@orieljs/framework 0.1.0-alpha.11 → 0.1.0-alpha.13

package/dist/index.js

@@ -22,7 +22,7 @@ import {
   renderToString,
   styleString,
   view
-} from "./chunk-24673JQF.js";
+} from "./chunk-ZRTWDJKD.js";
 import {
   API_ROUTES_STUB,
   Application as Application2,
@@ -74,6 +74,7 @@ import {
   QueueFake,
   RenameClasses,
   Repository,
+  SESSION_URI,
   StorageFake,
   TEMPORARY_UPLOAD_DEFAULTS,
   TemporaryFileNotFoundError,
@@ -148,7 +149,7 @@ import {
   vite,
   viteReactRefresh,
   writeResponse
-} from "./chunk-KDE5BLI3.js";
+} from "./chunk-OTCTQVDQ.js";
 import {
   Arr,
   BindingResolutionError,
@@ -175,7 +176,7 @@ import {
   retry,
   tap,
   value
-} from "./chunk-MURTCTRH.js";
+} from "./chunk-6GMXKQ6O.js";
 import {
   Application,
   AuthFactory,
@@ -217,7 +218,7 @@ import {
   ValidationFactory,
   ViewFactory,
   token
-} from "./chunk-HTJKT2R2.js";
+} from "./chunk-CKH4KCYF.js";
 
 // ../Auth/dist/index.js
 import { createHash } from "crypto";
@@ -229,6 +230,13 @@ import { createHmac } from "crypto";
 import { readdir } from "fs/promises";
 import { join } from "path";
 import { pathToFileURL } from "url";
+import { relative } from "path";
+import { existsSync, mkdirSync, readdirSync, writeFileSync } from "fs";
+import { join as join2 } from "path";
+import { createHmac as createHmac3, randomBytes as randomBytes2, randomInt as randomInt2, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import { renderSVG } from "uqr";
+import { randomInt } from "crypto";
+import { createHmac as createHmac2, randomBytes, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var AuthenticationError = class extends Error {
   constructor(message = "Unauthenticated.", guards = [], redirectTo2) {
     super(message);
@@ -1682,6 +1690,455 @@ function auth(guard2) {
   const manager2 = inject(AuthFactory);
   return guard2 === void 0 ? manager2 : manager2.guard(guard2);
 }
+var TWO_FACTOR_DEFAULTS = {
+  enabled: false,
+  methods: ["email", "app"],
+  default: "email",
+  code_ttl: 600,
+  pending_ttl: 600,
+  max_attempts: 5,
+  resend_after: 30,
+  window: 1,
+  recovery_codes: 8
+};
+function twoFactorConfig(config2) {
+  return { ...TWO_FACTOR_DEFAULTS, ...config2.get("auth.two_factor", {}) };
+}
+var TWO_FACTOR_COLUMNS_MIGRATION = `import { Migration, Schema } from '@orieljs/framework'
+
+export default class extends Migration {
+  async up() {
+    await Schema.table('users', (t) => {
+      t.text('two_factor_secret').nullable()
+      t.text('two_factor_recovery_codes').nullable()
+      t.timestamp('two_factor_confirmed_at').nullable()
+      t.string('two_factor_method', 10).nullable()
+    })
+  }
+
+  async down() {
+    await Schema.table('users', (t) => {
+      t.dropColumn('two_factor_secret', 'two_factor_recovery_codes', 'two_factor_confirmed_at', 'two_factor_method')
+    })
+  }
+}
+`;
+var NAME = "add_two_factor_columns_to_users_table";
+var pad = (value2) => String(value2).padStart(2, "0");
+function installTwoFactorMigration(directory, now5 = /* @__PURE__ */ new Date()) {
+  if (existsSync(directory) && readdirSync(directory).some((file) => file.endsWith(`_${NAME}.ts`))) {
+    throw new Error("The two-factor migration is there already: run `oriel migrate`.");
+  }
+  mkdirSync(directory, { recursive: true });
+  const stamp = `${now5.getFullYear()}_${pad(now5.getMonth() + 1)}_${pad(now5.getDate())}_${pad(now5.getHours())}${pad(now5.getMinutes())}${pad(now5.getSeconds())}`;
+  const path = join2(directory, `${stamp}_${NAME}.ts`);
+  writeFileSync(path, TWO_FACTOR_COLUMNS_MIGRATION);
+  return path;
+}
+var TwoFactorChallenged = class {
+  constructor(user, method) {
+    this.user = user;
+    this.method = method;
+  }
+  user;
+  method;
+};
+var TwoFactorFailed = class {
+  constructor(user, method) {
+    this.user = user;
+    this.method = method;
+  }
+  user;
+  method;
+};
+var TwoFactorAuthenticated = class {
+  constructor(user, method) {
+    this.user = user;
+    this.method = method;
+  }
+  user;
+  method;
+};
+var RecoveryCodeUsed = class {
+  constructor(user) {
+    this.user = user;
+  }
+  user;
+};
+var TwoFactorAppEnabled = class {
+  constructor(user) {
+    this.user = user;
+  }
+  user;
+};
+var TwoFactorAppDisabled = class {
+  constructor(user) {
+    this.user = user;
+  }
+  user;
+};
+function qrSvg(text4) {
+  return renderSVG(text4);
+}
+var CHARACTERS = "abcdefghijklmnopqrstuvwxyz0123456789";
+var part = () => Array.from({ length: 5 }, () => CHARACTERS[randomInt(CHARACTERS.length)]).join("");
+function generateRecoveryCodes(count = 8) {
+  const codes = /* @__PURE__ */ new Set();
+  while (codes.size < count) codes.add(`${part()}-${part()}`);
+  return [...codes];
+}
+function normalizeCode(input) {
+  return input.replace(/[\s-]/g, "").toLowerCase();
+}
+var TwoFactorStore = class {
+  constructor(encrypter, config2) {
+    this.encrypter = encrypter;
+    this.config = config2;
+  }
+  encrypter;
+  config;
+  secret(user) {
+    const stored = user.getAttribute("two_factor_secret");
+    return stored ? this.encrypter.decryptString(stored) : void 0;
+  }
+  /** A new secret (or none) is unconfirmed until confirm(). */
+  async setSecret(user, secret) {
+    user.setAttribute("two_factor_secret", secret === null ? null : this.encrypter.encryptString(secret));
+    user.setAttribute("two_factor_confirmed_at", null);
+    await user.save();
+  }
+  confirmedAt(user) {
+    const stored = user.getAttribute("two_factor_confirmed_at");
+    return stored ? new Date(stored) : void 0;
+  }
+  async confirm(user) {
+    user.setAttribute("two_factor_confirmed_at", /* @__PURE__ */ new Date());
+    await user.save();
+  }
+  recoveryCodes(user) {
+    const stored = user.getAttribute("two_factor_recovery_codes");
+    return stored ? JSON.parse(this.encrypter.decryptString(stored)) : [];
+  }
+  async setRecoveryCodes(user, codes) {
+    user.setAttribute("two_factor_recovery_codes", this.encrypter.encryptString(JSON.stringify(codes)));
+    await user.save();
+  }
+  /** Whether the user's authenticator counts: set up and confirmed. */
+  hasApp(user) {
+    return this.secret(user) !== void 0 && this.confirmedAt(user) !== void 0;
+  }
+  /** The methods open to the user now: the app's, of those the user can use. */
+  methods(user) {
+    return this.config().methods.filter((method) => method === "email" || this.hasApp(user));
+  }
+  /** The method the user is asked for: the one they chose if they can use it, else the app's default, else another. */
+  method(user) {
+    const open = this.methods(user);
+    const chosen = user.getAttribute("two_factor_method");
+    if (chosen && open.includes(chosen)) return chosen;
+    return open.includes(this.config().default) ? this.config().default : open[0];
+  }
+  async setMethod(user, method) {
+    user.setAttribute("two_factor_method", method);
+    await user.save();
+  }
+};
+var toMailCallback3;
+var TwoFactorCode = class {
+  constructor(code, minutes) {
+    this.code = code;
+    this.minutes = minutes;
+  }
+  code;
+  minutes;
+  /** Build the mail yourself (e.g. a MailMessage from the Notifications component). */
+  static toMailUsing(callback) {
+    toMailCallback3 = callback;
+  }
+  via() {
+    return ["mail"];
+  }
+  toMail(notifiable) {
+    if (toMailCallback3 !== void 0) return toMailCallback3(notifiable, this.code, this.minutes);
+    return {
+      subject: "Your sign-in code",
+      lines: [`Your sign-in code is ${this.code}.`, `It works once, for ${this.minutes} minutes.`],
+      outroLines: ["If you didn't just try to sign in, someone else knows your password: change it."]
+    };
+  }
+};
+var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+var STEP_SECONDS = 30;
+function base32Encode(bytes) {
+  let bits = 0;
+  let value2 = 0;
+  let out = "";
+  for (const byte of bytes) {
+    value2 = value2 << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      out += ALPHABET[value2 >>> bits - 5 & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) out += ALPHABET[value2 << 5 - bits & 31];
+  return out;
+}
+function base32Decode(text4) {
+  const clean = text4.replace(/[\s=]/g, "").toUpperCase();
+  const out = [];
+  let bits = 0;
+  let value2 = 0;
+  for (const char of clean) {
+    const index = ALPHABET.indexOf(char);
+    if (index === -1) throw new Error("Not a base32 secret.");
+    value2 = value2 << 5 | index;
+    bits += 5;
+    if (bits >= 8) {
+      out.push(value2 >>> bits - 8 & 255);
+      bits -= 8;
+    }
+  }
+  return new Uint8Array(out);
+}
+function generateSecret() {
+  return base32Encode(new Uint8Array(randomBytes(20)));
+}
+function totpCode(secret, at, step = Math.floor(at / 1e3 / STEP_SECONDS)) {
+  const counter = Buffer.alloc(8);
+  counter.writeBigUInt64BE(BigInt(step));
+  const hmac = createHmac2("sha1", base32Decode(secret)).update(counter).digest();
+  const offset = hmac[hmac.length - 1] & 15;
+  const binary = (hmac[offset] & 127) << 24 | hmac[offset + 1] << 16 | hmac[offset + 2] << 8 | hmac[offset + 3];
+  return String(binary % 1e6).padStart(6, "0");
+}
+function verifyTotp(secret, code, at, window = 1) {
+  if (!/^\d{6}$/.test(code)) return void 0;
+  const now5 = Math.floor(at / 1e3 / STEP_SECONDS);
+  let matched;
+  for (let step = now5 - window; step <= now5 + window; step++) {
+    if (timingSafeEqual2(Buffer.from(totpCode(secret, at, step)), Buffer.from(code)) && matched === void 0) matched = step;
+  }
+  return matched;
+}
+function otpauthUrl(options) {
+  const issuer = encodeURIComponent(options.issuer);
+  return `otpauth://totp/${issuer}:${encodeURIComponent(options.account)}?secret=${options.secret}&issuer=${issuer}&algorithm=SHA1&digits=6&period=${STEP_SECONDS}`;
+}
+var PENDING_LOGIN = "oriel.two_factor.login";
+var pendingKey = (nonce) => `oriel:two-factor:pending:${nonce}`;
+var emailKey = (id) => `oriel:two-factor:email:${String(id)}`;
+var stepKey = (id) => `oriel:two-factor:totp:${String(id)}`;
+function maskEmail(email) {
+  const [name = "", domain = ""] = String(email ?? "").split("@");
+  return `${name.slice(0, 1)}***@${domain}`;
+}
+var TwoFactorManager = class {
+  #requireWhen;
+  /** Who is asked for a second factor when two-factor is on. Default: everyone. */
+  requireWhen(callback) {
+    this.#requireWhen = callback;
+  }
+  /**
+   * Checks the credentials. `'authenticated'`: logged in (two-factor off, not required for this user, or no method
+   * open to them). `'challenge'`: the password was right and the code is asked for (an email method's code is sent
+   * now). `false`: wrong credentials.
