@guren/server 1.0.0-rc.9 → 1.1.0

package/dist/{Application-DtWDHXr1.d.ts → Application-BnsyCKXY.d.ts}

@@ -1,18 +1,19 @@
 import * as hono from 'hono';
-import { Context, MiddlewareHandler, Hono, ExecutionContext } from 'hono';
-import { A as AuthManager, O as OAuthManager, a as AuthContext, b as ApiToken, C as CreateSessionMiddlewareOptions } from './api-token-JOif2CtG.js';
+import { Context, MiddlewareHandler, Hono, Next, ExecutionContext } from 'hono';
+import { l as OAuthManager, g as AuthContext, j as ApiToken, C as CreateSessionMiddlewareOptions } from './api-token-BSSCLlFW.js';
+import { A as AuthManager } from './AuthManager-SfhCNkAU.js';
 import { InlineConfig, ViteDevServer } from 'vite';
 import { E as EventManager } from './EventManager-CmIoLt7r.js';
 import { C as CacheManager } from './CacheManager-BkvHEOZX.js';
 import { M as MailManager } from './MailManager-DpMvYiP9.js';
 import { L as LogManager } from './LogManager-7mxnkaPM.js';
-import { I as I18nManager } from './I18nManager-Dtgzsf5n.js';
-import { B as BroadcastManager } from './BroadcastManager-AkIWUGJo.js';
+import { I as I18nManager } from './I18nManager-BiSoczfV.js';
+import { B as BroadcastManager } from './BroadcastManager-CGWl9rUO.js';
 import { E as Encrypter, A as AppKeyring } from './app-key-CsBfRC_Q.js';
 import { S as StorageManager } from './StorageManager-oZTHqaza.js';
 import { H as HealthManager } from './HealthManager-DUyMIzsZ.js';
 import { S as Scheduler } from './Scheduler-BstvSca7.js';
-import { G as Gate } from './Gate-CNkBYf8m.js';
+import { G as Gate } from './Gate-CynjZCtS.js';
 import { M as Middleware } from './index-9_Jzj5jo.js';
 
 declare const CSRF_TOKEN_KEY = "_csrf_token";
@@ -129,6 +130,14 @@ type SharedPropsDefault = Record<string, unknown>;
 type ResolvedSharedInertiaProps = InertiaSharedProps extends Record<string, unknown> ? InertiaSharedProps : SharedPropsDefault;
 type SharedInertiaPropsResolver<Props extends Record<string, unknown> = ResolvedSharedInertiaProps> = (ctx: Context) => Promise<Props> | Props;
 declare function setInertiaSharedProps<Props extends Record<string, unknown> = ResolvedSharedInertiaProps>(resolverFn: SharedInertiaPropsResolver<Props> | null): void;
+declare function getInertiaSharedPropsResolver(): SharedInertiaPropsResolver<ResolvedSharedInertiaProps> | null;
+/**
+ * Register additional shared props without replacing resolvers registered
+ * earlier — the new resolver's props are merged over the previous ones.
+ * Use this from app providers so multiple providers can each contribute
+ * shared props (setInertiaSharedProps replaces the resolver wholesale).
+ */
+declare function shareInertiaProps<Props extends Record<string, unknown>>(resolverFn: SharedInertiaPropsResolver<Props>): void;
 
