@orieljs/framework 0.1.0-alpha.3 → 0.1.0-alpha.4

package/dist/{chunk-I2OMKIQZ.js → chunk-SBZQ6L3Z.js}

@@ -9,7 +9,7 @@ import {
   currentContainer,
   facade,
   inject
-} from "./chunk-HU43NADT.js";
+} from "./chunk-DCI2T7WJ.js";
 import {
   Application,
   AuthFactory,
@@ -17,6 +17,7 @@ import {
   ClassRegistry,
   ConfigRepository,
   ConsoleKernel,
+  CookieJar,
   CurrentRoute,
   DatabaseManager,
   Encrypter,
@@ -27,18 +28,22 @@ import {
   HttpKernel,
   HttpRequest,
   LiveManager,
+  LogManager,
   MailManager,
   MiddlewareCallbacks,
   NotificationDispatcher,
+  PipelineFactory,
   QueueManager,
   Redirector,
+  ResponseFactory,
   Router,
   RoutingPaths,
   Session,
   UrlGenerator,
   ValidationFactory,
-  ViewFactory
-} from "./chunk-S7YC43IH.js";
+  ViewFactory,
+  token
+} from "./chunk-WSGWYXAO.js";
 
 // ../Config/dist/index.js
 import { existsSync, readFileSync } from "fs";
@@ -88,12 +93,20 @@ function env(key, defaultValue) {
   const quoted = /^(["'])(.*)\1$/s.exec(raw);
   return quoted ? quoted[2] : raw;
 }
+function singleQuoted(source) {
+  const keys = /* @__PURE__ */ new Set();
+  for (const match of source.matchAll(/^[ \t]*(?:export[ \t]+)?([\w.-]+)[ \t]*=[ \t]*'/gm)) keys.add(match[1]);
+  return keys;
+}
 function loadEnvironment(basePath) {
   const appEnv = process.env.APP_ENV;
   const specific = appEnv ? join(basePath, `.env.${appEnv}`) : void 0;
   const file = specific && existsSync(specific) ? specific : join(basePath, ".env");
   if (!existsSync(file)) return void 0;
-  for (const [key, value] of Object.entries(parse(readFileSync(file)))) {
+  const source = readFileSync(file, "utf8");
+  const literal = singleQuoted(source);
+  for (const [key, raw] of Object.entries(parse(source))) {
+    const value = literal.has(key) ? raw : raw.replace(/\$\{([A-Za-z_][A-Za-z0-9_.]*)\}/g, (match, name) => process.env[name] ?? match);
     if (process.env[key] === void 0) process.env[key] = value;
   }
   return file;
@@ -140,10 +153,11 @@ var ApplicationBuilder = class {
     return this;
   }
   withRouting(options) {
-    const abs = (p) => p === void 0 ? void 0 : isAbsolute(p) ? p : join4(this.app.basePath(), p);
+    const abs = (p) => isAbsolute(p) ? p : join4(this.app.basePath(), p);
+    const each = (p) => Array.isArray(p) ? p.map(abs) : abs(p);
     const paths = { apiPrefix: options.apiPrefix ?? "api" };
-    if (options.web !== void 0) paths.web = abs(options.web);
-    if (options.api !== void 0) paths.api = abs(options.api);
+    if (options.web !== void 0) paths.web = each(options.web);
+    if (options.api !== void 0) paths.api = each(options.api);
     if (options.console !== void 0) paths.console = abs(options.console);
     if (options.health !== void 0) paths.health = options.health;
     this.routing = paths;
@@ -323,9 +337,9 @@ var Vite = class {
     const stylesheets = uniqueTags.filter((tag) => tag.startsWith("<link"));
     const scripts = uniqueTags.filter((tag) => !tag.startsWith("<link"));
     const seen = /* @__PURE__ */ new Set();
-    const uniquePreloads = preloads.filter(([, url]) => seen.has(url) ? false : (seen.add(url), true));
-    const sorted = [...uniquePreloads.filter(([, url]) => CSS_PATH.test(url)), ...uniquePreloads.filter(([, url]) => !CSS_PATH.test(url))];
-    const preloadTags = sorted.map(([src, url, chunk2]) => this.#preloadTag(src, url, chunk2, manifest));
+    const uniquePreloads = preloads.filter(([, url2]) => seen.has(url2) ? false : (seen.add(url2), true));
+    const sorted = [...uniquePreloads.filter(([, url2]) => CSS_PATH.test(url2)), ...uniquePreloads.filter(([, url2]) => !CSS_PATH.test(url2))];
+    const preloadTags = sorted.map(([src, url2, chunk2]) => this.#preloadTag(src, url2, chunk2, manifest));
     return new ViteHtml(preloadTags.join("") + stylesheets.join("") + scripts.join(""));
   }
   /** Laravel's @viteReactRefresh: the React Refresh preamble while the dev server runs; nothing otherwise. */
@@ -410,41 +424,41 @@ var Vite = class {
     }
     return imports;
   }
-  #tagForChunk(src, url, chunk2, manifest) {
-    if (CSS_PATH.test(url)) {
-      const attributes2 = this.#parseAttributes({ rel: "stylesheet", href: url, nonce: this.#nonce ?? false, ...this.#styleAttributes(src, url, chunk2, manifest) });
+  #tagForChunk(src, url2, chunk2, manifest) {
+    if (CSS_PATH.test(url2)) {
+      const attributes2 = this.#parseAttributes({ rel: "stylesheet", href: url2, nonce: this.#nonce ?? false, ...this.#styleAttributes(src, url2, chunk2, manifest) });
       return `<link ${attributes2.join(" ")} />`;
     }
-    const attributes = this.#parseAttributes({ type: "module", src: url, nonce: this.#nonce ?? false, ...this.#scriptAttributes(src, url, chunk2, manifest) });
+    const attributes = this.#parseAttributes({ type: "module", src: url2, nonce: this.#nonce ?? false, ...this.#scriptAttributes(src, url2, chunk2, manifest) });
     return `<script ${attributes.join(" ")}></script>`;
   }
-  #preloadTag(src, url, chunk2, manifest) {
-    const css = CSS_PATH.test(url);
+  #preloadTag(src, url2, chunk2, manifest) {
+    const css = CSS_PATH.test(url2);
     let attributes = {
       rel: css ? "preload" : "modulepreload",
       as: css ? "style" : "script",
-      href: url,
+      href: url2,
       nonce: this.#nonce ?? false,
-      crossorigin: (css ? this.#styleAttributes(src, url, chunk2, manifest) : this.#scriptAttributes(src, url, chunk2, manifest)).crossorigin ?? false
+      crossorigin: (css ? this.#styleAttributes(src, url2, chunk2, manifest) : this.#scriptAttributes(src, url2, chunk2, manifest)).crossorigin ?? false
     };
     if (this.#integrityKey !== false) attributes.integrity = chunk2?.[this.#integrityKey] ?? false;
     for (const resolver of this.#preloadResolvers) {
-      const resolved = resolver(src, url, chunk2, manifest);
+      const resolved = resolver(src, url2, chunk2, manifest);
       if (resolved === false) return "";
       attributes = { ...attributes, ...resolved };
     }
     const { href: _href, ...rest } = attributes;
-    this.#preloaded[url] = this.#parseAttributes(rest);
+    this.#preloaded[url2] = this.#parseAttributes(rest);
     return `<link ${this.#parseAttributes(attributes).join(" ")} />`;
   }
-  #scriptAttributes(src, url, chunk2, manifest) {
+  #scriptAttributes(src, url2, chunk2, manifest) {
     let attributes = this.#integrityKey !== false ? { integrity: chunk2?.[this.#integrityKey] ?? false } : {};
-    for (const resolver of this.#scriptResolvers) attributes = { ...attributes, ...resolver(src, url, chunk2, manifest) };
+    for (const resolver of this.#scriptResolvers) attributes = { ...attributes, ...resolver(src, url2, chunk2, manifest) };
     return attributes;
   }
-  #styleAttributes(src, url, chunk2, manifest) {
+  #styleAttributes(src, url2, chunk2, manifest) {
     let attributes = this.#integrityKey !== false ? { integrity: chunk2?.[this.#integrityKey] ?? false } : {};
-    for (const resolver of this.#styleResolvers) attributes = { ...attributes, ...resolver(src, url, chunk2, manifest) };
+    for (const resolver of this.#styleResolvers) attributes = { ...attributes, ...resolver(src, url2, chunk2, manifest) };
     return attributes;
   }
   /** false/null/undefined are dropped, true is a bare attribute, anything else name="value". */
@@ -476,7 +490,7 @@ var Application2 = class _Application extends Container {
     this.scoped(Vite, () => new Vite(this));
   }
   base;
-  version = "0.1.0-alpha.3";
+  version = "0.1.0-alpha.4";
   providers = [];
   bootingCallbacks = [];
   bootedCallbacks = [];
@@ -566,10 +580,10 @@ var Application2 = class _Application extends Container {
   terminating(callback) {
     this.terminatingCallbacks.push(callback);
   }
-  async handle(request) {
+  async handle(request2) {
     await this.boot();
     const scope = this.createScope();
-    return scope.run(() => scope.make(HttpKernel).handle(request));
+    return scope.run(() => scope.make(HttpKernel).handle(request2));
   }
   async terminate() {
     for (const callback of this.terminatingCallbacks) await callback();
@@ -594,10 +608,10 @@ var ClosureKernel = class {
     this.routes.set(`${method.toUpperCase()} ${path}`, handler);
     return this;
   }
-  async handle(request) {
-    const handler = this.routes.get(`${request.method} ${new URL(request.url).pathname}`);
+  async handle(request2) {
+    const handler = this.routes.get(`${request2.method} ${new URL(request2.url).pathname}`);
     if (!handler) return new Response("Not Found", { status: 404, headers: { "content-type": "text/plain; charset=utf-8" } });
-    return toResponse(await handler(request));
+    return toResponse(await handler(request2));
   }
 };
 function toResponse(output) {
@@ -607,18 +621,1852 @@ function toResponse(output) {
   return Response.json(output);
 }
 
+// ../Http/dist/index.js
+import { createReadStream } from "fs";
+import { stat } from "fs/promises";
+import { basename } from "path";
+import { Readable } from "stream";
+import { readFile } from "fs/promises";
+import { fileURLToPath } from "url";
+import { createReadStream as createReadStream2 } from "fs";
+import { stat as stat2 } from "fs/promises";
+import { Readable as Readable2 } from "stream";
+import { relative, resolve, sep } from "path";
+import { createServer } from "http";
+import { Readable as Readable3 } from "stream";
+import { pipeline } from "stream/promises";
+import { existsSync as existsSync4 } from "fs";
+import { mkdir, readFile as readFile2, writeFile } from "fs/promises";
+import { dirname } from "path";
+var HttpException = class extends Error {
+  constructor(status, message = "", headers = {}) {
+    super(message);
+    this.status = status;
+    this.headers = headers;
+  }
+  status;
+  headers;
+  kind = "Http";
+  name = "HttpException";
+};
+var HttpResponseException = class extends Error {
+  constructor(response2) {
+    super(`HTTP response exception (${response2.status}).`);
+    this.response = response2;
+    this.status = response2.status;
+  }
+  response;
+  kind = "Http";
+  name = "HttpResponseException";
+  status;
+};
+var HttpServerError = class extends Error {
+  kind = "Server";
+  status = 500;
+  name = "HttpServerError";
+};
+function exceedsJsonDepth(text, maxDepth) {
+  let depth = 0;
+  let inString = false;
+  for (let i = 0; i < text.length; i++) {
+    const code = text.charCodeAt(i);
+    if (inString) {
+      if (code === 92) i++;
+      else if (code === 34) inString = false;
+    } else if (code === 34) inString = true;
+    else if (code === 123 || code === 91) {
+      if (++depth > maxDepth) return true;
+    } else if (code === 125 || code === 93) depth--;
+  }
+  return false;
+}
+async function readBody(raw, limit) {
+  if (raw.body === null) return new Uint8Array(0);
+  const declared = Number(raw.headers.get("content-length") ?? NaN);
+  if (limit !== null && Number.isFinite(declared) && declared > limit) {
+    await raw.body.cancel();
+    throw new HttpException(413, "Content Too Large");
+  }
+  const reader = raw.body.getReader();
+  const chunks = [];
+  let size = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    size += value.byteLength;
+    if (limit !== null && size > limit) {
+      await reader.cancel();
+      throw new HttpException(413, "Content Too Large");
+    }
+    chunks.push(value);
+  }
+  const out = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk2 of chunks) {
+    out.set(chunk2, offset);
+    offset += chunk2.byteLength;
+  }
+  return out;
+}
+function requestScope() {
+  const container = currentContainer();
+  return container !== void 0 && container.bound(HttpRequest) ? container : void 0;
+}
+function currentRequest() {
+  return requestScope()?.make(HttpRequest);
+}
+function optionalSession() {
+  const scope = requestScope();
+  return scope?.bound(Session) ? scope.make(Session) : void 0;
+}
+function optionalCookieJar() {
+  const scope = requestScope();
+  return scope?.bound(CookieJar) ? scope.make(CookieJar) : void 0;
+}
+function serializeCookie(cookie) {
+  const parts = [`${encodeURIComponent(cookie.name)}=${encodeURIComponent(cookie.value)}`, `Path=${cookie.path}`];
+  if (cookie.domain !== void 0) parts.push(`Domain=${cookie.domain}`);
+  if (cookie.secure) parts.push("Secure");
+  if (cookie.httpOnly) parts.push("HttpOnly");
+  parts.push(`SameSite=${cookie.sameSite.charAt(0).toUpperCase()}${cookie.sameSite.slice(1)}`);
+  if (cookie.minutes < 0) parts.push("Max-Age=0", "Expires=Thu, 01 Jan 1970 00:00:00 GMT");
+  else if (cookie.minutes > 0) parts.push(`Max-Age=${Math.round(cookie.minutes * 60)}`);
+  return parts.join("; ");
+}
+var HttpRedirectResponse = class {
+  constructor(targetUrl, status = 302, headers) {
+    this.targetUrl = targetUrl;
+    this.status = status;
+    this.#headers = new Headers(headers);
+  }
+  targetUrl;
+  status;
+  #headers;
+  with(key, value) {
+    const session = optionalSession();
+    if (session === void 0) return this;
+    if (typeof key === "string") session.flash(key, value);
+    else for (const [name, item] of Object.entries(key)) session.flash(name, item);
+    return this;
+  }
+  /** Flashes `errors` as { [bag]: { field: string[] } }, keeping the other bags already flashed. */
+  withErrors(errors, bag = "default") {
+    const session = optionalSession();
+    if (session === void 0) return this;
+    const source = typeof errors.toObject === "function" ? errors.toObject() : errors;
+    const normalized = Object.fromEntries(
+      Object.entries(source).map(([field, messages]) => [field, Array.isArray(messages) ? [...messages] : [messages]])
+    );
+    const existing = session.get("errors", {});
+    session.flash("errors", { ...existing, [bag]: normalized });
+    return this;
+  }
+  /** Flashes `input`, or the current request's input (files are never part of input()). */
+  withInput(input) {
+    const session = optionalSession();
+    if (session === void 0) return this;
+    session.flashInput(input ?? currentRequest()?.input() ?? {});
+    return this;
+  }
+  /**
+   * Always a Set-Cookie header on this response (Laravel's RedirectResponse::withCookie). A bound CookieJar only
+   * supplies the defaults (path, domain, secure, same-site); queueing would lose the cookie outside the web group.
