@guren/server 1.0.0-rc.12 → 1.0.0-rc.14

package/dist/{Application-DtWDHXr1.d.ts → Application-CsylYL26.d.ts}

@@ -12,7 +12,7 @@ import { E as Encrypter, A as AppKeyring } from './app-key-CsBfRC_Q.js';
 import { S as StorageManager } from './StorageManager-oZTHqaza.js';
 import { H as HealthManager } from './HealthManager-DUyMIzsZ.js';
 import { S as Scheduler } from './Scheduler-BstvSca7.js';
-import { G as Gate } from './Gate-CNkBYf8m.js';
+import { G as Gate } from './Gate-CynjZCtS.js';
 import { M as Middleware } from './index-9_Jzj5jo.js';
 
 declare const CSRF_TOKEN_KEY = "_csrf_token";
@@ -259,7 +259,11 @@ interface SecurityHeadersOptions {
     referrerPolicy?: string | false;
     /** X-Permitted-Cross-Domain-Policies header. Set to false to disable. Default: 'none' */
     crossDomainPolicies?: string | false;
-    /** Strict-Transport-Security header. Default: false (disabled) */
+    /**
+     * Strict-Transport-Security header.
+     * Default: `{ maxAge: 31536000 }` (1 year) when NODE_ENV is 'production', false otherwise.
+     * Browsers ignore HSTS on plain-HTTP responses, so the production default is safe behind TLS terminators.
+     */
     hsts?: HstsOptions | false;
 }
 /**
@@ -1383,6 +1387,31 @@ declare class Controller {
      * ```
      */
     protected apiTokenUserId(): string | number;
+    /**
+     * Authorize the current user (or guest) for an ability.
+     * Throws AuthorizationException (403) when denied.
+     *
+     * ORM records are plain objects with no constructor information, so pass
+     * the model class alongside the record to resolve the policy:
+     *
+     * @example
+     * ```typescript
+     * const post = await Post.findOrFail(id)
+     * await this.authorize('update', [Post, post])
+     * await this.authorize('create', Post)
+     * ```
+     */
+    protected authorize(ability: string, ...args: unknown[]): Promise<void>;
+    /**
+     * Check whether the current user (or guest) can perform an ability.
+     *
+     * @example
+     * ```typescript
+     * if (await this.can('update', [Post, post])) { ... }
+     * ```
+     */
+    protected can(ability: string, ...args: unknown[]): Promise<boolean>;
+    private gateUser;
     protected inertia<TPage extends InertiaPageContractLike>(page: TPage, props: InertiaPageProps<TPage>, options?: InertiaResponseOptions): Promise<InertiaResponse<InertiaPageComponent<TPage>, InertiaPageProps<TPage> & ResolvedSharedInertiaProps>>;
     protected inertia<Component extends string, Props extends DefaultInertiaProps>(component: Component, props: Props, options?: InertiaResponseOptions): Promise<InertiaResponse<Component, Props & ResolvedSharedInertiaProps>>;
     protected json<T>(data: T, init?: ResponseInit): Response;
@@ -1773,6 +1802,15 @@ interface RouteDefinition {
         body?: SchemaLike<unknown>;
         output?: SchemaLike<unknown>;
     };
+    /** Named middleware (aliases or groups) applied to this route */
+    middlewareNames?: string[];
+    /** Whether inline (unnamed) middleware handlers are attached */
+    hasInlineMiddleware?: boolean;
+    /** Controller binding when the handler is a [Controller, 'method'] tuple */
+    controller?: {
+        name: string;
+        action: string;
+    };
     summary?: string;
     description?: string;
     tags?: string[];

package/dist/{ConsoleKernel-CqCVrdZs.d.ts → ConsoleKernel-BsbMQ38T.d.ts}

@@ -1,4 +1,4 @@
-import { C as Container } from './Application-DtWDHXr1.js';
+import { C as Container } from './Application-CsylYL26.js';
 
 /**
  * Parsed argument definition.

