@orieljs/framework 0.1.0-alpha.3 → 0.1.0-alpha.4

package/dist/index.js

@@ -22,18 +22,32 @@ import {
   renderToString,
   styleString,
   view
-} from "./chunk-WEGTH46M.js";
+} from "./chunk-3DETYZMZ.js";
 import {
+  API_ROUTES_STUB,
   Application as Application2,
   ApplicationBuilder,
   BusFake,
   ClosureKernel,
   Component,
   Computed,
+  ConvertEmptyStringsToNull,
   CorruptComponentPayloadError,
   ErrorBag,
+  ErrorHandler,
   EventFake,
+  ExceptionsConfiguration,
+  FormUploadedFile,
+  HttpException,
+  HttpRedirectResponse,
+  HttpRedirector,
+  HttpResponseException,
+  HttpResponseFactory,
+  HttpServerError,
+  HttpServiceProvider,
+  IncomingRequest,
   InvalidLiveRequestError,
+  Kernel,
   Live,
   LiveComponentManager,
   LiveComponentNotFoundError,
@@ -42,8 +56,10 @@ import {
   Locked,
   MailFake,
   MethodNotCallableError,
+  MiddlewareConfiguration,
   NotificationFake,
   On,
+  PERSISTENT_MIDDLEWARE,
   PendingEvent,
   PropertyNotUpdatableError,
   ProviderBootError,
@@ -51,18 +67,69 @@ import {
   QueueFake,
   Repository,
   StorageFake,
+  TestRequestScope,
   Testable,
+  TrimStrings,
   UPDATE_URI,
   Vite,
   ViteError,
   ViteHtml,
+  abort,
+  abortIf,
+  abortUnless,
+  addApiRouting,
+  applyExceptionCallbacks,
+  applyMiddlewareCallbacks,
+  back,
+  bunRuntime,
+  clientAddress,
   componentName,
+  contentDisposition,
+  currentRequest,
   currentVite,
+  debugPage,
+  detectRuntime,
   env,
+  escapeHtml,
+  exceedsJsonDepth,
+  extensionFromMime,
+  filterRouteList,
+  formatRouteList,
+  fromEntries,
+  ipMatches,
+  isBlank,
   live,
+  mergeRecursive,
+  minimalPage,
+  normalizeLists,
+  optionalCookieJar,
+  optionalSession,
+  parseBracketKey,
+  persistentMiddleware,
+  redirect,
+  registerHttpCommands,
+  request,
+  requestScope,
+  response,
+  route,
+  routeListRows,
+  sanitize,
+  serve,
+  serveBun,
+  serveNode,
+  servePublicFile,
+  setClientAddress,
+  stackFrames,
+  statusFor,
+  statusText,
+  summarizeValidation,
+  toWebRequest,
+  transformLeaves,
+  url,
   vite,
-  viteReactRefresh
-} from "./chunk-I2OMKIQZ.js";
+  viteReactRefresh,
+  writeResponse
+} from "./chunk-SBZQ6L3Z.js";
 import {
   Arr,
   BindingResolutionError,
@@ -74,6 +141,7 @@ import {
   LazyCollection,
   ServiceProvider,
   Str,
+  __,
   app,
   collect,
   config,
@@ -84,7 +152,7 @@ import {
   retry,
   tap,
   value
-} from "./chunk-HU43NADT.js";
+} from "./chunk-DCI2T7WJ.js";
 import {
   Application,
   AuthFactory,
@@ -100,25 +168,22 @@ import {
   DatabaseManager,
   Encrypter,
   EventDispatcher,
-  ExceptionCallbacks,
   ExceptionHandler,
   FailedJobProvider,
   FilesystemManager,
   Gate,
   Hasher,
-  HttpKernel,
   HttpRequest,
   InertiaFactory,
   InertiaSsrGateway,
   LogManager,
   MailManager,
-  MiddlewareCallbacks,
   NotificationDispatcher,
   PasswordBroker,
   PipelineFactory,
   QueueManager,
+  RateLimiter,
   Redirector,
-  ResponseFactory,
   RouteModelResolver,
   Router,
   RoutingPaths,
@@ -128,12 +193,14 @@ import {
   ValidationFactory,
   ViewFactory,
   token
-} from "./chunk-S7YC43IH.js";
+} from "./chunk-WSGWYXAO.js";
 
 // ../Auth/dist/index.js
-import { timingSafeEqual } from "crypto";
 import { createHash } from "crypto";
 import { createHash as createHash2 } from "crypto";
+import { timingSafeEqual } from "crypto";
+import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import { createHmac } from "crypto";
 import { readdir } from "fs/promises";
 import { join } from "path";
@@ -213,6 +280,24 @@ var PasswordReset = class {
   }
   user;
 };
+var Registered = class {
+  constructor(user) {
+    this.user = user;
+  }
+  user;
+};
+var Verified = class {
+  constructor(user) {
+    this.user = user;
+  }
+  user;
+};
+var Lockout = class {
+  constructor(request2) {
+    this.request = request2;
+  }
+  request;
+};
 var createUrlCallback;
 var toMailCallback;
 var ResetPassword = class {
@@ -261,6 +346,83 @@ var ResetPassword = class {
     return `/reset-password/${encodeURIComponent(this.token)}?email=${encodeURIComponent(email)}`;
   }
 };
+var createUrlCallback2;
+var toMailCallback2;
+var VerifyEmail = class {
+  /** Build the verification URL yourself (e.g. for a SPA front end). */
+  static createUrlUsing(callback) {
+    createUrlCallback2 = callback;
+  }
+  /** Build the mail yourself (e.g. a MailMessage from the Notifications component). */
+  static toMailUsing(callback) {
+    toMailCallback2 = callback;
+  }
+  via() {
+    return ["mail"];
+  }
+  toMail(notifiable) {
+    const user = notifiable;
+    const url2 = this.verificationUrl(user);
+    if (toMailCallback2 !== void 0) return toMailCallback2(user, url2);
+    const mail = {
+      subject: "Verify Email Address",
+      lines: ["Please click the button below to verify your email address."],
+      actionText: "Verify Email Address",
+      actionUrl: url2,
+      outroLines: ["If you did not create an account, no further action is required."]
+    };
+    return mail;
+  }
+  verificationUrl(notifiable) {
+    if (createUrlCallback2 !== void 0) return createUrlCallback2(notifiable);
+    const container = currentContainer();
+    if (container === void 0 || !container.bound(UrlGenerator)) {
+      throw new Error("VerifyEmail needs the UrlGenerator (Routing) to sign the verification link.");
+    }
+    const config2 = container.bound(ConfigRepository) ? container.make(ConfigRepository) : void 0;
+    const minutes = Number(config2?.get("auth.verification.expire", 60) ?? 60);
+    const id = typeof notifiable.getKey === "function" ? notifiable.getKey() : notifiable.getAuthIdentifier?.();
+    const hash2 = createHash("sha1").update(notifiable.getEmailForVerification()).digest("hex");
+    return container.make(UrlGenerator).temporarySignedRoute("verification.verify", minutes * 60, { id, hash: hash2 });
+  }
+};
+var SendEmailVerificationNotification = class {
+  async handle(event2) {
+    const user = event2.user;
+    if (typeof user.hasVerifiedEmail !== "function" || typeof user.sendEmailVerificationNotification !== "function") return;
+    if (!user.hasVerifiedEmail()) await user.sendEmailVerificationNotification();
+  }
+};
+function equals(known, user) {
+  const a = Buffer.from(known);
+  const b = Buffer.from(user);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+var EmailVerificationRequest = class {
+  static async validate() {
+    if (!await new this().authorize()) throw new AuthorizationError();
+    return {};
+  }
+  authorize() {
+    const request2 = inject(HttpRequest);
+    const user = request2.user();
+    if (user === void 0 || user === null) return false;
+    const key = typeof user.getKey === "function" ? user.getKey() : user.getAuthIdentifier();
+    const hash2 = createHash2("sha1").update(user.getEmailForVerification()).digest("hex");
+    return equals(String(key), String(request2.route("id") ?? "")) && equals(hash2, String(request2.route("hash") ?? ""));
+  }
+  rules() {
+    return {};
+  }
+  /** Marks the signed-in user's email as verified and fires Verified, unless it already was. */
+  async fulfill() {
+    const user = inject(HttpRequest).user();
+    if (user === void 0 || user === null || user.hasVerifiedEmail()) return;
+    await user.markEmailAsVerified();
+    const container = currentContainer();
+    if (container?.bound(EventDispatcher)) await container.make(EventDispatcher).dispatch(new Verified(user));
+  }
+};
 var verificationSender;
 function sendEmailVerificationUsing(callback) {
   verificationSender = callback;
@@ -316,19 +478,13 @@ function AuthenticatableModel(Base) {
     getEmailForVerification() {
       return String(this.getAttribute("email") ?? "");
     }
+    /** Sends the VerifyEmail notification (a signed link), or what sendEmailVerificationUsing() configured. */
     async sendEmailVerificationNotification() {
-      if (verificationSender === void 0) {
-        throw new Error("No email verification sender is configured. Call sendEmailVerificationUsing() in a service provider.");
-      }
-      await verificationSender(this);
+      if (verificationSender !== void 0) return verificationSender(this);
+      return sendNotification(this, new VerifyEmail());
     }
   };
 }
-function equals(known, user) {
-  const a = Buffer.from(known);
-  const b = Buffer.from(user);
-  return a.length === b.length && timingSafeEqual(a, b);
-}
 var EloquentUserProvider = class {
   constructor(hasher, model) {
     this.hasher = hasher;
@@ -384,7 +540,7 @@ var EloquentUserProvider = class {
     return this.model;
   }
 };
-var GUARD_HASH = createHash("sha1").update("Oriel\\Auth\\SessionGuard").digest("hex");
+var GUARD_HASH = createHash3("sha1").update("Oriel\\Auth\\SessionGuard").digest("hex");
 var SessionGuard = class {
   constructor(name, provider, container, options = {}) {
     this.name = name;
@@ -531,8 +687,8 @@ var SessionGuard = class {
     const session2 = this.#session();
     if (session2 === void 0) return;
     session2.put(this.getName(), id);
-    const store2 = session2;
-    if (typeof store2.migrate === "function") await store2.migrate(true);
+    const store = session2;
+    if (typeof store.migrate === "function") await store.migrate(true);
     else await session2.regenerate(true);
   }
   async #cycleRememberToken(user) {
@@ -579,7 +735,7 @@ function parseStoredDate(value2) {
   }
   return Number.isNaN(date.getTime()) ? void 0 : date;
 }
-var sha256 = (value2) => createHash2("sha256").update(value2).digest("hex");
+var sha256 = (value2) => createHash4("sha256").update(value2).digest("hex");
 function tokenableType(user) {
   const container = currentContainer();
   const cls = user.constructor;
@@ -647,7 +803,7 @@ var TokenRepository = class {
   clock;
   async create(user, name, abilities = ["*"], expiresAt) {
     const secret = Str.random(40);
-    const now4 = this.clock();
+    const now5 = this.clock();
     const attributes = {
       tokenable_type: tokenableType(user),
       tokenable_id: user.getAuthIdentifier(),
@@ -656,8 +812,8 @@ var TokenRepository = class {
       abilities: JSON.stringify(abilities),
       last_used_at: null,
       expires_at: expiresAt ?? null,
-      created_at: now4,
-      updated_at: now4
+      created_at: now5,
+      updated_at: now5
     };
     const id = await this.#query().insertGetId(attributes);
     return { accessToken: new PersonalAccessToken({ id, ...attributes }, this), plainTextToken: `${id}|${secret}` };
@@ -678,9 +834,9 @@ var TokenRepository = class {
   }
   /** Records the token's use (last_used_at). */
   async touch(token2) {
-    const now4 = this.clock();
-    token2.attributes.last_used_at = now4;
-    await this.#query().where("id", token2.id).update({ last_used_at: now4 });
+    const now5 = this.clock();
+    token2.attributes.last_used_at = now5;
+    await this.#query().where("id", token2.id).update({ last_used_at: now5 });
   }
   async tokensFor(user) {
     const rows = await this.#query().where("tokenable_type", tokenableType(user)).where("tokenable_id", user.getAuthIdentifier()).get();
@@ -790,15 +946,15 @@ var TokenGuard = class {
     return { user, token: token2 };
   }
   #isValid(token2) {
-    const now4 = (this.options.clock ?? (() => /* @__PURE__ */ new Date()))().getTime();
+    const now5 = (this.options.clock ?? (() => /* @__PURE__ */ new Date()))().getTime();
     const expiresAt = token2.expiresAt;
     const rawExpiresAt = token2.attributes.expires_at;
     if (rawExpiresAt !== null && rawExpiresAt !== void 0 && expiresAt === void 0) return false;
-    if (expiresAt !== void 0 && expiresAt.getTime() <= now4) return false;
+    if (expiresAt !== void 0 && expiresAt.getTime() <= now5) return false;
     const expiration = this.options.expiration;
     if (typeof expiration === "number") {
       const createdAt = token2.createdAt;
-      if (createdAt === void 0 || createdAt.getTime() + expiration * 6e4 <= now4) return false;
+      if (createdAt === void 0 || createdAt.getTime() + expiration * 6e4 <= now5) return false;
     }
     return true;
   }
@@ -1496,6 +1652,7 @@ var AuthServiceProvider = class extends ServiceProvider {
     if (this.app.bound(Router)) {
       this.app.make(Router).aliasMiddleware("auth", Authenticate).aliasMiddleware("guest", RedirectIfAuthenticated).aliasMiddleware("can", Authorize).aliasMiddleware("verified", EnsureEmailIsVerified);
     }
+    if (this.app.bound(EventDispatcher)) this.app.make(EventDispatcher).listen(Registered, SendEmailVerificationNotification);
     await discoverPolicies(this.app.appPath("Policies"), this.app.make(Gate));
   }
 };
@@ -1568,11 +1725,11 @@ var UniqueLock = class _UniqueLock {
   async acquire(job) {
     const members = job;
     const uniqueFor = typeof members.uniqueFor === "function" ? members.uniqueFor.call(job) : members.uniqueFor ?? 0;
-    const store2 = members.uniqueVia?.call(job);
+    const store = members.uniqueVia?.call(job);
     const key = _UniqueLock.key(job);
-    if (!await this.store(store2).lock(key, uniqueFor > 0 ? uniqueFor : void 0).get()) return void 0;
+    if (!await this.store(store).lock(key, uniqueFor > 0 ? uniqueFor : void 0).get()) return void 0;
     const spec = { key, untilProcessing: members.uniqueUntilProcessing === true };
-    if (store2 !== void 0) spec.store = store2;
+    if (store !== void 0) spec.store = store;
     return spec;
   }
   async release(spec) {
@@ -1918,7 +2075,7 @@ var BusServiceProvider = class extends ServiceProvider {
 
 // ../Cache/dist/index.js
 import { setTimeout as sleep } from "timers/promises";
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import { link, mkdir, readFile, rename, rm, stat, writeFile } from "fs/promises";
 import { dirname, join as join2 } from "path";
 import { setTimeout as sleep2 } from "timers/promises";
@@ -1939,8 +2096,8 @@ var TagsNotSupportedError = class extends Error {
   kind = "Server";
   status = 500;
   name = "TagsNotSupportedError";
-  constructor(store2) {
-    super(`The [${store2}] cache store does not support tags. Only the redis store does.`);
+  constructor(store) {
+    super(`The [${store}] cache store does not support tags. Only the redis store does.`);
   }
 };
 var UnknownCacheStoreError = class extends Error {
@@ -1974,8 +2131,8 @@ function roundTrip(value2) {
   return JSON.parse(serialize(value2));
 }
 var GenericLock = class {
-  constructor(store2, name, seconds, owner, pollMs = 50) {
-    this.store = store2;
+  constructor(store, name, seconds, owner, pollMs = 50) {
+    this.store = store;
     this.name = name;
     this.seconds = seconds;
     this.pollMs = pollMs;
@@ -2022,10 +2179,10 @@ var GenericLock = class {
     await this.store.forget(this.name);
   }
 };
-var defaultLockFactory = (store2, name, seconds, owner) => new GenericLock(store2, name, seconds, owner);
+var defaultLockFactory = (store, name, seconds, owner) => new GenericLock(store, name, seconds, owner);
 var Repository2 = class {
-  constructor(store2, lockFactory = defaultLockFactory) {
-    this.store = store2;
+  constructor(store, lockFactory = defaultLockFactory) {
+    this.store = store;
     this.lockFactory = lockFactory;
   }
   store;
@@ -2195,7 +2352,7 @@ var FileStore = class {
   directory;
   keyPrefix;
   path(key) {
-    const hash2 = createHash3("sha1").update(this.keyPrefix + key).digest("hex");
+    const hash2 = createHash5("sha1").update(this.keyPrefix + key).digest("hex");
     return join2(this.directory, hash2.slice(0, 2), hash2.slice(2, 4), hash2);
   }
   tempPath(path) {
@@ -2366,8 +2523,8 @@ var FileStore = class {
 };
 async function insertOrTakeOver(connection, table, row) {
   if (await connection.table(table).insertOrIgnore(row) === 1) return true;
-  const now4 = Math.floor(Date.now() / 1e3);
-  return await connection.table(table).where("key", row.key).where("expiration", "<=", now4).update(row) > 0;
+  const now5 = Math.floor(Date.now() / 1e3);
+  return await connection.table(table).where("key", row.key).where("expiration", "<=", now5).update(row) > 0;
 }
 var FOREVER_SECONDS = 31536e4;
 var now22 = () => Math.floor(Date.now() / 1e3);
@@ -2799,8 +2956,8 @@ var CacheManager2 = class {
     const table = cfg.table ?? "cache";
     const lockTable = cfg.lockTable ?? "cache_locks";
     const prefix = this.str(cfg.prefix);
-    const store2 = new DatabaseStore(connection, table, prefix);
-    return new Repository2(store2, (_store, name, seconds, owner) => new DatabaseLock(connection, lockTable, prefix + name, seconds, owner));
+    const store = new DatabaseStore(connection, table, prefix);
+    return new Repository2(store, (_store, name, seconds, owner) => new DatabaseLock(connection, lockTable, prefix + name, seconds, owner));
   }
   buildRedisStore(cfg) {
     const resolved = resolveRedisConfig(
@@ -2808,8 +2965,8 @@ var CacheManager2 = class {
       (connectionName) => this.container.make(ConfigRepository).get(`database.redis.${connectionName}`, {})
     );
     const redis = makeRedisClient(resolved);
-    const store2 = new RedisStore(redis, this.str(cfg.prefix));
-    return new RedisRepository(store2, redis);
+    const store = new RedisStore(redis, this.str(cfg.prefix));
+    return new RedisRepository(store, redis);
   }
   store(name) {
     const cacheConfig = this.cacheConfig();
@@ -2878,7 +3035,54 @@ var CacheManager2 = class {
     return this.store().tags(names);
   }
 };
+var now4 = () => Math.floor(Date.now() / 1e3);
+var CacheRateLimiter = class {
+  constructor(store) {
+    this.store = store;
+  }
+  store;
+  async tooManyAttempts(key, maxAttempts) {
+    const clean = this.cleanKey(key);
+    if (await this.#attempts(clean) >= maxAttempts) {
+      if (await this.store().has(`${clean}:timer`)) return true;
+      await this.store().forget(clean);
+    }
+    return false;
+  }
+  async hit(key, decaySeconds = 60) {
+    const clean = this.cleanKey(key);
+    const cache2 = this.store();
+    await cache2.add(`${clean}:timer`, now4() + decaySeconds, decaySeconds);
+    const added = await cache2.add(clean, 0, decaySeconds);
+    const hits = await cache2.increment(clean);
+    if (!added && hits === 1) await cache2.put(clean, 1, decaySeconds);
+    return hits;
+  }
+  attempts(key) {
+    return this.#attempts(this.cleanKey(key));
+  }
+  async remaining(key, maxAttempts) {
+    return Math.max(0, maxAttempts - await this.#attempts(this.cleanKey(key)));
+  }
+  async availableIn(key) {
+    const timer = await this.store().get(`${this.cleanKey(key)}:timer`);
+    return timer === void 0 ? 0 : Math.max(0, Number(timer) - now4());
+  }
+  async clear(key) {
+    const clean = this.cleanKey(key);
+    await this.store().forget(clean);
+    await this.store().forget(`${clean}:timer`);
+  }
+  /** Laravel's cleanRateLimiterKey(): accented letters become their plain letter ('zoë' and 'zoe' share a key). */
+  cleanKey(key) {
+    return key.normalize("NFKD").replace(/[̀-ͯ]/g, "");
+  }
+  async #attempts(clean) {
+    return Number(await this.store().get(clean) ?? 0);
+  }
+};
 var Cache = facade(CacheManager);
+var RateLimiter2 = facade(RateLimiter);
 function cache(arg, ttlSeconds) {
   const manager2 = inject(CacheManager);
   if (arg === void 0) return manager2;
@@ -2906,6 +3110,12 @@ var CacheServiceProvider = class extends ServiceProvider {
       "cache"
     );
     this.app.singleton(CacheManager, (container) => new CacheManager2(container));
+    this.app.singleton(RateLimiter, (container) => {
+      return new CacheRateLimiter(() => {
+        const name = container.make(ConfigRepository).get("cache.limiter", void 0);
+        return container.make(CacheManager).store(name === void 0 || name === "" ? void 0 : name);
+      });
+    });
   }
 };
 
@@ -2920,7 +3130,7 @@ import { start } from "repl";
 import { existsSync as existsSync2, readdirSync } from "fs";
 import { join as join4 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 import { CronExpressionParser } from "cron-parser";
 var InvalidSignatureError = class extends Error {
   name = "InvalidSignatureError";
@@ -2990,7 +3200,7 @@ var NodeConsoleInput = class {
     const line = this.lines.shift();
     if (line !== void 0) return line;
     if (this.ended) throw new Error("Aborted.");
-    return new Promise((resolve4, reject) => this.waiting.push({ resolve: resolve4, reject }));
+    return new Promise((resolve3, reject) => this.waiting.push({ resolve: resolve3, reject }));
   }
   close() {
     const rl = this.rl;
@@ -3035,11 +3245,11 @@ var Command = class {
   consoleOutput = new NodeConsoleOutput();
   consoleInput = new NodeConsoleInput();
   /** @internal Set by the kernel before handle() runs. */
