@guren/server 1.0.0-rc.23 → 1.0.0-rc.25

package/dist/{Application-D4_90raL.d.ts → Application-Hlryz3ln.d.ts}

@@ -1,6 +1,6 @@
 import * as hono from 'hono';
 import { Context, MiddlewareHandler, Hono, Next, ExecutionContext } from 'hono';
-import { A as AuthManager, O as OAuthManager, a as AuthContext, b as ApiToken, C as CreateSessionMiddlewareOptions } from './api-token-BGOsfuI9.js';
+import { A as AuthManager, O as OAuthManager, a as AuthContext, b as ApiToken, C as CreateSessionMiddlewareOptions } from './api-token-ChekhpB7.js';
 import { InlineConfig, ViteDevServer } from 'vite';
 import { E as EventManager } from './EventManager-CmIoLt7r.js';
 import { C as CacheManager } from './CacheManager-BkvHEOZX.js';

package/dist/{ConsoleKernel-BPYcP-2f.d.ts → ConsoleKernel-CVvaK-I6.d.ts}

@@ -1,4 +1,4 @@
-import { C as Container } from './Application-D4_90raL.js';
+import { C as Container } from './Application-Hlryz3ln.js';
 
 /**
  * Parsed argument definition.

package/dist/{api-token-BGOsfuI9.d.ts → api-token-ChekhpB7.d.ts}

@@ -84,6 +84,12 @@ interface UserProvider<User = Authenticatable> {
     getId(user: User): unknown;
     setRememberToken?(user: User, token: string | null): Promise<void> | void;
     getRememberToken?(user: User): Promise<string | null> | string | null;
+    /**
+     * Strip fields that must never leave the auth layer (password hashes,
+     * remember tokens, model `hidden` fields) from a user record before it
+     * is cached or handed to application code via guard.user().
+     */
+    sanitize?(user: User): User;
 }
 interface GuardContext {
     ctx: Context;
@@ -160,6 +166,13 @@ declare class ModelUserProvider<User extends Authenticatable = Authenticatable>
     retrieveByCredentials(credentials: AuthCredentials): Promise<User | null>;
     validateCredentials(user: User, credentials: AuthCredentials): Promise<boolean>;
     getId(user: User): unknown;
+    /**
+     * Strip the password hash, remember token, and the model's `hidden`
+     * fields before the record leaves the auth layer. Credential
+     * validation happens on the raw record before sanitizing, so this
+     * never affects login — only what `auth.user()` exposes.
+     */
+    sanitize(user: User): User;
     setRememberToken(user: User, token: string | null): Promise<void>;
     getRememberToken(user: User): Promise<string | null>;
 }

package/dist/auth/index.d.ts

@@ -1,5 +1,5 @@
-import { g as Authenticatable, G as Guard, U as UserProvider, S as Session, e as AuthCredentials, a7 as PasswordHasher } from '../api-token-BGOsfuI9.js';
-export { c as API_TOKEN_KEY, b as ApiToken, d as ApiTokenStore, a8 as AttachContextOptions, a as AuthContext, A as AuthManager, a9 as AuthManagerContract, f as AuthManagerOptions, B as BaseUserProvider, h as BearerTokenMiddlewareOptions, i as CreateApiTokenOptions, j as CreateApiTokenResult, k as GuardContext, l as GuardFactory, M as MemoryApiTokenStore, m as MemoryOAuthStateStore, o as ModelUserProvider, p as OAuthAuthorizeOptions, q as OAuthCallbackPayload, O as OAuthManager, r as OAuthManagerOptions, s as OAuthProviderConfig, t as OAuthProviderFactoryInput, u as OAuthStateConfig, v as OAuthStatePayload, w as OAuthStateStore, x as OAuthTokenResult, y as OAuthUserProfile, P as ProviderFactory, E as buildOAuthAuthorizeUrl, F as buildOAuthRedirectUrl, H as createApiToken, I as createBearerTokenMiddleware, J as createDiscordOAuthProviderConfig, K as createGitHubOAuthProviderConfig, L as createGoogleOAuthProviderConfig, N as createOAuthManager, Q as createOAuthState, T as exchangeOAuthCode, V as fetchOAuthUserProfile, W as getApiToken, X as getApiTokenOrFail, Z as getUserApiTokens, _ as parseApiToken, $ as parseOAuthRedirectUrl, a0 as revokeAllApiTokens, a1 as revokeApiToken, a2 as tokenCan, a3 as tokenCanAll, a4 as tokenCanAny, a5 as verifyApiToken, a6 as verifyOAuthState } from '../api-token-BGOsfuI9.js';
+import { g as Authenticatable, G as Guard, U as UserProvider, S as Session, e as AuthCredentials, a7 as PasswordHasher } from '../api-token-ChekhpB7.js';
+export { c as API_TOKEN_KEY, b as ApiToken, d as ApiTokenStore, a8 as AttachContextOptions, a as AuthContext, A as AuthManager, a9 as AuthManagerContract, f as AuthManagerOptions, B as BaseUserProvider, h as BearerTokenMiddlewareOptions, i as CreateApiTokenOptions, j as CreateApiTokenResult, k as GuardContext, l as GuardFactory, M as MemoryApiTokenStore, m as MemoryOAuthStateStore, o as ModelUserProvider, p as OAuthAuthorizeOptions, q as OAuthCallbackPayload, O as OAuthManager, r as OAuthManagerOptions, s as OAuthProviderConfig, t as OAuthProviderFactoryInput, u as OAuthStateConfig, v as OAuthStatePayload, w as OAuthStateStore, x as OAuthTokenResult, y as OAuthUserProfile, P as ProviderFactory, E as buildOAuthAuthorizeUrl, F as buildOAuthRedirectUrl, H as createApiToken, I as createBearerTokenMiddleware, J as createDiscordOAuthProviderConfig, K as createGitHubOAuthProviderConfig, L as createGoogleOAuthProviderConfig, N as createOAuthManager, Q as createOAuthState, T as exchangeOAuthCode, V as fetchOAuthUserProfile, W as getApiToken, X as getApiTokenOrFail, Z as getUserApiTokens, _ as parseApiToken, $ as parseOAuthRedirectUrl, a0 as revokeAllApiTokens, a1 as revokeApiToken, a2 as tokenCan, a3 as tokenCanAll, a4 as tokenCanAny, a5 as verifyApiToken, a6 as verifyOAuthState } from '../api-token-ChekhpB7.js';
 import { PlainObject, Model } from '@guren/orm';
 import 'hono';
 
