@guren/server 1.0.0-rc.24 → 1.0.0-rc.26

package/dist/{Application-D4_90raL.d.ts → Application-BnsyCKXY.d.ts}

@@ -1,6 +1,7 @@
 import * as hono from 'hono';
 import { Context, MiddlewareHandler, Hono, Next, ExecutionContext } from 'hono';
-import { A as AuthManager, O as OAuthManager, a as AuthContext, b as ApiToken, C as CreateSessionMiddlewareOptions } from './api-token-BGOsfuI9.js';
+import { l as OAuthManager, g as AuthContext, j as ApiToken, C as CreateSessionMiddlewareOptions } from './api-token-BSSCLlFW.js';
+import { A as AuthManager } from './AuthManager-SfhCNkAU.js';
 import { InlineConfig, ViteDevServer } from 'vite';
 import { E as EventManager } from './EventManager-CmIoLt7r.js';
 import { C as CacheManager } from './CacheManager-BkvHEOZX.js';
@@ -2177,4 +2178,4 @@ declare class Application {
 }
 declare function createApp(options?: ApplicationOptions): Application;
 
-export { type NotificationChannelFactory as $, Application as A, type InertiaSharedProps as B, Container as C, type DevBannerOptions as D, type ErrorResponse as E, type FailedJob as F, GUREN_ASCII_ART as G, type HostAuthorizationOptions as H, type InertiaOptions as I, type InertiaSsrContext as J, type InertiaSsrOptions as K, type InertiaSsrRenderer as L, type InertiaSsrResult as M, NotificationManager as N, type InferInertiaProps as O, type Provider as P, QueueManager as Q, Job as R, ServiceProvider as S, type JobClass as T, type JobFailureHandler as U, type JobHandler as V, type JobOptions as W, type Notifiable as X, Notification as Y, type NotificationAttachment as Z, type NotificationChannel as _, type StartViteDevServerOptions as a, setNotificationManager as a$, type NotificationClass as a0, type NotificationMailMessage as a1, type NotificationManagerOptions as a2, ProviderManager as a3, type QueueConfig as a4, type QueueDriver as a5, type QueueDriverFactory as a6, type QueuedJob as a7, type RendererRegistration as a8, type ResolvedSharedInertiaProps as a9, clearJobRegistry as aA, createApp as aB, createContainer as aC, createCsrfMiddleware as aD, createExceptionHandler as aE, createHostAuthorizationMiddleware as aF, createNotificationManager as aG, createQueueManager as aH, createSecurityHeaders as aI, csrfField as aJ, formatValidationErrors as aK, getContainer as aL, getCsrfToken as aM, getExceptionHandler as aN, getInertiaSharedPropsResolver as aO, getJob as aP, getNotificationManager as aQ, getQueueDriver as aR, getRegisteredJobs as aS, getValidatedData as aT, inertia as aU, parseRequestPayload as aV, registerJob as aW, resolve as aX, setContainer as aY, setExceptionHandler as aZ, setInertiaSharedProps as a_, type ResourceRouteOptions as aa, type RouteBuilder as ab, type RouteContractOptions as ac, type RouteDefinition as ad, type RouteOpenApiMetadata as ae, type ResourceAction as af, Router as ag, type SecurityHeadersOptions as ah, type SentNotification as ai, type ServiceBinding as aj, type ServiceClass as ak, type ServiceFactory as al, type ServiceProviderClass as am, type ServiceProviderConstructor as an, type ServiceProviderOptions as ao, type SharedInertiaPropsResolver as ap, type SlackAttachment as aq, type SlackBlock as ar, type SlackMessage as as, VALIDATED_DATA_KEY as at, type ValidateRequestOptions as au, type ValidationSchema as av, type WorkerOptions as aw, abort as ax, abortIf as ay, abortUnless as az, type StartedViteDevServer as b, setQueueDriver as b0, shareInertiaProps as b1, validate as b2, validateRequest as b3, validateRequestWith as b4, validateSafe as b5, verifyCsrfToken as b6, type ServiceBindings as c, type ApplicationListenOptions as d, type AuthPayload as e, CSRF_FORM_FIELD as f, CSRF_HEADER_NAME as g, CSRF_TOKEN_KEY as h, type ContextualBinding as i, type ContextualBindingBuilder as j, type ContextualNeedsBuilder as k, logDevServerBanner as l, Controller as m, type ControllerInertiaProps as n, type CsrfOptions as o, type DatabaseChannelOptions as p, type DatabaseNotification as q, type ExceptionClass as r, startViteDevServer as s, ExceptionHandler as t, type ExceptionHandlerOptions as u, type ExceptionRenderer as v, type ExceptionReporter as w, type HstsOptions as x, type InertiaPagePayload as y, type InertiaResponse as z };