+   */
+  async attempt(credentials, remember = false) {
+    const config2 = this.#config();
+    const guard2 = this.#guard();
+    if (!config2.enabled) return await guard2.attempt(credentials, remember) ? "authenticated" : false;
+    const guardName = inject(ConfigRepository).get("auth.defaults.guard", "web");
+    await this.#dispatch(new Attempting(guardName, credentials, remember));
+    const valid = await guard2.validate(credentials);
+    const user = guard2.getLastAttempted();
+    if (!valid || user === void 0) {
+      await this.#dispatch(new Failed(guardName, user, credentials));
+      return false;
+    }
+    const method = this.#store().method(user);
+    if (method === void 0 || !await (this.#requireWhen?.(user) ?? true)) {
+      await guard2.login(user, remember);
+      return "authenticated";
+    }
+    const nonce = randomBytes2(16).toString("hex");
+    const record = { id: user.getAuthIdentifier(), remember, method, expires: Date.now() + config2.pending_ttl * 1e3, attempts: 0, nonce };
+    inject(Session).put(PENDING_LOGIN, record);
+    await inject(CacheManager).put(pendingKey(nonce), true, config2.pending_ttl);
+    if (method === "email") await this.#sendCode(user);
+    await this.#dispatch(new TwoFactorChallenged(user, method));
+    return "challenge";
+  }
+  /** The pending login, for the challenge page: the method asked for, the others open, and where an email code went. */
+  async challenge() {
+    const pending = await this.#pending();
+    if (pending === void 0) return void 0;
+    return { method: pending.record.method, methods: this.#store().methods(pending.user), email: maskEmail(pending.user.getAttribute("email")) };
+  }
+  /** A 6-digit code for the pending method, or a recovery code. True: the user is logged in. */
+  async verify(code) {
+    const pending = await this.#pending();
+    if (pending === void 0) return false;
+    const { record, user } = pending;
+    const typed = normalizeCode(code);
+    let used;
+    if (/^\d{6}$/.test(typed)) {
+      if (record.method === "app" ? await this.#checkApp(user, typed) : await this.#checkEmail(user, typed)) used = record.method;
+    } else if (/^[a-z0-9]{10}$/.test(typed) && await this.#checkRecovery(user, typed)) {
+      used = "recovery";
+    }
+    if (used === void 0) {
+      record.attempts++;
+      await this.#dispatch(new TwoFactorFailed(user, record.method));
+      if (record.attempts >= this.#config().max_attempts) await this.#end(record);
+      else inject(Session).put(PENDING_LOGIN, record);
+      return false;
+    }
+    await this.#end(record);
+    await this.#guard().login(user, record.remember);
+    await this.#dispatch(new TwoFactorAuthenticated(user, used));
+    return true;
+  }
+  /** Asks for another of the user's methods; switching to email sends a code. */
+  async useMethod(method) {
+    const pending = await this.#pending();
+    if (pending === void 0 || !this.#store().methods(pending.user).includes(method)) return;
+    pending.record.method = method;
+    inject(Session).put(PENDING_LOGIN, pending.record);
+    if (method === "email") await this.#sendCode(pending.user);
+  }
+  /** Sends a new email code; false within `resend_after` seconds of the last one, or when the method isn't email. */
+  async resend() {
+    const pending = await this.#pending();
+    if (pending === void 0 || pending.record.method !== "email") return false;
+    const last = await inject(CacheManager).get(emailKey(pending.record.id));
+    if (last !== void 0 && Date.now() - last.sent < this.#config().resend_after * 1e3) return false;
+    await this.#sendCode(pending.user);
+    return true;
+  }
+  /**
+   * Starts setting up an authenticator app: a new secret (unconfirmed, so it doesn't count yet), the `otpauth://` URL
+   * and a QR code of it for the app to scan.
+   */
+  async enableApp(user) {
+    const secret = generateSecret();
+    await this.#store().setSecret(user, secret);
+    const issuer = this.#config().issuer ?? inject(ConfigRepository).get("app.name", "Oriel");
+    const url2 = otpauthUrl({ secret, issuer, account: String(user.getAttribute("email") ?? user.getAuthIdentifier()) });
+    return { secret, url: url2, svg: qrSvg(url2) };
+  }
+  /** Confirms the app with a code from it: then it counts, becomes the user's method, and recovery codes are made. */
+  async confirmApp(user, code) {
+    const store = this.#store();
+    const secret = store.secret(user);
+    if (secret === void 0 || verifyTotp(secret, normalizeCode(code), Date.now(), this.#config().window) === void 0) return false;
+    await store.confirm(user);
+    await store.setMethod(user, "app");
+    if (store.recoveryCodes(user).length === 0) await store.setRecoveryCodes(user, generateRecoveryCodes(this.#config().recovery_codes));
+    await this.#dispatch(new TwoFactorAppEnabled(user));
+    return true;
+  }
+  /** Removes the authenticator app: the secret is forgotten and the user is asked by email again. */
+  async disableApp(user) {
+    const store = this.#store();
+    await store.setSecret(user, null);
+    await store.setMethod(user, null);
+    await this.#dispatch(new TwoFactorAppDisabled(user));
+  }
+  /** The method the user prefers; one they can't use (an unconfirmed app, one the app turned off) isn't asked for. */
+  async setMethod(user, method) {
+    await this.#store().setMethod(user, method);
+  }
+  /** The user's recovery codes, made on first ask (show them once, and offer to make new ones). */
+  async recoveryCodes(user) {
+    const store = this.#store();
+    const codes = store.recoveryCodes(user);
+    if (codes.length > 0) return codes;
+    return this.regenerateRecoveryCodes(user);
+  }
+  /** New recovery codes; the old ones stop working. */
+  async regenerateRecoveryCodes(user) {
+    const codes = generateRecoveryCodes(this.#config().recovery_codes);
+    await this.#store().setRecoveryCodes(user, codes);
+    return codes;
+  }
+  #config() {
+    return twoFactorConfig(inject(ConfigRepository));
+  }
+  #store() {
+    return new TwoFactorStore(inject(Encrypter), () => this.#config());
+  }
+  #guard() {
+    return inject(AuthFactory).guard();
+  }
+  async #dispatch(event2) {
+    const container = currentContainer();
+    if (container?.bound(EventDispatcher)) await container.make(EventDispatcher).dispatch(event2);
+  }
+  /** The live pending login and its user; an expired, replayed or orphaned one is forgotten. */
+  async #pending() {
+    const session2 = inject(Session);
+    const record = session2.get(PENDING_LOGIN);
+    if (record === void 0 || record === null) return void 0;
+    const live2 = record.expires > Date.now() && await inject(CacheManager).get(pendingKey(record.nonce)) === true;
+    const user = live2 ? await this.#guard().provider.retrieveById(record.id) : void 0;
+    if (user === void 0) {
+      session2.forget(PENDING_LOGIN);
+      return void 0;
+    }
+    return { record, user };
+  }
+  async #end(record) {
+    inject(Session).forget(PENDING_LOGIN);
+    await inject(CacheManager).forget(pendingKey(record.nonce));
+  }
+  #hash(code) {
+    return createHmac3("sha256", inject(Encrypter).getKey()).update(code).digest("hex");
+  }
+  async #sendCode(user) {
+    const config2 = this.#config();
+    const code = String(randomInt2(1e6)).padStart(6, "0");
+    const now5 = Date.now();
+    const stored = { hash: this.#hash(code), sent: now5, expires: now5 + config2.code_ttl * 1e3 };
+    await inject(CacheManager).put(emailKey(user.getAuthIdentifier()), stored, config2.code_ttl);
+    await sendNotification(user, new TwoFactorCode(code, Math.round(config2.code_ttl / 60)));
+  }
+  async #checkEmail(user, code) {
+    const cache2 = inject(CacheManager);
+    const stored = await cache2.get(emailKey(user.getAuthIdentifier()));
+    if (stored === void 0 || stored.expires <= Date.now()) return false;
+    if (!timingSafeEqual3(Buffer.from(stored.hash), Buffer.from(this.#hash(code)))) return false;
+    await cache2.forget(emailKey(user.getAuthIdentifier()));
+    return true;
+  }
+  async #checkApp(user, code) {
+    const store = this.#store();
+    const secret = store.secret(user);
+    if (secret === void 0 || !store.hasApp(user)) return false;
+    const step = verifyTotp(secret, code, Date.now(), this.#config().window);
+    if (step === void 0) return false;
+    const cache2 = inject(CacheManager);
+    const last = await cache2.get(stepKey(user.getAuthIdentifier()));
+    if (last !== void 0 && step <= last) return false;
+    await cache2.put(stepKey(user.getAuthIdentifier()), step, 300);
+    return true;
+  }
+  async #checkRecovery(user, code) {
+    const store = this.#store();
+    const codes = store.recoveryCodes(user);
+    const index = codes.findIndex((candidate) => normalizeCode(candidate) === code);
+    if (index === -1) return false;
+    await store.setRecoveryCodes(user, codes.filter((_, i) => i !== index));
+    await this.#dispatch(new RecoveryCodeUsed(user));
+    return true;
+  }
+};
+var TwoFactorChallenge = class {
+  async handle(request2, next) {
+    if (await inject(TwoFactorManager).challenge() === void 0) throw new AuthenticationError("Log in first.");
+    return next(request2);
+  }
+};
 var AuthServiceProvider = class extends ServiceProvider {
   register() {
     this.mergeConfigFrom(
@@ -1693,7 +2150,8 @@ var AuthServiceProvider = class extends ServiceProvider {
         },
         providers: { users: { driver: "eloquent", model: null } },
         passwords: { users: { provider: "users", table: "password_reset_tokens", expire: 60, throttle: 60 } },
-        password_timeout: 10800
+        password_timeout: 10800,
+        two_factor: { ...TWO_FACTOR_DEFAULTS }
       },
       "auth"
     );
@@ -1703,15 +2161,29 @@ var AuthServiceProvider = class extends ServiceProvider {
     this.app.singleton(PasswordBrokerManager, (container) => new PasswordBrokerManager(container));
     this.app.singleton(PasswordBroker, (container) => container.make(PasswordBrokerManager).broker());
     this.app.singleton(TokenRepository, (container) => new TokenRepository(() => container.make(DatabaseManager)));
+    this.app.singleton(TwoFactorManager, () => new TwoFactorManager());
   }
   async boot() {
     if (this.app.bound(Router)) {
-      this.app.make(Router).aliasMiddleware("auth", Authenticate).aliasMiddleware("guest", RedirectIfAuthenticated).aliasMiddleware("can", Authorize).aliasMiddleware("verified", EnsureEmailIsVerified);
+      this.app.make(Router).aliasMiddleware("auth", Authenticate).aliasMiddleware("guest", RedirectIfAuthenticated).aliasMiddleware("can", Authorize).aliasMiddleware("verified", EnsureEmailIsVerified).aliasMiddleware("two-factor.challenge", TwoFactorChallenge);
     }
     if (this.app.bound(EventDispatcher)) this.app.make(EventDispatcher).listen(Registered, SendEmailVerificationNotification);
     await discoverPolicies(this.app.appPath("Policies"), this.app.make(Gate));
+    if (this.app.bound(ConsoleKernel)) {
+      const app2 = this.app;
+      this.app.make(ConsoleKernel).command("two-factor:install", function() {
+        try {
+          this.info(`Wrote ${relative(app2.basePath(), installTwoFactorMigration(app2.databasePath("migrations")))}: run \`oriel migrate\`.`);
+          return 0;
+        } catch (error) {
+          this.error(error instanceof Error ? error.message : String(error));
+          return 1;
+        }
+      }).purpose("Write the migration for two-factor login's columns on users");
+    }
   }
 };
+var TwoFactor = facade(TwoFactorManager);
 
 // ../Bus/dist/index.js
 var BusError = class extends Error {
@@ -1973,9 +2445,9 @@ var Dispatcher = class {
   }
   #afterResponseList() {
     const owner = currentContainer() ?? this.container;
-    let list5 = this.#afterResponse.get(owner);
-    if (list5 === void 0) this.#afterResponse.set(owner, list5 = []);
-    return list5;