+   */
+  withCookie(name, value, minutes = 0) {
+    const jar = optionalCookieJar();
+    const cookie = jar !== void 0 ? jar.make(name, value, minutes) : { name, value, minutes, path: "/", secure: false, httpOnly: true, sameSite: "lax" };
+    this.#headers.append("Set-Cookie", serializeCookie(cookie));
+    return this;
+  }
+  header(name, value) {
+    this.#headers.set(name, value);
+    return this;
+  }
+  toResponse() {
+    const headers = new Headers(this.#headers);
+    headers.set("Location", this.targetUrl);
+    return new Response(null, { status: this.status, headers });
+  }
+};
+function pathOf(url2) {
+  let parsed;
+  try {
+    parsed = new URL(url2, "http://localhost");
+  } catch {
+    return "/";
+  }
+  return `${parsed.pathname.replace(/^\/+/, "/")}${parsed.search}${parsed.hash}`;
+}
+var HttpRedirector = class {
+  to(path, status = 302, headers) {
+    return new HttpRedirectResponse(inject(UrlGenerator).to(path), status, headers);
+  }
+  route(name, parameters, status = 302) {
+    return new HttpRedirectResponse(inject(UrlGenerator).route(name, parameters), status);
+  }
+  back(fallback, status = 302) {
+    return new HttpRedirectResponse(inject(UrlGenerator).previous(fallback), status);
+  }
+  /** Pulls url.intended from the session (put there by guest()), else goes to `fallback`. */
+  intended(fallback = "/", status = 302) {
+    const path = optionalSession()?.pull("url.intended") ?? fallback;
+    return this.to(path, status);
+  }
+  away(url2, status = 302) {
+    return new HttpRedirectResponse(url2, status);
+  }
+  /**
+   * Remembers where a guest was going (a GET page, else the previous URL), then redirects to `path`. Only the path
+   * is stored, so intended() goes back on whichever host serves the app, and never to another site's Referer.
+   */
+  guest(path, status = 302) {
+    const session = optionalSession();
+    const request2 = currentRequest();
+    if (session !== void 0) {
+      const intended = request2 !== void 0 && request2.method() === "GET" && !request2.expectsJson() ? request2.fullUrl() : inject(UrlGenerator).previous();
+      session.put("url.intended", pathOf(intended));
+    }
+    return this.to(path, status);
+  }
+  setIntendedUrl(url2) {
+    optionalSession()?.put("url.intended", url2);
+  }
+  refresh(status = 302) {
+    return this.to(currentRequest()?.fullUrl() ?? inject(UrlGenerator).current(), status);
+  }
+};
+var KEY = /* @__PURE__ */ Symbol.for("oriel:http.client-address");
+var store = globalThis[KEY] ??= /* @__PURE__ */ new WeakMap();
+function setClientAddress(request2, address) {
+  if (address !== void 0 && address !== "") store.set(request2, address);
+}
+function clientAddress(request2) {
+  return store.get(request2);
+}
+var TYPES = {
+  avif: "image/avif",
+  css: "text/css",
+  csv: "text/csv",
+  doc: "application/msword",
+  docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  gif: "image/gif",
+  gz: "application/gzip",
+  html: "text/html",
+  ico: "image/vnd.microsoft.icon",
+  jpg: "image/jpeg",
+  js: "text/javascript",
+  map: "application/json",
+  json: "application/json",
+  md: "text/markdown",
+  mp3: "audio/mpeg",
+  mp4: "video/mp4",
+  otf: "font/otf",
+  pdf: "application/pdf",
+  png: "image/png",
+  svg: "image/svg+xml",
+  ttf: "font/ttf",
+  txt: "text/plain",
+  wasm: "application/wasm",
+  webm: "video/webm",
+  webp: "image/webp",
+  woff: "font/woff",
+  woff2: "font/woff2",
+  xls: "application/vnd.ms-excel",
+  xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  xml: "application/xml",
+  zip: "application/zip"
+};
+var ALIASES = { jpeg: "jpg", htm: "html", mjs: "js", text: "txt" };
+var EXTENSIONS = Object.fromEntries(Object.entries(TYPES).map(([extension, type]) => [type, extension]));
+function mimeFromExtension(pathOrExtension) {
+  const extension = pathOrExtension.slice(pathOrExtension.lastIndexOf(".") + 1).toLowerCase();
+  return TYPES[ALIASES[extension] ?? extension] ?? "application/octet-stream";
+}
+function extensionFromMime(type) {
+  return EXTENSIONS[type.split(";")[0].trim().toLowerCase()];
+}
+var FormUploadedFile = class {
+  constructor(file) {
+    this.file = file;
+    this.clientName = file.name ?? "";
+    this.mimeType = file.type === "" ? "application/octet-stream" : file.type;
+    this.size = file.size;
+  }
+  file;
+  clientName;
+  mimeType;
+  size;
+  /** Guessed from the MIME type, falling back to the client's extension (Laravel's extension()). */
+  extension() {
+    return extensionFromMime(this.mimeType) ?? this.clientExtension();
+  }
+  clientExtension() {
+    const dot = this.clientName.lastIndexOf(".");
+    return dot === -1 ? "" : this.clientName.slice(dot + 1).toLowerCase();
+  }
+  /** A random 40-character name with the guessed extension. */
+  hashName() {
+    const extension = this.extension();
+    return extension === "" ? Str.random(40) : `${Str.random(40)}.${extension}`;
+  }
+  arrayBuffer() {
+    return this.file.arrayBuffer();
+  }
+  text() {
+    return this.file.text();
+  }
+  stream() {
+    return this.file.stream();
+  }
+  store(directory, disk) {
+    return inject(FilesystemManager).disk(disk).putFile(directory, this);
+  }
+  storeAs(directory, name, disk) {
+    return inject(FilesystemManager).disk(disk).putFileAs(directory, this, name);
+  }
+};
+var FORBIDDEN = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+var INTEGER_KEY = /^(?:0|[1-9]\d*)$/;
+var isPlainObject = (value) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+};
+function parseBracketKey(name) {
+  const open = name.indexOf("[");
+  if (open <= 0 || !name.endsWith("]")) return [name];
+  const segments = [name.slice(0, open)];
+  const rest = name.slice(open);
+  const matches2 = rest.match(/\[[^[\]]*\]/g);
+  if (matches2 === null || matches2.join("") !== rest) return [name];
+  for (const match of matches2) segments.push(match.slice(1, -1));
+  return segments;
+}
+function normalizeLists(value) {
+  if (Array.isArray(value)) return value.map(normalizeLists);
+  if (!isPlainObject(value)) return value;
+  const keys = Object.keys(value);
+  const out = {};
+  for (const key of keys) out[key] = normalizeLists(value[key]);
+  if (keys.length > 0 && keys.every((key, index) => key === String(index))) return keys.map((key) => out[key]);
+  return out;
+}
+function fromEntries(entries) {
+  const root = {};
+  const nextIndex = /* @__PURE__ */ new WeakMap();
+  for (const [name, value] of entries) {
+    const segments = parseBracketKey(name);
+    if (segments.some((segment) => FORBIDDEN.has(segment))) continue;
+    let node = root;
+    for (let i = 0; i < segments.length; i++) {
+      let segment = segments[i];
+      const next = nextIndex.get(node) ?? 0;
+      if (segment === "") {
+        segment = String(next);
+        nextIndex.set(node, next + 1);
+      } else if (INTEGER_KEY.test(segment) && Number(segment) >= next) {
+        nextIndex.set(node, Number(segment) + 1);
+      }
+      if (i === segments.length - 1) {
+        node[segment] = value;
+        break;
+      }
+      if (!isPlainObject(node[segment])) node[segment] = {};
+      node = node[segment];
+    }
+  }
+  return normalizeLists(root);
+}
+function sanitize(value) {
+  if (Array.isArray(value)) return value.map(sanitize);
+  if (!isPlainObject(value)) return value;
+  const out = {};
+  for (const [key, item] of Object.entries(value)) if (!FORBIDDEN.has(key)) out[key] = sanitize(item);
+  return out;
+}
+function mergeRecursive(base, override) {
+  const out = { ...base };
+  for (const [key, value] of Object.entries(override)) {
+    if (FORBIDDEN.has(key)) continue;
+    const current = out[key];
+    out[key] = (isPlainObject(current) || Array.isArray(current)) && (isPlainObject(value) || Array.isArray(value)) ? normalizeLists(mergeRecursive({ ...current }, { ...value })) : value;
+  }
+  return out;
+}
+function isBlank(value) {
+  if (value === null || value === void 0) return true;
+  if (typeof value === "string") return value.trim() === "";
+  if (Array.isArray(value)) return value.length === 0;
+  if (isPlainObject(value)) return Object.keys(value).length === 0;
+  return false;
+}
+function transformLeaves(tree, transform, prefix = "") {
+  const out = {};
+  for (const [key, value] of Object.entries(tree)) out[key] = transformValue(`${prefix}${key}`, value, transform);
+  return out;
+}
+function transformValue(path, value, transform) {
+  if (Array.isArray(value)) return value.map((item, index) => transformValue(`${path}.${index}`, item, transform));
+  if (isPlainObject(value)) return transformLeaves(value, transform, `${path}.`);
+  return transform(path, value);
+}
+var TRUE_VALUES = /* @__PURE__ */ new Set(["1", "true", "on", "yes"]);
+var normalizeIp = (ip) => ip.trim().replace(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i, "$1");
+function ipv4ToNumber(ip) {
+  const parts = ip.split(".");
+  if (parts.length !== 4 || parts.some((part) => !/^\d{1,3}$/.test(part) || Number(part) > 255)) return void 0;
+  return parts.reduce((total, part) => total * 256 + Number(part), 0);
+}
+function ipMatches(ip, patterns) {
+  const address = normalizeIp(ip);
+  return patterns.some((pattern) => {
+    if (pattern === "*") return true;
+    if (!pattern.includes("/")) return normalizeIp(pattern) === address;
+    const [range, bits] = pattern.split("/");
+    const base = ipv4ToNumber(range);
+    const value = ipv4ToNumber(address);
+    const size = Number(bits);
+    if (base === void 0 || value === void 0 || !(size >= 0 && size <= 32)) return false;
+    const mask = size === 0 ? 0 : ~0 << 32 - size >>> 0;
+    return (base & mask) >>> 0 === (value & mask) >>> 0;
+  });
+}
+var IncomingRequest = class {
+  constructor(raw, options = {}) {
+    this.raw = raw;
+    this.#url = new URL(raw.url);
+    this.#trustedProxies = options.trustedProxies ?? [];
+    this.#maxBodySize = options.maxBodySize === void 0 ? 8 * 1024 * 1024 : options.maxBodySize;
+    this.#maxJsonDepth = options.maxJsonDepth === void 0 ? 512 : options.maxJsonDepth;
+    this.#query = fromEntries(this.#url.searchParams.entries());
+    this.#method = raw.method.toUpperCase();
+  }
+  raw;
+  #url;
+  #trustedProxies;
+  #maxBodySize;
+  #maxJsonDepth;
+  #query;
+  #body = {};
+  #files = {};
+  #content = "";
+  #method;
+  #cookies;
+  #loading;
+  #userResolver;
+  /** Reads and parses the body (JSON, urlencoded or multipart) once, then applies method spoofing. */
+  load() {
+    return this.#loading ??= this.#load();
+  }
+  async #load() {
+    const method = this.raw.method.toUpperCase();
+    if (method !== "GET" && method !== "HEAD" && this.raw.body !== null) {
+      const type = (this.raw.headers.get("content-type") ?? "").toLowerCase();
+      const isJson = type.includes("/json") || type.includes("+json");
+      const isUrlencoded = type.startsWith("application/x-www-form-urlencoded");
+      const isMultipart = type.startsWith("multipart/form-data");
+      if (isJson || isUrlencoded || isMultipart) {
+        const bytes = await readBody(this.raw, this.#maxBodySize);
+        if (isJson && this.#maxJsonDepth !== null && exceedsJsonDepth(new TextDecoder().decode(bytes), this.#maxJsonDepth)) {
+          throw new HttpException(400, "The request body is nested too deeply.");
+        }
+        try {
+          if (isJson) {
+            this.#content = new TextDecoder().decode(bytes);
+            this.#body = this.#parseJson(this.#content);
+          } else if (isUrlencoded) {
+            this.#content = new TextDecoder().decode(bytes);
+            this.#body = fromEntries(new URLSearchParams(this.#content).entries());
+          } else {
+            this.#parseForm(await new Response(bytes, { headers: { "content-type": this.raw.headers.get("content-type") ?? "" } }).formData());
+          }
+        } catch {
+        }
+      }
+    }
+    if (method === "POST") {
+      const override = this.raw.headers.get("x-http-method-override") ?? this.#string(this.#body._method) ?? this.#string(this.#query._method);
+      const spoofed = override?.toUpperCase();
+      if (spoofed !== void 0 && /^[A-Z]+$/.test(spoofed) && !["GET", "HEAD", "CONNECT", "TRACE"].includes(spoofed)) {
+        this.#method = spoofed;
+      }
+    }
+    return this;
+  }
+  #parseJson(text) {
+    let parsed;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      return {};
+    }
+    if (Array.isArray(parsed)) return sanitize({ ...parsed });
+    return isPlainObject(parsed) ? sanitize(parsed) : {};
+  }
+  #parseForm(form) {
+    const fields = [];
+    const files = [];
+    for (const [name, value] of form.entries()) {
+      if (typeof value === "string") fields.push([name, value]);
+      else if (!((value.name ?? "") === "" && value.size === 0)) files.push([name, new FormUploadedFile(value)]);
+    }
+    this.#body = fromEntries(fields);
+    this.#files = fromEntries(files);
+  }
+  #string(value) {
+    return typeof value === "string" && value !== "" ? value : void 0;
+  }
+  method() {
+    return this.#method;
+  }
+  isMethod(method) {
+    return this.#method === method.toUpperCase();
+  }
+  /** The scheme and host, honouring X-Forwarded-Proto/Host from trusted proxies. */
+  root() {
+    const trusted = this.#fromTrustedProxy();
+    const proto = trusted ? this.raw.headers.get("x-forwarded-proto")?.split(",")[0]?.trim() : void 0;
+    const host = trusted ? this.raw.headers.get("x-forwarded-host")?.split(",")[0]?.trim() : void 0;
+    const scheme = proto === "https" || proto === "http" ? proto : this.#url.protocol.slice(0, -1);
+    return `${scheme}://${host !== void 0 && host !== "" ? host : this.#url.host}`;
+  }
+  /** The URL without the query string or a trailing slash. */
+  url() {
+    return `${this.root()}${this.#url.pathname}`.replace(/\/+$/, "");
+  }
+  fullUrl() {
+    return this.#url.search === "" ? this.url() : `${this.url()}${this.#url.search}`;
+  }
+  /** 'posts/1', or '/' for the root. */
+  path() {
+    const trimmed = this.#url.pathname.replace(/^\/+|\/+$/g, "");
+    return trimmed === "" ? "/" : trimmed;
+  }
+  decodedPath() {
+    try {
+      return decodeURIComponent(this.path());
+    } catch {
+      return this.path();
+    }
+  }
+  secure() {
+    return this.root().startsWith("https:");
+  }
+  /** request.is('admin/*'): wildcard match against the decoded path. */
+  is(...patterns) {
+    const path = this.decodedPath();
+    return patterns.some((pattern) => {
+      const trimmed = pattern.replace(/^\/+|\/+$/g, "");
+      return Str.is(trimmed === "" ? "/" : trimmed, path);
+    });
+  }
+  routeIs(...names) {
+    const name = this.#currentRoute()?.route.getName();
+    return name !== void 0 && names.some((pattern) => Str.is(pattern, name));
+  }
+  header(name, defaultValue) {
+    return this.raw.headers.get(name) ?? defaultValue;
+  }
+  bearerToken() {
+    const header = this.header("authorization", "");
+    const position = header.toLowerCase().lastIndexOf("bearer ");
+    if (position === -1) return void 0;
+    const token2 = header.slice(position + 7).split(",")[0].trim();
