@orieljs/validation 0.1.0-alpha.1 → 0.1.0-alpha.10

package/dist/index.js

@@ -13,6 +13,23 @@ var ValidationErrorImpl = class extends Error {
   status = 422;
   name = "ValidationError";
 };
+var ValidationException = class _ValidationException extends ValidationErrorImpl {
+  /** Messages per field, each a string or a list. */
+  static withMessages(messages) {
+    const errors = Object.fromEntries(Object.entries(messages).map(([field, list]) => [field, typeof list === "string" ? [list] : [...list]]));
+    return new _ValidationException(errors);
+  }
+  constructor(errors, errorBag = "default", redirectTo) {
+    super(errors, errorBag, redirectTo);
+    this.message = summarize(errors);
+  }
+};
+function summarize(errors) {
+  const messages = Object.values(errors).flat();
+  if (messages.length === 0) return "The given data was invalid.";
+  const more = messages.length - 1;
+  return more === 0 ? messages[0] : `${messages[0]} (and ${more} more ${more === 1 ? "error" : "errors"})`;
+}
 var AuthorizationErrorImpl = class extends Error {
   kind = "Authorization";
   status = 403;
@@ -54,15 +71,17 @@ var FormRequest = class {
   /**
    * `const data = await StorePostRequest.validate()` (spec §4.3). Resolves the current request and the
    * ValidationFactory from the active container, runs authorize() first (throwing AuthorizationErrorImpl if it
-   * returns false), then validates request.all() against rules()/messages()/attributes() and returns the typed
-   * validated data (or throws the 422 ValidationError — see ValidatorImpl.validated()).
+   * returns false), then validates request.all() against rules()/messages()/attributes() and returns the validated
+   * data (or throws the 422 ValidationError — see ValidatorImpl.validated()). The data is typed from rules(): write
+   * it without a return type and with `as const` (`return { title: 'required|string' } as const`), so its rule
+   * strings keep their text; a rules() typed `Rules` gives `Record<string, unknown>`.
    */
   static async validate() {
     const instance = new this();
     if (!await instance.authorize()) throw new AuthorizationErrorImpl();
     const request = inject(HttpRequest);
     const factory = inject(ValidationFactory);
-    const validator = factory.make(request.all(), instance.rules(), instance.messages(), instance.attributes());
+    const validator = factory.make(request.all(), await instance.rules(), instance.messages(), instance.attributes());
     return validator.validated();
   }
 };
@@ -70,7 +89,7 @@ var FormRequest = class {
 // messages.ts
 import { Str } from "@orieljs/support";
 function defaultAttributeName(key) {
-  return key.split(".").map((segment) => Str.snake(segment).replace(/_/g, " ")).join(".");
+  return key.split(".").map((segment) => segment === "*" ? segment : Str.snake(segment).replace(/_/g, " ")).join(".");
 }
 function applyReplacements(template, replacements) {
   return Object.entries(replacements).reduce((message, [key, value]) => message.replaceAll(`:${key}`, value), template);
@@ -83,33 +102,97 @@ var DEFAULT_MESSAGES = {
   required_with_all: "The :attribute field is required when :values are present.",
   required_without: "The :attribute field is required when :values is not present.",
   required_without_all: "The :attribute field is required when none of :values are present.",
+  required_if_accepted: "The :attribute field is required when :other is accepted.",
+  required_if_declined: "The :attribute field is required when :other is declined.",
+  present: "The :attribute field must be present.",
+  present_if: "The :attribute field must be present when :other is :value.",
+  present_unless: "The :attribute field must be present unless :other is :value.",
+  present_with: "The :attribute field must be present when :values is present.",
+  present_with_all: "The :attribute field must be present when :values are present.",
+  filled: "The :attribute field must have a value.",
+  missing: "The :attribute field must be missing.",
+  missing_if: "The :attribute field must be missing when :other is :value.",
+  missing_unless: "The :attribute field must be missing unless :other is :value.",
+  missing_with: "The :attribute field must be missing when :values is present.",
+  missing_with_all: "The :attribute field must be missing when :values are present.",
+  prohibited: "The :attribute field is prohibited.",
+  prohibited_if: "The :attribute field is prohibited when :other is :value.",
+  prohibited_if_accepted: "The :attribute field is prohibited when :other is accepted.",
+  prohibited_if_declined: "The :attribute field is prohibited when :other is declined.",
+  prohibited_unless: "The :attribute field is prohibited unless :other is in :values.",
+  prohibits: "The :attribute field prohibits :other from being present.",
   string: "The :attribute field must be a string.",
   integer: "The :attribute field must be an integer.",
   numeric: "The :attribute field must be a number.",
   boolean: "The :attribute field must be true or false.",
   array: "The :attribute field must be an array.",
+  list: "The :attribute field must be a list.",
+  required_array_keys: "The :attribute field must contain entries for: :values.",
+  in_array_keys: "The :attribute field must contain at least one of the following keys: :values.",
+  contains: "The :attribute field is missing a required value.",
+  doesnt_contain: "The :attribute field must not contain any of the following: :values.",
+  distinct: "The :attribute field has a duplicate value.",
+  in_array: "The :attribute field must exist in :other.",
   email: "The :attribute field must be a valid email address.",
   url: "The :attribute field must be a valid URL.",
   uuid: "The :attribute field must be a valid UUID.",
+  ulid: "The :attribute field must be a valid ULID.",
+  ascii: "The :attribute field must only contain single-byte alphanumeric characters and symbols.",
+  hex_color: "The :attribute field must be a valid hexadecimal color.",
