@guren/server 1.0.0-rc.13 → 1.0.0-rc.14

package/dist/{Application-DtWDHXr1.d.ts → Application-CsylYL26.d.ts}

@@ -12,7 +12,7 @@ import { E as Encrypter, A as AppKeyring } from './app-key-CsBfRC_Q.js';
 import { S as StorageManager } from './StorageManager-oZTHqaza.js';
 import { H as HealthManager } from './HealthManager-DUyMIzsZ.js';
 import { S as Scheduler } from './Scheduler-BstvSca7.js';
-import { G as Gate } from './Gate-CNkBYf8m.js';
+import { G as Gate } from './Gate-CynjZCtS.js';
 import { M as Middleware } from './index-9_Jzj5jo.js';
 
 declare const CSRF_TOKEN_KEY = "_csrf_token";
@@ -259,7 +259,11 @@ interface SecurityHeadersOptions {
     referrerPolicy?: string | false;
     /** X-Permitted-Cross-Domain-Policies header. Set to false to disable. Default: 'none' */
     crossDomainPolicies?: string | false;
-    /** Strict-Transport-Security header. Default: false (disabled) */
+    /**
+     * Strict-Transport-Security header.
+     * Default: `{ maxAge: 31536000 }` (1 year) when NODE_ENV is 'production', false otherwise.
+     * Browsers ignore HSTS on plain-HTTP responses, so the production default is safe behind TLS terminators.
+     */
     hsts?: HstsOptions | false;
 }
 /**
@@ -1383,6 +1387,31 @@ declare class Controller {
      * ```
      */
     protected apiTokenUserId(): string | number;
+    /**
+     * Authorize the current user (or guest) for an ability.
+     * Throws AuthorizationException (403) when denied.
+     *
+     * ORM records are plain objects with no constructor information, so pass
+     * the model class alongside the record to resolve the policy:
+     *
+     * @example
+     * ```typescript
+     * const post = await Post.findOrFail(id)
+     * await this.authorize('update', [Post, post])
+     * await this.authorize('create', Post)
+     * ```
+     */
+    protected authorize(ability: string, ...args: unknown[]): Promise<void>;
+    /**
+     * Check whether the current user (or guest) can perform an ability.
+     *
+     * @example
+     * ```typescript
+     * if (await this.can('update', [Post, post])) { ... }
+     * ```
+     */
+    protected can(ability: string, ...args: unknown[]): Promise<boolean>;
+    private gateUser;
     protected inertia<TPage extends InertiaPageContractLike>(page: TPage, props: InertiaPageProps<TPage>, options?: InertiaResponseOptions): Promise<InertiaResponse<InertiaPageComponent<TPage>, InertiaPageProps<TPage> & ResolvedSharedInertiaProps>>;
     protected inertia<Component extends string, Props extends DefaultInertiaProps>(component: Component, props: Props, options?: InertiaResponseOptions): Promise<InertiaResponse<Component, Props & ResolvedSharedInertiaProps>>;
     protected json<T>(data: T, init?: ResponseInit): Response;
@@ -1773,6 +1802,15 @@ interface RouteDefinition {
         body?: SchemaLike<unknown>;
         output?: SchemaLike<unknown>;
     };
+    /** Named middleware (aliases or groups) applied to this route */
+    middlewareNames?: string[];
+    /** Whether inline (unnamed) middleware handlers are attached */
+    hasInlineMiddleware?: boolean;
+    /** Controller binding when the handler is a [Controller, 'method'] tuple */
+    controller?: {
+        name: string;
+        action: string;
+    };
     summary?: string;
     description?: string;
     tags?: string[];

package/dist/{ConsoleKernel-CqCVrdZs.d.ts → ConsoleKernel-BsbMQ38T.d.ts}

@@ -1,4 +1,4 @@
-import { C as Container } from './Application-DtWDHXr1.js';
+import { C as Container } from './Application-CsylYL26.js';
 
 /**
  * Parsed argument definition.

package/dist/{Gate-CNkBYf8m.d.ts → Gate-CynjZCtS.d.ts}

@@ -213,6 +213,11 @@ declare class Gate {
     check(ability: string, user: AuthUser | null, ...args: unknown[]): Promise<boolean>;
     /**
      * Check a policy for the given ability.
+     *
+     * The subject may be a class instance (policy resolved via its constructor)
+     * or a `[ModelClass, record]` / `['key', record]` tuple. The tuple form is
+     * required for plain records returned by the ORM, which carry no constructor
+     * information.
      */
     protected checkPolicy(ability: string, user: AuthUser | null, model: unknown, additionalArgs: unknown[]): Promise<boolean | undefined>;
     /**

package/dist/auth/index.js

@@ -566,7 +566,7 @@ var SessionGuard = class {
     if (!this.currentSession || !this.provider.setRememberToken) {
       return;
     }
-    const token = globalThis.crypto.randomUUID();
+    const token = generateToken(32);
     await this.provider.setRememberToken?.(user, token);
     this.currentSession.set(this.rememberSessionKey(), token);
   }
@@ -576,6 +576,7 @@ var SessionGuard = class {
     if (!session) {
       throw new Error("SessionGuard: session middleware is required to use the session guard.");
     }
+    session.regenerate();
     const identifier = this.provider.getId(castUser);
     session.set(this.sessionKey(), identifier);
     this.cachedUser = castUser;
@@ -800,7 +801,7 @@ var NodeHasher = class {
   }
 };
 