package/dist/{Gate-CNkBYf8m.d.ts → Gate-CynjZCtS.d.ts}

@@ -213,6 +213,11 @@ declare class Gate {
     check(ability: string, user: AuthUser | null, ...args: unknown[]): Promise<boolean>;
     /**
      * Check a policy for the given ability.
+     *
+     * The subject may be a class instance (policy resolved via its constructor)
+     * or a `[ModelClass, record]` / `['key', record]` tuple. The tuple form is
+     * required for plain records returned by the ORM, which carry no constructor
+     * information.
      */
     protected checkPolicy(ability: string, user: AuthUser | null, model: unknown, additionalArgs: unknown[]): Promise<boolean | undefined>;
     /**

package/dist/auth/index.js

@@ -566,7 +566,7 @@ var SessionGuard = class {
     if (!this.currentSession || !this.provider.setRememberToken) {
       return;
     }
-    const token = globalThis.crypto.randomUUID();
+    const token = generateToken(32);
     await this.provider.setRememberToken?.(user, token);
     this.currentSession.set(this.rememberSessionKey(), token);
   }
@@ -576,6 +576,7 @@ var SessionGuard = class {
     if (!session) {
       throw new Error("SessionGuard: session middleware is required to use the session guard.");
     }
+    session.regenerate();
     const identifier = this.provider.getId(castUser);
     session.set(this.sessionKey(), identifier);
     this.cachedUser = castUser;
@@ -800,7 +801,7 @@ var NodeHasher = class {
   }
 };
 
-// ../../node_modules/.bun/drizzle-orm@1.0.0-beta.18-7eb39f0+0354db235c5ceb35/node_modules/drizzle-orm/entity.js
+// ../../node_modules/.bun/drizzle-orm@1.0.0-rc.1+6cb67a8f81be6bcf/node_modules/drizzle-orm/entity.js
 var entityKind = /* @__PURE__ */ Symbol.for("drizzle:entityKind");
 function is(value, type) {
   if (!value || typeof value !== "object") return false;
@@ -814,12 +815,16 @@ function is(value, type) {
   return false;
 }
 
-// ../../node_modules/.bun/drizzle-orm@1.0.0-beta.18-7eb39f0+0354db235c5ceb35/node_modules/drizzle-orm/column-common.js
+// ../../node_modules/.bun/drizzle-orm@1.0.0-rc.1+6cb67a8f81be6bcf/node_modules/drizzle-orm/column-common.js
 var OriginalColumn = /* @__PURE__ */ Symbol.for("drizzle:OriginalColumn");
 
-// ../../node_modules/.bun/drizzle-orm@1.0.0-beta.18-7eb39f0+0354db235c5ceb35/node_modules/drizzle-orm/column.js
+// ../../node_modules/.bun/drizzle-orm@1.0.0-rc.1+6cb67a8f81be6bcf/node_modules/drizzle-orm/column.js
+var noop = (v) => v;
+noop.isNoop = true;
 var Column = class {
   static [entityKind] = "Column";
+  /** @internal */
+  codec;
   name;
   keyAsName;
   primary;
@@ -869,12 +874,13 @@ var Column = class {
     this.length = config["length"];
     this.isLengthExact = config["isLengthExact"];
   }
-  mapFromDriverValue(value) {
-    return value;
-  }
-  mapToDriverValue(value) {
-    return value;
+  mapFromDriverValue = noop;
+  mapToDriverValue = noop;
+  /** @internal */
+  postBuild() {
+    return this;
   }
+  /** @internal */
   shouldDisableInsert() {
     return this.config.generated !== void 0 && this.config.generated.type !== "byDefault";
   }
@@ -884,10 +890,28 @@ var Column = class {
   }
 };
 
-// ../../node_modules/.bun/drizzle-orm@1.0.0-beta.18-7eb39f0+0354db235c5ceb35/node_modules/drizzle-orm/table.utils.js
+// ../../node_modules/.bun/drizzle-orm@1.0.0-rc.1+6cb67a8f81be6bcf/node_modules/drizzle-orm/subquery.js
+var Subquery = class {
+  static [entityKind] = "Subquery";
+  constructor(sql2, fields, alias, isWith = false, usedTables = []) {
+    this._ = {
+      brand: "Subquery",
+      sql: sql2,
+      selectedFields: fields,
+      alias,
+      isWith,
+      usedTables
+    };
+  }
+};
+var WithSubquery = class extends Subquery {
+  static [entityKind] = "WithSubquery";
+};
+
+// ../../node_modules/.bun/drizzle-orm@1.0.0-rc.1+6cb67a8f81be6bcf/node_modules/drizzle-orm/table.utils.js
 var TableName = /* @__PURE__ */ Symbol.for("drizzle:Name");
 
