bazis 0.98.27 → 0.98.29

package/cli/build.ts

@@ -10,6 +10,13 @@ export interface BuildOptions {
   readonly bin: boolean;
   /** Executable path relative to the project; default `bin/<package name>`. */
   readonly outfile?: string;
+  /** Let the executable read `.env` files from its working directory (off by default). */
+  readonly dotenv?: boolean;
+}
+
+export interface CompileOptions {
+  /** Let the executable read `.env`, `.env.local`, `.env.<NODE_ENV>` from its working directory. */
+  readonly dotenv?: boolean;
 }
 
 /**
@@ -103,7 +110,7 @@ export async function runBuild(cwd: string, options: BuildOptions, codegen: Code
   if (typecheck !== 0 || !options.bin) return typecheck;
   const outfile = path.resolve(cwd, options.outfile ?? path.join("bin", await binaryName(cwd)));
   log(`[bazis] compile ${path.relative(cwd, outfile)}...`);
-  return compileBinary(bun, await projectEntry(cwd), outfile);
+  return compileBinary(bun, await projectEntry(cwd), outfile, { dotenv: options.dotenv });
 }
 
 /**
@@ -111,11 +118,18 @@ export async function runBuild(cwd: string, options: BuildOptions, codegen: Code
  * `.<hash>.bun-build` file in its working directory and cannot remove it when
  * that executable is read-only or carries `uchg` (scripts/bazis-bun). Compile
  * from a private directory and remove it afterwards.
+ *
+ * By default a Bun executable reads `bunfig.toml` and `.env` files from the
+ * directory it is started in: a `preload` in such a bunfig runs foreign code
+ * inside the application, and a stray `.env` silently changes its settings.
+ * The executable gets its settings from the real environment instead;
+ * `dotenv: true` restores reading `.env`. A bunfig is never read.
  */
-export function compileBinary(bun: string, entry: string, outfile: string): number {
+export function compileBinary(bun: string, entry: string, outfile: string, options: CompileOptions = {}): number {
   const workDir = mkdtempSync(path.join(tmpdir(), "bazis-compile-"));
+  const autoload = ["--no-compile-autoload-bunfig", options.dotenv === true ? "--compile-autoload-dotenv" : "--no-compile-autoload-dotenv"];
   try {
-    const result = Bun.spawnSync([bun, "build", "--compile", path.resolve(entry), "--outfile", path.resolve(outfile)],
+    const result = Bun.spawnSync([bun, "build", "--compile", ...autoload, path.resolve(entry), "--outfile", path.resolve(outfile)],
       { cwd: workDir, stdout: "inherit", stderr: "inherit" });
     return result.exitCode ?? 1;
   } finally {

package/cli/generateProject.ts

@@ -164,7 +164,8 @@ function buildProjectFiles(name: string, dependency: string, frameworkMode: Fram
     ["package.json", `${JSON.stringify(manifest, null, 2)}\n`],
     ["tsconfig.json", `${JSON.stringify(tsconfig, null, 2)}\n`],
     ["bazis.config.json", `${JSON.stringify(codegen, null, 2)}\n`],
-    [".gitignore", "node_modules/\nbin/\nsrc/generated/\n.env\n"],
+    // Bun reads .env, .env.local and .env.<NODE_ENV>: none of them belongs in git.
+    [".gitignore", "node_modules/\nbin/\nsrc/generated/\n.env\n.env.*\n!.env.example\n"],
     [".env.example", "# Copy to .env (Bun loads it automatically).\nBAZIS_ENV=development\nHOST=127.0.0.1\nPORT=3000\n"],
     ["src/app/test/health.test.ts", HEALTH_TEST],
     ["AGENTS.md", "# Working on this bazis project\n\nBefore changing the application, read the [module architecture](docs/architecture/MODULE_ARCHITECTURE.md). Create new modules only with `bunx bazis g module` or `bunx bazis g pack`; fill in the generated `MODULE.md` afterwards. Only codegen updates `src/generated/`.\n"],

package/cli/main.ts

@@ -16,6 +16,7 @@ export const USAGE = `Usage:
   bazis test [<bun test args>]                Codegen, then bun test
   bazis build                                 Codegen and typecheck
   bazis build --bin [--outfile <path>]        Also compile a standalone executable (default bin/<name>)
+  bazis build --bin --dotenv                  The executable also reads .env files from its working directory
   bazis --help
   g can also be written as generate.
 
@@ -85,7 +86,7 @@ export async function runCli(argv: readonly string[], runtime: CliRuntime = defa
     if (parsed.kind === "codegen") return await runtime.codegen(process.cwd(), parsed.target);
     if (parsed.kind === "dev") return await runDev(process.cwd(), runtime.codegen, runtime.log, { watch: parsed.watch });
     if (parsed.kind === "test") return await runTest(process.cwd(), parsed.args, runtime.codegen);
-    if (parsed.kind === "build") return await runBuild(process.cwd(), { bin: parsed.bin, outfile: parsed.outfile }, runtime.codegen, runtime.log);
+    if (parsed.kind === "build") return await runBuild(process.cwd(), { bin: parsed.bin, outfile: parsed.outfile, dotenv: parsed.dotenv }, runtime.codegen, runtime.log);
     if (parsed.kind === "new") {
       const result = await generateProject({ name: parsed.name, outputPath: parsed.outputPath, frameworkPath: parsed.frameworkPath, linkFramework: parsed.linkFramework, vendor: parsed.vendor, dryRun: parsed.dryRun });
       runtime.log(`[bazis] ${result.dryRun ? "planned" : "created"} project: ${result.projectDir}`);

package/cli/parseCli.ts

@@ -25,7 +25,7 @@ export type ParseCliResult =
   | { readonly kind: "codegen"; readonly target?: string }
   | { readonly kind: "dev"; readonly watch: boolean }
   | { readonly kind: "test"; readonly args: readonly string[] }
-  | { readonly kind: "build"; readonly bin: boolean; readonly outfile?: string }
+  | { readonly kind: "build"; readonly bin: boolean; readonly outfile?: string; readonly dotenv: boolean }
   | { readonly kind: "error"; readonly message: string };
 