 /**
  * Parses the incoming request payload supporting both JSON bodies and form submissions.
@@ -259,7 +268,11 @@ interface SecurityHeadersOptions {
     referrerPolicy?: string | false;
     /** X-Permitted-Cross-Domain-Policies header. Set to false to disable. Default: 'none' */
     crossDomainPolicies?: string | false;
-    /** Strict-Transport-Security header. Default: false (disabled) */
+    /**
+     * Strict-Transport-Security header.
+     * Default: `{ maxAge: 31536000 }` (1 year) when NODE_ENV is 'production', false otherwise.
+     * Browsers ignore HSTS on plain-HTTP responses, so the production default is safe behind TLS terminators.
+     */
     hsts?: HstsOptions | false;
 }
 /**
@@ -1358,6 +1371,28 @@ declare class Controller {
     }>(modelClass: T): Awaited<ReturnType<T['findOrFail']>>;
     protected get ctx(): Context;
     protected get request(): hono.HonoRequest<any, unknown>;
+    /**
+     * Get an uploaded file from a multipart request.
+     *
+     * Returns null when the field is missing, is not a file, or the upload is
+     * empty. Hono caches the parsed body, so this composes with other body
+     * reads in the same request.
+     *
+     * @example
+     * ```typescript
+     * const avatar = await this.file('avatar')
+     * if (!avatar) {
+     *   throw ValidationException.withMessages({ avatar: 'Choose a file.' })
+     * }
+     * await storage.disk().put(`avatars/${avatar.name}`, Buffer.from(await avatar.arrayBuffer()))
+     * ```
+     */
+    protected file(name: string): Promise<File | null>;
+    /**
+     * Get all uploaded files for a multipart field (e.g. `<input multiple>`).
+     * Returns an empty array when none were uploaded.
+     */
+    protected files(name: string): Promise<File[]>;
     protected get auth(): AuthContext;
     protected make<K extends keyof ServiceBindings>(key: K): ServiceBindings[K];
     protected make<T>(key: string): T;
@@ -1383,6 +1418,31 @@ declare class Controller {
      * ```
      */
     protected apiTokenUserId(): string | number;
+    /**
+     * Authorize the current user (or guest) for an ability.
+     * Throws AuthorizationException (403) when denied.
+     *
+     * ORM records are plain objects with no constructor information, so pass
+     * the model class alongside the record to resolve the policy:
+     *
+     * @example
+     * ```typescript
+     * const post = await Post.findOrFail(id)
+     * await this.authorize('update', [Post, post])
+     * await this.authorize('create', Post)
+     * ```
+     */
+    protected authorize(ability: string, ...args: unknown[]): Promise<void>;
+    /**
+     * Check whether the current user (or guest) can perform an ability.
+     *
+     * @example
+     * ```typescript
+     * if (await this.can('update', [Post, post])) { ... }
+     * ```
+     */
+    protected can(ability: string, ...args: unknown[]): Promise<boolean>;
+    private gateUser;
     protected inertia<TPage extends InertiaPageContractLike>(page: TPage, props: InertiaPageProps<TPage>, options?: InertiaResponseOptions): Promise<InertiaResponse<InertiaPageComponent<TPage>, InertiaPageProps<TPage> & ResolvedSharedInertiaProps>>;
     protected inertia<Component extends string, Props extends DefaultInertiaProps>(component: Component, props: Props, options?: InertiaResponseOptions): Promise<InertiaResponse<Component, Props & ResolvedSharedInertiaProps>>;
     protected json<T>(data: T, init?: ResponseInit): Response;
@@ -1710,8 +1770,10 @@ type ControllerAction<C extends ControllerConstructor = ControllerConstructor> =
 type RouteResult = Response | string | number | boolean | Record<string, unknown> | Array<unknown> | null | void;
 /**
  * Handler for a route - either an inline function or a controller action tuple.
+ * Inline handlers receive `next`, so any Hono middleware (e.g.
+ * `broadcast.sseMiddleware()`) can be mounted directly as a terminal handler.
  */
-type RouteHandler<C extends ControllerConstructor = ControllerConstructor> = ((c: Context) => RouteResult | Promise<RouteResult>) | ControllerAction<C>;
+type RouteHandler<C extends ControllerConstructor = ControllerConstructor> = ((c: Context, next: Next) => RouteResult | Promise<RouteResult>) | ControllerAction<C>;
 /**
  * Model binding resolver function.
  */
@@ -1773,6 +1835,15 @@ interface RouteDefinition {
         body?: SchemaLike<unknown>;
         output?: SchemaLike<unknown>;
     };
+    /** Named middleware (aliases or groups) applied to this route */
+    middlewareNames?: string[];
+    /** Whether inline (unnamed) middleware handlers are attached */
+    hasInlineMiddleware?: boolean;
+    /** Controller binding when the handler is a [Controller, 'method'] tuple */
+    controller?: {
+        name: string;
+        action: string;
+    };
     summary?: string;
     description?: string;
     tags?: string[];
@@ -2107,4 +2178,4 @@ declare class Application {
 }
 declare function createApp(options?: ApplicationOptions): Application;
 