-// ../../node_modules/.bun/drizzle-orm@1.0.0-beta.18-7eb39f0+0354db235c5ceb35/node_modules/drizzle-orm/entity.js
+// ../../node_modules/.bun/drizzle-orm@1.0.0-rc.1+6cb67a8f81be6bcf/node_modules/drizzle-orm/entity.js
 var entityKind = /* @__PURE__ */ Symbol.for("drizzle:entityKind");
 function is(value, type) {
   if (!value || typeof value !== "object") return false;
@@ -814,12 +815,16 @@ function is(value, type) {
   return false;
 }
 
-// ../../node_modules/.bun/drizzle-orm@1.0.0-beta.18-7eb39f0+0354db235c5ceb35/node_modules/drizzle-orm/column-common.js
+// ../../node_modules/.bun/drizzle-orm@1.0.0-rc.1+6cb67a8f81be6bcf/node_modules/drizzle-orm/column-common.js
 var OriginalColumn = /* @__PURE__ */ Symbol.for("drizzle:OriginalColumn");
 
-// ../../node_modules/.bun/drizzle-orm@1.0.0-beta.18-7eb39f0+0354db235c5ceb35/node_modules/drizzle-orm/column.js
+// ../../node_modules/.bun/drizzle-orm@1.0.0-rc.1+6cb67a8f81be6bcf/node_modules/drizzle-orm/column.js
+var noop = (v) => v;
+noop.isNoop = true;
 var Column = class {
   static [entityKind] = "Column";
+  /** @internal */
+  codec;
   name;
   keyAsName;
   primary;
@@ -869,12 +874,13 @@ var Column = class {
     this.length = config["length"];
     this.isLengthExact = config["isLengthExact"];
   }
-  mapFromDriverValue(value) {
-    return value;
-  }
-  mapToDriverValue(value) {
-    return value;
+  mapFromDriverValue = noop;
+  mapToDriverValue = noop;
+  /** @internal */
+  postBuild() {
+    return this;
   }
+  /** @internal */
   shouldDisableInsert() {
     return this.config.generated !== void 0 && this.config.generated.type !== "byDefault";
   }
@@ -884,10 +890,28 @@ var Column = class {
   }
 };
 
-// ../../node_modules/.bun/drizzle-orm@1.0.0-beta.18-7eb39f0+0354db235c5ceb35/node_modules/drizzle-orm/table.utils.js
+// ../../node_modules/.bun/drizzle-orm@1.0.0-rc.1+6cb67a8f81be6bcf/node_modules/drizzle-orm/subquery.js
+var Subquery = class {
+  static [entityKind] = "Subquery";
+  constructor(sql2, fields, alias, isWith = false, usedTables = []) {
+    this._ = {
+      brand: "Subquery",
+      sql: sql2,
+      selectedFields: fields,
+      alias,
+      isWith,
+      usedTables
+    };
+  }
+};
+var WithSubquery = class extends Subquery {
+  static [entityKind] = "WithSubquery";
+};
+
+// ../../node_modules/.bun/drizzle-orm@1.0.0-rc.1+6cb67a8f81be6bcf/node_modules/drizzle-orm/table.utils.js
 var TableName = /* @__PURE__ */ Symbol.for("drizzle:Name");
 
-// ../../node_modules/.bun/drizzle-orm@1.0.0-beta.18-7eb39f0+0354db235c5ceb35/node_modules/drizzle-orm/table.js
+// ../../node_modules/.bun/drizzle-orm@1.0.0-rc.1+6cb67a8f81be6bcf/node_modules/drizzle-orm/table.js
 var TableSchema = /* @__PURE__ */ Symbol.for("drizzle:Schema");
 var TableColumns = /* @__PURE__ */ Symbol.for("drizzle:Columns");
 var ExtraConfigColumns = /* @__PURE__ */ Symbol.for("drizzle:ExtraConfigColumns");
@@ -943,33 +967,15 @@ var Table = class {
   }
 };
 
-// ../../node_modules/.bun/drizzle-orm@1.0.0-beta.18-7eb39f0+0354db235c5ceb35/node_modules/drizzle-orm/subquery.js
-var Subquery = class {
-  static [entityKind] = "Subquery";
-  constructor(sql2, fields, alias, isWith = false, usedTables = []) {
-    this._ = {
-      brand: "Subquery",
-      sql: sql2,
-      selectedFields: fields,
-      alias,
-      isWith,
-      usedTables
-    };
-  }
-};
-var WithSubquery = class extends Subquery {
-  static [entityKind] = "WithSubquery";
-};
-
-// ../../node_modules/.bun/drizzle-orm@1.0.0-beta.18-7eb39f0+0354db235c5ceb35/node_modules/drizzle-orm/tracing.js
+// ../../node_modules/.bun/drizzle-orm@1.0.0-rc.1+6cb67a8f81be6bcf/node_modules/drizzle-orm/tracing.js
 var tracer = { startActiveSpan(name, fn) {
   return fn();
 } };
 