+    let list6 = this.#afterResponse.get(owner);
+    if (list6 === void 0) this.#afterResponse.set(owner, list6 = []);
+    return list6;
   }
   /** Runs the job (like dispatchSync) after the response is sent, or after the current queued job. */
   dispatchAfterResponse(job) {
@@ -2154,7 +2626,7 @@ var BusServiceProvider = class extends ServiceProvider {
 import { setTimeout as sleep } from "timers/promises";
 import { createHash as createHash5 } from "crypto";
 import { link, mkdir, readFile, rename, rm, stat, writeFile } from "fs/promises";
-import { dirname, join as join2 } from "path";
+import { dirname, join as join3 } from "path";
 import { setTimeout as sleep2 } from "timers/promises";
 import { createHash as createHash22, randomUUID } from "crypto";
 import Redis from "ioredis";
@@ -2430,7 +2902,7 @@ var FileStore = class {
   keyPrefix;
   path(key) {
     const hash2 = createHash5("sha1").update(this.keyPrefix + key).digest("hex");
-    return join2(this.directory, hash2.slice(0, 2), hash2.slice(2, 4), hash2);
+    return join3(this.directory, hash2.slice(0, 2), hash2.slice(2, 4), hash2);
   }
   tempPath(path) {
     return `${path}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
@@ -3016,8 +3488,8 @@ var RedisRepository = class extends Repository2 {
     return quit;
   }
   tags(names) {
-    const list5 = Array.isArray(names) ? names : [names];
-    const taggedStore = this.redisStore.tags(list5);
+    const list6 = Array.isArray(names) ? names : [names];
+    const taggedStore = this.redisStore.tags(list6);
     const prefix = this.redisStore.getPrefix();
     return new Repository2(taggedStore, (_store, name, seconds, owner) => new RedisLock(this.redis, prefix + name, seconds, owner));
   }
@@ -3234,18 +3706,18 @@ var CacheServiceProvider = class extends ServiceProvider {
 };
 
 // ../Console/dist/index.js
-import { existsSync } from "fs";
-import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
-import { dirname as dirname2, join as join3, relative, sep } from "path";
 import { existsSync as existsSync2 } from "fs";
+import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
+import { dirname as dirname2, join as join4, relative as relative2, sep } from "path";
+import { existsSync as existsSync22 } from "fs";
 import { join as join22 } from "path";
 import { existsSync as existsSync3 } from "fs";
 import { mkdir as mkdir22, writeFile as writeFile22 } from "fs/promises";
 import { dirname as dirname22, join as join32 } from "path";
-import { join as join4 } from "path";
+import { join as join42 } from "path";
 import { spawn } from "child_process";
 import { start as start2 } from "repl";
-import { existsSync as existsSync4, readdirSync } from "fs";
+import { existsSync as existsSync4, readdirSync as readdirSync2 } from "fs";
 import { join as join5 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 import { createHash as createHash6 } from "crypto";
@@ -3703,7 +4175,7 @@ var GeneratorCommand = class extends Command {
   async prepare(_rawName) {
   }
   qualifyClass(rawName) {
-    const segments = rawName.split("/").filter(Boolean).map((part) => Str.studly(part));
+    const segments = rawName.split("/").filter(Boolean).map((part2) => Str.studly(part2));
     const last = segments.pop();
     if (!last) throw new Error("A name is required.");
     const suffix2 = this.suffix();
@@ -3720,7 +4192,7 @@ var GeneratorCommand = class extends Command {
   }
   targetPath(rawName) {
     const { directories, className } = this.qualifyClass(rawName);
-    return join3(this.root(this.type()), ...directories, this.fileName(className));
+    return join4(this.root(this.type()), ...directories, this.fileName(className));
   }
   /** The singular kind of file for messages, like Laravel's `$type`: 'Http/Controllers' -> 'Controller'. */
   kind() {
@@ -3728,13 +4200,13 @@ var GeneratorCommand = class extends Command {
   }
   /** The import specifier from the generated file to `target` (an absolute path without extension): './X', '../Y/X'. */
   importPath(rawName, target) {
-    const specifier = relative(dirname2(this.targetPath(rawName)), target).split(sep).join("/");
+    const specifier = relative2(dirname2(this.targetPath(rawName)), target).split(sep).join("/");
     return specifier.startsWith(".") ? specifier : `./${specifier}`;
   }
   /** A --model value as studly segments: 'Admin/blog_post' -> ['Admin', 'BlogPost']; undefined when there is none. */
   modelSegments(value2) {
     if (typeof value2 !== "string") return void 0;
-    const segments = value2.split(/[/\\]/).filter(Boolean).map((part) => Str.studly(part));
+    const segments = value2.split(/[/\\]/).filter(Boolean).map((part2) => Str.studly(part2));
     return segments.length > 0 ? segments : void 0;
   }
   /** The model's file under app/Models, without the extension (Laravel's qualifyModel() into App\Models). */
@@ -3748,7 +4220,7 @@ var GeneratorCommand = class extends Command {
       return 1;
     }
     const target = this.targetPath(rawName);
-    if (existsSync(target) && !this.option("force")) {
+    if (existsSync2(target) && !this.option("force")) {
       this.error(`${this.kind()} already exists.`);
       return 1;
     }
@@ -4279,7 +4751,7 @@ var MakeControllerCommand = class extends GeneratorCommand {
   async prepare() {
     const segments = this.modelSegments(this.option("model"));
     if (!segments) return;
-    if (!existsSync2(`${this.modelPath(segments)}.ts`)) await this.call("make:model", { name: segments.join("/") });
+    if (!existsSync22(`${this.modelPath(segments)}.ts`)) await this.call("make:model", { name: segments.join("/") });
     if (this.option("requests")) {
       const model = segments.at(-1);
       await this.call("make:request", { name: `Store${model}Request` });
@@ -4343,7 +4815,7 @@ var MakeFactoryCommand = class extends GeneratorCommand {
   extraPlaceholders(rawName) {
     const option = this.option("model");
     const modelName = typeof option === "string" ? option : this.qualifyClass(rawName).className.replace(/Factory$/, "");
-    const segments = modelName.split("/").filter(Boolean).map((part) => Str.studly(part));
+    const segments = modelName.split("/").filter(Boolean).map((part2) => Str.studly(part2));
     return {
       model: segments.at(-1) ?? modelName,
       modelImport: this.importPath(rawName, inject(Application).appPath(["Models", ...segments].join("/")))
@@ -4374,7 +4846,7 @@ var MakeListenerCommand = class extends GeneratorCommand {
   extraPlaceholders(rawName) {
     const event2 = this.option("event");
     if (typeof event2 !== "string") return {};
-    const segments = event2.split("/").filter(Boolean).map((part) => Str.studly(part));
+    const segments = event2.split("/").filter(Boolean).map((part2) => Str.studly(part2));
     return {
       event: segments.at(-1) ?? event2,
       eventImport: this.importPath(rawName, inject(Application).appPath(["Events", ...segments].join("/")))
@@ -4404,7 +4876,7 @@ var MakeMailCommand = class extends GeneratorCommand {
   viewName(rawName) {
     const option = this.option("view");
     if (typeof option === "string" && option !== "") return option;
-    const parts = rawName.split("/").filter(Boolean).map((part) => Str.kebab(Str.studly(part)));
+    const parts = rawName.split("/").filter(Boolean).map((part2) => Str.kebab(Str.studly(part2)));
     return ["mail", ...parts].join(".");
   }
   /** Laravel's writeView(): an existing view is reported and left alone, even with --force. */
@@ -4620,7 +5092,7 @@ var MakeTestCommand = class extends GeneratorCommand {
     return TEST_STUB;
   }
   root(subpath) {
-    return inject(Application).basePath(join4("tests", subpath));
+    return inject(Application).basePath(join42("tests", subpath));
   }
   fileName(className) {
     return `${className.replace(/(?<=.)Test$/, "")}.test.ts`;
@@ -4835,7 +5307,7 @@ var TinkerCommand = class extends Command {
 };
 function sourceFiles(directory) {
   const files3 = [];
-  for (const entry of readdirSync(directory, { withFileTypes: true })) {
+  for (const entry of readdirSync2(directory, { withFileTypes: true })) {
     const path = join5(directory, entry.name);
     if (entry.isDirectory()) files3.push(...sourceFiles(path));
     else if (/\.(ts|js|mts|mjs)$/.test(entry.name) && !/\.d\.[mc]?ts$/.test(entry.name)) files3.push(path);
@@ -4933,6 +5405,15 @@ var Kernel2 = class {
   defaultOutput;
   lastOutput = "";
   running = 0;
+  loader;
+  bootstrapping;
+  /** What bootstrap() runs once: the provider hands it the loading of the app's commands and routes/console.ts. */
+  bootstrapWith(loader) {
+    this.loader = loader;
+  }
+  bootstrap() {
+    return this.bootstrapping ??= this.loader?.() ?? Promise.resolve();
+  }
   register(...commands) {
     for (const entry of commands) {
       const instance = typeof entry === "function" ? new entry() : entry;
@@ -5362,6 +5843,27 @@ var ScheduledEventImpl = class {
     if (this.betweenWindow && !this.isWithinWindow(this.betweenWindow, now5)) return false;
     return !this.unlessWindow || !this.isWithinWindow(this.unlessWindow, now5);
   }
+  /**
+   * The latest minute after `from` and up to `to` at which this event was due, its between()/unlessBetween() windows
+   * judged at that minute; undefined when there is none. Walks back from `to` (at most 10,000 due minutes).
+   */
+  dueAt(from, to) {
+    const end = Math.floor(to.getTime() / 6e4) * 6e4;
+    const parsed = CronExpressionParser.parse(this.cronExpression, { tz: this.zone(), currentDate: new Date(end + 6e4) });
+    for (let step = 0; step < 1e4; step++) {
+      let minute;
+      try {
+        minute = parsed.prev().toDate();
+      } catch {
+        return void 0;
+      }
+      if (minute.getTime() <= from.getTime()) return void 0;
+      if (this.betweenWindow && !this.isWithinWindow(this.betweenWindow, minute)) continue;
+      if (this.unlessWindow && this.isWithinWindow(this.unlessWindow, minute)) continue;
+      return minute;
+    }
+    return void 0;
+  }
   zone() {
     if (this.tz !== void 0) return this.tz;
     const container = currentContainer();
@@ -5482,6 +5984,9 @@ var ScheduleImpl = class {
   dueEvents(now5) {
     return this.scheduledEvents.filter((event2) => event2.isDue(now5));
   }
+  dueBetween(from, to) {
+    return this.scheduledEvents.filter((event2) => event2.dueAt(from, to) !== void 0);
+  }
   push(event2) {
     this.scheduledEvents.push(event2);
     return event2;
@@ -5490,7 +5995,14 @@ var ScheduleImpl = class {
 var ConsoleServiceProvider = class extends ServiceProvider {
   register() {
     this.mergeConfigFrom({ stubs: {} }, "console");
-    this.app.singleton(ConsoleKernel, () => new Kernel2(this.app));
+    this.app.singleton(ConsoleKernel, () => {
+      const kernel = new Kernel2(this.app);
+      kernel.bootstrapWith(async () => {
+        await discoverCommands(kernel, this.app.appPath("Console/Commands"));
+        await loadConsoleRoutes(this.app, kernel);
+      });
+      return kernel;
+    });
     this.app.singleton(Schedule, () => new ScheduleImpl());
   }
   boot() {
@@ -5527,9 +6039,7 @@ var ConsoleServiceProvider = class extends ServiceProvider {
     );
     this.app.booted(async (app2) => {
       if (!app2.runningInConsole()) return;
-      const kernel = app2.make(ConsoleKernel);
-      await discoverCommands(kernel, app2.appPath("Console/Commands"));
-      await loadConsoleRoutes(app2, kernel);
+      await app2.make(ConsoleKernel).bootstrap();
     });
   }
 };
@@ -5555,7 +6065,7 @@ async function runConsoleAndExit(app2, argv = process.argv.slice(2), exit = (cod
 }
 
 // ../Cookie/dist/index.js
-import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHmac as createHmac4, timingSafeEqual as timingSafeEqual4 } from "crypto";
 var SAME_SITE = { lax: "Lax", strict: "Strict", none: "None" };
 function serializeCookie(cookie2, now5 = Date.now()) {