+    return token2 === "" ? void 0 : token2;
+  }
+  userAgent() {
+    return this.header("user-agent");
+  }
+  /** The socket address, or the right-most untrusted X-Forwarded-For entry when the socket is a trusted proxy. */
+  ip() {
+    const socket = clientAddress(this.raw);
+    if (socket === void 0) return void 0;
+    const address = normalizeIp(socket);
+    if (!this.#fromTrustedProxy()) return address;
+    const chain = (this.raw.headers.get("x-forwarded-for") ?? "").split(",").map((entry) => normalizeIp(entry)).filter((entry) => entry !== "");
+    for (let i = chain.length - 1; i >= 0; i--) if (!ipMatches(chain[i], this.#trustedProxies)) return chain[i];
+    return chain[0] ?? address;
+  }
+  #fromTrustedProxy() {
+    const socket = clientAddress(this.raw);
+    return socket !== void 0 && this.#trustedProxies.length > 0 && ipMatches(socket, this.#trustedProxies);
+  }
+  ajax() {
+    return this.header("x-requested-with") === "XMLHttpRequest";
+  }
+  pjax() {
+    return this.header("x-pjax") === "true";
+  }
+  /** The first Accept type is JSON. */
+  wantsJson() {
+    const first = this.header("accept", "").split(",")[0].trim();
+    return first.includes("/json") || first.includes("+json");
+  }
+  /** Laravel: (ajax and not pjax and accepts anything) or wantsJson. */
+  expectsJson() {
+    const first = this.header("accept", "").split(",")[0].split(";")[0].trim();
+    const acceptsAny = first === "" || first === "*/*" || first === "*";
+    return this.ajax() && !this.pjax() && acceptsAny || this.wantsJson();
+  }
+  /** The raw body text for JSON and urlencoded requests ('' otherwise; the raw stream stays unread for other types). */
+  content() {
+    return this.#content;
+  }
+  query(key, defaultValue) {
+    return Arr.get(this.#query, key, defaultValue);
+  }
+  /** Body wins over the query string (PHP's $body + $query). Files are not input. */
+  input(key, defaultValue) {
+    return Arr.get({ ...this.#query, ...this.#body }, key, defaultValue);
+  }
+  /** Input plus files (array_replace_recursive). */
+  all() {
+    return mergeRecursive({ ...this.#query, ...this.#body }, this.#files);
+  }
+  only(...keys) {
+    const all = this.all();
+    const out = {};
+    for (const key of keys.flat()) if (Arr.has(all, key)) Arr.set(out, key, Arr.get(all, key));
+    return out;
+  }
+  except(...keys) {
+    const all = structuredCloneInput(this.all());
+    for (const key of keys.flat()) Arr.forget(all, key);
+    return all;
+  }
+  has(...keys) {
+    const all = this.all();
+    return keys.flat().every((key) => Arr.has(all, key));
+  }
+  hasAny(...keys) {
+    const all = this.all();
+    return keys.flat().some((key) => Arr.has(all, key));
+  }
+  missing(...keys) {
+    return !this.has(...keys);
+  }
+  filled(key) {
+    return !isBlank(Arr.get(this.all(), key));
+  }
+  string(key, defaultValue = "") {
+    const value = this.input(key);
+    return value === void 0 || value === null ? defaultValue : String(value);
+  }
+  /** PHP's FILTER_VALIDATE_BOOLEAN: '1', 'true', 'on', 'yes' (any case) and true are true. */
+  boolean(key, defaultValue = false) {
+    const value = this.input(key);
+    if (value === void 0) return defaultValue;
+    if (typeof value === "boolean") return value;
+    if (typeof value === "number") return value === 1;
+    return typeof value === "string" && TRUE_VALUES.has(value.trim().toLowerCase());
+  }
+  /** PHP's intval: leading digits, else 0. */
+  integer(key, defaultValue = 0) {
+    const value = this.input(key);
+    if (value === void 0) return defaultValue;
+    if (typeof value === "number") return Number.isFinite(value) ? Math.trunc(value) : 0;
+    if (typeof value === "boolean") return value ? 1 : 0;
+    const parsed = Number.parseInt(String(value).trim(), 10);
+    return Number.isNaN(parsed) ? 0 : parsed;
+  }
+  /** Adds or replaces top-level body values. */
+  merge(values) {
+    this.#body = { ...this.#body, ...sanitize(values) };
+    return this;
+  }
+  /** Rewrites every scalar in the query and the body (TrimStrings and ConvertEmptyStringsToNull use this). */
+  transformInput(transform) {
+    this.#query = transformLeaves(this.#query, transform);
+    this.#body = transformLeaves(this.#body, transform);
+    return this;
+  }
+  file(key) {
+    const value = Arr.get(this.#files, key);
+    return value instanceof FormUploadedFile ? value : void 0;
+  }
+  hasFile(key) {
+    const value = Arr.get(this.#files, key);
+    return value instanceof FormUploadedFile || Array.isArray(value) && value.some((item) => item instanceof FormUploadedFile);
+  }
+  allFiles() {
+    return { ...this.#files };
+  }
+  cookie(name) {
+    return this.cookies()[name];
+  }
+  cookies() {
+    if (this.#cookies === void 0) {
+      const cookies = {};
+      for (const part of (this.raw.headers.get("cookie") ?? "").split(";")) {
+        const index = part.indexOf("=");
+        if (index === -1) continue;
+        const name = part.slice(0, index).trim();
+        if (name === "" || Object.hasOwn(cookies, name)) continue;
+        let value = part.slice(index + 1).trim();
+        if (value.startsWith('"') && value.endsWith('"')) value = value.slice(1, -1);
+        try {
+          cookies[name] = decodeURIComponent(value);
+        } catch {
+          cookies[name] = value;
+        }
+      }
+      this.#cookies = cookies;
+    }
+    return { ...this.#cookies };
+  }
+  /** Replaces the parsed cookies (EncryptCookies calls this after decrypting). */
+  setCookies(cookies) {
+    this.#cookies = { ...cookies };
+  }
+  /** One route parameter (after model binding), or all of them. */
+  route(key) {
+    const parameters = this.#currentRoute()?.parameters ?? {};
+    return key === void 0 ? { ...parameters } : parameters[key];
+  }
+  session() {
+    return inject(Session);
+  }
+  user(guard) {
+    return this.#userResolver?.(guard);
+  }
+  setUserResolver(resolver) {
+    this.#userResolver = resolver;
+  }
+  /** Validates all() through the ValidationFactory; throws its Validation error on failure. */
+  validate(rules, messages, attributes) {
+    return inject(ValidationFactory).make(this.all(), rules, messages, attributes).validated();
+  }
+  #currentRoute() {
+    const container = currentContainer();
+    return container?.bound(CurrentRoute) ? container.make(CurrentRoute) : void 0;
+  }
+};
+function structuredCloneInput(tree) {
+  const out = {};
+  for (const [key, value] of Object.entries(tree)) {
+    out[key] = isPlainObject(value) ? structuredCloneInput(value) : Array.isArray(value) ? [...value] : value;
+  }
+  return out;
+}
+function request(key, defaultValue) {
+  const current = inject(HttpRequest);
+  return key === void 0 ? current : current.input(key, defaultValue);
+}
+function response(content, status, headers) {
+  const factory = inject(ResponseFactory);
+  return content === void 0 ? factory : factory.make(content, status, headers);
+}
+function redirect(to, status) {
+  const redirector = inject(Redirector);
+  return to === void 0 ? redirector : redirector.to(to, status);
+}
+function back(fallback, status) {
+  return inject(Redirector).back(fallback, status);
+}
+function url(path, query, absolute) {
+  const generator = inject(UrlGenerator);
+  return path === void 0 ? generator : generator.to(path, query, absolute);
+}
+function route(name, parameters, absolute) {
+  return inject(UrlGenerator).route(name, parameters, absolute);
+}
+function abort(status, message = "", headers = {}) {
+  if (status instanceof Response) throw new HttpResponseException(status);
+  throw new HttpException(status, message, headers);
+}
+function abortIf(condition, status, message = "", headers = {}) {
+  if (condition) abort(status, message, headers);
+}
+function abortUnless(condition, status, message = "", headers = {}) {
+  if (!condition) abort(status, message, headers);
+}
+function contentDisposition(type, name) {
+  const fallback = name.replace(/[^\x20-\x7e]/g, "_").replace(/["\\]/g, "\\$&");
+  const header = `${type}; filename="${fallback}"`;
+  return /^[\x20-\x7e]*$/.test(name) ? header : `${header}; filename*=UTF-8''${encodeURIComponent(name)}`;
+}
+var HttpResponseFactory = class {
+  /** Strings default to text/html; charset=utf-8, as in Laravel. */
+  make(content = null, status = 200, headers) {
+    const merged = new Headers(headers);
+    if (typeof content === "string" && !merged.has("content-type")) merged.set("content-type", "text/html; charset=utf-8");
+    return new Response(content, { status, headers: merged });
+  }
+  json(data, status = 200, headers) {
+    const merged = new Headers(headers);
+    if (!merged.has("content-type")) merged.set("content-type", "application/json");
+    return new Response(JSON.stringify(data === void 0 ? null : data), { status, headers: merged });
+  }
+  noContent(status = 204) {
+    return new Response(null, { status });
+  }
+  /** Renders a view (through the ViewFactory) into an HTML response. */
+  async view(name, data = {}, status = 200, headers) {
+    const html = await inject(ViewFactory).make(name, data).render();
+    return this.make(html, status, headers);
+  }
+  /** Streams a file as an attachment. A missing file is a 404. */
+  download(path, name = basename(path), headers) {
+    return this.#file(path, "attachment", name, headers);
+  }
+  /** Streams a file for the browser to display (Laravel's response()->file()). */
+  file(path, headers) {
+    return this.#file(path, "inline", basename(path), headers);
+  }
+  stream(body, status = 200, headers) {
+    return new Response(body, { status, headers });
+  }
+  async #file(path, disposition, name, headers) {
+    const info = await stat(path).catch(() => void 0);
+    if (info === void 0 || !info.isFile()) throw new HttpException(404);
+    const merged = new Headers(headers);
+    if (!merged.has("content-type")) merged.set("content-type", mimeFromExtension(name));
+    merged.set("content-length", String(info.size));
+    merged.set("content-disposition", contentDisposition(disposition, name));
+    const body = Readable.toWeb(createReadStream(path));
+    return new Response(body, { status: 200, headers: merged });
+  }
+};
+var ConvertEmptyStringsToNull = class {
+  async handle(request2, next) {
+    if (request2 instanceof IncomingRequest) request2.transformInput((_key, value) => value === "" ? null : value);
+    return next(request2);
+  }
+};
+var TRIM = /^[\s\uFEFF\u200B\u200E]+|[\s\uFEFF\u200B\u200E]+$/g;
+var TrimStrings = class {
+  /** Dotted input keys left untouched. Override in a subclass to change. */
+  except = ["current_password", "password", "password_confirmation"];
+  async handle(request2, next) {
+    if (request2 instanceof IncomingRequest) {
+      request2.transformInput(
+        (key, value) => typeof value === "string" && !this.except.includes(key) ? value.replace(TRIM, "") : value
+      );
+    }
+    return next(request2);
+  }
+};
+var plainServerError = () => new Response("Server Error", { status: 500, headers: { "content-type": "text/plain; charset=utf-8" } });
+var Kernel = class {
+  constructor(app) {
+    this.app = app;
+  }
+  app;
+  #middleware = [TrimStrings, ConvertEmptyStringsToNull];
+  #requests = /* @__PURE__ */ new WeakMap();
+  getGlobalMiddleware() {
+    return [...this.#middleware];
+  }
+  setGlobalMiddleware(middleware) {
+    this.#middleware = [...middleware];
+    return this;
+  }
+  appendMiddleware(...middleware) {
+    for (const cls of middleware) if (!this.#middleware.includes(cls)) this.#middleware.push(cls);
+    return this;
+  }
+  prependMiddleware(...middleware) {
+    for (const cls of [...middleware].reverse()) if (!this.#middleware.includes(cls)) this.#middleware.unshift(cls);
+    return this;
+  }
+  hasMiddleware(middleware) {
+    return this.#middleware.includes(middleware);
+  }
+  /** Runs in the current request scope (Application.handle() opens one); called directly, it opens its own. */
+  handle(raw) {
+    const current = currentContainer();
+    const scope = current !== void 0 && current !== this.app ? current : this.app.createScope();
+    return scope.run(() => this.#handle(raw, scope));
+  }
+  async #handle(raw, scope) {
+    let request2;
+    let response2;
+    try {
+      request2 = new IncomingRequest(raw, {
+        trustedProxies: this.#trustedProxies(),
+        maxBodySize: this.#maxBodySize(),
+        maxJsonDepth: this.#maxJsonDepth()
+      });
+      scope.instance(HttpRequest, request2);
+      const state = { scope, request: request2, middleware: [] };
+      this.#requests.set(raw, state);
+      await request2.load();
+      response2 = await this.#sendThroughGlobal(state);
+    } catch (error) {
+      request2 ??= this.#bareRequest(scope, raw);
+      if (request2 !== void 0) {
+        response2 = await this.#renderLast(scope, request2, error);
+      } else {
+        await this.#report(scope, error);
+        response2 = plainServerError();
+      }
+    }
+    if (raw.method.toUpperCase() === "HEAD" && response2.body !== null) {
+      await response2.body.cancel().catch(() => void 0);
+      response2 = new Response(null, { status: response2.status, statusText: response2.statusText, headers: response2.headers });
+    }
+    return response2;
+  }
+  /** The request without options, for rendering an error raised while the real one was being built. */
+  #bareRequest(scope, raw) {
+    try {
+      const request2 = new IncomingRequest(raw);
+      scope.instance(HttpRequest, request2);
+      return request2;
+    } catch {
+      return void 0;
+    }
+  }
+  /** Runs terminate() on the global and route middleware (inside the request's scope), then Application.terminate(), inside the same scope, so terminating callbacks see the request's bindings. */
+  async terminate(raw, response2) {
+    const state = this.#requests.get(raw);
+    if (state !== void 0) {
+      this.#requests.delete(raw);
+      await state.scope.run(async () => {
+        const route2 = state.scope.bound(CurrentRoute) ? state.scope.make(CurrentRoute).middleware : [];
+        for (const middleware of [...state.middleware, ...route2]) {
+          if (typeof middleware.terminate !== "function") continue;
+          try {
+            await middleware.terminate(state.request, response2);
+          } catch (error) {
+            await this.#report(state.scope, error);
+          }
+        }
+        await this.app.terminate();
+      });
+      return;
+    }
+    await this.app.terminate();
+  }
+  #sendThroughGlobal(state) {
+    const { scope, request: request2 } = state;
+    const pipes = this.#middleware.map((cls) => {
+      const instance = scope.make(cls);
+      state.middleware.push(instance);
+      return (passable, next) => this.#guard(scope, passable, () => instance.handle(passable, next));
+    });
+    return scope.make(PipelineFactory).make().send(request2).through(pipes).then((passable) => this.#guard(scope, passable, () => this.#dispatch(scope, passable)));
+  }
+  #dispatch(scope, request2) {
+    return scope.make(Router).dispatch(request2);
+  }