-// ../../node_modules/.bun/drizzle-orm@1.0.0-beta.18-7eb39f0+0354db235c5ceb35/node_modules/drizzle-orm/view-common.js
+// ../../node_modules/.bun/drizzle-orm@1.0.0-rc.1+6cb67a8f81be6bcf/node_modules/drizzle-orm/view-common.js
 var ViewBaseConfig = /* @__PURE__ */ Symbol.for("drizzle:ViewBaseConfig");
 
-// ../../node_modules/.bun/drizzle-orm@1.0.0-beta.18-7eb39f0+0354db235c5ceb35/node_modules/drizzle-orm/sql/sql.js
+// ../../node_modules/.bun/drizzle-orm@1.0.0-rc.1+6cb67a8f81be6bcf/node_modules/drizzle-orm/sql/sql.js
 var FakePrimitiveParam = class {
   static [entityKind] = "FakePrimitiveParam";
 };
@@ -991,6 +997,23 @@ function mergeQueries(queries) {
   }
   return result;
 }
+function _mergeQueries(queries) {
+  const result = {
+    sql: "",
+    params: []
+  };
+  const sqls = [];
+  for (const query of queries) {
+    sqls.push(query.sql);
+    result.params.push(...query.params);
+    if (query.typings?.length) {
+      if (!result.typings) result.typings = [];
+      result.typings.push(...query.typings);
+    }
+  }
+  result._sql = Object.assign(sqls, { raw: sqls });
+  return result;
+}
 var StringChunk = class {
   static [entityKind] = "StringChunk";
   value;
@@ -1035,8 +1058,8 @@ var SQL = class SQL2 {
       inlineParams: _config.inlineParams || this.shouldInlineParams,
       paramStartIndex: _config.paramStartIndex || { value: 0 }
     });
-    const { casing, escapeName, escapeParam, prepareTyping, inlineParams, paramStartIndex, invokeSource } = config;
-    return mergeQueries(chunks.map((chunk) => {
+    const { escapeName, escapeParam, prepareTyping, codecs, inlineParams, paramStartIndex, invokeSource } = config;
+    const mappedChunks = chunks.map((chunk) => {
       if (is(chunk, StringChunk)) return {
         sql: chunk.value.join(""),
         params: []
@@ -1075,7 +1098,7 @@ var SQL = class SQL2 {
         };
       }
       if (is(chunk, Column)) {
-        const columnName = casing.getColumnCasing(chunk);
+        const columnName = chunk.name;
         if (_config.invokeSource === "indexes") return {
           sql: escapeName(columnName),
           params: []
@@ -1095,21 +1118,33 @@ var SQL = class SQL2 {
         };
       }
       if (is(chunk, Param)) {
-        if (is(chunk.value, Placeholder)) return {
-          sql: escapeParam(paramStartIndex.value++, chunk),
-          params: [chunk],
-          typings: ["none"]
-        };
-        const mappedValue = chunk.value === null ? null : chunk.encoder.mapToDriverValue(chunk.value);
-        if (is(mappedValue, SQL2)) return this.buildQueryFromSourceParams([mappedValue], config);
+        if (is(chunk.value, SQL2)) return this.buildQueryFromSourceParams([chunk.value], config);
+        const useCodecs = codecs && is(chunk.encoder, Column);
+        if (is(chunk.value, Placeholder)) {
+          const escaped2 = escapeParam(paramStartIndex.value++, chunk);
+          chunk.codec = useCodecs ? (value) => codecs.apply(chunk.encoder, "normalizeParam", value) : void 0;
+          return {
+            sql: useCodecs ? codecs.apply(chunk.encoder, "castParam", escaped2) : escaped2,
+            params: [chunk],
+            typings: ["none"]
+          };
+        }
+        let mappedValue;
+        if (chunk.value === null) mappedValue = chunk.value;
+        else {
+          mappedValue = chunk.encoder.mapToDriverValue.isNoop ? chunk.value : chunk.encoder.mapToDriverValue(chunk.value);
+          if (is(mappedValue, SQL2)) return this.buildQueryFromSourceParams([mappedValue], config);
+          if (useCodecs) mappedValue = codecs.apply(chunk.encoder, "normalizeParam", mappedValue);
+        }
         if (inlineParams) return {
           sql: this.mapInlineParam(mappedValue, config),
           params: []
         };
         let typings = ["none"];
         if (prepareTyping) typings = [prepareTyping(chunk.encoder)];
+        const escaped = escapeParam(paramStartIndex.value++, mappedValue);
         return {
-          sql: escapeParam(paramStartIndex.value++, mappedValue),
+          sql: useCodecs ? codecs.apply(chunk.encoder, "castParam", escaped) : escaped,
           params: [mappedValue],
           typings
         };
@@ -1162,7 +1197,9 @@ var SQL = class SQL2 {
         params: [chunk],
         typings: ["none"]
       };
-    }));
+    });
+    if (_config.tagged) return _mergeQueries(mappedChunks);
+    return mergeQueries(mappedChunks);
   }
   mapInlineParam(chunk, { escapeString }) {
     if (chunk === null) return "null";
@@ -1214,7 +1251,9 @@ function isDriverValueEncoder(value) {
   return typeof value === "object" && value !== null && "mapToDriverValue" in value && typeof value.mapToDriverValue === "function";
 }
 var noopDecoder = { mapFromDriverValue: (value) => value };
+noopDecoder.mapFromDriverValue.isNoop = true;
 var noopEncoder = { mapToDriverValue: (value) => value };
+noopEncoder.mapToDriverValue.isNoop = true;
 var noopMapper = {
   ...noopDecoder,
   ...noopEncoder
@@ -1226,9 +1265,10 @@ var Param = class {
   * @param value - Parameter value
   * @param encoder - Encoder to convert the value to a driver parameter
   */
-  constructor(value, encoder = noopEncoder) {
+  constructor(value, encoder = noopEncoder, codec) {
     this.value = value;
     this.encoder = encoder;
+    this.codec = codec;
   }
   getSQL() {
     return new SQL([this]);
@@ -1274,7 +1314,58 @@ function sql(strings, ...params) {
     return new Param(value, encoder);
   }
   _sql.param = param;
+  function comment(input) {
+    const encoded = sqlCommenter(input);
+    if (!encoded.length) return void 0;
+    return sql.raw(encoded);
+  }
+  _sql.comment = comment;
 })(sql || (sql = {}));
+function sqlCommenter(input) {
+  const encoded = sqlCommenter.encodeInput(input);
+  if (!encoded.length) return "";
+  return `/*${encoded}*/`;
+}
+(function(_sqlCommenter) {
+  function merge(input1, input2) {
+    let encoded;
+    if (typeof input1 === "object" && typeof input2 === "object") encoded = encodeInput({
+      ...input1,
+      ...input2
+    });
+    else if (input1 && input2) encoded = [encodeInput(input1), encodeInput(input2)].filter((i) => i.length).join(",");
+    else if (input2) encoded = encodeInput(input2);
+    else if (input1) encoded = encodeInput(input1);
+    else return "";
+    if (!encoded.length) return "";
+    return `/*${encoded}*/`;
+  }
+  _sqlCommenter.merge = merge;
+  function encodeInput(input) {
+    if (typeof input === "string") {
+      if (!input.length) return input;
+      return sanitizeStringInput(input);
+    }
+    const parts = [];
+    for (const [key, value] of Object.entries(input)) {
+      if (value === null || value === void 0 || value === "") continue;
+      const encodedKey = sanitizeObjectElement(key);
+      const encodedValue = sanitizeObjectElement(String(value));
+      parts.push(`${encodedKey}='${encodedValue}'`);
+    }
+    if (!parts.length) return "";
+    return parts.sort().join(",");
+  }
+  _sqlCommenter.encodeInput = encodeInput;
+  function sanitizeObjectElement(key) {
+    return encodeURIComponent(key).replace(/'/g, `\\'`);
+  }
+  _sqlCommenter.sanitizeObjectElement = sanitizeObjectElement;
+  function sanitizeStringInput(input) {
+    return input.replace(/\/\*/g, "/ *").replace(/\*\//g, "* /");
+  }
+  _sqlCommenter.sanitizeStringInput = sanitizeStringInput;
+})(sqlCommenter || (sqlCommenter = {}));
 (function(_SQL) {
   class Aliased {
     static [entityKind] = "SQL.Aliased";
@@ -1351,7 +1442,7 @@ Subquery.prototype.getSQL = function() {
   return new SQL([this]);
 };
 
