@guren/server 1.0.0-rc.24 → 1.0.0-rc.26

package/dist/email-verification-CAeArjui.d.ts

@@ -0,0 +1,327 @@
+import { A as Authenticatable, U as UserProvider } from './api-token-BSSCLlFW.js';
+
+/**
+ * Hash a token using SHA-256 or SHA-512.
+ */
+declare function hashToken(token: string, algorithm?: 'sha256' | 'sha512'): string;
+/**
+ * Generate a secure random token.
+ */
+declare function generateToken(length?: number): string;
+/**
+ * Generate a random ID (16 bytes = 32 hex chars).
+ */
+declare function generateId(): string;
+/**
+ * Securely compare two hex strings using timing-safe comparison.
+ */
+declare function secureCompare(a: string, b: string): boolean;
+/**
+ * Securely compare two arbitrary strings using timing-safe comparison.
+ * Unlike secureCompare, this works with any string encoding (UUIDs, tokens, etc.).
+ */
+declare function secureStringCompare(a: string, b: string): boolean;
+/**
+ * Build a URL with token and optional email parameters.
+ */
+declare function buildTokenUrl(baseUrl: string, token: string, email?: string): string;
+/**
+ * Parse a URL to extract token and email parameters.
+ */
+declare function parseTokenUrl(url: string): {
+    token: string | null;
+    email: string | null;
+};
+
+/**
+ * Configuration for password reset tokens.
+ */
+interface PasswordResetConfig {
+    /** Token expiration time in milliseconds (default: 1 hour) */
+    expiresIn?: number;
+    /** Token byte length before encoding (default: 32) */
+    tokenLength?: number;
+}
+/**
+ * Storage interface for password reset tokens.
+ */
+interface PasswordResetTokenStore {
+    /** Store a token ID with associated email and expiration */
+    store(tokenId: string, email: string, expiresAt: Date): Promise<void>;
+    /** Find email by token ID, returns null if not found or expired */
+    find(tokenId: string): Promise<{
+        email: string;
+        expiresAt: Date;
+    } | null>;
+    /** Delete a token ID from storage */
+    delete(tokenId: string): Promise<void>;
+    /** Delete all tokens for an email */
+    deleteForEmail(email: string): Promise<void>;
+}
+/**
+ * In-memory token store for testing and development.
+ */
+declare class MemoryPasswordResetStore implements PasswordResetTokenStore {
+    private tokens;
+    store(tokenId: string, email: string, expiresAt: Date): Promise<void>;
+    find(tokenId: string): Promise<{
+        email: string;
+        expiresAt: Date;
+    } | null>;
+    delete(tokenId: string): Promise<void>;
+    deleteForEmail(email: string): Promise<void>;
+    /** Clear all tokens (useful for testing) */
+    clear(): void;
+}
+/**
+ * Result of creating a password reset token.
+ */
+interface PasswordResetTokenResult {
+    /** The plain-text token to send to the user (via email) */
+    token: string;
+    /** The token ID stored in the backing store */
+    tokenId: string;
+    /** When the token expires */
+    expiresAt: Date;
+}
+/**
+ * Create a password reset token for a user.
+ *
+ * @param email - The user's email address
+ * @param store - The token storage implementation
+ * @param config - Optional configuration
+ * @returns The token result containing plain token and hash
+ */
+declare function createPasswordResetToken(email: string, store: PasswordResetTokenStore, config?: PasswordResetConfig): Promise<PasswordResetTokenResult>;
+/**
+ * Verify a password reset token.
+ *
+ * @param token - The plain-text token from the reset URL
+ * @param store - The token storage implementation
+ * @param config - Optional configuration (must match createPasswordResetToken config)
+ * @returns The email if token is valid, null otherwise
+ */
+declare function verifyPasswordResetToken(token: string, store: PasswordResetTokenStore, _config?: PasswordResetConfig): Promise<string | null>;
+/**
+ * Complete a password reset by updating the user's password and invalidating the token.
+ *
+ * @param token - The plain-text token from the reset URL
+ * @param newPassword - The new password (should be validated by caller)
+ * @param store - The token storage implementation
+ * @param provider - The user provider to look up and update the user
+ * @param updatePassword - Function to update the user's password
+ * @param config - Optional configuration
+ * @returns The user if reset was successful, null if token is invalid
+ */
+declare function completePasswordReset<T extends Authenticatable>(token: string, newPassword: string, store: PasswordResetTokenStore, provider: UserProvider<T>, updatePassword: (user: T, password: string) => Promise<void>, _config?: PasswordResetConfig): Promise<T | null>;
+/**
+ * Build a password reset URL from a base URL and token.
+ */
+declare const buildPasswordResetUrl: typeof buildTokenUrl;
+/**
+ * Parse a password reset URL to extract the token and optional email.
+ */
+declare const parsePasswordResetUrl: typeof parseTokenUrl;
+
+/**
+ * Email verification token data stored in the backing store.
+ * Only the hashed token is stored for security.
+ */
+interface EmailVerificationToken {
+    email: string;
+    tokenId: string;
+    expiresAt: Date;
+    createdAt: Date;
+}
+/**
+ * Store interface for email verification tokens.
+ * Implement this to use database-backed storage.
+ */
+interface EmailVerificationTokenStore {
+    /**
+     * Store a new verification token.
+     */
+    store(token: EmailVerificationToken): Promise<void>;
+    /**
+     * Find a token by its opaque token ID.
+     */
+    findByTokenId(tokenId: string): Promise<EmailVerificationToken | null>;
+    /**
+     * Delete a token by its opaque token ID.
+     */
+    delete(tokenId: string): Promise<void>;
+    /**
+     * Delete all tokens for a given email.
+     */
+    deleteForEmail(email: string): Promise<void>;
+}
+/**
+ * In-memory store for testing purposes.
+ * Do NOT use in production - tokens will be lost on restart.