   const parts = [];
@@ -5593,12 +6103,12 @@ function parseSetCookie(header) {
 }
 function parseCookieHeader(header) {
   const cookies = {};
-  for (const part of (header ?? "").split(";")) {
-    const equals4 = part.indexOf("=");
+  for (const part2 of (header ?? "").split(";")) {
+    const equals4 = part2.indexOf("=");
     if (equals4 === -1) continue;
-    const name = part.slice(0, equals4).trim();
+    const name = part2.slice(0, equals4).trim();
     if (name === "" || Object.hasOwn(cookies, name) || name === "__proto__") continue;
-    cookies[name] = decode(part.slice(equals4 + 1).trim());
+    cookies[name] = decode(part2.slice(equals4 + 1).trim());
   }
   return cookies;
 }
@@ -5609,7 +6119,7 @@ function withHeaders(response2, change) {
 }
 var CookieValuePrefix = {
   create(name, key) {
-    return `${createHmac2("sha1", key).update(`${name}v2`).digest("hex")}|`;
+    return `${createHmac4("sha1", key).update(`${name}v2`).digest("hex")}|`;
   },
   remove(value2) {
     return value2.slice(41);
@@ -5619,7 +6129,7 @@ var CookieValuePrefix = {
     const actual = Buffer.from(value2.slice(0, 41));
     for (const key of keys) {
       const expected = Buffer.from(CookieValuePrefix.create(name, key));
-      if (actual.length === expected.length && timingSafeEqual2(actual, expected)) return CookieValuePrefix.remove(value2);
+      if (actual.length === expected.length && timingSafeEqual4(actual, expected)) return CookieValuePrefix.remove(value2);
     }
     return void 0;
   }
@@ -5688,11 +6198,11 @@ var AddQueuedCookiesToResponse = class {
 };
 var neverEncrypt = /* @__PURE__ */ new Set();
 function isDeletion(attributes, now5 = Date.now()) {
-  for (const part of attributes.split(";")) {
-    const equals4 = part.indexOf("=");
+  for (const part2 of attributes.split(";")) {
+    const equals4 = part2.indexOf("=");
     if (equals4 === -1) continue;
-    const key = part.slice(0, equals4).trim().toLowerCase();
-    const value2 = part.slice(equals4 + 1).trim();
+    const key = part2.slice(0, equals4).trim().toLowerCase();
+    const value2 = part2.slice(equals4 + 1).trim();
     if (key === "max-age" && Number(value2) <= 0) return true;
     if (key === "expires" && Date.parse(value2) <= now5) return true;
   }
@@ -5791,21 +6301,21 @@ import { sql as sql4 } from "kysely";
 import { sql as sql5 } from "kysely";
 import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
 import { isDeepStrictEqual } from "util";
-import { existsSync as existsSync5, readdirSync as readdirSync2 } from "fs";
-import { join as join42 } from "path";
+import { existsSync as existsSync5, readdirSync as readdirSync3 } from "fs";
+import { join as join43 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
-import { existsSync as existsSync22, mkdirSync, writeFileSync } from "fs";
+import { existsSync as existsSync23, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
 import { join as join52 } from "path";
 import { existsSync as existsSync32, readdirSync as readdirSync22 } from "fs";
 import { basename, extname, join as join6 } from "path";
 import { pathToFileURL as pathToFileURL22 } from "url";
 import { existsSync as existsSync42 } from "fs";
-import { isAbsolute, join as join7, relative as relative2 } from "path";
+import { isAbsolute, join as join7, relative as relative22 } from "path";
 import { pathToFileURL as pathToFileURL32 } from "url";
 import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
 import { dirname as dirname3, relative as relative3, sep as sep2 } from "path";
-import { existsSync as existsSync52, readdirSync as readdirSync3, statSync } from "fs";
+import { existsSync as existsSync52, readdirSync as readdirSync32, statSync } from "fs";
 import { join as join8 } from "path";
 import { pathToFileURL as pathToFileURL4 } from "url";
 import { randomUUID as randomUUID2 } from "crypto";
@@ -6217,9 +6727,9 @@ var Cursor = class _Cursor {
   static fromEncoded(encoded) {
     if (typeof encoded !== "string" || encoded === "") return void 0;
     try {
-      const json2 = JSON.parse(Buffer.from(encoded.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8"));
-      if (typeof json2 !== "object" || json2 === null || Array.isArray(json2)) return void 0;
-      const { _pointsToNextItems: pointsToNext, ...parameters } = json2;
+      const json3 = JSON.parse(Buffer.from(encoded.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8"));
+      if (typeof json3 !== "object" || json3 === null || Array.isArray(json3)) return void 0;
+      const { _pointsToNextItems: pointsToNext, ...parameters } = json3;
       if (typeof pointsToNext !== "boolean") return void 0;
       return new _Cursor(parameters, pointsToNext);
     } catch {
@@ -6436,9 +6946,9 @@ var Paginator = class extends AbstractPaginator {
     };
   }
 };
-var pad = (n, width = 2) => String(n).padStart(width, "0");
+var pad2 = (n, width = 2) => String(n).padStart(width, "0");
 function formatDateTime(date) {
-  return `${pad(date.getUTCFullYear(), 4)}-${pad(date.getUTCMonth() + 1)}-${pad(date.getUTCDate())} ${pad(date.getUTCHours())}:${pad(date.getUTCMinutes())}:${pad(date.getUTCSeconds())}`;
+  return `${pad2(date.getUTCFullYear(), 4)}-${pad2(date.getUTCMonth() + 1)}-${pad2(date.getUTCDate())} ${pad2(date.getUTCHours())}:${pad2(date.getUTCMinutes())}:${pad2(date.getUTCSeconds())}`;
 }
 function formatDate(date) {
   return formatDateTime(date).slice(0, 10);
@@ -6470,7 +6980,7 @@ var OPERATORS = /* @__PURE__ */ new Set(["=", "<", ">", "<=", ">=", "<>", "!=",
 var EMPTY = sql2.raw("");
 var isSqlFragment = (value2) => typeof value2 === "object" && value2 !== null && typeof value2.toOperationNode === "function";
 var join9 = (parts, separator = ", ") => sql2.join(parts, sql2.raw(separator));
-var clauses = (parts) => join9(parts.filter((part) => part !== void 0), " ");
+var clauses = (parts) => join9(parts.filter((part2) => part2 !== void 0), " ");
 function likeToGlob(pattern) {
   return pattern.replaceAll("*", "[*]").replaceAll("?", "[?]").replaceAll("%", "*").replaceAll("_", "?");
 }
@@ -6741,17 +7251,17 @@ function keyOf(item, alias) {
   }
   return value2;
 }
-var pad2 = (value2, width = 2) => String(value2).padStart(width, "0");
-function dateWhereValue(part, value2) {
+var pad22 = (value2, width = 2) => String(value2).padStart(width, "0");
+function dateWhereValue(part2, value2) {
   if (value2 instanceof Expression) return value2;
   if (value2 instanceof Date) {
-    if (part === "date") return `${pad2(value2.getUTCFullYear(), 4)}-${pad2(value2.getUTCMonth() + 1)}-${pad2(value2.getUTCDate())}`;
-    if (part === "time") return `${pad2(value2.getUTCHours())}:${pad2(value2.getUTCMinutes())}:${pad2(value2.getUTCSeconds())}`;
-    if (part === "day") return pad2(value2.getUTCDate());
-    if (part === "month") return pad2(value2.getUTCMonth() + 1);
+    if (part2 === "date") return `${pad22(value2.getUTCFullYear(), 4)}-${pad22(value2.getUTCMonth() + 1)}-${pad22(value2.getUTCDate())}`;
+    if (part2 === "time") return `${pad22(value2.getUTCHours())}:${pad22(value2.getUTCMinutes())}:${pad22(value2.getUTCSeconds())}`;
+    if (part2 === "day") return pad22(value2.getUTCDate());
+    if (part2 === "month") return pad22(value2.getUTCMonth() + 1);
     return String(value2.getUTCFullYear());
   }
-  if (part === "day" || part === "month") return pad2(Math.trunc(Number(value2)) || 0);
+  if (part2 === "day" || part2 === "month") return pad22(Math.trunc(Number(value2)) || 0);
   return typeof value2 === "number" ? String(value2) : value2;
 }
 var isRow = (value2) => typeof value2 === "object" && value2 !== null && !(value2 instanceof Expression) && !(value2 instanceof Builder) && !Array.isArray(value2);
@@ -7310,15 +7820,15 @@ var Builder = class _Builder {
     return [...this.connection.compile(this.grammar.compileSelect(this)).parameters];
   }
   clone() {
-    const copy = Object.create(Object.getPrototypeOf(this));
-    Object.assign(copy, this);
-    copy.columns = [...this.columns];
-    copy.joins = [...this.joins];
-    copy.wheres = [...this.wheres];
-    copy.groups = [...this.groups];
-    copy.havings = [...this.havings];
-    copy.orders = [...this.orders];
-    return copy;
+    const copy2 = Object.create(Object.getPrototypeOf(this));
+    Object.assign(copy2, this);
+    copy2.columns = [...this.columns];
+    copy2.joins = [...this.joins];
+    copy2.wheres = [...this.wheres];
+    copy2.groups = [...this.groups];
+    copy2.havings = [...this.havings];
+    copy2.orders = [...this.orders];
+    return copy2;
   }
   /** A fresh builder on the same connection and table (for nested where groups). */
   newQuery() {
@@ -7361,10 +7871,10 @@ var Builder = class _Builder {
     return this;
   }
   /** Laravel's addDateBasedWhere(): one value means '='; the operator is checked against the whitelist. */
-  addDateBasedWhere(part, column, args, boolean) {
+  addDateBasedWhere(part2, column, args, boolean) {
     const [operator, value2] = args.length === 1 ? ["=", args[0]] : [args[0].toLowerCase(), args[1]];
     this.grammar.operator(operator);
-    this.wheres.push({ type: "date", part, column, operator, value: dateWhereValue(part, value2), boolean });
+    this.wheres.push({ type: "date", part: part2, column, operator, value: dateWhereValue(part2, value2), boolean });
     return this;
   }
   pushNull(column, not, boolean) {
@@ -7931,7 +8441,7 @@ var SchemaGrammar = class {
     return sql4`${sql4.raw(type)} check (${sql4.id(column.name)} in (${allowed}))`;
   }
 };
-var present = (parts) => parts.filter((part) => part !== void 0);
+var present = (parts) => parts.filter((part2) => part2 !== void 0);
 function mergeRebuilds(steps) {
   const merged = [];
   for (const step of steps) {
@@ -9624,12 +10134,12 @@ var Builder2 = class extends Builder {
     return Builder.prototype.getBindings.call(this.applyScopes());
   }
   clone() {
-    const copy = super.clone();
-    copy.scopes = new Map(this.scopes);
-    copy.removedScopes = [...this.removedScopes];
-    copy.eagerLoad = new Map(this.eagerLoad);
-    copy.selectCasts = { ...this.selectCasts };
-    return new Proxy(copy, handler);
+    const copy2 = super.clone();
+    copy2.scopes = new Map(this.scopes);
+    copy2.removedScopes = [...this.removedScopes];
+    copy2.eagerLoad = new Map(this.eagerLoad);
+    copy2.selectCasts = { ...this.selectCasts };
+    return new Proxy(copy2, handler);
   }
   /** Nested where groups get a builder of the same model (without global scopes), so local scopes work inside them. */
   newQuery() {
@@ -9939,11 +10449,11 @@ var EloquentCollection = class extends Collection {
 };
 async function loadMissingOn(models, paths) {
   for (const path of paths) {
-    const [head = "", ...rest] = path.split(".");
-    const missing = models.filter((model) => !model.relationLoaded(head));
+    const [head2 = "", ...rest] = path.split(".");
+    const missing = models.filter((model) => !model.relationLoaded(head2));
     if (missing.length) await missing[0].newQueryWithoutRelationships().with(path).eagerLoadRelations(missing);
     if (!rest.length) continue;
-    const related = models.flatMap((model) => relatedModels(model.getRelations()[head]));
+    const related = models.flatMap((model) => relatedModels(model.getRelations()[head2]));
     if (related.length) await loadMissingOn(related, [rest.join(".")]);
   }
 }
@@ -10648,9 +11158,9 @@ var Factory2 = class _Factory {
     return new Collection(created);
   }
   newInstance(changes) {
-    const copy = Object.create(Object.getPrototypeOf(this));
-    Object.assign(copy, this, changes);
-    return copy;
+    const copy2 = Object.create(Object.getPrototypeOf(this));
+    Object.assign(copy2, this, changes);
+    return copy2;
   }
   async makeModels(attributes) {
     const models = [];
@@ -10710,9 +11220,9 @@ var Factory2 = class _Factory {
 };
 async function discoverFactories(path) {
   if (!existsSync5(path)) return;