-// ../../node_modules/.bun/drizzle-orm@1.0.0-beta.18-7eb39f0+0354db235c5ceb35/node_modules/drizzle-orm/sql/expressions/conditions.js
+// ../../node_modules/.bun/drizzle-orm@1.0.0-rc.1+6cb67a8f81be6bcf/node_modules/drizzle-orm/sql/expressions/conditions.js
 function bindIfParam(value, column) {
   if (isDriverValueEncoder(column) && !isSQLWrapper(value) && !is(value, Param) && !is(value, Placeholder) && !is(value, Column) && !is(value, Table) && !is(value, View)) return new Param(value, column);
   return value;
@@ -1368,7 +1459,7 @@ function and(...unfilteredConditions) {
   if (conditions.length === 1) return new SQL(conditions);
   return new SQL([
     new StringChunk("("),
-    sql.join(conditions, new StringChunk(" and ")),
+    sql.join(conditions.map((c) => sql`(${c})`), new StringChunk(" and ")),
     new StringChunk(")")
   ]);
 }
@@ -1378,7 +1469,7 @@ function or(...unfilteredConditions) {
   if (conditions.length === 1) return new SQL(conditions);
   return new SQL([
     new StringChunk("("),
-    sql.join(conditions, new StringChunk(" or ")),
+    sql.join(conditions.map((c) => sql`(${c})`), new StringChunk(" or ")),
     new StringChunk(")")
   ]);
 }
@@ -1418,7 +1509,7 @@ function like(column, value) {
   return sql`${column} like ${value}`;
 }
 