+  json: "The :attribute field must be a valid JSON string.",
+  ip: "The :attribute field must be a valid IP address.",
+  ipv4: "The :attribute field must be a valid IPv4 address.",
+  ipv6: "The :attribute field must be a valid IPv6 address.",
+  mac_address: "The :attribute field must be a valid MAC address.",
+  active_url: "The :attribute field must be a valid URL.",
+  timezone: "The :attribute field must be a valid timezone.",
+  starts_with: "The :attribute field must start with one of the following: :values.",
+  ends_with: "The :attribute field must end with one of the following: :values.",
+  doesnt_start_with: "The :attribute field must not start with one of the following: :values.",
+  doesnt_end_with: "The :attribute field must not end with one of the following: :values.",
   alpha: "The :attribute field must only contain letters.",
   alpha_num: "The :attribute field must only contain letters and numbers.",
-  alpha_dash: "The :attribute field must only contain letters, numbers, dashes and underscores.",
+  alpha_dash: "The :attribute field must only contain letters, numbers, dashes, and underscores.",
   regex: "The :attribute field format is invalid.",
+  not_regex: "The :attribute field format is invalid.",
+  lowercase: "The :attribute field must be lowercase.",
+  uppercase: "The :attribute field must be uppercase.",
+  current_password: "The password is incorrect.",
+  "password.letters": "The :attribute field must contain at least one letter.",
+  "password.mixed": "The :attribute field must contain at least one uppercase and one lowercase letter.",
+  "password.numbers": "The :attribute field must contain at least one number.",
+  "password.symbols": "The :attribute field must contain at least one symbol.",
   confirmed: "The :attribute field confirmation does not match.",
   same: "The :attribute field must match :other.",
-  different: "The :attribute field must be different from :other.",
+  different: "The :attribute field and :other must be different.",
   accepted: "The :attribute field must be accepted.",
+  accepted_if: "The :attribute field must be accepted when :other is :value.",
+  declined: "The :attribute field must be declined.",
+  declined_if: "The :attribute field must be declined when :other is :value.",
   digits: "The :attribute field must be :digits digits.",
+  digits_between: "The :attribute field must be between :min and :max digits.",
+  max_digits: "The :attribute field must not have more than :max digits.",
+  min_digits: "The :attribute field must have at least :min digits.",
+  decimal: "The :attribute field must have :decimal decimal places.",
+  multiple_of: "The :attribute field must be a multiple of :value.",
   date: "The :attribute field must be a valid date.",
   before: "The :attribute field must be a date before :date.",
+  before_or_equal: "The :attribute field must be a date before or equal to :date.",
   after: "The :attribute field must be a date after :date.",
+  after_or_equal: "The :attribute field must be a date after or equal to :date.",
+  date_equals: "The :attribute field must be a date equal to :date.",
+  date_format: "The :attribute field must match the format :format.",
   in: "The selected :attribute is invalid.",
   not_in: "The selected :attribute is invalid.",
+  enum: "The selected :attribute is invalid.",
   unique: "The :attribute has already been taken.",
   exists: "The selected :attribute is invalid.",
   file: "The :attribute field must be a file.",
   image: "The :attribute field must be an image.",
   mimes: "The :attribute field must be a file of type: :values.",
+  mimetypes: "The :attribute field must be a file of type: :values.",
+  extensions: "The :attribute field must have one of the following extensions: :values.",
+  dimensions: "The :attribute field has invalid image dimensions.",
   "max.string": "The :attribute field must not be greater than :max characters.",
   "max.numeric": "The :attribute field must not be greater than :max.",
   "max.array": "The :attribute field must not have more than :max items.",
@@ -125,13 +208,29 @@ var DEFAULT_MESSAGES = {
   "size.string": "The :attribute field must be :size characters.",
   "size.numeric": "The :attribute field must be :size.",
   "size.array": "The :attribute field must contain :size items.",
-  "size.file": "The :attribute field must be :size kilobytes."
+  "size.file": "The :attribute field must be :size kilobytes.",
+  "gt.array": "The :attribute field must have more than :value items.",
+  "gt.file": "The :attribute field must be greater than :value kilobytes.",
+  "gt.numeric": "The :attribute field must be greater than :value.",
+  "gt.string": "The :attribute field must be greater than :value characters.",
+  "gte.array": "The :attribute field must have :value items or more.",
+  "gte.file": "The :attribute field must be greater than or equal to :value kilobytes.",
+  "gte.numeric": "The :attribute field must be greater than or equal to :value.",
+  "gte.string": "The :attribute field must be greater than or equal to :value characters.",
+  "lt.array": "The :attribute field must have less than :value items.",
+  "lt.file": "The :attribute field must be less than :value kilobytes.",
+  "lt.numeric": "The :attribute field must be less than :value.",
+  "lt.string": "The :attribute field must be less than :value characters.",
+  "lte.array": "The :attribute field must not have more than :value items.",
+  "lte.file": "The :attribute field must be less than or equal to :value kilobytes.",
+  "lte.numeric": "The :attribute field must be less than or equal to :value.",
+  "lte.string": "The :attribute field must be less than or equal to :value characters."
 };
 
 // MessageBag.ts
 var MessageBagImpl = class {
-  items = {};
-  /** Not part of the MessageBag contract — used internally by ValidatorImpl and by after() hooks. */
+  // No prototype: a field named `constructor` or `toString` is a key like any other.