 const GENERATOR_ALIASES = new Map<string, "module" | "pack">([
@@ -33,7 +33,7 @@ const GENERATOR_ALIASES = new Map<string, "module" | "pack">([
   ["pack", "pack"], ["p", "pack"], ["module-pack", "pack"],
 ]);
 const VALUE_OPTIONS = new Set(["--modules-root", "--app-module", "--pack", "--parts", "--target", "--path", "--framework", "--outfile"]);
-const FLAG_OPTIONS = new Set(["--no-register", "--force", "--full", "--enterprise", "--minimal", "--empty", "--dry-run", "--no-codegen", "--link-framework", "--vendor", "--bin", "--watch"]);
+const FLAG_OPTIONS = new Set(["--no-register", "--force", "--full", "--enterprise", "--minimal", "--empty", "--dry-run", "--no-codegen", "--link-framework", "--vendor", "--bin", "--watch", "--dotenv"]);
 
 /** Parsing is pure: help and invalid input can never start generation. */
 export function parseCliArgs(argv: readonly string[]): ParseCliResult {
@@ -89,14 +89,15 @@ export function parseCliArgs(argv: readonly string[]): ParseCliResult {
   }
   if (options.has("--watch")) return error("--watch is only supported by dev.");
   if (command === "build") {
-    if (positional.length !== 1) return error("Use: bazis build [--bin [--outfile <path>]]");
+    if (positional.length !== 1) return error("Use: bazis build [--bin [--outfile <path>] [--dotenv]]");
     for (const option of options.keys()) {
-      if (option !== "--bin" && option !== "--outfile") return error(`Option ${option} is not supported by build.`);
+      if (option !== "--bin" && option !== "--outfile" && option !== "--dotenv") return error(`Option ${option} is not supported by build.`);
     }
     if (options.has("--outfile") && !options.has("--bin")) return error("--outfile requires --bin.");
-    return { kind: "build", bin: options.has("--bin"), outfile: options.get("--outfile") };
+    if (options.has("--dotenv") && !options.has("--bin")) return error("--dotenv requires --bin.");
+    return { kind: "build", bin: options.has("--bin"), outfile: options.get("--outfile"), dotenv: options.has("--dotenv") };
   }
-  if (options.has("--bin") || options.has("--outfile")) return error("--bin and --outfile are only supported by build.");
+  if (options.has("--bin") || options.has("--outfile") || options.has("--dotenv")) return error("--bin, --outfile and --dotenv are only supported by build.");
   if (command === "codegen") {
     if (positional.length !== 1) return error("Use: bazis codegen [--target <name|all>]");
     for (const option of options.keys()) {

package/core/di/ServiceProvider.ts

@@ -15,6 +15,7 @@ import { ServiceRegistry } from "./internal/ServiceRegistry";
 import { ResolutionTracker, type ResolutionActivation } from "./internal/ResolutionTracker";
 import { ScopeLifecycle } from "./internal/ScopeLifecycle";
 import { ServiceScope } from "./ServiceScope";
+import { RESOLVE_DEPENDENCY_LIST } from "./internal/resolveDependencyList";
 import { getConstructorDeps, getProviderDeps } from "./internal/providerDeps";
 import type { BuildServiceProviderOptions, ServiceKey, ServiceResolver } from "./types";
 import type {
@@ -550,7 +551,29 @@ export class ServiceProvider implements ServiceResolver {
         return this.tryResolveInternal(token, key, scopeState, stack(), ownerLifetime);
       },
       has: (token: Token<unknown>, key?: ServiceKey): boolean => this.has(token, key),
-    };
+      [RESOLVE_DEPENDENCY_LIST]: (key: object, deps: ProviderDependencyList): unknown[] => {
+        assertOriginScopeLive();
+        return this.resolveListIn(key, deps, scopeState, stack(), ownerLifetime);
+      },
+    } as ServiceResolver;
+  }
+
+  /** @internal See resolveDependencyList: the root resolver is the provider itself. */
+  [RESOLVE_DEPENDENCY_LIST](key: object, deps: ProviderDependencyList): unknown[] {
+    return this.resolveListIn(key, deps, this.lifetime.root, [], undefined);
+  }
+
+  // A dependency list resolved outside a registered provider (a DbContext's
+  // generated constructor dependencies). The synthetic provider is cached per
+  // key, so its plan is built once like any provider's.
+  private readonly listProviders = new WeakMap<object, Provider<unknown>>();
+  private resolveListIn(key: object, deps: ProviderDependencyList, scopeState: ResolutionScopeState, stack: ResolutionActivation[], ownerLifetime: ProviderLifetime | undefined): unknown[] {
+    let provider = this.listProviders.get(key);
+    if (provider === undefined || getProviderDeps(provider) !== deps) {
+      provider = { provide: key as Token<unknown>, useFactory: () => undefined, deps } as unknown as Provider<unknown>;
+      this.listProviders.set(key, provider);
+    }
+    return this.resolveDeps(this.getPlan(provider), scopeState, stack, ownerLifetime ?? "scoped");
   }
 
   private resolveDeps(

package/core/di/internal/resolveDependencyList.ts

@@ -0,0 +1,19 @@
+import type { ProviderDependencyList } from "../provider";
+import type { ServiceResolver } from "../types";
+
+/** @internal A resolver created by ServiceProvider resolves a dependency list in its own scope. */
+export const RESOLVE_DEPENDENCY_LIST = Symbol("bazis.di.resolveDependencyList");
+
+type ListResolver = ServiceResolver & { readonly [RESOLVE_DEPENDENCY_LIST]?: (key: object, deps: ProviderDependencyList) => unknown[] };
+
+/**
+ * Resolves `deps` (tokens, keyed, named, lazy or optional dependencies, as
+ * codegen records them) in the scope of `resolver`. `key` identifies the list
+ * so its resolution plan is built once. For framework factories that construct
+ * a class with generated dependencies, such as a DbContext.
+ */
+export function resolveDependencyList(resolver: ServiceResolver, key: object, deps: ProviderDependencyList): unknown[] {
+  const resolve = (resolver as ListResolver)[RESOLVE_DEPENDENCY_LIST];
+  if (resolve === undefined) throw new TypeError("resolveDependencyList() needs a resolver created by the container");
+  return resolve(key, deps);
+}