-  for (const file of readdirSync2(path).sort()) {
+  for (const file of readdirSync3(path).sort()) {
     if (!/\.(ts|js|mts|mjs)$/.test(file) || /\.d\.[mc]?ts$/.test(file)) continue;
-    const module = await import(pathToFileURL3(join42(path, file)).href);
+    const module = await import(pathToFileURL3(join43(path, file)).href);
     for (const exported of Object.values(module)) {
       if (typeof exported === "function" && exported.prototype instanceof Factory2) {
         Factory2.register(exported);
@@ -12482,9 +12992,9 @@ var MigrationCreator = class {
     }
     const stub = table === void 0 ? MIGRATION_STUB : create ? MIGRATION_CREATE_STUB : MIGRATION_UPDATE_STUB;
     const file = join52(path, `${migrationDatePrefix(options.date)}_${snake}.ts`);
-    if (existsSync22(file)) throw new LogicError(`Migration [${file}] already exists.`);
-    mkdirSync(path, { recursive: true });
-    writeFileSync(
+    if (existsSync23(file)) throw new LogicError(`Migration [${file}] already exists.`);
+    mkdirSync2(path, { recursive: true });
+    writeFileSync2(
       file,
       stub.replaceAll("{{ importSource }}", options.importSource ?? "@orieljs/framework").replaceAll("{{ table }}", table ?? "")
     );
@@ -12879,7 +13389,7 @@ async function generateModelTypes(context) {
   if (!context.models) return void 0;
   const outputFile = context.app.basePath(join7("types", "models.d.ts"));
   await new TypeGenerator({ outputFile, importSource: context.typesImportSource }).write((await context.models()).all());
-  return relative2(context.app.basePath(), outputFile);
+  return relative22(context.app.basePath(), outputFile);
 }
 async function writeModelTypes(context, command) {
   if (context.app.isProduction() || !existsSync42(context.app.basePath("types"))) return;
@@ -12970,7 +13480,7 @@ function registerMigrationCommands(kernel, context) {
       table: text(command.option("table")),
       importSource: context.stubsImportSource
     });
-    command.info(`Migration [${relative2(context.app.basePath(), file)}] created successfully.`);
+    command.info(`Migration [${relative22(context.app.basePath(), file)}] created successfully.`);
     return 0;
   });
 }
@@ -13025,7 +13535,7 @@ var ModelRegistry = class {
 function listFiles(directory) {
   if (!existsSync52(directory)) return [];
   const files3 = [];
-  for (const entry of readdirSync3(directory).sort()) {
+  for (const entry of readdirSync32(directory).sort()) {
     const path = join8(directory, entry);
     if (statSync(path).isDirectory()) files3.push(...listFiles(path));
     else if (MODEL_FILE.test(entry)) files3.push(path);
@@ -13505,7 +14015,7 @@ var DatabaseServiceProvider = class extends ServiceProvider {
 };
 
 // ../Encryption/dist/index.js
-import { createCipheriv, createDecipheriv, createHmac as createHmac3, randomBytes, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import { createCipheriv, createDecipheriv, createHmac as createHmac5, randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual5 } from "crypto";
 import { readFile as readFile2, writeFile as writeFile4 } from "fs/promises";
 var EncryptionFailure = class extends Error {
   kind = "Server";
@@ -13541,7 +14051,7 @@ var cipherSpec = (cipher) => Object.hasOwn(CIPHERS, cipher.toLowerCase()) ? CIPH
 function equals2(known, user) {
   const a = Buffer.from(known);
   const b = Buffer.from(user);
-  return a.length === b.length && timingSafeEqual3(a, b);
+  return a.length === b.length && timingSafeEqual5(a, b);
 }
 function parseKey(key) {
   if (typeof key !== "string" || key === "") throw new MissingAppKeyError();
@@ -13565,13 +14075,13 @@ var Encrypter2 = class _Encrypter {
   static generateKey(cipher = "aes-256-gcm") {
     const spec = cipherSpec(cipher);
     if (spec === void 0) throw new UnsupportedCipherError();
-    return new Uint8Array(randomBytes(spec.size));
+    return new Uint8Array(randomBytes3(spec.size));
   }
   encrypt(value2, serialize3 = true) {
     const plain2 = serialize3 ? JSON.stringify(value2) : value2;
     if (typeof plain2 !== "string") throw new EncryptError("Could not encrypt the data.");
     const spec = CIPHERS[this.#cipher];
-    const ivBytes = randomBytes(spec.ivLength);
+    const ivBytes = randomBytes3(spec.ivLength);
     let encrypted;
     let tagBytes;
     try {
@@ -13637,7 +14147,7 @@ var Encrypter2 = class _Encrypter {
     return this;
   }
   #hash(iv, value2, key) {
-    return createHmac3("sha256", key).update(iv + value2).digest("hex");
+    return createHmac5("sha256", key).update(iv + value2).digest("hex");
   }
   #decryptWith(key, iv, value2, tag) {
     try {
@@ -13717,8 +14227,8 @@ function decrypt(payload, unserialize = true) {
   return inject(Encrypter).decrypt(payload, unserialize);
 }
 function previousKeys(value2) {
-  const list5 = Array.isArray(value2) ? value2 : typeof value2 === "string" ? value2.split(",") : [];
-  return list5.map((key) => String(key).trim()).filter((key) => key !== "");
+  const list6 = Array.isArray(value2) ? value2 : typeof value2 === "string" ? value2.split(",") : [];
+  return list6.map((key) => String(key).trim()).filter((key) => key !== "");
 }
 var EncryptionServiceProvider = class extends ServiceProvider {
   register() {
@@ -13921,9 +14431,9 @@ var Dispatcher2 = class {
       throw new InvalidListenerError(label);
     }
     for (const event2 of Array.isArray(events) ? events : [events]) {
-      const list5 = this.listeners.get(event2) ?? [];
-      list5.push(listener);
-      this.listeners.set(event2, list5);
+      const list6 = this.listeners.get(event2) ?? [];
+      list6.push(listener);
+      this.listeners.set(event2, list6);
     }
   }
   hasListeners(event2) {
@@ -13935,12 +14445,12 @@ var Dispatcher2 = class {
   }
   /** Laravel's getRawListeners(): each event's listeners as registered (closures, classes, [class, method]). A copy. */
   getRawListeners() {
-    return new Map([...this.listeners].map(([event2, list5]) => [event2, [...list5]]));
+    return new Map([...this.listeners].map(([event2, list6]) => [event2, [...list6]]));
   }
   /** Introspection for the event:list command. Not part of the EventDispatcher contract. */
   registeredEvents() {
     const rows = [];
-    for (const [key, list5] of this.listeners) rows.push({ event: nameOf(key), listeners: list5.length });
+    for (const [key, list6] of this.listeners) rows.push({ event: nameOf(key), listeners: list6.length });
     return rows.sort((a, b) => a.event.localeCompare(b.event));
   }
   subscribe(subscriber) {
@@ -13984,8 +14494,8 @@ var Dispatcher2 = class {
     const exact = [...this.listeners.get(key) ?? []];
     const wildcardLists = typeof key === "string" ? this.wildcardPatternsFor(key).map((pattern) => [...this.listeners.get(pattern) ?? []]) : [];
     for (const listener of exact) yield { listener, wildcard: false };
-    for (const list5 of wildcardLists) {
-      for (const listener of list5) yield { listener, wildcard: true };
+    for (const list6 of wildcardLists) {
+      for (const listener of list6) yield { listener, wildcard: true };
     }
   }
   wildcardPatternsFor(event2) {
@@ -14084,6 +14594,8 @@ import {
   PutObjectCommand
 } from "@aws-sdk/client-s3";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
+import { copy, del, head, list as list4, put } from "@vercel/blob";
+import { posix as posix2 } from "path";
 import { lstat, mkdir as mkdir23, symlink, unlink } from "fs/promises";
 import { dirname as dirname23, relative as relative4 } from "path";
 var PathTraversalError = class extends Error {
@@ -14209,6 +14721,9 @@ function joinDiskPath(directory, name) {
 function uniqueFileName(extension) {
   return /^[a-z0-9]+$/i.test(extension) ? `${Str.random(40)}.${extension}` : Str.random(40);
 }
+function encodeKey(key) {
+  return key.split("/").map((segment) => encodeURIComponent(segment).replace(/[!'()*]/g, (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`)).join("/");
+}
 var FILE_MODE = { public: 420, private: 384 };
 var DIR_MODE = { public: 493, private: 448 };
 var LocalFilesystem = class {
@@ -14369,9 +14884,6 @@ var LocalFilesystem = class {
     await chmod(full, mode);
   }
 };
-function encodeKey(key) {
-  return key.split("/").map((segment) => encodeURIComponent(segment).replace(/[!'()*]/g, (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`)).join("/");
-}
 var isNotFound = (error) => {
   const name = error.name;
   const status = error.$metadata?.httpStatusCode;
@@ -14605,6 +15117,176 @@ var S3Filesystem = class {
     return { objects, prefixes: [...dirs] };
   }
 };
+var asBody = (body) => body instanceof Uint8Array && !Buffer.isBuffer(body) ? Buffer.from(body.buffer, body.byteOffset, body.byteLength) : body;
+function vercelBlobClient(token2) {
+  return {
+    put: (pathname, body, options) => put(pathname, asBody(body), { ...options, token: token2 }),
+    head: (pathname) => head(pathname, { token: token2 }),
+    del: (pathnames) => del(pathnames, { token: token2 }),
+    list: (options) => list4({ ...options, token: token2 }),
+    copy: (from, to, options) => copy(from, to, { ...options, token: token2 }),
+    fetch: (url2) => fetch(url2)
+  };
+}
+function blobStoreUrl(token2) {
+  const match = /^vercel_blob_rw_([A-Za-z0-9]+)_/.exec(token2 ?? "");
+  return match === null ? void 0 : `https://${match[1].toLowerCase()}.public.blob.vercel-storage.com`;
+}
+var CREATE = { access: "public", addRandomSuffix: false, allowOverwrite: true };
+var isNotFound2 = (error) => error.name === "BlobNotFoundError";
+var VercelBlobFilesystem = class {
+  constructor(client, config2) {
+    this.client = client;
+    this.config = config2;
+    if (config2.visibility === "private") throw new UnsupportedOperationError("visibility", "Vercel Blob disks are public");
+    this.root = (config2.root ?? "").replace(/^\/+|\/+$/g, "");
+  }
+  client;
+  config;
+  root;
+  /** The pathname in the store: the disk's root, then the path. */
+  key(path) {
+    return joinDiskPath(this.root, path.replace(/^\/+/, ""));
+  }
+  /** A store pathname back to the disk's path. */
+  unroot(pathname) {
+    return this.root === "" ? pathname : pathname.slice(this.root.length + 1);
+  }
+  async head(path) {
+    try {
+      return await this.client.head(this.key(path));
+    } catch (error) {
+      if (isNotFound2(error)) throw new FileNotFoundError(path);
+      throw error;
+    }
+  }
+  async exists(path) {
+    try {
+      await this.head(path);
+      return true;
+    } catch (error) {
+      if (error instanceof FileNotFoundError) return false;
+      throw error;
+    }
+  }
+  async missing(path) {
+    return !await this.exists(path);
+  }
+  async read(path) {
+    const response2 = await this.client.fetch((await this.head(path)).url);
+    if (response2.status === 404) throw new FileNotFoundError(path);
+    if (!response2.ok) throw new Error(`Vercel Blob answered ${response2.status} reading ${path}`);
+    return response2;
+  }
+  async get(path) {
+    return (await this.read(path)).text();
+  }
+  async getBytes(path) {
+    return new Uint8Array(await (await this.read(path)).arrayBuffer());
+  }
+  async readStream(path) {
+    const body = (await this.read(path)).body;
+    return body ?? new ReadableStream({ start: (controller) => controller.close() });
+  }
+  async put(path, contents, options) {
+    await this.store(path, contents, options?.mimeType ?? mimeFromExtension(posix2.extname(path)), options);
+    return true;
+  }
+  async putFile(directory, file, options) {
+    return this.putFileAs(directory, file, uniqueFileName(file.extension()), options);
+  }
+  /** Sends the upload's own type (its extension()), as the s3 disk does, never the type the client claimed. */
+  async putFileAs(directory, file, name, options) {
+    const path = joinDiskPath(directory, name);
+    await this.store(path, new Uint8Array(await file.arrayBuffer()), options?.mimeType ?? mimeFromExtension(file.extension()), options);