-// ../../node_modules/.bun/drizzle-orm@1.0.0-beta.18-7eb39f0+0354db235c5ceb35/node_modules/drizzle-orm/table.js
+// ../../node_modules/.bun/drizzle-orm@1.0.0-rc.1+6cb67a8f81be6bcf/node_modules/drizzle-orm/table.js
 var TableSchema = /* @__PURE__ */ Symbol.for("drizzle:Schema");
 var TableColumns = /* @__PURE__ */ Symbol.for("drizzle:Columns");
 var ExtraConfigColumns = /* @__PURE__ */ Symbol.for("drizzle:ExtraConfigColumns");
@@ -943,33 +967,15 @@ var Table = class {
   }
 };
 
-// ../../node_modules/.bun/drizzle-orm@1.0.0-beta.18-7eb39f0+0354db235c5ceb35/node_modules/drizzle-orm/subquery.js
-var Subquery = class {
-  static [entityKind] = "Subquery";
-  constructor(sql2, fields, alias, isWith = false, usedTables = []) {
-    this._ = {
-      brand: "Subquery",
-      sql: sql2,
-      selectedFields: fields,
-      alias,
-      isWith,
-      usedTables
-    };
-  }
-};
-var WithSubquery = class extends Subquery {
-  static [entityKind] = "WithSubquery";
-};
-
-// ../../node_modules/.bun/drizzle-orm@1.0.0-beta.18-7eb39f0+0354db235c5ceb35/node_modules/drizzle-orm/tracing.js
+// ../../node_modules/.bun/drizzle-orm@1.0.0-rc.1+6cb67a8f81be6bcf/node_modules/drizzle-orm/tracing.js
 var tracer = { startActiveSpan(name, fn) {
   return fn();
 } };
 
-// ../../node_modules/.bun/drizzle-orm@1.0.0-beta.18-7eb39f0+0354db235c5ceb35/node_modules/drizzle-orm/view-common.js
+// ../../node_modules/.bun/drizzle-orm@1.0.0-rc.1+6cb67a8f81be6bcf/node_modules/drizzle-orm/view-common.js
 var ViewBaseConfig = /* @__PURE__ */ Symbol.for("drizzle:ViewBaseConfig");
 