-// ../../node_modules/.bun/drizzle-orm@1.0.0-beta.18-7eb39f0+0354db235c5ceb35/node_modules/drizzle-orm/sql/expressions/select.js
+// ../../node_modules/.bun/drizzle-orm@1.0.0-rc.1+6cb67a8f81be6bcf/node_modules/drizzle-orm/sql/expressions/select.js
 function asc(column) {
   return sql`${column} asc`;
 }
@@ -1426,7 +1517,7 @@ function desc(column) {
   return sql`${column} desc`;
 }
 
-// ../../node_modules/.bun/drizzle-orm@1.0.0-beta.18-7eb39f0+0354db235c5ceb35/node_modules/drizzle-orm/sql/functions/aggregate.js
+// ../../node_modules/.bun/drizzle-orm@1.0.0-rc.1+6cb67a8f81be6bcf/node_modules/drizzle-orm/sql/functions/aggregate.js
 function count(expression) {
   return sql`count(${expression || sql.raw("*")})`.mapWith(Number);
 }
@@ -4426,7 +4517,7 @@ var Flush = bytes_default().H().end();
 var SSLRequest = bytes_default().i32(8).i32(80877103).end(8);
 var ExecuteUnnamed = Buffer.concat([bytes_default().E().str(bytes_default.N).i32(0).end(), Sync]);
 var DescribeUnnamed = bytes_default().D().str("S").str(bytes_default.N).end();
-var noop = () => {
+var noop2 = () => {
 };
 var retryRoutines = /* @__PURE__ */ new Set([
   "FetchPreparedStatement",
@@ -4471,7 +4562,7 @@ var errorFields = {
   82: "routine"
   // R
 };
-function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose = noop } = {}) {
+function Connection(options, queues = {}, { onopen = noop2, onend = noop2, onclose = noop2 } = {}) {
   const {
     sslnegotiation,
     ssl,
@@ -4954,7 +5045,7 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
       return query.resolve(query.statement), write(Sync);
   }
   async function Authentication(x, type = x.readUInt32BE(5)) {
-    (type === 3 ? AuthenticationCleartextPassword : type === 5 ? AuthenticationMD5Password : type === 10 ? SASL : type === 11 ? SASLContinue : type === 12 ? SASLFinal : type !== 0 ? UnknownAuth : noop)(x, type);
+    (type === 3 ? AuthenticationCleartextPassword : type === 5 ? AuthenticationMD5Password : type === 10 ? SASL : type === 11 ? SASLContinue : type === 12 ? SASLFinal : type !== 0 ? UnknownAuth : noop2)(x, type);
   }
   async function AuthenticationCleartextPassword() {
     const payload = await Pass();
@@ -5241,7 +5332,7 @@ function xor(a, b2) {
 function timer(fn, seconds) {
   seconds = typeof seconds === "function" ? seconds() : seconds;
   if (!seconds)
-    return { cancel: noop, start: noop };
+    return { cancel: noop2, start: noop2 };
   let timer2;
   return {
     cancel() {
@@ -5259,7 +5350,7 @@ function timer(fn, seconds) {
 }
 
 // ../../node_modules/.bun/postgres@3.4.8/node_modules/postgres/src/subscribe.js
-var noop2 = () => {
+var noop3 = () => {
 };
 function Subscribe(postgres2, options) {
   const subscribers = /* @__PURE__ */ new Map(), slot = "postgresjs_" + Math.random().toString(36).slice(2), state = {};
@@ -5296,7 +5387,7 @@ function Subscribe(postgres2, options) {
     return close();
   };
   return subscribe;
-  async function subscribe(event, fn, onsubscribe = noop2, onerror = noop2) {
+  async function subscribe(event, fn, onsubscribe = noop3, onerror = noop3) {
     event = parseEvent(event);
     if (!connection2)
       connection2 = init(sql2, slot, options.publications);

package/dist/authorization/index.d.ts

@@ -1,5 +1,5 @@
-import { f as Policy$1, A as AuthUser, a as AuthorizationResponse, G as Gate, b as AuthorizeOptions } from '../Gate-CNkBYf8m.js';
-export { c as GateCallback, d as GateDefinition, e as GateOptions, P as PolicyClass, g as PolicyMethod, h as PolicyRegistration, i as ResourceAction, R as Response, j as ResponseBuilder, k as authorize, l as can, m as cannot, n as createGate, o as defineGate, p as getGate, s as setGate } from '../Gate-CNkBYf8m.js';
+import { f as Policy$1, A as AuthUser, a as AuthorizationResponse, G as Gate, b as AuthorizeOptions } from '../Gate-CynjZCtS.js';
+export { c as GateCallback, d as GateDefinition, e as GateOptions, P as PolicyClass, g as PolicyMethod, h as PolicyRegistration, i as ResourceAction, R as Response, j as ResponseBuilder, k as authorize, l as can, m as cannot, n as createGate, o as defineGate, p as getGate, s as setGate } from '../Gate-CynjZCtS.js';
 import { Context } from 'hono';
 import { M as Middleware } from '../index-9_Jzj5jo.js';
 