+    return path;
+  }
+  async store(path, body, contentType, options) {
+    if (options?.visibility === "private") throw new UnsupportedOperationError("put", "Vercel Blob disks are public");
+    await this.client.put(this.key(path), body, { ...CREATE, ...contentType === void 0 ? {} : { contentType } });
+  }
+  async delete(paths) {
+    const list23 = Array.isArray(paths) ? paths : [paths];
+    if (list23.length > 0) await this.client.del(list23.map((path) => this.key(path)));
+    return true;
+  }
+  async copy(from, to) {
+    try {
+      await this.client.copy(this.key(from), this.key(to), CREATE);
+    } catch (error) {
+      if (isNotFound2(error)) throw new FileNotFoundError(from);
+      throw error;
+    }
+    return true;
+  }
+  async move(from, to) {
+    await this.copy(from, to);
+    await this.delete(from);
+    return true;
+  }
+  async size(path) {
+    return (await this.head(path)).size;
+  }
+  async lastModified(path) {
+    return new Date((await this.head(path)).uploadedAt);
+  }
+  async mimeType(path) {
+    return (await this.head(path)).contentType || void 0;
+  }
+  url(path) {
+    const base = this.config.url ?? blobStoreUrl(this.config.token);
+    if (base === void 0) throw new UnsupportedOperationError("url", "set the disk's token (BLOB_READ_WRITE_TOKEN) or its url");
+    return `${base.replace(/\/+$/, "")}/${encodeKey(this.key(path))}`;
+  }
+  /** A public store's files need no signature: the public URL. */
+  async temporaryUrl(path, _expiresAt) {
+    return this.url(path);
+  }
+  async files(directory = "", recursive = false) {
+    const { blobs } = await this.list(directory, recursive);
+    return blobs.map((pathname) => this.unroot(pathname)).sort();
+  }
+  async directories(directory = "", recursive = false) {
+    if (!recursive) return (await this.list(directory, false)).folders.map((folder) => this.unroot(folder.replace(/\/+$/, ""))).sort();
+    const found = /* @__PURE__ */ new Set();
+    const start3 = this.key(directory).replace(/\/+$/, "");
+    for (const pathname of (await this.list(directory, true)).blobs) {
+      const parts = pathname.split("/").slice(0, -1);
+      for (let i = 1; i <= parts.length; i++) {
+        const folder = parts.slice(0, i).join("/");
+        if (folder.length > start3.length && (start3 === "" || folder.startsWith(`${start3}/`))) found.add(this.unroot(folder));
+      }
+    }
+    return [...found].sort();
+  }
+  /** Blob folders exist through their files, so there's nothing to create. */
+  async makeDirectory(_path) {
+    return true;
+  }
+  async deleteDirectory(path) {
+    const { blobs } = await this.list(path, true);
+    for (let i = 0; i < blobs.length; i += 1e3) await this.client.del(blobs.slice(i, i + 1e3));
+    return true;
+  }
+  path(_path) {
+    throw new UnsupportedOperationError("path", "vercel-blob disks have no local filesystem path");
+  }
+  /** Every page of a listing: the store's pathnames, and in folded mode its folders (`prefix/name/`). */
+  async list(directory, recursive) {
+    const base = this.key(directory).replace(/\/+$/, "");
+    const prefix = base === "" ? void 0 : `${base}/`;
+    const blobs = [];
+    const folders = [];
+    let cursor;
+    do {
+      const page = await this.client.list({ prefix, cursor, mode: recursive ? "expanded" : "folded" });
+      blobs.push(...page.blobs.map((blob) => blob.pathname));
+      folders.push(...page.folders ?? []);
+      cursor = page.hasMore ? page.cursor : void 0;
+    } while (cursor !== void 0);
+    return { blobs, folders };
+  }
+};
 var FilesystemManager2 = class {
   constructor(container) {
     this.container = container;
@@ -14617,6 +15299,15 @@ var FilesystemManager2 = class {
       })
     );
     this.drivers.set("s3", (config2) => new S3Filesystem(this.buildS3Client(config2), this.s3Config(config2)));
+    this.drivers.set("vercel-blob", (config2) => {
+      const token2 = config2.token ?? process.env.BLOB_READ_WRITE_TOKEN;
+      return new VercelBlobFilesystem(vercelBlobClient(token2), {
+        token: token2,
+        url: config2.url,
+        root: config2.root,
+        visibility: config2.visibility
+      });
+    });
   }
   container;
   disks = /* @__PURE__ */ new Map();
@@ -14980,11 +15671,11 @@ var HashingServiceProvider = class extends ServiceProvider {
 import { existsSync as existsSync7, readdirSync as readdirSync5 } from "fs";
 import { join as join11, relative as relative5, sep as sep4 } from "path";
 import { createHash as createHash7 } from "crypto";
-import { existsSync as existsSync23, readFileSync } from "fs";
+import { existsSync as existsSync24, readFileSync } from "fs";
 import { spawn as spawn2 } from "child_process";
 import { existsSync as existsSync33 } from "fs";
 import { mkdir as mkdir5, writeFile as writeFile6 } from "fs/promises";
-import { dirname as dirname5, isAbsolute as isAbsolute2, join as join24, relative as relative22 } from "path";
+import { dirname as dirname5, isAbsolute as isAbsolute2, join as join24, relative as relative23 } from "path";
 import { existsSync as existsSync43, readFileSync as readFileSync2 } from "fs";
 var Header = {
   INERTIA: "X-Inertia",
@@ -15862,7 +16553,7 @@ var InertiaMiddleware = class {
     if (typeof assetUrl === "string" && assetUrl !== "") return md5(assetUrl);
     const app2 = this.container.make(Application);
     const manifest = app2.publicPath("build/manifest.json");
-    return existsSync23(manifest) ? md5(readFileSync(manifest)) : null;
+    return existsSync24(manifest) ? md5(readFileSync(manifest)) : null;
   }
   /** Props shared with every page. Override and spread `await super.share(request)` into your own. */
   async share(request2) {
@@ -15918,8 +16609,8 @@ var InertiaMiddleware = class {
         bag,
         Object.fromEntries(
           Object.entries(fields ?? {}).map(([field, messages]) => {
-            const list5 = Array.isArray(messages) ? messages.map(String) : [String(messages)];
-            return [field, this.withAllErrors ? list5 : list5[0] ?? ""];
+            const list6 = Array.isArray(messages) ? messages.map(String) : [String(messages)];
+            return [field, this.withAllErrors ? list6 : list6[0] ?? ""];
           })
         )
       ])
@@ -16143,7 +16834,7 @@ export class {{ class }} extends InertiaMiddleware {
   }
 }
 `;
-var DEFAULT_EXCEPT_ROUTES = ["live.*"];
+var DEFAULT_EXCEPT_ROUTES = ["live.*", "vercel.*"];
 async function loadPageTypes() {
   const specifier = "@orieljs/vite/types";
   try {
@@ -16172,7 +16863,7 @@ function registerInertiaCommands(kernel, app2, gateway, options = {}) {
       await writeFile6(output, renderRoutesModule(table));
       await mkdir5(dirname5(server), { recursive: true });
       await writeFile6(server, renderServerRouteTypes(routeTable(app2.make(Router).getRoutes())));
-      this.info(`Route types for ${Object.keys(table).length} named routes written to ${relative22(app2.basePath(), output)}.`);
+      this.info(`Route types for ${Object.keys(table).length} named routes written to ${relative23(app2.basePath(), output)}.`);
       return 0;
     }
   ).purpose("Generate the route table and route name types for the frontend");
@@ -16185,7 +16876,7 @@ function registerInertiaCommands(kernel, app2, gateway, options = {}) {
     const output = absolute(optionText(this.option("output")) ?? config2("inertia.types.pages", "resources/js/oriel/pages.d.ts"));
     const result = await module.generatePageTypes({ root: app2.basePath(), output });
     for (const warning of result.warnings) this.warn(warning);
-    this.info(`Page types for ${result.pages} pages written to ${relative22(app2.basePath(), result.output)}.`);
+    this.info(`Page types for ${result.pages} pages written to ${relative23(app2.basePath(), result.output)}.`);
     return 0;
   }).purpose("Generate TypeScript types for the Inertia page props");
   kernel.command("inertia:middleware {name=HandleInertiaRequests : The middleware class name} {--force : Overwrite an existing file}", async function() {
@@ -16196,12 +16887,12 @@ function registerInertiaCommands(kernel, app2, gateway, options = {}) {
     }
     const file = app2.appPath(join24("Http", "Middleware", `${name}.ts`));
     if (existsSync33(file) && this.option("force") !== true) {
-      this.error(`Middleware [${relative22(app2.basePath(), file)}] already exists.`);
+      this.error(`Middleware [${relative23(app2.basePath(), file)}] already exists.`);
       return 1;
     }
     await mkdir5(dirname5(file), { recursive: true });
     await writeFile6(file, MIDDLEWARE_STUB2.replace("{{ class }}", () => name));
-    this.info(`Middleware [${relative22(app2.basePath(), file)}] created successfully.`);
+    this.info(`Middleware [${relative23(app2.basePath(), file)}] created successfully.`);
     return 0;
   }).purpose("Create a new Inertia middleware");
   kernel.command("inertia:start-ssr {--runtime= : The runtime that runs the SSR bundle (node or bun)}", async function() {
@@ -16400,7 +17091,7 @@ var InertiaServiceProvider = class extends ServiceProvider {
 
 // ../Log/dist/index.js
 import pino2 from "pino";
-import { createWriteStream as createWriteStream2, mkdirSync as mkdirSync2, readdirSync as readdirSync6, rmSync } from "fs";
+import { createWriteStream as createWriteStream2, mkdirSync as mkdirSync3, readdirSync as readdirSync6, rmSync } from "fs";
 import { basename as basename2, dirname as dirname6, extname as extname3, join as join12 } from "path";
 import { Writable } from "stream";
 import "pino";
@@ -16529,7 +17220,7 @@ var DailyRotatingStream = class extends Writable {
     this.now = now5;
     this.dir = dirname6(basePath);
     this.stem = basename2(basePath, extname3(basePath) || void 0);
-    mkdirSync2(this.dir, { recursive: true });
+    mkdirSync3(this.dir, { recursive: true });
   }
   days;
   now;
@@ -16940,8 +17631,8 @@ function normalizeAddress(recipient) {
 }
 function normalizeAddresses(recipients) {
   if (recipients === void 0) return [];
-  const list5 = Array.isArray(recipients) ? recipients : [recipients];
-  return list5.map(normalizeAddress);
+  const list6 = Array.isArray(recipients) ? recipients : [recipients];
+  return list6.map(normalizeAddress);
 }
 function formatAddress(address) {
   return address.name ? `${address.name} <${address.address}>` : address.address;
@@ -17242,7 +17933,7 @@ function copyShouldQueueFields(target, source) {
 }
 function recipientsHash(to = [], cc = [], bcc = []) {
   if (to.length + cc.length + bcc.length === 0) return void 0;
-  const addresses = (list5) => list5.map((recipient) => recipient.address);
+  const addresses = (list6) => list6.map((recipient) => recipient.address);
   const recipients = JSON.stringify({ to: addresses(to), cc: addresses(cc), bcc: addresses(bcc) });
   return createHash8("sha1").update(recipients).digest("hex");
 }
@@ -17963,9 +18654,9 @@ function isQueueableNotification(notification) {
 }
 function forNotifiable(notification) {
   if (notification.id) return notification;
-  const copy = Object.assign(Object.create(Object.getPrototypeOf(notification)), notification);
-  copy.id = randomUUID23();
-  return copy;
+  const copy2 = Object.assign(Object.create(Object.getPrototypeOf(notification)), notification);
+  copy2.id = randomUUID23();
+  return copy2;
 }
 function toNotifiableList(notifiables) {
   if (Array.isArray(notifiables)) return notifiables;
@@ -17996,12 +18687,12 @@ var Dispatcher3 = class {
     return channel;
   }
   async send(notifiables, notification) {
-    const list5 = toNotifiableList(notifiables);
-    if (list5.length === 0) return;
+    const list6 = toNotifiableList(notifiables);
+    if (list6.length === 0) return;
     if (isQueueableNotification(notification)) {
       if (!this.container.bound(BusDispatcher)) throw new NotificationQueueUnavailableError();