-  bind(args, options, io2) {
+  bind(args, options, io) {
     this.boundArguments = args;
     this.boundOptions = options;
-    this.consoleInput = io2.input;
-    this.consoleOutput = io2.output;
+    this.consoleInput = io.input;
+    this.consoleOutput = io.output;
   }
   argument(name) {
     return this.boundArguments[name];
@@ -4009,15 +4219,15 @@ var ScheduleListCommand = class extends Command {
 function summaryOf(event2) {
   return event2.getSummary();
 }
-async function runDueEvents(events, io2, now4) {
+async function runDueEvents(events, io, now5) {
   const backgroundRuns = [];
   for (const event2 of events) {
-    io2.info(`Running scheduled task: ${summaryOf(event2)}`);
+    io.info(`Running scheduled task: ${summaryOf(event2)}`);
     const attempt = async () => {
       try {
-        await event2.run(now4);
+        await event2.run(now5);
       } catch (error) {
-        io2.error(`  Failed: ${error instanceof Error ? error.message : String(error)}`);
+        io.error(`  Failed: ${error instanceof Error ? error.message : String(error)}`);
       }
     };
     if (event2.isBackground()) {
@@ -4032,13 +4242,13 @@ var ScheduleRunCommand = class extends Command {
   signature = "schedule:run";
   description = "Run the scheduled commands";
   async handle() {
-    const now4 = /* @__PURE__ */ new Date();
-    const due = inject(Schedule).dueEvents(now4);
+    const now5 = /* @__PURE__ */ new Date();
+    const due = inject(Schedule).dueEvents(now5);
     if (due.length === 0) {
       this.info("No scheduled commands are ready to run.");
       return 0;
     }
-    await runDueEvents(due, this, now4);
+    await runDueEvents(due, this, now5);
     return 0;
   }
 };
@@ -4052,7 +4262,7 @@ var ScheduleWorkCommand = class extends Command {
   description = "Start the schedule worker";
   async handle() {
     const schedule = inject(Schedule);
-    const sleep5 = this.workOptions.sleep ?? ((ms) => new Promise((resolve4) => setTimeout(resolve4, ms)));
+    const sleep5 = this.workOptions.sleep ?? ((ms) => new Promise((resolve3) => setTimeout(resolve3, ms)));
     const clock = this.workOptions.now ?? Date.now;
     this.info("Running scheduled tasks every minute.");
     let lastMinute;
@@ -4061,8 +4271,8 @@ var ScheduleWorkCommand = class extends Command {
       const minute = Math.floor(time / 6e4);
       if (minute !== lastMinute) {
         lastMinute = minute;
-        const now4 = new Date(time);
-        await runDueEvents(schedule.dueEvents(now4), this, now4);
+        const now5 = new Date(time);
+        await runDueEvents(schedule.dueEvents(now5), this, now5);
       }
       await sleep5(Math.max(0, (minute + 1) * 6e4 - clock()) + 10);
     }
@@ -4085,13 +4295,13 @@ var TestCommand = class extends Command {
     if (typeof filter === "string") args.push("--testNamePattern", filter);
     const extra = this.argument("args");
     if (Array.isArray(extra)) args.push(...extra);
-    return new Promise((resolve4) => {
+    return new Promise((resolve3) => {
       const child = this.spawner("npx", args);
       child.on("error", (error) => {
         this.error(error.message);
-        resolve4(1);
+        resolve3(1);
       });
-      child.on("exit", (code) => resolve4(code ?? 1));
+      child.on("exit", (code) => resolve3(code ?? 1));
     });
   }
 };
@@ -4106,10 +4316,10 @@ var TinkerCommand = class extends Command {
   handle() {
     const app2 = inject(Application);
     const startRepl = this.tinkerOptions.start ?? ((options) => start(options));
-    return new Promise((resolve4) => {
+    return new Promise((resolve3) => {
       const repl = startRepl({ prompt: "oriel> " });
       repl.context.app = app2;
-      repl.on("exit", () => resolve4(0));
+      repl.on("exit", () => resolve3(0));
     });
   }
 };
@@ -4201,11 +4411,11 @@ function parametersToInput(parameters, signature) {
   }
   return { arguments: args, options };
 }
-var Kernel = class {
-  constructor(app2, io2 = {}) {
+var Kernel2 = class {
+  constructor(app2, io = {}) {
     this.app = app2;
-    this.defaultInput = io2.input ?? new NodeConsoleInput();
-    this.defaultOutput = io2.output ?? new NodeConsoleOutput();
+    this.defaultInput = io.input ?? new NodeConsoleInput();
+    this.defaultOutput = io.output ?? new NodeConsoleOutput();
   }
   app;
   commands = /* @__PURE__ */ new Map();
@@ -4238,22 +4448,22 @@ var Kernel = class {
     return code;
   }
   /** @internal Runs a command with the given I/O. Command.call() passes its own, so nested output isn't swallowed. */
-  async callWithIo(command, parameters, io2) {
+  async callWithIo(command, parameters, io) {
     const instance = this.findOrThrow(command);
     const signature = parseSignature(instance.signature);
-    return this.execute(instance, signature, parametersToInput(parameters, signature), io2);
+    return this.execute(instance, signature, parametersToInput(parameters, signature), io);
   }
   async handle(argv) {
-    const io2 = { input: this.defaultInput, output: this.defaultOutput };
+    const io = { input: this.defaultInput, output: this.defaultOutput };
     this.running++;
     try {
       const [name, ...rest] = this.normalizeTopLevel(argv);
       const instance = this.findOrThrow(name);
       const signature = parseSignature(instance.signature);
       const input = parseArgv(rest, signature);
-      return await this.execute(instance, signature, input, io2);
+      return await this.execute(instance, signature, input, io);
     } catch (error) {
-      return this.reportTopLevelError(error, io2.output);
+      return this.reportTopLevelError(error, io.output);
     } finally {
       if (--this.running === 0) this.defaultInput.close?.();
     }
@@ -4295,10 +4505,10 @@ var Kernel = class {
       throw new CommandNotFoundError(`Command "${name}" is not defined.`, suggest(name, [...this.commands.keys()]));
     return instance;
   }
-  async execute(instance, signature, input, io2) {
+  async execute(instance, signature, input, io) {
     validateRequiredArguments(signature, input);
     const run = Object.create(instance);
-    run.bind?.(resolveArguments(signature, input), resolveOptions(signature, input), io2);
+    run.bind?.(resolveArguments(signature, input), resolveOptions(signature, input), io);
     const scope = this.app.createScope();
     scope.instance(ConsoleKernel, this);
     return scope.run(async () => {
@@ -4331,7 +4541,7 @@ function parseTime(time) {
   return [minute, hour];
 }
 function sha1(value2) {
-  return createHash4("sha1").update(value2).digest("hex");
+  return createHash6("sha1").update(value2).digest("hex");
 }
 var ScheduledEventImpl = class {
   /**
@@ -4470,21 +4680,21 @@ var ScheduledEventImpl = class {
    * Minute precision: `now` is truncated to the start of its minute, since cron-parser's includesDate() also
    * compares seconds. Without timezone(), expressions are read in app.timezone (UTC by default), as in Laravel.
    */
-  isDue(now4) {
-    const minute = new Date(Math.floor(now4.getTime() / 6e4) * 6e4);
+  isDue(now5) {
+    const minute = new Date(Math.floor(now5.getTime() / 6e4) * 6e4);
     const parsed = CronExpressionParser.parse(this.cronExpression, { tz: this.zone() });
     if (!parsed.includesDate(minute)) return false;
-    return !this.betweenWindow || this.isWithinWindow(now4);
+    return !this.betweenWindow || this.isWithinWindow(now5);
   }
   zone() {
     if (this.tz !== void 0) return this.tz;
     const container = currentContainer();
     return container?.bound(ConfigRepository) ? container.make(ConfigRepository).get("app.timezone", "UTC") : "UTC";
   }
-  isWithinWindow(now4) {
+  isWithinWindow(now5) {
     const { start: start2, end } = this.betweenWindow;
     const format = (d) => d.toLocaleTimeString("en-GB", { hour: "2-digit", minute: "2-digit", hour12: false, timeZone: this.zone() });
-    const current = format(now4);
+    const current = format(now5);
     return start2 <= end ? current >= start2 && current <= end : current >= start2 || current <= end;
   }
   /**
@@ -4574,8 +4784,8 @@ var ScheduleImpl = class {
   events() {
     return [...this.scheduledEvents];
   }
-  dueEvents(now4) {
-    return this.scheduledEvents.filter((event2) => event2.isDue(now4));
+  dueEvents(now5) {
+    return this.scheduledEvents.filter((event2) => event2.isDue(now5));
   }
   push(event2) {
     this.scheduledEvents.push(event2);
@@ -4585,7 +4795,7 @@ var ScheduleImpl = class {
 var ConsoleServiceProvider = class extends ServiceProvider {
   register() {
     this.mergeConfigFrom({ stubs: {} }, "console");
-    this.app.singleton(ConsoleKernel, () => new Kernel(this.app));
+    this.app.singleton(ConsoleKernel, () => new Kernel2(this.app));
     this.app.singleton(Schedule, () => new ScheduleImpl());
   }
   boot() {
@@ -4644,14 +4854,14 @@ async function runConsoleAndExit(app2, argv = process.argv.slice(2), exit = (cod
 // ../Cookie/dist/index.js
 import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var SAME_SITE = { lax: "Lax", strict: "Strict", none: "None" };
-function serializeCookie(cookie2, now4 = Date.now()) {
+function serializeCookie(cookie2, now5 = Date.now()) {
   const parts = [];
   if (cookie2.minutes < 0) {
     parts.push(`${cookie2.name}=`, "Expires=Thu, 01 Jan 1970 00:00:00 GMT", "Max-Age=0");
   } else {
     parts.push(`${cookie2.name}=${encodeURIComponent(cookie2.value)}`);
     if (cookie2.minutes > 0) {
-      parts.push(`Expires=${new Date(now4 + cookie2.minutes * 6e4).toUTCString()}`, `Max-Age=${cookie2.minutes * 60}`);
+      parts.push(`Expires=${new Date(now5 + cookie2.minutes * 6e4).toUTCString()}`, `Max-Age=${cookie2.minutes * 60}`);
     }
   }
   parts.push(`Path=${cookie2.path}`);
@@ -4774,14 +4984,14 @@ var AddQueuedCookiesToResponse = class {
   }
 };
 var neverEncrypt = /* @__PURE__ */ new Set();
-function isDeletion(attributes, now4 = Date.now()) {
+function isDeletion(attributes, now5 = Date.now()) {
   for (const part of attributes.split(";")) {
     const equals4 = part.indexOf("=");
     if (equals4 === -1) continue;
     const key = part.slice(0, equals4).trim().toLowerCase();
     const value2 = part.slice(equals4 + 1).trim();
     if (key === "max-age" && Number(value2) <= 0) return true;
-    if (key === "expires" && Date.parse(value2) <= now4) return true;
+    if (key === "expires" && Date.parse(value2) <= now5) return true;
   }
   return false;
 }
@@ -8484,9 +8694,9 @@ var BelongsToMany = class extends Relation {
   pivotRow(id, attributes, creating) {
     const row = { ...attributes, [this.foreignPivotKey]: this.getParentKey(), [this.relatedPivotKey]: this.idOf(id) };
     if (this.pivotTimestamps && creating) {
-      const now4 = formatDateTime(this.parent.freshTimestamp());
-      row[this.pivotTimestamps[0]] ??= now4;
-      row[this.pivotTimestamps[1]] ??= now4;
+      const now5 = formatDateTime(this.parent.freshTimestamp());
+      row[this.pivotTimestamps[0]] ??= now5;
+      row[this.pivotTimestamps[1]] ??= now5;
     }
     return row;
   }
@@ -9876,9 +10086,9 @@ var Model = class _Model {
   }
   /** The current time, to the second (the storage precision). */
   freshTimestamp() {
-    const now4 = /* @__PURE__ */ new Date();
-    now4.setMilliseconds(0);
-    return now4;
+    const now5 = /* @__PURE__ */ new Date();
+    now5.setMilliseconds(0);
+    return now5;
   }
   updateTimestamps() {
     const time = this.freshTimestamp();
@@ -11243,7 +11453,7 @@ function databaseConfigDefaults(app2) {
     }
   };
 }
-function currentRequest() {
+function currentRequest2() {
   const container = currentContainer();
   if (!container?.bound(HttpRequest)) return void 0;
   try {
@@ -11253,13 +11463,13 @@ function currentRequest() {
   }
 }
 function usePaginationResolvers() {
-  AbstractPaginator.currentPathResolver = () => currentRequest()?.url() ?? "/";
+  AbstractPaginator.currentPathResolver = () => currentRequest2()?.url() ?? "/";
   AbstractPaginator.currentPageResolver = (pageName) => {
-    const page = Number(currentRequest()?.input(pageName));
+    const page = Number(currentRequest2()?.input(pageName));
     return Number.isInteger(page) && page >= 1 ? page : 1;
   };
-  AbstractPaginator.queryStringResolver = () => currentRequest()?.query() ?? {};
-  AbstractPaginator.currentCursorResolver = (cursorName) => currentRequest()?.input(cursorName);
+  AbstractPaginator.queryStringResolver = () => currentRequest2()?.query() ?? {};
+  AbstractPaginator.currentCursorResolver = (cursorName) => currentRequest2()?.input(cursorName);
 }
 var DatabaseServiceProvider = class extends ServiceProvider {
   register() {
@@ -12679,1866 +12889,93 @@ var HashingServiceProvider = class extends ServiceProvider {
   }
 };
 
-// ../Http/dist/index.js
-import { createReadStream as createReadStream2 } from "fs";
-import { stat as stat3 } from "fs/promises";
-import { basename as basename2 } from "path";
-import { Readable as Readable2 } from "stream";
-import { readFile as readFile4 } from "fs/promises";
-import { fileURLToPath } from "url";
-import { createReadStream as createReadStream22 } from "fs";
-import { stat as stat22 } from "fs/promises";
-import { Readable as Readable22 } from "stream";
-import { relative as relative5, resolve as resolve3, sep as sep4 } from "path";
-import { createServer } from "http";
-import { Readable as Readable3 } from "stream";
-import { pipeline as pipeline2 } from "stream/promises";
+// ../Inertia/dist/index.js
 import { existsSync as existsSync7 } from "fs";
-import { mkdir as mkdir5, readFile as readFile22, writeFile as writeFile6 } from "fs/promises";
-import { dirname as dirname5 } from "path";
-var HttpException = class extends Error {
-  constructor(status, message = "", headers = {}) {
-    super(message);
-    this.status = status;
-    this.headers = headers;
-  }
-  status;
-  headers;
-  kind = "Http";
-  name = "HttpException";
+import { join as join10 } from "path";
+import { createHash as createHash7 } from "crypto";
+import { existsSync as existsSync23, readFileSync } from "fs";
+import { spawn as spawn2 } from "child_process";
+import { existsSync as existsSync33 } from "fs";
+import { mkdir as mkdir5, writeFile as writeFile6 } from "fs/promises";
+import { dirname as dirname5, isAbsolute as isAbsolute2, join as join24, relative as relative5 } from "path";
+import { existsSync as existsSync42, readFileSync as readFileSync2 } from "fs";
+var Header = {
+  INERTIA: "X-Inertia",
+  ERROR_BAG: "X-Inertia-Error-Bag",
+  LOCATION: "X-Inertia-Location",
+  REDIRECT: "X-Inertia-Redirect",
+  VERSION: "X-Inertia-Version",
+  PARTIAL_COMPONENT: "X-Inertia-Partial-Component",
+  PARTIAL_ONLY: "X-Inertia-Partial-Data",
+  PARTIAL_EXCEPT: "X-Inertia-Partial-Except",
+  RESET: "X-Inertia-Reset",
+  INFINITE_SCROLL_MERGE_INTENT: "X-Inertia-Infinite-Scroll-Merge-Intent",
+  EXCEPT_ONCE_PROPS: "X-Inertia-Except-Once-Props"
 };
-var HttpResponseException = class extends Error {
-  constructor(response2) {
-    super(`HTTP response exception (${response2.status}).`);
-    this.response = response2;
-    this.status = response2.status;
+function parseList(value2) {
+  const items = (value2 ?? "").split(",").filter((item) => item !== "");
+  return items.length === 0 ? void 0 : items;
+}
+var Prop = class {
+  constructor(value2) {
+    this.value = value2;
   }
-  response;
-  kind = "Http";
-  name = "HttpResponseException";
-  status;
-};
-var HttpServerError = class extends Error {
-  kind = "Server";
-  status = 500;
-  name = "HttpServerError";
-};
-async function readBody2(raw3, limit) {
-  if (raw3.body === null) return new Uint8Array(0);
-  const declared = Number(raw3.headers.get("content-length") ?? NaN);
-  if (limit !== null && Number.isFinite(declared) && declared > limit) {
-    await raw3.body.cancel();
-    throw new HttpException(413, "Content Too Large");
+  value;
+  mergeState = { merge: false, deep: false, append: true, appendPaths: [], prependPaths: [], matchOn: [] };
+  onceState = { once: false, fresh: false, key: void 0, ttlSeconds: void 0 };
+  deferred = false;
+  deferGroup;
+  /** Calls the callback, if the value is one. */
+  async resolve() {
+    return typeof this.value === "function" ? await this.value() : this.value;
   }
-  const reader = raw3.body.getReader();
-  const chunks = [];
-  let size = 0;
-  for (; ; ) {
-    const { done, value: value2 } = await reader.read();
-    if (done) break;
-    size += value2.byteLength;
-    if (limit !== null && size > limit) {
-      await reader.cancel();
-      throw new HttpException(413, "Content Too Large");
-    }
-    chunks.push(value2);
+  /** Never sent on the first load (OptionalProp, DeferProp). */
+  ignoresFirstLoad() {
+    return false;
   }
-  const out = new Uint8Array(size);
-  let offset = 0;
-  for (const chunk of chunks) {
-    out.set(chunk, offset);
-    offset += chunk.byteLength;
+  /** Sent even when a partial reload didn't ask for it (AlwaysProp). */
+  isAlways() {
+    return false;
   }
-  return out;
-}
-function requestScope() {
-  const container = currentContainer();
-  return container !== void 0 && container.bound(HttpRequest) ? container : void 0;
-}
-function currentRequest2() {
-  return requestScope()?.make(HttpRequest);
-}
-function optionalSession() {
-  const scope = requestScope();
-  return scope?.bound(Session) ? scope.make(Session) : void 0;
-}
-function optionalCookieJar() {
-  const scope = requestScope();
-  return scope?.bound(CookieJar) ? scope.make(CookieJar) : void 0;
-}
-function serializeCookie2(cookie2) {
-  const parts = [`${encodeURIComponent(cookie2.name)}=${encodeURIComponent(cookie2.value)}`, `Path=${cookie2.path}`];
-  if (cookie2.domain !== void 0) parts.push(`Domain=${cookie2.domain}`);
-  if (cookie2.secure) parts.push("Secure");
-  if (cookie2.httpOnly) parts.push("HttpOnly");
-  parts.push(`SameSite=${cookie2.sameSite.charAt(0).toUpperCase()}${cookie2.sameSite.slice(1)}`);
-  if (cookie2.minutes < 0) parts.push("Max-Age=0", "Expires=Thu, 01 Jan 1970 00:00:00 GMT");
-  else if (cookie2.minutes > 0) parts.push(`Max-Age=${Math.round(cookie2.minutes * 60)}`);
-  return parts.join("; ");
-}
-var HttpRedirectResponse = class {
-  constructor(targetUrl, status = 302, headers) {
-    this.targetUrl = targetUrl;
-    this.status = status;
-    this.#headers = new Headers(headers);
+  /** Errors are reported and the prop is left out, instead of failing the page (defer(..., { rescue: true })). */
+  shouldRescue() {
+    return false;
   }
-  targetUrl;
-  status;
-  #headers;
-  with(key, value2) {
-    const session2 = optionalSession();
-    if (session2 === void 0) return this;
-    if (typeof key === "string") session2.flash(key, value2);
-    else for (const [name, item] of Object.entries(key)) session2.flash(name, item);
+  // Once (honoured by OptionalProp, DeferProp, MergeProp and OnceProp) ------------------------------------
+  /** once(), once(false), once(true, { as: 'key', until: 3600 }). */
+  once(value2 = true, options = {}) {
+    this.onceState.once = value2;
+    if (options.as !== void 0) this.onceState.key = options.as;
+    if (options.until !== void 0) this.onceState.ttlSeconds = secondsUntil(options.until);
     return this;
   }
-  /** Flashes `errors` as { [bag]: { field: string[] } }, keeping the other bags already flashed. */
-  withErrors(errors2, bag = "default") {
-    const session2 = optionalSession();
-    if (session2 === void 0) return this;
-    const source = typeof errors2.toObject === "function" ? errors2.toObject() : errors2;
-    const normalized = Object.fromEntries(
-      Object.entries(source).map(([field, messages]) => [field, Array.isArray(messages) ? [...messages] : [messages]])
-    );
-    const existing = session2.get("errors", {});
-    session2.flash("errors", { ...existing, [bag]: normalized });
+  /** A custom once key, so pages can share the prop under different names. */
+  as(key) {
+    this.onceState.key = key;
     return this;
   }
-  /** Flashes `input`, or the current request's input (files are never part of input()). */
-  withInput(input) {
-    const session2 = optionalSession();
-    if (session2 === void 0) return this;
-    session2.flashInput(input ?? currentRequest2()?.input() ?? {});
+  /** Send the prop again even though the client already has it. */
+  fresh(value2 = true) {
+    this.onceState.fresh = value2;
     return this;
   }
-  /**
-   * Always a Set-Cookie header on this response (Laravel's RedirectResponse::withCookie). A bound CookieJar only
-   * supplies the defaults (path, domain, secure, same-site); queueing would lose the cookie outside the web group.