package/core/infra/connectors/codex/CodexAppServerClient.ts

@@ -232,7 +232,7 @@ export class CodexAppServerClient implements CodexClient {
         if (method === "account/updated") this.modelCache = undefined;
       }, () => { this.clearLogin(); this.modelCache = undefined; });
       const initialized = await client.request("initialize", {
-        clientInfo: { name: "bazis", title: "Bazis", version: "0.98.27" }, capabilities: { experimentalApi: true },
+        clientInfo: { name: "bazis", title: "Bazis", version: "0.98.29" }, capabilities: { experimentalApi: true },
       }, 15_000, signal);
       if (resolve(text(initialized.codexHome, 4096)) !== this.paths.home) throw new CodexError("PROTOCOL_ERROR");
       client.notify("initialized");

package/core/kernel/config/README.md

@@ -26,6 +26,16 @@ Flat Configuration key names are case-insensitive. A later source also wins
 between the canonical name and an explicit env alias.
 Numbers are finite; an empty string never becomes zero; a Secret does not allow an
 empty or whitespace value. TypeScript forbids unsupported object types.
+In `production` a Secret whose value would come from the `default` section (no source
+supplied it and the `production` section does not declare it) is an error: a secret
+default in the code is a development value. `production: { key: secret("…") }`
+declares a production value explicitly.
+
+`secretFilesSource(directory, { optional })` reads secret files as Docker and Kubernetes
+mount them (`/run/secrets`): one file per value, the file name is the key (`db.password`)
+or its variable (`BAZIS_DB__PASSWORD`), trailing line breaks are removed, hidden entries
+(Kubernetes `..data`) and directories are skipped, a file over 64 KiB is an error.
+Errors name the file, never its content. A missing directory is an error unless `optional`.
 
 A declaration stores no chosen environment, values or cache. `get/has/ensureValid`
 stay for standalone reading of the process env, but `ensureValid` no longer

package/core/kernel/config/defineConfig.ts

@@ -156,7 +156,8 @@ export function defineConfig(prefixOrSchema: string | ConfigSchema<Defaults>, ma
     const issues: string[] = [];
     // A wrong value names what came and where to change it: the variable that
     // supplied it, or the variables that can override the value from the code.
-    const got = (raw: unknown) => raw === undefined ? "" : `, got ${JSON.stringify(String(raw)).slice(0, 80)}`;
+    // A key with a sensitive name never shows its value.
+    const got = (key: string, raw: unknown) => raw === undefined || isSensitiveKey(fullKey(key)) ? "" : `, got ${JSON.stringify(String(raw)).slice(0, 80)}`;
     const source = (key: string, selected: { readonly name: string } | undefined) => ` (${selected ? selected.name : names.get(key)!.join(", ")})`;
     for (const key of keys) {
       const base = schema.default[key]!;
@@ -179,23 +180,31 @@ export function defineConfig(prefixOrSchema: string | ConfigSchema<Defaults>, ma
       let value: ConfigValueType | undefined;
       if (type === "secret") {
         if (typeof raw !== "string" || !raw.trim()) issues.push(`${fullKey(key)} — required non-empty secret is not set (${names.get(key)!.join(", ")})`);
+        // A secret default in the code is a development value; production must
+        // get the secret from a source or declare its own value explicitly.
+        // No "apiKey: …" in the hint: the console redaction would hide it.
+        else if (environment === "production" && selected === undefined && override === undefined) issues.push(`${fullKey(key)} — production would use the development default secret from the code; set ${names.get(key)!.join(" or ")}, or declare ${key} in the production section`);
         else value = new Secret(raw);
       } else if (type === "number") {
         const parsed = Number(raw);
-        if (raw === undefined || (typeof raw === "string" && !raw.trim()) || !Number.isFinite(parsed)) issues.push(`${fullKey(key)} — expected a finite number${got(raw)}${source(key, selected)}`);
+        if (raw === undefined || (typeof raw === "string" && !raw.trim()) || !Number.isFinite(parsed)) issues.push(`${fullKey(key)} — expected a finite number${got(key, raw)}${source(key, selected)}`);
         else value = parsed;
       } else if (type === "boolean") {
         const normalized = String(raw).toLowerCase();
         if (normalized === "true" || normalized === "1") value = true;
         else if (normalized === "false" || normalized === "0") value = false;
-        else issues.push(`${fullKey(key)} — expected a boolean (true, false, 1, 0)${got(raw)}${source(key, selected)}`);
+        else issues.push(`${fullKey(key)} — expected a boolean (true, false, 1, 0)${got(key, raw)}${source(key, selected)}`);
       } else if (typeof raw === "string") value = raw;
       else issues.push(`${fullKey(key)} — expected a string`);
       if (value === undefined) continue;
-      if (isEnum(base) && !base.values.includes(value as string | number)) issues.push(`${fullKey(key)} — ${JSON.stringify(value)} is not allowed, use one of: ${base.values.join(", ")}${source(key, selected)}`);
+      if (isEnum(base) && !base.values.includes(value as string | number)) issues.push(`${fullKey(key)} — ${isSensitiveKey(fullKey(key)) ? "the value" : JSON.stringify(value)} is not allowed, use one of: ${base.values.join(", ")}${source(key, selected)}`);
       try {
         const issue = validators[key]?.(value);
-        if (issue) issues.push(`${fullKey(key)} — ${issue}`);
+        // A validator may quote its own value; hide it in that message only.
+        // Replacing secrets across the whole text turned a one-letter secret
+        // into "m***il.***piKey".
+        const sensitive = value instanceof Secret ? value.reveal() : typeof value === "string" && isSensitiveKey(fullKey(key)) ? value : "";
+        if (issue) issues.push(`${fullKey(key)} — ${sensitive.trim() ? issue.replaceAll(sensitive, "***") : issue}`);
       } catch { issues.push(`${fullKey(key)} — validator failed`); }
       values.set(key, value);
       inspection.push(Object.freeze({ key: fullKey(key), type: type as ConfigInspection["type"], env: names.get(key)!, source: selected?.source ?? (override === undefined ? "default" : environment), value: safeValue(fullKey(key), value) }));
@@ -203,11 +212,7 @@ export function defineConfig(prefixOrSchema: string | ConfigSchema<Defaults>, ma
     if (issues.length) {
       // "key — text", not "key: text": the console redaction would read
       // "db.password: required" as a secret value and hide the word "required".
-      let message = issues.join("; ");
-      for (const [key, value] of values) {
-        const sensitive = value instanceof Secret ? value.reveal() : typeof value === "string" && isSensitiveKey(key) ? value : undefined;
-        if (sensitive) message = message.replaceAll(sensitive, "***");
-      }
+      const message = issues.join("; ");
       throw new KernelError(`Invalid configuration (environment "${environment}"): ${message}.`);
     }
     const rows = Object.freeze(inspection);