+export { type NotificationAttachment as $, Application as A, type InertiaPagePayload as B, Container as C, type DevBannerOptions as D, type ErrorResponse as E, type FailedJob as F, GUREN_ASCII_ART as G, type HostAuthorizationOptions as H, type InertiaOptions as I, type InertiaResponse as J, type InertiaSharedProps as K, type InertiaSsrContext as L, type InertiaSsrOptions as M, NotificationManager as N, type InertiaSsrRenderer as O, type Provider as P, QueueManager as Q, type InertiaSsrResult as R, ServiceProvider as S, type InferInertiaProps as T, Job as U, type JobClass as V, type JobFailureHandler as W, type JobHandler as X, type JobOptions as Y, type Notifiable as Z, Notification as _, type StartViteDevServerOptions as a, setExceptionHandler as a$, type NotificationChannel as a0, type NotificationChannelFactory as a1, type NotificationClass as a2, type NotificationMailMessage as a3, type NotificationManagerOptions as a4, ProviderManager as a5, type QueueConfig as a6, type QueueDriver as a7, type QueueDriverFactory as a8, type QueuedJob as a9, abortIf as aA, abortUnless as aB, clearJobRegistry as aC, createApp as aD, createContainer as aE, createCsrfMiddleware as aF, createExceptionHandler as aG, createHostAuthorizationMiddleware as aH, createNotificationManager as aI, createQueueManager as aJ, createSecurityHeaders as aK, csrfField as aL, formatValidationErrors as aM, getContainer as aN, getCsrfToken as aO, getExceptionHandler as aP, getInertiaSharedPropsResolver as aQ, getJob as aR, getNotificationManager as aS, getQueueDriver as aT, getRegisteredJobs as aU, getValidatedData as aV, inertia as aW, parseRequestPayload as aX, registerJob as aY, resolve as aZ, setContainer as a_, type RendererRegistration as aa, type ResolvedSharedInertiaProps as ab, type ResourceRouteOptions as ac, type RouteBuilder as ad, type RouteContractOptions as ae, type RouteDefinition as af, type RouteOpenApiMetadata as ag, type ResourceAction as ah, Router as ai, type SecurityHeadersOptions as aj, type SentNotification as ak, type ServiceBinding as al, type ServiceClass as am, type ServiceFactory as an, type ServiceProviderClass as ao, type ServiceProviderConstructor as ap, type ServiceProviderOptions as aq, type SharedInertiaPropsResolver as ar, type SlackAttachment as as, type SlackBlock as at, type SlackMessage as au, VALIDATED_DATA_KEY as av, type ValidateRequestOptions as aw, type ValidationSchema as ax, type WorkerOptions as ay, abort as az, type StartedViteDevServer as b, setInertiaSharedProps as b0, setNotificationManager as b1, setQueueDriver as b2, shareInertiaProps as b3, validate as b4, validateRequest as b5, validateRequestWith as b6, validateSafe as b7, verifyCsrfToken as b8, type ServiceBindings as c, type ApplicationListenOptions as d, type ApplicationOptions as e, type AuthPayload as f, type AuthPluginOptions as g, CSRF_FORM_FIELD as h, CSRF_HEADER_NAME as i, CSRF_TOKEN_KEY as j, type ContextualBinding as k, logDevServerBanner as l, type ContextualBindingBuilder as m, type ContextualNeedsBuilder as n, Controller as o, type ControllerInertiaProps as p, type CsrfOptions as q, type DatabaseChannelOptions as r, startViteDevServer as s, type DatabaseNotification as t, type ExceptionClass as u, ExceptionHandler as v, type ExceptionHandlerOptions as w, type ExceptionRenderer as x, type ExceptionReporter as y, type HstsOptions as z };