-   */
-  withCookie(name, value2, minutes = 0) {
-    const jar = optionalCookieJar();
-    const cookie2 = jar !== void 0 ? jar.make(name, value2, minutes) : { name, value: value2, minutes, path: "/", secure: false, httpOnly: true, sameSite: "lax" };
-    this.#headers.append("Set-Cookie", serializeCookie2(cookie2));
+  /** Expire after a number of seconds, or at a Date. */
+  until(delay) {
+    this.onceState.ttlSeconds = secondsUntil(delay);
     return this;
   }
-  header(name, value2) {
-    this.#headers.set(name, value2);
-    return this;
+  // Merging -------------------------------------------------------------------------------------------------
+  isMergeable() {
+    return false;
   }
-  toResponse() {
-    const headers = new Headers(this.#headers);
-    headers.set("Location", this.targetUrl);
-    return new Response(null, { status: this.status, headers });
+  shouldMerge() {
+    return this.isMergeable() && this.mergeState.merge;
   }
-};
-var HttpRedirector = class {
-  to(path, status = 302, headers) {
-    return new HttpRedirectResponse(inject(UrlGenerator).to(path), status, headers);
+  shouldDeepMerge() {
+    return this.mergeState.deep;
   }
-  route(name, parameters, status = 302) {
-    return new HttpRedirectResponse(inject(UrlGenerator).route(name, parameters), status);
-  }
-  back(fallback, status = 302) {
-    return new HttpRedirectResponse(inject(UrlGenerator).previous(fallback), status);
-  }
-  /** Pulls url.intended from the session (put there by guest()), else goes to `fallback`. */
-  intended(fallback = "/", status = 302) {
-    const path = optionalSession()?.pull("url.intended") ?? fallback;
-    return this.to(path, status);
-  }
-  away(url2, status = 302) {
-    return new HttpRedirectResponse(url2, status);
-  }
-  /** Remembers where a guest was going (a GET page, else the previous URL), then redirects to `path`. */
-  guest(path, status = 302) {
-    const session2 = optionalSession();
-    const request2 = currentRequest2();
-    if (session2 !== void 0) {
-      const intended = request2 !== void 0 && request2.method() === "GET" && !request2.expectsJson() ? request2.fullUrl() : inject(UrlGenerator).previous();
-      session2.put("url.intended", intended);
-    }
-    return this.to(path, status);
-  }
-  setIntendedUrl(url2) {
-    optionalSession()?.put("url.intended", url2);
-  }
-  refresh(status = 302) {
-    return this.to(currentRequest2()?.fullUrl() ?? inject(UrlGenerator).current(), status);
-  }
-};
-var KEY = /* @__PURE__ */ Symbol.for("oriel:http.client-address");
-var store = globalThis[KEY] ??= /* @__PURE__ */ new WeakMap();
-function setClientAddress(request2, address) {
-  if (address !== void 0 && address !== "") store.set(request2, address);
-}
-function clientAddress(request2) {
-  return store.get(request2);
-}
-var TYPES = {
-  avif: "image/avif",
-  css: "text/css",
-  csv: "text/csv",
-  doc: "application/msword",
-  docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-  gif: "image/gif",
-  gz: "application/gzip",
-  html: "text/html",
-  ico: "image/vnd.microsoft.icon",
-  jpg: "image/jpeg",
-  js: "text/javascript",
-  map: "application/json",
-  json: "application/json",
-  md: "text/markdown",
-  mp3: "audio/mpeg",
-  mp4: "video/mp4",
-  otf: "font/otf",
-  pdf: "application/pdf",
-  png: "image/png",
-  svg: "image/svg+xml",
-  ttf: "font/ttf",
-  txt: "text/plain",
-  wasm: "application/wasm",
-  webm: "video/webm",
-  webp: "image/webp",
-  woff: "font/woff",
-  woff2: "font/woff2",
-  xls: "application/vnd.ms-excel",
-  xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
-  xml: "application/xml",
-  zip: "application/zip"
-};
-var ALIASES = { jpeg: "jpg", htm: "html", mjs: "js", text: "txt" };
-var EXTENSIONS2 = Object.fromEntries(Object.entries(TYPES).map(([extension, type]) => [type, extension]));
-function mimeFromExtension2(pathOrExtension) {
-  const extension = pathOrExtension.slice(pathOrExtension.lastIndexOf(".") + 1).toLowerCase();
-  return TYPES[ALIASES[extension] ?? extension] ?? "application/octet-stream";
-}
-function extensionFromMime(type) {
-  return EXTENSIONS2[type.split(";")[0].trim().toLowerCase()];
-}
-var FormUploadedFile = class {
-  constructor(file) {
-    this.file = file;
-    this.clientName = file.name ?? "";
-    this.mimeType = file.type === "" ? "application/octet-stream" : file.type;
-    this.size = file.size;
-  }
-  file;
-  clientName;
-  mimeType;
-  size;
-  /** Guessed from the MIME type, falling back to the client's extension (Laravel's extension()). */
-  extension() {
-    return extensionFromMime(this.mimeType) ?? this.clientExtension();
-  }
-  clientExtension() {
-    const dot = this.clientName.lastIndexOf(".");
-    return dot === -1 ? "" : this.clientName.slice(dot + 1).toLowerCase();
-  }
-  /** A random 40-character name with the guessed extension. */
-  hashName() {
-    const extension = this.extension();
-    return extension === "" ? Str.random(40) : `${Str.random(40)}.${extension}`;
-  }
-  arrayBuffer() {
-    return this.file.arrayBuffer();
-  }
-  text() {
-    return this.file.text();
-  }
-  stream() {
-    return this.file.stream();
-  }
-  store(directory, disk) {
-    return inject(FilesystemManager).disk(disk).putFile(directory, this);
-  }
-  storeAs(directory, name, disk) {
-    return inject(FilesystemManager).disk(disk).putFileAs(directory, this, name);
-  }
-};
-var FORBIDDEN = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
-var INTEGER_KEY = /^(?:0|[1-9]\d*)$/;
-var isPlainObject2 = (value2) => {
-  if (typeof value2 !== "object" || value2 === null || Array.isArray(value2)) return false;
-  const prototype = Object.getPrototypeOf(value2);
-  return prototype === Object.prototype || prototype === null;
-};
-function parseBracketKey(name) {
-  const open = name.indexOf("[");
-  if (open <= 0 || !name.endsWith("]")) return [name];
-  const segments = [name.slice(0, open)];
-  const rest = name.slice(open);
-  const matches = rest.match(/\[[^[\]]*\]/g);
-  if (matches === null || matches.join("") !== rest) return [name];
-  for (const match of matches) segments.push(match.slice(1, -1));
-  return segments;
-}
-function normalizeLists(value2) {
-  if (Array.isArray(value2)) return value2.map(normalizeLists);
-  if (!isPlainObject2(value2)) return value2;
-  const keys = Object.keys(value2);
-  const out = {};
-  for (const key of keys) out[key] = normalizeLists(value2[key]);
-  if (keys.length > 0 && keys.every((key, index) => key === String(index))) return keys.map((key) => out[key]);
-  return out;
-}
-function fromEntries(entries) {
-  const root = {};
-  const nextIndex = /* @__PURE__ */ new WeakMap();
-  for (const [name, value2] of entries) {
-    const segments = parseBracketKey(name);
-    if (segments.some((segment) => FORBIDDEN.has(segment))) continue;
-    let node = root;
-    for (let i = 0; i < segments.length; i++) {
-      let segment = segments[i];
-      const next = nextIndex.get(node) ?? 0;
-      if (segment === "") {
-        segment = String(next);
-        nextIndex.set(node, next + 1);
-      } else if (INTEGER_KEY.test(segment) && Number(segment) >= next) {
-        nextIndex.set(node, Number(segment) + 1);
-      }
-      if (i === segments.length - 1) {
-        node[segment] = value2;
-        break;
-      }
-      if (!isPlainObject2(node[segment])) node[segment] = {};
-      node = node[segment];
-    }
-  }
-  return normalizeLists(root);
-}
-function sanitize(value2) {
-  if (Array.isArray(value2)) return value2.map(sanitize);
-  if (!isPlainObject2(value2)) return value2;
-  const out = {};
-  for (const [key, item] of Object.entries(value2)) if (!FORBIDDEN.has(key)) out[key] = sanitize(item);
-  return out;
-}
-function mergeRecursive(base, override) {
-  const out = { ...base };
-  for (const [key, value2] of Object.entries(override)) {
-    if (FORBIDDEN.has(key)) continue;
-    const current = out[key];
-    out[key] = (isPlainObject2(current) || Array.isArray(current)) && (isPlainObject2(value2) || Array.isArray(value2)) ? normalizeLists(mergeRecursive({ ...current }, { ...value2 })) : value2;
-  }
-  return out;
-}
-function isBlank(value2) {
-  if (value2 === null || value2 === void 0) return true;
-  if (typeof value2 === "string") return value2.trim() === "";
-  if (Array.isArray(value2)) return value2.length === 0;
-  if (isPlainObject2(value2)) return Object.keys(value2).length === 0;
-  return false;
-}
-function transformLeaves(tree, transform, prefix = "") {
-  const out = {};
-  for (const [key, value2] of Object.entries(tree)) out[key] = transformValue(`${prefix}${key}`, value2, transform);
-  return out;
-}
-function transformValue(path, value2, transform) {
-  if (Array.isArray(value2)) return value2.map((item, index) => transformValue(`${path}.${index}`, item, transform));
-  if (isPlainObject2(value2)) return transformLeaves(value2, transform, `${path}.`);
-  return transform(path, value2);
-}
-var TRUE_VALUES = /* @__PURE__ */ new Set(["1", "true", "on", "yes"]);
-var normalizeIp = (ip) => ip.trim().replace(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i, "$1");
-function ipv4ToNumber(ip) {
-  const parts = ip.split(".");
-  if (parts.length !== 4 || parts.some((part) => !/^\d{1,3}$/.test(part) || Number(part) > 255)) return void 0;
-  return parts.reduce((total, part) => total * 256 + Number(part), 0);
-}
-function ipMatches(ip, patterns) {
-  const address = normalizeIp(ip);
-  return patterns.some((pattern) => {
-    if (pattern === "*") return true;
-    if (!pattern.includes("/")) return normalizeIp(pattern) === address;
-    const [range, bits] = pattern.split("/");
-    const base = ipv4ToNumber(range);
-    const value2 = ipv4ToNumber(address);
-    const size = Number(bits);
-    if (base === void 0 || value2 === void 0 || !(size >= 0 && size <= 32)) return false;
-    const mask = size === 0 ? 0 : ~0 << 32 - size >>> 0;
-    return (base & mask) >>> 0 === (value2 & mask) >>> 0;
-  });
-}
-var IncomingRequest = class {
-  constructor(raw3, options = {}) {
-    this.raw = raw3;
-    this.#url = new URL(raw3.url);
-    this.#trustedProxies = options.trustedProxies ?? [];
-    this.#maxBodySize = options.maxBodySize === void 0 ? 8 * 1024 * 1024 : options.maxBodySize;
-    this.#query = fromEntries(this.#url.searchParams.entries());
-    this.#method = raw3.method.toUpperCase();
-  }
-  raw;
-  #url;
-  #trustedProxies;
-  #maxBodySize;
-  #query;
-  #body = {};
-  #files = {};
-  #content = "";
-  #method;
-  #cookies;
-  #loading;
-  #userResolver;
-  /** Reads and parses the body (JSON, urlencoded or multipart) once, then applies method spoofing. */
-  load() {
-    return this.#loading ??= this.#load();
-  }
-  async #load() {
-    const method = this.raw.method.toUpperCase();
-    if (method !== "GET" && method !== "HEAD" && this.raw.body !== null) {
-      const type = (this.raw.headers.get("content-type") ?? "").toLowerCase();
-      const isJson = type.includes("/json") || type.includes("+json");
-      const isUrlencoded = type.startsWith("application/x-www-form-urlencoded");
-      const isMultipart = type.startsWith("multipart/form-data");
-      if (isJson || isUrlencoded || isMultipart) {
-        const bytes = await readBody2(this.raw, this.#maxBodySize);
-        try {
-          if (isJson) {
-            this.#content = new TextDecoder().decode(bytes);
-            this.#body = this.#parseJson(this.#content);
-          } else if (isUrlencoded) {
-            this.#content = new TextDecoder().decode(bytes);
-            this.#body = fromEntries(new URLSearchParams(this.#content).entries());
-          } else {
-            this.#parseForm(await new Response(bytes, { headers: { "content-type": this.raw.headers.get("content-type") ?? "" } }).formData());
-          }
-        } catch {
-        }
-      }
-    }
-    if (method === "POST") {
-      const override = this.raw.headers.get("x-http-method-override") ?? this.#string(this.#body._method) ?? this.#string(this.#query._method);
-      const spoofed = override?.toUpperCase();
-      if (spoofed !== void 0 && /^[A-Z]+$/.test(spoofed) && !["GET", "HEAD", "CONNECT", "TRACE"].includes(spoofed)) {
-        this.#method = spoofed;
-      }
-    }
-    return this;
-  }
-  #parseJson(text3) {
-    let parsed;
-    try {
-      parsed = JSON.parse(text3);
-    } catch {
-      return {};
-    }
-    if (Array.isArray(parsed)) return sanitize({ ...parsed });
-    return isPlainObject2(parsed) ? sanitize(parsed) : {};
-  }
-  #parseForm(form) {
-    const fields = [];
-    const files3 = [];
-    for (const [name, value2] of form.entries()) {
-      if (typeof value2 === "string") fields.push([name, value2]);
-      else if (!((value2.name ?? "") === "" && value2.size === 0)) files3.push([name, new FormUploadedFile(value2)]);
-    }
-    this.#body = fromEntries(fields);
-    this.#files = fromEntries(files3);
-  }
-  #string(value2) {
-    return typeof value2 === "string" && value2 !== "" ? value2 : void 0;
-  }
-  method() {
-    return this.#method;
-  }
-  isMethod(method) {
-    return this.#method === method.toUpperCase();
-  }
-  /** The scheme and host, honouring X-Forwarded-Proto/Host from trusted proxies. */
-  root() {
-    const trusted = this.#fromTrustedProxy();
-    const proto = trusted ? this.raw.headers.get("x-forwarded-proto")?.split(",")[0]?.trim() : void 0;
-    const host = trusted ? this.raw.headers.get("x-forwarded-host")?.split(",")[0]?.trim() : void 0;
-    const scheme = proto === "https" || proto === "http" ? proto : this.#url.protocol.slice(0, -1);
-    return `${scheme}://${host !== void 0 && host !== "" ? host : this.#url.host}`;
-  }
-  /** The URL without the query string or a trailing slash. */
-  url() {
-    return `${this.root()}${this.#url.pathname}`.replace(/\/+$/, "");
-  }
-  fullUrl() {
-    return this.#url.search === "" ? this.url() : `${this.url()}${this.#url.search}`;
-  }
-  /** 'posts/1', or '/' for the root. */
-  path() {
-    const trimmed = this.#url.pathname.replace(/^\/+|\/+$/g, "");
-    return trimmed === "" ? "/" : trimmed;
-  }
-  decodedPath() {
-    try {
-      return decodeURIComponent(this.path());
-    } catch {
-      return this.path();
-    }
-  }
-  secure() {
-    return this.root().startsWith("https:");
-  }
-  /** request.is('admin/*'): wildcard match against the decoded path. */
-  is(...patterns) {
-    const path = this.decodedPath();
-    return patterns.some((pattern) => {
-      const trimmed = pattern.replace(/^\/+|\/+$/g, "");
-      return Str.is(trimmed === "" ? "/" : trimmed, path);
-    });
-  }
-  routeIs(...names) {
-    const name = this.#currentRoute()?.route.getName();
-    return name !== void 0 && names.some((pattern) => Str.is(pattern, name));
-  }
-  header(name, defaultValue) {
-    return this.raw.headers.get(name) ?? defaultValue;
-  }
-  bearerToken() {
-    const header = this.header("authorization", "");
-    const position = header.toLowerCase().lastIndexOf("bearer ");
-    if (position === -1) return void 0;
-    const token2 = header.slice(position + 7).split(",")[0].trim();
-    return token2 === "" ? void 0 : token2;
-  }
-  userAgent() {
-    return this.header("user-agent");
-  }
-  /** The socket address, or the right-most untrusted X-Forwarded-For entry when the socket is a trusted proxy. */
-  ip() {
-    const socket = clientAddress(this.raw);
-    if (socket === void 0) return void 0;
-    const address = normalizeIp(socket);
-    if (!this.#fromTrustedProxy()) return address;
-    const chain = (this.raw.headers.get("x-forwarded-for") ?? "").split(",").map((entry) => normalizeIp(entry)).filter((entry) => entry !== "");
-    for (let i = chain.length - 1; i >= 0; i--) if (!ipMatches(chain[i], this.#trustedProxies)) return chain[i];
-    return chain[0] ?? address;
-  }
-  #fromTrustedProxy() {
-    const socket = clientAddress(this.raw);
-    return socket !== void 0 && this.#trustedProxies.length > 0 && ipMatches(socket, this.#trustedProxies);
-  }
-  ajax() {
-    return this.header("x-requested-with") === "XMLHttpRequest";
-  }
-  pjax() {
-    return this.header("x-pjax") === "true";
-  }
-  /** The first Accept type is JSON. */
-  wantsJson() {
-    const first = this.header("accept", "").split(",")[0].trim();
-    return first.includes("/json") || first.includes("+json");
-  }
-  /** Laravel: (ajax and not pjax and accepts anything) or wantsJson. */
-  expectsJson() {
-    const first = this.header("accept", "").split(",")[0].split(";")[0].trim();
-    const acceptsAny = first === "" || first === "*/*" || first === "*";
-    return this.ajax() && !this.pjax() && acceptsAny || this.wantsJson();
-  }
-  /** The raw body text for JSON and urlencoded requests ('' otherwise; the raw stream stays unread for other types). */
-  content() {
-    return this.#content;
-  }
-  query(key, defaultValue) {
-    return Arr.get(this.#query, key, defaultValue);
-  }
-  /** Body wins over the query string (PHP's $body + $query). Files are not input. */
-  input(key, defaultValue) {
-    return Arr.get({ ...this.#query, ...this.#body }, key, defaultValue);
-  }
-  /** Input plus files (array_replace_recursive). */
-  all() {
-    return mergeRecursive({ ...this.#query, ...this.#body }, this.#files);
-  }
-  only(...keys) {
-    const all = this.all();
-    const out = {};
-    for (const key of keys.flat()) if (Arr.has(all, key)) Arr.set(out, key, Arr.get(all, key));
-    return out;
-  }
-  except(...keys) {
-    const all = structuredCloneInput(this.all());
-    for (const key of keys.flat()) Arr.forget(all, key);
-    return all;
-  }
-  has(...keys) {
-    const all = this.all();
-    return keys.flat().every((key) => Arr.has(all, key));
-  }
-  hasAny(...keys) {
-    const all = this.all();
-    return keys.flat().some((key) => Arr.has(all, key));
-  }
-  missing(...keys) {
-    return !this.has(...keys);
-  }
-  filled(key) {
-    return !isBlank(Arr.get(this.all(), key));
-  }
-  string(key, defaultValue = "") {
-    const value2 = this.input(key);
-    return value2 === void 0 || value2 === null ? defaultValue : String(value2);
-  }
-  /** PHP's FILTER_VALIDATE_BOOLEAN: '1', 'true', 'on', 'yes' (any case) and true are true. */
-  boolean(key, defaultValue = false) {
-    const value2 = this.input(key);
-    if (value2 === void 0) return defaultValue;
-    if (typeof value2 === "boolean") return value2;
-    if (typeof value2 === "number") return value2 === 1;
-    return typeof value2 === "string" && TRUE_VALUES.has(value2.trim().toLowerCase());
-  }
-  /** PHP's intval: leading digits, else 0. */
-  integer(key, defaultValue = 0) {
-    const value2 = this.input(key);
-    if (value2 === void 0) return defaultValue;
-    if (typeof value2 === "number") return Number.isFinite(value2) ? Math.trunc(value2) : 0;
-    if (typeof value2 === "boolean") return value2 ? 1 : 0;
-    const parsed = Number.parseInt(String(value2).trim(), 10);
-    return Number.isNaN(parsed) ? 0 : parsed;
-  }
-  /** Adds or replaces top-level body values. */
-  merge(values) {
-    this.#body = { ...this.#body, ...sanitize(values) };
-    return this;
-  }
-  /** Rewrites every scalar in the query and the body (TrimStrings and ConvertEmptyStringsToNull use this). */
-  transformInput(transform) {
-    this.#query = transformLeaves(this.#query, transform);
-    this.#body = transformLeaves(this.#body, transform);
-    return this;
-  }
-  file(key) {
-    const value2 = Arr.get(this.#files, key);
-    return value2 instanceof FormUploadedFile ? value2 : void 0;
-  }
-  hasFile(key) {
-    const value2 = Arr.get(this.#files, key);
-    return value2 instanceof FormUploadedFile || Array.isArray(value2) && value2.some((item) => item instanceof FormUploadedFile);
-  }
-  allFiles() {
-    return { ...this.#files };
-  }
-  cookie(name) {
-    return this.cookies()[name];
-  }
-  cookies() {
-    if (this.#cookies === void 0) {
-      const cookies = {};
-      for (const part of (this.raw.headers.get("cookie") ?? "").split(";")) {
-        const index = part.indexOf("=");
-        if (index === -1) continue;
-        const name = part.slice(0, index).trim();
-        if (name === "" || Object.hasOwn(cookies, name)) continue;
-        let value2 = part.slice(index + 1).trim();
-        if (value2.startsWith('"') && value2.endsWith('"')) value2 = value2.slice(1, -1);
-        try {
-          cookies[name] = decodeURIComponent(value2);
-        } catch {
-          cookies[name] = value2;
-        }
-      }
-      this.#cookies = cookies;
-    }
-    return { ...this.#cookies };
-  }
-  /** Replaces the parsed cookies (EncryptCookies calls this after decrypting). */
-  setCookies(cookies) {
-    this.#cookies = { ...cookies };
-  }
-  /** One route parameter (after model binding), or all of them. */
-  route(key) {
-    const parameters = this.#currentRoute()?.parameters ?? {};
-    return key === void 0 ? { ...parameters } : parameters[key];
-  }
-  session() {
-    return inject(Session);
-  }
-  user(guard2) {
-    return this.#userResolver?.(guard2);
-  }
-  setUserResolver(resolver) {
-    this.#userResolver = resolver;
-  }
-  /** Validates all() through the ValidationFactory; throws its Validation error on failure. */
-  validate(rules, messages, attributes) {
-    return inject(ValidationFactory).make(this.all(), rules, messages, attributes).validated();
-  }
-  #currentRoute() {
-    const container = currentContainer();
-    return container?.bound(CurrentRoute) ? container.make(CurrentRoute) : void 0;
-  }
-};
-function structuredCloneInput(tree) {
-  const out = {};
-  for (const [key, value2] of Object.entries(tree)) {
-    out[key] = isPlainObject2(value2) ? structuredCloneInput(value2) : Array.isArray(value2) ? [...value2] : value2;
-  }
-  return out;
-}