@@ -18,6 +18,8 @@ declare class SessionGuard<User extends Authenticatable = Authenticatable> imple
     private sessionKey;
     private rememberSessionKey;
     private loadRememberedUser;
+    /** Strip auth-internal fields before a record is cached or exposed. */
+    private sanitizeUser;
     private resolveUser;
     check(): Promise<boolean>;
     guest(): Promise<boolean>;

package/dist/auth/index.js

@@ -54,7 +54,7 @@ import {
   verifyEmailToken,
   verifyOAuthState,
   verifyPasswordResetToken
-} from "../chunk-BJXAHGDR.js";
+} from "../chunk-J2ZAO6TV.js";
 import "../chunk-DAQKYKLH.js";
 import "../chunk-ONSDE37A.js";
 import "../chunk-QQKTH5KX.js";

package/dist/broadcasting/index.js

@@ -9,7 +9,7 @@ import {
   createTypedBroadcaster,
   getBroadcastManager,
   setBroadcastManager
-} from "../chunk-AFI3A6GB.js";
+} from "../chunk-44F7JQ7I.js";
 export {
   BroadcastManager,
   Channel,

package/dist/{chunk-AFI3A6GB.js → chunk-44F7JQ7I.js}

@@ -490,6 +490,14 @@ async function parseRequestPayload(ctx) {
   }
   return {};
 }
+function flattenRequestQueries(ctx) {
+  const queries = ctx.req.queries();
+  const flat = {};
+  for (const [key, values] of Object.entries(queries)) {
+    flat[key] = values.length === 1 ? values[0] : values;
+  }
+  return flat;
+}
 function formatValidationErrors(error, fallbackMessage = "The provided data is invalid.") {
   const errors = {};
   for (const issue of error.issues ?? []) {
@@ -927,6 +935,7 @@ function wrapChannel(name, channel) {
 
 export {
   parseRequestPayload,
+  flattenRequestQueries,
   formatValidationErrors,
   Channel,
   PrivateChannel,