package/dist/AuthManager-SfhCNkAU.d.ts

@@ -0,0 +1,79 @@
+import { Context } from 'hono';
+import { Model } from '@guren/orm';
+import { A as Authenticatable, U as UserProvider, a as AuthCredentials, b as AuthManagerContract, c as AuthManagerOptions, G as GuardFactory, P as ProviderFactory, d as GuardContext, e as Guard, f as AttachContextOptions, g as AuthContext } from './api-token-BSSCLlFW.js';
+
+interface PasswordHasher {
+    hash(plain: string): Promise<string>;
+    verify(hashed: string, plain: string): Promise<boolean>;
+    needsRehash?(hashed: string): boolean;
+}
+
+declare abstract class BaseUserProvider<User extends Authenticatable = Authenticatable> implements UserProvider<User> {
+    abstract retrieveById(identifier: unknown): Promise<User | null>;
+    abstract retrieveByCredentials(credentials: AuthCredentials): Promise<User | null>;
+    abstract validateCredentials(user: User, credentials: AuthCredentials): Promise<boolean>;
+    abstract getId(user: User): unknown;
+    setRememberToken(user: User, token: string | null): Promise<void>;
+    getRememberToken(user: User): Promise<string | null>;
+}
+
+interface ModelUserProviderOptions {
+    idColumn?: string;
+    usernameColumn?: string;
+    passwordColumn?: string;
+    rememberTokenColumn?: string;
+    hasher?: PasswordHasher;
+    credentialsPasswordField?: string;
+}
+declare class ModelUserProvider<User extends Authenticatable = Authenticatable> extends BaseUserProvider<User> {
+    private readonly model;
+    private readonly idColumn;
+    private readonly usernameColumn;
+    private readonly passwordColumn;
+    private readonly rememberTokenColumn;
+    private readonly hasher;
+    private readonly credentialsPasswordField;
+    constructor(model: typeof Model, options?: ModelUserProviderOptions);
+    private cast;
+    retrieveById(identifier: unknown): Promise<User | null>;
+    retrieveByCredentials(credentials: AuthCredentials): Promise<User | null>;
+    validateCredentials(user: User, credentials: AuthCredentials): Promise<boolean>;
+    getId(user: User): unknown;
+    /**
+     * Strip the password hash, remember token, and the model's `hidden`
+     * fields before the record leaves the auth layer. Credential
+     * validation happens on the raw record before sanitizing, so this
+     * never affects login — only what `auth.user()` exposes.
+     */
+    sanitize(user: User): User;
+    setRememberToken(user: User, token: string | null): Promise<void>;
+    getRememberToken(user: User): Promise<string | null>;
+}
+
+declare class AuthManager implements AuthManagerContract {
+    private readonly guards;
+    private readonly providers;
+    private defaultGuard;
+    constructor(options?: AuthManagerOptions);
+    registerGuard<User>(name: string, factory: GuardFactory<User>): void;
+    registerProvider<User>(name: string, factory: ProviderFactory<User>): void;
+    getProvider<User>(name: string): UserProvider<User>;
+    createGuard<User>(name: string, context: GuardContext): Guard<User>;
+    guardNames(): string[];
+    setDefaultGuard(name: string): void;
+    getDefaultGuard(): string;
+    createAuthContext(ctx: Context, options?: AttachContextOptions): AuthContext;
+    attempt(name: string, ctx: Context, credentials: AuthCredentials, remember?: boolean): Promise<boolean>;
+    /**
+     * Shorthand method to register a model-based authentication provider and session guard.
+     * This simplifies the common case of authenticating users via a database model.
+     *
+     * @param model - The model class to use for user authentication
+     * @param options - Options for the ModelUserProvider (partial, with defaults)
+     * @param providerName - Name for the provider (defaults to 'users')
+     * @param guardName - Name for the guard (defaults to 'web')
+     */
+    useModel(model: typeof Model<PlainObject>, options?: Partial<ModelUserProviderOptions>, providerName?: string, guardName?: string): void;
+}
+
+export { AuthManager as A, BaseUserProvider as B, ModelUserProvider as M, type PasswordHasher as P };

package/dist/{ConsoleKernel-BPYcP-2f.d.ts → ConsoleKernel-BDtBETjm.d.ts}

@@ -1,4 +1,4 @@
-import { C as Container } from './Application-D4_90raL.js';
+import { C as Container } from './Application-BnsyCKXY.js';
 
 /**
  * Parsed argument definition.

package/dist/{api-token-BGOsfuI9.d.ts → api-token-BSSCLlFW.d.ts}

@@ -1,5 +1,4 @@
 import { MiddlewareHandler, Context } from 'hono';
-import { Model } from '@guren/orm';
 
 type SessionData = Record<string, unknown>;
 interface SessionStore {
@@ -84,6 +83,12 @@ interface UserProvider<User = Authenticatable> {
     getId(user: User): unknown;
     setRememberToken?(user: User, token: string | null): Promise<void> | void;
     getRememberToken?(user: User): Promise<string | null> | string | null;
+    /**
+     * Strip fields that must never leave the auth layer (password hashes,
+     * remember tokens, model `hidden` fields) from a user record before it
+     * is cached or handed to application code via guard.user().
+     */
+    sanitize?(user: User): User;
 }
 interface GuardContext {
     ctx: Context;
@@ -123,73 +128,6 @@ interface AuthManagerContract {
     createAuthContext(ctx: Context, options?: AttachContextOptions): AuthContext;
 }
 