-// ../../node_modules/.bun/drizzle-orm@1.0.0-beta.18-7eb39f0+0354db235c5ceb35/node_modules/drizzle-orm/sql/sql.js
+// ../../node_modules/.bun/drizzle-orm@1.0.0-rc.1+6cb67a8f81be6bcf/node_modules/drizzle-orm/sql/sql.js
 var FakePrimitiveParam = class {
   static [entityKind] = "FakePrimitiveParam";
 };
@@ -991,6 +997,23 @@ function mergeQueries(queries) {
   }
   return result;
 }
+function _mergeQueries(queries) {
+  const result = {
+    sql: "",
+    params: []
+  };
+  const sqls = [];
+  for (const query of queries) {
+    sqls.push(query.sql);
+    result.params.push(...query.params);
+    if (query.typings?.length) {
+      if (!result.typings) result.typings = [];
+      result.typings.push(...query.typings);
+    }
+  }
+  result._sql = Object.assign(sqls, { raw: sqls });
+  return result;
+}
 var StringChunk = class {
   static [entityKind] = "StringChunk";
   value;
@@ -1035,8 +1058,8 @@ var SQL = class SQL2 {
       inlineParams: _config.inlineParams || this.shouldInlineParams,
       paramStartIndex: _config.paramStartIndex || { value: 0 }
     });
-    const { casing, escapeName, escapeParam, prepareTyping, inlineParams, paramStartIndex, invokeSource } = config;
-    return mergeQueries(chunks.map((chunk) => {
+    const { escapeName, escapeParam, prepareTyping, codecs, inlineParams, paramStartIndex, invokeSource } = config;
+    const mappedChunks = chunks.map((chunk) => {
       if (is(chunk, StringChunk)) return {
         sql: chunk.value.join(""),
         params: []
@@ -1075,7 +1098,7 @@ var SQL = class SQL2 {
         };
       }
       if (is(chunk, Column)) {
-        const columnName = casing.getColumnCasing(chunk);
+        const columnName = chunk.name;
         if (_config.invokeSource === "indexes") return {
           sql: escapeName(columnName),
           params: []
@@ -1095,21 +1118,33 @@ var SQL = class SQL2 {
         };
       }
       if (is(chunk, Param)) {
-        if (is(chunk.value, Placeholder)) return {
-          sql: escapeParam(paramStartIndex.value++, chunk),
-          params: [chunk],
-          typings: ["none"]
-        };
-        const mappedValue = chunk.value === null ? null : chunk.encoder.mapToDriverValue(chunk.value);
-        if (is(mappedValue, SQL2)) return this.buildQueryFromSourceParams([mappedValue], config);
+        if (is(chunk.value, SQL2)) return this.buildQueryFromSourceParams([chunk.value], config);
+        const useCodecs = codecs && is(chunk.encoder, Column);
+        if (is(chunk.value, Placeholder)) {
+          const escaped2 = escapeParam(paramStartIndex.value++, chunk);
+          chunk.codec = useCodecs ? (value) => codecs.apply(chunk.encoder, "normalizeParam", value) : void 0;
+          return {
+            sql: useCodecs ? codecs.apply(chunk.encoder, "castParam", escaped2) : escaped2,
+            params: [chunk],
+            typings: ["none"]
+          };
+        }
+        let mappedValue;
+        if (chunk.value === null) mappedValue = chunk.value;
+        else {
+          mappedValue = chunk.encoder.mapToDriverValue.isNoop ? chunk.value : chunk.encoder.mapToDriverValue(chunk.value);
+          if (is(mappedValue, SQL2)) return this.buildQueryFromSourceParams([mappedValue], config);
+          if (useCodecs) mappedValue = codecs.apply(chunk.encoder, "normalizeParam", mappedValue);
+        }
         if (inlineParams) return {
           sql: this.mapInlineParam(mappedValue, config),
           params: []
         };
         let typings = ["none"];
         if (prepareTyping) typings = [prepareTyping(chunk.encoder)];
+        const escaped = escapeParam(paramStartIndex.value++, mappedValue);
         return {
-          sql: escapeParam(paramStartIndex.value++, mappedValue),
+          sql: useCodecs ? codecs.apply(chunk.encoder, "castParam", escaped) : escaped,
           params: [mappedValue],
           typings
         };
@@ -1162,7 +1197,9 @@ var SQL = class SQL2 {
         params: [chunk],
         typings: ["none"]
       };
-    }));
+    });
+    if (_config.tagged) return _mergeQueries(mappedChunks);
+    return mergeQueries(mappedChunks);
   }
   mapInlineParam(chunk, { escapeString }) {
     if (chunk === null) return "null";
@@ -1214,7 +1251,9 @@ function isDriverValueEncoder(value) {
   return typeof value === "object" && value !== null && "mapToDriverValue" in value && typeof value.mapToDriverValue === "function";
 }
 var noopDecoder = { mapFromDriverValue: (value) => value };
+noopDecoder.mapFromDriverValue.isNoop = true;
 var noopEncoder = { mapToDriverValue: (value) => value };
+noopEncoder.mapToDriverValue.isNoop = true;
 var noopMapper = {
   ...noopDecoder,
   ...noopEncoder
@@ -1226,9 +1265,10 @@ var Param = class {
   * @param value - Parameter value
   * @param encoder - Encoder to convert the value to a driver parameter
   */
-  constructor(value, encoder = noopEncoder) {
+  constructor(value, encoder = noopEncoder, codec) {
     this.value = value;
     this.encoder = encoder;
+    this.codec = codec;
   }
   getSQL() {
     return new SQL([this]);
@@ -1274,7 +1314,58 @@ function sql(strings, ...params) {
     return new Param(value, encoder);
   }
   _sql.param = param;
+  function comment(input) {
+    const encoded = sqlCommenter(input);
+    if (!encoded.length) return void 0;
+    return sql.raw(encoded);
+  }
+  _sql.comment = comment;
 })(sql || (sql = {}));
+function sqlCommenter(input) {
+  const encoded = sqlCommenter.encodeInput(input);
+  if (!encoded.length) return "";
+  return `/*${encoded}*/`;
+}
+(function(_sqlCommenter) {
+  function merge(input1, input2) {
+    let encoded;
+    if (typeof input1 === "object" && typeof input2 === "object") encoded = encodeInput({
+      ...input1,
+      ...input2
+    });
+    else if (input1 && input2) encoded = [encodeInput(input1), encodeInput(input2)].filter((i) => i.length).join(",");
+    else if (input2) encoded = encodeInput(input2);
+    else if (input1) encoded = encodeInput(input1);
+    else return "";
+    if (!encoded.length) return "";
+    return `/*${encoded}*/`;
+  }
+  _sqlCommenter.merge = merge;
+  function encodeInput(input) {
+    if (typeof input === "string") {
+      if (!input.length) return input;
+      return sanitizeStringInput(input);
+    }
+    const parts = [];
+    for (const [key, value] of Object.entries(input)) {
+      if (value === null || value === void 0 || value === "") continue;
+      const encodedKey = sanitizeObjectElement(key);
+      const encodedValue = sanitizeObjectElement(String(value));
+      parts.push(`${encodedKey}='${encodedValue}'`);
+    }
+    if (!parts.length) return "";
+    return parts.sort().join(",");
+  }
+  _sqlCommenter.encodeInput = encodeInput;
+  function sanitizeObjectElement(key) {
+    return encodeURIComponent(key).replace(/'/g, `\\'`);
+  }
+  _sqlCommenter.sanitizeObjectElement = sanitizeObjectElement;
+  function sanitizeStringInput(input) {
+    return input.replace(/\/\*/g, "/ *").replace(/\*\//g, "* /");
+  }
+  _sqlCommenter.sanitizeStringInput = sanitizeStringInput;
+})(sqlCommenter || (sqlCommenter = {}));
 (function(_SQL) {
   class Aliased {
     static [entityKind] = "SQL.Aliased";
@@ -1351,7 +1442,7 @@ Subquery.prototype.getSQL = function() {
   return new SQL([this]);
 };
 