-function request(key, defaultValue) {
-  const current = inject(HttpRequest);
-  return key === void 0 ? current : current.input(key, defaultValue);
-}
-function response(content, status, headers) {
-  const factory = inject(ResponseFactory);
-  return content === void 0 ? factory : factory.make(content, status, headers);
-}
-function redirect(to, status) {
-  const redirector = inject(Redirector);
-  return to === void 0 ? redirector : redirector.to(to, status);
-}
-function back(fallback, status) {
-  return inject(Redirector).back(fallback, status);
-}
-function url(path, query, absolute) {
-  const generator = inject(UrlGenerator);
-  return path === void 0 ? generator : generator.to(path, query, absolute);
-}
-function route(name, parameters, absolute) {
-  return inject(UrlGenerator).route(name, parameters, absolute);
-}
-function abort(status, message = "", headers = {}) {
-  if (status instanceof Response) throw new HttpResponseException(status);
-  throw new HttpException(status, message, headers);
-}
-function abortIf(condition, status, message = "", headers = {}) {
-  if (condition) abort(status, message, headers);
-}
-function abortUnless(condition, status, message = "", headers = {}) {
-  if (!condition) abort(status, message, headers);
-}
-function contentDisposition(type, name) {
-  const fallback = name.replace(/[^\x20-\x7e]/g, "_").replace(/["\\]/g, "\\$&");
-  const header = `${type}; filename="${fallback}"`;
-  return /^[\x20-\x7e]*$/.test(name) ? header : `${header}; filename*=UTF-8''${encodeURIComponent(name)}`;
-}
-var HttpResponseFactory = class {
-  /** Strings default to text/html; charset=utf-8, as in Laravel. */
-  make(content = null, status = 200, headers) {
-    const merged = new Headers(headers);
-    if (typeof content === "string" && !merged.has("content-type")) merged.set("content-type", "text/html; charset=utf-8");
-    return new Response(content, { status, headers: merged });
-  }
-  json(data, status = 200, headers) {
-    const merged = new Headers(headers);
-    if (!merged.has("content-type")) merged.set("content-type", "application/json");
-    return new Response(JSON.stringify(data === void 0 ? null : data), { status, headers: merged });
-  }
-  noContent(status = 204) {
-    return new Response(null, { status });
-  }
-  /** Renders a view (through the ViewFactory) into an HTML response. */
-  async view(name, data = {}, status = 200, headers) {
-    const html2 = await inject(ViewFactory).make(name, data).render();
-    return this.make(html2, status, headers);
-  }
-  /** Streams a file as an attachment. A missing file is a 404. */
-  download(path, name = basename2(path), headers) {
-    return this.#file(path, "attachment", name, headers);
-  }
-  /** Streams a file for the browser to display (Laravel's response()->file()). */
-  file(path, headers) {
-    return this.#file(path, "inline", basename2(path), headers);
-  }
-  stream(body, status = 200, headers) {
-    return new Response(body, { status, headers });
-  }
-  async #file(path, disposition, name, headers) {
-    const info = await stat3(path).catch(() => void 0);
-    if (info === void 0 || !info.isFile()) throw new HttpException(404);
-    const merged = new Headers(headers);
-    if (!merged.has("content-type")) merged.set("content-type", mimeFromExtension2(name));
-    merged.set("content-length", String(info.size));
-    merged.set("content-disposition", contentDisposition(disposition, name));
-    const body = Readable2.toWeb(createReadStream2(path));
-    return new Response(body, { status: 200, headers: merged });
-  }
-};
-var ConvertEmptyStringsToNull = class {
-  async handle(request2, next) {
-    if (request2 instanceof IncomingRequest) request2.transformInput((_key, value2) => value2 === "" ? null : value2);
-    return next(request2);
-  }
-};
-var TRIM = /^[\s\uFEFF\u200B\u200E]+|[\s\uFEFF\u200B\u200E]+$/g;
-var TrimStrings = class {
-  /** Dotted input keys left untouched. Override in a subclass to change. */
-  except = ["current_password", "password", "password_confirmation"];
-  async handle(request2, next) {
-    if (request2 instanceof IncomingRequest) {
-      request2.transformInput(
-        (key, value2) => typeof value2 === "string" && !this.except.includes(key) ? value2.replace(TRIM, "") : value2
-      );
-    }
-    return next(request2);
-  }
-};
-var plainServerError = () => new Response("Server Error", { status: 500, headers: { "content-type": "text/plain; charset=utf-8" } });
-var Kernel2 = class {
-  constructor(app2) {
-    this.app = app2;
-  }
-  app;
-  #middleware = [TrimStrings, ConvertEmptyStringsToNull];
-  #requests = /* @__PURE__ */ new WeakMap();
-  getGlobalMiddleware() {
-    return [...this.#middleware];
-  }
-  setGlobalMiddleware(middleware) {
-    this.#middleware = [...middleware];
-    return this;
-  }
-  appendMiddleware(...middleware) {
-    for (const cls of middleware) if (!this.#middleware.includes(cls)) this.#middleware.push(cls);
-    return this;
-  }
-  prependMiddleware(...middleware) {
-    for (const cls of [...middleware].reverse()) if (!this.#middleware.includes(cls)) this.#middleware.unshift(cls);
-    return this;
-  }
-  hasMiddleware(middleware) {
-    return this.#middleware.includes(middleware);
-  }
-  /** Runs in the current request scope (Application.handle() opens one); called directly, it opens its own. */
-  handle(raw3) {
-    const current = currentContainer();
-    const scope = current !== void 0 && current !== this.app ? current : this.app.createScope();
-    return scope.run(() => this.#handle(raw3, scope));
-  }
-  async #handle(raw3, scope) {
-    let request2;
-    let response2;
-    try {
-      request2 = new IncomingRequest(raw3, { trustedProxies: this.#trustedProxies(), maxBodySize: this.#maxBodySize() });
-      scope.instance(HttpRequest, request2);
-      const state = { scope, request: request2, middleware: [] };
-      this.#requests.set(raw3, state);
-      await request2.load();
-      response2 = await this.#sendThroughGlobal(state);
-    } catch (error) {
-      request2 ??= this.#bareRequest(scope, raw3);
-      if (request2 !== void 0) {
-        response2 = await this.#renderLast(scope, request2, error);
-      } else {
-        await this.#report(scope, error);
-        response2 = plainServerError();
-      }
-    }
-    if (raw3.method.toUpperCase() === "HEAD" && response2.body !== null) {
-      await response2.body.cancel().catch(() => void 0);
-      response2 = new Response(null, { status: response2.status, statusText: response2.statusText, headers: response2.headers });
-    }
-    return response2;
-  }
-  /** The request without options, for rendering an error raised while the real one was being built. */
-  #bareRequest(scope, raw3) {
-    try {
-      const request2 = new IncomingRequest(raw3);
-      scope.instance(HttpRequest, request2);
-      return request2;
-    } catch {
-      return void 0;
-    }
-  }
-  /** Runs terminate() on the global and route middleware (inside the request's scope), then Application.terminate(), inside the same scope, so terminating callbacks see the request's bindings. */
-  async terminate(raw3, response2) {
-    const state = this.#requests.get(raw3);
-    if (state !== void 0) {
-      this.#requests.delete(raw3);
-      await state.scope.run(async () => {
-        const route2 = state.scope.bound(CurrentRoute) ? state.scope.make(CurrentRoute).middleware : [];
-        for (const middleware of [...state.middleware, ...route2]) {
-          if (typeof middleware.terminate !== "function") continue;
-          try {
-            await middleware.terminate(state.request, response2);
-          } catch (error) {
-            await this.#report(state.scope, error);
-          }
-        }
-        await this.app.terminate();
-      });
-      return;
-    }
-    await this.app.terminate();
-  }
-  #sendThroughGlobal(state) {
-    const { scope, request: request2 } = state;
-    const pipes = this.#middleware.map((cls) => {
-      const instance = scope.make(cls);
-      state.middleware.push(instance);
-      return (passable, next) => this.#guard(scope, passable, () => instance.handle(passable, next));
-    });
-    return scope.make(PipelineFactory).make().send(request2).through(pipes).then((passable) => this.#guard(scope, passable, () => this.#dispatch(scope, passable)));
-  }
-  #dispatch(scope, request2) {
-    return scope.make(Router).dispatch(request2);
-  }
-  /** Converts a Responsable result, and renders a thrown error at this stage (Laravel's Routing\Pipeline). */
-  async #guard(scope, request2, run) {
-    try {
-      const result = await run();
-      if (result instanceof Response) return result;
-      const responsable = result;
-      if (typeof responsable?.toResponse === "function") return await responsable.toResponse(request2);
-      throw new HttpServerError("Middleware must return a Response.");
-    } catch (error) {
-      if (!scope.bound(ExceptionHandler)) throw error;
-      const handler3 = scope.make(ExceptionHandler);
-      await handler3.report(error);
-      return handler3.render(request2, error);
-    }
-  }
-  /** Last resort: the handler failed or isn't bound. Never throws. */
-  async #renderLast(scope, request2, error) {
-    if (scope.bound(ExceptionHandler)) {
-      try {
-        const handler3 = scope.make(ExceptionHandler);
-        await handler3.report(error);
-        return await handler3.render(request2, error);
-      } catch (renderError2) {
-        console.error(renderError2);
-      }
-    } else {
-      console.error(error);
-    }
-    return plainServerError();
-  }
-  async #report(scope, error) {
-    try {
-      if (scope.bound(ExceptionHandler)) await scope.make(ExceptionHandler).report(error);
-      else console.error(error);
-    } catch (reportError) {
-      console.error(reportError);
-    }
-  }
-  /** config('http.max_body_size'): bytes, or null for no limit. Anything else is a configuration error. */
-  #maxBodySize() {
-    if (!this.app.bound(ConfigRepository)) return 8 * 1024 * 1024;
-    const value2 = this.app.make(ConfigRepository).get("http.max_body_size", 8 * 1024 * 1024);
-    if (value2 === null) return null;
-    if (typeof value2 === "number" && Number.isFinite(value2) && value2 >= 0) return value2;
-    throw new HttpServerError(
-      `Invalid http.max_body_size ${JSON.stringify(value2) ?? String(value2)}: use a number of bytes (0 or more), or null for no limit.`
-    );
-  }
-  /** config('http.trusted_proxies'): an array, or a comma-separated string such as '*' or '10.0.0.0/8,::1'. */
-  #trustedProxies() {
-    if (!this.app.bound(ConfigRepository)) return [];
-    const value2 = this.app.make(ConfigRepository).get("http.trusted_proxies", []);
-    if (typeof value2 === "string") return value2.split(",").map((entry) => entry.trim()).filter((entry) => entry !== "");
-    return Array.isArray(value2) ? value2.map(String) : [];
-  }
-};
-var MiddlewareConfiguration = class {
-  constructor(kernel, router, config2) {
-    this.kernel = kernel;
-    this.router = router;
-    this.config = config2;
-  }
-  kernel;
-  router;
-  config;
-  append(...middleware) {
-    this.kernel.appendMiddleware(...middleware);
-    return this;
-  }
-  prepend(...middleware) {
-    this.kernel.prependMiddleware(...middleware);
-    return this;
-  }
-  web(options) {
-    return this.#modifyGroup("web", options);
-  }
-  api(options) {
-    return this.#modifyGroup("api", options);
-  }
-  alias(aliases2) {
-    for (const [name, middleware] of Object.entries(aliases2)) this.router.aliasMiddleware(name, middleware);
-    return this;
-  }
-  group(name, middleware) {
-    this.router.middlewareGroup(name, middleware);
-    return this;
-  }
-  /** Stored in config('http.csrf_except'), which the Session component's VerifyCsrfToken reads. */
-  validateCsrfTokens(options) {
-    const current = this.config?.get("http.csrf_except", []) ?? [];
-    this.config?.set("http.csrf_except", [...current, ...options.except]);
-    return this;
-  }
-  /** Stored in config('http.redirect_guests_to'), which the Auth middleware and the exception handler read. */
-  redirectGuestsTo(url2) {
-    this.config?.set("http.redirect_guests_to", url2);
-    return this;
-  }
-  /** Laravel 11's redirectUsersTo(): stored in config('http.redirect_users_to') for Auth's RedirectIfAuthenticated. */
-  redirectUsersTo(url2) {
-    this.config?.set("http.redirect_users_to", url2);
-    return this;
-  }
-  /** Laravel's order: prepends, then the group minus removals, then appends. */
-  #modifyGroup(name, { append = [], prepend = [], remove = [] }) {
-    const current = this.router.getMiddlewareGroups()[name] ?? [];
-    const moved = /* @__PURE__ */ new Set([...append, ...prepend, ...remove]);
-    this.router.middlewareGroup(name, [...prepend, ...current.filter((entry) => !moved.has(entry)), ...append]);
-    return this;
-  }
-};
-function applyMiddlewareCallbacks(app2, kernel) {
-  if (!app2.bound(MiddlewareCallbacks)) return;
-  const callbacks = app2.make(MiddlewareCallbacks);
-  if (callbacks.length === 0) return;
-  const config2 = app2.bound(ConfigRepository) ? app2.make(ConfigRepository) : void 0;
-  const configurator = new MiddlewareConfiguration(kernel, app2.make(Router), config2);
-  for (const callback of callbacks) callback(configurator);
-}
-var STATUS_TEXTS = {
-  400: "Bad Request",
-  401: "Unauthorized",
-  402: "Payment Required",
-  403: "Forbidden",
-  404: "Not Found",
-  405: "Method Not Allowed",
-  408: "Request Timeout",
-  409: "Conflict",
-  410: "Gone",
-  413: "Content Too Large",
-  415: "Unsupported Media Type",
-  419: "Page Expired",
-  422: "Unprocessable Content",
-  429: "Too Many Requests",
-  500: "Server Error",
-  502: "Bad Gateway",
-  503: "Service Unavailable",
-  504: "Gateway Timeout"
-};
-function statusText(status) {
-  return STATUS_TEXTS[status] ?? (status >= 500 ? "Server Error" : "Error");
-}
-function escapeHtml(value2) {
-  return value2.replace(/[&<>"']/g, (char) => `&#${char.charCodeAt(0)};`);
-}
-function minimalPage(status, message) {
-  const title = escapeHtml(message);
-  return `<!DOCTYPE html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${title}</title>
-<style>body{margin:0;font-family:ui-sans-serif,system-ui,sans-serif;background:#f7fafc;color:#1a202c;display:flex;align-items:center;justify-content:center;min-height:100vh}.code{padding:0 1rem;border-right:1px solid #a0aec0;font-size:1.125rem}.message{padding:0 1rem;font-size:1.125rem;text-transform:uppercase;letter-spacing:.05em}</style>
-</head>
-<body><div class="code">${status}</div><div class="message">${title}</div></body>
-</html>`;
-}
-function stackFrames(error) {
-  const frames = [];
-  for (const raw3 of (error.stack ?? "").split("\n").slice(1)) {
-    const text3 = raw3.trim();
-    const match = /(?:\(|@|at )((?:file:\/\/)?(?:\/|[A-Za-z]:\\)[^()]*?):(\d+):(\d+)\)?$/.exec(text3);
-    if (match === null) continue;
-    const location = match[1];
-    const file = location.startsWith("file://") ? fileURLToPath(location) : location;
-    frames.push({ file, line: Number(match[2]), column: Number(match[3]), text: text3 });
-  }
-  return frames;
-}
-async function excerpt(frame, radius = 5) {
-  const source = await readFile4(frame.file, "utf8").catch(() => void 0);
-  if (source === void 0) return void 0;
-  const lines = source.split("\n");
-  const start2 = Math.max(1, frame.line - radius);
-  const end = Math.min(lines.length, frame.line + radius);
-  const rows = [];
-  for (let number3 = start2; number3 <= end; number3++) {
-    const current = number3 === frame.line ? ' class="current"' : "";
-    rows.push(`<tr${current}><td class="n">${number3}</td><td><code>${escapeHtml(lines[number3 - 1] ?? "")}</code></td></tr>`);
-  }
-  return `<table class="source">${rows.join("")}</table>`;
-}
-async function debugPage(error, method, url2) {
-  const err = error instanceof Error ? error : new Error(String(error));
-  const frames = stackFrames(err);
-  const appFrame = frames.find((frame) => !frame.file.includes("node_modules") && !frame.file.startsWith("node:")) ?? frames[0];
-  const source = appFrame === void 0 ? void 0 : await excerpt(appFrame);
-  const causes = [];
-  for (let cause = err.cause, depth = 0; cause !== void 0 && depth < 5; cause = cause.cause, depth++) {
-    causes.push(`<li>${escapeHtml(cause instanceof Error ? `${cause.name}: ${cause.message}` : String(cause))}</li>`);
-  }
-  return `<!DOCTYPE html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<title>${escapeHtml(err.message || err.name)}</title>
-<style>body{margin:0;font-family:ui-sans-serif,system-ui,sans-serif;background:#f3f4f6;color:#111827}main{max-width:1100px;margin:2rem auto;padding:0 1rem}header{background:#fff;border-radius:.5rem;padding:1.5rem;box-shadow:0 1px 3px #0001}.class{color:#dc2626;font-weight:600}.message{font-size:1.5rem;margin:.5rem 0}.request{color:#6b7280}section{background:#fff;border-radius:.5rem;padding:1rem;margin-top:1rem;box-shadow:0 1px 3px #0001;overflow:auto}.source td{padding:0 .5rem;white-space:pre;font-size:.85rem}.source .n{color:#9ca3af;text-align:right}.source .current{background:#fee2e2}ol{font-family:ui-monospace,monospace;font-size:.85rem}</style>
-</head>
-<body><main>
-<header><div class="class">${escapeHtml(err.name)}</div><div class="message">${escapeHtml(err.message)}</div><div class="request">${escapeHtml(method)} ${escapeHtml(url2)}</div></header>
-${appFrame === void 0 ? "" : `<section><div>${escapeHtml(appFrame.file)}:${appFrame.line}</div>${source ?? ""}</section>`}
-<section><ol>${frames.map((frame) => `<li>${escapeHtml(frame.text)}</li>`).join("")}</ol></section>
-${causes.length === 0 ? "" : `<section><div>Caused by</div><ul>${causes.join("")}</ul></section>`}
-</main></body>
-</html>`;
-}
-var NOT_REPORTED = /* @__PURE__ */ new Set(["Http", "ModelNotFound", "Validation", "Authentication", "Authorization", "TokenMismatch"]);
-var HTTP_KINDS = /* @__PURE__ */ new Set(["Http", "ModelNotFound", "Authorization", "TokenMismatch"]);
-var kindOf = (error) => typeof error === "object" && error !== null && typeof error.kind === "string" ? error.kind : void 0;
-function statusFor(error) {
-  const status = error?.status;
-  switch (kindOf(error)) {
-    case "Http":
-      return status ?? 500;
-    case "ModelNotFound":
-      return 404;
-    case "Authorization":
-      return status ?? 403;
-    case "TokenMismatch":
-      return 419;
-    case "Authentication":
-      return 401;
-    case "Validation":
-      return status ?? 422;
-    case "Server":
-      return status ?? 500;
-    default:
-      return 500;
-  }
-}
-function summarizeValidation(errors2) {
-  const messages = Object.values(errors2).flat();
-  if (messages.length === 0) return "The given data was invalid.";
-  const more = messages.length - 1;
-  return more === 0 ? messages[0] : `${messages[0]} (and ${more} more ${more === 1 ? "error" : "errors"})`;
-}
-var isHttpLike = (error) => {
-  const kind = kindOf(error);
-  return kind !== void 0 && HTTP_KINDS.has(kind);
-};
-var ErrorHandler = class {
-  constructor(app2) {
-    this.app = app2;
-  }
-  app;
-  /** Input keys never flashed back on a validation redirect. */
-  dontFlash = ["current_password", "password", "password_confirmation"];
-  #reportCallbacks = [];
-  #renderCallbacks = [];
-  #dontReport = [];
-  #reported = /* @__PURE__ */ new WeakSet();
-  reportUsing(callback) {
-    this.#reportCallbacks.push(callback);
-  }
-  renderUsing(callback) {
-    this.#renderCallbacks.push(callback);
-  }
-  ignore(...classes) {
-    this.#dontReport.push(...classes);
-  }
-  shouldReport(error) {
-    const kind = kindOf(error);
-    if (kind !== void 0 && NOT_REPORTED.has(kind)) return false;
-    return !this.#dontReport.some((cls) => error instanceof cls);
-  }
-  /** Report callbacks first (returning false stops the default log), then LogManager.error(), else console.error. Once per error. */
-  async report(error) {
-    if (!this.shouldReport(error)) return;
-    if (typeof error === "object" && error !== null) {
-      if (this.#reported.has(error)) return;
-      this.#reported.add(error);
-    }
-    try {
-      for (const callback of this.#reportCallbacks) if (await callback(error) === false) return;
-      const container = this.#container();
-      if (container.bound(LogManager)) {
-        const message = error instanceof Error ? error.message : String(error);
-        container.make(LogManager).error(message, { exception: error });
-      } else {
-        console.error(error);
-      }
-    } catch (reportError) {
-      console.error(reportError);
-    }
-  }
-  async render(request2, error) {
-    for (const callback of this.#renderCallbacks) {
-      const response3 = await callback(error, request2);
-      if (response3 instanceof Response) return response3;
-    }
-    if (error instanceof HttpResponseException) return error.response;
-    const custom = await this.#renderCustom(request2, error);
-    if (custom !== void 0) return custom;
-    const http = this.#httpRequest(request2);
-    const kind = kindOf(error);
-    let response2;
-    if (kind === "Validation") response2 = await this.#renderValidation(http, error);
-    else if (kind === "Authentication") response2 = await this.#renderAuthentication(http, error);
-    else if (http.expectsJson()) response2 = this.#renderJson(error);
-    else response2 = await this.#renderHtml(http, error);
-    const headers = error?.headers;
-    if (headers !== void 0) for (const [name, value2] of Object.entries(headers)) response2.headers.set(name, value2);
-    return response2;
-  }
-  /** An error with its own render(request) or toResponse(request) (Laravel's renderable exceptions / Responsable). */