-interface PasswordHasher {
-    hash(plain: string): Promise<string>;
-    verify(hashed: string, plain: string): Promise<boolean>;
-    needsRehash?(hashed: string): boolean;
-}
-
-declare abstract class BaseUserProvider<User extends Authenticatable = Authenticatable> implements UserProvider<User> {
-    abstract retrieveById(identifier: unknown): Promise<User | null>;
-    abstract retrieveByCredentials(credentials: AuthCredentials): Promise<User | null>;
-    abstract validateCredentials(user: User, credentials: AuthCredentials): Promise<boolean>;
-    abstract getId(user: User): unknown;
-    setRememberToken(user: User, token: string | null): Promise<void>;
-    getRememberToken(user: User): Promise<string | null>;
-}
-
-interface ModelUserProviderOptions {
-    idColumn?: string;
-    usernameColumn?: string;
-    passwordColumn?: string;
-    rememberTokenColumn?: string;
-    hasher?: PasswordHasher;
-    credentialsPasswordField?: string;
-}
-declare class ModelUserProvider<User extends Authenticatable = Authenticatable> extends BaseUserProvider<User> {
-    private readonly model;
-    private readonly idColumn;
-    private readonly usernameColumn;
-    private readonly passwordColumn;
-    private readonly rememberTokenColumn;
-    private readonly hasher;
-    private readonly credentialsPasswordField;
-    constructor(model: typeof Model, options?: ModelUserProviderOptions);
-    private cast;
-    retrieveById(identifier: unknown): Promise<User | null>;
-    retrieveByCredentials(credentials: AuthCredentials): Promise<User | null>;
-    validateCredentials(user: User, credentials: AuthCredentials): Promise<boolean>;
-    getId(user: User): unknown;
-    setRememberToken(user: User, token: string | null): Promise<void>;
-    getRememberToken(user: User): Promise<string | null>;
-}
-
-declare class AuthManager implements AuthManagerContract {
-    private readonly guards;
-    private readonly providers;
-    private defaultGuard;
-    constructor(options?: AuthManagerOptions);
-    registerGuard<User>(name: string, factory: GuardFactory<User>): void;
-    registerProvider<User>(name: string, factory: ProviderFactory<User>): void;
-    getProvider<User>(name: string): UserProvider<User>;
-    createGuard<User>(name: string, context: GuardContext): Guard<User>;
-    guardNames(): string[];
-    setDefaultGuard(name: string): void;
-    getDefaultGuard(): string;
-    createAuthContext(ctx: Context, options?: AttachContextOptions): AuthContext;
-    attempt(name: string, ctx: Context, credentials: AuthCredentials, remember?: boolean): Promise<boolean>;
-    /**
-     * Shorthand method to register a model-based authentication provider and session guard.
-     * This simplifies the common case of authenticating users via a database model.
-     *
-     * @param model - The model class to use for user authentication
-     * @param options - Options for the ModelUserProvider (partial, with defaults)
-     * @param providerName - Name for the provider (defaults to 'users')
-     * @param guardName - Name for the guard (defaults to 'web')
-     */
-    useModel(model: typeof Model<PlainObject>, options?: Partial<ModelUserProviderOptions>, providerName?: string, guardName?: string): void;
-}
-
 interface OAuthProviderConfig {
     clientId: string;
     clientSecret: string;
@@ -249,7 +187,12 @@ interface OAuthManagerOptions {
 }
 declare class MemoryOAuthStateStore implements OAuthStateStore {
     private readonly states;
+    private readonly maxEntries;
+    constructor(options?: {
+        maxEntries?: number;
+    });
     store(stateHash: string, payload: OAuthStatePayload): Promise<void>;
+    private sweepExpired;
     find(stateHash: string): Promise<OAuthStatePayload | null>;
     delete(stateHash: string): Promise<void>;
     clear(): void;
@@ -595,4 +538,4 @@ declare function getApiTokenOrFail(ctx: Context): {
     abilities: string[];
 };
 