+  /** Converts a Responsable result, and renders a thrown error at this stage (Laravel's Routing\Pipeline). */
+  async #guard(scope, request2, run) {
+    try {
+      const result = await run();
+      if (result instanceof Response) return result;
+      const responsable = result;
+      if (typeof responsable?.toResponse === "function") return await responsable.toResponse(request2);
+      throw new HttpServerError("Middleware must return a Response.");
+    } catch (error) {
+      if (!scope.bound(ExceptionHandler)) throw error;
+      const handler = scope.make(ExceptionHandler);
+      await handler.report(error);
+      return handler.render(request2, error);
+    }
+  }
+  /** Last resort: the handler failed or isn't bound. Never throws. */
+  async #renderLast(scope, request2, error) {
+    if (scope.bound(ExceptionHandler)) {
+      try {
+        const handler = scope.make(ExceptionHandler);
+        await handler.report(error);
+        return await handler.render(request2, error);
+      } catch (renderError) {
+        console.error(renderError);
+      }
+    } else {
+      console.error(error);
+    }
+    return plainServerError();
+  }
+  async #report(scope, error) {
+    try {
+      if (scope.bound(ExceptionHandler)) await scope.make(ExceptionHandler).report(error);
+      else console.error(error);
+    } catch (reportError) {
+      console.error(reportError);
+    }
+  }
+  /** config('http.max_body_size'): bytes, or null for no limit. Anything else is a configuration error. */
+  #maxBodySize() {
+    if (!this.app.bound(ConfigRepository)) return 8 * 1024 * 1024;
+    const value = this.app.make(ConfigRepository).get("http.max_body_size", 8 * 1024 * 1024);
+    if (value === null) return null;
+    if (typeof value === "number" && Number.isFinite(value) && value >= 0) return value;
+    throw new HttpServerError(
+      `Invalid http.max_body_size ${JSON.stringify(value) ?? String(value)}: use a number of bytes (0 or more), or null for no limit.`
+    );
+  }
+  /** config('http.max_json_depth'): how deep a JSON body may nest, or null for no limit. */
+  #maxJsonDepth() {
+    if (!this.app.bound(ConfigRepository)) return 512;
+    const value = this.app.make(ConfigRepository).get("http.max_json_depth", 512);
+    if (value === null) return null;
+    if (typeof value === "number" && Number.isInteger(value) && value >= 1) return value;
+    throw new HttpServerError(
+      `Invalid http.max_json_depth ${JSON.stringify(value) ?? String(value)}: use a whole number (1 or more), or null for no limit.`
+    );
+  }
+  /** config('http.trusted_proxies'): an array, or a comma-separated string such as '*' or '10.0.0.0/8,::1'. */
+  #trustedProxies() {
+    if (!this.app.bound(ConfigRepository)) return [];
+    const value = this.app.make(ConfigRepository).get("http.trusted_proxies", []);
+    if (typeof value === "string") return value.split(",").map((entry) => entry.trim()).filter((entry) => entry !== "");
+    return Array.isArray(value) ? value.map(String) : [];
+  }
+};
+var MiddlewareConfiguration = class {
+  constructor(kernel, router, config) {
+    this.kernel = kernel;
+    this.router = router;
+    this.config = config;
+  }
+  kernel;
+  router;
+  config;
+  append(...middleware) {
+    this.kernel.appendMiddleware(...middleware);
+    return this;
+  }
+  prepend(...middleware) {
+    this.kernel.prependMiddleware(...middleware);
+    return this;
+  }
+  web(options) {
+    return this.#modifyGroup("web", options);
+  }
+  api(options) {
+    return this.#modifyGroup("api", options);
+  }
+  alias(aliases) {
+    for (const [name, middleware] of Object.entries(aliases)) this.router.aliasMiddleware(name, middleware);
+    return this;
+  }
+  group(name, middleware) {
+    this.router.middlewareGroup(name, middleware);
+    return this;
+  }
+  /** Stored in config('http.csrf_except'), which the Session component's VerifyCsrfToken reads. */
+  validateCsrfTokens(options) {
+    const current = this.config?.get("http.csrf_except", []) ?? [];
+    this.config?.set("http.csrf_except", [...current, ...options.except]);
+    return this;
+  }
+  /** Stored in config('http.redirect_guests_to'), which the Auth middleware and the exception handler read. */
+  redirectGuestsTo(url2) {
+    this.config?.set("http.redirect_guests_to", url2);
+    return this;
+  }
+  /** Laravel 11's redirectUsersTo(): stored in config('http.redirect_users_to') for Auth's RedirectIfAuthenticated. */
+  redirectUsersTo(url2) {
+    this.config?.set("http.redirect_users_to", url2);
+    return this;
+  }
+  /** Laravel's order: prepends, then the group minus removals, then appends. */
+  #modifyGroup(name, { append = [], prepend = [], remove = [] }) {
+    const current = this.router.getMiddlewareGroups()[name] ?? [];
+    const moved = /* @__PURE__ */ new Set([...append, ...prepend, ...remove]);
+    this.router.middlewareGroup(name, [...prepend, ...current.filter((entry) => !moved.has(entry)), ...append]);
+    return this;
+  }
+};
+function applyMiddlewareCallbacks(app, kernel) {
+  if (!app.bound(MiddlewareCallbacks)) return;
+  const callbacks = app.make(MiddlewareCallbacks);
+  if (callbacks.length === 0) return;
+  const config = app.bound(ConfigRepository) ? app.make(ConfigRepository) : void 0;
+  const configurator = new MiddlewareConfiguration(kernel, app.make(Router), config);
+  for (const callback of callbacks) callback(configurator);
+}
+var STATUS_TEXTS = {
+  400: "Bad Request",
+  401: "Unauthorized",
+  402: "Payment Required",
+  403: "Forbidden",
+  404: "Not Found",
+  405: "Method Not Allowed",
+  408: "Request Timeout",
+  409: "Conflict",
+  410: "Gone",
+  413: "Content Too Large",
+  415: "Unsupported Media Type",
+  419: "Page Expired",
+  422: "Unprocessable Content",
+  429: "Too Many Requests",
+  500: "Server Error",
+  502: "Bad Gateway",
+  503: "Service Unavailable",
+  504: "Gateway Timeout"
+};
+function statusText(status) {
+  return STATUS_TEXTS[status] ?? (status >= 500 ? "Server Error" : "Error");
+}
+function escapeHtml(value) {
+  return value.replace(/[&<>"']/g, (char) => `&#${char.charCodeAt(0)};`);
+}
+function minimalPage(status, message) {
+  const title = escapeHtml(message);
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${title}</title>
+<style>body{margin:0;font-family:ui-sans-serif,system-ui,sans-serif;background:#f7fafc;color:#1a202c;display:flex;align-items:center;justify-content:center;min-height:100vh}.code{padding:0 1rem;border-right:1px solid #a0aec0;font-size:1.125rem}.message{padding:0 1rem;font-size:1.125rem;text-transform:uppercase;letter-spacing:.05em}</style>
+</head>
+<body><div class="code">${status}</div><div class="message">${title}</div></body>
+</html>`;
+}
+function stackFrames(error) {
+  const frames = [];
+  for (const raw of (error.stack ?? "").split("\n").slice(1)) {
+    const text = raw.trim();
+    const match = /(?:\(|@|at )((?:file:\/\/)?(?:\/|[A-Za-z]:\\)[^()]*?):(\d+):(\d+)\)?$/.exec(text);
+    if (match === null) continue;
+    const location = match[1];
+    const file = location.startsWith("file://") ? fileURLToPath(location) : location;
+    frames.push({ file, line: Number(match[2]), column: Number(match[3]), text });
+  }
+  return frames;
+}
+async function excerpt(frame, radius = 5) {
+  const source = await readFile(frame.file, "utf8").catch(() => void 0);
+  if (source === void 0) return void 0;
+  const lines = source.split("\n");
+  const start = Math.max(1, frame.line - radius);
+  const end = Math.min(lines.length, frame.line + radius);
+  const rows = [];
+  for (let number = start; number <= end; number++) {
+    const current = number === frame.line ? ' class="current"' : "";
+    rows.push(`<tr${current}><td class="n">${number}</td><td><code>${escapeHtml(lines[number - 1] ?? "")}</code></td></tr>`);
+  }
+  return `<table class="source">${rows.join("")}</table>`;
+}
+async function debugPage(error, method, url2) {
+  const err = error instanceof Error ? error : new Error(String(error));
+  const frames = stackFrames(err);
+  const appFrame = frames.find((frame) => !frame.file.includes("node_modules") && !frame.file.startsWith("node:")) ?? frames[0];
+  const source = appFrame === void 0 ? void 0 : await excerpt(appFrame);
+  const causes = [];
+  for (let cause = err.cause, depth = 0; cause !== void 0 && depth < 5; cause = cause.cause, depth++) {
+    causes.push(`<li>${escapeHtml(cause instanceof Error ? `${cause.name}: ${cause.message}` : String(cause))}</li>`);
+  }
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<title>${escapeHtml(err.message || err.name)}</title>
+<style>body{margin:0;font-family:ui-sans-serif,system-ui,sans-serif;background:#f3f4f6;color:#111827}main{max-width:1100px;margin:2rem auto;padding:0 1rem}header{background:#fff;border-radius:.5rem;padding:1.5rem;box-shadow:0 1px 3px #0001}.class{color:#dc2626;font-weight:600}.message{font-size:1.5rem;margin:.5rem 0}.request{color:#6b7280}section{background:#fff;border-radius:.5rem;padding:1rem;margin-top:1rem;box-shadow:0 1px 3px #0001;overflow:auto}.source td{padding:0 .5rem;white-space:pre;font-size:.85rem}.source .n{color:#9ca3af;text-align:right}.source .current{background:#fee2e2}ol{font-family:ui-monospace,monospace;font-size:.85rem}</style>
+</head>
+<body><main>
+<header><div class="class">${escapeHtml(err.name)}</div><div class="message">${escapeHtml(err.message)}</div><div class="request">${escapeHtml(method)} ${escapeHtml(url2)}</div></header>
+${appFrame === void 0 ? "" : `<section><div>${escapeHtml(appFrame.file)}:${appFrame.line}</div>${source ?? ""}</section>`}
+<section><ol>${frames.map((frame) => `<li>${escapeHtml(frame.text)}</li>`).join("")}</ol></section>
+${causes.length === 0 ? "" : `<section><div>Caused by</div><ul>${causes.join("")}</ul></section>`}
+</main></body>
+</html>`;
+}
+var NOT_REPORTED = /* @__PURE__ */ new Set(["Http", "ModelNotFound", "Validation", "Authentication", "Authorization", "TokenMismatch"]);
+var HTTP_KINDS = /* @__PURE__ */ new Set(["Http", "ModelNotFound", "Authorization", "TokenMismatch"]);
+var kindOf = (error) => typeof error === "object" && error !== null && typeof error.kind === "string" ? error.kind : void 0;
+function statusFor(error) {
+  const status = error?.status;
+  switch (kindOf(error)) {
+    case "Http":
+      return status ?? 500;
+    case "ModelNotFound":
+      return 404;
+    case "Authorization":
+      return status ?? 403;
+    case "TokenMismatch":
+      return 419;
+    case "Authentication":
+      return 401;
+    case "Validation":
+      return status ?? 422;
+    case "Server":
+      return status ?? 500;
+    default:
+      return 500;
+  }
+}
+function summarizeValidation(errors) {
+  const messages = Object.values(errors).flat();
+  if (messages.length === 0) return "The given data was invalid.";
+  const more = messages.length - 1;
+  return more === 0 ? messages[0] : `${messages[0]} (and ${more} more ${more === 1 ? "error" : "errors"})`;
+}
+var isHttpLike = (error) => {
+  const kind = kindOf(error);
+  return kind !== void 0 && HTTP_KINDS.has(kind);
+};
+var ErrorHandler = class {
+  constructor(app) {
+    this.app = app;
+  }
+  app;
+  /** Input keys never flashed back on a validation redirect. */
+  dontFlash = ["current_password", "password", "password_confirmation"];
+  #reportCallbacks = [];
+  #renderCallbacks = [];
+  #dontReport = [];
+  #reported = /* @__PURE__ */ new WeakSet();
+  #jsonWhen;
+  reportUsing(callback) {
+    this.#reportCallbacks.push(callback);
+  }
+  renderUsing(callback) {
+    this.#renderCallbacks.push(callback);
+  }
+  ignore(...classes) {
+    this.#dontReport.push(...classes);
+  }
+  /** Laravel's shouldRenderJsonWhen(): the callback decides JSON or HTML instead of the Accept header. */
+  shouldRenderJsonWhen(callback) {
+    this.#jsonWhen = callback;
+  }
+  /** Laravel's shouldReturnJson(): the shouldRenderJsonWhen() callback when set, else request.expectsJson(). */
+  shouldReturnJson(request2, error) {
+    return this.#jsonWhen !== void 0 ? this.#jsonWhen(request2, error) : request2.expectsJson();
+  }
+  shouldReport(error) {
+    const kind = kindOf(error);
+    if (kind !== void 0 && NOT_REPORTED.has(kind)) return false;
+    return !this.#dontReport.some((cls) => error instanceof cls);
+  }
+  /** Report callbacks first (returning false stops the default log), then LogManager.error(), else console.error. Once per error. */
+  async report(error) {
+    if (!this.shouldReport(error)) return;
+    if (typeof error === "object" && error !== null) {
+      if (this.#reported.has(error)) return;
+      this.#reported.add(error);
+    }
+    try {
+      for (const callback of this.#reportCallbacks) if (await callback(error) === false) return;
+      const container = this.#container();
+      if (container.bound(LogManager)) {
+        const message = error instanceof Error ? error.message : String(error);
+        container.make(LogManager).error(message, { exception: error });
+      } else {
+        console.error(error);
+      }
+    } catch (reportError) {
+      console.error(reportError);
+    }
+  }
+  async render(request2, error) {
+    for (const callback of this.#renderCallbacks) {
+      const response3 = await callback(error, request2);
+      if (response3 instanceof Response) return response3;
+    }
+    if (error instanceof HttpResponseException) return error.response;
+    const custom = await this.#renderCustom(request2, error);
+    if (custom !== void 0) return custom;
+    const http = this.#httpRequest(request2);
+    const kind = kindOf(error);
+    let response2;
+    if (kind === "Validation") response2 = await this.#renderValidation(http, error);
+    else if (kind === "Authentication") response2 = await this.#renderAuthentication(http, error);
+    else if (this.shouldReturnJson(http, error)) response2 = this.#renderJson(error);
+    else response2 = await this.#renderHtml(http, error);
+    const headers = error?.headers;
+    if (headers !== void 0) for (const [name, value] of Object.entries(headers)) response2.headers.set(name, value);
+    return response2;
+  }
+  /** An error with its own render(request) or toResponse(request) (Laravel's renderable exceptions / Responsable). */
+  async #renderCustom(request2, error) {
+    if (typeof error !== "object" || error === null) return void 0;
+    const candidate = error;
+    for (const method of [candidate.render, candidate.toResponse]) {
+      if (typeof method !== "function") continue;
+      const response2 = await method.call(error, request2);
+      if (response2 instanceof Response) return response2;
+    }
+    return void 0;
+  }
+  async #renderValidation(request2, error) {
+    if (this.shouldReturnJson(request2, error)) {
+      return this.#json({ message: summarizeValidation(error.errors), errors: error.errors }, statusFor(error));
+    }
+    const input = { ...request2.input() };
+    for (const key of this.dontFlash) delete input[key];
+    const container = this.#container();
+    if (!container.bound(Redirector)) {
+      return this.#redirect(error.redirectTo ?? request2.header("referer") ?? "/");