package/core/kernel/config/sources.ts

@@ -1,3 +1,5 @@
+import { readdir, stat } from "node:fs/promises";
+import path from "node:path";
 import { KernelError } from "../errors";
 import type { ConfigSource } from "../types";
 
@@ -96,6 +98,62 @@ export function jsonFileSource(path: string, options?: { readonly optional?: boo
   };
 }
 
+/** Largest secret file read by {@link secretFilesSource}: keys and certificates are a few KiB. */
+const SECRET_FILE_MAX_BYTES = 64 * 1024;
+
+/**
+ * Secret files of a directory, as Docker and Kubernetes mount them
+ * (`/run/secrets`). Each file is one value; its name is the key, written as
+ * the key (`db.password`) or as its variable (`BAZIS_DB__PASSWORD`). Trailing
+ * line breaks are removed. Hidden entries (Kubernetes `..data`) and
+ * directories are skipped. Errors name the file, never its content.
+ */
+export function secretFilesSource(directory: string, options?: { readonly optional?: boolean }): ConfigSource {
+  return {
+    description: `files(${directory})`,
+    load: async () => {
+      let names: string[];
+      try {
+        names = await readdir(directory);
+      } catch (error) {
+        if (options?.optional === true && (error as NodeJS.ErrnoException).code === "ENOENT") {
+          return {};
+        }
+        throw new KernelError(`Secret directory "${directory}" cannot be read (${(error as NodeJS.ErrnoException).code ?? "error"}).`);
+      }
+      const result: Record<string, string> = {};
+      for (const name of names.sort()) {
+        if (name.startsWith(".")) {
+          continue;
+        }
+        const file = path.join(directory, name);
+        let text: string;
+        try {
+          // stat follows the symlinks Kubernetes uses for each key.
+          const info = await stat(file);
+          if (!info.isFile()) {
+            continue;
+          }
+          if (info.size > SECRET_FILE_MAX_BYTES) {
+            throw new KernelError(`Secret file "${file}" is larger than ${SECRET_FILE_MAX_BYTES} bytes.`);
+          }
+          text = await Bun.file(file).text();
+        } catch (error) {
+          if (error instanceof KernelError) throw error;
+          throw new KernelError(`Secret file "${file}" cannot be read (${(error as NodeJS.ErrnoException).code ?? "error"}).`);
+        }
+        const key = name.toUpperCase().startsWith(ENV_PREFIX)
+          ? name.slice(ENV_PREFIX.length).toLowerCase().replaceAll("__", ".")
+          : name.toLowerCase();
+        if (key.length > 0) {
+          result[key] = text.replace(/[\r\n]+$/, "");
+        }
+      }
+      return result;
+    },
+  };
+}
+
 function flatten(tree: ConfigTree, prefix = "", into: Record<string, string> = {}): Record<string, string> {
   for (const [key, value] of Object.entries(tree)) {
     const fullKey = prefix.length > 0 ? `${prefix}.${key}` : key;

package/core/kernel/index.ts

@@ -29,7 +29,7 @@ export {
   type ValidatableConfig,
 } from "./config/defineConfig";
 export { addConfigOptions, configOptions, type ConfigOptionsBinding } from "./config/addConfigOptions";
-export { argsSource, envSource, jsonFileSource, memorySource } from "./config/sources";
+export { argsSource, envSource, jsonFileSource, memorySource, secretFilesSource } from "./config/sources";
 
 export {
   EVENT_HANDLER,

package/core/kernel/logging/ConsoleLogger.ts

@@ -1,4 +1,4 @@
-import { redactSensitive, type SensitiveRedactionOptions } from "../../../library/redaction";
+import { redactSensitive, redactSensitiveText, type SensitiveRedactionOptions } from "../../../library/redaction";
 import type { LogFields, LogLevel, Logger } from "./Logger";
 import { getRequestId, getTraceparent } from "../correlation/requestContext";
 
@@ -16,7 +16,10 @@ export interface ConsoleLoggerOptions {
   readonly minLevel?: LogLevel;
   /** Prefix tag, e.g. the app name. */
   readonly name?: string;
-  /** Structured fields are redacted by default; pass false only for trusted local debugging. */
+  /**
+   * The message and structured fields are redacted by default (secret keys, `password=…`,
+   * bearer tokens, URL credentials); pass false only for trusted local debugging.
+   */
   readonly redaction?: SensitiveRedactionOptions | false;
   /**
    * Inside a request, add `requestId` (and `traceparent`, when the request
@@ -83,6 +86,7 @@ export class ConsoleLogger implements Logger {
       return;
     }
     const line = this.requestContext ? withRequestContext(fields) : fields;
-    LEVEL_SINK[level](`${this.prefix}${level}: ${message}${formatFields(line, this.redaction)}`);
+    const text = this.redaction === false ? message : redactSensitiveText(message, this.redaction);
+    LEVEL_SINK[level](`${this.prefix}${level}: ${text}${formatFields(line, this.redaction)}`);
   }
 }