+  items = /* @__PURE__ */ Object.create(null);
   add(key, message) {
     ;
     (this.items[key] ??= []).push(message);
@@ -163,38 +262,8 @@ var MessageBagImpl = class {
   }
 };
 
-// rules/database.ts
-import { DatabaseManager } from "@orieljs/contracts";
-import { inject as inject2 } from "@orieljs/container";
-function guessColumn(attribute, expandedFromWildcard = false) {
-  if (!expandedFromWildcard) return attribute;
-  return attribute.split(".").filter((segment) => !/^\d+$/.test(segment)).at(-1) ?? attribute;
-}
-function isNoExcept(except) {
-  return except === void 0 || except === null || except === "" || except === "NULL";
-}
-async function matchingRecordExists(table, column, value, except, idColumn = "id") {
-  const db = inject2(DatabaseManager);
-  let query = db.connection().table(table).where(column, value);
-  if (!isNoExcept(except)) query = query.where(idColumn, "!=", except);
-  return query.exists();
-}
-var databaseRules = {
-  unique: {
-    validate: async (ctx) => {
-      const [table, column, except, idColumn] = ctx.parameters;
-      return !await matchingRecordExists(table, column || guessColumn(ctx.attribute, ctx.expandedFromWildcard), ctx.value, except, idColumn || "id");
-    },
-    messageKey: () => "unique"
-  },
-  exists: {
-    validate: async (ctx) => {
-      const [table, column] = ctx.parameters;
-      return matchingRecordExists(table, column || guessColumn(ctx.attribute, ctx.expandedFromWildcard), ctx.value);
-    },
-    messageKey: () => "exists"
-  }
-};
+// rules/acceptance.ts
+import { Arr as Arr3 } from "@orieljs/support";
 
 // parse.ts
 import { Arr } from "@orieljs/support";
@@ -205,18 +274,26 @@ function splitOnce(value, separator) {
   const index = value.indexOf(separator);
   return index === -1 ? [value, void 0] : [value.slice(0, index), value.slice(index + 1)];
 }
-function parseRuleSpec(spec) {
+function isExpandingRule(item) {
+  return typeof item === "object" && item !== null && typeof item.expandRules === "function";
+}
+function parseRuleSpec(spec, data = {}) {
   const items = typeof spec === "string" ? spec.split("|") : spec;
-  return items.filter((item) => item !== "").map((item) => {
-    if (typeof item !== "string") return { kind: "object", rule: item };
+  return items.filter((item) => item !== "").flatMap((item) => {
+    if (isExpandingRule(item)) return parseRuleSpec(item.expandRules(data), data);
+    if (typeof item !== "string") return [{ kind: "object", rule: item }];
     const [name, raw] = splitOnce(item, ":");
-    return { kind: "named", name, parameters: raw === void 0 ? [] : splitParameters(name, raw) };
+    return [{ kind: "named", name, parameters: raw === void 0 ? [] : splitParameters(name, raw) }];
   });
 }
 function isEmptyValue(value) {
   if (value === null || value === void 0) return true;
-  if (typeof value === "string") return value === "";
+  if (typeof value === "string") return value.trim() === "";
   if (Array.isArray(value)) return value.length === 0;
+  if (typeof value === "object") {
+    const proto = Object.getPrototypeOf(value);
+    return (proto === Object.prototype || proto === null) && Object.keys(value).length === 0;
+  }
   return false;
 }
 function isUploadedFileLike(value) {
@@ -246,45 +323,566 @@ function expandWildcardKeys(pattern, data) {
   return paths;
 }
 
-// rules/file.ts
-var IMAGE_EXTENSIONS = /* @__PURE__ */ new Set(["jpg", "jpeg", "png", "bmp", "gif", "svg", "webp"]);
-var fileRules = {
-  file: { validate: (ctx) => isUploadedFileLike(ctx.value), messageKey: () => "file" },
-  image: {
+// rules/dependent.ts
+import { Arr as Arr2 } from "@orieljs/support";
+
+// rules/type.ts
+var BOOLEAN_VALUES = [true, false, 0, 1, "0", "1"];
+var NUMERIC_STRING_RE = /^\s*[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?\s*$/;
+function isNumeric(value) {
+  if (typeof value === "number") return Number.isFinite(value);
+  return typeof value === "string" && NUMERIC_STRING_RE.test(value);
+}
+function isPlainObject(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+var typeRules = {
+  string: { validate: (ctx) => typeof ctx.value === "string", messageKey: () => "string" },
+  /** `integer:strict` refuses the text of a number (Laravel's is_int()). */
+  integer: {
+    validate: (ctx) => ctx.parameters[0] === "strict" ? Number.isInteger(ctx.value) : typeof ctx.value !== "object" && /^-?\d+$/.test(String(ctx.value).trim()),
+    messageKey: () => "integer"
+  },
+  /** `numeric:strict` refuses the text of a number. */
+  numeric: {
+    validate: (ctx) => ctx.parameters[0] === "strict" ? typeof ctx.value === "number" && Number.isFinite(ctx.value) : isNumeric(ctx.value),
+    messageKey: () => "numeric"
+  },
+  /** `boolean:strict` lets only true and false through. */
+  boolean: {
+    validate: (ctx) => ctx.parameters[0] === "strict" ? typeof ctx.value === "boolean" : BOOLEAN_VALUES.includes(ctx.value),
+    messageKey: () => "boolean"
+  },
+  /**
+   * `array`: a list. `array:name,email`: an object (PHP's associative array) whose keys are all among those named, as
+   * Laravel's validateArray() with keys.
+   */
+  array: {
+    validate: (ctx) => ctx.parameters.length === 0 ? Array.isArray(ctx.value) : isPlainObject(ctx.value) && Object.keys(ctx.value).every((key) => ctx.parameters.includes(key)),
+    messageKey: () => "array"
+  }
+};
+
+// rules/dependent.ts
+function truthy(value) {
+  if (typeof value === "string") return value !== "" && value !== "0";
+  if (Array.isArray(value)) return value.length > 0;
+  return Boolean(value);
+}
+function looseEquals(value, parameter) {
+  if (typeof parameter === "boolean") return truthy(value) === parameter;
+  if (typeof value === "number") return isNumeric(parameter) ? Number(parameter) === value : String(value) === parameter;
+  if (typeof value === "string") return isNumeric(value) && isNumeric(parameter) ? Number(value) === Number(parameter) : value === parameter;
+  return false;
+}
+function otherFieldMatches(ctx) {
+  const [field = "", ...listed4] = ctx.parameters;
+  const other = Arr2.get(ctx.data, field);
+  let values = listed4;
+  if (typeof other === "boolean" || ctx.getRule?.(field, "boolean") !== void 0) {
+    values = values.map((value) => value === "true" ? true : value === "false" ? false : value);
+  }
+  if (other === null || other === void 0) {
+    values = values.map((value) => typeof value === "string" && value.toLowerCase() === "null" ? null : value);
+    return values.includes(null);
+  }
+  if (typeof other === "boolean") return values.includes(other);
+  return values.some((value) => value !== null && looseEquals(other, value));
+}
+function displayableValue(value) {
+  if (typeof value === "boolean") return value ? "true" : "false";
+  if (value === null || value === void 0) return "empty";
+  if (typeof value === "object") return "array";
+  return String(value);
+}
+function displayName(ctx, field) {
+  return ctx.displayName?.(field) ?? defaultAttributeName(field);
+}
+function otherAndValue(ctx) {