-// ../../node_modules/.bun/drizzle-orm@1.0.0-beta.18-7eb39f0+0354db235c5ceb35/node_modules/drizzle-orm/sql/expressions/conditions.js
+// ../../node_modules/.bun/drizzle-orm@1.0.0-rc.1+6cb67a8f81be6bcf/node_modules/drizzle-orm/sql/expressions/conditions.js
 function bindIfParam(value, column) {
   if (isDriverValueEncoder(column) && !isSQLWrapper(value) && !is(value, Param) && !is(value, Placeholder) && !is(value, Column) && !is(value, Table) && !is(value, View)) return new Param(value, column);
   return value;
@@ -1368,7 +1459,7 @@ function and(...unfilteredConditions) {
   if (conditions.length === 1) return new SQL(conditions);
   return new SQL([
     new StringChunk("("),
-    sql.join(conditions, new StringChunk(" and ")),
+    sql.join(conditions.map((c) => sql`(${c})`), new StringChunk(" and ")),
     new StringChunk(")")
   ]);
 }
@@ -1378,7 +1469,7 @@ function or(...unfilteredConditions) {
   if (conditions.length === 1) return new SQL(conditions);
   return new SQL([
     new StringChunk("("),
-    sql.join(conditions, new StringChunk(" or ")),
+    sql.join(conditions.map((c) => sql`(${c})`), new StringChunk(" or ")),
     new StringChunk(")")
   ]);
 }
@@ -1418,7 +1509,7 @@ function like(column, value) {
   return sql`${column} like ${value}`;
 }
 
-// ../../node_modules/.bun/drizzle-orm@1.0.0-beta.18-7eb39f0+0354db235c5ceb35/node_modules/drizzle-orm/sql/expressions/select.js
+// ../../node_modules/.bun/drizzle-orm@1.0.0-rc.1+6cb67a8f81be6bcf/node_modules/drizzle-orm/sql/expressions/select.js
 function asc(column) {
   return sql`${column} asc`;
 }
@@ -1426,7 +1517,7 @@ function desc(column) {
   return sql`${column} desc`;
 }
 