package/dist/authorization/index.js

@@ -364,13 +364,29 @@ var Gate = class {
   }
   /**
    * Check a policy for the given ability.
+   *
+   * The subject may be a class instance (policy resolved via its constructor)
+   * or a `[ModelClass, record]` / `['key', record]` tuple. The tuple form is
+   * required for plain records returned by the ORM, which carry no constructor
+   * information.
    */
   async checkPolicy(ability, user, model, additionalArgs) {
-    const modelConstructor = model?.constructor;
-    if (!modelConstructor) {
+    let policyKey;
+    let subject = model;
+    let hasSubject = true;
+    if (Array.isArray(model) && model.length === 2 && (typeof model[0] === "function" || typeof model[0] === "string")) {
+      policyKey = model[0];
+      subject = model[1];
+    } else if (typeof model === "function") {
+      policyKey = model;
+      hasSubject = false;
+    } else {
+      policyKey = model?.constructor;
+    }
+    if (!policyKey) {
       return void 0;
     }
-    const policyClass = this.policies.get(modelConstructor);
+    const policyClass = this.policies.get(policyKey);
     if (!policyClass) {
       return void 0;
     }
@@ -383,7 +399,7 @@ var Gate = class {
     }
     const method = policy[ability];
     if (typeof method === "function") {
-      return method.call(policy, user, model, ...additionalArgs);
+      return hasSubject ? method.call(policy, user, subject, ...additionalArgs) : method.call(policy, user, ...additionalArgs);
     }
     return void 0;
   }

