@guren/server 1.0.0-rc.14 → 1.0.0-rc.15

package/dist/{Application-CsylYL26.d.ts → Application-CddorcPa.d.ts}

@@ -1,6 +1,6 @@
 import * as hono from 'hono';
 import { Context, MiddlewareHandler, Hono, ExecutionContext } from 'hono';
-import { A as AuthManager, O as OAuthManager, a as AuthContext, b as ApiToken, C as CreateSessionMiddlewareOptions } from './api-token-JOif2CtG.js';
+import { A as AuthManager, O as OAuthManager, a as AuthContext, b as ApiToken, C as CreateSessionMiddlewareOptions } from './api-token-BGOsfuI9.js';
 import { InlineConfig, ViteDevServer } from 'vite';
 import { E as EventManager } from './EventManager-CmIoLt7r.js';
 import { C as CacheManager } from './CacheManager-BkvHEOZX.js';

package/dist/{ConsoleKernel-BsbMQ38T.d.ts → ConsoleKernel-BlCJEZTR.d.ts}

@@ -1,4 +1,4 @@
-import { C as Container } from './Application-CsylYL26.js';
+import { C as Container } from './Application-CddorcPa.js';
 
 /**
  * Parsed argument definition.

package/dist/api-token-BGOsfuI9.d.ts

@@ -0,0 +1,598 @@
+import { MiddlewareHandler, Context } from 'hono';
+import { Model } from '@guren/orm';
+
+type SessionData = Record<string, unknown>;
+interface SessionStore {
+    /**
+     * Read a session by its opaque identifier.
+     * Returns undefined when the session does not exist or has expired.
+     */
+    read(id: string): Promise<SessionData | undefined>;
+    /**
+     * Persist a session using upsert semantics for the given opaque identifier.
+     */
+    write(id: string, data: SessionData, ttlSeconds: number): Promise<void>;
+    /**
+     * Destroy a session. Implementations must treat repeated calls as safe.
+     */
+    destroy(id: string): Promise<void>;
+}
+declare class MemorySessionStore implements SessionStore {
+    private readonly now;
+    private readonly store;
+    constructor(now?: () => number);
+    read(id: string): Promise<SessionData | undefined>;
+    write(id: string, data: SessionData, ttlSeconds: number): Promise<void>;
+    destroy(id: string): Promise<void>;
+}
+interface SessionOptions {
+    cookieName?: string;
+    cookiePath?: string;
+    cookieDomain?: string;
+    cookieSecure?: boolean;
+    cookieSameSite?: 'Strict' | 'Lax' | 'None';
+    cookieHttpOnly?: boolean;
+    cookieMaxAgeSeconds?: number;
+    ttlSeconds?: number;
+    store?: SessionStore;
+}
+interface Session {
+    readonly id: string;
+    readonly isNew: boolean;
+    get<T = unknown>(key: string): T | undefined;
+    set<T = unknown>(key: string, value: T): void;
+    has(key: string): boolean;
+    forget(key: string): void;
+    flush(): void;
+    all(): SessionData;
+    regenerate(): void;
+    invalidate(): void;
+    flash(key: string, value: unknown): void;
+    getFlash<T = unknown>(key: string): T | undefined;
+    reflash(): void;
+    keep(...keys: string[]): void;
+}
+interface CreateSessionMiddlewareOptions extends SessionOptions {
+}
+declare function createSessionMiddleware(options?: CreateSessionMiddlewareOptions): MiddlewareHandler;
+declare function getSessionFromContext<T extends Session = Session>(ctx: {
+    get: (key: string) => unknown;
+}): T | undefined;
+
+type AuthCredentials = Record<string, unknown>;
+interface Authenticatable {
+    getAuthIdentifier(): unknown;
+    getAuthPassword(): string | null | undefined;
+    getRememberToken?(): string | null | undefined;
+    setRememberToken?(token: string | null): void | Promise<void>;
+}
+interface Guard<User = Authenticatable> {
+    check(): Promise<boolean>;
+    guest(): Promise<boolean>;
+    user<T = User>(): Promise<T | null>;
+    id(): Promise<unknown>;
+    login<T = User>(user: T, remember?: boolean): Promise<void>;
+    logout(): Promise<void>;
+    attempt(credentials: AuthCredentials, remember?: boolean): Promise<boolean>;
+    validate(credentials: AuthCredentials): Promise<User | null>;
+    session<T extends Session = Session>(): T | undefined;
+}
+interface UserProvider<User = Authenticatable> {
+    retrieveById(identifier: unknown): Promise<User | null>;
+    retrieveByCredentials(credentials: AuthCredentials): Promise<User | null>;
+    validateCredentials(user: User, credentials: AuthCredentials): Promise<boolean>;
+    getId(user: User): unknown;
+    setRememberToken?(user: User, token: string | null): Promise<void> | void;