-export { parseOAuthRedirectUrl as $, AuthManager as A, BaseUserProvider as B, type CreateSessionMiddlewareOptions as C, type SessionStore as D, buildOAuthAuthorizeUrl as E, buildOAuthRedirectUrl as F, type Guard as G, createApiToken as H, createBearerTokenMiddleware as I, createDiscordOAuthProviderConfig as J, createGitHubOAuthProviderConfig as K, createGoogleOAuthProviderConfig as L, MemoryApiTokenStore as M, createOAuthManager as N, OAuthManager as O, type ProviderFactory as P, createOAuthState as Q, createSessionMiddleware as R, type Session as S, exchangeOAuthCode as T, type UserProvider as U, fetchOAuthUserProfile as V, getApiToken as W, getApiTokenOrFail as X, getSessionFromContext as Y, getUserApiTokens as Z, parseApiToken as _, type AuthContext as a, revokeAllApiTokens as a0, revokeApiToken as a1, tokenCan as a2, tokenCanAll as a3, tokenCanAny as a4, verifyApiToken as a5, verifyOAuthState as a6, type PasswordHasher as a7, type AttachContextOptions as a8, type AuthManagerContract as a9, type ApiToken as b, API_TOKEN_KEY as c, type ApiTokenStore as d, type AuthCredentials as e, type AuthManagerOptions as f, type Authenticatable as g, type BearerTokenMiddlewareOptions as h, type CreateApiTokenOptions as i, type CreateApiTokenResult as j, type GuardContext as k, type GuardFactory as l, MemoryOAuthStateStore as m, MemorySessionStore as n, ModelUserProvider as o, type OAuthAuthorizeOptions as p, type OAuthCallbackPayload as q, type OAuthManagerOptions as r, type OAuthProviderConfig as s, type OAuthProviderFactoryInput as t, type OAuthStateConfig as u, type OAuthStatePayload as v, type OAuthStateStore as w, type OAuthTokenResult as x, type OAuthUserProfile as y, type SessionData as z };
+export { revokeAllApiTokens as $, type Authenticatable as A, type BearerTokenMiddlewareOptions as B, type CreateSessionMiddlewareOptions as C, buildOAuthAuthorizeUrl as D, buildOAuthRedirectUrl as E, createApiToken as F, type GuardFactory as G, createBearerTokenMiddleware as H, createDiscordOAuthProviderConfig as I, createGitHubOAuthProviderConfig as J, createGoogleOAuthProviderConfig as K, createOAuthManager as L, MemoryApiTokenStore as M, createOAuthState as N, type OAuthStateStore as O, type ProviderFactory as P, createSessionMiddleware as Q, exchangeOAuthCode as R, type SessionStore as S, fetchOAuthUserProfile as T, type UserProvider as U, getApiToken as V, getApiTokenOrFail as W, getSessionFromContext as X, getUserApiTokens as Y, parseApiToken as Z, parseOAuthRedirectUrl as _, type AuthCredentials as a, revokeApiToken as a0, tokenCan as a1, tokenCanAll as a2, tokenCanAny as a3, verifyApiToken as a4, verifyOAuthState as a5, type AuthManagerContract as b, type AuthManagerOptions as c, type GuardContext as d, type Guard as e, type AttachContextOptions as f, type AuthContext as g, type SessionData as h, type ApiTokenStore as i, type ApiToken as j, type OAuthStatePayload as k, OAuthManager as l, API_TOKEN_KEY as m, type CreateApiTokenOptions as n, type CreateApiTokenResult as o, MemoryOAuthStateStore as p, MemorySessionStore as q, type OAuthAuthorizeOptions as r, type OAuthCallbackPayload as s, type OAuthManagerOptions as t, type OAuthProviderConfig as u, type OAuthProviderFactoryInput as v, type OAuthStateConfig as w, type OAuthTokenResult as x, type OAuthUserProfile as y, type Session as z };

package/dist/auth/index.d.ts

@@ -1,6 +1,9 @@
-import { g as Authenticatable, G as Guard, U as UserProvider, S as Session, e as AuthCredentials, a7 as PasswordHasher } from '../api-token-BGOsfuI9.js';