-// ../../node_modules/.bun/drizzle-orm@1.0.0-beta.18-7eb39f0+0354db235c5ceb35/node_modules/drizzle-orm/sql/functions/aggregate.js
+// ../../node_modules/.bun/drizzle-orm@1.0.0-rc.1+6cb67a8f81be6bcf/node_modules/drizzle-orm/sql/functions/aggregate.js
 function count(expression) {
   return sql`count(${expression || sql.raw("*")})`.mapWith(Number);
 }
@@ -1633,6 +1724,16 @@ async function resolveMutation(result) {
 function isPromiseLike(value) {
   return typeof value === "object" && value !== null && "then" in value && typeof value.then === "function";
 }
+async function resolveWithReturning(query) {
+  if (query && typeof query === "object" && "returning" in query && typeof query.returning === "function") {
+    const rows = await query.returning();
+    return {
+      usedReturning: true,
+      row: Array.isArray(rows) ? rows[0] : rows
+    };
+  }
+  return { usedReturning: false, row: void 0 };
+}
 var DrizzleAdapter = {
   configure(db) {
     database = db;
@@ -1697,7 +1798,10 @@ var DrizzleAdapter = {
   },
   async create(table, data, writeOptions) {
     const db = resolveExecutor(writeOptions);
-    const result = await resolveMutation(db.insert(table).values(data));
+    const query = db.insert(table).values(data);
+    const { usedReturning, row } = await resolveWithReturning(query);
+    if (usedReturning) return row;
+    const result = await resolveMutation(query);
     return result;
   },
   async update(table, where, data, writeOptions) {
@@ -1706,8 +1810,10 @@ var DrizzleAdapter = {
       throw new Error("DrizzleAdapter: configured database does not support updates.");
     }
     const clause = resolveWhere(table, where);
-    const query = db.update(table).set(data);
-    const result = await resolveMutation(clause ? query.where(clause) : query);
+    const finalQuery = clause ? db.update(table).set(data).where(clause) : db.update(table).set(data);
+    const { usedReturning, row } = await resolveWithReturning(finalQuery);
+    if (usedReturning) return row;
+    const result = await resolveMutation(finalQuery);
     return result;
   },
   async delete(table, where, writeOptions) {
@@ -1716,8 +1822,10 @@ var DrizzleAdapter = {
       throw new Error("DrizzleAdapter: configured database does not support deletes.");
     }
     const clause = resolveWhere(table, where);
-    const query = db.delete(table);
-    const result = await resolveMutation(clause ? query.where(clause) : query);
+    const finalQuery = clause ? db.delete(table).where(clause) : db.delete(table);
+    const { usedReturning, row } = await resolveWithReturning(finalQuery);
+    if (usedReturning) return row;
+    const result = await resolveMutation(finalQuery);
     return result;
   },
   async findManyAdvanced(table, conditions, options, queryOptions) {
@@ -1779,8 +1887,10 @@ var DrizzleAdapter = {
       throw new Error("DrizzleAdapter: configured database does not support updates.");
     }
     const clause = buildDrizzleConditions(table, conditions);
-    const query = db.update(table).set(data);
-    const result = await resolveMutation(clause ? query.where(clause) : query);
+    const finalQuery = clause ? db.update(table).set(data).where(clause) : db.update(table).set(data);
+    const { usedReturning, row } = await resolveWithReturning(finalQuery);
+    if (usedReturning) return row;
+    const result = await resolveMutation(finalQuery);
     return result;
   },
   async deleteAdvanced(table, conditions, writeOptions) {
@@ -1789,8 +1899,10 @@ var DrizzleAdapter = {
       throw new Error("DrizzleAdapter: configured database does not support deletes.");
     }
     const clause = buildDrizzleConditions(table, conditions);
-    const query = db.delete(table);
-    const result = await resolveMutation(clause ? query.where(clause) : query);
+    const finalQuery = clause ? db.delete(table).where(clause) : db.delete(table);
+    const { usedReturning, row } = await resolveWithReturning(finalQuery);
+    if (usedReturning) return row;
+    const result = await resolveMutation(finalQuery);
     return result;
   },
   async transaction(callback) {
@@ -4405,7 +4517,7 @@ var Flush = bytes_default().H().end();
 var SSLRequest = bytes_default().i32(8).i32(80877103).end(8);
 var ExecuteUnnamed = Buffer.concat([bytes_default().E().str(bytes_default.N).i32(0).end(), Sync]);
 var DescribeUnnamed = bytes_default().D().str("S").str(bytes_default.N).end();
-var noop = () => {
+var noop2 = () => {
 };
 var retryRoutines = /* @__PURE__ */ new Set([
   "FetchPreparedStatement",
@@ -4450,7 +4562,7 @@ var errorFields = {
   82: "routine"
   // R
 };
-function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose = noop } = {}) {
+function Connection(options, queues = {}, { onopen = noop2, onend = noop2, onclose = noop2 } = {}) {
   const {
     sslnegotiation,
     ssl,
@@ -4933,7 +5045,7 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
       return query.resolve(query.statement), write(Sync);
   }
   async function Authentication(x, type = x.readUInt32BE(5)) {
-    (type === 3 ? AuthenticationCleartextPassword : type === 5 ? AuthenticationMD5Password : type === 10 ? SASL : type === 11 ? SASLContinue : type === 12 ? SASLFinal : type !== 0 ? UnknownAuth : noop)(x, type);
+    (type === 3 ? AuthenticationCleartextPassword : type === 5 ? AuthenticationMD5Password : type === 10 ? SASL : type === 11 ? SASLContinue : type === 12 ? SASLFinal : type !== 0 ? UnknownAuth : noop2)(x, type);
   }
   async function AuthenticationCleartextPassword() {
     const payload = await Pass();
@@ -5220,7 +5332,7 @@ function xor(a, b2) {
 function timer(fn, seconds) {
   seconds = typeof seconds === "function" ? seconds() : seconds;
   if (!seconds)
-    return { cancel: noop, start: noop };
+    return { cancel: noop2, start: noop2 };
   let timer2;
   return {
     cancel() {
@@ -5238,7 +5350,7 @@ function timer(fn, seconds) {
 }
 