-export { type NotificationChannelFactory as $, Application as A, type InertiaSharedProps as B, Container as C, type DevBannerOptions as D, type ErrorResponse as E, type FailedJob as F, GUREN_ASCII_ART as G, type HostAuthorizationOptions as H, type InertiaOptions as I, type InertiaSsrContext as J, type InertiaSsrOptions as K, type InertiaSsrRenderer as L, type InertiaSsrResult as M, NotificationManager as N, type InferInertiaProps as O, type Provider as P, QueueManager as Q, Job as R, ServiceProvider as S, type JobClass as T, type JobFailureHandler as U, type JobHandler as V, type JobOptions as W, type Notifiable as X, Notification as Y, type NotificationAttachment as Z, type NotificationChannel as _, type StartViteDevServerOptions as a, setQueueDriver as a$, type NotificationClass as a0, type NotificationMailMessage as a1, type NotificationManagerOptions as a2, ProviderManager as a3, type QueueConfig as a4, type QueueDriver as a5, type QueueDriverFactory as a6, type QueuedJob as a7, type RendererRegistration as a8, type ResolvedSharedInertiaProps as a9, clearJobRegistry as aA, createApp as aB, createContainer as aC, createCsrfMiddleware as aD, createExceptionHandler as aE, createHostAuthorizationMiddleware as aF, createNotificationManager as aG, createQueueManager as aH, createSecurityHeaders as aI, csrfField as aJ, formatValidationErrors as aK, getContainer as aL, getCsrfToken as aM, getExceptionHandler as aN, getJob as aO, getNotificationManager as aP, getQueueDriver as aQ, getRegisteredJobs as aR, getValidatedData as aS, inertia as aT, parseRequestPayload as aU, registerJob as aV, resolve as aW, setContainer as aX, setExceptionHandler as aY, setInertiaSharedProps as aZ, setNotificationManager as a_, type ResourceRouteOptions as aa, type RouteBuilder as ab, type RouteContractOptions as ac, type RouteDefinition as ad, type RouteOpenApiMetadata as ae, type ResourceAction as af, Router as ag, type SecurityHeadersOptions as ah, type SentNotification as ai, type ServiceBinding as aj, type ServiceClass as ak, type ServiceFactory as al, type ServiceProviderClass as am, type ServiceProviderConstructor as an, type ServiceProviderOptions as ao, type SharedInertiaPropsResolver as ap, type SlackAttachment as aq, type SlackBlock as ar, type SlackMessage as as, VALIDATED_DATA_KEY as at, type ValidateRequestOptions as au, type ValidationSchema as av, type WorkerOptions as aw, abort as ax, abortIf as ay, abortUnless as az, type StartedViteDevServer as b, validate as b0, validateRequest as b1, validateRequestWith as b2, validateSafe as b3, verifyCsrfToken as b4, type ServiceBindings as c, type ApplicationListenOptions as d, type AuthPayload as e, CSRF_FORM_FIELD as f, CSRF_HEADER_NAME as g, CSRF_TOKEN_KEY as h, type ContextualBinding as i, type ContextualBindingBuilder as j, type ContextualNeedsBuilder as k, logDevServerBanner as l, Controller as m, type ControllerInertiaProps as n, type CsrfOptions as o, type DatabaseChannelOptions as p, type DatabaseNotification as q, type ExceptionClass as r, startViteDevServer as s, ExceptionHandler as t, type ExceptionHandlerOptions as u, type ExceptionRenderer as v, type ExceptionReporter as w, type HstsOptions as x, type InertiaPagePayload as y, type InertiaResponse as z };
+export { type NotificationAttachment as $, Application as A, type InertiaPagePayload as B, Container as C, type DevBannerOptions as D, type ErrorResponse as E, type FailedJob as F, GUREN_ASCII_ART as G, type HostAuthorizationOptions as H, type InertiaOptions as I, type InertiaResponse as J, type InertiaSharedProps as K, type InertiaSsrContext as L, type InertiaSsrOptions as M, NotificationManager as N, type InertiaSsrRenderer as O, type Provider as P, QueueManager as Q, type InertiaSsrResult as R, ServiceProvider as S, type InferInertiaProps as T, Job as U, type JobClass as V, type JobFailureHandler as W, type JobHandler as X, type JobOptions as Y, type Notifiable as Z, Notification as _, type StartViteDevServerOptions as a, setExceptionHandler as a$, type NotificationChannel as a0, type NotificationChannelFactory as a1, type NotificationClass as a2, type NotificationMailMessage as a3, type NotificationManagerOptions as a4, ProviderManager as a5, type QueueConfig as a6, type QueueDriver as a7, type QueueDriverFactory as a8, type QueuedJob as a9, abortIf as aA, abortUnless as aB, clearJobRegistry as aC, createApp as aD, createContainer as aE, createCsrfMiddleware as aF, createExceptionHandler as aG, createHostAuthorizationMiddleware as aH, createNotificationManager as aI, createQueueManager as aJ, createSecurityHeaders as aK, csrfField as aL, formatValidationErrors as aM, getContainer as aN, getCsrfToken as aO, getExceptionHandler as aP, getInertiaSharedPropsResolver as aQ, getJob as aR, getNotificationManager as aS, getQueueDriver as aT, getRegisteredJobs as aU, getValidatedData as aV, inertia as aW, parseRequestPayload as aX, registerJob as aY, resolve as aZ, setContainer as a_, type RendererRegistration as aa, type ResolvedSharedInertiaProps as ab, type ResourceRouteOptions as ac, type RouteBuilder as ad, type RouteContractOptions as ae, type RouteDefinition as af, type RouteOpenApiMetadata as ag, type ResourceAction as ah, Router as ai, type SecurityHeadersOptions as aj, type SentNotification as ak, type ServiceBinding as al, type ServiceClass as am, type ServiceFactory as an, type ServiceProviderClass as ao, type ServiceProviderConstructor as ap, type ServiceProviderOptions as aq, type SharedInertiaPropsResolver as ar, type SlackAttachment as as, type SlackBlock as at, type SlackMessage as au, VALIDATED_DATA_KEY as av, type ValidateRequestOptions as aw, type ValidationSchema as ax, type WorkerOptions as ay, abort as az, type StartedViteDevServer as b, setInertiaSharedProps as b0, setNotificationManager as b1, setQueueDriver as b2, shareInertiaProps as b3, validate as b4, validateRequest as b5, validateRequestWith as b6, validateSafe as b7, verifyCsrfToken as b8, type ServiceBindings as c, type ApplicationListenOptions as d, type ApplicationOptions as e, type AuthPayload as f, type AuthPluginOptions as g, CSRF_FORM_FIELD as h, CSRF_HEADER_NAME as i, CSRF_TOKEN_KEY as j, type ContextualBinding as k, logDevServerBanner as l, type ContextualBindingBuilder as m, type ContextualNeedsBuilder as n, Controller as o, type ControllerInertiaProps as p, type CsrfOptions as q, type DatabaseChannelOptions as r, startViteDevServer as s, type DatabaseNotification as t, type ExceptionClass as u, ExceptionHandler as v, type ExceptionHandlerOptions as w, type ExceptionRenderer as x, type ExceptionReporter as y, type HstsOptions as z };