       const bus = this.container.make(BusDispatcher);
-      for (const notifiable of list5) {
+      for (const notifiable of list6) {
         const own = forNotifiable(notification);
         for (const channel of notification.via(notifiable)) {
           await bus.dispatch(new SendQueuedNotifications([notifiable], own, [channel]));
@@ -18009,11 +18700,11 @@ var Dispatcher3 = class {
       }
       return;
     }
-    await this.sendNow(list5, notification);
+    await this.sendNow(list6, notification);
   }
   async sendNow(notifiables, notification, channels) {
-    const list5 = toNotifiableList(notifiables);
-    for (const notifiable of list5) {
+    const list6 = toNotifiableList(notifiables);
+    for (const notifiable of list6) {
       const own = forNotifiable(notification);
       const names = channels ?? notification.via(notifiable);
       for (const name of names) {
@@ -18440,7 +19131,7 @@ async function restoreValue(value2, registry2) {
 }
 function normalizeBackoff(backoff) {
   if (typeof backoff === "number") return [backoff];
-  if (typeof backoff === "string" && backoff !== "") return backoff.split(",").map((part) => Number(part.trim()));
+  if (typeof backoff === "string" && backoff !== "") return backoff.split(",").map((part2) => Number(part2.trim()));
   if (Array.isArray(backoff)) return backoff.map(Number);
   return void 0;
 }
@@ -19991,7 +20682,7 @@ function discoverJobs(directory, registry2) {
   return discoverClasses(directory, registry2, isJobClass);
 }
 var text3 = (value2) => optionalString2(value2) || void 0;
-var list4 = (value2) => Array.isArray(value2) ? value2.map(String) : text3(value2) ? [String(value2)] : [];
+var list5 = (value2) => Array.isArray(value2) ? value2.map(String) : text3(value2) ? [String(value2)] : [];
 var number2 = (value2, fallback) => {
   const parsed = Number(value2);
   return value2 === void 0 || value2 === null || value2 === "" || Number.isNaN(parsed) ? fallback : parsed;
@@ -20116,7 +20807,7 @@ function registerQueueCommands(kernel, context) {
     'queue:retry {id?* : The ID of the failed job or "all" to retry all jobs} {--queue= : Retry all of the failed jobs for the specified queue}',
     "Retry a failed queue job",
     async (out) => {
-      const ids = await retryableIds(list4(out.argument("id")), text3(out.option("queue")));
+      const ids = await retryableIds(list5(out.argument("id")), text3(out.option("queue")));
       if (ids.length === 0) {
         out.info("No retryable jobs found.");
         return 0;
@@ -20229,7 +20920,7 @@ var QueueServiceProvider = class extends ServiceProvider {
 };
 
 // ../Routing/dist/index.js
-import { createHmac as createHmac4, timingSafeEqual as timingSafeEqual4 } from "crypto";
+import { createHmac as createHmac6, timingSafeEqual as timingSafeEqual6 } from "crypto";
 import { pathToFileURL as pathToFileURL7 } from "url";
 import { createHash as createHash10 } from "crypto";
 import { createHash as createHash23 } from "crypto";
@@ -20690,7 +21381,7 @@ async function dispatchRoute(router, request2, container) {
 }
 var ALL_VERBS = ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
 function mergeGroup(parent, child) {
-  const prefix = [parent.prefix, child.prefix].map((part) => (part ?? "").replace(/^\/+|\/+$/g, "")).filter((part) => part !== "").join("/");
+  const prefix = [parent.prefix, child.prefix].map((part2) => (part2 ?? "").replace(/^\/+|\/+$/g, "")).filter((part2) => part2 !== "").join("/");
   const merged = {
     middleware: [...parent.middleware ?? [], ...child.middleware ?? []]
   };
@@ -20845,7 +21536,7 @@ var BaseRouter = class {
     }
     const prefix = (group.prefix ?? "").replace(/^\/+|\/+$/g, "");
     const path = uri.replace(/^\/+|\/+$/g, "");
-    const route2 = new RouteDefinition(verbs, [prefix, path].filter((part) => part !== "").join("/"), action, {
+    const route2 = new RouteDefinition(verbs, [prefix, path].filter((part2) => part2 !== "").join("/"), action, {
       ...group.as !== void 0 && { namePrefix: group.as },
       ...group.middleware !== void 0 && { middleware: group.middleware },
       ...group.controller !== void 0 && { controller: group.controller },
@@ -20994,20 +21685,20 @@ var BaseRouter = class {
     return this;
   }
   pushMiddlewareToGroup(group, middleware) {
-    const list5 = this.#groups[group] ??= [];
-    if (!list5.includes(middleware)) list5.push(middleware);
+    const list6 = this.#groups[group] ??= [];
+    if (!list6.includes(middleware)) list6.push(middleware);
     return this;
   }
   prependMiddlewareToGroup(group, middleware) {
-    const list5 = this.#groups[group] ??= [];
-    if (!list5.includes(middleware)) list5.unshift(middleware);
+    const list6 = this.#groups[group] ??= [];
+    if (!list6.includes(middleware)) list6.unshift(middleware);
     return this;
   }
   hasMiddlewareGroup(name) {
     return Object.hasOwn(this.#groups, name);
   }
   getMiddlewareGroups() {
-    return Object.fromEntries(Object.entries(this.#groups).map(([name, list5]) => [name, [...list5]]));
+    return Object.fromEntries(Object.entries(this.#groups).map(([name, list6]) => [name, [...list6]]));
   }
   /** Every route, in registration order. */
   getRoutes() {
@@ -21070,12 +21761,12 @@ function routeKey(value2, field) {
   return typeof model.getRouteKey === "function" ? model.getRouteKey() : value2;
 }
 function sign(url2, key) {
-  return createHmac4("sha256", key).update(url2).digest("hex");
+  return createHmac6("sha256", key).update(url2).digest("hex");
 }
 function safeEquals(expected, given) {
   const a = Buffer.from(expected);
   const b = Buffer.from(given);
-  return a.length === b.length && timingSafeEqual4(a, b);
+  return a.length === b.length && timingSafeEqual6(a, b);
 }
 function availableAt(expiration) {
   return expiration instanceof Date ? Math.floor(expiration.getTime() / 1e3) : Math.floor(Date.now() / 1e3) + expiration;
@@ -21306,9 +21997,9 @@ function withHeaders2(response2, headers) {
     for (const [name, value2] of Object.entries(headers)) response2.headers.set(name, value2);
     return response2;
   } catch {
-    const copy = new Headers(response2.headers);
-    for (const [name, value2] of Object.entries(headers)) copy.set(name, value2);
-    return new Response(response2.body, { status: response2.status, statusText: response2.statusText, headers: copy });
+    const copy2 = new Headers(response2.headers);
+    for (const [name, value2] of Object.entries(headers)) copy2.set(name, value2);
+    return new Response(response2.body, { status: response2.status, statusText: response2.statusText, headers: copy2 });
   }
 }
 var ThrottleRequests = class {
@@ -21446,8 +22137,8 @@ var RoutingServiceProvider = class extends ServiceProvider {
 import { mkdir as mkdir6, readdir as readdir3, readFile as readFile4, rename as rename3, rm as rm3, stat as stat3, writeFile as writeFile7 } from "fs/promises";
 import { join as join14 } from "path";
 import { Redis as Redis3 } from "ioredis";
-import { randomInt } from "crypto";
-import { timingSafeEqual as timingSafeEqual5 } from "crypto";
+import { randomInt as randomInt3 } from "crypto";
+import { timingSafeEqual as timingSafeEqual7 } from "crypto";
 var unique = (values) => [...new Set(values)];
 var Store = class {
   #id = "";
@@ -21515,8 +22206,8 @@ var Store = class {
     for (const [name, item] of Object.entries(values)) Arr.set(this.#attributes, name, item);
   }
   push(key, value2) {
-    const list5 = this.get(key, []);
-    this.put(key, [...Array.isArray(list5) ? list5 : [list5], value2]);
+    const list6 = this.get(key, []);
+    this.put(key, [...Array.isArray(list6) ? list6 : [list6], value2]);
   }
   increment(key, amount = 1) {
     const value2 = Number(this.get(key, 0)) + amount;
@@ -22004,7 +22695,7 @@ var StartSession = class {
   /** Laravel's lottery: on average lottery[0] requests out of lottery[1] clean up expired sessions. */
   async #collectGarbage(session2, config2) {
     const [chances, outOf] = config2.lottery ?? [2, 100];
-    if (session2.getHandler !== void 0 && randomInt(1, outOf + 1) <= chances) {
+    if (session2.getHandler !== void 0 && randomInt3(1, outOf + 1) <= chances) {
       await session2.getHandler().gc((config2.lifetime ?? 120) * 60);
     }
   }
@@ -22016,7 +22707,7 @@ var StartSession = class {
 function equals3(known, user) {
   const a = Buffer.from(known);
   const b = Buffer.from(user);
-  return a.length === b.length && timingSafeEqual5(a, b);
+  return a.length === b.length && timingSafeEqual7(a, b);
 }
 var VerifyCsrfToken = class {
   /** URIs (wildcards allowed) excluded from the check, in addition to config('http.csrf_except'). */
@@ -22190,7 +22881,7 @@ var ValidationErrorImpl = class extends Error {
 var ValidationException = class _ValidationException extends ValidationErrorImpl {
   /** Messages per field, each a string or a list. */
   static withMessages(messages) {
-    const errors2 = Object.fromEntries(Object.entries(messages).map(([field, list5]) => [field, typeof list5 === "string" ? [list5] : [...list5]]));
+    const errors2 = Object.fromEntries(Object.entries(messages).map(([field, list6]) => [field, typeof list6 === "string" ? [list6] : [...list6]]));
     return new _ValidationException(errors2);
   }
   constructor(errors2, errorBag = "default", redirectTo2) {
@@ -23442,11 +24133,11 @@ var urlPatterns = /* @__PURE__ */ new Map();
 function isUrl(value2, protocols) {
   if (typeof value2 !== "string") return false;
   if (protocols.length === 0) return URL_RE.test(value2);
-  const list5 = protocols.join("|");
-  let pattern = urlPatterns.get(list5);
+  const list6 = protocols.join("|");
+  let pattern = urlPatterns.get(list6);
   if (pattern === void 0) {
     try {
-      pattern = urlPattern(list5);
+      pattern = urlPattern(list6);
     } catch (error) {
       throw new InvalidRuleParameterError(
         "url",
@@ -23454,7 +24145,7 @@ function isUrl(value2, protocols) {
         error instanceof Error ? error.message : String(error)
       );
     }
-    urlPatterns.set(list5, pattern);
+    urlPatterns.set(list6, pattern);
   }
   return pattern.test(value2);
 }
@@ -23880,11 +24571,11 @@ var sizeRules = {
   in: { validate: (ctx) => isListed(ctx.value, ctx.parameters, ctx.ruleNames), messageKey: () => "in" },
   not_in: { validate: (ctx) => !isListed(ctx.value, ctx.parameters, ctx.ruleNames), messageKey: () => "not_in" }
 };
-function isListed(value2, list5, ruleNames) {
+function isListed(value2, list6, ruleNames) {
   if (Array.isArray(value2) && ruleNames.includes("array")) {
-    return value2.every((item) => (typeof item !== "object" || item === null) && list5.includes(String(item)));
+    return value2.every((item) => (typeof item !== "object" || item === null) && list6.includes(String(item)));
   }
-  return (typeof value2 !== "object" || value2 === null) && list5.includes(String(value2));
+  return (typeof value2 !== "object" || value2 === null) && list6.includes(String(value2));
 }
 var REGIONS = ["Africa", "America", "Antarctica", "Arctic", "Asia", "Atlantic", "Australia", "Europe", "Indian", "Pacific"];
 var ZONE_RE = /^[A-Z][A-Za-z_-]*(?:\/[A-Z][A-Za-z0-9_+-]*)+$/;
@@ -24033,13 +24724,13 @@ var PasswordRule = class _PasswordRule {
     if (this.#numbers && !/\p{N}/u.test(value2)) say("password.numbers");
   }
   #copy() {
-    const copy = new _PasswordRule(this.#min);
-    copy.#max = this.#max;
-    copy.#letters = this.#letters;
-    copy.#mixedCase = this.#mixedCase;
-    copy.#numbers = this.#numbers;
-    copy.#symbols = this.#symbols;
-    return copy;
+    const copy2 = new _PasswordRule(this.#min);
+    copy2.#max = this.#max;
+    copy2.#letters = this.#letters;
+    copy2.#mixedCase = this.#mixedCase;
+    copy2.#numbers = this.#numbers;
+    copy2.#symbols = this.#symbols;
+    return copy2;
   }
 };
 var BuiltinRuleObject = class {
@@ -24344,17 +25035,17 @@ function buildNested(flat) {