 // ../../node_modules/.bun/postgres@3.4.8/node_modules/postgres/src/subscribe.js
-var noop2 = () => {
+var noop3 = () => {
 };
 function Subscribe(postgres2, options) {
   const subscribers = /* @__PURE__ */ new Map(), slot = "postgresjs_" + Math.random().toString(36).slice(2), state = {};
@@ -5275,7 +5387,7 @@ function Subscribe(postgres2, options) {
     return close();
   };
   return subscribe;
-  async function subscribe(event, fn, onsubscribe = noop2, onerror = noop2) {
+  async function subscribe(event, fn, onsubscribe = noop3, onerror = noop3) {
     event = parseEvent(event);
     if (!connection2)
       connection2 = init(sql2, slot, options.publications);

package/dist/authorization/index.d.ts

@@ -1,5 +1,5 @@
-import { f as Policy$1, A as AuthUser, a as AuthorizationResponse, G as Gate, b as AuthorizeOptions } from '../Gate-CNkBYf8m.js';
-export { c as GateCallback, d as GateDefinition, e as GateOptions, P as PolicyClass, g as PolicyMethod, h as PolicyRegistration, i as ResourceAction, R as Response, j as ResponseBuilder, k as authorize, l as can, m as cannot, n as createGate, o as defineGate, p as getGate, s as setGate } from '../Gate-CNkBYf8m.js';
+import { f as Policy$1, A as AuthUser, a as AuthorizationResponse, G as Gate, b as AuthorizeOptions } from '../Gate-CynjZCtS.js';
+export { c as GateCallback, d as GateDefinition, e as GateOptions, P as PolicyClass, g as PolicyMethod, h as PolicyRegistration, i as ResourceAction, R as Response, j as ResponseBuilder, k as authorize, l as can, m as cannot, n as createGate, o as defineGate, p as getGate, s as setGate } from '../Gate-CynjZCtS.js';
 import { Context } from 'hono';
 import { M as Middleware } from '../index-9_Jzj5jo.js';
 

package/dist/authorization/index.js

@@ -364,13 +364,29 @@ var Gate = class {
   }
   /**
    * Check a policy for the given ability.
+   *
+   * The subject may be a class instance (policy resolved via its constructor)
+   * or a `[ModelClass, record]` / `['key', record]` tuple. The tuple form is
+   * required for plain records returned by the ORM, which carry no constructor
+   * information.
    */
   async checkPolicy(ability, user, model, additionalArgs) {
-    const modelConstructor = model?.constructor;
-    if (!modelConstructor) {
+    let policyKey;
+    let subject = model;
+    let hasSubject = true;
+    if (Array.isArray(model) && model.length === 2 && (typeof model[0] === "function" || typeof model[0] === "string")) {
+      policyKey = model[0];
+      subject = model[1];
+    } else if (typeof model === "function") {
+      policyKey = model;
+      hasSubject = false;
+    } else {
+      policyKey = model?.constructor;
+    }
+    if (!policyKey) {
       return void 0;
     }
-    const policyClass = this.policies.get(modelConstructor);
+    const policyClass = this.policies.get(policyKey);
     if (!policyClass) {
       return void 0;
     }
@@ -383,7 +399,7 @@ var Gate = class {
     }
     const method = policy[ability];
     if (typeof method === "function") {
-      return method.call(policy, user, model, ...additionalArgs);
+      return hasSubject ? method.call(policy, user, subject, ...additionalArgs) : method.call(policy, user, ...additionalArgs);
     }
     return void 0;
   }