package/dist/{chunk-BJXAHGDR.js → chunk-J2ZAO6TV.js}

@@ -270,10 +270,10 @@ function getSessionFromContext(ctx) {
 
 // src/auth/RequestAuthContext.ts
 var RequestAuthContext = class {
-  constructor(manager, ctx, currentSession, resolveGuard) {
+  constructor(manager, ctx, resolveSession, resolveGuard) {
     this.manager = manager;
     this.ctx = ctx;
-    this.currentSession = currentSession;
+    this.resolveSession = resolveSession;
     this.resolveGuard = resolveGuard;
   }
   guardCache = /* @__PURE__ */ new Map();
@@ -286,7 +286,7 @@ var RequestAuthContext = class {
     return this.guardCache.get(key);
   }
   session() {
-    return this.currentSession;
+    return this.resolveSession();
   }
   async check() {
     return this.guard().check();
@@ -455,11 +455,31 @@ var ModelUserProvider = class extends BaseUserProvider {
   getId(user) {
     return user[this.idColumn];
   }
+  /**
+   * Strip the password hash, remember token, and the model's `hidden`
+   * fields before the record leaves the auth layer. Credential
+   * validation happens on the raw record before sanitizing, so this
+   * never affects login — only what `auth.user()` exposes.
+   */
+  sanitize(user) {
+    const blocked = /* @__PURE__ */ new Set([
+      this.passwordColumn,
+      this.rememberTokenColumn,
+      ...this.model.hidden ?? []
+    ]);
+    const clean = {};
+    for (const [key, value] of Object.entries(user)) {
+      if (!blocked.has(key)) {
+        clean[key] = value;
+      }
+    }
+    return clean;
+  }
   async setRememberToken(user, token) {
     if (typeof user[this.rememberTokenColumn] !== "undefined") {
       ;
       user[this.rememberTokenColumn] = token;
-      await this.model.update({ [this.idColumn]: this.getId(user) }, { [this.rememberTokenColumn]: token });
+      await this.model.forceUpdate({ [this.idColumn]: this.getId(user) }, { [this.rememberTokenColumn]: token });
     }
   }
   async getRememberToken(user) {
@@ -554,9 +574,14 @@ var SessionGuard = class {
       this.currentSession.forget(this.rememberSessionKey());
       return null;
     }
-    this.cachedUser = user;
     await this.provider.setRememberToken?.(user, rememberToken);
-    return user;
+    const sanitized = this.sanitizeUser(user);
+    this.cachedUser = sanitized;
+    return sanitized;
+  }
+  /** Strip auth-internal fields before a record is cached or exposed. */
+  sanitizeUser(user) {
+    return this.provider.sanitize ? this.provider.sanitize(user) : user;
   }
   async resolveUser() {
     if (this.cachedUser !== void 0) {
@@ -579,8 +604,9 @@ var SessionGuard = class {
       this.cachedUser = null;
       return null;
     }
-    this.cachedUser = user;
-    return user;
+    const sanitized = this.sanitizeUser(user);
+    this.cachedUser = sanitized;
+    return sanitized;
   }
   async check() {
     return await this.resolveUser() !== null;
@@ -616,7 +642,7 @@ var SessionGuard = class {
     session.regenerate();
     const identifier = this.provider.getId(castUser);
     session.set(this.sessionKey(), identifier);
-    this.cachedUser = castUser;
+    this.cachedUser = this.sanitizeUser(castUser);
     if (remember) {
       await this.remember(castUser);
     } else {
@@ -705,16 +731,16 @@ var AuthManager = class {
   }
   createAuthContext(ctx, options = {}) {
     const guardName = options.guard ?? this.defaultGuard;
-    const session = getSessionFromContext(ctx);
+    const resolveSession = () => getSessionFromContext(ctx);
     const guardFactory = (name) => {
       const targetName = name ?? guardName;
       return this.createGuard(targetName, {
         ctx,
-        session,
+        session: resolveSession(),
         manager: this
       });
     };
-    return new RequestAuthContext(this, ctx, session, guardFactory);
+    return new RequestAuthContext(this, ctx, resolveSession, guardFactory);
   }
   async attempt(name, ctx, credentials, remember) {
     const guard = this.createAuthContext(ctx, { guard: name }).guard(name);

package/dist/{chunk-NFGDKY3L.js → chunk-X4E2I4Z5.js}

@@ -6,7 +6,7 @@ import standard from "figlet/importable-fonts/Standard.js";
 // package.json
 var package_default = {
   name: "@guren/server",
-  version: "1.0.0-rc.23",
+  version: "1.0.0-rc.25",
   type: "module",
   license: "MIT",
   repository: {
@@ -111,8 +111,8 @@ var package_default = {
     test: "bun test"
   },
   dependencies: {
-    "@guren/inertia-client": "^1.0.0-rc.22",
-    "@guren/orm": "^1.0.0-rc.24",
+    "@guren/inertia-client": "^1.0.0-rc.24",
+    "@guren/orm": "^1.0.0-rc.26",
     "@modelcontextprotocol/sdk": "^1.27.1",
     chalk: "^5.3.0",
     consola: "^3.4.2",

