@guren/server 1.0.0-rc.13 → 1.0.0-rc.15

package/dist/lambda/index.d.ts

@@ -1,10 +1,11 @@
 import * as hono_aws_lambda from 'hono/aws-lambda';
 export { APIGatewayProxyResult, LambdaEvent } from 'hono/aws-lambda';
-import { A as Application } from '../Application-DtWDHXr1.js';
+import { A as Application } from '../Application-CddorcPa.js';
 import { S as Scheduler } from '../Scheduler-BstvSca7.js';
-import { C as ConsoleKernel } from '../ConsoleKernel-CqCVrdZs.js';
+import { C as ConsoleKernel } from '../ConsoleKernel-BlCJEZTR.js';
 import 'hono';
-import '../api-token-JOif2CtG.js';
+import '../api-token-BGOsfuI9.js';
+import '@guren/orm';
 import 'vite';
 import '../EventManager-CmIoLt7r.js';
 import '../CacheManager-BkvHEOZX.js';
@@ -16,7 +17,7 @@ import '../index-9_Jzj5jo.js';
 import '../app-key-CsBfRC_Q.js';
 import '../StorageManager-oZTHqaza.js';
 import '../HealthManager-DUyMIzsZ.js';
-import '../Gate-CNkBYf8m.js';
+import '../Gate-CynjZCtS.js';
 
 /**
  * SQS event record from AWS Lambda.
@@ -68,7 +69,7 @@ declare function createLambdaHandler(app: Application): <L extends hono_aws_lamb
     headers?: undefined;
     multiValueHeaders: Record<string, string[]>;
 } : {
-    headers: Record<string, string>;
+    headers: Record<string, string | string[]>;
     multiValueHeaders?: undefined;
 })>;
 /**

package/dist/mail/index.d.ts

@@ -244,6 +244,7 @@ declare class Mail {
     attach(attachment: MailAttachment): this;
     /**
      * Add a custom header.
+     * Rejects CR/LF characters to prevent SMTP header injection.
      */
     header(key: string, value: string): this;
     /**

package/dist/mail/index.js

@@ -599,8 +599,12 @@ var Mail = class {
   }
   /**
    * Add a custom header.
+   * Rejects CR/LF characters to prevent SMTP header injection.
    */
   header(key, value) {
+    if (/[\r\n]/.test(key) || /[\r\n]/.test(value)) {
+      throw new Error("Mail: header names and values cannot contain newline characters.");
+    }
     if (!this.message.headers) {
       this.message.headers = {};
     }

package/dist/mcp/index.d.ts

@@ -1,7 +1,8 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { S as ServiceProvider } from '../Application-DtWDHXr1.js';
+import { S as ServiceProvider } from '../Application-CddorcPa.js';
 import 'hono';
-import '../api-token-JOif2CtG.js';
+import '../api-token-BGOsfuI9.js';
+import '@guren/orm';
 import 'vite';
 import '../EventManager-CmIoLt7r.js';
 import '../CacheManager-BkvHEOZX.js';
@@ -14,7 +15,7 @@ import '../app-key-CsBfRC_Q.js';
 import '../StorageManager-oZTHqaza.js';
 import '../HealthManager-DUyMIzsZ.js';
 import '../Scheduler-BstvSca7.js';
-import '../Gate-CNkBYf8m.js';
+import '../Gate-CynjZCtS.js';
 
 /**
  * CLI functions that the MCP server wraps.

package/dist/notifications/index.d.ts

@@ -1,8 +1,9 @@
-import { _ as NotificationChannel, X as Notifiable, Y as Notification, q as DatabaseNotification, p as DatabaseChannelOptions, as as SlackMessage, ai as SentNotification } from '../Application-DtWDHXr1.js';
-export { Z as NotificationAttachment, $ as NotificationChannelFactory, a0 as NotificationClass, a1 as NotificationMailMessage, N as NotificationManager, a2 as NotificationManagerOptions, aq as SlackAttachment, ar as SlackBlock, aG as createNotificationManager, aP as getNotificationManager, a_ as setNotificationManager } from '../Application-DtWDHXr1.js';
+import { _ as NotificationChannel, X as Notifiable, Y as Notification, q as DatabaseNotification, p as DatabaseChannelOptions, as as SlackMessage, ai as SentNotification } from '../Application-CddorcPa.js';
+export { Z as NotificationAttachment, $ as NotificationChannelFactory, a0 as NotificationClass, a1 as NotificationMailMessage, N as NotificationManager, a2 as NotificationManagerOptions, aq as SlackAttachment, ar as SlackBlock, aG as createNotificationManager, aP as getNotificationManager, a_ as setNotificationManager } from '../Application-CddorcPa.js';
 import { M as MailManager } from '../MailManager-DpMvYiP9.js';
 import 'hono';
-import '../api-token-JOif2CtG.js';
+import '../api-token-BGOsfuI9.js';
+import '@guren/orm';
 import 'vite';
 import '../EventManager-CmIoLt7r.js';
 import '../CacheManager-BkvHEOZX.js';
@@ -14,7 +15,7 @@ import '../app-key-CsBfRC_Q.js';
 import '../StorageManager-oZTHqaza.js';
 import '../HealthManager-DUyMIzsZ.js';
 import '../Scheduler-BstvSca7.js';
-import '../Gate-CNkBYf8m.js';
+import '../Gate-CynjZCtS.js';
 