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { E as ErrorResponse, S as ServiceProvider, C as Container, c as ServiceBindings, Q as QueueManager, N as NotificationManager } from './Application-DtWDHXr1.js';
-export { A as Application, d as ApplicationListenOptions, e as AuthPayload, f as CSRF_FORM_FIELD, g as CSRF_HEADER_NAME, h as CSRF_TOKEN_KEY, P as ContainerProvider, i as ContextualBinding, j as ContextualBindingBuilder, k as ContextualNeedsBuilder, m as Controller, n as ControllerInertiaProps, o as CsrfOptions, p as DatabaseChannelOptions, q as DatabaseNotification, r as ExceptionClass, t as ExceptionHandler, u as ExceptionHandlerOptions, v as ExceptionRenderer, w as ExceptionReporter, F as FailedJob, H as HostAuthorizationOptions, x as HstsOptions, I as InertiaOptions, y as InertiaPagePayload, z as InertiaResponse, B as InertiaSharedProps, J as InertiaSsrContext, K as InertiaSsrOptions, L as InertiaSsrRenderer, M as InertiaSsrResult, O as InferInertiaProps, R as Job, T as JobClass, U as JobFailureHandler, V as JobHandler, W as JobOptions, X as Notifiable, Y as Notification, Z as NotificationAttachment, _ as NotificationChannel, $ as NotificationChannelFactory, a0 as NotificationClass, a1 as NotificationMailMessage, a2 as NotificationManagerOptions, a3 as ProviderManager, a4 as QueueConfig, a5 as QueueDriver, a6 as QueueDriverFactory, a7 as QueuedJob, a8 as RendererRegistration, a9 as ResolvedSharedInertiaProps, aa as ResourceRouteOptions, ab as RouteBuilder, ac as RouteContractOptions, ad as RouteDefinition, ae as RouteOpenApiMetadata, af as RouteResourceAction, ag as Router, ah as SecurityHeadersOptions, ai as SentNotification, aj as ServiceBinding, ak as ServiceClass, al as ServiceFactory, am as ServiceProviderClass, an as ServiceProviderConstructor, ao as ServiceProviderOptions, ap as SharedInertiaPropsResolver, aq as SlackAttachment, ar as SlackBlock, as as SlackMessage, at as VALIDATED_DATA_KEY, au as ValidateRequestOptions, av as ValidationSchema, aw as WorkerOptions, ax as abort, ay as abortIf, az as abortUnless, aA as clearJobRegistry, aB as createApp, aC as createContainer, aD as createCsrfMiddleware, aE as createExceptionHandler, aF as createHostAuthorizationMiddleware, aG as createNotificationManager, aH as createQueueManager, aI as createSecurityHeaders, aJ as csrfField, aK as formatValidationErrors, aL as getContainer, aM as getCsrfToken, aN as getExceptionHandler, aO as getJob, aP as getNotificationManager, aQ as getQueueDriver, aR as getRegisteredJobs, aS as getValidatedData, aT as inertia, aU as parseRequestPayload, aV as registerJob, aW as resolve, aX as setContainer, aY as setExceptionHandler, aZ as setInertiaSharedProps, a_ as setNotificationManager, a$ as setQueueDriver, b0 as validate, b1 as validateRequest, b2 as validateRequestWith, b3 as validateSafe, b4 as verifyCsrfToken } from './Application-DtWDHXr1.js';
+import { E as ErrorResponse, S as ServiceProvider, C as Container, c as ServiceBindings, Q as QueueManager, N as NotificationManager } from './Application-CsylYL26.js';
+export { A as Application, d as ApplicationListenOptions, e as AuthPayload, f as CSRF_FORM_FIELD, g as CSRF_HEADER_NAME, h as CSRF_TOKEN_KEY, P as ContainerProvider, i as ContextualBinding, j as ContextualBindingBuilder, k as ContextualNeedsBuilder, m as Controller, n as ControllerInertiaProps, o as CsrfOptions, p as DatabaseChannelOptions, q as DatabaseNotification, r as ExceptionClass, t as ExceptionHandler, u as ExceptionHandlerOptions, v as ExceptionRenderer, w as ExceptionReporter, F as FailedJob, H as HostAuthorizationOptions, x as HstsOptions, I as InertiaOptions, y as InertiaPagePayload, z as InertiaResponse, B as InertiaSharedProps, J as InertiaSsrContext, K as InertiaSsrOptions, L as InertiaSsrRenderer, M as InertiaSsrResult, O as InferInertiaProps, R as Job, T as JobClass, U as JobFailureHandler, V as JobHandler, W as JobOptions, X as Notifiable, Y as Notification, Z as NotificationAttachment, _ as NotificationChannel, $ as NotificationChannelFactory, a0 as NotificationClass, a1 as NotificationMailMessage, a2 as NotificationManagerOptions, a3 as ProviderManager, a4 as QueueConfig, a5 as QueueDriver, a6 as QueueDriverFactory, a7 as QueuedJob, a8 as RendererRegistration, a9 as ResolvedSharedInertiaProps, aa as ResourceRouteOptions, ab as RouteBuilder, ac as RouteContractOptions, ad as RouteDefinition, ae as RouteOpenApiMetadata, af as RouteResourceAction, ag as Router, ah as SecurityHeadersOptions, ai as SentNotification, aj as ServiceBinding, ak as ServiceClass, al as ServiceFactory, am as ServiceProviderClass, an as ServiceProviderConstructor, ao as ServiceProviderOptions, ap as SharedInertiaPropsResolver, aq as SlackAttachment, ar as SlackBlock, as as SlackMessage, at as VALIDATED_DATA_KEY, au as ValidateRequestOptions, av as ValidationSchema, aw as WorkerOptions, ax as abort, ay as abortIf, az as abortUnless, aA as clearJobRegistry, aB as createApp, aC as createContainer, aD as createCsrfMiddleware, aE as createExceptionHandler, aF as createHostAuthorizationMiddleware, aG as createNotificationManager, aH as createQueueManager, aI as createSecurityHeaders, aJ as csrfField, aK as formatValidationErrors, aL as getContainer, aM as getCsrfToken, aN as getExceptionHandler, aO as getJob, aP as getNotificationManager, aQ as getQueueDriver, aR as getRegisteredJobs, aS as getValidatedData, aT as inertia, aU as parseRequestPayload, aV as registerJob, aW as resolve, aX as setContainer, aY as setExceptionHandler, aZ as setInertiaSharedProps, a_ as setNotificationManager, a$ as setQueueDriver, b0 as validate, b1 as validateRequest, b2 as validateRequestWith, b3 as validateSafe, b4 as verifyCsrfToken } from './Application-CsylYL26.js';