+ */
+declare class MemoryEmailVerificationStore implements EmailVerificationTokenStore {
+    private tokens;
+    store(token: EmailVerificationToken): Promise<void>;
+    findByTokenId(tokenId: string): Promise<EmailVerificationToken | null>;
+    delete(tokenId: string): Promise<void>;
+    deleteForEmail(email: string): Promise<void>;
+    /**
+     * Clear all tokens (useful for testing).
+     */
+    clear(): void;
+    /**
+     * Get the count of stored tokens (useful for testing).
+     */
+    get size(): number;
+}
+/**
+ * Configuration options for email verification.
+ */
+interface EmailVerificationConfig {
+    /**
+     * Token expiration time in milliseconds.
+     * @default 86400000 (24 hours)
+     */
+    expiresIn?: number;
+    /**
+     * Token byte length (before hex encoding).
+     * @default 32
+     */
+    tokenLength?: number;
+}
+/**
+ * Result of creating an email verification token.
+ */
+interface EmailVerificationTokenResult {
+    /**
+     * The raw token to send to the user via email.
+     * This is NOT stored - only the hash is stored.
+     */
+    token: string;
+    /**
+     * When the token expires.
+     */
+    expiresAt: Date;
+}
+/**
+ * Create a new email verification token.
+ *
+ * @param email - The email address to verify
+ * @param store - Token store implementation
+ * @param config - Optional configuration
+ * @returns The raw token to send via email
+ *
+ * @example
+ * ```ts
+ * const { token, expiresAt } = await createEmailVerificationToken(
+ *   user.email,
+ *   verificationStore
+ * )
+ *
+ * // Send email with verification link
+ * await sendEmail({
+ *   to: user.email,
+ *   subject: 'Verify your email',
+ *   html: `<a href="${buildVerificationUrl(baseUrl, token)}">Verify Email</a>`,
+ * })
+ * ```
+ */
+declare function createEmailVerificationToken(email: string, store: EmailVerificationTokenStore, config?: EmailVerificationConfig): Promise<EmailVerificationTokenResult>;
+/**
+ * Verify an email verification token.
+ *
+ * @param token - The raw token from the verification link
+ * @param store - Token store implementation
+ * @param config - Optional configuration (not currently used, reserved for future)
+ * @returns The email address if valid, null if invalid or expired
+ *
+ * @example
+ * ```ts
+ * const email = await verifyEmailToken(token, verificationStore)
+ *
+ * if (!email) {
+ *   return ctx.json({ error: 'Invalid or expired token' }, 400)
+ * }
+ *
+ * // Mark user as verified
+ * await User.update({ email }, { emailVerifiedAt: new Date() })
+ * ```
+ */
+declare function verifyEmailToken(token: string, store: EmailVerificationTokenStore, _config?: EmailVerificationConfig): Promise<string | null>;
+/**
+ * Complete email verification by consuming the token.
+ *
+ * @param token - The raw token from the verification link
+ * @param store - Token store implementation
+ * @param markVerified - Function to mark the user as verified
+ * @returns The result of markVerified if successful, null if token invalid
+ *
+ * @example
+ * ```ts
+ * const result = await completeEmailVerification(
+ *   token,
+ *   verificationStore,
+ *   async (email) => {
+ *     await User.update({ email }, { emailVerifiedAt: new Date() })
+ *     return User.findByEmail(email)
+ *   }
+ * )
+ *
+ * if (!result) {
+ *   return ctx.json({ error: 'Invalid or expired token' }, 400)
+ * }
+ *
+ * return ctx.redirect('/dashboard')
+ * ```
+ */
+declare function completeEmailVerification<T>(token: string, store: EmailVerificationTokenStore, markVerified: (email: string) => Promise<T>): Promise<T | null>;
+/**
+ * Build a verification URL.
+ */
+declare const buildVerificationUrl: typeof buildTokenUrl;
+/**
+ * Parse a verification URL to extract token and email.
+ */
+declare const parseVerificationUrl: typeof parseTokenUrl;
+/**
+ * Check if a user's email is verified.
+ * Helper function for use with User models.
+ *
+ * @param user - User object with emailVerifiedAt field
+ * @returns true if verified, false otherwise
+ *
+ * @example
+ * ```ts
+ * if (!isEmailVerified(user)) {
+ *   return ctx.redirect('/verify-email')
+ * }
+ * ```
+ */
+declare function isEmailVerified(user: {
+    emailVerifiedAt?: Date | null;
+} | null): boolean;
+/**
+ * Middleware factory to require verified email.