 /**
  * Mail notification channel.

package/dist/queue/index.d.ts

@@ -1,8 +1,9 @@
-import { a5 as QueueDriver, a7 as QueuedJob, F as FailedJob, aw as WorkerOptions } from '../Application-DtWDHXr1.js';
-export { R as Job, T as JobClass, U as JobFailureHandler, V as JobHandler, W as JobOptions, a4 as QueueConfig, a6 as QueueDriverFactory, Q as QueueManager, aA as clearJobRegistry, aH as createQueueManager, aO as getJob, aQ as getQueueDriver, aR as getRegisteredJobs, aV as registerJob, a$ as setQueueDriver } from '../Application-DtWDHXr1.js';
+import { a5 as QueueDriver, a7 as QueuedJob, F as FailedJob, aw as WorkerOptions } from '../Application-CddorcPa.js';
+export { R as Job, T as JobClass, U as JobFailureHandler, V as JobHandler, W as JobOptions, a4 as QueueConfig, a6 as QueueDriverFactory, Q as QueueManager, aA as clearJobRegistry, aH as createQueueManager, aO as getJob, aQ as getQueueDriver, aR as getRegisteredJobs, aV as registerJob, a$ as setQueueDriver } from '../Application-CddorcPa.js';
 import { Redis } from 'ioredis';
 import 'hono';
-import '../api-token-JOif2CtG.js';
+import '../api-token-BGOsfuI9.js';
+import '@guren/orm';
 import 'vite';
 import '../EventManager-CmIoLt7r.js';
 import '../CacheManager-BkvHEOZX.js';
@@ -15,7 +16,7 @@ import '../app-key-CsBfRC_Q.js';
 import '../StorageManager-oZTHqaza.js';
 import '../HealthManager-DUyMIzsZ.js';
 import '../Scheduler-BstvSca7.js';
-import '../Gate-CNkBYf8m.js';
+import '../Gate-CynjZCtS.js';
 
 /**
  * In-memory queue driver for development and testing.

package/dist/runtime/index.d.ts

@@ -1,7 +1,8 @@
-import { A as Application } from '../Application-DtWDHXr1.js';
-export { D as DevBannerOptions, G as GUREN_ASCII_ART, a as StartViteDevServerOptions, b as StartedViteDevServer, l as logDevServerBanner, s as startViteDevServer } from '../Application-DtWDHXr1.js';
+import { A as Application } from '../Application-CddorcPa.js';
+export { D as DevBannerOptions, G as GUREN_ASCII_ART, a as StartViteDevServerOptions, b as StartedViteDevServer, l as logDevServerBanner, s as startViteDevServer } from '../Application-CddorcPa.js';
 import 'hono';
-import '../api-token-JOif2CtG.js';
+import '../api-token-BGOsfuI9.js';
+import '@guren/orm';
 import 'vite';
 import '../EventManager-CmIoLt7r.js';
 import '../CacheManager-BkvHEOZX.js';
@@ -14,7 +15,7 @@ import '../app-key-CsBfRC_Q.js';
 import '../StorageManager-oZTHqaza.js';
 import '../HealthManager-DUyMIzsZ.js';
 import '../Scheduler-BstvSca7.js';
-import '../Gate-CNkBYf8m.js';
+import '../Gate-CynjZCtS.js';
 
 type RootPublicAssetsConfig = boolean | RootPublicAssetsOptions;
 interface RootPublicAssetsOptions {