-  async #renderCustom(request2, error) {
-    if (typeof error !== "object" || error === null) return void 0;
-    const candidate = error;
-    for (const method of [candidate.render, candidate.toResponse]) {
-      if (typeof method !== "function") continue;
-      const response2 = await method.call(error, request2);
-      if (response2 instanceof Response) return response2;
-    }
-    return void 0;
-  }
-  async #renderValidation(request2, error) {
-    if (request2.expectsJson()) {
-      return this.#json({ message: summarizeValidation(error.errors), errors: error.errors }, statusFor(error));
-    }
-    const input = { ...request2.input() };
-    for (const key of this.dontFlash) delete input[key];
-    const container = this.#container();
-    if (!container.bound(Redirector)) {
-      return this.#redirect(error.redirectTo ?? request2.header("referer") ?? "/");
-    }
-    const redirector = container.make(Redirector);
-    const redirect2 = error.redirectTo !== void 0 ? redirector.to(error.redirectTo) : redirector.back();
-    const response2 = await redirect2.withInput(input).withErrors(error.errors, error.errorBag).toResponse(request2);
-    return response2;
-  }
-  async #renderAuthentication(request2, error) {
-    if (request2.expectsJson()) return this.#json({ message: error.message || "Unauthenticated." }, 401);
-    const target = error.redirectTo ?? this.#guestRedirect(request2);
-    const container = this.#container();
-    if (!container.bound(Redirector)) return this.#redirect(target);
-    const redirector = container.make(Redirector);
-    const redirect2 = typeof redirector.guest === "function" ? redirector.guest(target) : redirector.to(target);
-    return await redirect2.toResponse(request2);
-  }
-  /** config('http.redirect_guests_to'), then route('login'), then '/login'. */
-  #guestRedirect(request2) {
-    const configured = this.#config("http.redirect_guests_to", void 0);
-    if (typeof configured === "function") return String(configured(request2));
-    if (typeof configured === "string" && configured !== "") return configured;
-    const container = this.#container();
-    if (container.bound(UrlGenerator)) {
-      const url2 = container.make(UrlGenerator);
-      if (url2.hasRoute("login")) return url2.route("login");
-    }
-    return "/login";
-  }
-  #renderJson(error) {
-    const status = statusFor(error);
-    if (isHttpLike(error)) {
-      const message = error instanceof Error && error.message !== "" ? error.message : statusText(status);
-      return this.#json({ message }, status);
-    }
-    if (!this.#debug()) return this.#json({ message: "Server Error" }, status);
-    const err = error instanceof Error ? error : new Error(String(error));
-    const [frame] = stackFrames(err);
-    return this.#json(
-      {
-        message: err.message,
-        exception: err.name,
-        file: frame?.file,
-        line: frame?.line,
-        trace: stackFrames(err).map((entry) => entry.text)
-      },
-      status
-    );
-  }
-  async #renderHtml(request2, error) {
-    const status = statusFor(error);
-    if (!isHttpLike(error) && this.#debug()) {
-      return this.#html(await debugPage(error, request2.method(), request2.fullUrl()), status);
-    }
-    const message = status === 403 && error instanceof Error && error.message !== "" ? error.message : statusText(status);
-    const view2 = await this.#errorView(status, error, message);
-    return this.#html(view2 ?? minimalPage(status, message), status);
-  }
-  /** resources/views/errors/{status}.tsx, then errors/4xx or errors/5xx, through the ViewFactory. */
-  async #errorView(status, error, message) {
-    const container = this.#container();
-    if (!container.bound(ViewFactory)) return void 0;
-    const views = container.make(ViewFactory);
-    for (const name of [`errors.${status}`, `errors.${Math.floor(status / 100)}xx`]) {
-      if (!views.exists(name)) continue;
-      try {
-        return await views.make(name, { exception: error, status, message }).render();
-      } catch (viewError) {
-        await this.report(viewError);
-        return void 0;
-      }
-    }
-    return void 0;
-  }
-  #httpRequest(request2) {
-    if (typeof request2 === "object" && request2 !== null && typeof request2.expectsJson === "function") {
-      return request2;
-    }
-    return new IncomingRequest(request2 instanceof Request ? request2 : new Request("http://localhost/"));
-  }
-  #json(body, status) {
-    return new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
-  }
-  #html(body, status) {
-    return new Response(body, { status, headers: { "content-type": "text/html; charset=utf-8" } });
-  }
-  #redirect(location) {
-    return new Response(null, { status: 302, headers: { Location: location } });
-  }
-  #debug() {
-    return this.#config("app.debug", false) === true;
-  }
-  #config(key, fallback) {
-    return this.app.bound(ConfigRepository) ? this.app.make(ConfigRepository).get(key, fallback) : fallback;
-  }
-  /** The request scope while handling a request (so scoped services resolve), else the application. */
-  #container() {
-    return currentContainer() ?? this.app;
-  }
-};
-var ExceptionsConfiguration = class {
-  constructor(handler3) {
-    this.handler = handler3;
-  }
-  handler;
-  report(callback) {
-    this.handler.reportUsing(callback);
-    return this;
-  }
-  render(callback) {
-    this.handler.renderUsing(callback);
-    return this;
-  }
-  dontReport(...classes) {
-    this.handler.ignore(...classes);
-    return this;
-  }
-};
-function applyExceptionCallbacks(app2, handler3) {
-  if (!app2.bound(ExceptionCallbacks)) return;
-  const configurator = new ExceptionsConfiguration(handler3);
-  for (const callback of app2.make(ExceptionCallbacks)) callback(configurator);
-}
-var HIDDEN_SEGMENT = /^\.|\.(ts|tsx|mts|cts)$|[. ]$/i;
-async function servePublicFile(publicPath, request2) {
-  if (request2.method !== "GET" && request2.method !== "HEAD") return void 0;
-  let pathname;
-  try {
-    pathname = decodeURIComponent(new URL(request2.url).pathname);
-  } catch {
-    return void 0;
-  }
-  if (pathname === "/" || pathname.includes("\0")) return void 0;
-  const root = resolve3(publicPath);
-  const file = resolve3(root, `.${pathname}`);
-  if (!file.startsWith(root + sep4)) return void 0;
-  if (relative5(root, file).split(/[\\/]/).some((segment) => HIDDEN_SEGMENT.test(segment))) return void 0;
-  const info = await stat22(file).catch(() => void 0);
-  if (info === void 0 || !info.isFile()) return void 0;
-  const type = mimeFromExtension2(file);
-  const headers = new Headers({
-    "content-type": type.startsWith("text/") || type === "application/json" ? `${type}; charset=utf-8` : type,
-    "content-length": String(info.size),
-    "last-modified": info.mtime.toUTCString()
-  });
-  if (pathname.startsWith("/build/assets/")) headers.set("cache-control", "public, max-age=31536000, immutable");
-  if (request2.method === "HEAD") return new Response(null, { status: 200, headers });
-  const body = Readable22.toWeb(createReadStream22(file));
-  return new Response(body, { status: 200, headers });
-}
-async function terminateRequest(app2, request2, response2) {
-  try {
-    if (app2.bound(HttpKernel)) await app2.make(HttpKernel).terminate?.(request2, response2);
-  } catch (error) {
-    console.error(error);
-  }
-}
-async function handleSafely(app2, request2, publicPath) {
-  try {
-    if (publicPath !== void 0) {
-      const file = await servePublicFile(publicPath, request2);
-      if (file !== void 0) return file;
-    }
-    return await app2.handle(request2);
-  } catch (error) {
-    console.error(error);
-    return plainServerError();
-  }
-}
-function exitOnSignals(close, closed) {
-  const onSignal = () => {
-    void close().then(() => process.exit(0));
-  };
-  process.once("SIGINT", onSignal);
-  process.once("SIGTERM", onSignal);
-  void closed.then(() => {
-    process.off("SIGINT", onSignal);
-    process.off("SIGTERM", onSignal);
-  });
-}
-var displayHost = (hostname) => hostname.includes(":") ? `[${hostname}]` : hostname;
-function bunRuntime() {
-  return globalThis.Bun;
-}
-async function serveBun(app2, options) {
-  const bun = bunRuntime();
-  if (bun === void 0) throw new HttpServerError("Bun.serve is not available: the process is not running on Bun.");
-  let markClosed = () => void 0;
-  const closed = new Promise((resolve22) => markClosed = resolve22);
-  const server = bun.serve({
-    port: options.port,
-    hostname: options.hostname,
-    async fetch(request2, current) {
-      setClientAddress(request2, current.requestIP(request2)?.address);
-      const response2 = await handleSafely(app2, request2, options.publicPath);
-      setTimeout(() => void terminateRequest(app2, request2, response2), 0);
-      return response2;
-    },
-    error(error) {
-      console.error(error);
-      return plainServerError();
-    }
-  });
-  let closing;
-  const close = () => closing ??= (async () => {
-    let timer;
-    const forced = new Promise((resolve22) => {
-      timer = setTimeout(() => void Promise.resolve(server.stop(true)).then(resolve22), options.shutdownTimeout);
-    });
-    await Promise.race([Promise.resolve(server.stop(false)), forced]);
-    clearTimeout(timer);
-    markClosed();
-  })();
-  if (options.signals) exitOnSignals(close, closed);
-  return {
-    runtime: "bun",
-    hostname: options.hostname,
-    port: server.port,
-    url: `http://${displayHost(options.hostname)}:${server.port}`,
-    close,
-    closed
-  };
-}
-function requestBody(req) {
-  let finished = false;
-  const detach = () => {
-    finished = true;
-    req.off("data", onData);
-    req.off("end", onEnd);
-    req.off("error", onError);
-    req.off("close", onClose);
-  };
-  let controller;
-  const onData = (chunk) => {
-    if (finished) return;
-    controller.enqueue(new Uint8Array(chunk.buffer, chunk.byteOffset, chunk.byteLength));
-    if ((controller.desiredSize ?? 0) <= 0) req.pause();
-  };
-  const onEnd = () => {
-    if (finished) return;
-    detach();
-    controller.close();
-  };
-  const onError = (error) => {
-    if (finished) return;
-    detach();
-    controller.error(error);
-  };
-  const onClose = () => {
-    if (!finished && !req.complete) onError(new Error("The request was aborted."));
-  };
-  return new ReadableStream(
-    {
-      start(c) {
-        controller = c;
-        req.on("data", onData);
-        req.on("end", onEnd);
-        req.on("error", onError);
-        req.on("close", onClose);
-        req.pause();
-      },
-      pull() {
-        req.resume();
-      },
-      cancel() {
-        detach();
-      }
-    },
-    { highWaterMark: 0 }
-  );
-}
-function toWebRequest(req, res, fallbackHost) {
-  const target = req.url ?? "/";
-  const url2 = new URL(`http://${req.headers.host ?? fallbackHost}${target.startsWith("/") ? target : `/${target}`}`);
-  const headers = new Headers();
-  for (let i = 0; i < req.rawHeaders.length; i += 2) {
-    const name = req.rawHeaders[i];
-    if (!name.startsWith(":")) headers.append(name, req.rawHeaders[i + 1]);
-  }
-  const method = (req.method ?? "GET").toUpperCase();
-  const controller = new AbortController();
-  res.once("close", () => {
-    if (!res.writableFinished) controller.abort();
-  });
-  const init = { method, headers, signal: controller.signal };
-  if (method !== "GET" && method !== "HEAD") {
-    init.body = requestBody(req);
-    init.duplex = "half";
-  }
-  return new Request(url2, init);
-}
-async function writeResponse(res, response2) {
-  res.statusCode = response2.status;
-  if (response2.statusText !== "") res.statusMessage = response2.statusText;
-  response2.headers.forEach((value2, name) => {
-    if (name !== "set-cookie") res.setHeader(name, value2);
-  });
-  const cookies = response2.headers.getSetCookie();
-  if (cookies.length > 0) res.setHeader("set-cookie", cookies);
-  if (response2.body === null) {
-    res.end();
-    return;
-  }
-  await pipeline2(Readable3.fromWeb(response2.body), res);
-}
-async function serveNode(app2, options) {
-  const fallbackHost = `${displayHost(options.hostname)}:${options.port}`;
-  const server = createServer((req, res) => {
-    void (async () => {
-      let request2;
-      try {
-        request2 = toWebRequest(req, res, fallbackHost);
-      } catch {
-        res.statusCode = 400;
-        res.end("Bad Request");
-        return;
-      }
-      setClientAddress(request2, req.socket.remoteAddress);
-      const response2 = await handleSafely(app2, request2, options.publicPath);
-      try {
-        await writeResponse(res, response2);
-      } catch {
-        res.destroy();
-      }
-      await terminateRequest(app2, request2, response2);
-    })();
-  });
-  await new Promise((resolve22, reject) => {
-    server.once("error", reject);
-    server.listen(options.port, options.hostname, () => {
-      server.off("error", reject);
-      resolve22();
-    });
-  });
-  const address = server.address();
-  const closed = new Promise((resolve22) => server.once("close", () => resolve22()));
-  let closing;
-  const close = () => closing ??= (async () => {
-    const done = new Promise((resolve22) => server.close(() => resolve22()));
-    server.closeIdleConnections();
-    const idle = setInterval(() => server.closeIdleConnections(), 50);
-    const force = setTimeout(() => server.closeAllConnections(), options.shutdownTimeout);
-    await done;
-    clearInterval(idle);
-    clearTimeout(force);
-  })();
-  if (options.signals) exitOnSignals(close, closed);
-  return {
-    runtime: "node",
-    hostname: options.hostname,
-    port: address.port,
-    url: `http://${displayHost(options.hostname)}:${address.port}`,
-    close,
-    closed
-  };
-}
-function detectRuntime() {
-  return bunRuntime() !== void 0 ? "bun" : "node";
-}
-async function serve(app2, options = {}) {
-  const resolved = {
-    port: options.port ?? Number(process.env.PORT ?? process.env.SERVER_PORT ?? 8e3),
-    hostname: options.hostname ?? "127.0.0.1",
-    signals: options.signals ?? true,
-    shutdownTimeout: options.shutdownTimeout ?? 1e4,
-    ...options.publicPath !== false && { publicPath: options.publicPath ?? app2.publicPath() }
-  };
-  await app2.boot();
-  const runtime = options.runtime ?? detectRuntime();
-  const server = runtime === "bun" ? await serveBun(app2, resolved) : await serveNode(app2, resolved);
-  const onListen = options.onListen ?? ((running) => console.log(`Server running on [${running.url}].`));
-  onListen(server);
-  return server;
-}
-function io(command) {
-  return {
-    option: (name) => {
-      const value2 = command.option(name);
-      return value2 === void 0 || value2 === null || value2 === false || value2 === "" ? void 0 : String(value2);
-    },
-    flag: (name) => {
-      const value2 = command.option(name);
-      return value2 === true || value2 === "true" || value2 === "1";
-    },
-    info: (message) => command.info(message),
-    line: (message) => command.line(message),
-    warn: (message) => command.warn(message),
-    error: (message) => command.error(message)
-  };
-}
-var middlewareName = (reference) => typeof reference === "string" ? reference : reference.name;
-function routeListRows(routes) {
-  const rows = routes.map((route2) => {
-    const listable = route2;
-    return {
-      method: route2.methods.join("|"),
-      uri: route2.uri,
-      name: route2.getName() ?? null,
-      action: typeof listable.getActionName === "function" ? listable.getActionName() : "Closure",
-      middleware: typeof listable.gatherMiddleware === "function" ? listable.gatherMiddleware().map(middlewareName) : []
-    };
-  });
-  return rows.sort((a, b) => a.uri < b.uri ? -1 : a.uri > b.uri ? 1 : 0);
-}
-function filterRouteList(rows, filters) {
-  const excluded2 = (filters.exceptPath ?? "").split(",").filter((path) => path !== "");
-  return rows.filter((row) => {
-    if (filters.name !== void 0 && !(row.name ?? "").includes(filters.name)) return false;
-    if (filters.path !== void 0 && !row.uri.includes(filters.path)) return false;
-    if (filters.method !== void 0 && !row.method.includes(filters.method.toUpperCase())) return false;
-    return !excluded2.some((path) => row.uri.includes(path));
-  });
-}
-function formatRouteList(rows, width) {
-  const methodWidth = Math.max(...rows.map((row) => row.method.length));
-  const lines = rows.map((row) => {
-    const spaces = " ".repeat(Math.max(methodWidth + 6 - row.method.length, 0));
-    const action = row.action === "Closure" ? row.name ?? "" : row.name === null ? row.action : `${row.name} \u203A ${row.action}`;
-    const used = row.method.length + spaces.length + row.uri.length + action.length + 6 + (action === "" ? 0 : 1);
-    const dots = ".".repeat(Math.max(width - used, 0));
-    return `  ${row.method} ${spaces}${row.uri}${dots === "" ? "" : ` ${dots}`}${action === "" ? "" : ` ${action}`}`;
-  });
-  const count = `Showing [${rows.length}] ${rows.length === 1 ? "route" : "routes"}`;
-  return [...lines, "", `${" ".repeat(Math.max(width - count.length - 2, 0))}${count}`];
-}
-var API_ROUTES_STUB = `import { request, Route } from '@orieljs/framework'
-
-Route.get('/user', () => request().user()).middleware('auth:token')
-`;
-function addApiRouting(source) {
-  const code = source.replace(/^[ \t]*\/\/.*$/gm, "");
-  if (/withRouting\(\s*\{[^}]*\bapi\s*:/.test(code)) return source;
-  const commented = /^([ \t]*)\/\/\s*(api:\s*['"`][^'"`\n]*['"`],?)[ \t]*$/m.exec(source);
-  if (commented !== null) return source.replace(commented[0], () => `${commented[1]}${commented[2]}`);
-  const web = /^([ \t]*)web:\s*(['"`])[^'"`\n]*\2[ \t]*,?[ \t]*$/m.exec(source);
-  if (web !== null) {
-    const line = web[0].trimEnd();
-    return source.replace(web[0], () => `${line.endsWith(",") ? line : `${line},`}
-${web[1]}api: 'routes/api.ts',`);
-  }
-  const inline = /withRouting\(\s*\{/.exec(source);
-  if (inline !== null) return source.replace(inline[0], () => `${inline[0]} api: 'routes/api.ts',`);
-  const create = /^([ \t]*)\.create\(\)/m.exec(source);
-  if (create !== null) return source.replace(create[0], () => `${create[1]}.withRouting({ api: 'routes/api.ts' })
-${create[0]}`);
-  return void 0;
-}
-function registerHttpCommands(kernel, app2, options = {}) {
-  const serveApp = options.serve ?? serve;
-  const terminalWidth = options.terminalWidth ?? (() => process.stdout.columns ?? 120);
-  kernel.command(
-    "serve {--host=127.0.0.1 : The host address to serve the application on} {--port= : The port to serve the application on}",
-    async function() {
-      const out = io(this);
-      const port = out.option("port");
-      if (port !== void 0 && !/^\d+$/.test(port)) {
-        out.error("The --port option must be a number.");
-        return 1;
-      }
-      const server = await serveApp(app2, {
-        hostname: out.option("host") ?? "127.0.0.1",
-        ...port !== void 0 && { port: Number(port) },
-        onListen: (running) => {
-          out.info(`Server running on [${running.url}].`);
-          out.line("Press Ctrl+C to stop the server");
-        }
-      });
-      await server.closed;
-      return 0;
-    }
-  ).purpose("Serve the application on the Oriel development server");
-  kernel.command(
-    "route:list {--method= : Filter the routes by method} {--name= : Filter the routes by name} {--path= : Only show routes matching the given path pattern} {--except-path= : Do not display the routes matching the given path pattern} {--reverse : Reverse the ordering of the routes} {--json : Output the route list as JSON}",
-    function() {
-      const out = io(this);
-      if (!app2.bound(Router)) {
-        out.error("The router is not available. Is the Routing service provider registered?");
-        return 1;
-      }
-      const all = routeListRows(app2.make(Router).getRoutes());
-      if (all.length === 0) {
-        out.error("Your application doesn't have any routes.");
-        return 0;
-      }
-      const rows = filterRouteList(all, {
-        ...out.option("method") !== void 0 && { method: out.option("method") },
-        ...out.option("name") !== void 0 && { name: out.option("name") },
-        ...out.option("path") !== void 0 && { path: out.option("path") },
-        ...out.option("except-path") !== void 0 && { exceptPath: out.option("except-path") }
-      });
-      if (rows.length === 0) {
-        out.error("Your application doesn't have any routes matching the given criteria.");
-        return 0;
-      }
-      if (out.flag("reverse")) rows.reverse();
-      if (out.flag("json")) {
-        out.line(JSON.stringify(rows));
-        return 0;
-      }
-      for (const line of formatRouteList(rows, terminalWidth())) out.line(line);
-      return 0;
-    }
-  ).purpose("List all registered routes");
-  kernel.command("install:api {--force : Overwrite any existing API routes file}", async function() {
-    const out = io(this);
-    const routesFile = app2.basePath("routes/api.ts");
-    if (existsSync7(routesFile) && !out.flag("force")) {
-      out.error("API routes file already exists.");
-    } else {
-      await mkdir5(dirname5(routesFile), { recursive: true });
-      await writeFile6(routesFile, API_ROUTES_STUB);
-      out.info("Published API routes file.");
-    }
-    const bootstrapFile = app2.bootstrapPath("app.ts");
-    const source = existsSync7(bootstrapFile) ? await readFile22(bootstrapFile, "utf8") : void 0;
-    const updated = source === void 0 ? void 0 : addApiRouting(source);
-    if (updated === void 0) {
-      out.warn(
-        "Unable to automatically add API route definition to bootstrap file. Add api: 'routes/api.ts' to withRouting() in bootstrap/app.ts."