+ *
+ * @param options - Configuration options
+ * @returns Middleware function
+ *
+ * @example
+ * ```ts
+ * router.get('/dashboard', [DashboardController, 'index'],
+ *   requireAuthenticated(),
+ *   requireVerifiedEmail({ redirectTo: '/verify-email' })
+ * )
+ * ```
+ */
+declare function requireVerifiedEmail(options?: {
+    redirectTo?: string;
+    getUser?: (ctx: unknown) => Promise<{
+        emailVerifiedAt?: Date | null;
+    } | null>;
+}): (ctx: {
+    get: (key: string) => unknown;
+    redirect: (url: string) => Response;
+}, next: () => Promise<void>) => Promise<Response | undefined>;
+
+export { type EmailVerificationTokenStore as E, MemoryEmailVerificationStore as M, type PasswordResetTokenStore as P, type EmailVerificationToken as a, type EmailVerificationConfig as b, type EmailVerificationTokenResult as c, MemoryPasswordResetStore as d, type PasswordResetConfig as e, type PasswordResetTokenResult as f, buildPasswordResetUrl as g, buildVerificationUrl as h, completeEmailVerification as i, completePasswordReset as j, createEmailVerificationToken as k, createPasswordResetToken as l, isEmailVerified as m, parseVerificationUrl as n, verifyPasswordResetToken as o, parsePasswordResetUrl as p, buildTokenUrl as q, requireVerifiedEmail as r, generateId as s, generateToken as t, hashToken as u, verifyEmailToken as v, parseTokenUrl as w, secureCompare as x, secureStringCompare as y };

package/dist/index.d.ts

@@ -1,16 +1,19 @@
-import { E as ErrorResponse, S as ServiceProvider, C as Container, c as ServiceBindings, Q as QueueManager, N as NotificationManager } from './Application-D4_90raL.js';
-export { A as Application, d as ApplicationListenOptions, e as AuthPayload, f as CSRF_FORM_FIELD, g as CSRF_HEADER_NAME, h as CSRF_TOKEN_KEY, P as ContainerProvider, i as ContextualBinding, j as ContextualBindingBuilder, k as ContextualNeedsBuilder, m as Controller, n as ControllerInertiaProps, o as CsrfOptions, p as DatabaseChannelOptions, q as DatabaseNotification, r as ExceptionClass, t as ExceptionHandler, u as ExceptionHandlerOptions, v as ExceptionRenderer, w as ExceptionReporter, F as FailedJob, H as HostAuthorizationOptions, x as HstsOptions, I as InertiaOptions, y as InertiaPagePayload, z as InertiaResponse, B as InertiaSharedProps, J as InertiaSsrContext, K as InertiaSsrOptions, L as InertiaSsrRenderer, M as InertiaSsrResult, O as InferInertiaProps, R as Job, T as JobClass, U as JobFailureHandler, V as JobHandler, W as JobOptions, X as Notifiable, Y as Notification, Z as NotificationAttachment, _ as NotificationChannel, $ as NotificationChannelFactory, a0 as NotificationClass, a1 as NotificationMailMessage, a2 as NotificationManagerOptions, a3 as ProviderManager, a4 as QueueConfig, a5 as QueueDriver, a6 as QueueDriverFactory, a7 as QueuedJob, a8 as RendererRegistration, a9 as ResolvedSharedInertiaProps, aa as ResourceRouteOptions, ab as RouteBuilder, ac as RouteContractOptions, ad as RouteDefinition, ae as RouteOpenApiMetadata, af as RouteResourceAction, ag as Router, ah as SecurityHeadersOptions, ai as SentNotification, aj as ServiceBinding, ak as ServiceClass, al as ServiceFactory, am as ServiceProviderClass, an as ServiceProviderConstructor, ao as ServiceProviderOptions, ap as SharedInertiaPropsResolver, aq as SlackAttachment, ar as SlackBlock, as as SlackMessage, at as VALIDATED_DATA_KEY, au as ValidateRequestOptions, av as ValidationSchema, aw as WorkerOptions, ax as abort, ay as abortIf, az as abortUnless, aA as clearJobRegistry, aB as createApp, aC as createContainer, aD as createCsrfMiddleware, aE as createExceptionHandler, aF as createHostAuthorizationMiddleware, aG as createNotificationManager, aH as createQueueManager, aI as createSecurityHeaders, aJ as csrfField, aK as formatValidationErrors, aL as getContainer, aM as getCsrfToken, aN as getExceptionHandler, aO as getInertiaSharedPropsResolver, aP as getJob, aQ as getNotificationManager, aR as getQueueDriver, aS as getRegisteredJobs, aT as getValidatedData, aU as inertia, aV as parseRequestPayload, aW as registerJob, aX as resolve, aY as setContainer, aZ as setExceptionHandler, a_ as setInertiaSharedProps, a$ as setNotificationManager, b0 as setQueueDriver, b1 as shareInertiaProps, b2 as validate, b3 as validateRequest, b4 as validateRequestWith, b5 as validateSafe, b6 as verifyCsrfToken } from './Application-D4_90raL.js';
+import { E as ErrorResponse, S as ServiceProvider, C as Container, c as ServiceBindings, Q as QueueManager, N as NotificationManager } from './Application-BnsyCKXY.js';
+export { A as Application, d as ApplicationListenOptions, e as ApplicationOptions, f as AuthPayload, g as AuthPluginOptions, h as CSRF_FORM_FIELD, i as CSRF_HEADER_NAME, j as CSRF_TOKEN_KEY, P as ContainerProvider, k as ContextualBinding, m as ContextualBindingBuilder, n as ContextualNeedsBuilder, o as Controller, p as ControllerInertiaProps, q as CsrfOptions, r as DatabaseChannelOptions, t as DatabaseNotification, u as ExceptionClass, v as ExceptionHandler, w as ExceptionHandlerOptions, x as ExceptionRenderer, y as ExceptionReporter, F as FailedJob, H as HostAuthorizationOptions, z as HstsOptions, I as InertiaOptions, B as InertiaPagePayload, J as InertiaResponse, K as InertiaSharedProps, L as InertiaSsrContext, M as InertiaSsrOptions, O as InertiaSsrRenderer, R as InertiaSsrResult, T as InferInertiaProps, U