+    }
+    const redirector = container.make(Redirector);
+    const redirect2 = error.redirectTo !== void 0 ? redirector.to(error.redirectTo) : redirector.back();
+    const response2 = await redirect2.withInput(input).withErrors(error.errors, error.errorBag).toResponse(request2);
+    return response2;
+  }
+  async #renderAuthentication(request2, error) {
+    if (this.shouldReturnJson(request2, error)) return this.#json({ message: error.message || "Unauthenticated." }, 401);
+    const target2 = error.redirectTo ?? this.#guestRedirect(request2);
+    const container = this.#container();
+    if (!container.bound(Redirector)) return this.#redirect(target2);
+    const redirector = container.make(Redirector);
+    const redirect2 = typeof redirector.guest === "function" ? redirector.guest(target2) : redirector.to(target2);
+    return await redirect2.toResponse(request2);
+  }
+  /** config('http.redirect_guests_to'), then route('login'), then '/login'. */
+  #guestRedirect(request2) {
+    const configured = this.#config("http.redirect_guests_to", void 0);
+    if (typeof configured === "function") return String(configured(request2));
+    if (typeof configured === "string" && configured !== "") return configured;
+    const container = this.#container();
+    if (container.bound(UrlGenerator)) {
+      const url2 = container.make(UrlGenerator);
+      if (url2.hasRoute("login")) return url2.route("login");
+    }
+    return "/login";
+  }
+  #renderJson(error) {
+    const status = statusFor(error);
+    if (isHttpLike(error)) {
+      const message = error instanceof Error && error.message !== "" ? error.message : statusText(status);
+      return this.#json({ message }, status);
+    }
+    if (!this.#debug()) return this.#json({ message: "Server Error" }, status);
+    const err = error instanceof Error ? error : new Error(String(error));
+    const [frame] = stackFrames(err);
+    return this.#json(
+      {
+        message: err.message,
+        exception: err.name,
+        file: frame?.file,
+        line: frame?.line,
+        trace: stackFrames(err).map((entry) => entry.text)
+      },
+      status
+    );
+  }
+  async #renderHtml(request2, error) {
+    const status = statusFor(error);
+    if (!isHttpLike(error) && this.#debug()) {
+      return this.#html(await debugPage(error, request2.method(), request2.fullUrl()), status);
+    }
+    const message = status === 403 && error instanceof Error && error.message !== "" ? error.message : statusText(status);
+    const view = await this.#errorView(status, error, message);
+    return this.#html(view ?? minimalPage(status, message), status);
+  }
+  /** resources/views/errors/{status}.tsx, then errors/4xx or errors/5xx, through the ViewFactory. */
+  async #errorView(status, error, message) {
+    const container = this.#container();
+    if (!container.bound(ViewFactory)) return void 0;
+    const views = container.make(ViewFactory);
+    for (const name of [`errors.${status}`, `errors.${Math.floor(status / 100)}xx`]) {
+      if (!views.exists(name)) continue;
+      try {
+        return await views.make(name, { exception: error, status, message }).render();
+      } catch (viewError) {
+        await this.report(viewError);
+        return void 0;
+      }
+    }
+    return void 0;
+  }
+  #httpRequest(request2) {
+    if (typeof request2 === "object" && request2 !== null && typeof request2.expectsJson === "function") {
+      return request2;
+    }
+    return new IncomingRequest(request2 instanceof Request ? request2 : new Request("http://localhost/"));
+  }
+  #json(body, status) {
+    return new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
+  }
+  #html(body, status) {
+    return new Response(body, { status, headers: { "content-type": "text/html; charset=utf-8" } });
+  }
+  #redirect(location) {
+    return new Response(null, { status: 302, headers: { Location: location } });
+  }
+  #debug() {
+    return this.#config("app.debug", false) === true;
+  }
+  #config(key, fallback) {
+    return this.app.bound(ConfigRepository) ? this.app.make(ConfigRepository).get(key, fallback) : fallback;
+  }
+  /** The request scope while handling a request (so scoped services resolve), else the application. */
+  #container() {
+    return currentContainer() ?? this.app;
+  }
+};
+var ExceptionsConfiguration = class {
+  constructor(handler) {
+    this.handler = handler;
+  }
+  handler;
+  report(callback) {
+    this.handler.reportUsing(callback);
+    return this;
+  }
+  render(callback) {
+    this.handler.renderUsing(callback);
+    return this;
+  }
+  dontReport(...classes) {
+    this.handler.ignore(...classes);
+    return this;
+  }
+  /** shouldRenderJsonWhen((request) => request.is('api/*')): JSON errors for those requests, whatever they accept. */
+  shouldRenderJsonWhen(callback) {
+    this.handler.shouldRenderJsonWhen(callback);
+    return this;
+  }
+};
+function applyExceptionCallbacks(app, handler) {
+  if (!app.bound(ExceptionCallbacks)) return;
+  const configurator = new ExceptionsConfiguration(handler);
+  for (const callback of app.make(ExceptionCallbacks)) callback(configurator);
+}
+var HIDDEN_SEGMENT = /^\.|\.(ts|tsx|mts|cts)$|[. ]$/i;
+async function servePublicFile(publicPath, request2) {
+  if (request2.method !== "GET" && request2.method !== "HEAD") return void 0;
+  let pathname;
+  try {
+    pathname = decodeURIComponent(new URL(request2.url).pathname);
+  } catch {
+    return void 0;
+  }
+  if (pathname === "/" || pathname.includes("\0")) return void 0;
+  const root = resolve(publicPath);
+  const file = resolve(root, `.${pathname}`);
+  if (!file.startsWith(root + sep)) return void 0;
+  if (relative(root, file).split(/[\\/]/).some((segment) => HIDDEN_SEGMENT.test(segment))) return void 0;
+  const info = await stat2(file).catch(() => void 0);
+  if (info === void 0 || !info.isFile()) return void 0;
+  const type = mimeFromExtension(file);
+  const headers = new Headers({
+    "content-type": type.startsWith("text/") || type === "application/json" ? `${type}; charset=utf-8` : type,
+    "content-length": String(info.size),
+    "last-modified": info.mtime.toUTCString()
+  });
+  if (pathname.startsWith("/build/assets/")) headers.set("cache-control", "public, max-age=31536000, immutable");
+  if (request2.method === "HEAD") return new Response(null, { status: 200, headers });
+  const body = Readable2.toWeb(createReadStream2(file));
+  return new Response(body, { status: 200, headers });
+}
+async function terminateRequest(app, request2, response2) {
+  try {
+    if (app.bound(HttpKernel)) await app.make(HttpKernel).terminate?.(request2, response2);
+  } catch (error) {
+    console.error(error);
+  }
+}
+async function handleSafely(app, request2, publicPath) {
+  try {
+    if (publicPath !== void 0) {
+      const file = await servePublicFile(publicPath, request2);
+      if (file !== void 0) return file;
+    }
+    return await app.handle(request2);
+  } catch (error) {
+    console.error(error);
+    return plainServerError();
+  }
+}
+function exitOnSignals(close, closed) {
+  const onSignal = () => {
+    void close().then(() => process.exit(0));
+  };
+  process.once("SIGINT", onSignal);
+  process.once("SIGTERM", onSignal);
+  void closed.then(() => {
+    process.off("SIGINT", onSignal);
+    process.off("SIGTERM", onSignal);
+  });
+}
+var displayHost = (hostname) => hostname.includes(":") ? `[${hostname}]` : hostname;
+function bunRuntime() {
+  return globalThis.Bun;
+}
+async function serveBun(app, options) {
+  const bun = bunRuntime();
+  if (bun === void 0) throw new HttpServerError("Bun.serve is not available: the process is not running on Bun.");
+  let markClosed = () => void 0;
+  const closed = new Promise((resolve2) => markClosed = resolve2);
+  const server = bun.serve({
+    port: options.port,
+    hostname: options.hostname,
+    async fetch(request2, current) {
+      setClientAddress(request2, current.requestIP(request2)?.address);
+      const response2 = await handleSafely(app, request2, options.publicPath);
+      setTimeout(() => void terminateRequest(app, request2, response2), 0);
+      return response2;
+    },
+    error(error) {
+      console.error(error);
+      return plainServerError();
+    }
+  });
+  let closing;
+  const close = () => closing ??= (async () => {
+    let timer;
+    const forced = new Promise((resolve2) => {
+      timer = setTimeout(() => void Promise.resolve(server.stop(true)).then(resolve2), options.shutdownTimeout);
+    });
+    await Promise.race([Promise.resolve(server.stop(false)), forced]);
+    clearTimeout(timer);
+    markClosed();
+  })();
+  if (options.signals) exitOnSignals(close, closed);
+  return {
+    runtime: "bun",
+    hostname: options.hostname,
+    port: server.port,
+    url: `http://${displayHost(options.hostname)}:${server.port}`,
+    close,
+    closed
+  };
+}
+function requestBody(req) {
+  let finished = false;
+  const detach = () => {
+    finished = true;
+    req.off("data", onData);
+    req.off("end", onEnd);
+    req.off("error", onError);
+    req.off("close", onClose);
+  };
+  let controller;
+  const onData = (chunk2) => {
+    if (finished) return;
+    controller.enqueue(new Uint8Array(chunk2.buffer, chunk2.byteOffset, chunk2.byteLength));
+    if ((controller.desiredSize ?? 0) <= 0) req.pause();
+  };
+  const onEnd = () => {
+    if (finished) return;
+    detach();
+    controller.close();
+  };
+  const onError = (error) => {
+    if (finished) return;
+    detach();
+    controller.error(error);
+  };
+  const onClose = () => {
+    if (!finished && !req.complete) onError(new Error("The request was aborted."));
+  };
+  return new ReadableStream(
+    {
+      start(c) {
+        controller = c;
+        req.on("data", onData);
+        req.on("end", onEnd);
+        req.on("error", onError);
+        req.on("close", onClose);
+        req.pause();
+      },
+      pull() {
+        req.resume();
+      },
+      cancel() {
+        detach();
+      }
+    },
+    { highWaterMark: 0 }
+  );
+}
+function toWebRequest(req, res, fallbackHost) {
+  const target2 = req.url ?? "/";
+  const url2 = new URL(`http://${req.headers.host ?? fallbackHost}${target2.startsWith("/") ? target2 : `/${target2}`}`);
+  const headers = new Headers();
+  for (let i = 0; i < req.rawHeaders.length; i += 2) {
+    const name = req.rawHeaders[i];
+    if (!name.startsWith(":")) headers.append(name, req.rawHeaders[i + 1]);
+  }
+  const method = (req.method ?? "GET").toUpperCase();
+  const controller = new AbortController();
+  res.once("close", () => {
+    if (!res.writableFinished) controller.abort();
+  });
+  const init = { method, headers, signal: controller.signal };
+  if (method !== "GET" && method !== "HEAD") {
+    init.body = requestBody(req);
+    init.duplex = "half";
+  }
+  return new Request(url2, init);
+}
+async function writeResponse(res, response2) {
+  res.statusCode = response2.status;
+  if (response2.statusText !== "") res.statusMessage = response2.statusText;
+  response2.headers.forEach((value, name) => {
+    if (name !== "set-cookie") res.setHeader(name, value);
+  });
+  const cookies = response2.headers.getSetCookie();
+  if (cookies.length > 0) res.setHeader("set-cookie", cookies);
+  if (response2.body === null) {
+    res.end();
+    return;
+  }
+  await pipeline(Readable3.fromWeb(response2.body), res);
+}
+async function serveNode(app, options) {
+  const fallbackHost = `${displayHost(options.hostname)}:${options.port}`;
+  const server = createServer((req, res) => {
+    void (async () => {
+      let request2;
+      try {
+        request2 = toWebRequest(req, res, fallbackHost);
+      } catch {
+        res.statusCode = 400;
+        res.end("Bad Request");
+        return;
+      }
+      setClientAddress(request2, req.socket.remoteAddress);
+      const response2 = await handleSafely(app, request2, options.publicPath);
+      try {
+        await writeResponse(res, response2);
+      } catch {
+        res.destroy();
+      }
+      await terminateRequest(app, request2, response2);
+    })();
+  });
+  await new Promise((resolve2, reject) => {
+    server.once("error", reject);
+    server.listen(options.port, options.hostname, () => {
+      server.off("error", reject);
+      resolve2();
+    });
+  });
+  const address = server.address();
+  const closed = new Promise((resolve2) => server.once("close", () => resolve2()));
+  let closing;
+  const close = () => closing ??= (async () => {
+    const done = new Promise((resolve2) => server.close(() => resolve2()));
+    server.closeIdleConnections();
+    const idle = setInterval(() => server.closeIdleConnections(), 50);
+    const force = setTimeout(() => server.closeAllConnections(), options.shutdownTimeout);
+    await done;
+    clearInterval(idle);
+    clearTimeout(force);
+  })();
+  if (options.signals) exitOnSignals(close, closed);
+  return {
+    runtime: "node",
+    hostname: options.hostname,
+    port: address.port,
+    url: `http://${displayHost(options.hostname)}:${address.port}`,
+    close,
+    closed
+  };
+}
+function detectRuntime() {
+  return bunRuntime() !== void 0 ? "bun" : "node";
+}
+async function serve(app, options = {}) {
+  const resolved = {
+    port: options.port ?? Number(process.env.PORT ?? process.env.SERVER_PORT ?? 8e3),
+    hostname: options.hostname ?? "127.0.0.1",
+    signals: options.signals ?? true,
+    shutdownTimeout: options.shutdownTimeout ?? 1e4,
+    ...options.publicPath !== false && { publicPath: options.publicPath ?? app.publicPath() }
+  };
+  await app.boot();
+  const runtime = options.runtime ?? detectRuntime();
+  const server = runtime === "bun" ? await serveBun(app, resolved) : await serveNode(app, resolved);
+  const onListen = options.onListen ?? ((running) => console.log(`Server running on [${running.url}].`));
+  onListen(server);
+  return server;
+}
+function io(command) {
+  return {
+    option: (name) => {
+      const value = command.option(name);
+      return value === void 0 || value === null || value === false || value === "" ? void 0 : String(value);
+    },
+    flag: (name) => {
+      const value = command.option(name);
+      return value === true || value === "true" || value === "1";
+    },
+    info: (message) => command.info(message),
+    line: (message) => command.line(message),
+    warn: (message) => command.warn(message),
+    error: (message) => command.error(message)
+  };
+}
+var middlewareName = (reference) => typeof reference === "string" ? reference : reference.name;
+function routeListRows(routes) {
+  const rows = routes.map((route2) => {
+    const listable = route2;
+    return {
+      method: route2.methods.join("|"),
+      uri: route2.uri,
+      name: route2.getName() ?? null,
+      action: typeof listable.getActionName === "function" ? listable.getActionName() : "Closure",
+      middleware: typeof listable.gatherMiddleware === "function" ? listable.gatherMiddleware().map(middlewareName) : []
+    };
+  });
+  return rows.sort((a, b) => a.uri < b.uri ? -1 : a.uri > b.uri ? 1 : 0);
+}