package/dist/AuthManager-SfhCNkAU.d.ts

@@ -0,0 +1,79 @@
+import { Context } from 'hono';
+import { Model } from '@guren/orm';
+import { A as Authenticatable, U as UserProvider, a as AuthCredentials, b as AuthManagerContract, c as AuthManagerOptions, G as GuardFactory, P as ProviderFactory, d as GuardContext, e as Guard, f as AttachContextOptions, g as AuthContext } from './api-token-BSSCLlFW.js';
+
+interface PasswordHasher {
+    hash(plain: string): Promise<string>;
+    verify(hashed: string, plain: string): Promise<boolean>;
+    needsRehash?(hashed: string): boolean;
+}
+
+declare abstract class BaseUserProvider<User extends Authenticatable = Authenticatable> implements UserProvider<User> {
+    abstract retrieveById(identifier: unknown): Promise<User | null>;
+    abstract retrieveByCredentials(credentials: AuthCredentials): Promise<User | null>;
+    abstract validateCredentials(user: User, credentials: AuthCredentials): Promise<boolean>;
+    abstract getId(user: User): unknown;
+    setRememberToken(user: User, token: string | null): Promise<void>;
+    getRememberToken(user: User): Promise<string | null>;
+}
+
+interface ModelUserProviderOptions {
+    idColumn?: string;
+    usernameColumn?: string;
+    passwordColumn?: string;
+    rememberTokenColumn?: string;
+    hasher?: PasswordHasher;
+    credentialsPasswordField?: string;
+}
+declare class ModelUserProvider<User extends Authenticatable = Authenticatable> extends BaseUserProvider<User> {
+    private readonly model;
+    private readonly idColumn;
+    private readonly usernameColumn;
+    private readonly passwordColumn;
+    private readonly rememberTokenColumn;
+    private readonly hasher;
+    private readonly credentialsPasswordField;
+    constructor(model: typeof Model, options?: ModelUserProviderOptions);
+    private cast;
+    retrieveById(identifier: unknown): Promise<User | null>;
+    retrieveByCredentials(credentials: AuthCredentials): Promise<User | null>;
+    validateCredentials(user: User, credentials: AuthCredentials): Promise<boolean>;
+    getId(user: User): unknown;
+    /**
+     * Strip the password hash, remember token, and the model's `hidden`
+     * fields before the record leaves the auth layer. Credential
+     * validation happens on the raw record before sanitizing, so this
+     * never affects login — only what `auth.user()` exposes.
+     */
+    sanitize(user: User): User;
+    setRememberToken(user: User, token: string | null): Promise<void>;
+    getRememberToken(user: User): Promise<string | null>;
+}
+
+declare class AuthManager implements AuthManagerContract {
+    private readonly guards;
+    private readonly providers;
+    private defaultGuard;
+    constructor(options?: AuthManagerOptions);
+    registerGuard<User>(name: string, factory: GuardFactory<User>): void;
+    registerProvider<User>(name: string, factory: ProviderFactory<User>): void;
+    getProvider<User>(name: string): UserProvider<User>;
+    createGuard<User>(name: string, context: GuardContext): Guard<User>;
+    guardNames(): string[];
+    setDefaultGuard(name: string): void;
+    getDefaultGuard(): string;
+    createAuthContext(ctx: Context, options?: AttachContextOptions): AuthContext;
+    attempt(name: string, ctx: Context, credentials: AuthCredentials, remember?: boolean): Promise<boolean>;
+    /**
+     * Shorthand method to register a model-based authentication provider and session guard.
+     * This simplifies the common case of authenticating users via a database model.
+     *
+     * @param model - The model class to use for user authentication
+     * @param options - Options for the ModelUserProvider (partial, with defaults)
+     * @param providerName - Name for the provider (defaults to 'users')
+     * @param guardName - Name for the guard (defaults to 'web')
+     */
+    useModel(model: typeof Model<PlainObject>, options?: Partial<ModelUserProviderOptions>, providerName?: string, guardName?: string): void;
+}
+
+export { AuthManager as A, BaseUserProvider as B, ModelUserProvider as M, type PasswordHasher as P };