+  const field = ctx.parameters[0] ?? "";
+  return { other: displayName(ctx, field), value: displayableValue(Arr2.get(ctx.data, field)) };
+}
+function otherAndValues(ctx) {
+  return { other: displayName(ctx, ctx.parameters[0] ?? ""), values: ctx.parameters.slice(1).join(", ") };
+}
+function fieldList(ctx) {
+  return { values: ctx.parameters.map((field) => displayName(ctx, field)).join(" / ") };
+}
+
+// rules/acceptance.ts
+var ACCEPTED_VALUES = ["yes", "on", 1, "1", true, "true"];
+var DECLINED_VALUES = ["no", "off", 0, "0", false, "false"];
+var isAccepted = (value) => !isEmptyValue(value) && ACCEPTED_VALUES.includes(value);
+var isDeclined = (value) => !isEmptyValue(value) && DECLINED_VALUES.includes(value);
+var otherAccepted = (data, field = "") => isAccepted(Arr3.get(data, field));
+var otherDeclined = (data, field = "") => isDeclined(Arr3.get(data, field));
+var acceptanceRules = {
+  accepted: { implicit: true, validate: (ctx) => isAccepted(ctx.value), messageKey: () => "accepted" },
+  accepted_if: {
+    implicit: true,
+    validate: (ctx) => !otherFieldMatches(ctx) || isAccepted(ctx.value),
+    messageKey: () => "accepted_if",
+    replacements: otherAndValue
+  },
+  declined: { implicit: true, validate: (ctx) => isDeclined(ctx.value), messageKey: () => "declined" },
+  declined_if: {
+    implicit: true,
+    validate: (ctx) => !otherFieldMatches(ctx) || isDeclined(ctx.value),
+    messageKey: () => "declined_if",
+    replacements: otherAndValue
+  }
+};
+
+// rules/array.ts
+import { Arr as Arr4 } from "@orieljs/support";
+function alike(a, b, strict = false) {
+  if (strict || a === b) return a === b;
+  if (typeof b === "string" || typeof b === "boolean") return looseEquals(a, b);
+  if (typeof a === "string" || typeof a === "boolean") return looseEquals(b, a);
+  return false;
+}
+var listed = (values) => ({ values: values.join(", ") });
+function matches(value, other, comparison3) {
+  if (comparison3 === "strict") return value === other;
+  if (comparison3 === "loose") return alike(value, other);
+  return (typeof other === "string" || typeof other === "number") && String(other).toLowerCase() === String(value).toLowerCase();
+}
+function looseClass(value) {
+  if (typeof value === "number") return Number.isFinite(value) ? `n:${value}` : void 0;
+  if (typeof value === "string") return isNumeric(value) ? `n:${Number(value)}` : `s:${value}`;
+  return void 0;
+}
+var increment = (counts, key) => counts.set(key, (counts.get(key) ?? 0) + 1);
+var PatternValues = class _PatternValues {
+  constructor(values) {
+    this.values = values;
+    for (const value of values) {
+      increment(this.identical, value);
+      if (typeof value === "string" || typeof value === "number") increment(this.text, String(value).toLowerCase());
+      const loose = looseClass(value);
+      if (loose !== void 0) increment(this.classes, loose);
+      else if (typeof value === "number") this.unclassed.push(value);
+      if (typeof value === "boolean") increment(this.booleans, value);
+      if (typeof value !== "string") increment(this.truthiness, truthy(value));
+    }
+  }
+  values;
+  /** By identity (SameValueZero): strict comparison, and null, undefined and objects under loose comparison. */
+  identical = /* @__PURE__ */ new Map();
+  /** Strings and numbers by their lower-cased text. */
+  text = /* @__PURE__ */ new Map();
+  /** Strings and finite numbers by looseClass(). */
+  classes = /* @__PURE__ */ new Map();
+  /** Booleans by value: what a string, number, null or object equals loosely besides its own class. */
+  booleans = /* @__PURE__ */ new Map();
+  /** Every value but a string, by PHP truthiness: what a boolean equals loosely. */
+  truthiness = /* @__PURE__ */ new Map();
+  /** NaN and ±Infinity, compared one by one. */
+  unclassed = [];
+  /** How many of the values `value` matches under the comparison. */
+  count(value, comparison3) {
+    if (comparison3 === "strict") return Number.isNaN(value) ? 0 : this.identical.get(value) ?? 0;
+    if (comparison3 === "ignore_case") return this.text.get(String(value).toLowerCase()) ?? 0;
+    if (typeof value === "boolean") return this.truthiness.get(value) ?? 0;
+    const loose = looseClass(value);
+    if (loose === void 0 && typeof value === "number") return this.values.filter((other) => alike(value, other)).length;
+    const own = loose === void 0 ? this.identical.get(value) ?? 0 : (this.classes.get(loose) ?? 0) + this.unclassed.filter((other) => alike(value, other)).length;
+    return own + (this.booleans.get(truthy(value)) ?? 0);
+  }
+  /** The values of the fields `pattern` names in the context's data, gathered once per validation pass. */
+  static of(ctx, pattern) {
+    const key = `array:values:${pattern}`;
+    const cached = ctx.cache?.get(key);
+    if (cached instanceof _PatternValues) return cached;
+    const fields = expandWildcardKeys(pattern, ctx.data).filter((field) => Arr4.has(ctx.data, field));
+    const values = new _PatternValues(fields.map((field) => Arr4.get(ctx.data, field)));
+    ctx.cache?.set(key, values);
+    return values;
+  }
+};
+var arrayRules = {
+  list: { validate: (ctx) => Array.isArray(ctx.value), messageKey: () => "list" },
+  required_array_keys: {
+    validate: (ctx) => isPlainObject(ctx.value) && ctx.parameters.every((key) => Object.hasOwn(ctx.value, key)),
+    messageKey: () => "required_array_keys",
+    replacements: (ctx) => listed(ctx.parameters)
+  },
+  in_array_keys: {
+    validate: (ctx) => isPlainObject(ctx.value) && ctx.parameters.some((key) => Object.hasOwn(ctx.value, key)),
+    messageKey: () => "in_array_keys",
+    replacements: (ctx) => listed(ctx.parameters)
+  },
+  /** Every value named is an item of the array (compared as PHP's in_array() does). */
+  contains: {
     validate: (ctx) => {
-      if (!isUploadedFileLike(ctx.value)) return false;
-      if (ctx.value.mimeType.startsWith("image/")) return true;
-      return IMAGE_EXTENSIONS.has(ctx.value.extension().toLowerCase());
+      const items = ctx.value;
+      return Array.isArray(items) && ctx.parameters.every((needle) => items.some((item) => alike(item, needle)));
     },
-    messageKey: () => "image"
+    messageKey: () => "contains"
   },
-  mimes: {
+  doesnt_contain: {
     validate: (ctx) => {
-      if (!isUploadedFileLike(ctx.value)) return false;
-      const allowed = ctx.parameters.map((p) => p.toLowerCase());
-      return allowed.includes(ctx.value.extension().toLowerCase());
+      const items = ctx.value;
+      return Array.isArray(items) && !ctx.parameters.some((needle) => items.some((item) => alike(item, needle)));
     },
-    messageKey: () => "mimes",
-    replacements: (ctx) => ({ values: ctx.parameters.join(", ") })
+    messageKey: () => "doesnt_contain",
+    replacements: (ctx) => listed(ctx.parameters)
+  },
+  /**
+   * Laravel's validateDistinct(): no other field under the same wildcard holds this value. `distinct:strict` compares
+   * with `===`; `distinct:ignore_case` compares text case-insensitively.