+function filterRouteList(rows, filters) {
+  const excluded = (filters.exceptPath ?? "").split(",").filter((path) => path !== "");
+  return rows.filter((row) => {
+    if (filters.name !== void 0 && !(row.name ?? "").includes(filters.name)) return false;
+    if (filters.path !== void 0 && !row.uri.includes(filters.path)) return false;
+    if (filters.method !== void 0 && !row.method.includes(filters.method.toUpperCase())) return false;
+    return !excluded.some((path) => row.uri.includes(path));
+  });
+}
+function formatRouteList(rows, width) {
+  const methodWidth = Math.max(...rows.map((row) => row.method.length));
+  const lines = rows.map((row) => {
+    const spaces = " ".repeat(Math.max(methodWidth + 6 - row.method.length, 0));
+    const action = row.action === "Closure" ? row.name ?? "" : row.name === null ? row.action : `${row.name} \u203A ${row.action}`;
+    const used = row.method.length + spaces.length + row.uri.length + action.length + 6 + (action === "" ? 0 : 1);
+    const dots = ".".repeat(Math.max(width - used, 0));
+    return `  ${row.method} ${spaces}${row.uri}${dots === "" ? "" : ` ${dots}`}${action === "" ? "" : ` ${action}`}`;
+  });
+  const count = `Showing [${rows.length}] ${rows.length === 1 ? "route" : "routes"}`;
+  return [...lines, "", `${" ".repeat(Math.max(width - count.length - 2, 0))}${count}`];
+}
+var API_ROUTES_STUB = `import { request, Route } from '@orieljs/framework'
+
+Route.get('/user', () => request().user()).middleware('auth:token')
+`;
+function addApiRouting(source) {
+  const code = source.replace(/^[ \t]*\/\/.*$/gm, "");
+  if (/withRouting\(\s*\{[^}]*\bapi\s*:/.test(code)) return source;
+  const commented = /^([ \t]*)\/\/\s*(api:\s*['"`][^'"`\n]*['"`],?)[ \t]*$/m.exec(source);
+  if (commented !== null) return source.replace(commented[0], () => `${commented[1]}${commented[2]}`);
+  const web = /^([ \t]*)web:\s*(['"`])[^'"`\n]*\2[ \t]*,?[ \t]*$/m.exec(source);
+  if (web !== null) {
+    const line = web[0].trimEnd();
+    return source.replace(web[0], () => `${line.endsWith(",") ? line : `${line},`}
+${web[1]}api: 'routes/api.ts',`);
+  }
+  const inline = /withRouting\(\s*\{/.exec(source);
+  if (inline !== null) return source.replace(inline[0], () => `${inline[0]} api: 'routes/api.ts',`);
+  const create = /^([ \t]*)\.create\(\)/m.exec(source);
+  if (create !== null) return source.replace(create[0], () => `${create[1]}.withRouting({ api: 'routes/api.ts' })
+${create[0]}`);
+  return void 0;
+}
+function registerHttpCommands(kernel, app, options = {}) {
+  const serveApp = options.serve ?? serve;
+  const terminalWidth = options.terminalWidth ?? (() => process.stdout.columns ?? 120);
+  kernel.command(
+    "serve {--host=127.0.0.1 : The host address to serve the application on} {--port= : The port to serve the application on}",
+    async function() {
+      const out = io(this);
+      const port = out.option("port");
+      if (port !== void 0 && !/^\d+$/.test(port)) {
+        out.error("The --port option must be a number.");
+        return 1;
+      }
+      const server = await serveApp(app, {
+        hostname: out.option("host") ?? "127.0.0.1",
+        ...port !== void 0 && { port: Number(port) },
+        onListen: (running) => {
+          out.info(`Server running on [${running.url}].`);
+          out.line("Press Ctrl+C to stop the server");
+        }
+      });
+      await server.closed;
+      return 0;
+    }
+  ).purpose("Serve the application on the Oriel development server");
+  kernel.command(
+    "route:list {--method= : Filter the routes by method} {--name= : Filter the routes by name} {--path= : Only show routes matching the given path pattern} {--except-path= : Do not display the routes matching the given path pattern} {--reverse : Reverse the ordering of the routes} {--json : Output the route list as JSON}",
+    function() {
+      const out = io(this);
+      if (!app.bound(Router)) {
+        out.error("The router is not available. Is the Routing service provider registered?");
+        return 1;
+      }
+      const all = routeListRows(app.make(Router).getRoutes());
+      if (all.length === 0) {
+        out.error("Your application doesn't have any routes.");
+        return 0;
+      }
+      const rows = filterRouteList(all, {
+        ...out.option("method") !== void 0 && { method: out.option("method") },
+        ...out.option("name") !== void 0 && { name: out.option("name") },
+        ...out.option("path") !== void 0 && { path: out.option("path") },
+        ...out.option("except-path") !== void 0 && { exceptPath: out.option("except-path") }
+      });
+      if (rows.length === 0) {
+        out.error("Your application doesn't have any routes matching the given criteria.");
+        return 0;
+      }
+      if (out.flag("reverse")) rows.reverse();
+      if (out.flag("json")) {
+        out.line(JSON.stringify(rows));
+        return 0;
+      }
+      for (const line of formatRouteList(rows, terminalWidth())) out.line(line);
+      return 0;
+    }
+  ).purpose("List all registered routes");
+  kernel.command("install:api {--force : Overwrite any existing API routes file}", async function() {
+    const out = io(this);
+    const routesFile = app.basePath("routes/api.ts");
+    if (existsSync4(routesFile) && !out.flag("force")) {
+      out.error("API routes file already exists.");
+    } else {
+      await mkdir(dirname(routesFile), { recursive: true });
+      await writeFile(routesFile, API_ROUTES_STUB);
+      out.info("Published API routes file.");
+    }
+    const bootstrapFile = app.bootstrapPath("app.ts");
+    const source = existsSync4(bootstrapFile) ? await readFile2(bootstrapFile, "utf8") : void 0;
+    const updated = source === void 0 ? void 0 : addApiRouting(source);
+    if (updated === void 0) {
+      out.warn(
+        "Unable to automatically add API route definition to bootstrap file. Add api: 'routes/api.ts' to withRouting() in bootstrap/app.ts."
+      );
+    } else if (updated !== source) {
+      await writeFile(bootstrapFile, updated);
+    }
+    out.info("API scaffolding installed. Run [oriel migrate] to create the personal access tokens table.");
+    return 0;
+  }).purpose("Create an API routes file and prepare the application for API authentication");
+}
+var HttpServiceProvider = class extends ServiceProvider {
+  register() {
+    this.mergeConfigFrom(
+      {
+        trusted_proxies: [],
+        max_body_size: 8 * 1024 * 1024,
+        max_json_depth: 512,
+        csrf_except: [],
+        redirect_guests_to: void 0,
+        redirect_users_to: void 0
+      },
+      "http"
+    );
+    this.app.singleton(HttpKernel, () => new Kernel(this.app));
+    this.app.singleton(ExceptionHandler, () => {
+      const handler = new ErrorHandler(this.app);
+      applyExceptionCallbacks(this.app, handler);
+      return handler;
+    });
+    this.app.singleton(ResponseFactory, () => new HttpResponseFactory());
+    this.app.singleton(Redirector, () => new HttpRedirector());
+  }
+  boot() {
+    this.app.booted(() => {
+      const kernel = this.app.make(HttpKernel);
+      if (kernel instanceof Kernel && this.app.bound(Router)) applyMiddlewareCallbacks(this.app, kernel);
+    });
+    if (this.app.bound(ConsoleKernel)) registerHttpCommands(this.app.make(ConsoleKernel), this.app);
+  }
+};
+
 // ../Live/dist/index.js
 import { AssertionError } from "assert";
 import { isDeepStrictEqual } from "util";
 import { AsyncLocalStorage } from "async_hooks";
 import { randomBytes as randomBytes2 } from "crypto";
 import { createHmac, timingSafeEqual } from "crypto";
-import { existsSync as existsSync4, readdirSync as readdirSync2 } from "fs";
-import { join as join5, relative, sep } from "path";
+import { existsSync as existsSync5, readdirSync as readdirSync2 } from "fs";
+import { join as join5, relative as relative2, sep as sep2 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 import { existsSync as existsSync22 } from "fs";
-import { mkdir, writeFile } from "fs/promises";
-import { dirname, join as join23, relative as relative2, sep as sep2 } from "path";
+import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
+import { dirname as dirname2, join as join23, relative as relative22, sep as sep22 } from "path";
 Symbol.metadata ??= /* @__PURE__ */ Symbol.for("Symbol.metadata");
 var LISTENERS = /* @__PURE__ */ Symbol.for("oriel:live.listeners");
 var LOCKED = /* @__PURE__ */ Symbol.for("oriel:live.locked");
@@ -771,9 +2619,9 @@ var Component = class {
     return new PendingEvent(event);
   }
   /** Sends the browser to `url` after this request; `navigate` uses o:navigate instead of a full page load. */
-  redirect(url, options = {}) {
+  redirect(url2, options = {}) {
     const state = stateOf(this);
-    state.redirect = url;
+    state.redirect = url2;
     if (options.navigate === true) state.redirectUsingNavigate = true;
     else delete state.redirectUsingNavigate;
   }
@@ -884,14 +2732,14 @@ function rootTag(html, component) {
   let rootEnd = -1;
   TOKEN.lastIndex = 0;
   for (let match = TOKEN.exec(source); match !== null; match = TOKEN.exec(source)) {
-    const [token, closing, opening, selfClosing] = match;
+    const [token2, closing, opening, selfClosing] = match;
     if (root === void 0 && match.index !== 0) fail22();
     if (depth === 0 && root !== void 0) fail22();
     if (opening !== void 0) {
       const tag = opening.toLowerCase();
       root ??= tag;
       if (selfClosing === "/" || VOID.has(tag)) {
-        if (depth === 0) rootEnd = match.index + token.length;
+        if (depth === 0) rootEnd = match.index + token2.length;
         continue;
       }
       if (RAW_TEXT.has(tag)) {
@@ -903,7 +2751,7 @@ function rootTag(html, component) {
       depth++;
     } else if (closing !== void 0) {
       if (--depth < 0) fail22();
-      if (depth === 0) rootEnd = match.index + token.length;
+      if (depth === 0) rootEnd = match.index + token2.length;
     }
   }
   if (root === void 0 || depth !== 0 || source.slice(rootEnd).trim() !== "") fail22();
@@ -920,23 +2768,31 @@ var fail = (message, actual, expected) => {
   throw new AssertionError({ message, actual, expected, operator: "live" });
 };
 var getPath = (target2, path) => path.split(".").reduce((node, segment) => typeof node === "object" && node !== null ? node[segment] : void 0, target2);
+var TestRequestScope = token("Testing.RequestScope");
+function requestScope2() {
+  const container = currentContainer() ?? Container.getInstance();
+  return container?.bound(TestRequestScope) === true ? container.make(TestRequestScope) : (run) => run();
+}
 var Testable = class _Testable {
-  constructor(manager, result) {
+  constructor(manager, scope, result) {
     this.manager = manager;
+    this.scope = scope;
     this.#snapshot = JSON.stringify(result.snapshot);
     this.#html = result.html ?? "";
     this.#effects = result.effects;
     this.#instance = result.instance;
   }
   manager;
+  scope;
   #snapshot;
   #html;
   #effects;
   #instance;
   /** Mounts `component` with `params`, as `<Live component={…} {...params} />` would. */
   static async create(component, params = {}) {
+    const scope = requestScope2();
     const manager = inject(LiveManager);
-    return new _Testable(manager, await manager.mountComponent(component, params));
+    return new _Testable(manager, scope, await scope(() => manager.mountComponent(component, params)));
   }
   /** The component instance after the last request. */
   instance() {
@@ -971,7 +2827,7 @@ var Testable = class _Testable {
     return this.#update({}, [{ method: "$refresh", params: [] }]);
   }
   async #update(updates, calls) {
-    const result = await this.manager.updateComponent(this.#snapshot, updates, calls);
+    const result = await this.scope(() => this.manager.updateComponent(this.#snapshot, updates, calls));
     this.#snapshot = JSON.stringify(result.snapshot);
     if (result.html !== void 0) this.#html = result.html;
     this.#effects = result.effects;
@@ -1029,10 +2885,10 @@ var Testable = class _Testable {
     if (found.length > 0) fail(`Component has errors: "${found.join('", "')}"`, errors);
     return this;
   }
-  assertRedirect(url) {
-    const redirect = this.#effects.redirect;
-    if (redirect === void 0) fail("Component did not perform a redirect.");
-    if (url !== void 0 && redirect !== url) fail("Component redirected to an unexpected URL.", redirect, url);
+  assertRedirect(url2) {
+    const redirect2 = this.#effects.redirect;
+    if (redirect2 === void 0) fail("Component did not perform a redirect.");
+    if (url2 !== void 0 && redirect2 !== url2) fail("Component redirected to an unexpected URL.", redirect2, url2);
     return this;
   }
   assertNoRedirect() {
@@ -1088,8 +2944,8 @@ function defaultName(cls) {
   return typeof name === "string" && name !== "" ? Str.kebab(name) : void 0;
 }
 function componentFiles(directory) {
-  if (!existsSync4(directory)) return [];
-  return readdirSync2(directory, { recursive: true, encoding: "utf8" }).filter((file) => /\.(tsx|ts|jsx|js|mts|mjs)$/.test(file) && !/\.(test|spec|d)\.[^.]+$/.test(file)).map((file) => file.split(sep).join("/")).sort();
+  if (!existsSync5(directory)) return [];
+  return readdirSync2(directory, { recursive: true, encoding: "utf8" }).filter((file) => /\.(tsx|ts|jsx|js|mts|mjs)$/.test(file) && !/\.(test|spec|d)\.[^.]+$/.test(file)).map((file) => file.split(sep2).join("/")).sort();
 }
 async function discover(directory) {
   const found = [];
@@ -1098,16 +2954,87 @@ async function discover(directory) {
       /* @vite-ignore */
       pathToFileURL2(join5(directory, file)).href
     );
-    found.push([componentName(relative(directory, join5(directory, file))), module.default]);
+    found.push([componentName(relative2(directory, join5(directory, file))), module.default]);
   }
   return found;
 }
+var PERSISTENT_MIDDLEWARE = ["auth", "verified", "guest"];
+function canMatch(router) {
+  const methods = router;
+  return ["getRoutesByMatchOrder", "getPatterns", "getPatternVersion", "getMiddleware", "getMiddlewareGroups"].every((name) => typeof methods[name] === "function");
+}
+function isMatchingRoute(route2) {
+  const candidate = route2;
+  return typeof candidate === "object" && candidate !== null && Array.isArray(candidate.methods) && ["match", "gatherMiddleware", "excludedMiddleware"].every((name) => typeof candidate[name] === "function");
+}
+function routePath(path) {
+  const trimmed = path.replace(/^\/+|\/+$/g, "").replace(/\/{2,}/g, "/");
+  return trimmed === "" ? "" : `/${trimmed}`;
+}
+function expand(references, aliases, groups, out = [], visiting = /* @__PURE__ */ new Set()) {
+  for (const reference of references) {
+    if (typeof reference === "function") {
+      out.push({ cls: reference, parameters: [] });
+      continue;
+    }
+    const index = reference.indexOf(":");
+    const name = index === -1 ? reference : reference.slice(0, index);
+    if (index === -1 && Object.hasOwn(groups, name)) {
+      if (visiting.has(name)) continue;
+      visiting.add(name);
+      expand(groups[name], aliases, groups, out, visiting);