package/dist/index.d.ts

@@ -1,10 +1,10 @@
-import { E as ErrorResponse, S as ServiceProvider, C as Container, c as ServiceBindings, Q as QueueManager, N as NotificationManager } from './Application-D4_90raL.js';
-export { A as Application, d as ApplicationListenOptions, e as AuthPayload, f as CSRF_FORM_FIELD, g as CSRF_HEADER_NAME, h as CSRF_TOKEN_KEY, P as ContainerProvider, i as ContextualBinding, j as ContextualBindingBuilder, k as ContextualNeedsBuilder, m as Controller, n as ControllerInertiaProps, o as CsrfOptions, p as DatabaseChannelOptions, q as DatabaseNotification, r as ExceptionClass, t as ExceptionHandler, u as ExceptionHandlerOptions, v as ExceptionRenderer, w as ExceptionReporter, F as FailedJob, H as HostAuthorizationOptions, x as HstsOptions, I as InertiaOptions, y as InertiaPagePayload, z as InertiaResponse, B as InertiaSharedProps, J as InertiaSsrContext, K as InertiaSsrOptions, L as InertiaSsrRenderer, M as InertiaSsrResult, O as InferInertiaProps, R as Job, T as JobClass, U as JobFailureHandler, V as JobHandler, W as JobOptions, X as Notifiable, Y as Notification, Z as NotificationAttachment, _ as NotificationChannel, $ as NotificationChannelFactory, a0 as NotificationClass, a1 as NotificationMailMessage, a2 as NotificationManagerOptions, a3 as ProviderManager, a4 as QueueConfig, a5 as QueueDriver, a6 as QueueDriverFactory, a7 as QueuedJob, a8 as RendererRegistration, a9 as ResolvedSharedInertiaProps, aa as ResourceRouteOptions, ab as RouteBuilder, ac as RouteContractOptions, ad as RouteDefinition, ae as RouteOpenApiMetadata, af as RouteResourceAction, ag as Router, ah as SecurityHeadersOptions, ai as SentNotification, aj as ServiceBinding, ak as ServiceClass, al as ServiceFactory, am as ServiceProviderClass, an as ServiceProviderConstructor, ao as ServiceProviderOptions, ap as SharedInertiaPropsResolver, aq as SlackAttachment, ar as SlackBlock, as as SlackMessage, at as VALIDATED_DATA_KEY, au as ValidateRequestOptions, av as ValidationSchema, aw as WorkerOptions, ax as abort, ay as abortIf, az as abortUnless, aA as clearJobRegistry, aB as createApp, aC as createContainer, aD as createCsrfMiddleware, aE as createExceptionHandler, aF as createHostAuthorizationMiddleware, aG as createNotificationManager, aH as createQueueManager, aI as createSecurityHeaders, aJ as csrfField, aK as formatValidationErrors, aL as getContainer, aM as getCsrfToken, aN as getExceptionHandler, aO as getInertiaSharedPropsResolver, aP as getJob, aQ as getNotificationManager, aR as getQueueDriver, aS as getRegisteredJobs, aT as getValidatedData, aU as inertia, aV as parseRequestPayload, aW as registerJob, aX as resolve, aY as setContainer, aZ as setExceptionHandler, a_ as setInertiaSharedProps, a$ as setNotificationManager, b0 as setQueueDriver, b1 as shareInertiaProps, b2 as validate, b3 as validateRequest, b4 as validateRequestWith, b5 as validateSafe, b6 as verifyCsrfToken } from './Application-D4_90raL.js';
+import { E as ErrorResponse, S as ServiceProvider, C as Container, c as ServiceBindings, Q as QueueManager, N as NotificationManager } from './Application-Hlryz3ln.js';
+export { A as Application, d as ApplicationListenOptions, e as AuthPayload, f as CSRF_FORM_FIELD, g as CSRF_HEADER_NAME, h as CSRF_TOKEN_KEY, P as ContainerProvider, i as ContextualBinding, j as ContextualBindingBuilder, k as ContextualNeedsBuilder, m as Controller, n as ControllerInertiaProps, o as CsrfOptions, p as DatabaseChannelOptions, q as DatabaseNotification, r as ExceptionClass, t as ExceptionHandler, u as ExceptionHandlerOptions, v as ExceptionRenderer, w as ExceptionReporter, F as FailedJob, H as HostAuthorizationOptions, x as HstsOptions, I as InertiaOptions, y as InertiaPagePayload, z as InertiaResponse, B as InertiaSharedProps, J as InertiaSsrContext, K as InertiaSsrOptions, L as InertiaSsrRenderer, M as InertiaSsrResult, O as InferInertiaProps, R as Job, T as JobClass, U as JobFailureHandler, V as JobHandler, W as JobOptions, X as Notifiable, Y as Notification, Z as NotificationAttachment, _ as NotificationChannel, $ as NotificationChannelFactory, a0 as NotificationClass, a1 as NotificationMailMessage, a2 as NotificationManagerOptions, a3 as ProviderManager, a4 as QueueConfig, a5 as QueueDriver, a6 as QueueDriverFactory, a7 as QueuedJob, a8 as RendererRegistration, a9 as ResolvedSharedInertiaProps, aa as ResourceRouteOptions, ab as RouteBuilder, ac as RouteContractOptions, ad as RouteDefinition, ae as RouteOpenApiMetadata, af as RouteResourceAction, ag as Router, ah as SecurityHeadersOptions, ai as SentNotification, aj as ServiceBinding, ak as ServiceClass, al as ServiceFactory, am as ServiceProviderClass, an as ServiceProviderConstructor, ao as ServiceProviderOptions, ap as SharedInertiaPropsResolver, aq as SlackAttachment, ar as SlackBlock, as as SlackMessage, at as VALIDATED_DATA_KEY, au as ValidateRequestOptions, av as ValidationSchema, aw as WorkerOptions, ax as abort, ay as abortIf, az as abortUnless, aA as clearJobRegistry, aB as createApp, aC as createContainer, aD as createCsrfMiddleware, aE as createExceptionHandler, aF as createHostAuthorizationMiddleware, aG as createNotificationManager, aH as createQueueManager, aI as createSecurityHeaders, aJ as csrfField, aK as formatValidationErrors, aL as getContainer, aM as getCsrfToken, aN as getExceptionHandler, aO as getInertiaSharedPropsResolver, aP as getJob, aQ as getNotificationManager, aR as getQueueDriver, aS as getRegisteredJobs, aT as getValidatedData, aU as inertia, aV as parseRequestPayload, aW as registerJob, aX as resolve, aY as setContainer, aZ as setExceptionHandler, a_ as setInertiaSharedProps, a$ as setNotificationManager, b0 as setQueueDriver, b1 as shareInertiaProps, b2 as validate, b3 as validateRequest, b4 as validateRequestWith, b5 as validateSafe, b6 as verifyCsrfToken } from './Application-Hlryz3ln.js';
 import * as hono from 'hono';
 import { Context, MiddlewareHandler } from 'hono';
 export { Context } from 'hono';
-import { a as AuthContext } from './api-token-BGOsfuI9.js';
-export { c as API_TOKEN_KEY, b as ApiToken, d as ApiTokenStore, e as AuthCredentials, A as AuthManager, f as AuthManagerOptions, g as Authenticatable, B as BaseUserProvider, h as BearerTokenMiddlewareOptions, i as CreateApiTokenOptions, j as CreateApiTokenResult, G as Guard, k as GuardContext, l as GuardFactory, M as MemoryApiTokenStore, m as MemoryOAuthStateStore, n as MemorySessionStore, o as ModelUserProvider, p as OAuthAuthorizeOptions, q as OAuthCallbackPayload, O as OAuthManager, r as OAuthManagerOptions, s as OAuthProviderConfig, t as OAuthProviderFactoryInput, u as OAuthStateConfig, v as OAuthStatePayload, w as OAuthStateStore, x as OAuthTokenResult, y as OAuthUserProfile, P as ProviderFactory, S as Session, z as SessionData, D as SessionStore, U as UserProvider, E as buildOAuthAuthorizeUrl, F as buildOAuthRedirectUrl, H as createApiToken, I as createBearerTokenMiddleware, J as createDiscordOAuthProviderConfig, K as createGitHubOAuthProviderConfig, L as createGoogleOAuthProviderConfig, N as createOAuthManager, Q as createOAuthState, R as createSessionMiddleware, T as exchangeOAuthCode, V as fetchOAuthUserProfile, W as getApiToken, X as getApiTokenOrFail, Y as getSessionFromContext, Z as getUserApiTokens, _ as parseApiToken, $ as parseOAuthRedirectUrl, a0 as revokeAllApiTokens, a1 as revokeApiToken, a2 as tokenCan, a3 as tokenCanAll, a4 as tokenCanAny, a5 as verifyApiToken, a6 as verifyOAuthState } from './api-token-BGOsfuI9.js';
+import { a as AuthContext } from './api-token-ChekhpB7.js';