package/dist/{BroadcastManager-AkIWUGJo.d.ts → BroadcastManager-CGWl9rUO.d.ts}

@@ -123,6 +123,11 @@ interface SSEMiddlewareOptions {
      * Retry delay for SSE reconnection.
      */
     retry?: number;
+    /**
+     * Function to get the user from the request context, used to authorize
+     * channels requested via the `?channels=` query parameter.
+     */
+    getUser?: (ctx: unknown) => unknown | Promise<unknown>;
 }
 /**
  * Auth middleware options.

package/dist/{ConsoleKernel-CqCVrdZs.d.ts → ConsoleKernel-BDtBETjm.d.ts}

@@ -1,4 +1,4 @@
-import { C as Container } from './Application-DtWDHXr1.js';
+import { C as Container } from './Application-BnsyCKXY.js';
 
 /**
  * Parsed argument definition.

package/dist/{Gate-CNkBYf8m.d.ts → Gate-CynjZCtS.d.ts}

@@ -213,6 +213,11 @@ declare class Gate {
     check(ability: string, user: AuthUser | null, ...args: unknown[]): Promise<boolean>;
     /**
      * Check a policy for the given ability.
+     *
+     * The subject may be a class instance (policy resolved via its constructor)
+     * or a `[ModelClass, record]` / `['key', record]` tuple. The tuple form is
+     * required for plain records returned by the ORM, which carry no constructor
+     * information.
      */
     protected checkPolicy(ability: string, user: AuthUser | null, model: unknown, additionalArgs: unknown[]): Promise<boolean | undefined>;
     /**

package/dist/{I18nManager-Dtgzsf5n.d.ts → I18nManager-BiSoczfV.d.ts}

@@ -71,9 +71,14 @@ interface I18nConfig {
      */
     fallbackLocale?: string;
     /**
-     * Path to translation files.
+     * Path to translation files (constructs a JsonLoader internally).
      */
     path?: string;
+    /**
+     * Custom translation loader (e.g. JsonLoader, MemoryLoader).
+     * Takes precedence over `path`.
+     */
+    loader?: TranslationLoader;
     /**
      * Preloaded messages.
      */

package/dist/McpServiceProvider-JW6PDVMD.js

@@ -0,0 +1,7 @@
+import {
+  McpServiceProvider
+} from "./chunk-WVY45EIW.js";
+import "./chunk-VT5KRDPH.js";
+export {
+  McpServiceProvider
+};