 import * as hono from 'hono';
 import { Context, MiddlewareHandler } from 'hono';
 export { Context } from 'hono';
@@ -35,10 +35,10 @@ export { DatabaseChannel, MailChannel, MailChannelOptions, MemoryChannel, SlackC
 import { B as BroadcastManager } from './BroadcastManager-AkIWUGJo.js';
 export { A as AuthMiddlewareOptions, a as BroadcastDriver, b as BroadcastDriverFactory, c as BroadcastEvent, d as BroadcastManagerOptions, e as BroadcastableEvent, C as Channel, f as ChannelAuthorizer, g as ChannelRegistration, P as PresenceBroadcastDriver, h as PresenceChannel, i as PresenceChannelAuthorizer, j as PresenceMember, k as PrivateChannel, S as SSEClient, l as SSEMiddlewareOptions, W as WebSocketClient, m as createBroadcastManager, n as getBroadcastManager, s as setBroadcastManager } from './BroadcastManager-AkIWUGJo.js';
 export { RedisClient as BroadcastRedisClient, RedisDriverOptions as BroadcastRedisDriverOptions, MemoryDriver as MemoryBroadcastDriver, RedisDriver as RedisBroadcastDriver, createTypedBroadcaster } from './broadcasting/index.js';
-import { I as InputInterface, P as ParsedSignature, O as OptionDefinition, a as CommandInstance, b as OutputInterface } from './ConsoleKernel-CqCVrdZs.js';
-export { A as ArgumentDefinition, c as CommandClass, C as ConsoleKernel, d as ConsoleKernelOptions, e as ProgressInterface, f as PromptInterface, S as ScheduledCommand, g as createConsoleKernel } from './ConsoleKernel-CqCVrdZs.js';
+import { I as InputInterface, P as ParsedSignature, O as OptionDefinition, a as CommandInstance, b as OutputInterface } from './ConsoleKernel-BsbMQ38T.js';
+export { A as ArgumentDefinition, c as CommandClass, C as ConsoleKernel, d as ConsoleKernelOptions, e as ProgressInterface, f as PromptInterface, S as ScheduledCommand, g as createConsoleKernel } from './ConsoleKernel-BsbMQ38T.js';
 import * as readline from 'readline';
-export { R as AuthResponse, A as AuthUser, a as AuthorizationResponse, b as AuthorizeOptions, G as Gate, c as GateCallback, d as GateDefinition, e as GateOptions, P as PolicyClass, f as PolicyInterface, g as PolicyMethod, h as PolicyRegistration, i as ResourceAction, j as ResponseBuilder, k as authorizeAbility, l as can, m as cannot, n as createGate, o as defineGate, p as getGate, s as setGate } from './Gate-CNkBYf8m.js';
+export { R as AuthResponse, A as AuthUser, a as AuthorizationResponse, b as AuthorizeOptions, G as Gate, c as GateCallback, d as GateDefinition, e as GateOptions, P as PolicyClass, f as PolicyInterface, g as PolicyMethod, h as PolicyRegistration, i as ResourceAction, j as ResponseBuilder, k as authorizeAbility, l as can, m as cannot, n as createGate, o as defineGate, p as getGate, s as setGate } from './Gate-CynjZCtS.js';
 export { AuthorizedContext, Policy, authorizeAllMiddleware, authorizeMiddleware, authorizeResourceMiddleware, definePolicy, withAuthorization } from './authorization/index.js';
 export { A as AppKeyring, D as DecryptOptions, a as EncryptOptions, b as EncryptedPayload, E as Encrypter, c as EncrypterConfig, H as HashAlgorithm, d as HmacOptions, P as PasswordHashOptions, R as RandomStringOptions, e as createEncrypter, f as decrypt, g as deriveAppKey, h as deriveAppKeyring, i as encrypt, j as generateAppKey, k as generateKey, l as getAppKeyringFromEnv, m as getEncrypter, n as normalizeAppKey, p as parseAppKey, o as parsePreviousAppKeys, s as setEncrypter } from './app-key-CsBfRC_Q.js';
 export { MessageSigner, SignMessageOptions, SignedMessageClaims, SignedUrlOptions, VerifySignedMessageOptions, VerifySignedUrlOptions, check as checkHash, generateOtp, generatePassword, generateSlug, hash, hashPassword, hmac, md5, needsRehash, pick, random, randomBase64, randomBase64Url, randomHex, randomInt, randomString, sample, secureCompare, sha256, sha512, shuffle, signUrl, urlSafeToken, uuid, verifyHmac, verifyPassword, verifySignedUrl } from './encryption/index.js';
@@ -160,6 +160,17 @@ interface RateLimitOptions {
      * @default 'rl:'
      */
     keyPrefix?: string;
+    /**
+     * Trust reverse-proxy headers for client IP resolution, checked in order:
+     * `CF-Connecting-IP`, `True-Client-IP`, `X-Real-IP`, then the first entry
+     * of `X-Forwarded-For`. Falls back to `server.requestIP()` when none are set.
+     *
+     * Enable ONLY when every request passes through a proxy that sets or strips
+     * these headers — on direct deployments clients can spoof them to bypass
+     * per-client limits. Ignored when a custom `keyGenerator` is supplied.
+     * @default false
+     */
+    trustProxy?: boolean;
 }
 /**
  * Create a rate limiting middleware.
@@ -732,11 +743,6 @@ declare class MethodNotAllowedException extends HttpException {
     static forMethod(method: string, allowedMethods: string[]): MethodNotAllowedException;
 }
 
-/**
- * Generate a production-friendly HTML error page.
- * Shows status code, a generic message, and a link back to the home page.
- * No stack traces or internal details are exposed.
- */
 declare function renderErrorPage(statusCode: number, message?: string): string;
 
 type ViewRenderer = (template: string, props: Record<string, unknown>) => Response | Promise<Response>;
@@ -868,7 +874,9 @@ declare class SchedulingServiceProvider extends ServiceProvider {
 }
 
 /**
- * Binds the Gate as a singleton in the container.
+ * Binds the Gate as a singleton in the container and exposes it as the
+ * global gate so `getGate()`, `can()`, and controller authorization helpers
+ * work without manual wiring.
  */
 declare class AuthorizationServiceProvider extends ServiceProvider {
     register(): void;