Historically I've always viewed repository objects as part of the storage layer fairly deep down. But I recently had an interesting discussion that made me realize I never really meant it to be that way.
Because I always considered "good" repositories to have interfaces that makes sense to the business logic (or domain model if you prefer that term) rather than being simple CRUD repositories. It is true that some repositories don't need to be more complex than simple CRUD, but there is often some more intricate search method that technically is a read, but way more complex than searching for an entity based on an id.
Another argument for considering the repository to be part of the business logic layer is that it should return business logic entities. The repository is the glue between your business logic and your data access layer (DAL). And in my opinion the DAL should not know anything about the types in the business logic layer so by definition the repository is part of your business logic even if you don't buy my first argument related to CRUD.