as Job, V as JobClass, W as JobFailureHandler, X as JobHandler, Y as JobOptions, Z as Notifiable, _ as Notification, $ as NotificationAttachment, a0 as NotificationChannel, a1 as NotificationChannelFactory, a2 as NotificationClass, a3 as NotificationMailMessage, a4 as NotificationManagerOptions, a5 as ProviderManager, a6 as QueueConfig, a7 as QueueDriver, a8 as QueueDriverFactory, a9 as QueuedJob, aa as RendererRegistration, ab as ResolvedSharedInertiaProps, ac as ResourceRouteOptions, ad as RouteBuilder, ae as RouteContractOptions, af as RouteDefinition, ag as RouteOpenApiMetadata, ah as RouteResourceAction, ai as Router, aj as SecurityHeadersOptions, ak as SentNotification, al as ServiceBinding, am as ServiceClass, an as ServiceFactory, ao as ServiceProviderClass, ap as ServiceProviderConstructor, aq as ServiceProviderOptions, ar as SharedInertiaPropsResolver, as as SlackAttachment, at as SlackBlock, au as SlackMessage, av as VALIDATED_DATA_KEY, aw as ValidateRequestOptions, ax as ValidationSchema, ay as WorkerOptions, az as abort, aA as abortIf, aB as abortUnless, aC as clearJobRegistry, aD as createApp, aE as createContainer, aF as createCsrfMiddleware, aG as createExceptionHandler, aH as createHostAuthorizationMiddleware, aI as createNotificationManager, aJ as createQueueManager, aK as createSecurityHeaders, aL as csrfField, aM as formatValidationErrors, aN as getContainer, aO as getCsrfToken, aP as getExceptionHandler, aQ as getInertiaSharedPropsResolver, aR as getJob, aS as getNotificationManager, aT as getQueueDriver, aU as getRegisteredJobs, aV as getValidatedData, aW as inertia, aX as parseRequestPayload, aY as registerJob, aZ as resolve, a_ as setContainer, a$ as setExceptionHandler, b0 as setInertiaSharedProps, b1 as setNotificationManager, b2 as setQueueDriver, b3 as shareInertiaProps, b4 as validate, b5 as validateRequest, b6 as validateRequestWith, b7 as validateSafe, b8 as verifyCsrfToken } from './Application-BnsyCKXY.js';
 import * as hono from 'hono';
 import { Context, MiddlewareHandler } from 'hono';
 export { Context } from 'hono';
-import { a as AuthContext } from './api-token-BGOsfuI9.js';
-export { c as API_TOKEN_KEY, b as ApiToken, d as ApiTokenStore, e as AuthCredentials, A as AuthManager, f as AuthManagerOptions, g as Authenticatable, B as BaseUserProvider, h as BearerTokenMiddlewareOptions, i as CreateApiTokenOptions, j as CreateApiTokenResult, G as Guard, k as GuardContext, l as GuardFactory, M as MemoryApiTokenStore, m as MemoryOAuthStateStore, n as MemorySessionStore, o as ModelUserProvider, p as OAuthAuthorizeOptions, q as OAuthCallbackPayload, O as OAuthManager, r as OAuthManagerOptions, s as OAuthProviderConfig, t as OAuthProviderFactoryInput, u as OAuthStateConfig, v as OAuthStatePayload, w as OAuthStateStore, x as OAuthTokenResult, y as OAuthUserProfile, P as ProviderFactory, S as Session, z as SessionData, D as SessionStore, U as UserProvider, E as buildOAuthAuthorizeUrl, F as buildOAuthRedirectUrl, H as createApiToken, I as createBearerTokenMiddleware, J as createDiscordOAuthProviderConfig, K as createGitHubOAuthProviderConfig, L as createGoogleOAuthProviderConfig, N as createOAuthManager, Q as createOAuthState, R as createSessionMiddleware, T as exchangeOAuthCode, V as fetchOAuthUserProfile, W as getApiToken, X as getApiTokenOrFail, Y as getSessionFromContext, Z as getUserApiTokens, _ as parseApiToken, $ as parseOAuthRedirectUrl, a0 as revokeAllApiTokens, a1 as revokeApiToken, a2 as tokenCan, a3 as tokenCanAll, a4 as tokenCanAny, a5 as verifyApiToken, a6 as verifyOAuthState } from './api-token-BGOsfuI9.js';
-export { AuthenticatableModel, EmailVerificationConfig, EmailVerificationToken, EmailVerificationTokenResult, EmailVerificationTokenStore, ScryptHasher as Hash, MemoryEmailVerificationStore, MemoryPasswordResetStore, NodeHasher, PasswordResetConfig, PasswordResetTokenResult, PasswordResetTokenStore, ScryptHasher, SessionGuard, buildPasswordResetUrl, buildVerificationUrl, completeEmailVerification, completePasswordReset, createEmailVerificationToken, createPasswordResetToken, isEmailVerified, parsePasswordResetUrl, parseVerificationUrl, requireVerifiedEmail, verifyEmailToken, verifyPasswordResetToken } from './auth/index.js';
+import { P as PasswordHasher } from './AuthManager-SfhCNkAU.js';
+export { A as AuthManager, B as BaseUserProvider, M as ModelUserProvider } from './AuthManager-SfhCNkAU.js';
+export { AuthenticatableModel, NodeHasher, ScryptHasher, SessionGuard } from './auth/index.js';
+export { b as EmailVerificationConfig, a as EmailVerificationToken, c as EmailVerificationTokenResult, E as EmailVerificationTokenStore, M as MemoryEmailVerificationStore, d as MemoryPasswordResetStore, e as PasswordResetConfig, f as PasswordResetTokenResult, P as PasswordResetTokenStore, g as buildPasswordResetUrl, h as buildVerificationUrl, i as completeEmailVerification, j as completePasswordReset, k as createEmailVerificationToken, l as createPasswordResetToken, m as isEmailVerified, p as parsePasswordResetUrl, n as parseVerificationUrl, r as requireVerifiedEmail, v as verifyEmailToken, o as verifyPasswordResetToken } from './email-verification-CAeArjui.js';
+import { g as AuthContext } from './api-token-BSSCLlFW.js';