+   */
+  distinct: {
+    validate: (ctx) => {
+      const comparison3 = ctx.parameters.includes("ignore_case") ? "ignore_case" : ctx.parameters.includes("strict") ? "strict" : "loose";
+      const own = Arr4.has(ctx.data, ctx.attribute) && matches(ctx.value, Arr4.get(ctx.data, ctx.attribute), comparison3) ? 1 : 0;
+      return PatternValues.of(ctx, ctx.pattern ?? ctx.attribute).count(ctx.value, comparison3) - own === 0;
+    },
+    messageKey: () => "distinct"
+  },
+  /** The value is one of the values of the fields the parameter names (`in_array:colors.*`). */
+  in_array: {
+    validate: (ctx) => PatternValues.of(ctx, ctx.parameters[0] ?? "").count(ctx.value, "loose") > 0,
+    messageKey: () => "in_array",
+    replacements: (ctx) => ({ other: displayName(ctx, ctx.parameters[0] ?? "") })
   }
 };
 
-// rules/format.ts
-import { Arr as Arr2 } from "@orieljs/support";
-var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-var ALPHA_RE = /^[A-Za-z]+$/;
-var ALPHA_NUM_RE = /^[A-Za-z0-9]+$/;
-var ALPHA_DASH_RE = /^[A-Za-z0-9_-]+$/;
-var ACCEPTED_VALUES = ["yes", "on", 1, "1", true, "true"];
-function compileRegex(raw) {
-  const match = /^\/(.*)\/([a-z]*)$/.exec(raw);
-  try {
-    return match ? new RegExp(match[1], match[2]) : new RegExp(raw);
-  } catch (error) {
-    throw new InvalidRuleParameterError("regex", raw, error instanceof Error ? error.message : String(error));
+// rules/auth.ts
+import { AuthFactory, Hasher } from "@orieljs/contracts";
+import { inject as inject2 } from "@orieljs/container";
+var authRules = {
+  current_password: {
+    validate: async (ctx) => {
+      const guard = inject2(AuthFactory).guard(ctx.parameters[0]);
+      if (await guard.guest()) return false;
+      const user = await guard.user();
+      return user !== void 0 && typeof ctx.value === "string" && inject2(Hasher).check(ctx.value, user.getAuthPassword());
+    },
+    messageKey: () => "current_password"
   }
+};
+
+// rules/database.ts
+import { DatabaseManager } from "@orieljs/contracts";
+import { inject as inject3 } from "@orieljs/container";
+function guessColumn(attribute, expandedFromWildcard = false) {
+  if (!expandedFromWildcard) return attribute;
+  return attribute.split(".").filter((segment) => !/^\d+$/.test(segment)).at(-1) ?? attribute;
+}
+function isNoExcept(except) {
+  return except === void 0 || except === null || except === "" || except === "NULL";
+}
+async function matchingRecordExists(table, column, value, except, idColumn = "id") {
+  const db = inject3(DatabaseManager);
+  let query = db.connection().table(table).where(column, value);
+  if (!isNoExcept(except)) query = query.where(idColumn, "!=", except);
+  return query.exists();
+}
+var databaseRules = {
+  unique: {
+    validate: async (ctx) => {
+      const [table, column, except, idColumn] = ctx.parameters;
+      return !await matchingRecordExists(table, column || guessColumn(ctx.attribute, ctx.expandedFromWildcard), ctx.value, except, idColumn || "id");
+    },
+    messageKey: () => "unique"
+  },
+  exists: {
+    validate: async (ctx) => {
+      const [table, column] = ctx.parameters;
+      return matchingRecordExists(table, column || guessColumn(ctx.attribute, ctx.expandedFromWildcard), ctx.value);
+    },
+    messageKey: () => "exists"
+  }
+};
+
+// rules/date.ts
+import { Arr as Arr5 } from "@orieljs/support";
+
+// dates/phpFormat.ts
+var DAYS = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
+var MONTHS = ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"];
+var UNSUPPORTED = /* @__PURE__ */ new Set(["z", "W", "t", "L", "o", "X", "x", "B", "e", "I", "T", "Z", "c", "r", "N", "w", "#", "?", "*", "+"]);
+var pad = (value, length2) => String(Math.abs(value)).padStart(length2, "0");
+function suffix(day) {
+  if (day % 100 >= 11 && day % 100 <= 13) return "th";
+  return ["th", "st", "nd", "rd"][day % 10] ?? "th";
+}
+function formatOffset(offset, colon) {
+  const sign = offset < 0 ? "-" : "+";
+  return `${sign}${pad(Math.trunc(Math.abs(offset) / 60), 2)}${colon ? ":" : ""}${pad(Math.abs(offset) % 60, 2)}`;
+}
+function parse(format2, value) {
+  const fields = { year: 1970, month: 1, day: 1, hour: 0, minute: 0, second: 0, micro: 0, offset: void 0, unix: void 0 };
+  let meridiem;
+  let twelveHour = false;
+  let position = 0;
+  const digits = (min, max) => {
+    const match = new RegExp(`^\\d{${min},${max}}`).exec(value.slice(position));
+    if (!match) return void 0;
+    position += match[0].length;
+    return Number(match[0]);
+  };
+  const word = (names, short) => {
+    const match = /^[A-Za-z]+/.exec(value.slice(position));
+    if (!match) return void 0;
+    const text = match[0].toLowerCase();
+    const index = names.findIndex((name) => name.toLowerCase() === text || short && name.slice(0, 3).toLowerCase() === text);
+    if (index === -1) return void 0;
+    position += match[0].length;
+    return index;
+  };
+  const offset = (colon) => {
+    const rest = value.slice(position);
+    if (colon === "z" && rest.startsWith("Z")) {
+      position += 1;
+      return 0;
+    }
+    const match = (colon === "none" ? /^([+-])(\d{2})(\d{2})/ : /^([+-])(\d{2}):(\d{2})/).exec(rest);
+    if (!match) return void 0;
+    position += match[0].length;
+    return (match[1] === "-" ? -1 : 1) * (Number(match[2]) * 60 + Number(match[3]));
+  };
+  for (let i = 0; i < format2.length; i++) {