package/core/orm/buildOrmProviders.ts

@@ -1,6 +1,8 @@
-import { DI, HOSTED_SERVICE, type InjectionToken, type ModuleOwnedContributionSnapshot, type ProviderDefinition } from "../di";
+import { DI, HOSTED_SERVICE, type InjectionToken, type ModuleOwnedContributionSnapshot, type ProviderDefinition, type ProviderDependencyList, type ServiceResolver } from "../di";
+import { getGeneratedClassDeps } from "../di/module/autoDeps";
+import { resolveDependencyList } from "../di/internal/resolveDependencyList";
 import { HEALTH_CHECK } from "../kernel";
-import { DbContextOptions, type DatabaseProvider, type DbContext } from "../../library/orm";
+import { DbContextOptions, OrmError, type DatabaseProvider, type DbContext } from "../../library/orm";
 import { OrmLifecycle } from "./OrmLifecycle";
 import { ownedStoreLifecycleFor, ownedStoreLifecycleHealthFor } from "./OrmOwnedStoreLifecycle";
 import { effectiveOrmModuleConfig, ownedStoreRegistrations } from "./ownedStoreContributions";
@@ -9,7 +11,9 @@ import { DATABASE_PROVIDER } from "./DATABASE_PROVIDER";
 import type { OrmModuleConfig } from "./ormModule";
 
 type EntityClass = new () => object;
-type ContextClass<TContext extends DbContext> = new (options: DbContextOptions) => TContext;
+/** A DbContext subclass: `DbContextOptions` first, then its own constructor dependencies (since 0.98.28). */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+type ContextClass<TContext extends DbContext> = new (options: DbContextOptions, ...dependencies: any[]) => TContext;
 
 type OrmBuildConfig<TContext extends DbContext> = OrmModuleConfig<TContext> & {
   readonly context: ContextClass<TContext>;
@@ -27,6 +31,27 @@ function createContextOptions<TContext extends DbContext>(
   });
 }
 
+const contextDependencies = new WeakMap<object, ProviderDependencyList>();
+
+/**
+ * Creates a context with `options` and the rest of its constructor
+ * dependencies (generated by codegen) resolved in the request scope, so a
+ * context may read the current user or tenant: `constructor(options:
+ * DbContextOptions, private readonly user: CurrentUser)`.
+ */
+function constructContext<TContext extends DbContext>(context: ContextClass<TContext>, options: DbContextOptions, resolver: ServiceResolver): TContext {
+  const generated = getGeneratedClassDeps(context);
+  if (generated === undefined || generated.length === 0) return new context(options);
+  const first = generated[0];
+  if (first !== DbContextOptions && !(typeof first === "function" && first.name === "DbContextOptions")) {
+    throw new OrmError(`${context.name}: the first constructor parameter of a DbContext must be DbContextOptions; put its other dependencies after it.`);
+  }
+  if (generated.length === 1) return new context(options);
+  let rest = contextDependencies.get(context);
+  if (rest === undefined) { rest = generated.slice(1); contextDependencies.set(context, rest); }
+  return new context(options, ...resolveDependencyList(resolver, context, rest));
+}
+
 function createOrmLifecycle<TContext extends DbContext>(
   config: OrmBuildConfig<TContext>,
   options: DbContextOptions,
@@ -72,9 +97,9 @@ export function buildOrmModuleProviders<TContext extends DbContext>(
     const token = providerOrToken;
     const providers: ProviderDefinition[] = [
       DI.scoped(
-        DI.factoryProvider(config.context, [token, SERVICE_PROVIDER] as const, (provider: DatabaseProvider, serviceProvider) => {
+        DI.factoryProviderWithResolver(config.context, [token, SERVICE_PROVIDER] as const, (resolver, provider: DatabaseProvider, serviceProvider) => {
           const current = effectiveConfigFor(serviceProvider, registrationIdentity, config);
-          return new current.context(createContextOptions(current, provider));
+          return constructContext(current.context, createContextOptions(current, provider), resolver);
         }),
       ),
       DI.singleton(
@@ -105,10 +130,10 @@ export function buildOrmModuleProviders<TContext extends DbContext>(
 
   const provider = providerOrToken;
   const providers: ProviderDefinition[] = [
-    DI.scoped(DI.factoryProvider(config.context, [SERVICE_PROVIDER], (serviceProvider) => {
+    DI.scoped(DI.factoryProviderWithResolver(config.context, [SERVICE_PROVIDER], (resolver, serviceProvider) => {
       const current = effectiveConfigFor(serviceProvider, registrationIdentity, config);
       const context = current === config ? config.context : current.context;
-      return new context(current === config && optionsAtModuleCall !== undefined ? optionsAtModuleCall : createContextOptions(current, provider));
+      return constructContext(context, current === config && optionsAtModuleCall !== undefined ? optionsAtModuleCall : createContextOptions(current, provider), resolver);
     })),
     // Standalone mode: the context owns its provider and closes it.
     DI.singleton(DI.factoryProvider(HOSTED_SERVICE, [SERVICE_PROVIDER], (serviceProvider) => {

package/core/orm/ormModule.ts

@@ -20,7 +20,9 @@ import { OrmConnectionLifecycle } from "./OrmLifecycle";
 import { attachOrmGraphContribution, attachOwnedStoreRegistration } from "./ownedStoreContributions";
 
 type EntityClass = new () => object;
-type ContextClass<TContext extends DbContext> = new (options: DbContextOptions) => TContext;
+/** A DbContext subclass: `DbContextOptions` first, then its own constructor dependencies (since 0.98.28). */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+type ContextClass<TContext extends DbContext> = new (options: DbContextOptions, ...dependencies: any[]) => TContext;
 
 /**
  * The single ORM registration shape. One function, three scenarios depending

package/core/orm/registerRepositories.ts

@@ -3,7 +3,9 @@ import { Repository, type DbContext, type DbContextOptions } from "../../library
 import { repositoryFor } from "./repository";
 
 type EntityClass = new () => object;
-type ContextClass<TContext extends DbContext> = new (options: DbContextOptions) => TContext;
+/** A DbContext subclass: `DbContextOptions` first, then its own constructor dependencies (since 0.98.28). */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+type ContextClass<TContext extends DbContext> = new (options: DbContextOptions, ...dependencies: any[]) => TContext;
 