-      );
-    } else if (updated !== source) {
-      await writeFile6(bootstrapFile, updated);
-    }
-    out.info("API scaffolding installed. Run [oriel migrate] to create the personal access tokens table.");
-    return 0;
-  }).purpose("Create an API routes file and prepare the application for API authentication");
-}
-var HttpServiceProvider = class extends ServiceProvider {
-  register() {
-    this.mergeConfigFrom(
-      {
-        trusted_proxies: [],
-        max_body_size: 8 * 1024 * 1024,
-        csrf_except: [],
-        redirect_guests_to: void 0,
-        redirect_users_to: void 0
-      },
-      "http"
-    );
-    this.app.singleton(HttpKernel, () => new Kernel2(this.app));
-    this.app.singleton(ExceptionHandler, () => {
-      const handler3 = new ErrorHandler(this.app);
-      applyExceptionCallbacks(this.app, handler3);
-      return handler3;
-    });
-    this.app.singleton(ResponseFactory, () => new HttpResponseFactory());
-    this.app.singleton(Redirector, () => new HttpRedirector());
-  }
-  boot() {
-    this.app.booted(() => {
-      const kernel = this.app.make(HttpKernel);
-      if (kernel instanceof Kernel2 && this.app.bound(Router)) applyMiddlewareCallbacks(this.app, kernel);
-    });
-    if (this.app.bound(ConsoleKernel)) registerHttpCommands(this.app.make(ConsoleKernel), this.app);
-  }
-};
-
-// ../Inertia/dist/index.js
-import { existsSync as existsSync8 } from "fs";
-import { join as join10 } from "path";
-import { createHash as createHash5 } from "crypto";
-import { existsSync as existsSync23, readFileSync } from "fs";
-import { spawn as spawn2 } from "child_process";
-import { existsSync as existsSync33 } from "fs";
-import { mkdir as mkdir6, writeFile as writeFile7 } from "fs/promises";
-import { dirname as dirname6, isAbsolute as isAbsolute2, join as join24, relative as relative6 } from "path";
-import { existsSync as existsSync42, readFileSync as readFileSync2 } from "fs";
-var Header = {
-  INERTIA: "X-Inertia",
-  ERROR_BAG: "X-Inertia-Error-Bag",
-  LOCATION: "X-Inertia-Location",
-  REDIRECT: "X-Inertia-Redirect",
-  VERSION: "X-Inertia-Version",
-  PARTIAL_COMPONENT: "X-Inertia-Partial-Component",
-  PARTIAL_ONLY: "X-Inertia-Partial-Data",
-  PARTIAL_EXCEPT: "X-Inertia-Partial-Except",
-  RESET: "X-Inertia-Reset",
-  INFINITE_SCROLL_MERGE_INTENT: "X-Inertia-Infinite-Scroll-Merge-Intent",
-  EXCEPT_ONCE_PROPS: "X-Inertia-Except-Once-Props"
-};
-function parseList(value2) {
-  const items = (value2 ?? "").split(",").filter((item) => item !== "");
-  return items.length === 0 ? void 0 : items;
-}
-var Prop = class {
-  constructor(value2) {
-    this.value = value2;
-  }
-  value;
-  mergeState = { merge: false, deep: false, append: true, appendPaths: [], prependPaths: [], matchOn: [] };
-  onceState = { once: false, fresh: false, key: void 0, ttlSeconds: void 0 };
-  deferred = false;
-  deferGroup;
-  /** Calls the callback, if the value is one. */
-  async resolve() {
-    return typeof this.value === "function" ? await this.value() : this.value;
-  }
-  /** Never sent on the first load (OptionalProp, DeferProp). */
-  ignoresFirstLoad() {
-    return false;
-  }
-  /** Sent even when a partial reload didn't ask for it (AlwaysProp). */
-  isAlways() {
-    return false;
-  }
-  /** Errors are reported and the prop is left out, instead of failing the page (defer(..., { rescue: true })). */
-  shouldRescue() {
-    return false;
-  }
-  // Once (honoured by OptionalProp, DeferProp, MergeProp and OnceProp) ------------------------------------
-  /** once(), once(false), once(true, { as: 'key', until: 3600 }). */
-  once(value2 = true, options = {}) {
-    this.onceState.once = value2;
-    if (options.as !== void 0) this.onceState.key = options.as;
-    if (options.until !== void 0) this.onceState.ttlSeconds = secondsUntil(options.until);
-    return this;
-  }
-  /** A custom once key, so pages can share the prop under different names. */
-  as(key) {
-    this.onceState.key = key;
-    return this;
-  }
-  /** Send the prop again even though the client already has it. */
-  fresh(value2 = true) {
-    this.onceState.fresh = value2;
-    return this;
-  }
-  /** Expire after a number of seconds, or at a Date. */
-  until(delay) {
-    this.onceState.ttlSeconds = secondsUntil(delay);
-    return this;
-  }
-  // Merging -------------------------------------------------------------------------------------------------
-  isMergeable() {
-    return false;
-  }
-  shouldMerge() {
-    return this.isMergeable() && this.mergeState.merge;
-  }
-  shouldDeepMerge() {
-    return this.mergeState.deep;
-  }
-  matchesOn() {
-    return [...this.mergeState.matchOn];
+  matchesOn() {
+    return [...this.mergeState.matchOn];
   }
   appendsAtRoot() {
     return this.mergeState.append && this.mergesAtRoot();
@@ -15116,9 +13553,9 @@ var Response2 = class {
   }
 };
 function pageExists(component, paths, extensions) {
-  return paths.some((path) => extensions.some((extension) => existsSync8(join10(path, `${component}.${extension}`))));
+  return paths.some((path) => extensions.some((extension) => existsSync7(join10(path, `${component}.${extension}`))));
 }
-var ResponseFactory2 = class _ResponseFactory {
+var ResponseFactory = class _ResponseFactory {
   constructor(app2, parent) {
     this.app = app2;
     this.parent = parent;
@@ -15243,7 +13680,7 @@ function inertiaFactory() {
   const container = currentContainer();
   if (container === void 0) throw new ContainerNotAvailableError("Inertia");
   if (container.bound(HttpRequest)) return container.make(InertiaFactory);
-  return container.make(Application).make(ResponseFactory2);
+  return container.make(Application).make(ResponseFactory);
 }
 function inertia(component, props = {}) {
   const factory = inertiaFactory();
@@ -15419,7 +13856,7 @@ function isEmpty(response2) {
   return response2.status === 200 && (response2.body === null || response2.headers.get("content-length") === "0");
 }
 function md5(value2) {
-  return createHash5("md5").update(value2).digest("hex");
+  return createHash7("md5").update(value2).digest("hex");
 }
 var EncryptHistory = class {
   #container = inject(Container);
@@ -15498,6 +13935,7 @@ export class {{ class }} extends InertiaMiddleware {
   }
 }
 `;
+var DEFAULT_EXCEPT_ROUTES = ["live.*"];
 async function loadPageTypes() {
   const specifier = "@orieljs/vite/types";
   try {
@@ -15521,12 +13959,12 @@ function registerInertiaCommands(kernel, app2, gateway, options = {}) {
       }
       const output = absolute(optionText(this.option("output")) ?? config2("inertia.types.routes", "resources/js/oriel/routes.ts"));
       const server = absolute(optionText(this.option("server")) ?? config2("inertia.types.server_routes", "types/routes.d.ts"));
-      const table = routeTable(app2.make(Router).getRoutes(), config2("inertia.types.except_routes", []));
-      await mkdir6(dirname6(output), { recursive: true });
-      await writeFile7(output, renderRoutesModule(table));
-      await mkdir6(dirname6(server), { recursive: true });
-      await writeFile7(server, renderServerRouteTypes(routeTable(app2.make(Router).getRoutes())));
-      this.info(`Route types for ${Object.keys(table).length} named routes written to ${relative6(app2.basePath(), output)}.`);
+      const table = routeTable(app2.make(Router).getRoutes(), config2("inertia.types.except_routes", DEFAULT_EXCEPT_ROUTES));
+      await mkdir5(dirname5(output), { recursive: true });
+      await writeFile6(output, renderRoutesModule(table));
+      await mkdir5(dirname5(server), { recursive: true });
+      await writeFile6(server, renderServerRouteTypes(routeTable(app2.make(Router).getRoutes())));
+      this.info(`Route types for ${Object.keys(table).length} named routes written to ${relative5(app2.basePath(), output)}.`);
       return 0;
     }
   ).purpose("Generate the route table and route name types for the frontend");
@@ -15539,7 +13977,7 @@ function registerInertiaCommands(kernel, app2, gateway, options = {}) {
     const output = absolute(optionText(this.option("output")) ?? config2("inertia.types.pages", "resources/js/oriel/pages.d.ts"));
     const result = await module.generatePageTypes({ root: app2.basePath(), output });
     for (const warning of result.warnings) this.warn(warning);
-    this.info(`Page types for ${result.pages} pages written to ${relative6(app2.basePath(), result.output)}.`);
+    this.info(`Page types for ${result.pages} pages written to ${relative5(app2.basePath(), result.output)}.`);
     return 0;
   }).purpose("Generate TypeScript types for the Inertia page props");
   kernel.command("inertia:middleware {name=HandleInertiaRequests : The middleware class name} {--force : Overwrite an existing file}", async function() {
@@ -15550,12 +13988,12 @@ function registerInertiaCommands(kernel, app2, gateway, options = {}) {
     }
     const file = app2.appPath(join24("Http", "Middleware", `${name}.ts`));
     if (existsSync33(file) && this.option("force") !== true) {
-      this.error(`Middleware [${relative6(app2.basePath(), file)}] already exists.`);
+      this.error(`Middleware [${relative5(app2.basePath(), file)}] already exists.`);
       return 1;
     }
-    await mkdir6(dirname6(file), { recursive: true });
-    await writeFile7(file, MIDDLEWARE_STUB2.replace("{{ class }}", () => name));
-    this.info(`Middleware [${relative6(app2.basePath(), file)}] created successfully.`);
+    await mkdir5(dirname5(file), { recursive: true });
+    await writeFile6(file, MIDDLEWARE_STUB2.replace("{{ class }}", () => name));
+    this.info(`Middleware [${relative5(app2.basePath(), file)}] created successfully.`);
     return 0;
   }).purpose("Create a new Inertia middleware");
   kernel.command("inertia:start-ssr {--runtime= : The runtime that runs the SSR bundle (node or bun)}", async function() {
@@ -15568,13 +14006,18 @@ function registerInertiaCommands(kernel, app2, gateway, options = {}) {
       this.error("Inertia SSR bundle not found. Build it with `vite build --ssr`, or set `inertia.ssr.bundle`.");
       return 1;
     }
+    const port = urlPort(gateway.productionUrl());
+    if (port === void 0) {
+      this.error(`inertia.ssr.url [${gateway.productionUrl()}] is not a URL.`);
+      return 1;
+    }
     const runtime = optionText(this.option("runtime")) ?? config2("inertia.ssr.runtime", "node");
-    const child = (options.spawn ?? spawn2)(runtime, [bundle], { stdio: "inherit" });
-    return await new Promise((resolve4) => {
-      child.on("exit", (code) => resolve4(code ?? 0));
+    const child = (options.spawn ?? spawn2)(runtime, [bundle], { stdio: "inherit", env: { ...process.env, INERTIA_SSR_PORT: port } });
+    return await new Promise((resolve3) => {
+      child.on("exit", (code) => resolve3(code ?? 0));
       child.on("error", (error) => {
         this.error(`Could not start the SSR server: ${error.message}`);
-        resolve4(1);
+        resolve3(1);
       });
     });
   }).purpose("Start the Inertia SSR server");
@@ -15595,6 +14038,15 @@ function registerInertiaCommands(kernel, app2, gateway, options = {}) {
     return 1;
   }).purpose("Check the Inertia SSR server health status");
 }
+function urlPort(url2) {
+  try {
+    const parsed = new URL(url2);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return void 0;
+    return parsed.port !== "" ? parsed.port : parsed.protocol === "https:" ? "443" : "80";
+  } catch {
+    return void 0;
+  }
+}
 function optionText(value2) {
   return value2 === void 0 || value2 === null || value2 === false || value2 === "" ? void 0 : String(value2);
 }
@@ -15722,12 +14174,13 @@ var InertiaServiceProvider = class extends ServiceProvider {
         expose_shared_prop_keys: true,
         store_previous_url: false,
         history: { encrypt: false },
-        types: { pages: "resources/js/oriel/pages.d.ts", routes: "resources/js/oriel/routes.ts", server_routes: "types/routes.d.ts", except_routes: [] }
+        // live.* (Live's update endpoint) stays out of the browser's route table; the server's route names keep it.