+    const char = format2[i];
+    let read = 0;
+    switch (char) {
+      case "!":
+      case "|":
+        continue;
+      case "\\":
+        i++;
+        if (value[position] !== format2[i]) return void 0;
+        position++;
+        continue;
+      case "d":
+      case "j":
+        read = digits(1, 2);
+        if (read !== void 0) fields.day = read;
+        break;
+      case "D":
+      case "l":
+        read = word(DAYS, true);
+        break;
+      case "S":
+        if (!/^(st|nd|rd|th)/i.test(value.slice(position))) return void 0;
+        position += 2;
+        break;
+      case "F":
+      case "M":
+        read = word(MONTHS, true);
+        if (read !== void 0) fields.month = read + 1;
+        break;
+      case "m":
+      case "n":
+        read = digits(1, 2);
+        if (read !== void 0) fields.month = read;
+        break;
+      case "Y":
+        read = digits(1, 4);
+        if (read !== void 0) fields.year = read;
+        break;
+      case "y":
+        read = digits(2, 2);
+        if (read !== void 0) fields.year = read + (read < 70 ? 2e3 : 1900);
+        break;
+      case "a":
+      case "A": {
+        const match = /^(am|pm)/i.exec(value.slice(position));
+        if (!match) return void 0;
+        position += 2;
+        meridiem = match[1].toLowerCase();
+        break;
+      }
+      case "g":
+      case "h":
+        read = digits(1, 2);
+        if (read !== void 0 && (read < 1 || read > 12)) return void 0;
+        if (read !== void 0) fields.hour = read;
+        twelveHour = true;
+        break;
+      case "G":
+      case "H":
+        read = digits(1, 2);
+        if (read !== void 0) fields.hour = read;
+        break;
+      case "i":
+        read = digits(2, 2);
+        if (read !== void 0) fields.minute = read;
+        break;
+      case "s":
+        read = digits(2, 2);
+        if (read !== void 0) fields.second = read;
+        break;
+      case "v":
+        read = digits(3, 3);
+        if (read !== void 0) fields.micro = read * 1e3;
+        break;
+      case "u": {
+        const match = /^\d{1,6}/.exec(value.slice(position));
+        read = match ? Number(match[0].padEnd(6, "0")) : void 0;
+        if (match) position += match[0].length;
+        if (read !== void 0) fields.micro = read;
+        break;
+      }
+      case "O":
+        read = fields.offset = offset("none");
+        break;
+      case "P":
+        read = fields.offset = offset("required");
+        break;
+      case "p":
+        read = fields.offset = offset("z");
+        break;
+      case "U": {
+        const match = /^-?\d+/.exec(value.slice(position));
+        read = match ? Number(match[0]) : void 0;
+        if (match) position += match[0].length;
+        fields.unix = read;
+        break;
+      }
+      default:
+        if (value[position] !== char) return void 0;
+        position++;
+        continue;
+    }
+    if (read === void 0) return void 0;
+  }
+  if (position !== value.length) return void 0;
+  if (twelveHour && meridiem !== void 0) fields.hour = fields.hour % 12 + (meridiem === "pm" ? 12 : 0);
+  return fields;
+}
+function wallClock(fields) {
+  if (fields.unix !== void 0) return new Date(fields.unix * 1e3);
+  const date = /* @__PURE__ */ new Date(0);
+  date.setUTCFullYear(fields.year, fields.month - 1, fields.day);
+  date.setUTCHours(fields.hour, fields.minute, fields.second, Math.floor(fields.micro / 1e3));
+  return date;
+}
+function format(format2, date, micro, offset) {
+  let out = "";
+  for (let i = 0; i < format2.length; i++) {
+    const char = format2[i];
+    const day = date.getUTCDate();
+    const hour = date.getUTCHours();
+    switch (char) {
+      case "!":
+      case "|":
+        break;
+      case "\\":
+        i++;
+        out += format2[i] ?? "";
+        break;
+      case "d":
+        out += pad(day, 2);
+        break;
+      case "j":
+        out += String(day);
+        break;
+      case "D":
+        out += DAYS[date.getUTCDay()].slice(0, 3);
+        break;
+      case "l":
+        out += DAYS[date.getUTCDay()];
+        break;
+      case "S":
+        out += suffix(day);
+        break;
+      case "F":
+        out += MONTHS[date.getUTCMonth()];
+        break;
+      case "M":
+        out += MONTHS[date.getUTCMonth()].slice(0, 3);
+        break;
+      case "m":
+        out += pad(date.getUTCMonth() + 1, 2);
+        break;
+      case "n":
+        out += String(date.getUTCMonth() + 1);
+        break;
+      case "Y":
+        out += pad(date.getUTCFullYear(), 4);
+        break;
+      case "y":
+        out += pad(date.getUTCFullYear() % 100, 2);
+        break;
+      case "a":
+        out += hour < 12 ? "am" : "pm";
+        break;
+      case "A":
+        out += hour < 12 ? "AM" : "PM";
+        break;
+      case "g":
+        out += String(hour % 12 || 12);
+        break;
+      case "h":
+        out += pad(hour % 12 || 12, 2);
+        break;
+      case "G":
+        out += String(hour);
+        break;
+      case "H":
+        out += pad(hour, 2);
+        break;
+      case "i":
+        out += pad(date.getUTCMinutes(), 2);
+        break;
+      case "s":
+        out += pad(date.getUTCSeconds(), 2);
+        break;
+      case "v":
+        out += pad(Math.floor(micro / 1e3), 3);
+        break;
+      case "u":