-export { c as API_TOKEN_KEY, b as ApiToken, d as ApiTokenStore, a8 as AttachContextOptions, a as AuthContext, A as AuthManager, a9 as AuthManagerContract, f as AuthManagerOptions, B as BaseUserProvider, h as BearerTokenMiddlewareOptions, i as CreateApiTokenOptions, j as CreateApiTokenResult, k as GuardContext, l as GuardFactory, M as MemoryApiTokenStore, m as MemoryOAuthStateStore, o as ModelUserProvider, p as OAuthAuthorizeOptions, q as OAuthCallbackPayload, O as OAuthManager, r as OAuthManagerOptions, s as OAuthProviderConfig, t as OAuthProviderFactoryInput, u as OAuthStateConfig, v as OAuthStatePayload, w as OAuthStateStore, x as OAuthTokenResult, y as OAuthUserProfile, P as ProviderFactory, E as buildOAuthAuthorizeUrl, F as buildOAuthRedirectUrl, H as createApiToken, I as createBearerTokenMiddleware, J as createDiscordOAuthProviderConfig, K as createGitHubOAuthProviderConfig, L as createGoogleOAuthProviderConfig, N as createOAuthManager, Q as createOAuthState, T as exchangeOAuthCode, V as fetchOAuthUserProfile, W as getApiToken, X as getApiTokenOrFail, Z as getUserApiTokens, _ as parseApiToken, $ as parseOAuthRedirectUrl, a0 as revokeAllApiTokens, a1 as revokeApiToken, a2 as tokenCan, a3 as tokenCanAll, a4 as tokenCanAny, a5 as verifyApiToken, a6 as verifyOAuthState } from '../api-token-BGOsfuI9.js';
+import { P as PasswordHasher } from '../AuthManager-SfhCNkAU.js';
+export { A as AuthManager, B as BaseUserProvider, M as ModelUserProvider } from '../AuthManager-SfhCNkAU.js';
+import { A as Authenticatable, e as Guard, U as UserProvider, z as Session, a as AuthCredentials } from '../api-token-BSSCLlFW.js';
+export { m as API_TOKEN_KEY, j as ApiToken, i as ApiTokenStore, f as AttachContextOptions, g as AuthContext, b as AuthManagerContract, c as AuthManagerOptions, B as BearerTokenMiddlewareOptions, n as CreateApiTokenOptions, o as CreateApiTokenResult, d as GuardContext, G as GuardFactory, M as MemoryApiTokenStore, p as MemoryOAuthStateStore, r as OAuthAuthorizeOptions, s as OAuthCallbackPayload, l as OAuthManager, t as OAuthManagerOptions, u as OAuthProviderConfig, v as OAuthProviderFactoryInput, w as OAuthStateConfig, k as OAuthStatePayload, O as OAuthStateStore, x as OAuthTokenResult, y as OAuthUserProfile, P as ProviderFactory, D as buildOAuthAuthorizeUrl, E as buildOAuthRedirectUrl, F as createApiToken, H as createBearerTokenMiddleware, I as createDiscordOAuthProviderConfig, J as createGitHubOAuthProviderConfig, K as createGoogleOAuthProviderConfig, L as createOAuthManager, N as createOAuthState, R as exchangeOAuthCode, T as fetchOAuthUserProfile, V as getApiToken, W as getApiTokenOrFail, Y as getUserApiTokens, Z as parseApiToken, _ as parseOAuthRedirectUrl, $ as revokeAllApiTokens, a0 as revokeApiToken, a1 as tokenCan, a2 as tokenCanAll, a3 as tokenCanAny, a4 as verifyApiToken, a5 as verifyOAuthState } from '../api-token-BSSCLlFW.js';
 import { PlainObject, Model } from '@guren/orm';
+export { b as EmailVerificationConfig, a as EmailVerificationToken, c as EmailVerificationTokenResult, E as EmailVerificationTokenStore, M as MemoryEmailVerificationStore, d as MemoryPasswordResetStore, e as PasswordResetConfig, f as PasswordResetTokenResult, P as PasswordResetTokenStore, g as buildPasswordResetUrl, q as buildTokenUrl, h as buildVerificationUrl, i as completeEmailVerification, j as completePasswordReset, k as createEmailVerificationToken, l as createPasswordResetToken, s as generateId, t as generateToken, u as hashToken, m as isEmailVerified, p as parsePasswordResetUrl, w as parseTokenUrl, n as parseVerificationUrl, r as requireVerifiedEmail, x as secureCompare, y as secureStringCompare, v as verifyEmailToken, o as verifyPasswordResetToken } from '../email-verification-CAeArjui.js';
 import 'hono';
 