+export { c as API_TOKEN_KEY, b as ApiToken, d as ApiTokenStore, e as AuthCredentials, A as AuthManager, f as AuthManagerOptions, g as Authenticatable, B as BaseUserProvider, h as BearerTokenMiddlewareOptions, i as CreateApiTokenOptions, j as CreateApiTokenResult, G as Guard, k as GuardContext, l as GuardFactory, M as MemoryApiTokenStore, m as MemoryOAuthStateStore, n as MemorySessionStore, o as ModelUserProvider, p as OAuthAuthorizeOptions, q as OAuthCallbackPayload, O as OAuthManager, r as OAuthManagerOptions, s as OAuthProviderConfig, t as OAuthProviderFactoryInput, u as OAuthStateConfig, v as OAuthStatePayload, w as OAuthStateStore, x as OAuthTokenResult, y as OAuthUserProfile, P as ProviderFactory, S as Session, z as SessionData, D as SessionStore, U as UserProvider, E as buildOAuthAuthorizeUrl, F as buildOAuthRedirectUrl, H as createApiToken, I as createBearerTokenMiddleware, J as createDiscordOAuthProviderConfig, K as createGitHubOAuthProviderConfig, L as createGoogleOAuthProviderConfig, N as createOAuthManager, Q as createOAuthState, R as createSessionMiddleware, T as exchangeOAuthCode, V as fetchOAuthUserProfile, W as getApiToken, X as getApiTokenOrFail, Y as getSessionFromContext, Z as getUserApiTokens, _ as parseApiToken, $ as parseOAuthRedirectUrl, a0 as revokeAllApiTokens, a1 as revokeApiToken, a2 as tokenCan, a3 as tokenCanAll, a4 as tokenCanAny, a5 as verifyApiToken, a6 as verifyOAuthState } from './api-token-ChekhpB7.js';
 export { AuthenticatableModel, EmailVerificationConfig, EmailVerificationToken, EmailVerificationTokenResult, EmailVerificationTokenStore, ScryptHasher as Hash, MemoryEmailVerificationStore, MemoryPasswordResetStore, NodeHasher, PasswordResetConfig, PasswordResetTokenResult, PasswordResetTokenStore, ScryptHasher, SessionGuard, buildPasswordResetUrl, buildVerificationUrl, completeEmailVerification, completePasswordReset, createEmailVerificationToken, createPasswordResetToken, isEmailVerified, parsePasswordResetUrl, parseVerificationUrl, requireVerifiedEmail, verifyEmailToken, verifyPasswordResetToken } from './auth/index.js';
 export { M as Middleware, d as defineMiddleware, j as jsonResponse } from './index-9_Jzj5jo.js';
 import { E as EventManager } from './EventManager-CmIoLt7r.js';
@@ -35,8 +35,8 @@ export { DatabaseChannel, MailChannel, MailChannelOptions, MemoryChannel, SlackC
 import { B as BroadcastManager } from './BroadcastManager-CGWl9rUO.js';
 export { A as AuthMiddlewareOptions, a as BroadcastDriver, b as BroadcastDriverFactory, c as BroadcastEvent, d as BroadcastManagerOptions, e as BroadcastableEvent, C as Channel, f as ChannelAuthorizer, g as ChannelRegistration, P as PresenceBroadcastDriver, h as PresenceChannel, i as PresenceChannelAuthorizer, j as PresenceMember, k as PrivateChannel, S as SSEClient, l as SSEMiddlewareOptions, W as WebSocketClient, m as createBroadcastManager, n as getBroadcastManager, s as setBroadcastManager } from './BroadcastManager-CGWl9rUO.js';
 export { RedisClient as BroadcastRedisClient, RedisDriverOptions as BroadcastRedisDriverOptions, MemoryDriver as MemoryBroadcastDriver, RedisDriver as RedisBroadcastDriver, createTypedBroadcaster } from './broadcasting/index.js';
-import { I as InputInterface, P as ParsedSignature, O as OptionDefinition, a as CommandInstance, b as OutputInterface } from './ConsoleKernel-BPYcP-2f.js';
-export { A as ArgumentDefinition, c as CommandClass, C as ConsoleKernel, d as ConsoleKernelOptions, e as ProgressInterface, f as PromptInterface, S as ScheduledCommand, g as createConsoleKernel } from './ConsoleKernel-BPYcP-2f.js';
+import { I as InputInterface, P as ParsedSignature, O as OptionDefinition, a as CommandInstance, b as OutputInterface } from './ConsoleKernel-CVvaK-I6.js';
+export { A as ArgumentDefinition, c as CommandClass, C as ConsoleKernel, d as ConsoleKernelOptions, e as ProgressInterface, f as PromptInterface, S as ScheduledCommand, g as createConsoleKernel } from './ConsoleKernel-CVvaK-I6.js';
 import * as readline from 'readline';
 export { R as AuthResponse, A as AuthUser, a as AuthorizationResponse, b as AuthorizeOptions, G as Gate, c as GateCallback, d as GateDefinition, e as GateOptions, P as PolicyClass, f as PolicyInterface, g as PolicyMethod, h as PolicyRegistration, i as ResourceAction, j as ResponseBuilder, k as authorizeAbility, l as can, m as cannot, n as createGate, o as defineGate, p as getGate, s as setGate } from './Gate-CynjZCtS.js';
 export { AuthorizedContext, Policy, authorizeAllMiddleware, authorizeMiddleware, authorizeResourceMiddleware, definePolicy, withAuthorization } from './authorization/index.js';