+        out += pad(micro, 6);
+        break;
+      case "O":
+        out += formatOffset(offset, false);
+        break;
+      case "P":
+        out += formatOffset(offset, true);
+        break;
+      case "p":
+        out += offset === 0 ? "Z" : formatOffset(offset, true);
+        break;
+      case "U":
+        out += String(Math.floor(date.getTime() / 1e3));
+        break;
+      default:
+        out += char;
+    }
+  }
+  return out;
+}
+function assertSupportedFormat(rule, dateFormat) {
+  for (let i = 0; i < dateFormat.length; i++) {
+    if (dateFormat[i] === "\\") i++;
+    else if (UNSUPPORTED.has(dateFormat[i])) {
+      throw new InvalidRuleParameterError(rule, dateFormat, `the format character "${dateFormat[i]}" is not supported`);
+    }
+  }
+}
+function matchesFormat(dateFormat, value) {
+  const fields = parse(dateFormat, value);
+  if (!fields) return false;
+  const offset = fields.offset ?? 0;
+  return format(dateFormat, wallClock(fields), fields.micro, offset) === value;
 }
+function timestampWithFormat(dateFormat, value) {
+  const fields = parse(dateFormat, value);
+  if (!fields) return Number.NaN;
+  if (fields.unix !== void 0) return fields.unix * 1e3;
+  const utc = wallClock(fields).getTime();
+  if (fields.offset !== void 0) return utc - fields.offset * 6e4;
+  const local = /* @__PURE__ */ new Date(0);
+  local.setFullYear(fields.year, fields.month - 1, fields.day);
+  local.setHours(fields.hour, fields.minute, fields.second, Math.floor(fields.micro / 1e3));
+  return local.getTime();
+}
+
+// rules/date.ts
 var DATE_SHAPES = [
   /^\d{4}-\d{1,2}-\d{1,2}(?:[T\s].*)?$/,
   /^\d{1,2}[/.-]\d{1,2}[/.-]\d{2,4}(?:\s.*)?$/,
@@ -350,41 +948,444 @@ function relativeDate(param) {
   return date.getTime();
 }
 var FIELD_REFERENCE_RE = /^[A-Za-z_][\w-]*(?:\.[\w-]+)*$/;
-function resolveDateParam(rule, param, data) {
-  const fieldValue = Arr2.get(data, param);
-  if (typeof fieldValue === "string") {
-    const parsed = parseDate(fieldValue);
+var isDateInput = (value) => typeof value === "string" || typeof value === "number" && Number.isFinite(value);
+function resolveDateParam(ctx, rule, param, format2) {
+  const fieldValue = Arr5.get(ctx.data, param);
+  if (isDateInput(fieldValue)) {
+    const parsed = readDate(fieldValue, ctx.getRule?.(param, "date_format")?.[0] ?? format2);
     if (!Number.isNaN(parsed)) return parsed;
   }
   const relative = relativeDate(param);
   if (relative !== void 0) return relative;
-  const literal = parseDate(param);
+  const literal = readDate(param, format2);
   if (!Number.isNaN(literal)) return literal;
-  if (FIELD_REFERENCE_RE.test(param)) return Number.NaN;
+  if (FIELD_REFERENCE_RE.test(param)) return null;
   throw new InvalidRuleParameterError(rule, param, 'expected a date, today/tomorrow/yesterday/now, "+N unit", or a field name');
 }
-function compareDate(ctx, rule) {
-  const target = resolveDateParam(rule, ctx.parameters[0] ?? "", ctx.data);
-  if (typeof ctx.value !== "string") return false;
-  const value = parseDate(ctx.value);
-  if (Number.isNaN(value) || Number.isNaN(target)) return false;
-  return rule === "before" ? value < target : value > target;
+function readDate(value, format2) {
+  if (format2 !== void 0) {
+    const formatted = timestampWithFormat(format2, String(value));
+    if (!Number.isNaN(formatted)) return formatted;
+  }
+  return typeof value === "number" ? value * 1e3 : parseDate(value);
+}
+var COMPARE = {
+  before: (value, target) => value < target,
+  before_or_equal: (value, target) => value <= target,
+  after: (value, target) => value > target,
+  after_or_equal: (value, target) => value >= target,
+  date_equals: (value, target) => value === target
+};
+function compareDates(ctx, rule) {
+  const format2 = ctx.getRule?.(ctx.attribute, "date_format")?.[0];
+  const param = ctx.parameters[0] ?? "";
+  const target = resolveDateParam(ctx, rule, param, format2);
+  if (!isDateInput(ctx.value)) return false;
+  if (target === null && format2 !== void 0) {
+    return Arr5.get(ctx.data, param) == null;
+  }
+  const value = readDate(ctx.value, format2);
+  if (Number.isNaN(value)) return false;
+  if (target === null) {
+    return COMPARE[rule](Math.trunc(value / 1e3) === 0 ? 0 : 1, 0);
+  }
+  return COMPARE[rule](value, target);
+}
+function dateReplacement(ctx) {
+  const param = ctx.parameters[0] ?? "";
+  const format2 = ctx.getRule?.(ctx.attribute, "date_format")?.[0];
+  const isDate = relativeDate(param) !== void 0 || !Number.isNaN(readDate(param, format2));
+  return { date: isDate && !Arr5.has(ctx.data, param) ? param : displayName(ctx, param) };
+}
+var comparison = (rule) => ({
+  validate: (ctx) => compareDates(ctx, rule),
+  messageKey: () => rule,
+  replacements: dateReplacement
+});
+var dateRules = {
+  date: {
+    validate: (ctx) => typeof ctx.value === "string" && !Number.isNaN(parseDate(ctx.value)),
+    messageKey: () => "date"
+  },
+  before: comparison("before"),
+  before_or_equal: comparison("before_or_equal"),
+  after: comparison("after"),
+  after_or_equal: comparison("after_or_equal"),
+  date_equals: comparison("date_equals"),
+  /**
+   * Laravel's validateDateFormat(): the value (text, or a number) reads with one of the formats (PHP's characters,
+   * `date_format:Y-m-d,d/m/Y`) and formats back to the same text, so `2026-02-30` and `2026-2-28` fail `Y-m-d`.