package/dist/runtime/index.js

@@ -315,6 +315,20 @@ function parseImportMap(value, options = {}) {
   }
 }
 
+// src/encryption/Hash.ts
+import {
+  createHash,
+  createHmac,
+  randomBytes,
+  scrypt,
+  timingSafeEqual
+} from "crypto";
+import { promisify } from "util";
+var scryptAsync = promisify(scrypt);
+function hash(value, algorithm = "sha256", encoding = "hex") {
+  return createHash(algorithm).update(value).digest(encoding);
+}
+
 // src/http/inertia-assets.ts
 var DEFAULT_STYLES_ENTRY = "/public/assets/app.css";
 var DEFAULT_DEV_STYLES_ENTRY = "/resources/css/app.css";
@@ -460,6 +474,12 @@ function autoConfigureInertiaAssets(app, options) {
   const clientEntry = clientManifest?.["resources/js/app.tsx"];
   const clientEntryFile = getManifestFile(clientEntry);
   const clientCssFiles = getManifestCss(clientEntry);
+  if (clientManifest?.__raw__) {
+    setEnvIfUserDidNotProvide(
+      "GUREN_INERTIA_VERSION",
+      hash(clientManifest.__raw__, "sha1").slice(0, 12)
+    );
+  }
   if (clientEntryFile) {
     setEnvIfUserDidNotProvide("GUREN_INERTIA_ENTRY", `/public/assets/${clientEntryFile.replace(/^\//u, "")}`);
   }
@@ -513,7 +533,8 @@ function captureInertiaEnvFlags() {
     GUREN_INERTIA_ENTRY: process.env.GUREN_INERTIA_ENTRY !== void 0,
     GUREN_INERTIA_STYLES: process.env.GUREN_INERTIA_STYLES !== void 0,
     GUREN_INERTIA_SSR_ENTRY: process.env.GUREN_INERTIA_SSR_ENTRY !== void 0,
-    GUREN_INERTIA_SSR_MANIFEST: process.env.GUREN_INERTIA_SSR_MANIFEST !== void 0
+    GUREN_INERTIA_SSR_MANIFEST: process.env.GUREN_INERTIA_SSR_MANIFEST !== void 0,
+    GUREN_INERTIA_VERSION: process.env.GUREN_INERTIA_VERSION !== void 0
   };
 }
 function resolveDevSsrEntry(options) {
@@ -552,6 +573,10 @@ function loadViteManifest(candidatePaths, label) {
         value: manifestPath,
         enumerable: false
       });
+      Object.defineProperty(manifest, "__raw__", {
+        value: raw,
+        enumerable: false
+      });
       return manifest;
     } catch (error) {
       if (error.code !== "ENOENT") {
@@ -615,7 +640,7 @@ import standard from "figlet/importable-fonts/Standard.js";
 // package.json
 var package_default = {
   name: "@guren/server",
-  version: "1.0.0-rc.13",
+  version: "1.0.0-rc.15",
   type: "module",
   license: "MIT",
   repository: {
@@ -720,14 +745,15 @@ var package_default = {
     test: "bun test"
   },
   dependencies: {
-    "@guren/inertia-client": "^1.0.0-rc.12",
+    "@guren/inertia-client": "^1.0.0-rc.14",
+    "@guren/orm": "^1.0.0-rc.14",
     "@modelcontextprotocol/sdk": "^1.27.1",
     chalk: "^5.3.0",
     consola: "^3.4.2",
     figlet: "^1.7.0",
-    hono: "^4.12.8",
+    hono: "^4.12.18",
     ioredis: "^5.9.1",
-    nodemailer: "^7.0.12"
+    nodemailer: "^8.0.4"
   },
   peerDependencies: {
     "@aws-sdk/client-s3": "^3.0.0",
@@ -749,7 +775,7 @@ var package_default = {
   devDependencies: {
     "@types/ioredis": "^5.0.0",
     "@types/node": "^20.14.10",
-    "@types/nodemailer": "^7.0.5",
+    "@types/nodemailer": "^8.0.1",
     tsup: "^8.5.0",
     typescript: "^5.4.0",
     vite: "^8.0.0"

package/dist/storage/index.d.ts

@@ -22,6 +22,7 @@ declare class LocalDriver implements StorageDriver {
     constructor(options: LocalDriverOptions);
     /**
      * Get the full path for a file.
+     * Rejects paths that resolve outside the storage root (e.g. via `../`).
      */
     private fullPath;
     /**

package/dist/storage/index.js

@@ -11,7 +11,7 @@ import {
   rename
 } from "fs/promises";
 import { existsSync } from "fs";
-import { join, dirname } from "path";
+import { join, dirname, resolve, sep } from "path";
 var LocalDriver = class {
   root;
   baseUrl;
@@ -23,9 +23,15 @@ var LocalDriver = class {
   }
   /**
    * Get the full path for a file.
+   * Rejects paths that resolve outside the storage root (e.g. via `../`).
    */
   fullPath(path) {
-    return join(this.root, path);
+    const root = resolve(this.root);
+    const candidate = resolve(root, path);
+    if (candidate !== root && !candidate.startsWith(root + sep)) {
+      throw new Error(`LocalDriver: path escapes the storage root: "${path}"`);
+    }
+    return candidate;
   }
   /**
    * Ensure the directory exists.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guren/server",
-  "version": "1.0.0-rc.13",
+  "version": "1.0.0-rc.15",
   "type": "module",
   "license": "MIT",
   "repository": {
@@ -105,14 +105,15 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@guren/inertia-client": "^1.0.0-rc.12",
+    "@guren/inertia-client": "^1.0.0-rc.14",
+    "@guren/orm": "^1.0.0-rc.14",
     "@modelcontextprotocol/sdk": "^1.27.1",
     "chalk": "^5.3.0",
     "consola": "^3.4.2",
     "figlet": "^1.7.0",
-    "hono": "^4.12.8",
+    "hono": "^4.12.18",
     "ioredis": "^5.9.1",
-    "nodemailer": "^7.0.12"
+    "nodemailer": "^8.0.4"
   },
   "peerDependencies": {
     "@aws-sdk/client-s3": "^3.0.0",
@@ -134,7 +135,7 @@
   "devDependencies": {
     "@types/ioredis": "^5.0.0",
     "@types/node": "^20.14.10",
-    "@types/nodemailer": "^7.0.5",
+    "@types/nodemailer": "^8.0.1",
     "tsup": "^8.5.0",
     "typescript": "^5.4.0",
     "vite": "^8.0.0"