 interface SessionGuardOptions {
@@ -18,6 +21,8 @@ declare class SessionGuard<User extends Authenticatable = Authenticatable> imple
     private sessionKey;
     private rememberSessionKey;
     private loadRememberedUser;
+    /** Strip auth-internal fields before a record is cached or exposed. */
+    private sanitizeUser;
     private resolveUser;
     check(): Promise<boolean>;
     guest(): Promise<boolean>;
@@ -92,328 +97,4 @@ declare abstract class AuthenticatableModel<TRecord extends PlainObject = PlainO
     protected static preparePersistencePayload(data: PlainObject): Promise<PlainObject>;
 }
 
-/**
- * Hash a token using SHA-256 or SHA-512.
- */
-declare function hashToken(token: string, algorithm?: 'sha256' | 'sha512'): string;
-/**
- * Generate a secure random token.
- */
-declare function generateToken(length?: number): string;
-/**
- * Generate a random ID (16 bytes = 32 hex chars).
- */
-declare function generateId(): string;
-/**
- * Securely compare two hex strings using timing-safe comparison.
- */
-declare function secureCompare(a: string, b: string): boolean;
-/**
- * Securely compare two arbitrary strings using timing-safe comparison.
- * Unlike secureCompare, this works with any string encoding (UUIDs, tokens, etc.).
- */
-declare function secureStringCompare(a: string, b: string): boolean;
-/**
- * Build a URL with token and optional email parameters.
- */
-declare function buildTokenUrl(baseUrl: string, token: string, email?: string): string;
-/**
- * Parse a URL to extract token and email parameters.
- */
-declare function parseTokenUrl(url: string): {
-    token: string | null;
-    email: string | null;
-};
-
-/**
- * Configuration for password reset tokens.
- */
-interface PasswordResetConfig {
-    /** Token expiration time in milliseconds (default: 1 hour) */
-    expiresIn?: number;
-    /** Token byte length before encoding (default: 32) */
-    tokenLength?: number;
-}
-/**
- * Storage interface for password reset tokens.
- */
-interface PasswordResetTokenStore {
-    /** Store a token ID with associated email and expiration */
-    store(tokenId: string, email: string, expiresAt: Date): Promise<void>;
-    /** Find email by token ID, returns null if not found or expired */
-    find(tokenId: string): Promise<{
-        email: string;
-        expiresAt: Date;
-    } | null>;
-    /** Delete a token ID from storage */
-    delete(tokenId: string): Promise<void>;
-    /** Delete all tokens for an email */
-    deleteForEmail(email: string): Promise<void>;
-}
-/**
- * In-memory token store for testing and development.
- */
-declare class MemoryPasswordResetStore implements PasswordResetTokenStore {
-    private tokens;
-    store(tokenId: string, email: string, expiresAt: Date): Promise<void>;
-    find(tokenId: string): Promise<{
-        email: string;
-        expiresAt: Date;
-    } | null>;
-    delete(tokenId: string): Promise<void>;
-    deleteForEmail(email: string): Promise<void>;
-    /** Clear all tokens (useful for testing) */
-    clear(): void;
-}
-/**
- * Result of creating a password reset token.
- */
-interface PasswordResetTokenResult {
-    /** The plain-text token to send to the user (via email) */
-    token: string;
-    /** The token ID stored in the backing store */
-    tokenId: string;
-    /** When the token expires */
-    expiresAt: Date;
-}
-/**
- * Create a password reset token for a user.
- *
- * @param email - The user's email address
- * @param store - The token storage implementation
- * @param config - Optional configuration
- * @returns The token result containing plain token and hash
- */
-declare function createPasswordResetToken(email: string, store: PasswordResetTokenStore, config?: PasswordResetConfig): Promise<PasswordResetTokenResult>;
-/**
- * Verify a password reset token.
- *
- * @param token - The plain-text token from the reset URL
- * @param store - The token storage implementation
- * @param config - Optional configuration (must match createPasswordResetToken config)
- * @returns The email if token is valid, null otherwise
- */
-declare function verifyPasswordResetToken(token: string, store: PasswordResetTokenStore, _config?: PasswordResetConfig): Promise<string | null>;
-/**
- * Complete a password reset by updating the user's password and invalidating the token.
- *
- * @param token - The plain-text token from the reset URL
- * @param newPassword - The new password (should be validated by caller)
- * @param store - The token storage implementation
- * @param provider - The user provider to look up and update the user
- * @param updatePassword - Function to update the user's password
- * @param config - Optional configuration
- * @returns The user if reset was successful, null if token is invalid
- */
-declare function completePasswordReset<T extends Authenticatable>(token: string, newPassword: string, store: PasswordResetTokenStore, provider: UserProvider<T>, updatePassword: (user: T, password: string) => Promise<void>, _config?: PasswordResetConfig): Promise<T | null>;
-/**
- * Build a password reset URL from a base URL and token.
- */
-declare const buildPasswordResetUrl: typeof buildTokenUrl;
-/**
- * Parse a password reset URL to extract the token and optional email.
- */
-declare const parsePasswordResetUrl: typeof parseTokenUrl;
-
-/**
- * Email verification token data stored in the backing store.
- * Only the hashed token is stored for security.
- */
-interface EmailVerificationToken {
-    email: string;
-    tokenId: string;
-    expiresAt: Date;
-    createdAt: Date;
-}
-/**
- * Store interface for email verification tokens.
- * Implement this to use database-backed storage.
- */
-interface EmailVerificationTokenStore {
-    /**
-     * Store a new verification token.
-     */
-    store(token: EmailVerificationToken): Promise<void>;
-    /**
-     * Find a token by its opaque token ID.
-     */
-    findByTokenId(tokenId: string): Promise<EmailVerificationToken | null>;
-    /**
-     * Delete a token by its opaque token ID.
-     */
-    delete(tokenId: string): Promise<void>;
-    /**
-     * Delete all tokens for a given email.
-     */
-    deleteForEmail(email: string): Promise<void>;
-}
-/**
- * In-memory store for testing purposes.