+        types: { pages: "resources/js/oriel/pages.d.ts", routes: "resources/js/oriel/routes.ts", server_routes: "types/routes.d.ts", except_routes: [...DEFAULT_EXCEPT_ROUTES] }
       },
       "inertia"
     );
-    this.app.singleton(ResponseFactory2, () => new ResponseFactory2(this.app));
-    this.app.scoped(InertiaFactory, (container) => container.make(ResponseFactory2).forRequest());
+    this.app.singleton(ResponseFactory, () => new ResponseFactory(this.app));
+    this.app.scoped(InertiaFactory, (container) => container.make(ResponseFactory).forRequest());
     this.app.singleton(HttpGateway, () => new HttpGateway(this.app));
     this.app.singleton(InertiaSsrGateway, (container) => container.make(HttpGateway));
   }
@@ -15740,7 +14193,7 @@ var InertiaServiceProvider = class extends ServiceProvider {
 // ../Log/dist/index.js
 import pino2 from "pino";
 import { createWriteStream as createWriteStream2, mkdirSync as mkdirSync2, readdirSync as readdirSync5, rmSync } from "fs";
-import { basename as basename3, dirname as dirname7, extname as extname3, join as join11 } from "path";
+import { basename as basename2, dirname as dirname6, extname as extname3, join as join11 } from "path";
 import { Writable } from "stream";
 import "pino";
 var rootKey = {};
@@ -15862,12 +14315,12 @@ function localDay(date) {
 }
 var DATE_PATTERN = /^(\d{4})-(\d{2})-(\d{2})$/;
 var DailyRotatingStream = class extends Writable {
-  constructor(basePath, days, now4 = () => /* @__PURE__ */ new Date()) {
+  constructor(basePath, days, now5 = () => /* @__PURE__ */ new Date()) {
     super();
     this.days = days;
-    this.now = now4;
-    this.dir = dirname7(basePath);
-    this.stem = basename3(basePath, extname3(basePath) || void 0);
+    this.now = now5;
+    this.dir = dirname6(basePath);
+    this.stem = basename2(basePath, extname3(basePath) || void 0);
     mkdirSync2(this.dir, { recursive: true });
   }
   days;
@@ -15932,8 +14385,8 @@ var DailyRotatingStream = class extends Writable {
   prune() {
     if (this.days <= 0) return;
     const prefix = `${this.stem}-`;
-    const now4 = this.now();
-    const cutoff = new Date(now4.getFullYear(), now4.getMonth(), now4.getDate() - (this.days - 1)).getTime();
+    const now5 = this.now();
+    const cutoff = new Date(now5.getFullYear(), now5.getMonth(), now5.getDate() - (this.days - 1)).getTime();
     for (const file of readdirSync5(this.dir)) {
       if (!file.startsWith(prefix) || !file.endsWith(".log")) continue;
       const match = DATE_PATTERN.exec(file.slice(prefix.length, -".log".length));
@@ -15996,9 +14449,9 @@ function createSingleChannel(path, minimumLevel = "debug") {
   destination.on("error", (error) => reportLogWriteFailure(path, error));
   return new PinoLogger(pino2(PINO_OPTIONS, destination), minimumLevel);
 }
-function createDailyChannel(path, days = 14, minimumLevel = "debug", now4) {
+function createDailyChannel(path, days = 14, minimumLevel = "debug", now5) {
   assertLogLevel(minimumLevel);
-  const stream = new DailyRotatingStream(path, days, now4);
+  const stream = new DailyRotatingStream(path, days, now5);
   return new PinoLogger(pino2(PINO_OPTIONS, stream), minimumLevel);
 }
 function createStderrChannel(minimumLevel = "debug") {
@@ -16701,7 +15154,8 @@ var MailMessage = class {
   introLines = [];
   actionData;
   outroLines = [];
-  salutationLine = "Regards,\nApplication";
+  /** Unset: "Regards," and config('app.name'), as Laravel's template. */
+  salutationLine;
   toAddresses = [];
   ccAddresses = [];
   bccAddresses = [];
@@ -16766,11 +15220,18 @@ var MailMessage = class {
       html2.push(`<p>${escapeHtml2(line)}</p>`);
       text3.push(line);
     }
-    html2.push(`<p>${escapeHtml2(this.salutationLine).replace(/\n/g, "<br>")}</p>`);
-    text3.push(this.salutationLine);
+    const salutation = this.salutationLine ?? `Regards,
+${appName()}`;
+    html2.push(`<p>${escapeHtml2(salutation).replace(/\n/g, "<br>")}</p>`);
+    text3.push(salutation);
     return { html: `<!doctype html><html><body>${html2.join("\n")}</body></html>`, text: text3.join("\n\n") };
   }
 };
+function appName() {
+  const container = currentContainer();
+  const name = container?.bound(ConfigRepository) ? container.make(ConfigRepository).get("app.name") : void 0;
+  return typeof name === "string" && name !== "" ? name : "Oriel";
+}
 function escapeHtml2(value2) {
   return value2.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
@@ -16841,9 +15302,9 @@ function wrapRow(row, db) {
     readAt: row.read_at ? parseStoredDate2(row.read_at) : void 0,
     async markAsRead() {
       if (record.readAt) return;
-      const now4 = /* @__PURE__ */ new Date();
-      await db.table(NOTIFICATIONS_TABLE).where("id", record.id).update({ read_at: now4, updated_at: now4 });
-      record.readAt = now4;
+      const now5 = /* @__PURE__ */ new Date();
+      await db.table(NOTIFICATIONS_TABLE).where("id", record.id).update({ read_at: now5, updated_at: now5 });
+      record.readAt = now5;
     },
     async markAsUnread() {
       if (!record.readAt) return;
@@ -16875,7 +15336,7 @@ var DatabaseNotificationChannel = class {
     const model = notifiable;
     if (typeof model.getKey !== "function") throw new NotDatabaseNotifiableError(notifiable.constructor.name);
     const db = requireDatabase();
-    const now4 = /* @__PURE__ */ new Date();
+    const now5 = /* @__PURE__ */ new Date();
     await db.table(NOTIFICATIONS_TABLE).insert({
       id: notification.id ?? randomUUID4(),
       type: notification.constructor.name,
@@ -16883,8 +15344,8 @@ var DatabaseNotificationChannel = class {
       notifiable_id: model.getKey(),
       data: JSON.stringify(data),
       read_at: null,
-      created_at: now4,
-      updated_at: now4
+      created_at: now5,
+      updated_at: now5
     });
   }
 };
@@ -17226,7 +15687,7 @@ import { randomUUID as randomUUID24 } from "crypto";
 import { Redis as Redis2 } from "ioredis";
 import { randomUUID as randomUUID32 } from "crypto";
 import { setTimeout as sleep4 } from "timers/promises";
-import { existsSync as existsSync9, readdirSync as readdirSync6, statSync as statSync3 } from "fs";
+import { existsSync as existsSync8, readdirSync as readdirSync6, statSync as statSync3 } from "fs";
 import { join as join12 } from "path";
 import { pathToFileURL as pathToFileURL6 } from "url";
 var QueueError = class extends Error {
@@ -17331,7 +15792,7 @@ function resolveClass(registry2, name) {
   if (!registry2.has(name)) throw new JobClassNotFoundError(name);
   return registry2.resolve(name);
 }
-function isPlainObject3(value2) {
+function isPlainObject2(value2) {
   const proto = Object.getPrototypeOf(value2);
   return proto === Object.prototype || proto === null;
 }
@@ -17385,7 +15846,7 @@ function serializeValue(value2, registry2, path = "data", seen = /* @__PURE__ */
       }
       return { [TAG]: "model", class: name2, key: serializeValue(object.getKey(), registry2, `${path}.key`, seen) ?? null };
     }
-    if (isPlainObject3(object)) {
+    if (isPlainObject2(object)) {
       const fields = serializeFields(object, registry2, path, seen);
       return Object.hasOwn(fields, TAG) ? { [TAG]: "object", value: fields } : fields;
     }
@@ -17719,8 +16180,8 @@ var CallQueuedHandler = class {
     const lock = payload.uniqueLock;
     if (!lock || !this.container.bound(CacheManager)) return;
     const cache2 = this.container.make(CacheManager);
-    const store2 = lock.store !== void 0 ? cache2.store(lock.store) : cache2;
-    await store2.lock(lock.key).forceRelease();
+    const store = lock.store !== void 0 ? cache2.store(lock.store) : cache2;
+    await store.lock(lock.key).forceRelease();
   }
 };
 var WithoutOverlapping = class {
@@ -17957,34 +16418,34 @@ var DatabaseQueue = class extends QueueBase {
     });
   }
   async pushToDatabase(queue, payload, delaySeconds2, attempts, db = this.database()) {
-    const now4 = this.currentTime();
+    const now5 = this.currentTime();
     const id = await db.table(this.table).insertGetId({
       queue,
       payload: encodePayload({ ...payload, attempts: 0 }),
       attempts,
       reserved_at: null,
-      available_at: now4 + Math.max(0, Math.round(delaySeconds2)),
-      created_at: now4
+      available_at: now5 + Math.max(0, Math.round(delaySeconds2)),
+      created_at: now5
     });
     return String(id);
   }
   /** The oldest available row, or the oldest reservation older than retry_after, whichever has the lower id. */
   async getNextAvailableJob(db, queue) {
-    const now4 = this.currentTime();
-    const available = await db.table(this.table).where("queue", queue).whereNull("reserved_at").where("available_at", "<=", now4).orderBy("id", "asc").lockForUpdate().first();
-    const expired = await db.table(this.table).where("queue", queue).whereNotNull("reserved_at").where("reserved_at", "<=", now4 - this.retryAfter).orderBy("id", "asc").lockForUpdate().first();
+    const now5 = this.currentTime();
+    const available = await db.table(this.table).where("queue", queue).whereNull("reserved_at").where("available_at", "<=", now5).orderBy("id", "asc").lockForUpdate().first();
+    const expired = await db.table(this.table).where("queue", queue).whereNotNull("reserved_at").where("reserved_at", "<=", now5 - this.retryAfter).orderBy("id", "asc").lockForUpdate().first();
     if (!available || !expired) return available ?? expired;
     return Number(available.id) <= Number(expired.id) ? available : expired;
   }
   /** Reserves the row only if nobody else changed it since we read it. */
   async markJobAsReserved(db, record) {
-    const now4 = this.currentTime();
+    const now5 = this.currentTime();
     const query = db.table(this.table).where("id", record.id).where("attempts", record.attempts);
     if (record.reserved_at === null) query.whereNull("reserved_at");
     else query.where("reserved_at", record.reserved_at);
-    const affected = await query.update({ reserved_at: now4, attempts: Number(record.attempts) + 1 });
+    const affected = await query.update({ reserved_at: now5, attempts: Number(record.attempts) + 1 });
     if (affected === 0) return false;
-    record.reserved_at = now4;
+    record.reserved_at = now5;
     record.attempts = Number(record.attempts) + 1;
     return true;
   }
@@ -18112,11 +16573,11 @@ var RedisQueue = class extends QueueBase {
   }
   async pop(queue) {
     const key = this.key(queue);
-    const now4 = this.now();
-    await this.redis().eval(MIGRATE_EXPIRED_JOBS, 3, `${key}:delayed`, key, `${key}:notify`, now4);
-    await this.redis().eval(MIGRATE_EXPIRED_JOBS, 3, `${key}:reserved`, key, `${key}:notify`, now4);
+    const now5 = this.now();
+    await this.redis().eval(MIGRATE_EXPIRED_JOBS, 3, `${key}:delayed`, key, `${key}:notify`, now5);
+    await this.redis().eval(MIGRATE_EXPIRED_JOBS, 3, `${key}:reserved`, key, `${key}:notify`, now5);
     for (; ; ) {
-      const [job, reserved] = await this.redis().eval(POP, 3, key, `${key}:reserved`, `${key}:notify`, now4 + this.retryAfter);
+      const [job, reserved] = await this.redis().eval(POP, 3, key, `${key}:reserved`, `${key}:notify`, now5 + this.retryAfter);
       if (!job || !reserved) return void 0;
       try {
         return new RedisJob(this.jobContext(), this, job, reserved, this.getQueue(queue));
@@ -18510,8 +16971,8 @@ var DatabaseBatchRepository = class {
     await this.database().table(this.table).where("id", id).update({ finished_at: this.now() });
   }
   async cancel(id) {
-    const now4 = this.now();
-    await this.database().table(this.table).where("id", id).update({ cancelled_at: now4, finished_at: now4 });
+    const now5 = this.now();
+    await this.database().table(this.table).where("id", id).update({ cancelled_at: now5, finished_at: now5 });
   }
   async delete(id) {
     await this.database().table(this.table).where("id", id).delete();
@@ -18816,13 +17277,13 @@ var Worker = class _Worker {
     }
   }
 };
-var EXTENSIONS3 = [".ts", ".js", ".mts", ".mjs"];
+var EXTENSIONS2 = [".ts", ".js", ".mts", ".mjs"];
 function files2(directory) {
   const found = [];
   for (const entry of readdirSync6(directory).sort()) {
     const path = join12(directory, entry);
     if (statSync3(path).isDirectory()) found.push(...files2(path));
-    else if (EXTENSIONS3.some((extension) => entry.endsWith(extension)) && !entry.endsWith(".d.ts")) found.push(path);
+    else if (EXTENSIONS2.some((extension) => entry.endsWith(extension)) && !entry.endsWith(".d.ts")) found.push(path);
   }
   return found;
 }
@@ -18830,7 +17291,7 @@ var WORKER_DISCOVERY_DIRECTORIES = ["Events", "Listeners", "Mail", "Notification
 var isClass2 = (value2) => typeof value2 === "function" && /^class[\s{]/.test(Function.prototype.toString.call(value2));
 var isJobClass = (value2) => typeof value2.prototype.handle === "function";
 async function discoverClasses(directory, registry2, filter = () => true) {
-  if (!existsSync9(directory)) return [];
+  if (!existsSync8(directory)) return [];
   const names = [];
   for (const file of files2(directory)) {
     const module = await import(pathToFileURL6(file).href);
@@ -19041,7 +17502,9 @@ var QueueServiceProvider = class extends ServiceProvider {
 };
 
 // ../Routing/dist/index.js
+import { createHmac as createHmac4, timingSafeEqual as timingSafeEqual4 } from "crypto";
 import { pathToFileURL as pathToFileURL7 } from "url";
+import { createHash as createHash8 } from "crypto";
 var NotFoundHttpError = class extends Error {
   kind = "Http";
   status = 404;
@@ -19095,6 +17558,24 @@ var RoutingError = class extends Error {
   status = 500;
   name = "RoutingError";
 };
+var InvalidUrlSignatureError = class extends Error {
+  kind = "Http";
+  status = 403;
+  name = "InvalidUrlSignatureError";
+  constructor() {
+    super("Invalid signature.");
+  }
+};
+var ThrottleRequestsError = class extends Error {
+  constructor(headers = {}) {
+    super("Too Many Attempts.");
+    this.headers = headers;
+  }
+  headers;
+  kind = "Http";
+  status = 429;
+  name = "ThrottleRequestsError";
+};
 async function toResponse(request2, value2) {
   if (value2 instanceof Response) return value2;
   if (value2 === null || value2 === void 0) return new Response(null, { status: 204 });
@@ -19339,6 +17820,7 @@ var RouteDefinition = class {
     this.#name = (this.#name ?? "") + name;
     return this;
   }
+  /** middleware('auth', 'verified') or middleware(['auth', 'verified']). */
   middleware(...middleware) {
     this.#middleware.push(...middleware.flat());
     return this;
@@ -19796,7 +18278,7 @@ var BaseRouter = class {
   }
 };
 var VALID_URL = /^(#|\/\/|https?:\/\/|(mailto|tel|sms):)/i;
-var isPlainObject4 = (value2) => {
+var isPlainObject3 = (value2) => {
   if (typeof value2 !== "object" || value2 === null || Array.isArray(value2)) return false;
   const prototype = Object.getPrototypeOf(value2);
   return prototype === Object.prototype || prototype === null;
@@ -19805,7 +18287,7 @@ function buildQuery2(values) {
   const pairs = [];
   const add = (key, value2) => {
     if (value2 === null || value2 === void 0) return;
-    if (typeof value2 === "object" && (Array.isArray(value2) || isPlainObject4(value2))) {
+    if (typeof value2 === "object" && (Array.isArray(value2) || isPlainObject3(value2))) {
       for (const [child, nested] of Object.entries(value2)) add(`${key}[${child}]`, nested);
       return;
     }
@@ -19821,6 +18303,17 @@ function routeKey(value2, field) {
   if (field !== void 0) return typeof model.getAttribute === "function" ? model.getAttribute(field) : model[field];
   return typeof model.getRouteKey === "function" ? model.getRouteKey() : value2;
 }
+function sign(url2, key) {
+  return createHmac4("sha256", key).update(url2).digest("hex");
+}
+function safeEquals(expected, given) {
+  const a = Buffer.from(expected);
+  const b = Buffer.from(given);
+  return a.length === b.length && timingSafeEqual4(a, b);
+}
+function availableAt(expiration) {
+  return expiration instanceof Date ? Math.floor(expiration.getTime() / 1e3) : Math.floor(Date.now() / 1e3) + expiration;
+}
 var BaseUrlGenerator = class {
   constructor(router, container) {
     this.router = router;
@@ -19849,8 +18342,8 @@ var BaseUrlGenerator = class {
   route(name, parameters, absolute = true) {
     const route2 = this.router.getByName(name);
     if (route2 === void 0) throw new RouteNotDefinedError(name);
-    const named = isPlainObject4(parameters) ? { ...parameters } : {};
-    const positional = Array.isArray(parameters) ? [...parameters] : parameters === void 0 || parameters === null || isPlainObject4(parameters) ? [] : [parameters];
+    const named = isPlainObject3(parameters) ? { ...parameters } : {};
+    const positional = Array.isArray(parameters) ? [...parameters] : parameters === void 0 || parameters === null || isPlainObject3(parameters) ? [] : [parameters];
     const values = /* @__PURE__ */ new Map();
     const missing = [];
     for (const parameter of route2.parameters) {
@@ -19908,6 +18401,69 @@ var BaseUrlGenerator = class {
   hasRoute(name) {
     return this.router.getByName(name) !== void 0;
   }
+  /**
+   * Laravel's URL::signedRoute(): the route URL with its parameters sorted by name, then a `signature` query (the
+   * HMAC-SHA256 of that URL, keyed by APP_KEY). `expiration` (a Date, or seconds from now) adds `expires`.
+   * `absolute: false` signs the path only (checked by `signed:relative`).
+   */
+  signedRoute(name, parameters, expiration, absolute = true) {
+    const named = this.#namedParameters(name, parameters);
+    for (const reserved of ["signature", "expires"]) {
+      if (Object.hasOwn(named, reserved)) {
+        throw new RoutingError(`"${reserved}" is a reserved parameter when generating signed routes. Please rename your route parameter.`);
+      }
+    }
+    if (expiration !== void 0) named.expires = availableAt(expiration);
+    const sorted = Object.fromEntries(Object.keys(named).sort().map((key) => [key, named[key]]));
+    const signature = sign(this.route(name, sorted, absolute), this.#signingKeys()[0]);
+    return this.route(name, { ...sorted, signature }, absolute);
+  }
+  /** Laravel's URL::temporarySignedRoute(): a signed URL that expires at `expiration` (a Date, or seconds from now). */
+  temporarySignedRoute(name, expiration, parameters, absolute = true) {
+    return this.signedRoute(name, parameters, expiration, absolute);
+  }
+  /** The request URL carries a correct signature (current or previous APP_KEY) that hasn't expired. */
+  hasValidSignature(request2, absolute = true) {
+    return this.hasCorrectSignature(request2, absolute) && this.signatureHasNotExpired(request2);
+  }
+  /** The signature matches the URL without its `signature` query, in a constant-time comparison. */
+  hasCorrectSignature(request2, absolute = true) {
+    const full = new URL(request2.fullUrl());
+    const path = request2.path();
+    const url2 = absolute ? request2.url() : path === "/" ? "/" : `/${path}`;
+    const query = full.search.slice(1).split("&").filter((pair) => pair !== "" && pair.split("=")[0] !== "signature").join("&");
+    const original = query === "" ? url2 : `${url2}?${query}`;
+    const given = full.searchParams.get("signature") ?? "";
+    return this.#signingKeys().some((key) => safeEquals(sign(original, key), given));
+  }
+  /** No `expires` query, or one that is still in the future. */
+  signatureHasNotExpired(request2) {
+    const expires = new URL(request2.fullUrl()).searchParams.get("expires");
+    if (expires === null || expires === "") return true;
+    const at = Number(expires);
+    return Number.isFinite(at) && Math.floor(Date.now() / 1e3) <= at;
+  }
+  /** Named parameters: an object as is, positional values (a list or one value) by the route's parameter names. */
+  #namedParameters(name, parameters) {
+    if (isPlainObject3(parameters)) return { ...parameters };
+    const route2 = this.router.getByName(name);
+    if (route2 === void 0) throw new RouteNotDefinedError(name);
+    const values = parameters === void 0 || parameters === null ? [] : Array.isArray(parameters) ? parameters : [parameters];
+    const named = {};
+    route2.parameters.forEach((parameter, index) => {
+      if (index < values.length) named[parameter.name] = values[index];
+    });
+    return named;
+  }
+  /** The Encrypter's key, then its previous keys (config app.previous_keys), so rotated keys still verify. */
+  #signingKeys() {
+    const scope = this.#scope();
+    if (scope === void 0 || !scope.bound(Encrypter)) {
+      throw new RoutingError("Signed URLs need the Encrypter: set APP_KEY (oriel key:generate).");
+    }
+    const encrypter = scope.make(Encrypter);
+    return typeof encrypter.getAllKeys === "function" ? encrypter.getAllKeys() : [encrypter.getKey()];
+  }
   #join(path, absolute) {
     const trimmed = path.replace(/^\/+|\/+$/g, "");
     if (!absolute) return `/${trimmed}`;
@@ -19940,6 +18496,60 @@ function healthResponse() {
   const html2 = '<!DOCTYPE html>\n<html lang="en">\n<head>\n<meta charset="utf-8">\n<title>Application up</title>\n</head>\n<body><h1>Application up</h1></body>\n</html>';
   return new Response(html2, { status: 200, headers: { "content-type": "text/html; charset=utf-8" } });
 }
+var sha12 = (value2) => createHash8("sha1").update(value2).digest("hex");
+function withHeaders2(response2, headers) {
+  try {
+    for (const [name, value2] of Object.entries(headers)) response2.headers.set(name, value2);
+    return response2;
+  } catch {
+    const copy = new Headers(response2.headers);
+    for (const [name, value2] of Object.entries(headers)) copy.set(name, value2);
+    return new Response(response2.body, { status: response2.status, statusText: response2.statusText, headers: copy });
+  }
+}
+var ThrottleRequests = class {
+  async handle(request2, next, maxAttempts = "60", decayMinutes = "1", prefix = "") {
+    const max = Number(maxAttempts);
+    const decay = Number(decayMinutes);
+    if (maxAttempts.trim() === "" || !Number.isInteger(max) || max < 0 || decayMinutes.trim() === "" || !Number.isFinite(decay) || decay <= 0) {
+      throw new RoutingError(
+        `Invalid throttle parameters "${maxAttempts},${decayMinutes}": use throttle:<maxAttempts>,<decayMinutes>[,<prefix>] (named rate limiters are not supported).`
+      );
+    }
+    const limiter = inject(RateLimiter);
+    const key = prefix + this.resolveRequestSignature(request2);
+    if (await limiter.tooManyAttempts(key, max)) {
+      const retryAfter = await limiter.availableIn(key);
+      throw new ThrottleRequestsError({
+        "X-RateLimit-Limit": String(max),
+        "X-RateLimit-Remaining": "0",
+        "Retry-After": String(retryAfter),
+        "X-RateLimit-Reset": String(Math.floor(Date.now() / 1e3) + retryAfter)
+      });
+    }
+    await limiter.hit(key, Math.round(decay * 60));
+    const response2 = await next(request2);
+    return withHeaders2(response2, {
+      "X-RateLimit-Limit": String(max),
+      "X-RateLimit-Remaining": String(await limiter.remaining(key, max))
+    });
+  }
+  /** The signed-in user's identifier, else the client IP, hashed (Laravel's resolveRequestSignature()). */
+  resolveRequestSignature(request2) {
+    const user = request2.user();
+    if (user !== void 0 && user !== null && typeof user.getAuthIdentifier === "function") {
+      return sha12(String(user.getAuthIdentifier()));
+    }
+    return sha12(`|${request2.ip() ?? ""}`);
+  }
+};
+var ValidateSignature = class {
+  async handle(request2, next, ...parameters) {
+    const absolute = parameters[0] !== "relative";
+    if (inject(UrlGenerator).hasValidSignature(request2, absolute)) return next(request2);
+    throw new InvalidUrlSignatureError();
+  }
+};
 var RoutingServiceProvider = class extends ServiceProvider {
   register() {
     this.app.singleton(Router, () => new BaseRouter(this.app));
@@ -19957,23 +18567,28 @@ var RoutingServiceProvider = class extends ServiceProvider {
    * when the route files run.