package/dist/index.js

@@ -102,7 +102,7 @@ import {
   logDevServerBanner,
   parseImportMap,
   startViteDevServer
-} from "./chunk-NFGDKY3L.js";
+} from "./chunk-X4E2I4Z5.js";
 import {
   API_TOKEN_KEY,
   AuthManager,
@@ -155,7 +155,7 @@ import {
   verifyEmailToken,
   verifyOAuthState,
   verifyPasswordResetToken
-} from "./chunk-BJXAHGDR.js";
+} from "./chunk-J2ZAO6TV.js";
 import {
   Gate,
   Policy,
@@ -200,11 +200,12 @@ import {
   RedisDriver as RedisDriver2,
   createBroadcastManager,
   createTypedBroadcaster,
+  flattenRequestQueries,
   formatValidationErrors,
   getBroadcastManager,
   parseRequestPayload,
   setBroadcastManager
-} from "./chunk-AFI3A6GB.js";
+} from "./chunk-44F7JQ7I.js";
 import {
   CacheManager,
   FileStore,
@@ -623,7 +624,7 @@ function createContractHandler(path, options, handler) {
     if (params instanceof Response) {
       return params;
     }
-    const query = parseRouteSegment(options.query, ctx.req.query(), 422);
+    const query = parseRouteSegment(options.query, flattenRequestQueries(ctx), 422);
     if (query instanceof Response) {
       return query;
     }
@@ -699,10 +700,11 @@ function createContractValidationMiddleware(route) {
       }
     }
     if (schemas.query) {
-      const result = parseRouteSegment(schemas.query, c.req.query(), 422);
+      const query = flattenRequestQueries(c);
+      const result = parseRouteSegment(schemas.query, query, 422);
       if (result instanceof Response) {
         throw ValidationException.withMessages(
-          formatValidationErrors(schemas.query.safeParse(c.req.query()).error)
+          formatValidationErrors(schemas.query.safeParse(query).error)
         );
       }
     }
@@ -1793,6 +1795,8 @@ var Application = class {
     }
     if (this.options.auth) {
       this.providerManager.register(AuthServiceProvider);
+    } else {
+      this.hono.use("*", attachAuthContext((ctx) => this.authManager.createAuthContext(ctx)));
     }
     this.providerManager.register(AuthorizationServiceProvider);
     const userProviders = Array.isArray(this.options.providers) ? this.options.providers : [];
@@ -1851,9 +1855,6 @@ var Application = class {
   async boot() {
     this.mountSecurityDefaults();
     await this.providerManager.registerAll();
-    if (!this.options.auth) {
-      this.hono.use("*", attachAuthContext((ctx) => this.authManager.createAuthContext(ctx)));
-    }
     await this.options.boot?.(this.hono);
     await this.mountRoutes();
     await this.mountMcpEndpoint();
@@ -2642,12 +2643,7 @@ var Controller = class {
   }
   /** Flatten query string arrays to scalar values for cleaner schema usage. */
   flattenQueries() {
-    const queries = this.ctx.req.queries();
-    const flat = {};
-    for (const [key, values] of Object.entries(queries)) {
-      flat[key] = values.length === 1 ? values[0] : values;
-    }
-    return flat;
+    return flattenRequestQueries(this.ctx);
   }
   // ─── Validation ─────────────────────────────────────────────────
   /**

package/dist/lambda/index.d.ts

@@ -1,10 +1,10 @@
 import * as hono_aws_lambda from 'hono/aws-lambda';
 export { APIGatewayProxyResult, LambdaEvent } from 'hono/aws-lambda';
-import { A as Application } from '../Application-D4_90raL.js';
+import { A as Application } from '../Application-Hlryz3ln.js';
 import { S as Scheduler } from '../Scheduler-BstvSca7.js';
-import { C as ConsoleKernel } from '../ConsoleKernel-BPYcP-2f.js';
+import { C as ConsoleKernel } from '../ConsoleKernel-CVvaK-I6.js';
 import 'hono';
-import '../api-token-BGOsfuI9.js';
+import '../api-token-ChekhpB7.js';
 import '@guren/orm';
 import 'vite';
 import '../EventManager-CmIoLt7r.js';

package/dist/mcp/index.d.ts

@@ -1,7 +1,7 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { S as ServiceProvider } from '../Application-D4_90raL.js';
+import { S as ServiceProvider } from '../Application-Hlryz3ln.js';
 import 'hono';
-import '../api-token-BGOsfuI9.js';
+import '../api-token-ChekhpB7.js';
 import '@guren/orm';
 import 'vite';
 import '../EventManager-CmIoLt7r.js';