+      visiting.delete(name);
+    } else if (Object.hasOwn(aliases, name)) {
+      out.push({ cls: aliases[name], parameters: index === -1 ? [] : reference.slice(index + 1).split(",") });
+    }
+  }
+  return out;
+}
+function persistentMiddleware(router, persistent, method, path) {
+  if (!canMatch(router)) throw new LiveError("Live re-applies the page route's middleware to updates, which needs Oriel's router.");
+  const routes = router.getRoutesByMatchOrder();
+  if (!Array.isArray(routes) || !routes.every(isMatchingRoute)) throw new LiveError("Live re-applies the page route's middleware to updates, which needs Oriel's routes.");
+  const verb = method.toUpperCase();
+  const target2 = routePath(path);
+  const patterns = router.getPatterns();
+  const version = router.getPatternVersion();
+  const route2 = routes.find((candidate) => candidate.methods.includes(verb) && candidate.match(target2, patterns, version) !== void 0);
+  if (route2 === void 0) return [];
+  const aliases = router.getMiddleware();
+  const groups = router.getMiddlewareGroups();
+  const wanted = new Set(persistent.flatMap((name) => Object.hasOwn(aliases, name) ? [aliases[name]] : []));
+  const excluded = new Set(expand(route2.excludedMiddleware(), aliases, groups).map((entry) => entry.cls));
+  const ids = /* @__PURE__ */ new Map();
+  const seen = /* @__PURE__ */ new Set();
+  return expand(route2.gatherMiddleware(), aliases, groups).filter((entry) => {
+    if (!ids.has(entry.cls)) ids.set(entry.cls, ids.size);
+    const key = `${ids.get(entry.cls)}:${entry.parameters.join(",")}`;
+    if (!wanted.has(entry.cls) || excluded.has(entry.cls) || seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+async function throughMiddleware(container, request2, middleware, destination) {
+  let ran;
+  const run = async (index) => {
+    if (index === middleware.length) {
+      ran = { result: await destination() };
+      return new Response(null, { status: 204 });
+    }
+    const { cls, parameters } = middleware[index];
+    const instance = container.make(cls);
+    const next = () => run(index + 1);
+    return instance.handle(request2, next, ...parameters);
+  };
+  const response2 = await run(0);
+  return ran ? ran.result : response2;
+}
 function isModel(value) {
   if (typeof value !== "object" || value === null) return false;
   const candidate = value;
   return typeof candidate.getKey === "function" && typeof candidate.getKeyName === "function" && typeof candidate.getTable === "function" && typeof candidate.exists === "boolean";
 }
-var isPlainObject = (value) => {
+var isPlainObject2 = (value) => {
   const proto = Object.getPrototypeOf(value);
   return proto === Object.prototype || proto === null;
 };
@@ -1154,7 +3081,7 @@ function dehydrate(value, registry, path, seen = /* @__PURE__ */ new Set()) {
       }
       return [items.map((item, i) => dehydrate(item, registry, `${path}.${i}`, seen)), { s: "clctn" }];
     }
-    if (isPlainObject(object)) {
+    if (isPlainObject2(object)) {
       const out = {};
       for (const [key, item] of Object.entries(object)) out[key] = dehydrate(item, registry, `${path}.${key}`, seen);
       return [out, { s: "obj" }];
@@ -1241,10 +3168,11 @@ function isUpdatable(instance, path) {
   return !isModel(node) && !(node instanceof Collection);
 }
 var renderContext = new AsyncLocalStorage();
-function optional(container, token) {
-  if (!container.bound(token)) return void 0;
+var pageRequest = new AsyncLocalStorage();
+function optional(container, token2) {
+  if (!container.bound(token2)) return void 0;
   try {
-    return container.make(token);
+    return container.make(token2);
   } catch {
     return void 0;
   }
@@ -1291,8 +3219,8 @@ var LiveComponentManager = class {
     if (!isComponentClass(cls)) throw new LiveComponentNotFoundError(name);
     return cls;
   }
-  isLiveRequest(request) {
-    return request.header("X-Oriel-Live") === "true";
+  isLiveRequest(request2) {
+    return request2.header("X-Oriel-Live") === "true";
   }
   /** The first render: HTML with o:id, o:snapshot and o:effects on the root element. */
   async mount(component, params = {}, key) {
@@ -1322,8 +3250,9 @@ var LiveComponentManager = class {
     }
     this.prepareComputed(instance);
     await hook(instance, "mount", params);
-    const request = optional(this.container(), HttpRequest);
-    const memo = { id: state.id, name, path: request?.path() ?? "", method: request?.method() ?? "GET", children: {}, errors: {} };
+    const request2 = optional(this.container(), HttpRequest);
+    const page = pageRequest.getStore() ?? { path: request2?.path() ?? "", method: request2?.method() ?? "GET" };
+    const memo = { id: state.id, name, path: page.path, method: page.method, children: {}, errors: {} };
     const { html, tag } = await this.render(instance, memo, {});
     const effects = this.effects(instance);
     const listeners = Object.keys(listenersOf(cls));
@@ -1333,10 +3262,11 @@ var LiveComponentManager = class {
     return { instance, snapshot, effects, html: insertAttributesIntoRoot(html, attributes), tag };
   }
   /** Applies each component's updates and calls, re-renders it and returns its new snapshot and effects. */
-  async update(request) {
+  async update(request2) {
     const components = [];
-    for (const component of request.components) {
-      const result = await this.updateComponent(component.snapshot, component.updates, component.calls);
+    for (const component of request2.components) {
+      const { memo } = this.verify(component.snapshot);
+      const result = await pageRequest.run({ path: memo.path, method: memo.method }, () => this.updateComponent(component.snapshot, component.updates, component.calls));
       components.push({ snapshot: JSON.stringify(result.snapshot), effects: result.effects });
     }
     return { components };
@@ -1378,10 +3308,27 @@ var LiveComponentManager = class {
     if (calls.length > 0) effects.returns = returns;
     return { instance, snapshot: await this.snapshot(instance, memo), effects, html, tag };
   }
-  /** The route action of POST /oriel/live/update. */
-  async handle(request) {
-    if (!this.isLiveRequest(request)) throw new InvalidLiveRequestError("Live update requests need the X-Oriel-Live header.");
-    return this.update(this.payload(request));
+  /**
+   * The route action of POST /oriel/live/update. Each component's update runs behind the auth middleware of the route
+   * that rendered its page (Livewire's persistent middleware): a signed-out tab gets a 401, never the action. When a
+   * middleware answers instead (a redirect), that is the response.
+   */
+  async handle(request2) {
+    if (!this.isLiveRequest(request2)) throw new InvalidLiveRequestError("Live update requests need the X-Oriel-Live header.");
+    const container = this.container();
+    const persistent = optional(container, ConfigRepository)?.get("live.persistent_middleware", PERSISTENT_MIDDLEWARE) ?? PERSISTENT_MIDDLEWARE;
+    const components = [];
+    for (const component of this.payload(request2).components) {
+      const { memo } = this.verify(component.snapshot);
+      const middleware = persistentMiddleware(container.make(Router), persistent, memo.method, memo.path);
+      const result = await pageRequest.run(
+        { path: memo.path, method: memo.method },
+        () => throughMiddleware(container, request2, middleware, () => this.updateComponent(component.snapshot, component.updates, component.calls))
+      );
+      if (result instanceof Response) return result;
+      components.push({ snapshot: JSON.stringify(result.snapshot), effects: result.effects });
+    }
+    return { components };
   }
   /** A full-page component (Route.get('/counter', Counter)): mounted with the route parameters, inside the layout. */
   async page(component) {
@@ -1389,9 +3336,9 @@ var LiveComponentManager = class {
     const params = { ...optional(container, CurrentRoute)?.parameters ?? {} };
     const cls = component.constructor;
     const result = await this.mountComponent(cls, params, component);
-    const redirect = result.effects.redirect;
-    if (redirect !== void 0) {
-      return optional(container, Redirector)?.to(redirect) ?? new Response(null, { status: 302, headers: { Location: redirect } });
+    const redirect2 = result.effects.redirect;
+    if (redirect2 !== void 0) {
+      return optional(container, Redirector)?.to(redirect2) ?? new Response(null, { status: 302, headers: { Location: redirect2 } });
     }
     const layout = cls.layout ?? optional(container, ConfigRepository)?.get("live.layout") ?? "components.layouts.app";
     const html = result.html;
@@ -1424,11 +3371,11 @@ var LiveComponentManager = class {
     return this.container().make(Encrypter).getKey();
   }
   /** The request body, read from the raw JSON when the request has it, so TrimStrings can't alter typed values. */
-  payload(request) {
+  payload(request2) {
     let body;
     try {
-      const content = request.content;
-      body = typeof content === "function" ? JSON.parse(content.call(request)) : request.all();
+      const content = request2.content;
+      body = typeof content === "function" ? JSON.parse(content.call(request2)) : request2.all();
     } catch {
       throw new InvalidLiveRequestError("The Live update request body is not valid JSON.");
     }
@@ -1563,7 +3510,7 @@ test('{{ name }} renders', async () => {
 `;
 var CLASS_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
 function importPath(from, to) {
-  const path = relative2(dirname(from), to).split(sep2).join("/").replace(/\.tsx?$/, "");
+  const path = relative22(dirname2(from), to).split(sep22).join("/").replace(/\.tsx?$/, "");
   return path.startsWith(".") ? path : `./${path}`;
 }
 function registerLiveCommands(kernel, app) {
@@ -1579,23 +3526,23 @@ function registerLiveCommands(kernel, app) {
     const file = join23(directory, ...segments.slice(0, -1), `${className}.tsx`);
     const force = this.option("force") === true;
     if (existsSync22(file) && !force) {
-      this.error(`Component [${relative2(app.basePath(), file)}] already exists.`);
+      this.error(`Component [${relative22(app.basePath(), file)}] already exists.`);
       return 1;
     }
-    await mkdir(dirname(file), { recursive: true });
-    await writeFile(file, COMPONENT_STUB.replace("{{ class }}", () => className));
-    this.info(`Component [${relative2(app.basePath(), file)}] created successfully.`);
+    await mkdir2(dirname2(file), { recursive: true });
+    await writeFile2(file, COMPONENT_STUB.replace("{{ class }}", () => className));
+    this.info(`Component [${relative22(app.basePath(), file)}] created successfully.`);
     if (this.option("test") === true) {
       const testFile = app.basePath(join23("tests", "Feature", "Live", ...segments.slice(0, -1), `${className}.test.ts`));
       if (existsSync22(testFile) && !force) {
-        this.error(`Test [${relative2(app.basePath(), testFile)}] already exists.`);
+        this.error(`Test [${relative22(app.basePath(), testFile)}] already exists.`);
         return 1;
       }
       const name = segments.map((segment) => Str.kebab(segment)).join(".");
       const test = TEST_STUB.replaceAll("{{ class }}", () => className).replace("{{ component }}", () => importPath(testFile, file)).replace("{{ testCase }}", () => importPath(testFile, app.basePath(join23("tests", "TestCase.ts")))).replace("{{ name }}", () => name);
-      await mkdir(dirname(testFile), { recursive: true });
-      await writeFile(testFile, test);
-      this.info(`Test [${relative2(app.basePath(), testFile)}] created successfully.`);
+      await mkdir2(dirname2(testFile), { recursive: true });
+      await writeFile2(testFile, test);
+      this.info(`Test [${relative22(app.basePath(), testFile)}] created successfully.`);
     }
     return 0;
   }).purpose("Create a new Live component");
@@ -1603,7 +3550,7 @@ function registerLiveCommands(kernel, app) {
 var UPDATE_URI = "/oriel/live/update";
 var LiveServiceProvider = class extends ServiceProvider {
   register() {
-    this.mergeConfigFrom({ class_path: this.app.appPath("Live"), layout: "components.layouts.app" }, "live");
+    this.mergeConfigFrom({ class_path: this.app.appPath("Live"), layout: "components.layouts.app", persistent_middleware: [...PERSISTENT_MIDDLEWARE] }, "live");
     this.app.singleton(LiveComponentManager, () => new LiveComponentManager(this.app));
     this.app.singleton(LiveManager, (container) => container.make(LiveComponentManager));
   }
@@ -1623,7 +3570,7 @@ var LiveServiceProvider = class extends ServiceProvider {
 // ../Testing/dist/index.js
 import { AssertionError as AssertionError2 } from "assert";
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync6 } from "fs";
 import { join as join6 } from "path";
 import { createHmac as createHmac2 } from "crypto";
 import { randomUUID } from "crypto";
@@ -1649,7 +3596,7 @@ function format(value) {
     return String(value);
   }
 }
-function escapeHtml(value) {
+function escapeHtml2(value) {
   return value.replace(/[&<>"']/g, (char) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#039;" })[char]);
 }
 function stripTags(html) {
@@ -2162,12 +4109,12 @@ function sizeOf(value) {
 function toPlain(value) {
   return value === void 0 ? void 0 : JSON.parse(JSON.stringify(value));
 }
-function inertiaPageOf(response) {
+function inertiaPageOf(response2) {
   let page;
   try {
-    if (response.headers.has("X-Inertia")) page = JSON.parse(response.content);
+    if (response2.headers.has("X-Inertia")) page = JSON.parse(response2.content);
     else {
-      const match = /<script data-page="[^"]*" type="application\/json">([\s\S]*?)<\/script>/.exec(response.content);
+      const match = /<script data-page="[^"]*" type="application\/json">([\s\S]*?)<\/script>/.exec(response2.content);
       page = match === null ? void 0 : JSON.parse(match[1]);
     }
   } catch {
@@ -2180,11 +4127,11 @@ function inertiaPageOf(response) {
 var AssertableInertia = class _AssertableInertia extends AssertableJson {
   #page;
   #response;
-  static fromTestResponse(response) {
-    const page = inertiaPageOf(response);
+  static fromTestResponse(response2) {
+    const page = inertiaPageOf(response2);
     const instance = new _AssertableInertia(page.props);
     instance.#page = page;
-    instance.#response = response;
+    instance.#response = response2;
     return instance;
   }
   /** Scopes are plain AssertableJson: the page-level methods only make sense at the root. */
@@ -2204,7 +4151,7 @@ var AssertableInertia = class _AssertableInertia extends AssertableJson {
     if (shouldExist === true || shouldExist === void 0 && config?.get("inertia.testing.ensure_pages_exist", true) !== false) {
       const paths = config?.get("inertia.pages.paths", []) ?? [];
       const extensions = config?.get("inertia.pages.extensions", []) ?? [];
-      const exists = paths.some((path) => extensions.some((extension) => existsSync5(join6(path, `${value}.${extension}`))));