 /**
  * Registers a scoped `IRepository<T>` for each context entity and the

package/library/orm/DbContext.ts

@@ -36,7 +36,7 @@ export abstract class DbContext {
     this.#options = options;
     this.changeTracker = new ChangeTracker();
     const provider = observedProvider(this, options.provider);
-    this.#runtime = { provider, models: options.model, tracker: this.changeTracker, runImmediateOperation: (operation) => monitorImmediateOperation(this, operation) };
+    this.#runtime = { context: this, provider, models: options.model, tracker: this.changeTracker, runImmediateOperation: (operation) => monitorImmediateOperation(this, operation) };
     this.database = new DatabaseFacade(provider, options.model);
   }
 

package/library/orm/Metadata/ModelBuilder.ts

@@ -143,6 +143,7 @@ export class ModelBuilder {
       relations,
       foreignKeys,
       queryFilters: raw.queryFilters ?? [],
+      contextQueryFilters: raw.contextQueryFilters ?? [],
       softDeleteProperty: raw.softDeleteProperty,
       propertyByName: (name: string) => byName.get(name),
       relationByName: (name: string) => relationByName.get(name),

package/library/orm/Metadata/decorators.ts

@@ -1,6 +1,6 @@
 import type { ColumnOptionsType, RelationKind, PropertyConvention } from "./types";
 import type { ValueConverter } from "./ValueConverter";
-import { evaluatePredicate, type PredicateFn } from "../Query/conditions";
+import { evaluatePredicate, type FieldSelector, type PredicateFn, type Predicate } from "../Query/conditions";
 import type { Condition } from "../Query/conditions";
 import { compileCheck, type CheckPredicate } from "../Schema/CheckExpression";
 
@@ -114,6 +114,8 @@ export interface RawEntity {
   properties: Map<string, RawProperty>;
   relations: RawRelation[];
   queryFilters?: Condition[];
+  /** `@QueryFilter((entity, context) => …)`: evaluated per query with the context. */
+  contextQueryFilters?: ContextQueryFilter[];
   /** Soft-delete property name (see `@SoftDelete` / `@Entity({ softDelete })`). */
   softDeleteProperty?: string;
   keyDeclaration?: { properties: readonly string[]; name?: string; anchor: string; composite: boolean };
@@ -135,7 +137,7 @@ function cloneRaw(source: RawEntity): RawEntity {
   for (const [name, prop] of source.properties) {
     properties.set(name, { ...prop, index: prop.index ? { ...prop.index } : undefined });
   }
-  return { ...source, properties, relations: source.relations.map((relation) => ({ ...relation })), keyDeclaration: source.keyDeclaration && { ...source.keyDeclaration, properties: [...source.keyDeclaration.properties] }, indexes: source.indexes?.map((index) => ({ ...index, properties: [...index.properties] })), foreignKeys: source.foreignKeys?.map((foreignKey) => ({ ...foreignKey, properties: [...foreignKey.properties] })), checks: source.checks?.map((check) => ({ ...check })), queryFilters: source.queryFilters?.map(cloneCondition) };
+  return { ...source, properties, relations: source.relations.map((relation) => ({ ...relation })), keyDeclaration: source.keyDeclaration && { ...source.keyDeclaration, properties: [...source.keyDeclaration.properties] }, indexes: source.indexes?.map((index) => ({ ...index, properties: [...index.properties] })), foreignKeys: source.foreignKeys?.map((foreignKey) => ({ ...foreignKey, properties: [...foreignKey.properties] })), checks: source.checks?.map((check) => ({ ...check })), queryFilters: source.queryFilters?.map(cloneCondition), contextQueryFilters: source.contextQueryFilters && [...source.contextQueryFilters] };
 }
 
 function cloneCondition(condition: Condition): Condition {
@@ -364,14 +366,30 @@ export function HasConversion(converter: ValueConverter) {
   };
 }
 
+/** A query filter that reads the `DbContext` of the query (a tenant, the current user). */
+export type ContextQueryFilter = (entity: FieldSelector<never>, context: never) => Predicate;
+
 /**
  * Global query filter for the entity (multi-tenant, flags and so on).
  * Applied automatically; disabled with `ignoreQueryFilters()`.
+ *
+ * With one parameter the filter is fixed when the class is declared:
+ * `@QueryFilter<Note>((n) => n.archived.eq(false))`. With a second parameter
+ * it receives the `DbContext` of each query and is evaluated then:
+ * `@QueryFilter<Note, NotesDb>((n, db) => n.tenantId.eq(db.tenantId))`. If it
+ * throws, the query fails instead of running unfiltered.
  */
-export function QueryFilter<T extends object>(predicate: PredicateFn<T>) {
+type QueryFilterDecorator = (value: abstract new (...args: never[]) => unknown, context: ClassDecoratorContext) => void;
+export function QueryFilter<T extends object>(predicate: PredicateFn<T>): QueryFilterDecorator;
+export function QueryFilter<T extends object, C extends object>(predicate: (entity: FieldSelector<T>, context: C) => Predicate): QueryFilterDecorator;
+export function QueryFilter<T extends object>(predicate: PredicateFn<T> | ((entity: FieldSelector<T>, context: never) => Predicate)): QueryFilterDecorator {
   return (_value: abstract new (...args: never[]) => unknown, context: ClassDecoratorContext): void => {
     const raw = ownRaw(context.metadata);
-    const node = evaluatePredicate(predicate, "@QueryFilter").node;
+    if (predicate.length >= 2) {
+      raw.contextQueryFilters = [...(raw.contextQueryFilters ?? []), predicate as unknown as ContextQueryFilter];
+      return;
+    }
+    const node = evaluatePredicate(predicate as PredicateFn<T>, "@QueryFilter").node;
     raw.queryFilters = [...(raw.queryFilters ?? []), node];
   };
 }