package/dist/notifications/index.d.ts

@@ -1,8 +1,8 @@
-import { _ as NotificationChannel, X as Notifiable, Y as Notification, q as DatabaseNotification, p as DatabaseChannelOptions, as as SlackMessage, ai as SentNotification } from '../Application-D4_90raL.js';
-export { Z as NotificationAttachment, $ as NotificationChannelFactory, a0 as NotificationClass, a1 as NotificationMailMessage, N as NotificationManager, a2 as NotificationManagerOptions, aq as SlackAttachment, ar as SlackBlock, aG as createNotificationManager, aQ as getNotificationManager, a$ as setNotificationManager } from '../Application-D4_90raL.js';
+import { _ as NotificationChannel, X as Notifiable, Y as Notification, q as DatabaseNotification, p as DatabaseChannelOptions, as as SlackMessage, ai as SentNotification } from '../Application-Hlryz3ln.js';
+export { Z as NotificationAttachment, $ as NotificationChannelFactory, a0 as NotificationClass, a1 as NotificationMailMessage, N as NotificationManager, a2 as NotificationManagerOptions, aq as SlackAttachment, ar as SlackBlock, aG as createNotificationManager, aQ as getNotificationManager, a$ as setNotificationManager } from '../Application-Hlryz3ln.js';
 import { M as MailManager } from '../MailManager-DpMvYiP9.js';
 import 'hono';
-import '../api-token-BGOsfuI9.js';
+import '../api-token-ChekhpB7.js';
 import '@guren/orm';
 import 'vite';
 import '../EventManager-CmIoLt7r.js';

package/dist/queue/index.d.ts

@@ -1,8 +1,8 @@
-import { a5 as QueueDriver, a7 as QueuedJob, F as FailedJob, aw as WorkerOptions } from '../Application-D4_90raL.js';
-export { R as Job, T as JobClass, U as JobFailureHandler, V as JobHandler, W as JobOptions, a4 as QueueConfig, a6 as QueueDriverFactory, Q as QueueManager, aA as clearJobRegistry, aH as createQueueManager, aP as getJob, aR as getQueueDriver, aS as getRegisteredJobs, aW as registerJob, b0 as setQueueDriver } from '../Application-D4_90raL.js';
+import { a5 as QueueDriver, a7 as QueuedJob, F as FailedJob, aw as WorkerOptions } from '../Application-Hlryz3ln.js';
+export { R as Job, T as JobClass, U as JobFailureHandler, V as JobHandler, W as JobOptions, a4 as QueueConfig, a6 as QueueDriverFactory, Q as QueueManager, aA as clearJobRegistry, aH as createQueueManager, aP as getJob, aR as getQueueDriver, aS as getRegisteredJobs, aW as registerJob, b0 as setQueueDriver } from '../Application-Hlryz3ln.js';
 import { Redis } from 'ioredis';
 import 'hono';
-import '../api-token-BGOsfuI9.js';
+import '../api-token-ChekhpB7.js';
 import '@guren/orm';
 import 'vite';
 import '../EventManager-CmIoLt7r.js';

package/dist/runtime/index.d.ts

@@ -1,7 +1,7 @@
-import { A as Application } from '../Application-D4_90raL.js';
-export { D as DevBannerOptions, G as GUREN_ASCII_ART, a as StartViteDevServerOptions, b as StartedViteDevServer, l as logDevServerBanner, s as startViteDevServer } from '../Application-D4_90raL.js';
+import { A as Application } from '../Application-Hlryz3ln.js';
+export { D as DevBannerOptions, G as GUREN_ASCII_ART, a as StartViteDevServerOptions, b as StartedViteDevServer, l as logDevServerBanner, s as startViteDevServer } from '../Application-Hlryz3ln.js';
 import 'hono';
-import '../api-token-BGOsfuI9.js';
+import '../api-token-ChekhpB7.js';
 import '@guren/orm';
 import 'vite';
 import '../EventManager-CmIoLt7r.js';

package/dist/runtime/index.js

@@ -3,7 +3,7 @@ import {
   logDevServerBanner,
   parseImportMap,
   startViteDevServer
-} from "../chunk-NFGDKY3L.js";
+} from "../chunk-X4E2I4Z5.js";
 import {
   hash
 } from "../chunk-QQKTH5KX.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guren/server",
-  "version": "1.0.0-rc.23",
+  "version": "1.0.0-rc.25",
   "type": "module",
   "license": "MIT",
   "repository": {
@@ -105,8 +105,8 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@guren/inertia-client": "^1.0.0-rc.22",
-    "@guren/orm": "^1.0.0-rc.24",
+    "@guren/inertia-client": "^1.0.0-rc.24",
+    "@guren/orm": "^1.0.0-rc.26",
     "@modelcontextprotocol/sdk": "^1.27.1",
     "chalk": "^5.3.0",
     "consola": "^3.4.2",