+      const exists = paths.some((path) => extensions.some((extension) => existsSync6(join6(path, `${value}.${extension}`))));
       if (!exists) fail2(`Inertia page component file [${value}] does not exist.`);
     }
     return this;
@@ -2253,8 +4200,8 @@ var AssertableInertia = class _AssertableInertia extends AssertableJson {
     if (onlyList !== void 0 || exceptList !== void 0) headers["X-Inertia-Partial-Component"] = this.page.component;
     if (onlyList !== void 0) headers["X-Inertia-Partial-Data"] = onlyList;
     if (exceptList !== void 0) headers["X-Inertia-Partial-Except"] = exceptList;
-    const response = await client.request("GET", this.page.url, { headers });
-    const reloaded = _AssertableInertia.fromTestResponse(response);
+    const response2 = await client.request("GET", this.page.url, { headers });
+    const reloaded = _AssertableInertia.fromTestResponse(response2);
     reloaded.component(this.page.component, false).url(this.page.url).version(this.page.version);
     await callback?.(reloaded);
     return this;
@@ -2349,8 +4296,8 @@ function isExpired(cookie, now = Date.now()) {
   if (cookie.maxAge !== void 0 && !Number.isNaN(cookie.maxAge)) return cookie.maxAge <= 0;
   return cookie.expires !== void 0 && cookie.expires.getTime() <= now;
 }
-function responseCookies(response) {
-  return response.headers.getSetCookie().map(parseSetCookie);
+function responseCookies(response2) {
+  return response2.headers.getSetCookie().map(parseSetCookie);
 }
 function cookieHeader(cookies) {
   return [...cookies].map(([name, value]) => `${encodeURIComponent(name)}=${encodeURIComponent(value)}`).join("; ");
@@ -2367,8 +4314,8 @@ var TestResponse = class _TestResponse {
   context;
   decoded;
   /** Reads the body once, so every assertion is synchronous. */
-  static async from(response, context = {}) {
-    return new _TestResponse(response, await response.text(), context);
+  static async from(response2, context = {}) {
+    return new _TestResponse(response2, await response2.text(), context);
   }
   get status() {
     return this.baseResponse.status;
@@ -2860,11 +4807,11 @@ ${JSON.stringify(errors, null, 2)}`, { actual: errors, expected: {} });
     return Arr.get(this.viewDataOf(this.ensureView()), key);
   }
   // Internals ---------------------------------------------------------------------------------------------
-  absolute(url) {
+  absolute(url2) {
     try {
-      return new URL(url, this.context.request?.url ?? "http://localhost").href;
+      return new URL(url2, this.context.request?.url ?? "http://localhost").href;
     } catch {
-      return url;
+      return url2;
     }
   }
   excerpt(text = this.content) {
@@ -2919,7 +4866,7 @@ ${this.excerpt()}`;
     return decryptCookie(app.make(Encrypter), cookie.name, cookie.value);
   }
   needles(value, escape) {
-    return [value].flat().map((needle) => escape ? escapeHtml(needle) : needle);
+    return [value].flat().map((needle) => escape ? escapeHtml2(needle) : needle);
   }
   inOrder(haystack, needles) {
     let position = 0;
@@ -2964,9 +4911,9 @@ function recordingViewFactory(factory, views) {
 }
 function recordingExceptionHandler(handler, record) {
   return forward(handler, {
-    async render(request, error) {
+    async render(request2, error) {
       record(error);
-      return handler.render(request, error);
+      return handler.render(request2, error);
     }
   });
 }
@@ -3004,13 +4951,13 @@ var HttpClient = class {
   /** Requests whose actingAs users reached the guards (the AuthFactory they went through). */
   actingAsApplied = /* @__PURE__ */ new WeakMap();
   async request(method, uri, options = {}) {
-    let response = await this.send(this.buildRequest(method, uri, options));
-    if (!this.followRedirects) return response;
-    for (let hops = 0; isRedirect(response.status); hops++) {
-      if (hops >= MAX_REDIRECTS) fail2(`Too many redirects (more than ${MAX_REDIRECTS}), last location [${response.headers.get("Location")}].`);
-      response = await this.send(this.buildRequest("GET", response.headers.get("Location") ?? "/", {}));
+    let response2 = await this.send(this.buildRequest(method, uri, options));
+    if (!this.followRedirects) return response2;
+    for (let hops = 0; isRedirect(response2.status); hops++) {
+      if (hops >= MAX_REDIRECTS) fail2(`Too many redirects (more than ${MAX_REDIRECTS}), last location [${response2.headers.get("Location")}].`);
+      response2 = await this.send(this.buildRequest("GET", response2.headers.get("Location") ?? "/", {}));
     }
-    return response;
+    return response2;
   }
   /** Runs `fn` in a scope prepared like a request's (carried session, actingAs users), e.g. for assertAuthenticated(). */
   async inScope(fn) {
@@ -3021,23 +4968,48 @@ var HttpClient = class {
       return fn(scope);
     });
   }
+  /**
+   * Runs `run` in a request scope like this client's requests have (a request for `method uri` bound, the carried
+   * session, actingAs users), then carries the session and the users on, as after a request. Live.test() runs its
+   * mount and updates through it.
+   */
+  async withinRequest(run, method = "GET", uri = "/") {
+    await this.app.boot();
+    const request2 = this.buildRequest(method, uri, {});
+    setClientAddress2(request2, "127.0.0.1");
+    const scope = this.app.createScope();
+    const context = { request: request2, app: this.app, client: this };
+    const result = await scope.run(async () => {
+      this.beforeRequest(scope, context);
+      scope.instance(HttpRequest, new IncomingRequest(request2));
+      if (scope.bound(AuthFactory)) {
+        try {
+          await scope.make(AuthFactory).guard().check();
+        } catch {
+        }
+      }
+      return run();
+    });
+    await scope.run(() => this.afterRequest(scope, context));
+    return result;
+  }
   /** Runs the request through the app's real HttpKernel, in a request scope this client owns. */
-  async send(request) {
+  async send(request2) {
     const app = this.app;
     await app.boot();
-    setClientAddress(request, "127.0.0.1");
+    setClientAddress2(request2, "127.0.0.1");
     const scope = app.createScope();
-    const context = { request, app, client: this };
-    const response = await scope.run(async () => {
+    const context = { request: request2, app, client: this };
+    const response2 = await scope.run(async () => {
       await this.beforeRequest(scope, context);
       this.previousUrl = void 0;
-      return scope.make(HttpKernel).handle(request);
+      return scope.make(HttpKernel).handle(request2);
     });
     await scope.run(() => this.afterRequest(scope, context));
-    this.rememberCookies(response);
-    await app.make(HttpKernel).terminate?.(request, response);
+    this.rememberCookies(response2);
+    await app.make(HttpKernel).terminate?.(request2, response2);
     if (!this.handleExceptions && context.exception !== void 0) throw context.exception;
-    return TestResponse.from(response, context);
+    return TestResponse.from(response2, context);
   }
   /** Prepares the request scope: recorders, the carried session and actingAs users. */
   beforeRequest(scope, context) {
@@ -3092,12 +5064,12 @@ var HttpClient = class {
   }
   buildRequest(method, uri, options) {
     const verb = method.toUpperCase();
-    const url = new URL(uri, this.baseUrl());
+    const url2 = new URL(uri, this.baseUrl());
     const headers = new Headers({ ...this.headers, ...options.headers });
     let body;
     const data = options.data ?? {};
     if (verb === "GET" || verb === "HEAD") {
-      for (const [key, value] of flatten(data)) if (typeof value === "string") url.searchParams.append(key, value);
+      for (const [key, value] of flatten(data)) if (typeof value === "string") url2.searchParams.append(key, value);
     } else if (options.json) {
       body = JSON.stringify(data);
     } else if (Object.keys(data).length > 0) {
@@ -3116,7 +5088,7 @@ var HttpClient = class {
     }
     const cookies = this.cookieHeader();
     if (cookies !== "") headers.set("Cookie", cookies);
-    return new Request(url, { method: verb, headers, body });
+    return new Request(url2, { method: verb, headers, body });
   }
   baseUrl() {
     const configured = this.app.bound(ConfigRepository) ? this.app.make(ConfigRepository).get("app.url") : void 0;
@@ -3131,8 +5103,8 @@ var HttpClient = class {
     return cookieHeader(values);
   }
   /** Like a browser: cookies the app sets are sent back on later requests in the same test; deleted ones are dropped. */
-  rememberCookies(response) {
-    for (const cookie of responseCookies(response)) {
+  rememberCookies(response2) {
+    for (const cookie of responseCookies(response2)) {
       if (isExpired(cookie)) this.cookies.delete(cookie.name);
       else this.cookies.set(cookie.name, { value: cookie.value, encrypt: false });
     }
@@ -3141,9 +5113,9 @@ var HttpClient = class {
 function isRedirect(status) {
   return status >= 300 && status < 400 && status !== 304;
 }
-function setClientAddress(request, address) {
+function setClientAddress2(request2, address) {
   const g = globalThis;
-  (g[CLIENT_ADDRESS] ??= /* @__PURE__ */ new WeakMap()).set(request, address);
+  (g[CLIENT_ADDRESS] ??= /* @__PURE__ */ new WeakMap()).set(request2, address);
 }
 function flatten(data, prefix = "") {
   const out = [];
@@ -3239,11 +5211,43 @@ var InteractsWithApplication = class {
       if (global === app) Container.setInstance(void 0);
     }
   }
+  /**
+   * Laravel's withoutVite(): in this test's requests vite([...]) and viteReactRefresh() render nothing, so feature
+   * tests of pages pass before `vite build` has written public/build/manifest.json.
+   */
+  withoutVite() {
+    const app = this.app;
+    app.scoped(Vite, () => new WithoutVite(app));
+    return this;
+  }
   /** Runs in tearDown(), before the application is thrown away (in registration order). */
   beforeApplicationDestroyed(callback) {
     this.destroying.push(callback);
   }
 };
+var WithoutVite = class extends Vite {
+  tags() {
+    return new ViteHtml("");
+  }
+  reactRefresh() {
+    return void 0;
+  }
+  asset() {
+    return "";
+  }
+  content() {
+    return "";
+  }
+  manifestHash() {
+    return void 0;
+  }
+  preloadedAssets() {
+    return {};
+  }
+  toHtml() {
+    return "";
+  }
+};
 async function disconnectAll(db) {
   const manager = db;
   if (typeof manager.disconnectAll === "function") await manager.disconnectAll();
@@ -3258,6 +5262,11 @@ var MakesHttpRequests = class extends InteractsWithApplication {
   createHttpClient() {
     return new HttpClient(this.app);
   }
+  /** Live.test() runs in this test's request scope (Live reads the same token: no import between the packages). */
+  async setUp() {
+    await super.setUp();
+    this.app.instance(token("Testing.RequestScope"), (run) => this.http.withinRequest(run));
+  }
   async tearDown() {
     try {
       await super.tearDown();
@@ -3273,8 +5282,8 @@ var MakesHttpRequests = class extends InteractsWithApplication {
     this.http.headers[name] = value;
     return this;
   }
-  withToken(token, type = "Bearer") {
-    return this.withHeader("Authorization", `${type} ${token}`);
+  withToken(token2, type = "Bearer") {
+    return this.withHeader("Authorization", `${type} ${token2}`);
   }
   withBasicAuth(username, password) {
     return this.withToken(Buffer.from(`${username}:${password}`).toString("base64"), "Basic");
@@ -3305,9 +5314,9 @@ var MakesHttpRequests = class extends InteractsWithApplication {
     return this;
   }
   /** Sets the Referer and the session's previous URL, so redirect()->back() goes there. */
-  from(url) {
-    this.http.previousUrl = url;
-    return this.withHeader("Referer", url);
+  from(url2) {
+    this.http.previousUrl = url2;
+    return this.withHeader("Referer", url2);
   }
   /** Puts data in the session for the following requests (Laravel's withSession()). */
   withSession(data) {
@@ -3457,13 +5466,13 @@ var InteractsWithConsole = class extends InteractsWithDatabase {
 };
 var TestCase = class extends InteractsWithConsole {
 };
-function install(token, fake) {
-  facade(token).swap(fake);
+function install(token2, fake) {
+  facade(token2).swap(fake);
   return fake;
 }
-function bound(token) {
+function bound(token2) {
   const container = currentContainer();
-  return container !== void 0 && container.bound(token) ? container.make(token) : void 0;
+  return container !== void 0 && container.bound(token2) ? container.make(token2) : void 0;
 }
 function nameOf(target2) {
   if (typeof target2 === "string") return target2;
@@ -4159,8 +6168,8 @@ var AnonymousNotifiable = class {
   }
   dispatcher;
   routes = /* @__PURE__ */ new Map();
-  route(channel, route) {
-    this.routes.set(channel, route);
+  route(channel, route2) {
+    this.routes.set(channel, route2);
     return this;
   }
   routeNotificationFor(channel) {
@@ -4204,8 +6213,8 @@ var NotificationFake = class _NotificationFake {
   async sendNow(notifiables, notification, channels) {
     this.record(notifiables, notification, channels);
   }
-  route(channel, route) {
-    return new AnonymousNotifiable(this).route(channel, route);
+  route(channel, route2) {
+    return new AnonymousNotifiable(this).route(channel, route2);
   }
   /** The Notifications provider calls this in boot(); a fake has no channels to register. */
   extend(_channel, _factory) {
@@ -4626,6 +6635,70 @@ export {
   viteReactRefresh,
   Application2 as Application,
   ClosureKernel,
+  HttpException,
+  HttpResponseException,
+  HttpServerError,
+  exceedsJsonDepth,
+  requestScope,
+  currentRequest,
+  optionalSession,
+  optionalCookieJar,
+  HttpRedirectResponse,
+  HttpRedirector,
+  setClientAddress,
+  clientAddress,
+  extensionFromMime,
+  FormUploadedFile,
+  parseBracketKey,
+  normalizeLists,
+  fromEntries,
+  sanitize,
+  mergeRecursive,
+  isBlank,
+  transformLeaves,
+  ipMatches,
+  IncomingRequest,
+  request,
+  response,
+  redirect,
+  back,
+  url,
+  route,
+  abort,
+  abortIf,
+  abortUnless,
+  contentDisposition,
+  HttpResponseFactory,
+  ConvertEmptyStringsToNull,
+  TrimStrings,
+  Kernel,
+  MiddlewareConfiguration,
+  applyMiddlewareCallbacks,
+  statusText,
+  escapeHtml,
+  minimalPage,
+  stackFrames,
+  debugPage,
+  statusFor,
+  summarizeValidation,
+  ErrorHandler,
+  ExceptionsConfiguration,
+  applyExceptionCallbacks,
+  servePublicFile,
+  bunRuntime,
+  serveBun,
+  toWebRequest,
+  writeResponse,
+  serveNode,
+  detectRuntime,
+  serve,
+  routeListRows,
+  filterRouteList,
+  formatRouteList,
+  API_ROUTES_STUB,
+  addApiRouting,
+  registerHttpCommands,
+  HttpServiceProvider,
   On,
   Locked,
   Computed,
@@ -4638,10 +6711,13 @@ export {
   PropertyNotUpdatableError,
   LiveComponentNotFoundError,
   InvalidLiveRequestError,
+  TestRequestScope,
   Testable,
   live,
   Live,
   componentName,
+  PERSISTENT_MIDDLEWARE,
+  persistentMiddleware,
   LiveComponentManager,
   UPDATE_URI,
   LiveServiceProvider,
@@ -4690,4 +6766,4 @@ export {
   StorageFake,
   FakeFile
 };
-//# sourceMappingURL=chunk-I2OMKIQZ.js.map
+//# sourceMappingURL=chunk-SBZQ6L3Z.js.map