package/library/orm/Metadata/types.ts

@@ -131,6 +131,8 @@ export interface EntityModel {
   readonly foreignKeys: readonly ForeignKeyModel[];
   /** Global query filters (`@QueryFilter`), applied to every SELECT. */
   readonly queryFilters: readonly Condition[];
+  /** Query filters that read the query's `DbContext`; evaluated per query (see `effectiveQueryFilters`). */
+  readonly contextQueryFilters?: readonly import("./decorators").ContextQueryFilter[];
   /** Soft-delete property name (NULL = not deleted). `@SoftDelete` / `@Entity({ softDelete })`. */
   readonly softDeleteProperty?: string;
   /** Property by name. */

package/library/orm/Query/EntityQuery.ts

@@ -6,6 +6,7 @@ import { IncludeLoader } from "./IncludeLoader";
 import { materialize, materializeProjection } from "./materialize";
 import { EMPTY_PLAN, withCondition, withOrder, type QueryPlan } from "./QueryPlan";
 import { SqlTranslator } from "./SqlTranslator";
+import { effectiveQueryFilters } from "./queryFilters";
 import { executeImmediateDelete, executeImmediateUpdate, type OrmMutationResultV1, type OrmUpdateValuesV1 } from "./ImmediateMutations";
 
 export interface ForUpdateOptionsV1 { readonly skipLocked?: boolean; }
@@ -144,7 +145,7 @@ export class EntityQuery<T extends object, TResult = T> {
   }
 
   protected translator(): SqlTranslator {
-    return new SqlTranslator(this.model, this.runtime.provider.dialect);
+    return new SqlTranslator(this.model, this.runtime.provider.dialect, this.plan.ignoreQueryFilters ? [] : effectiveQueryFilters(this.model, this.runtime.context));
   }
 
   async toList(): Promise<TResult[]> {

package/library/orm/Query/ImmediateMutations.ts

@@ -8,6 +8,7 @@ import type { SqlParam } from "../Providers/types";
 import type { QueryPlan } from "./QueryPlan";
 import { Operand, type Condition, type FieldSelector } from "./conditions";
 import { SqlTranslator } from "./SqlTranslator";
+import { effectiveQueryFilters } from "./queryFilters";
 
 export interface OrmMutationResultV1 { readonly affectedRows: number; }
 export interface OrmInsertIfAbsentResultV1 { readonly inserted: boolean; }
@@ -17,7 +18,7 @@ export type OrmUniqueKeySelectorV1<T extends object> = (entity: FieldSelector<T>
 export function executeImmediateUpdate<T extends object>(model: EntityModel, runtime: DbContextRuntime, plan: QueryPlan, values: OrmUpdateValuesV1<T>): Promise<OrmMutationResultV1> {
   return runtime.runImmediateOperation(async () => {
     guard(model, runtime); const admittedPlan = admitPlan(plan, "executeUpdate");
-    const conditions = effectiveConditions(model, admittedPlan); const assignments = encodeAssignments(runtime, admitUpdateValues(model, values));
+    const conditions = effectiveConditions(model, admittedPlan, runtime); const assignments = encodeAssignments(runtime, admitUpdateValues(model, values));
     const compiled = new SqlTranslator(model, runtime.provider.dialect).immediateUpdate(assignments, conditions, (property, value) => encode(runtime, property, snapshot(value), true));
     Object.freeze(compiled.params);
     guard(model, runtime);
@@ -28,7 +29,7 @@ export function executeImmediateUpdate<T extends object>(model: EntityModel, run
 
 export function executeImmediateDelete(model: EntityModel, runtime: DbContextRuntime, plan: QueryPlan): Promise<OrmMutationResultV1> {
   return runtime.runImmediateOperation(async () => {
-    guard(model, runtime); const admittedPlan = admitPlan(plan, "executeDelete"); const conditions = effectiveConditions(model, admittedPlan);
+    guard(model, runtime); const admittedPlan = admitPlan(plan, "executeDelete"); const conditions = effectiveConditions(model, admittedPlan, runtime);
     const compiled = new SqlTranslator(model, runtime.provider.dialect).immediateDelete(conditions, (property, value) => encode(runtime, property, snapshot(value), true));
     Object.freeze(compiled.params);
     guard(model, runtime);
@@ -177,8 +178,8 @@ function conflictTarget<T extends object>(model: EntityModel, options: { readonl
   return Object.freeze(columns as string[]);
 }
 
-function effectiveConditions(model: EntityModel, plan: AdmittedImmediatePlan): readonly Condition[] {
-  const source: Condition[] = plan.ignoreQueryFilters ? [] : readConditionList(model.queryFilters);
+function effectiveConditions(model: EntityModel, plan: AdmittedImmediatePlan, runtime: DbContextRuntime): readonly Condition[] {
+  const source: Condition[] = plan.ignoreQueryFilters ? [] : readConditionList([...effectiveQueryFilters(model, runtime.context)]);
   if (!plan.ignoreQueryFilters && model.softDeleteProperty) source.push({ kind: "null", property: model.softDeleteProperty, negated: false });
   source.push(...plan.explicitConditions); const active = new Set<object>(); const memo = new WeakMap<object, Condition>();
   return Object.freeze(source.map((condition) => cloneCondition(model, condition, active, memo)));

package/library/orm/Query/IncludeLoader.ts

@@ -6,6 +6,7 @@ import type { DbContextRuntime } from "../runtime";
 import { materialize } from "./materialize";
 import { EMPTY_PLAN } from "./QueryPlan";
 import { SqlTranslator } from "./SqlTranslator";
+import { effectiveQueryFilters } from "./queryFilters";
 
 interface Level {
   readonly model: EntityModel;
@@ -156,7 +157,7 @@ export class IncludeLoader {
   }
 
   private async queryIn(model: EntityModel, property: string, values: readonly unknown[], noTracking: boolean): Promise<object[]> {
-    const translator = new SqlTranslator(model, this.runtime.provider.dialect);
+    const translator = new SqlTranslator(model, this.runtime.provider.dialect, effectiveQueryFilters(model, this.runtime.context));
     const result: object[] = [];
     const chunkSize = maxParametersPerInList(this.runtime.provider);
     for (let start = 0; start < values.length; start += chunkSize) {
@@ -180,7 +181,7 @@ export class IncludeLoader {
 