+    getRememberToken?(user: User): Promise<string | null> | string | null;
+}
+interface GuardContext {
+    ctx: Context;
+    session: Session | undefined;
+    manager: AuthManagerContract;
+}
+type GuardFactory<User = Authenticatable> = (context: GuardContext) => Guard<User>;
+interface ProviderFactory<User = Authenticatable> {
+    (manager: AuthManagerContract): UserProvider<User>;
+}
+interface AuthManagerOptions {
+    defaultGuard?: string;
+}
+interface AttachContextOptions {
+    guard?: string;
+}
+interface AuthContext<User = Authenticatable> {
+    check(): Promise<boolean>;
+    guest(): Promise<boolean>;
+    user<T = User>(): Promise<T | null>;
+    userOrFail<T = User>(): Promise<T>;
+    id(): Promise<unknown>;
+    login<T = User>(user: T, remember?: boolean): Promise<void>;
+    attempt(credentials: AuthCredentials, remember?: boolean): Promise<boolean>;
+    logout(): Promise<void>;
+    guard<T = User>(name?: string): Guard<T>;
+    session<T extends Session = Session>(): T | undefined;
+}
+interface AuthManagerContract {
+    registerGuard<User = Authenticatable>(name: string, factory: GuardFactory<User>): void;
+    registerProvider<User = Authenticatable>(name: string, factory: ProviderFactory<User>): void;
+    getProvider<User = Authenticatable>(name: string): UserProvider<User>;
+    createGuard<User = Authenticatable>(name: string, context: GuardContext): Guard<User>;
+    guardNames(): string[];
+    setDefaultGuard(name: string): void;
+    getDefaultGuard(): string;
+    createAuthContext(ctx: Context, options?: AttachContextOptions): AuthContext;
+}
+
+interface PasswordHasher {
+    hash(plain: string): Promise<string>;
+    verify(hashed: string, plain: string): Promise<boolean>;
+    needsRehash?(hashed: string): boolean;
+}
+
+declare abstract class BaseUserProvider<User extends Authenticatable = Authenticatable> implements UserProvider<User> {
+    abstract retrieveById(identifier: unknown): Promise<User | null>;
+    abstract retrieveByCredentials(credentials: AuthCredentials): Promise<User | null>;
+    abstract validateCredentials(user: User, credentials: AuthCredentials): Promise<boolean>;
+    abstract getId(user: User): unknown;
+    setRememberToken(user: User, token: string | null): Promise<void>;
+    getRememberToken(user: User): Promise<string | null>;
+}
+
+interface ModelUserProviderOptions {
+    idColumn?: string;
+    usernameColumn?: string;
+    passwordColumn?: string;
+    rememberTokenColumn?: string;
+    hasher?: PasswordHasher;
+    credentialsPasswordField?: string;
+}
+declare class ModelUserProvider<User extends Authenticatable = Authenticatable> extends BaseUserProvider<User> {
+    private readonly model;
+    private readonly idColumn;
+    private readonly usernameColumn;
+    private readonly passwordColumn;
+    private readonly rememberTokenColumn;
+    private readonly hasher;
+    private readonly credentialsPasswordField;
+    constructor(model: typeof Model, options?: ModelUserProviderOptions);
+    private cast;
+    retrieveById(identifier: unknown): Promise<User | null>;
+    retrieveByCredentials(credentials: AuthCredentials): Promise<User | null>;
+    validateCredentials(user: User, credentials: AuthCredentials): Promise<boolean>;
+    getId(user: User): unknown;
+    setRememberToken(user: User, token: string | null): Promise<void>;
+    getRememberToken(user: User): Promise<string | null>;
+}
+
+declare class AuthManager implements AuthManagerContract {
+    private readonly guards;
+    private readonly providers;
+    private defaultGuard;
+    constructor(options?: AuthManagerOptions);
+    registerGuard<User>(name: string, factory: GuardFactory<User>): void;
+    registerProvider<User>(name: string, factory: ProviderFactory<User>): void;
+    getProvider<User>(name: string): UserProvider<User>;
+    createGuard<User>(name: string, context: GuardContext): Guard<User>;
+    guardNames(): string[];
+    setDefaultGuard(name: string): void;
+    getDefaultGuard(): string;
+    createAuthContext(ctx: Context, options?: AttachContextOptions): AuthContext;
+    attempt(name: string, ctx: Context, credentials: AuthCredentials, remember?: boolean): Promise<boolean>;
+    /**
+     * Shorthand method to register a model-based authentication provider and session guard.
