoryConnection();
+  init_transactionControl();
+  init_acquisitionMetrics();
+  transactionFrame = createAsyncContextStore("@getstrata/transactionFrame");
+  outerFrames = new WeakMap;
+  transactionRoots = new WeakMap;
+  transactionAliases = new WeakMap;
+});
+
 // ../../src/core/runtime/optionalPeer.ts
 function missingOptionalPeer(packageName, reason, error) {
   return new Error(`Install ${packageName} ${reason} (\`bun add ${packageName}\`).`, {
@@ -319,8 +925,6 @@ function timingSafeCompareString(left, right) {
 }
 
 // ../../src/core/auth/saml/samlAssertionReplay.ts
-init_boundConnection();
-init_defaultConnection();
 init_dialect();
 
 // ../../src/core/database/errors.ts
@@ -443,6 +1047,7 @@ function isUniqueConstraintError(error) {
 }
 
 // ../../src/core/auth/saml/samlAssertionReplay.ts
+init_transaction();
 var REPLAY_RETENTION_MS = 60 * 60 * 1000;
 
 class InMemorySamlAssertionReplayStore {
@@ -470,17 +1075,18 @@ class InMemorySamlAssertionReplayStore {
 
 class SqlSamlAssertionReplayStore {
   async consume(assertionId) {
-    const sql = getBoundDatabaseConnection() ?? getDefaultDatabasePool();
     const dialect = currentSqlDialect();
     try {
-      await sql.unsafe(`INSERT INTO auth_saml_assertions (assertion_id, consumed_at) VALUES (${dialect.placeholder(1)}, ${dialect.placeholder(2)})`, [assertionId, new Date().toISOString()]);
+      await runInTransaction(async (connection) => {
+        await connection.unsafe(`INSERT INTO auth_saml_assertions (assertion_id, consumed_at) VALUES (${dialect.placeholder(1)}, ${dialect.placeholder(2)})`, [assertionId, dialect.timestampValue(new Date)]);
+        await connection.unsafe(`DELETE FROM auth_saml_assertions WHERE consumed_at < ${dialect.placeholder(1)}`, [dialect.timestampValue(new Date(Date.now() - REPLAY_RETENTION_MS))]);
+      });
     } catch (error) {
       if (isUniqueConstraintError(error)) {
         throw new Error("SAML assertion replay detected.");
       }
       throw error;
     }
-    await sql.unsafe(`DELETE FROM auth_saml_assertions WHERE consumed_at < ${dialect.placeholder(1)}`, [new Date(Date.now() - REPLAY_RETENTION_MS).toISOString()]);
   }
 }
 var sqlReplayStore = new SqlSamlAssertionReplayStore;
@@ -503,6 +1109,7 @@ async function consumeSamlAssertion(assertionId) {
 }
 
 // ../../src/core/auth/saml/samlServiceProvider.ts
+var CLOCK_SKEW_MS = 5000;
 function readAssertionId(profile) {
   if (typeof profile.ID === "string" && profile.ID.trim()) {
     return profile.ID.trim();
@@ -511,6 +1118,43 @@ function readAssertionId(profile) {
   const assertionId = parsed?.Assertion?.$?.ID;
   return typeof assertionId === "string" ? assertionId.trim() : "";
 }
+function assertBearerRecipient(profile, acsUrl) {
+  const subjects = profile.getAssertion?.()?.Assertion?.Subject;
+  const confirmations = Array.isArray(subjects) && subjects.length === 1 ? subjects[0]?.SubjectConfirmation : undefined;
+  const now = Date.now();
+  const matches = Array.isArray(confirmations) && confirmations.some((confirmation) => {
+    if (confirmation?.$?.Method !== "urn:oasis:names:tc:SAML:2.0:cm:bearer")
+      return false;
+    const data = confirmation.SubjectConfirmationData;
+    if (!Array.isArray(data) || data.length !== 1)
+      return false;
+    const attributes = data[0]?.$;
+    if (attributes?.Recipient !== acsUrl || attributes.NotBefore !== undefined)
+      return false;
+    if (typeof attributes.NotOnOrAfter !== "string")
+      return false;
+    const expires = Date.parse(attributes.NotOnOrAfter);
+    return Number.isFinite(expires) && now < expires + CLOCK_SKEW_MS;
+  });
+  if (!matches)
+    throw new Error("SAML assertion bearer recipient is invalid.");
+}
+async function assertResponseDestination(profile, acsUrl) {
+  const xml = profile.getSamlResponseXml?.();
+  const invalid = () => new Error("SAML response destination is invalid.");
+  if (typeof xml !== "string" || !xml.trim())
+    throw invalid();
+  const parserModule = "@xmldom/xmldom";
+  const { DOMParser } = await import(parserModule);
+  const document = new DOMParser({
+    errorHandler: () => {
+      throw invalid();
+    }
+  }).parseFromString(xml, "application/xml");
+  const response = document.documentElement;
+  if (document.doctype || response?.localName !== "Response" || response.namespaceURI !== "urn:oasis:names:tc:SAML:2.0:protocol" || response.getAttribute("Destination") !== acsUrl)
+    throw invalid();
+}
 function requireSamlOption(value, name) {
   const trimmed = value?.trim() ?? "";
   if (!trimmed) {
@@ -575,7 +1219,7 @@ class SamlServiceProvider {
       idpCert: this.options.idpCert,
       audience: this.options.spEntityId,
       idpIssuer: this.options.idpIssuer,
-      acceptedClockSkewMs: 5000,
+      acceptedClockSkewMs: CLOCK_SKEW_MS,
       wantAssertionsSigned: this.options.wantAssertionsSigned ?? true,
       wantAuthnResponseSigned: this.options.wantAuthnResponseSigned ?? true,
       disableRequestedAuthnContext: this.options.disableRequestedAuthnContext ?? false
@@ -606,6 +1250,8 @@ class SamlServiceProvider {
     if (!assertionId) {
       throw new Error("SAML assertion did not include an ID.");
     }
+    assertBearerRecipient(profile, this.options.acsUrl);
+    await assertResponseDestination(profile, this.options.acsUrl);
     await consumeSamlAssertion(assertionId);
     const email = profile.email || (typeof profile["urn:oid:0.9.2342.19200300.100.1.3"] === "string" ? profile["urn:oid:0.9.2342.19200300.100.1.3"] : "") || "";
     if (!email) {