    */
   boot() {
+    this.app.make(Router).aliasMiddleware("signed", ValidateSignature).aliasMiddleware("throttle", ThrottleRequests);
     this.app.booted(async () => {
       if (!this.app.bound(RoutingPaths)) return;
       const { web, api, health, apiPrefix } = this.app.make(RoutingPaths);
       const router = this.app.make(Router);
       if (health !== void 0) router.get(health, () => healthResponse());
-      if (web !== void 0) await router.middleware("web").group(() => loadRoutesFrom(this.app, router, web));
-      if (api !== void 0) await router.prefix(apiPrefix).middleware("api").group(() => loadRoutesFrom(this.app, router, api));
+      if (web !== void 0) await router.middleware("web").group(() => this.#load(router, web));
+      if (api !== void 0) await router.prefix(apiPrefix).middleware("api").group(() => this.#load(router, api));
     });
   }
+  /** One file or several, in order: each is imported afresh for this application (a nested import is not). */
+  async #load(router, files3) {
+    for (const file of [files3].flat()) await loadRoutesFrom(this.app, router, file);
+  }
 };
 
 // ../Session/dist/index.js
-import { mkdir as mkdir7, readdir as readdir3, readFile as readFile5, rename as rename3, rm as rm3, stat as stat4, writeFile as writeFile8 } from "fs/promises";
+import { mkdir as mkdir6, readdir as readdir3, readFile as readFile4, rename as rename3, rm as rm3, stat as stat3, writeFile as writeFile7 } from "fs/promises";
 import { join as join13 } from "path";
 import { Redis as Redis3 } from "ioredis";
 import { randomInt } from "crypto";
-import { timingSafeEqual as timingSafeEqual4 } from "crypto";
+import { timingSafeEqual as timingSafeEqual5 } from "crypto";
 var unique = (values) => [...new Set(values)];
 var Store = class {
   #id = "";
@@ -20212,18 +18827,18 @@ var FileSessionHandler = class {
     if (!VALID_ID.test(id)) return "";
     const file = join13(this.path, id);
     try {
-      const { mtimeMs } = await stat4(file);
+      const { mtimeMs } = await stat3(file);
       if (mtimeMs < this.clock() - this.minutes * 6e4) return "";
-      return await readFile5(file, "utf8");
+      return await readFile4(file, "utf8");
     } catch {
       return "";
     }
   }
   async write(id, data) {
     if (!VALID_ID.test(id)) return;
-    await mkdir7(this.path, { recursive: true });
+    await mkdir6(this.path, { recursive: true });
     const temporary = join13(this.path, `.${id}.${Str.random(8)}.tmp`);
-    await writeFile8(temporary, data, "utf8");
+    await writeFile7(temporary, data, "utf8");
     await rename3(temporary, join13(this.path, id));
   }
   async destroy(id) {
@@ -20234,7 +18849,7 @@ var FileSessionHandler = class {
     const files3 = await readdir3(this.path).catch(() => []);
     for (const file of files3) {
       if (!VALID_ID.test(file)) continue;
-      const { mtimeMs } = await stat4(join13(this.path, file)).catch(() => ({ mtimeMs: Number.POSITIVE_INFINITY }));
+      const { mtimeMs } = await stat3(join13(this.path, file)).catch(() => ({ mtimeMs: Number.POSITIVE_INFINITY }));
       if (mtimeMs <= expiration) await rm3(join13(this.path, file), { force: true });
     }
   }
@@ -20542,7 +19157,7 @@ var StartSession = class {
 function equals3(known, user) {
   const a = Buffer.from(known);
   const b = Buffer.from(user);
-  return a.length === b.length && timingSafeEqual4(a, b);
+  return a.length === b.length && timingSafeEqual5(a, b);
 }
 var VerifyCsrfToken = class {
   /** URIs (wildcards allowed) excluded from the check, in addition to config('http.csrf_except'). */
@@ -20644,15 +19259,15 @@ var SessionFacade = facade(Session, {
   extend: (driver, factory) => inject(SessionManager).extend(driver, factory)
 });
 function session(key, defaultValue) {
-  const store2 = inject(Session);
-  if (key === void 0) return store2;
-  if (typeof key === "string") return store2.get(key, defaultValue);
-  store2.put(key);
+  const store = inject(Session);
+  if (key === void 0) return store;
+  if (typeof key === "string") return store.get(key, defaultValue);
+  store.put(key);
   return void 0;
 }
 function old(key, defaultValue) {
-  const store2 = scopeSession();
-  return store2 === void 0 ? defaultValue : store2.getOldInput(key, defaultValue);
+  const store = scopeSession();
+  return store === void 0 ? defaultValue : store.getOldInput(key, defaultValue);
 }
 function csrfToken() {
   return inject(Session).token();
@@ -20705,6 +19320,23 @@ var ValidationErrorImpl = class extends Error {
   status = 422;
   name = "ValidationError";
 };
+var ValidationException = class _ValidationException extends ValidationErrorImpl {
+  /** Messages per field, each a string or a list. */
+  static withMessages(messages) {
+    const errors2 = Object.fromEntries(Object.entries(messages).map(([field, list3]) => [field, typeof list3 === "string" ? [list3] : [...list3]]));
+    return new _ValidationException(errors2);
+  }
+  constructor(errors2, errorBag = "default", redirectTo2) {
+    super(errors2, errorBag, redirectTo2);
+    this.message = summarize(errors2);
+  }
+};
+function summarize(errors2) {
+  const messages = Object.values(errors2).flat();
+  if (messages.length === 0) return "The given data was invalid.";
+  const more = messages.length - 1;
+  return more === 0 ? messages[0] : `${messages[0]} (and ${more} more ${more === 1 ? "error" : "errors"})`;
+}
 var AuthorizationErrorImpl = class extends Error {
   kind = "Authorization";
   status = 403;
@@ -20780,6 +19412,13 @@ var DEFAULT_MESSAGES = {
   alpha_num: "The :attribute field must only contain letters and numbers.",
   alpha_dash: "The :attribute field must only contain letters, numbers, dashes and underscores.",
   regex: "The :attribute field format is invalid.",
+  lowercase: "The :attribute field must be lowercase.",
+  uppercase: "The :attribute field must be uppercase.",
+  current_password: "The password is incorrect.",
+  "password.letters": "The :attribute field must contain at least one letter.",
+  "password.mixed": "The :attribute field must contain at least one uppercase and one lowercase letter.",
+  "password.numbers": "The :attribute field must contain at least one number.",
+  "password.symbols": "The :attribute field must contain at least one symbol.",
   confirmed: "The :attribute field confirmation does not match.",
   same: "The :attribute field must match :other.",
   different: "The :attribute field must be different from :other.",
@@ -20845,6 +19484,17 @@ var MessageBagImpl = class {
     return structuredClone(this.items);
   }
 };
+var authRules = {
+  current_password: {
+    validate: async (ctx) => {
+      const guard2 = inject(AuthFactory).guard(ctx.parameters[0]);
+      if (await guard2.guest()) return false;
+      const user = await guard2.user();
+      return user !== void 0 && typeof ctx.value === "string" && inject(Hasher).check(ctx.value, user.getAuthPassword());
+    },
+    messageKey: () => "current_password"
+  }
+};
 function guessColumn(attribute, expandedFromWildcard = false) {
   if (!expandedFromWildcard) return attribute;
   return attribute.split(".").filter((segment) => !/^\d+$/.test(segment)).at(-1) ?? attribute;
@@ -21027,8 +19677,8 @@ function resolveDateParam(rule, param, data) {
     const parsed = parseDate(fieldValue);
     if (!Number.isNaN(parsed)) return parsed;
   }
-  const relative7 = relativeDate(param);
-  if (relative7 !== void 0) return relative7;
+  const relative6 = relativeDate(param);
+  if (relative6 !== void 0) return relative6;
   const literal = parseDate(param);
   if (!Number.isNaN(literal)) return literal;
   if (FIELD_REFERENCE_RE.test(param)) return Number.NaN;
@@ -21065,6 +19715,14 @@ var formatRules = {
     validate: (ctx) => typeof ctx.value === "string" && ALPHA_DASH_RE.test(ctx.value),
     messageKey: () => "alpha_dash"
   },
+  lowercase: {
+    validate: (ctx) => (typeof ctx.value === "string" || typeof ctx.value === "number") && String(ctx.value).toLowerCase() === String(ctx.value),
+    messageKey: () => "lowercase"
+  },
+  uppercase: {
+    validate: (ctx) => (typeof ctx.value === "string" || typeof ctx.value === "number") && String(ctx.value).toUpperCase() === String(ctx.value),
+    messageKey: () => "uppercase"
+  },
   regex: {
     validate: (ctx) => typeof ctx.value === "string" && compileRegex(ctx.parameters[0] ?? "").test(ctx.value),
     messageKey: () => "regex"
@@ -21186,7 +19844,7 @@ var typeRules = {
 function hasAny(ctx, names) {
   return names.some((name) => ctx.ruleNames.includes(name));
 }
-function isPlainObject5(value2) {
+function isPlainObject4(value2) {
   if (typeof value2 !== "object" || value2 === null) return false;
   const proto = Object.getPrototypeOf(value2);
   return proto === Object.prototype || proto === null;
@@ -21199,7 +19857,7 @@ function measure(ctx) {
   if (Array.isArray(value2)) return { type: "array", size: value2.length };
   if (isUploadedFileLike(value2)) return { type: "file", size: value2.size / 1024 };
   if (hasAny(ctx, ["file", "image"])) return { type: "file", size: Number.NaN };
-  if (isPlainObject5(value2)) return { type: "array", size: Object.keys(value2).length };
+  if (isPlainObject4(value2)) return { type: "array", size: Object.keys(value2).length };
   if (hasAny(ctx, ["array"])) return { type: "array", size: stringLength(value2) };
   return { type: "string", size: stringLength(value2) };
 }
@@ -21246,7 +19904,81 @@ var builtinRules = {
   ...formatRules,
   ...sizeRules,
   ...fileRules,
-  ...databaseRules
+  ...databaseRules,
+  ...authRules
+};
+var defaultRule;
+var PasswordRule = class _PasswordRule {
+  #min;
+  #max;
+  #letters = false;
+  #mixedCase = false;
+  #numbers = false;
+  #symbols = false;
+  constructor(min = 8) {
+    this.#min = Math.max(1, min);
+  }
+  /** A password rule of at least `size` characters: PasswordRule.min(12).mixedCase(). */
+  static min(size) {
+    return new _PasswordRule(size);
+  }
+  static defaults(rule) {
+    if (rule !== void 0) {
+      defaultRule = rule ?? void 0;
+      return;
+    }
+    const resolved = typeof defaultRule === "function" ? defaultRule() : defaultRule;
+    return resolved === void 0 ? new _PasswordRule(8) : resolved.#copy();
+  }
+  min(size) {
+    this.#min = Math.max(1, size);
+    return this;
+  }
+  max(size) {
+    this.#max = size;
+    return this;
+  }
+  /** At least one letter. */
+  letters() {
+    this.#letters = true;
+    return this;
+  }
+  /** At least one uppercase and one lowercase letter. */
+  mixedCase() {
+    this.#mixedCase = true;
+    return this;
+  }
+  /** At least one number. */
+  numbers() {
+    this.#numbers = true;
+    return this;
+  }
+  /** At least one symbol (punctuation, a symbol or a space). */
+  symbols() {
+    this.#symbols = true;
+    return this;
+  }
+  validate(attribute, value2, fail) {
+    const name = defaultAttributeName(attribute);
+    const say = (key, replacements = {}) => fail(applyReplacements(DEFAULT_MESSAGES[key], { attribute: name, ...replacements }));
+    if (typeof value2 !== "string") return say("string");
+    const length = [...value2].length;
+    if (length < this.#min) say("min.string", { min: String(this.#min) });
+    if (this.#max !== void 0 && length > this.#max) say("max.string", { max: String(this.#max) });
+    if (this.#mixedCase && !/(\p{Ll}+.*\p{Lu})|(\p{Lu}+.*\p{Ll})/u.test(value2)) say("password.mixed");
+    if (this.#letters && !/\p{L}/u.test(value2)) say("password.letters");
+    if (this.#symbols && !/\p{Z}|\p{S}|\p{P}/u.test(value2)) say("password.symbols");
+    if (this.#numbers && !/\p{N}/u.test(value2)) say("password.numbers");
+  }
+  #copy() {
+    const copy = new _PasswordRule(this.#min);
+    copy.#max = this.#max;
+    copy.#letters = this.#letters;
+    copy.#mixedCase = this.#mixedCase;
+    copy.#numbers = this.#numbers;
+    copy.#symbols = this.#symbols;
+    return copy;
+  }
 };
 var BuiltinRuleObject = class {
   // Declares all 4 contract parameters so a subclass's inferred type (from `Rule.in(...)` etc.) still accepts a
@@ -21319,7 +20051,9 @@ var ExistsRule = class extends BuiltinRuleObject {
 var Rule = {
   in: (values) => new InRule(values),
   unique: (table, column) => new UniqueRule(table, column),
-  exists: (table, column) => new ExistsRule(table, column)
+  exists: (table, column) => new ExistsRule(table, column),
+  /** Laravel's Password::defaults(): the application's password rule (at least 8 characters unless PasswordRule.defaults() changed it). */
+  password: () => PasswordRule.defaults()
 };
 var SKIPPED_MODIFIERS = /* @__PURE__ */ new Set(["bail", "nullable", "sometimes"]);
 function buildNested(flat) {
@@ -21434,9 +20168,9 @@ var ValidatorImpl = class {
           const implicit = rule.kind === "named" && (this.registry[rule.name]?.implicit ?? false);
           if (!implicit && (!present2 || isBlank2)) continue;
           if (!implicit && nullable && isNull) continue;
-          const message = await this.runRule(rule, field, pattern, value2, names);
-          if (message !== void 0) {
-            this.bag.add(field, message);
+          const messages = await this.runRule(rule, field, pattern, value2, names);
+          if (messages.length > 0) {
+            for (const message of messages) this.bag.add(field, message);
             if (bail || implicit) break;
           }
         }
@@ -21449,26 +20183,24 @@ var ValidatorImpl = class {
     const expanded = pattern.includes("*");
     if (rule.kind === "object") {
       if (rule.rule instanceof BuiltinRuleObject) {
-        if (await rule.rule.passes(field, value2, this.data, expanded)) return void 0;
+        if (await rule.rule.passes(field, value2, this.data, expanded)) return [];
         const ctx2 = { attribute: field, expandedFromWildcard: expanded, value: value2, parameters: [], data: this.data, ruleNames };
-        return this.failureMessage(rule.rule.ruleName, this.registry[rule.rule.ruleName], ctx2, pattern);
+        return [this.failureMessage(rule.rule.ruleName, this.registry[rule.rule.ruleName], ctx2, pattern)];
       }
-      let failure;
-      await rule.rule.validate(field, value2, (message) => {
-        failure = message;
-      }, this.data);
-      return failure;
+      const failures = [];
+      await rule.rule.validate(field, value2, (message) => void failures.push(message), this.data);
+      return failures;
     }
     const builtin = this.registry[rule.name];
     if (!builtin) throw new UnknownValidationRuleError(rule.name);
     const ctx = { attribute: field, expandedFromWildcard: expanded, value: value2, parameters: rule.parameters, data: this.data, ruleNames };
-    if (await builtin.validate(ctx)) return void 0;
-    return this.failureMessage(rule.name, builtin, ctx, pattern);
+    if (await builtin.validate(ctx)) return [];
+    return [this.failureMessage(rule.name, builtin, ctx, pattern)];
   }
   /** Custom message (concrete field, then wildcard pattern, then rule name) or the default, with :attribute filled. */
   failureMessage(name, builtin, ctx, pattern) {
     const field = ctx.attribute;
-    const template = this.customMessages[`${field}.${name}`] ?? this.customMessages[`${pattern}.${name}`] ?? this.customMessages[name] ?? DEFAULT_MESSAGES[builtin?.messageKey(ctx) ?? name] ?? builtin?.defaultMessage ?? "The :attribute field is invalid.";
+    const template = this.customMessages[`${field}.${name}`] ?? this.customMessages[`${pattern}.${name}`] ?? this.customMessages[name] ?? builtin?.message ?? DEFAULT_MESSAGES[builtin?.messageKey(ctx) ?? name] ?? builtin?.defaultMessage ?? "The :attribute field is invalid.";
     const display = this.customAttributes[field] ?? this.customAttributes[pattern] ?? defaultAttributeName(field);
     return applyReplacements(template, { attribute: display, ...builtin?.replacements?.(ctx) ?? {} });
   }
@@ -21482,6 +20214,7 @@ var ValidationFactoryImpl = class {
     this.extended[name] = {
       validate: (ctx) => callback(ctx.attribute, ctx.value, ctx.parameters, ctx.data),
       messageKey: () => name,
+      ...message === void 0 ? {} : { message },
       defaultMessage: message ?? "The :attribute field is invalid."
     };
   }
@@ -21593,6 +20326,7 @@ export {
   CHAIN,
   Cache,
   CacheManager2 as CacheManager,
+  CacheRateLimiter,
   Repository2 as CacheRepositoryImpl,
   CacheServiceProvider,
   CallQueuedHandler,
@@ -21609,7 +20343,7 @@ export {
   ComponentNotFoundError,
   Computed,
   Connection,
-  Kernel as ConsoleKernelImpl,
+  Kernel2 as ConsoleKernelImpl,
   ConsoleServiceProvider,
   Container2 as Container,
   ContainerNotAvailableError,
@@ -21646,6 +20380,7 @@ export {
   Dispatchable,
   ELEMENT,
   EloquentUserProvider,
+  EmailVerificationRequest,
   EncryptCookies,
   EncryptError,
   EncryptHistory,
@@ -21695,7 +20430,7 @@ export {
   HelpCommand,
   HtmlString,
   HttpException,
-  Kernel2 as HttpKernelImpl,
+  Kernel as HttpKernelImpl,
   HttpRedirectResponse,
   HttpRedirector,
   HttpResponseException,
@@ -21709,7 +20444,7 @@ export {
   InertiaHtml,
   InertiaMiddleware,
   Response2 as InertiaPageResponse,
-  ResponseFactory2 as InertiaResponseFactory,
+  ResponseFactory as InertiaResponseFactory,
   InertiaServiceProvider,
   InvalidCacheConfigError,
   InvalidCastError,
@@ -21718,6 +20453,7 @@ export {
   InvalidLogLevelError,
   InvalidRuleParameterError,
   InvalidSignatureError,
+  InvalidUrlSignatureError,
   InvalidViewError,
   JOBS_TABLE_MIGRATION,
   JobClassNotFoundError,
@@ -21736,6 +20472,7 @@ export {
   LocalFilesystem,
   LockTimeoutError,
   Locked,
+  Lockout,
   Log,
   LogChannelCycleError,
   LogManager2 as LogManager,
@@ -21820,12 +20557,14 @@ export {
   On,
   OnceProp,
   OptionalProp,
+  PERSISTENT_MIDDLEWARE,
   PERSONAL_ACCESS_TOKENS_MIGRATION,
   Paginator,
   Password,
   PasswordBroker2 as PasswordBroker,
   PasswordBrokerManager,
   PasswordReset,
+  PasswordRule,
   PathTraversalError,
   PendingBatch,
   PendingChain,
@@ -21854,6 +20593,7 @@ export {
   QueuedConsoleInput,
   QueuedMailSender,
   RESTART_CACHE_KEY,
+  RateLimiter2 as RateLimiter,
   RedirectIfAuthenticated,
   RedisJob,
   RedisLock,
@@ -21862,6 +20602,7 @@ export {
   RedisSessionHandler,
   RedisStore,
   RedisTaggedStore,
+  Registered,
   Relation,
   RelationNotFoundError,
   RelationNotLoadedError,
@@ -21891,6 +20632,7 @@ export {
   SchemaGrammar,
   ScrollProp,
   Seeder,
+  SendEmailVerificationNotification,
   SendQueuedMailable,
   SendQueuedNotifications,
   ServiceProvider,
@@ -21913,7 +20655,10 @@ export {
   SyncQueue,
   TagsNotSupportedError,
   TestCommand,
+  TestRequestScope,
   Testable,
+  ThrottleRequests,
+  ThrottleRequestsError,
   TimeoutExceededError,
   TinkerCommand,
   TokenGuard,
@@ -21944,13 +20689,17 @@ export {
   UnsupportedCipherError,
   UnsupportedOperationError,
   UrlGenerationError,
+  ValidateSignature,
   Validated,
   ValidationErrorImpl,
+  ValidationException,
   ValidationFactoryImpl,
   ValidationServiceProvider,
   Validator,
   ValidatorImpl,
+  Verified,
   VerifyCsrfToken,
+  VerifyEmail,
   View,
   Factory as ViewFactoryImpl,
   ViewFactoryUnavailableError,
@@ -21963,6 +20712,7 @@ export {
   WORKER_DISCOVERY_DIRECTORIES,
   WithoutOverlapping,
   Worker,
+  __,
   abort,
   abortIf,
   abortUnless,
@@ -22001,7 +20751,7 @@ export {
   csrfToken,
   currentContainer,
   currentLogContext,
-  currentRequest2 as currentRequest,
+  currentRequest,
   currentVite,
   databaseConfigDefaults,
   debugPage,
@@ -22032,6 +20782,7 @@ export {
   errors,
   escapeHtml,
   event,
+  exceedsJsonDepth,
   expandWildcardKeys,
   extensionFromMime,
   facade,
@@ -22108,6 +20859,7 @@ export {
   parseRuleSpec,
   parseSignature,
   passwordVerify,
+  persistentMiddleware,
   prepareValue,
   queueConfigDefaults,
   queueOptionsOf,