+export { m as API_TOKEN_KEY, j as ApiToken, i as ApiTokenStore, a as AuthCredentials, c as AuthManagerOptions, A as Authenticatable, B as BearerTokenMiddlewareOptions, n as CreateApiTokenOptions, o as CreateApiTokenResult, e as Guard, d as GuardContext, G as GuardFactory, M as MemoryApiTokenStore, p as MemoryOAuthStateStore, q as MemorySessionStore, r as OAuthAuthorizeOptions, s as OAuthCallbackPayload, l as OAuthManager, t as OAuthManagerOptions, u as OAuthProviderConfig, v as OAuthProviderFactoryInput, w as OAuthStateConfig, k as OAuthStatePayload, O as OAuthStateStore, x as OAuthTokenResult, y as OAuthUserProfile, P as ProviderFactory, z as Session, h as SessionData, S as SessionStore, U as UserProvider, D as buildOAuthAuthorizeUrl, E as buildOAuthRedirectUrl, F as createApiToken, H as createBearerTokenMiddleware, I as createDiscordOAuthProviderConfig, J as createGitHubOAuthProviderConfig, K as createGoogleOAuthProviderConfig, L as createOAuthManager, N as createOAuthState, Q as createSessionMiddleware, R as exchangeOAuthCode, T as fetchOAuthUserProfile, V as getApiToken, W as getApiTokenOrFail, X as getSessionFromContext, Y as getUserApiTokens, Z as parseApiToken, _ as parseOAuthRedirectUrl, $ as revokeAllApiTokens, a0 as revokeApiToken, a1 as tokenCan, a2 as tokenCanAll, a3 as tokenCanAny, a4 as verifyApiToken, a5 as verifyOAuthState } from './api-token-BSSCLlFW.js';
 export { M as Middleware, d as defineMiddleware, j as jsonResponse } from './index-9_Jzj5jo.js';
 import { E as EventManager } from './EventManager-CmIoLt7r.js';
 export { a as Event, b as EventClass, c as EventListener, d as EventSubscription, L as ListenerOptions, R as RegisteredListener, e as createEventManager } from './EventManager-CmIoLt7r.js';
 export { ApplicationShutdown, ApplicationStarted, JobFailed, JobProcessed, Listener, ListenerClass, RequestFinished, RequestReceived, UserAuthenticated, UserLoggedOut } from './events/index.js';
-export { FailedJobHandler, FailedJobInfo, FailedJobReporter, MemoryDriver, RedisDriver, RedisDriverOptions, SqsDriver, SyncDriver, Worker, WorkerEvents, createSqsAdapter, processJob } from './queue/index.js';
+export { FailedJobHandler, FailedJobInfo, FailedJobReporter, MemoryDriver, MemoryDriver as MemoryQueueDriver, RedisDriver, RedisDriverOptions, RedisDriver as RedisQueueDriver, SqsDriver, SyncDriver, SyncDriver as SyncQueueDriver, Worker, WorkerEvents, createSqsAdapter, processJob } from './queue/index.js';
 import { M as MailManager } from './MailManager-DpMvYiP9.js';
 export { a as MailAddress, b as MailAttachment, c as MailConfig, d as MailMessage, e as MailTransport, f as MailTransportConfig, g as MailTransportFactory, h as MemoryTransportOptions, R as ResendTransportOptions, S as SendResult, i as SmtpTransportOptions, j as createMailManager } from './MailManager-DpMvYiP9.js';
 export { LogTransport, Mail, MemoryTransport, ResendTransport, SmtpTransport, getMailManager, mail, setMailManager } from './mail/index.js';
@@ -35,16 +38,17 @@ export { DatabaseChannel, MailChannel, MailChannelOptions, MemoryChannel, SlackC
 import { B as BroadcastManager } from './BroadcastManager-CGWl9rUO.js';
 export { A as AuthMiddlewareOptions, a as BroadcastDriver, b as BroadcastDriverFactory, c as BroadcastEvent, d as BroadcastManagerOptions, e as BroadcastableEvent, C as Channel, f as ChannelAuthorizer, g as ChannelRegistration, P as PresenceBroadcastDriver, h as PresenceChannel, i as PresenceChannelAuthorizer, j as PresenceMember, k as PrivateChannel, S as SSEClient, l as SSEMiddlewareOptions, W as WebSocketClient, m as createBroadcastManager, n as getBroadcastManager, s as setBroadcastManager } from './BroadcastManager-CGWl9rUO.js';
 export { RedisClient as BroadcastRedisClient, RedisDriverOptions as BroadcastRedisDriverOptions, MemoryDriver as MemoryBroadcastDriver, RedisDriver as RedisBroadcastDriver, createTypedBroadcaster } from './broadcasting/index.js';
-import { I as InputInterface, P as ParsedSignature, O as OptionDefinition, a as CommandInstance, b as OutputInterface } from './ConsoleKernel-BPYcP-2f.js';
-export { A as ArgumentDefinition, c as CommandClass, C as ConsoleKernel, d as ConsoleKernelOptions, e as ProgressInterface, f as PromptInterface, S as ScheduledCommand, g as createConsoleKernel } from './ConsoleKernel-BPYcP-2f.js';
+import { I as InputInterface, P as ParsedSignature, O as OptionDefinition, a as CommandInstance, b as OutputInterface } from './ConsoleKernel-BDtBETjm.js';
+export { A as ArgumentDefinition, c as CommandClass, C as ConsoleKernel, d as ConsoleKernelOptions, e as ProgressInterface, f as PromptInterface, S as ScheduledCommand, g as createConsoleKernel } from './ConsoleKernel-BDtBETjm.js';
 import * as readline from 'readline';
 export { R as AuthResponse, A as AuthUser, a as AuthorizationResponse, b as AuthorizeOptions, G as Gate, c as GateCallback, d as GateDefinition, e as GateOptions, P as PolicyClass, f as PolicyInterface, g as PolicyMethod, h as PolicyRegistration, i as ResourceAction, j as ResponseBuilder, k as authorizeAbility, l as can, m as cannot, n as createGate, o as defineGate, p as getGate, s as setGate } from './Gate-CynjZCtS.js';
 export { AuthorizedContext, Policy, authorizeAllMiddleware, authorizeMiddleware, authorizeResourceMiddleware, definePolicy, withAuthorization } from './authorization/index.js';