   private async queryTuples(model: EntityModel, properties: readonly string[], values: readonly (readonly unknown[])[], noTracking: boolean): Promise<object[]> {
     const result: object[] = []; const perTuple = properties.length; const chunkSize = Math.max(1, Math.floor(maxParametersPerInList(this.runtime.provider) / perTuple));
-    for (let start = 0; start < values.length; start += chunkSize) { const translator = new SqlTranslator(model, this.runtime.provider.dialect); const { sql, params } = translator.selectAll({ ...EMPTY_PLAN, conditions: [{ kind: "tuples", properties, values: values.slice(start, start + chunkSize) }], noTracking }); for (let entity of (await this.runtime.provider.query(sql, params)).map((row) => materialize<object>(model, row, this.runtime.provider.dialect))) { if (!noTracking) entity = this.runtime.tracker.trackLoaded(entity, model); result.push(entity); } }
+    for (let start = 0; start < values.length; start += chunkSize) { const translator = new SqlTranslator(model, this.runtime.provider.dialect, effectiveQueryFilters(model, this.runtime.context)); const { sql, params } = translator.selectAll({ ...EMPTY_PLAN, conditions: [{ kind: "tuples", properties, values: values.slice(start, start + chunkSize) }], noTracking }); for (let entity of (await this.runtime.provider.query(sql, params)).map((row) => materialize<object>(model, row, this.runtime.provider.dialect))) { if (!noTracking) entity = this.runtime.tracker.trackLoaded(entity, model); result.push(entity); } }
     return result;
   }
   private tuple(model: EntityModel, values: readonly unknown[]): string | undefined {

package/library/orm/Query/SqlTranslator.ts

@@ -35,9 +35,11 @@ export function quotedColumnList(model: EntityModel, dialect: SqlDialect): strin
  * parameter array (no concatenation of user data).
  */
 export class SqlTranslator {
+  /** `filters`: the query filters to apply (see `effectiveQueryFilters`); the model's fixed ones by default. */
   constructor(
     private readonly model: EntityModel,
     private readonly dialect: SqlDialect,
+    private readonly filters: readonly Condition[] = model.queryFilters,
   ) {}
 
   /** SELECT of all columns (or a projection) with WHERE/ORDER/LIMIT/OFFSET. */
@@ -98,7 +100,7 @@ export class SqlTranslator {
   private whereClause(plan: QueryPlan, params: SqlParam[], encode: ConditionValueEncoder = (property, value) => encodeProperty(property, value, this.dialect)): string {
     const parts: string[] = [];
     if (!plan.ignoreQueryFilters) {
-      for (const filter of this.model.queryFilters) {
+      for (const filter of this.filters) {
         parts.push(this.condition(filter, params, encode));
       }
       if (this.model.softDeleteProperty) {

package/library/orm/Query/queryFilters.ts

@@ -0,0 +1,16 @@
+import type { EntityModel } from "../Metadata/types";
+import { evaluatePredicate, type Condition, type FieldSelector } from "./conditions";
+
+/**
+ * The query filters of `model` for a query of `context`: the fixed ones plus
+ * the context filters evaluated now. A context filter that throws fails the
+ * query; it never runs without the filter.
+ */
+export function effectiveQueryFilters(model: EntityModel, context: object | undefined): readonly Condition[] {
+  const dynamic = model.contextQueryFilters ?? [];
+  if (dynamic.length === 0) return model.queryFilters;
+  return [
+    ...model.queryFilters,
+    ...dynamic.map((filter) => evaluatePredicate((entity) => filter(entity as FieldSelector<never>, context as never), "@QueryFilter").node),
+  ];
+}

package/library/orm/runtime.ts

@@ -7,6 +7,8 @@ import type { ChangeTracker } from "./Tracking/ChangeTracker";
  * module to break import cycles between the context, the set and the tracker.
  */
 export interface DbContextRuntime {
+  /** The DbContext that owns this runtime; context query filters read it. */
+  readonly context?: object;
   readonly provider: DatabaseProvider;
   readonly models: OrmModel;
   readonly tracker: ChangeTracker;

package/library/redaction/index.ts

@@ -19,6 +19,8 @@ const DEFAULT_SENSITIVE_FRAGMENTS = [
 const SECRET_TEXT_PATTERN =
   /\b(password|passwd|passphrase|secret|token|api[-_]?key|cookie|set-cookie|private[-_]?key|client[-_]?secret)\b(\s*[:=]\s*)("[^"]*"|'[^']*'|[^,\s}]+)/gi;
 const BEARER_TEXT_PATTERN = /\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi;
+// Credentials in a URL: postgres://user:password@host, https://token@host.
+const URL_USERINFO_PATTERN = /\b([a-z][a-z0-9+.-]*:\/\/)([^\s/?#@]+)@/gi;
 
 export interface SensitiveRedactionOptions {
   readonly replacement?: string;
@@ -162,5 +164,7 @@ function normalizeKey(key: string): string {
 function redactText(value: string, replacement: string): string {
   return value
     .replace(SECRET_TEXT_PATTERN, (_match, name: string, separator: string) => `${name}${separator}${replacement}`)
-    .replace(BEARER_TEXT_PATTERN, (_match, scheme: string) => `${scheme} ${replacement}`);
+    .replace(BEARER_TEXT_PATTERN, (_match, scheme: string) => `${scheme} ${replacement}`)
+    .replace(URL_USERINFO_PATTERN, (_match, scheme: string, userinfo: string) =>
+      `${scheme}${userinfo.includes(":") ? `${replacement}:${replacement}` : replacement}@`);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bazis",
-  "version": "0.98.27",
+  "version": "0.98.29",
   "description": "Modular backend framework for Bun in TypeScript: DI wired by codegen, HTTP, a PostgreSQL ORM, JWT, WebSocket, agents and a CLI.",
   "license": "MIT",
   "author": "Alexander Alenin",