- * Do NOT use in production - tokens will be lost on restart.
- */
-declare class MemoryEmailVerificationStore implements EmailVerificationTokenStore {
-    private tokens;
-    store(token: EmailVerificationToken): Promise<void>;
-    findByTokenId(tokenId: string): Promise<EmailVerificationToken | null>;
-    delete(tokenId: string): Promise<void>;
-    deleteForEmail(email: string): Promise<void>;
-    /**
-     * Clear all tokens (useful for testing).
-     */
-    clear(): void;
-    /**
-     * Get the count of stored tokens (useful for testing).
-     */
-    get size(): number;
-}
-/**
- * Configuration options for email verification.
- */
-interface EmailVerificationConfig {
-    /**
-     * Token expiration time in milliseconds.
-     * @default 86400000 (24 hours)
-     */
-    expiresIn?: number;
-    /**
-     * Token byte length (before hex encoding).
-     * @default 32
-     */
-    tokenLength?: number;
-}
-/**
- * Result of creating an email verification token.
- */
-interface EmailVerificationTokenResult {
-    /**
-     * The raw token to send to the user via email.
-     * This is NOT stored - only the hash is stored.
-     */
-    token: string;
-    /**
-     * When the token expires.
-     */
-    expiresAt: Date;
-}
-/**
- * Create a new email verification token.
- *
- * @param email - The email address to verify
- * @param store - Token store implementation
- * @param config - Optional configuration
- * @returns The raw token to send via email
- *
- * @example
- * ```ts
- * const { token, expiresAt } = await createEmailVerificationToken(
- *   user.email,
- *   verificationStore
- * )
- *
- * // Send email with verification link
- * await sendEmail({
- *   to: user.email,
- *   subject: 'Verify your email',
- *   html: `<a href="${buildVerificationUrl(baseUrl, token)}">Verify Email</a>`,
- * })
- * ```
- */
-declare function createEmailVerificationToken(email: string, store: EmailVerificationTokenStore, config?: EmailVerificationConfig): Promise<EmailVerificationTokenResult>;
-/**
- * Verify an email verification token.
- *
- * @param token - The raw token from the verification link
- * @param store - Token store implementation
- * @param config - Optional configuration (not currently used, reserved for future)
- * @returns The email address if valid, null if invalid or expired
- *
- * @example
- * ```ts
- * const email = await verifyEmailToken(token, verificationStore)
- *
- * if (!email) {
- *   return ctx.json({ error: 'Invalid or expired token' }, 400)
- * }
- *
- * // Mark user as verified
- * await User.update({ email }, { emailVerifiedAt: new Date() })
- * ```
- */
-declare function verifyEmailToken(token: string, store: EmailVerificationTokenStore, _config?: EmailVerificationConfig): Promise<string | null>;
-/**
- * Complete email verification by consuming the token.
- *
- * @param token - The raw token from the verification link
- * @param store - Token store implementation
- * @param markVerified - Function to mark the user as verified
- * @returns The result of markVerified if successful, null if token invalid
- *
- * @example
- * ```ts
- * const result = await completeEmailVerification(
- *   token,
- *   verificationStore,
- *   async (email) => {
- *     await User.update({ email }, { emailVerifiedAt: new Date() })
- *     return User.findByEmail(email)
- *   }
- * )
- *
- * if (!result) {
- *   return ctx.json({ error: 'Invalid or expired token' }, 400)
- * }
- *
- * return ctx.redirect('/dashboard')
- * ```
- */
-declare function completeEmailVerification<T>(token: string, store: EmailVerificationTokenStore, markVerified: (email: string) => Promise<T>): Promise<T | null>;
-/**
- * Build a verification URL.
- */
-declare const buildVerificationUrl: typeof buildTokenUrl;
-/**
- * Parse a verification URL to extract token and email.
- */
-declare const parseVerificationUrl: typeof parseTokenUrl;
-/**
- * Check if a user's email is verified.
- * Helper function for use with User models.
- *
- * @param user - User object with emailVerifiedAt field
- * @returns true if verified, false otherwise
- *
- * @example
- * ```ts
- * if (!isEmailVerified(user)) {
- *   return ctx.redirect('/verify-email')
- * }
- * ```
- */
-declare function isEmailVerified(user: {
-    emailVerifiedAt?: Date | null;
-} | null): boolean;
-/**
- * Middleware factory to require verified email.
- *
- * @param options - Configuration options
- * @returns Middleware function
- *
- * @example
- * ```ts
- * router.get('/dashboard', [DashboardController, 'index'],
- *   requireAuthenticated(),
- *   requireVerifiedEmail({ redirectTo: '/verify-email' })
- * )
- * ```
- */
-declare function requireVerifiedEmail(options?: {
-    redirectTo?: string;
-    getUser?: (ctx: unknown) => Promise<{
-        emailVerifiedAt?: Date | null;
-    } | null>;
-}): (ctx: {
-    get: (key: string) => unknown;
-    redirect: (url: string) => Response;
-}, next: () => Promise<void>) => Promise<Response | undefined>;
-
-export { AuthCredentials, Authenticatable, AuthenticatableModel, type EmailVerificationConfig, type EmailVerificationToken, type EmailVerificationTokenResult, type EmailVerificationTokenStore, Guard, MemoryEmailVerificationStore, MemoryPasswordResetStore, NodeHasher, PasswordHasher, type PasswordResetConfig, type PasswordResetTokenResult, type PasswordResetTokenStore, ScryptHasher, SessionGuard, UserProvider, buildPasswordResetUrl, buildTokenUrl, buildVerificationUrl, completeEmailVerification, completePasswordReset, createEmailVerificationToken, createPasswordResetToken, generateId, generateToken, hashToken, isEmailVerified, parsePasswordResetUrl, parseTokenUrl, parseVerificationUrl, requireVerifiedEmail, secureCompare, secureStringCompare, verifyEmailToken, verifyPasswordResetToken };
+export { AuthCredentials, Authenticatable, AuthenticatableModel, Guard, NodeHasher, PasswordHasher, ScryptHasher, SessionGuard, UserProvider };

package/dist/auth/index.js

@@ -54,7 +54,7 @@ import {
   verifyEmailToken,
   verifyOAuthState,
   verifyPasswordResetToken
-} from "../chunk-F3664MFN.js";
+} from "../chunk-2T6JN4VR.js";
 import "../chunk-DAQKYKLH.js";
 import "../chunk-ONSDE37A.js";
 import "../chunk-QQKTH5KX.js";