 export { A as AppKeyring, D as DecryptOptions, a as EncryptOptions, b as EncryptedPayload, E as Encrypter, c as EncrypterConfig, H as HashAlgorithm, d as HmacOptions, P as PasswordHashOptions, R as RandomStringOptions, e as createEncrypter, f as decrypt, g as deriveAppKey, h as deriveAppKeyring, i as encrypt, j as generateAppKey, k as generateKey, l as getAppKeyringFromEnv, m as getEncrypter, n as normalizeAppKey, p as parseAppKey, o as parsePreviousAppKeys, s as setEncrypter } from './app-key-CsBfRC_Q.js';
 export { MessageSigner, SignMessageOptions, SignedMessageClaims, SignedUrlOptions, VerifySignedMessageOptions, VerifySignedUrlOptions, check as checkHash, generateOtp, generatePassword, generateSlug, hash, hashPassword, hmac, md5, needsRehash, pick, random, randomBase64, randomBase64Url, randomHex, randomInt, randomString, sample, secureCompare, sha256, sha512, shuffle, signUrl, urlSafeToken, uuid, verifyHmac, verifyPassword, verifySignedUrl } from './encryption/index.js';
-import Redis, { RedisOptions } from 'ioredis';
+export { M as MemoryRateLimitStore, a as RateLimitEntry, d as RateLimitInfo, e as RateLimitOptions, R as RateLimitStore, S as SlidingWindowRateLimitStore, f as createRateLimitMiddleware, c as createRedisClient, g as getRateLimitInfo, r as resetRateLimit } from './client-CKXJLsTe.js';
 import 'vite';
 import '@guren/orm';
+import 'ioredis';
 
 interface RequireAuthOptions {
     redirectTo?: string;
@@ -56,199 +60,6 @@ declare function attachAuthContext(contextFactory: (ctx: Context) => AuthContext
 declare function requireAuthenticated(options?: RequireAuthOptions): MiddlewareHandler;
 declare function requireGuest(options?: RequireAuthOptions): MiddlewareHandler;
 
-/**
- * Rate limit entry stored in the backing store.
- */
-interface RateLimitEntry {
-    count: number;
-    resetAt: number;
-}
-/**
- * Store interface for rate limit data.
- * Implement this for Redis or database-backed storage.
- */
-interface RateLimitStore {
-    /**
-     * Get the current rate limit entry for a key.
-     */
-    get(key: string): Promise<RateLimitEntry | null>;
-    /**
-     * Increment the count for a key and return the new entry.
-     * If the key doesn't exist, create it with count=1.
-     */
-    increment(key: string, windowMs: number): Promise<RateLimitEntry>;
-    /**
-     * Reset the count for a key.
-     */
-    reset(key: string): Promise<void>;
-}
-/**
- * Base class for in-memory rate limit stores with automatic cleanup.
- */
-declare abstract class BaseMemoryStore implements RateLimitStore {
-    protected cleanupInterval?: ReturnType<typeof setInterval>;
-    constructor(cleanupIntervalMs?: number);
-    abstract get(key: string): Promise<RateLimitEntry | null>;
-    abstract increment(key: string, windowMs: number): Promise<RateLimitEntry>;
-    abstract reset(key: string): Promise<void>;
-    abstract cleanup(): void;
-    abstract clear(): void;
-    abstract get size(): number;
-    destroy(): void;
-}
-/**
- * In-memory rate limit store.
- * Suitable for single-process development, not for production clusters.
- */
-declare class MemoryRateLimitStore extends BaseMemoryStore {
-    private entries;
-    get(key: string): Promise<RateLimitEntry | null>;
-    increment(key: string, windowMs: number): Promise<RateLimitEntry>;
-    reset(key: string): Promise<void>;
-    cleanup(): void;
-    clear(): void;
-    get size(): number;
-}
-/**
- * Configuration options for rate limiting.
- */
-interface RateLimitOptions {
-    /**
-     * Maximum number of requests allowed in the time window.
-     * @default 100
-     */
-    limit?: number;
-    /**
-     * Time window in milliseconds.
-     * @default 60000 (1 minute)
-     */
-    windowMs?: number;
-    /**
-     * Function to extract the rate limit key from the request.
-     * Defaults to using the client IP address.
-     */
-    keyGenerator?: (ctx: Context) => string | Promise<string>;
-    /**
-     * Rate limit store implementation.
-     * Defaults to in-memory store.
-     */
-    store?: RateLimitStore;
-    /**
-     * Whether to skip rate limiting for certain requests.
-     */
-    skip?: (ctx: Context) => boolean | Promise<boolean>;
-    /**
-     * Custom handler when rate limit is exceeded.
-     */
-    onRateLimited?: (ctx: Context, retryAfter: number) => Response | Promise<Response>;
-    /**
-     * Whether to add rate limit headers to all responses.
-     * @default true
-     */
-    headers?: boolean;
-    /**
-     * Custom message when rate limit is exceeded.
-     * @default 'Too many requests, please try again later.'
-     */
-    message?: string;
-    /**
-     * HTTP status code when rate limit is exceeded.
-     * @default 429
-     */
-    statusCode?: number;
-    /**
-     * Prefix for rate limit keys.
-     * @default 'rl:'
-     */
-    keyPrefix?: string;
-    /**
-     * Trust reverse-proxy headers for client IP resolution, checked in order:
-     * `CF-Connecting-IP`, `True-Client-IP`, `X-Real-IP`, then the first entry
-     * of `X-Forwarded-For`. Falls back to `server.requestIP()` when none are set.
-     *
-     * Enable ONLY when every request passes through a proxy that sets or strips
-     * these headers — on direct deployments clients can spoof them to bypass
-     * per-client limits. Ignored when a custom `keyGenerator` is supplied.
-     * @default false
-     */
-    trustProxy?: boolean;
-}
-/**
- * Create a rate limiting middleware.