+     * This simplifies the common case of authenticating users via a database model.
+     *
+     * @param model - The model class to use for user authentication
+     * @param options - Options for the ModelUserProvider (partial, with defaults)
+     * @param providerName - Name for the provider (defaults to 'users')
+     * @param guardName - Name for the guard (defaults to 'web')
+     */
+    useModel(model: typeof Model<PlainObject>, options?: Partial<ModelUserProviderOptions>, providerName?: string, guardName?: string): void;
+}
+
+interface OAuthProviderConfig {
+    clientId: string;
+    clientSecret: string;
+    redirectUri: string;
+    authorizeUrl: string;
+    tokenUrl: string;
+    userInfoUrl: string;
+    scopes?: string[];
+    tokenAuthMethod?: 'client_secret_post' | 'client_secret_basic';
+    userInfoMethod?: 'GET' | 'POST';
+    mapProfile?: (raw: Record<string, unknown>, token: OAuthTokenResult) => OAuthUserProfile;
+}
+interface OAuthTokenResult {
+    accessToken: string;
+    tokenType?: string;
+    refreshToken?: string;
+    expiresIn?: number;
+    scope?: string;
+    raw: Record<string, unknown>;
+}
+interface OAuthUserProfile {
+    id: string;
+    email?: string;
+    name?: string;
+    avatar?: string;
+    token: OAuthTokenResult;
+    raw: Record<string, unknown>;
+}
+interface OAuthStatePayload {
+    provider: string;
+    redirectTo?: string;
+    expiresAt: Date;
+}
+interface OAuthStateStore {
+    store(stateHash: string, payload: OAuthStatePayload): Promise<void>;
+    find(stateHash: string): Promise<OAuthStatePayload | null>;
+    delete(stateHash: string): Promise<void>;
+}
+interface OAuthStateConfig {
+    expiresIn?: number;
+    stateLength?: number;
+    hashAlgorithm?: 'sha256' | 'sha512';
+}
+interface OAuthAuthorizeOptions {
+    scope?: string[];
+    redirectTo?: string;
+    state?: string;
+    extraParams?: Record<string, string>;
+}
+interface OAuthCallbackPayload {
+    code: string;
+    state: string;
+}
+interface OAuthManagerOptions {
+    stateStore?: OAuthStateStore;
+    stateConfig?: OAuthStateConfig;
+}
+declare class MemoryOAuthStateStore implements OAuthStateStore {
+    private readonly states;
+    store(stateHash: string, payload: OAuthStatePayload): Promise<void>;
+    find(stateHash: string): Promise<OAuthStatePayload | null>;
+    delete(stateHash: string): Promise<void>;
+    clear(): void;
+}
+declare class OAuthManager {
+    private readonly providers;
+    private readonly stateStore;
+    private readonly stateConfig;
+    constructor(options?: OAuthManagerOptions);
+    registerProvider(name: string, config: OAuthProviderConfig): void;
+    providerNames(): string[];
+    getProvider(name: string): OAuthProviderConfig;
+    authorize(providerName: string, options?: OAuthAuthorizeOptions): Promise<{
+        url: string;
+        state: string;
+        expiresAt: Date;
+    }>;
+    user(providerName: string, payload: OAuthCallbackPayload): Promise<OAuthUserProfile>;
+}
+declare function createOAuthManager(options?: OAuthManagerOptions): OAuthManager;
+declare function createOAuthState(provider: string, store: OAuthStateStore, config?: OAuthStateConfig, redirectTo?: string, fixedState?: string): Promise<{
+    state: string;
+    expiresAt: Date;
+}>;
+declare function verifyOAuthState(state: string, provider: string, store: OAuthStateStore, config?: OAuthStateConfig): Promise<OAuthStatePayload | null>;