   const created = /* @__PURE__ */ new Set([root]);
   for (const [path, value2] of Object.entries(flat)) {
     const parts = path.split(".");
-    if (parts.some((part) => UNSAFE_KEYS.has(part))) continue;
+    if (parts.some((part2) => UNSAFE_KEYS.has(part2))) continue;
     let current = root;
-    for (const part of parts.slice(0, -1)) {
-      const existing = Object.hasOwn(current, part) ? current[part] : void 0;
+    for (const part2 of parts.slice(0, -1)) {
+      const existing = Object.hasOwn(current, part2) ? current[part2] : void 0;
       if (typeof existing === "object" && existing !== null && created.has(existing)) {
         current = existing;
         continue;
       }
       const container = cloneContainer(existing);
       created.add(container);
-      current[part] = container;
+      current[part2] = container;
       current = container;
     }
     current[parts.at(-1)] = value2;
@@ -24383,16 +25074,16 @@ function withoutPaths(data, paths) {
     const parts = path.split(".");
     const leaf = parts.pop();
     let node = root;
-    for (const part of parts) {
-      const child = Object.hasOwn(node, part) ? node[part] : void 0;
+    for (const part2 of parts) {
+      const child = Object.hasOwn(node, part2) ? node[part2] : void 0;
       if (!isPlainContainer(child)) {
         node = void 0;
         break;
       }
-      const copy = copies.has(child) ? child : Array.isArray(child) ? [...child] : { ...child };
-      copies.add(copy);
-      node[part] = copy;
-      node = copy;
+      const copy2 = copies.has(child) ? child : Array.isArray(child) ? [...child] : { ...child };
+      copies.add(copy2);
+      node[part2] = copy2;
+      node = copy2;
     }
     if (node === void 0 || !Object.hasOwn(node, leaf)) continue;
     if (Array.isArray(node)) node[Number(leaf)] = EXCLUDED;
@@ -24676,6 +25367,52 @@ var ValidationServiceProvider = class extends ServiceProvider {
 import { existsSync as existsSync9, readdirSync as readdirSync8, readFileSync as readFileSync3, realpathSync, statSync as statSync4 } from "fs";
 import { cp, mkdir as mkdir7, rm as rm4, writeFile as writeFile8 } from "fs/promises";
 import { basename as basename3, dirname as dirname7, join as join15, relative as relative6, resolve as resolve4 } from "path";
+import { CronExpressionParser as CronExpressionParser2 } from "cron-parser";
+import { timingSafeEqual as timingSafeEqual8 } from "crypto";
+import { CronExpressionParser as CronExpressionParser3 } from "cron-parser";
+var SCHEDULE_PATH = "/_oriel/schedule";
+var DEFAULT_CRON = "0 3 * * *";
+var LAST_RUN = "oriel:vercel:schedule:last";
+var LOCK = "oriel:vercel:schedule";
+var json2 = (body, status = 200) => Response.json(body, { status, headers: { "cache-control": "no-store" } });
+function authorized(header, secret) {
+  const expected = Buffer.from(`Bearer ${secret}`);
+  const given = Buffer.from(header ?? "");
+  return given.length === expected.length && timingSafeEqual8(given, expected);
+}
+function previousTrigger(expression, now5) {
+  const parsed = CronExpressionParser3.parse(expression, { currentDate: new Date(now5.getTime() + 6e4), tz: "UTC" });
+  parsed.prev();
+  return parsed.prev().toDate();
+}
+async function runVercelSchedule(authorization, options = {}) {
+  const secret = process.env.CRON_SECRET;
+  if (!secret) return new Response("Not Found", { status: 404 });
+  if (!authorized(authorization, secret)) return json2({ error: "Unauthorized" }, 401);
+  const cache2 = inject(CacheManager);
+  const lock = cache2.lock(LOCK, 900);
+  if (!await lock.get()) return json2({ ran: 0, failed: 0, skipped: "busy" });
+  try {
+    await inject(ConsoleKernel).bootstrap();
+    const now5 = options.now?.() ?? /* @__PURE__ */ new Date();
+    const last = await cache2.get(LAST_RUN);
+    const from = last === void 0 ? previousTrigger(options.trigger ?? process.env.ORIEL_VERCEL_CRON ?? DEFAULT_CRON, now5) : new Date(last);
+    const due = inject(Schedule).dueBetween(from, now5);
+    let failed = 0;
+    for (const event2 of due) {
+      try {
+        await event2.run();
+      } catch (error) {
+        failed++;
+        await inject(ExceptionHandler).report(error);
+      }
+    }
+    await cache2.forever(LAST_RUN, now5.toISOString());
+    return json2({ ran: due.length, failed }, failed > 0 ? 500 : 200);
+  } finally {
+    await lock.release();
+  }
+}
 var LAUNCHER = `// Oriel on Vercel: boots the app once per function instance and hands it each request.
 import { fileURLToPath } from 'node:url'
 
@@ -24758,8 +25495,10 @@ async function buildVercelOutput(app2, options = {}) {
   const vcConfig = { runtime: options.runtime ?? "nodejs22.x", handler: "index.mjs", launcherType: "Nodejs", shouldAddHelpers: false, supportsResponseStreaming: true };
   await writeFile8(join15(fn, ".vc-config.json"), `${JSON.stringify(vcConfig, null, 2)}
 `);
+  const { crons, cronWarnings } = await scheduleCron(app2, options.cron);
   const config2 = {
     version: 3,
+    ...crons === void 0 ? {} : { crons },
     routes: [
       // The built assets' names change with their content, so they're cached for a year, as serve() does.
       { src: "^/build/assets/(.*)$", headers: { "cache-control": "public, max-age=31536000, immutable" }, continue: true },
@@ -24778,7 +25517,26 @@ async function buildVercelOutput(app2, options = {}) {
   const warnings = platform === "linux" ? [] : [
     `Built on ${PLATFORM_NAMES[platform] ?? platform}: the function's native packages (such as esbuild, which tsx needs) only run on this kind of machine, and Vercel's functions run on Linux. Let Vercel run the build, or build on Linux.`
   ];
-  return { functionBytes, staticFiles: countFiles(staticFolder), warnings };
+  return { functionBytes, staticFiles: countFiles(staticFolder), warnings: [...warnings, ...cronWarnings] };
+}
+async function scheduleCron(app2, cron) {
+  if (cron === false) return { cronWarnings: [] };
+  if (app2.bound(ConsoleKernel)) await app2.make(ConsoleKernel).bootstrap();
+  if (!app2.bound(Schedule)) return { cronWarnings: [] };
+  const schedule = app2.make(Schedule);
+  if (schedule.events().length === 0) return { cronWarnings: [] };
+  const expression = cron ?? DEFAULT_CRON;
+  const fires = CronExpressionParser2.parse(expression, { tz: "UTC" });
+  const start3 = fires.next().toDate();
+  const end = fires.next().toDate();
+  const middle = new Date((start3.getTime() + end.getTime()) / 2);
+  const later = new Set(schedule.dueBetween(middle, end));
+  const often = schedule.dueBetween(start3, middle).filter((event2) => later.has(event2));
+  const plan = cron === void 0 ? " (once a day on Vercel's Hobby plan)" : "";
+  return {
+    crons: [{ path: SCHEDULE_PATH, schedule: expression }],
+    cronWarnings: often.map((event2) => `"${event2.getSummaryForDisplay()}" (${event2.expression}) is due more often than the cron "${expression}", so it runs once per trigger${plan}.`)
+  };
 }
 async function copyDependencies(base, fn) {
   const manifest = JSON.parse(readFileSync3(join15(base, "package.json"), "utf8"));
@@ -24823,11 +25581,19 @@ var megabytes = (bytes) => `${(bytes / 1024 / 1024).toFixed(1)} MB`;
 var megabytes2 = (bytes) => `${(bytes / 1024 / 1024).toFixed(1)} MB`;
 var VercelServiceProvider = class extends ServiceProvider {
   boot() {
+    if (this.app.bound(Router)) {
+      this.app.make(Router).get(SCHEDULE_PATH, () => {
+        const request2 = inject(HttpRequest);
+        return runVercelSchedule(request2.header("authorization"), { trigger: request2.header("x-vercel-cron-schedule") });
+      }).name("vercel.schedule");
+    }
     if (!this.app.bound(ConsoleKernel)) return;
     const app2 = this.app;
-    this.app.make(ConsoleKernel).command("vercel:build", async function() {
+    this.app.make(ConsoleKernel).command("vercel:build {--cron= : When Vercel calls the scheduler, as a cron expression (UTC), or false for never}", async function() {
       try {
-        const { staticFiles, functionBytes, warnings } = await buildVercelOutput(app2);
+        const option = this.option("cron");
+        const cron = typeof option === "string" && option !== "" ? option === "false" ? false : option : void 0;
+        const { staticFiles, functionBytes, warnings } = await buildVercelOutput(app2, { cron });
         const files3 = staticFiles === 1 ? "1 static file" : `${staticFiles} static files`;
         this.info(`Wrote .vercel/output: ${files3}, a function of ${megabytes2(functionBytes)}.`);
         for (const warning of warnings) this.warn(warning);
@@ -24851,7 +25617,7 @@ import { parse as parse2 } from "dotenv";
 var SECRET = /key|secret|password|token|credential|salt|private/i;
 var CREDENTIALS = /^[a-z][a-z0-9+.-]*:\/\/[^/?#\s]*@/i;
 var byName = (a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0;
-var posix2 = (path) => path.split(sep5).join("/");
+var posix3 = (path) => path.split(sep5).join("/");
 function commandSection(all) {
   return Object.entries(all).map(([name, command]) => {
     const signature = parseSignature(command.signature);
@@ -24893,8 +25659,8 @@ function viewSection(paths, hints, extensions, basePath) {
       const extension = extensions.find((candidate) => item.name.endsWith(`.${candidate}`));
       if (extension === void 0) continue;
       const file = join16(item.parentPath, item.name);
-      const name = prefix + posix2(relative7(root, file)).slice(0, -(extension.length + 1)).split("/").join(".");
-      if (!views.has(name)) views.set(name, posix2(relative7(basePath, file)));
+      const name = prefix + posix3(relative7(root, file)).slice(0, -(extension.length + 1)).split("/").join(".");
+      if (!views.has(name)) views.set(name, posix3(relative7(basePath, file)));
     }
   };
   for (const path of paths) collect2(path, "");
@@ -24903,7 +25669,7 @@ function viewSection(paths, hints, extensions, basePath) {
 }
 
 // ide/IdeInfoCommand.ts
-var posix3 = (path) => path.split(sep6).join("/");
+var posix4 = (path) => path.split(sep6).join("/");
 var read = (file) => existsSync11(file) ? readFileSync4(file, "utf8") : null;
 var IdeInfoCommand = class extends Command {
   signature = "ide:info {--pretty : Indent the JSON}";
@@ -24935,7 +25701,7 @@ function describe(app2, container) {
   const basePath = app2.basePath();
   const config2 = optional(ConfigRepository);
   const get = (key, fallback) => config2 ? config2.get(key, fallback) : fallback;
-  const relativeTo = (file) => posix3(relative8(basePath, file));
+  const relativeTo = (file) => posix4(relative8(basePath, file));
   const configDirectory = app2.configPath();
   const configFiles = existsSync11(configDirectory) ? readdirSync10(configDirectory).filter((file) => /\.(ts|js|mjs)$/.test(file)).map((file) => relativeTo(join17(configDirectory, file))) : [];
   const factory = optional(ViewFactory);
@@ -25369,6 +26135,7 @@ export {
   QueuedMailSender,
   RESTART_CACHE_KEY,
   RateLimiter2 as RateLimiter,
+  RecoveryCodeUsed,
   RedirectIfAuthenticated,
   RedisJob,
   RedisLock,
@@ -25395,6 +26162,7 @@ export {
   Rule,
   S3Filesystem,
   SCHEDULE_INTERRUPT_KEY,
+  SESSION_URI,
   SSR_RENDER_FAILED,
   STORAGE_LINK_SIGNATURE,
   Schedule5 as Schedule,
@@ -25436,6 +26204,7 @@ export {
   SyncJob,
   SyncQueue,
   TEMPORARY_UPLOAD_DEFAULTS,
+  TWO_FACTOR_COLUMNS_MIGRATION,
   TagsNotSupportedError,
   TemporaryFileNotFoundError,
   TemporaryUploadedFile,
@@ -25451,6 +26220,15 @@ export {
   TokenRepository,
   TrimStrings,
   TsxView,
+  TwoFactor,
+  TwoFactorAppDisabled,
+  TwoFactorAppEnabled,
+  TwoFactorAuthenticated,
+  TwoFactorChallenge,
+  TwoFactorChallenged,
+  TwoFactorCode,
+  TwoFactorFailed,
+  TwoFactorManager,
   TypeGenerator,
   UNIQUE,
   UNIQUE_LOCK,
@@ -25486,6 +26264,7 @@ export {
   ValidationServiceProvider,
   Validator,
   ValidatorImpl,
+  VercelBlobFilesystem,
   VercelServiceProvider,
   Verified,
   VerifyCsrfToken,