- *
- * @example
- * ```ts
- * // Basic usage - 100 requests per minute per IP
- * app.use('*', createRateLimitMiddleware())
- *
- * // Stricter limit for login endpoint
- * router.post('/login', [AuthController, 'login'],
- *   createRateLimitMiddleware({
- *     limit: 5,
- *     windowMs: 15 * 60 * 1000, // 15 minutes
- *   })
- * )
- *
- * // Custom key based on authenticated user
- * app.use('/api/*', createRateLimitMiddleware({
- *   limit: 1000,
- *   windowMs: 60 * 60 * 1000, // 1 hour
- *   keyGenerator: async (ctx) => {
- *     const user = await ctx.get('user')
- *     return user?.id?.toString() ?? defaultKeyGenerator(ctx)
- *   },
- * }))
- * ```
- */
-declare function createRateLimitMiddleware(options?: RateLimitOptions): MiddlewareHandler;
-/**
- * Rate limit result information.
- */
-interface RateLimitInfo {
-    limit: number;
-    remaining: number;
-    resetAt: Date;
-    isLimited: boolean;
-}
-/**
- * Get rate limit information for a key without incrementing.
- *
- * @example
- * ```ts
- * const info = await getRateLimitInfo('user:123', store, { limit: 100 })
- * console.log(`${info.remaining} requests remaining`)
- * ```
- */
-declare function getRateLimitInfo(key: string, store: RateLimitStore, options?: {
-    limit: number;
-    keyPrefix?: string;
-}): Promise<RateLimitInfo>;
-/**
- * Reset rate limit for a specific key.
- *
- * @example
- * ```ts
- * // Reset rate limit after successful captcha
- * await resetRateLimit(clientIp, store)
- * ```
- */
-declare function resetRateLimit(key: string, store: RateLimitStore, options?: {
-    keyPrefix?: string;
-}): Promise<void>;
-/**
- * Sliding window rate limit store.
- * More accurate than fixed window but uses more memory.
- */
-declare class SlidingWindowRateLimitStore extends BaseMemoryStore {
-    private requests;
-    get(key: string): Promise<RateLimitEntry | null>;
-    increment(key: string, windowMs: number): Promise<RateLimitEntry>;
-    reset(key: string): Promise<void>;
-    cleanup(): void;
-    clear(): void;
-    get size(): number;
-}
-
 interface CspDirectives {
     defaultSrc?: string[];
     scriptSrc?: string[];
@@ -1023,6 +834,10 @@ interface FileLike {
  * // data is typed as StorePostData
  * ```
  */
+/**
+ * @deprecated Legacy compatibility layer — prefer schema-first validation
+ * via `this.validateBody()` / `validateQuery()` / `validateParams()`.
+ */
 declare abstract class FormRequest<T = Record<string, unknown>> {
     protected ctx: Context;
     /**
@@ -2302,10 +2117,6 @@ declare abstract class Command implements CommandInstance {
      * Call another command.
      */
     call(command: string, args?: string[]): Promise<number>;
-    /**
-     * Call another command silently.
-     */
-    callSilent(command: string, args?: string[]): Promise<number>;
     /**
      * Resolve a service from the container.
      */
@@ -2651,38 +2462,16 @@ declare function renderDebugPage(error: Error, request?: Request): string;
 declare function debugErrorMiddleware(): MiddlewareHandler;
 
 /**
- * Options for creating a Redis client.
+ * Runtime-detecting password hasher: uses Bun's native scrypt implementation
+ * when running on Bun, and the Node.js crypto implementation otherwise
+ * (e.g. AWS Lambda on the Node runtime). This is the hasher behind the
+ * `Hash` export, so code written against `Hash` runs on both runtimes.
  */
-interface RedisClientOptions extends RedisOptions {
-    /**
-     * Redis connection URL (e.g., 'redis://localhost:6379').
-     * If provided, overrides host/port/password.
-     */
-    url?: string;
-    /**
-     * Key prefix for all operations.
-     * @default ''
-     */
-    keyPrefix?: string;
+declare class DefaultHasher implements PasswordHasher {
+    private readonly delegate;
+    constructor();
+    hash(plain: string): Promise<string>;
+    verify(hashed: string, plain: string): Promise<boolean>;
 }
-/**
- * Create a Redis client with the given options.