+declare function buildOAuthAuthorizeUrl(provider: OAuthProviderConfig, state: string, options?: {
+    scope?: string[];
+    extraParams?: Record<string, string>;
+}): string;
+declare function exchangeOAuthCode(provider: OAuthProviderConfig, code: string): Promise<OAuthTokenResult>;
+declare function fetchOAuthUserProfile(provider: OAuthProviderConfig, token: OAuthTokenResult): Promise<OAuthUserProfile>;
+interface OAuthProviderFactoryInput {
+    clientId: string;
+    clientSecret: string;
+    redirectUri: string;
+    scopes?: string[];
+}
+declare function createGitHubOAuthProviderConfig(input: OAuthProviderFactoryInput): OAuthProviderConfig;
+declare function createGoogleOAuthProviderConfig(input: OAuthProviderFactoryInput): OAuthProviderConfig;
+declare function createDiscordOAuthProviderConfig(input: OAuthProviderFactoryInput): OAuthProviderConfig;
+declare function buildOAuthRedirectUrl(baseUrl: string, token: string, email?: string): string;
+declare function parseOAuthRedirectUrl(url: string): {
+    token: string | null;
+    email: string | null;
+};
+
+/**
+ * API token data stored in the backing store.
+ */
+interface ApiToken {
+    id: string;
+    name: string;
+    hashedToken: string;
+    userId: string | number;
+    abilities: string[];
+    lastUsedAt: Date | null;
+    expiresAt: Date | null;
+    createdAt: Date;
+}
+/**
+ * Store interface for API tokens.
+ * Implement this for database-backed storage.
+ */
+interface ApiTokenStore {
+    /**
+     * Store a new API token.
+     */
+    store(token: ApiToken): Promise<void>;
+    /**
+     * Find a token by its hashed value.
+     */
+    findByHashedToken(hashedToken: string): Promise<ApiToken | null>;
+    /**
+     * Find all tokens for a user.
+     */
+    findByUserId(userId: string | number): Promise<ApiToken[]>;
+    /**
+     * Delete a token by its ID.
+     */
+    delete(id: string): Promise<void>;
+    /**
+     * Delete all tokens for a user.
+     */
+    deleteForUser(userId: string | number): Promise<void>;
+    /**
+     * Update the last used timestamp.
+     */
+    updateLastUsed(id: string, timestamp: Date): Promise<void>;
+}
+/**
+ * In-memory token store for testing.
+ * Do NOT use in production - tokens will be lost on restart.
+ */
+declare class MemoryApiTokenStore implements ApiTokenStore {
+    private tokens;
+    private byHash;
+    store(token: ApiToken): Promise<void>;
+    findByHashedToken(hashedToken: string): Promise<ApiToken | null>;
+    findByUserId(userId: string | number): Promise<ApiToken[]>;
+    delete(id: string): Promise<void>;
+    deleteForUser(userId: string | number): Promise<void>;
+    updateLastUsed(id: string, timestamp: Date): Promise<void>;
+    /**
+     * Clear all tokens (useful for testing).
+     */
+    clear(): void;
+    /**
+     * Get the number of stored tokens.
+     */
+    get size(): number;
+}
+/**
+ * Configuration for API token creation.
+ */
+interface CreateApiTokenOptions {
+    /**
+     * Human-readable name for the token.
+     */
+    name: string;
+    /**
+     * User ID the token belongs to.
+     */
+    userId: string | number;
+    /**
+     * Token abilities/scopes.
+     * @default ['*'] (all abilities)
+     */
+    abilities?: string[];
+    /**
+     * Token expiration time in milliseconds from now.
+     * @default null (never expires)
+     */
+    expiresIn?: number | null;
+    /**
+     * Token byte length (before encoding).
+     * @default 32
+     */
+    tokenLength?: number;
+}
+/**
+ * Result of creating an API token.
+ */
+interface CreateApiTokenResult {
+    /**
+     * The full token to give to the user.
+     * Format: {id}|{plainToken}
+     * This is the ONLY time the plain token is available.
+     */
+    plainTextToken: string;
+    /**
+     * The token record (without the plain token).
+     */
+    token: ApiToken;
+}
+/**
+ * Create a new API token.
+ *
+ * @example
+ * ```ts
+ * const { plainTextToken, token } = await createApiToken(store, {
+ *   name: 'My App Token',
+ *   userId: user.id,
+ *   abilities: ['read', 'write'],
+ *   expiresIn: 30 * 24 * 60 * 60 * 1000, // 30 days
+ * })
+ *
+ * // Return plainTextToken to user - this is the only time it's available
+ * return ctx.json({ token: plainTextToken })
+ * ```
+ */
+declare function createApiToken(store: ApiTokenStore, options: CreateApiTokenOptions): Promise<CreateApiTokenResult>;
+/**
+ * Parse a plain text token into its components.
+ */
+declare function parseApiToken(plainTextToken: string): {
+    id: string;
+    token: string;
+} | null;
+/**
+ * Verify an API token and return the associated user ID.
+ *
+ * @example
+ * ```ts
+ * const result = await verifyApiToken(plainTextToken, store)
+ *
+ * if (!result) {
+ *   return ctx.json({ error: 'Invalid token' }, 401)
+ * }
+ *
+ * console.log(`User ${result.userId} authenticated with abilities:`, result.abilities)
+ * ```
+ */
+declare function verifyApiToken(plainTextToken: string, store: ApiTokenStore, options?: {
+    updateLastUsed?: boolean;
+}): Promise<{
+    token: ApiToken;
+    userId: string | number;
+    abilities: string[];
+} | null>;
+/**
+ * Check if a token has a specific ability.
+ */
+declare function tokenCan(token: ApiToken | {
+    abilities: string[];
+}, ability: string): boolean;
+/**
+ * Check if a token has all specified abilities.
+ */
+declare function tokenCanAll(token: ApiToken | {
+    abilities: string[];
+}, abilities: string[]): boolean;
+/**
+ * Check if a token has any of the specified abilities.
+ */
+declare function tokenCanAny(token: ApiToken | {
+    abilities: string[];
+}, abilities: string[]): boolean;
+/**
+ * Revoke (delete) an API token.
+ *
+ * @example
+ * ```ts
+ * await revokeApiToken(tokenId, store)
+ * ```
+ */
+declare function revokeApiToken(id: string, store: ApiTokenStore): Promise<void>;
+/**
+ * Revoke all API tokens for a user.
+ *
+ * @example
+ * ```ts
+ * // Revoke all tokens when user changes password
+ * await revokeAllApiTokens(user.id, store)
+ * ```
+ */
+declare function revokeAllApiTokens(userId: string | number, store: ApiTokenStore): Promise<void>;
+/**
+ * Get all API tokens for a user.
+ *
+ * @example
+ * ```ts
+ * const tokens = await getUserApiTokens(user.id, store)
+ * // Returns tokens without the plain text (only metadata)
+ * ```
+ */
+declare function getUserApiTokens(userId: string | number, store: ApiTokenStore): Promise<ApiToken[]>;
+/**
+ * Context key for storing the authenticated token.
+ */
+declare const API_TOKEN_KEY = "guren:api-token";
+/**
+ * Options for the bearer token middleware.
+ */
+interface BearerTokenMiddlewareOptions {
+    /**
+     * Token store implementation.
+     */
+    store: ApiTokenStore;
+    /**
+     * Function to load the user from the user ID.
+     */
+    loadUser?: (userId: string | number) => Promise<unknown>;
+    /**
+     * Required abilities for this route.
+     * If not specified, any valid token is accepted.
+     */
+    abilities?: string[];
+    /**
+     * Custom handler when authentication fails.