- *
- * @example
- * ```ts
- * // Using URL
- * const redis = createRedisClient({ url: 'redis://localhost:6379' })
- *
- * // Using host/port
- * const redis = createRedisClient({ host: 'localhost', port: 6379 })
- *
- * // With key prefix
- * const redis = createRedisClient({
- *   url: process.env.REDIS_URL,
- *   keyPrefix: 'myapp:',
- * })
- * ```
- */
-declare function createRedisClient(options?: RedisClientOptions): Redis;
 
-export { AUTH_CONTEXT_KEY, AuthContext, AuthContext as AuthRuntimeContext, AuthServiceProvider, AuthenticationException, AuthorizationException, AuthorizationServiceProvider, AutoDiscovery, BaseFactory, type BaseResource, BaseSeeder, BroadcastManager, BroadcastServiceProvider, BufferedOutput, CSP_NONCE_KEY, CacheManager, CacheServiceProvider, Command, CommandInstance, Container, type CorsOptions, type CspDirectives, type CspOptions, type CursorPaginatedResponse, type CursorPaginationMeta, CursorPaginator, type CursorPaginatorOptions, type DiscoveryOptions, type DiscoveryResult, EncryptionServiceProvider, ErrorResponse, ErrorServiceProvider, EventManager, EventServiceProvider, BaseFactory as Factory, type FactoryClass, type Factory as FactoryInterface, FieldValidator, type FileLike, type FileValidationOptions, type ForceHttpsOptions, FormRequest, HealthServiceProvider, HttpException, I18nManager, I18nServiceProvider, type ImageValidationOptions, InertiaServiceProvider, type InferResourceData, Input, InputInterface, JsonResource, LogManager, LogServiceProvider, MailManager, MailServiceProvider, MemoryRateLimitStore, MethodNotAllowedException, NotFoundHttpException, NotificationManager, NotificationServiceProvider, OAuthServiceProvider, OptionDefinition, Output, OutputInterface, type PaginatedPageProps, type PaginatedResponse, type PaginatedResultLike, type PaginationLinks, type PaginationMeta, type PaginationPageLink, Paginator, type PaginatorOptions, ParsedSignature, QueueManager, QueueServiceProvider, type RateLimitEntry, type RateLimitInfo, type RateLimitOptions, type RateLimitStore, type RedirectSafetyOptions, type RequireAuthOptions, Resource, type ResourceClass, ResourceCollection, type ResourceData, type RuleDefinition, Scheduler, SchedulingServiceProvider, BaseSeeder as Seeder, type SeederClass, type Seeder as SeederInterface, SeederRunner, type SeederRunnerOptions, ServiceBindings, ServiceProvider, SlidingWindowRateLimitStore, StorageManager, StorageServiceProvider, type ValidationErrors, ValidationException, type ValidationResult, type ValidationRule, Validator, type ValidatorOptions, ViewEngine, after, afterOrEqual, alpha, alphaDash, alphaNum, array as arrayRule, attachAuthContext, before, beforeOrEqual, between, boolean as booleanRule, collect, confirmed, createCorsMiddleware, createCspMiddleware, createFacade, createFacades, createForceHttpsMiddleware, createRateLimitMiddleware, createRedirectSafetyMiddleware, createRedisClient, createSeederRunner, createValidator, cursorPaginate, custom, dateFormat, date as dateRule, debugErrorMiddleware, decodeCursor, defineFactory, different, email as emailRule, encodeCursor, endsWith, exists, file as fileRule, getCspNonce, getRateLimitInfo, image as imageRule, inValues, integer, ip, ipv4, ipv6, isSafeRedirectUrl, json as jsonRule, max, maxFileSize, mimes, min, minFileSize, notIn, nullable, numeric, object as objectRule, paginate, parseSignature, quickValidate, quickValidateOrThrow, regex, renderDebugPage, renderErrorPage, requestIdMiddleware, requestLoggingMiddleware, requireAuthenticated, requireGuest, required, requiredIf, requiredUnless, requiredWith, requiredWithout, resetCalledSeeders, resetRateLimit, same, size, startsWith, string as stringRule, unique, url as urlRule, uuid as uuidRule };
+export { AUTH_CONTEXT_KEY, AuthContext, AuthContext as AuthRuntimeContext, AuthServiceProvider, AuthenticationException, AuthorizationException, AuthorizationServiceProvider, AutoDiscovery, BaseFactory, type BaseResource, BaseSeeder, BroadcastManager, BroadcastServiceProvider, BufferedOutput, CSP_NONCE_KEY, CacheManager, CacheServiceProvider, Command, CommandInstance, Container, type CorsOptions, type CspDirectives, type CspOptions, type CursorPaginatedResponse, type CursorPaginationMeta, CursorPaginator, type CursorPaginatorOptions, DefaultHasher, type DiscoveryOptions, type DiscoveryResult, EncryptionServiceProvider, ErrorResponse, ErrorServiceProvider, EventManager, EventServiceProvider, BaseFactory as Factory, type FactoryClass, type Factory as FactoryInterface, FieldValidator, type FileLike, type FileValidationOptions, type ForceHttpsOptions, FormRequest, DefaultHasher as Hash, HealthServiceProvider, HttpException, I18nManager, I18nServiceProvider, type ImageValidationOptions, InertiaServiceProvider, type InferResourceData, Input, InputInterface, JsonResource, LogManager, LogServiceProvider, MailManager, MailServiceProvider, MethodNotAllowedException, NotFoundHttpException, NotificationManager, NotificationServiceProvider, OAuthServiceProvider, OptionDefinition, Output, OutputInterface, type PaginatedPageProps, type PaginatedResponse, type PaginatedResultLike, type PaginationLinks, type PaginationMeta, type PaginationPageLink, Paginator, type PaginatorOptions, ParsedSignature, QueueManager, QueueServiceProvider, type RedirectSafetyOptions, type RequireAuthOptions, Resource, type ResourceClass, ResourceCollection, type ResourceData, type RuleDefinition, Scheduler, SchedulingServiceProvider, BaseSeeder as Seeder, type SeederClass, type Seeder as SeederInterface, SeederRunner, type SeederRunnerOptions, ServiceBindings, ServiceProvider, StorageManager, StorageServiceProvider, type ValidationErrors, ValidationException, type ValidationResult, type ValidationRule, Validator, type ValidatorOptions, ViewEngine, after, afterOrEqual, alpha, alphaDash, alphaNum, array as arrayRule, attachAuthContext, before, beforeOrEqual, between, boolean as booleanRule, collect, confirmed, createCorsMiddleware, createCspMiddleware, createFacade, createFacades, createForceHttpsMiddleware, createRedirectSafetyMiddleware, createSeederRunner, createValidator, cursorPaginate, custom, dateFormat, date as dateRule, debugErrorMiddleware, decodeCursor, defineFactory, different, email as emailRule, encodeCursor, endsWith, exists, file as fileRule, getCspNonce, image as imageRule, inValues, integer, ip, ipv4, ipv6, isSafeRedirectUrl, json as jsonRule, max, maxFileSize, mimes, min, minFileSize, notIn, nullable, numeric, object as objectRule, paginate, parseSignature, quickValidate, quickValidateOrThrow, regex, renderDebugPage, renderErrorPage, requestIdMiddleware, requestLoggingMiddleware, requireAuthenticated, requireGuest, required, requiredIf, requiredUnless, requiredWith, requiredWithout, resetCalledSeeders, same, size, startsWith, string as stringRule, unique, url as urlRule, uuid as uuidRule };