+     */
+    onUnauthorized?: (ctx: Context) => Response | Promise<Response>;
+    /**
+     * Custom handler when token lacks required abilities.
+     */
+    onForbidden?: (ctx: Context, required: string[]) => Response | Promise<Response>;
+    /**
+     * Header name to extract the token from.
+     * @default 'Authorization'
+     */
+    headerName?: string;
+    /**
+     * Whether to update the token's lastUsedAt timestamp.
+     * @default true
+     */
+    updateLastUsed?: boolean;
+}
+/**
+ * Create middleware that authenticates requests using Bearer tokens.
+ *
+ * @example
+ * ```ts
+ * // Basic usage
+ * app.use('/api/*', createBearerTokenMiddleware({ store }))
+ *
+ * // With ability requirement
+ * router.delete('/api/posts/:id', [PostController, 'destroy'],
+ *   createBearerTokenMiddleware({
+ *     store,
+ *     abilities: ['posts:delete'],
+ *   })
+ * )
+ *
+ * // With user loading
+ * app.use('/api/*', createBearerTokenMiddleware({
+ *   store,
+ *   loadUser: async (userId) => User.find(userId),
+ * }))
+ * ```
+ */
+declare function createBearerTokenMiddleware(options: BearerTokenMiddlewareOptions): MiddlewareHandler;
+/**
+ * Get the authenticated API token from the request context.
+ *
+ * @example
+ * ```ts
+ * router.get('/api/me', async (ctx) => {
+ *   const { token, userId, abilities } = getApiToken(ctx)!
+ *   return ctx.json({ userId, tokenName: token.name, abilities })
+ * })
+ * ```
+ */
+declare function getApiToken(ctx: Context): {
+    token: ApiToken;
+    userId: string | number;
+    abilities: string[];
+} | null;
+/**
+ * Get the authenticated API token from the request context, or throw.
+ *
+ * @throws {AuthenticationException} When no token is present in the context.
+ *
+ * @example
+ * ```ts
+ * router.get('/api/me', async (ctx) => {
+ *   const { token, userId, abilities } = getApiTokenOrFail(ctx)
+ *   return ctx.json({ userId, tokenName: token.name, abilities })
+ * })
+ * ```
+ */
+declare function getApiTokenOrFail(ctx: Context): {
+    token: ApiToken;
+    userId: string | number;
+    abilities: string[];
+};
+
+export { parseOAuthRedirectUrl as $, AuthManager as A, BaseUserProvider as B, type CreateSessionMiddlewareOptions as C, type SessionStore as D, buildOAuthAuthorizeUrl as E, buildOAuthRedirectUrl as F, type Guard as G, createApiToken as H, createBearerTokenMiddleware as I, createDiscordOAuthProviderConfig as J, createGitHubOAuthProviderConfig as K, createGoogleOAuthProviderConfig as L, MemoryApiTokenStore as M, createOAuthManager as N, OAuthManager as O, type ProviderFactory as P, createOAuthState as Q, createSessionMiddleware as R, type Session as S, exchangeOAuthCode as T, type UserProvider as U, fetchOAuthUserProfile as V, getApiToken as W, getApiTokenOrFail as X, getSessionFromContext as Y, getUserApiTokens as Z, parseApiToken as _, type AuthContext as a, revokeAllApiTokens as a0, revokeApiToken as a1, tokenCan as a2, tokenCanAll as a3, tokenCanAny as a4, verifyApiToken as a5, verifyOAuthState as a6, type PasswordHasher as a7, type AttachContextOptions as a8, type AuthManagerContract as a9, type ApiToken as b, API_TOKEN_KEY as c, type ApiTokenStore as d, type AuthCredentials as e, type AuthManagerOptions as f, type Authenticatable as g, type BearerTokenMiddlewareOptions as h, type CreateApiTokenOptions as i, type CreateApiTokenResult as j, type GuardContext as k, type GuardFactory as l, MemoryOAuthStateStore as m, MemorySessionStore as n, ModelUserProvider as o, type OAuthAuthorizeOptions as p, type OAuthCallbackPayload as q, type OAuthManagerOptions as r, type OAuthProviderConfig as s, type OAuthProviderFactoryInput as t, type OAuthStateConfig as u, type OAuthStatePayload as v, type OAuthStateStore as w, type OAuthTokenResult as x, type OAuthUserProfile as y, type SessionData as z };

package/dist/auth/index.d.ts

@@ -1,5 +1,6 @@
-import { g as Authenticatable, G as Guard, U as UserProvider, S as Session, e as AuthCredentials, a7 as PasswordHasher, a8 as PlainObject, a9 as Model } from '../api-token-JOif2CtG.js';
-export { c as API_TOKEN_KEY, b as ApiToken, d as ApiTokenStore, aa as AttachContextOptions, a as AuthContext, A as AuthManager, ab as AuthManagerContract, f as AuthManagerOptions, B as BaseUserProvider, h as BearerTokenMiddlewareOptions, i as CreateApiTokenOptions, j as CreateApiTokenResult, k as GuardContext, l as GuardFactory, M as MemoryApiTokenStore, m as MemoryOAuthStateStore, o as ModelUserProvider, p as OAuthAuthorizeOptions, q as OAuthCallbackPayload, O as OAuthManager, r as OAuthManagerOptions, s as OAuthProviderConfig, t as OAuthProviderFactoryInput, u as OAuthStateConfig, v as OAuthStatePayload, w as OAuthStateStore, x as OAuthTokenResult, y as OAuthUserProfile, P as ProviderFactory, E as buildOAuthAuthorizeUrl, F as buildOAuthRedirectUrl, H as createApiToken, I as createBearerTokenMiddleware, J as createDiscordOAuthProviderConfig, K as createGitHubOAuthProviderConfig, L as createGoogleOAuthProviderConfig, N as createOAuthManager, Q as createOAuthState, T as exchangeOAuthCode, V as fetchOAuthUserProfile, W as getApiToken, X as getApiTokenOrFail, Z as getUserApiTokens, _ as parseApiToken, $ as parseOAuthRedirectUrl, a0 as revokeAllApiTokens, a1 as revokeApiToken, a2 as tokenCan, a3 as tokenCanAll, a4 as tokenCanAny, a5 as verifyApiToken, a6 as verifyOAuthState } from '../api-token-JOif2CtG.js';
+import { g as Authenticatable, G as Guard, U as UserProvider, S as Session, e as AuthCredentials, a7 as PasswordHasher } from '../api-token-BGOsfuI9.js';
+export { c as API_TOKEN_KEY, b as ApiToken, d as ApiTokenStore, a8 as AttachContextOptions, a as AuthContext, A as AuthManager, a9 as AuthManagerContract, f as AuthManagerOptions, B as BaseUserProvider, h as BearerTokenMiddlewareOptions, i as CreateApiTokenOptions, j as CreateApiTokenResult, k as GuardContext, l as GuardFactory, M as MemoryApiTokenStore, m as MemoryOAuthStateStore, o as ModelUserProvider, p as OAuthAuthorizeOptions, q as OAuthCallbackPayload, O as OAuthManager, r as OAuthManagerOptions, s as OAuthProviderConfig, t as OAuthProviderFactoryInput, u as OAuthStateConfig, v as OAuthStatePayload, w as OAuthStateStore, x as OAuthTokenResult, y as OAuthUserProfile, P as ProviderFactory, E as buildOAuthAuthorizeUrl, F as buildOAuthRedirectUrl, H as createApiToken, I as createBearerTokenMiddleware, J as createDiscordOAuthProviderConfig, K as createGitHubOAuthProviderConfig, L as createGoogleOAuthProviderConfig, N as createOAuthManager, Q as createOAuthState, T as exchangeOAuthCode, V as fetchOAuthUserProfile, W as getApiToken, X as getApiTokenOrFail, Z as getUserApiTokens, _ as parseApiToken, $ as parseOAuthRedirectUrl, a0 as revokeAllApiTokens, a1 as revokeApiToken, a2 as tokenCan, a3 as tokenCanAll, a4 as tokenCanAny, a5 as verifyApiToken, a6 as verifyOAuthState } from '../api-token-BGOsfuI9.js';
+import { PlainObject, Model } from '@guren/orm';
 import 'hono';
 
 interface SessionGuardOptions {