+   */
+  date_format: {
+    validate: (ctx) => {
+      for (const format2 of ctx.parameters) assertSupportedFormat("date_format", format2);
+      if (typeof ctx.value !== "string" && !(typeof ctx.value === "number" && Number.isFinite(ctx.value))) return false;
+      const text = String(ctx.value);
+      return ctx.parameters.some((format2) => matchesFormat(format2, text));
+    },
+    messageKey: () => "date_format",
+    replacements: (ctx) => ({ format: ctx.parameters[0] ?? "" })
+  }
+};
+
+// rules/exclude.ts
+import { Arr as Arr6 } from "@orieljs/support";
+var excludeRules = {
+  exclude: { excludes: true, validate: () => false, messageKey: () => "exclude" },
+  /** Excluded when the other field holds one of the values; nothing happens while the other field is missing. */
+  exclude_if: {
+    excludes: true,
+    validate: (ctx) => !Arr6.has(ctx.data, ctx.parameters[0] ?? "") || !otherFieldMatches(ctx),
+    messageKey: () => "exclude_if"
+  },
+  exclude_unless: { excludes: true, validate: (ctx) => otherFieldMatches(ctx), messageKey: () => "exclude_unless" },
+  /** Excluded while the other field's key is there. */
+  exclude_with: { excludes: true, validate: (ctx) => !Arr6.has(ctx.data, ctx.parameters[0] ?? ""), messageKey: () => "exclude_with" },
+  /** Excluded while any field named is missing or empty. */
+  exclude_without: {
+    excludes: true,
+    validate: (ctx) => !ctx.parameters.some((field) => isEmptyValue(Arr6.get(ctx.data, field))),
+    messageKey: () => "exclude_without"
+  }
+};
+
+// rules/file.ts
+import { FileType } from "@orieljs/support";
+
+// files/dimensions.ts
+var FRAME_MARKERS = /* @__PURE__ */ new Set([192, 193, 194, 195, 197, 198, 199, 201, 202, 203, 205, 206, 207]);
+var MAX_JPEG_STEPS = 1024;
+var MAX_BOXES = 1024;
+var fourcc = (view, offset) => String.fromCharCode(view.getUint8(offset), view.getUint8(offset + 1), view.getUint8(offset + 2), view.getUint8(offset + 3));
+var u24le = (view, offset) => view.getUint8(offset) | view.getUint8(offset + 1) << 8 | view.getUint8(offset + 2) << 16;
+var READERS = {
+  "image/png": (view) => fourcc(view, 12) === "IHDR" ? { width: view.getUint32(16), height: view.getUint32(20) } : void 0,
+  "image/gif": (view) => ({ width: view.getUint16(6, true), height: view.getUint16(8, true) }),
+  "image/bmp": (view) => view.getUint32(14, true) === 12 ? { width: view.getUint16(18, true), height: view.getUint16(20, true) } : { width: Math.abs(view.getInt32(18, true)), height: Math.abs(view.getInt32(22, true)) },
+  "image/jpeg": jpeg,
+  "image/webp": webp,
+  "image/avif": avif
+};
+function imageDimensions(bytes, mime) {
+  const reader = READERS[mime];
+  if (!reader) return void 0;
+  try {
+    const size = reader(new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength));
+    return size && size.width > 0 && size.height > 0 ? size : void 0;
+  } catch (error) {
+    if (error instanceof RangeError) return void 0;
+    throw error;
+  }
+}
+function jpeg(view) {
+  let offset = 2;
+  for (let step = 0; step < MAX_JPEG_STEPS && offset + 4 <= view.byteLength; step++) {
+    if (view.getUint8(offset) !== 255) return void 0;
+    const marker = view.getUint8(offset + 1);
+    if (marker === 255) offset += 1;
+    else if (marker === 216 || marker === 1 || marker >= 208 && marker <= 215) offset += 2;
+    else if (marker === 217 || marker === 218) return void 0;
+    else if (FRAME_MARKERS.has(marker)) return { height: view.getUint16(offset + 5), width: view.getUint16(offset + 7) };
+    else offset += 2 + view.getUint16(offset + 2);
+  }
+  return void 0;
+}
+function webp(view) {
+  const chunk = fourcc(view, 12);
+  if (chunk === "VP8 ") {
+    if (view.getUint8(23) !== 157 || view.getUint8(24) !== 1 || view.getUint8(25) !== 42) return void 0;
+    return { width: view.getUint16(26, true) & 16383, height: view.getUint16(28, true) & 16383 };
+  }
+  if (chunk === "VP8L") {
+    if (view.getUint8(20) !== 47) return void 0;
+    const bits = view.getUint32(21, true);
+    return { width: (bits & 16383) + 1, height: (bits >>> 14 & 16383) + 1 };
+  }
+  if (chunk === "VP8X") return { width: u24le(view, 24) + 1, height: u24le(view, 27) + 1 };
+  return void 0;
+}
+function* boxes(view, start, end) {
+  let offset = start;
+  for (let count = 0; count < MAX_BOXES && offset + 8 <= end; count++) {
+    let size = view.getUint32(offset);
+    let header = 8;
+    if (size === 1) {
+      size = Number(view.getBigUint64(offset + 8));
+      header = 16;
+    } else if (size === 0) {
+      size = end - offset;
+    }
+    if (size < header || offset + size > end) return;
+    yield { type: fourcc(view, offset + 4), start: offset + header, end: offset + size };
+    offset += size;
+  }
+}
+var findBox = (view, start, end, type) => {
+  for (const box of boxes(view, start, end)) if (box.type === type) return box;
+  return void 0;
+};
+function avif(view) {
+  const meta = findBox(view, 0, view.byteLength, "meta");
+  const iprp = meta && findBox(view, meta.start + 4, meta.end, "iprp");
+  const ipco = iprp && findBox(view, iprp.start, iprp.end, "ipco");
+  if (!ipco) return void 0;
+  let largest;
+  for (const box of boxes(view, ipco.start, ipco.end)) {
+    if (box.type !== "ispe") continue;
+    const size = { width: view.getUint32(box.start + 4), height: view.getUint32(box.start + 8) };
+    if (!largest || size.width * size.height > largest.width * largest.height) largest = size;
+  }
+  return largest;
+}
+
+// rules/file.ts
+var { BINARY_AND_MARKUP_TYPES, detectFileType, EMPTY, RASTER_IMAGES, SVG, TEXT } = FileType;
+var inspections = /* @__PURE__ */ new WeakMap();
+function inspect(file) {
+  let inspection = inspections.get(file);
+  if (!inspection) {
+    inspection = file.arrayBuffer().then((buffer) => {
+      const bytes = new Uint8Array(buffer);
+      const type = detectFileType(bytes);
+      return { type, dimensions: RASTER_IMAGES.has(type.mime) ? imageDimensions(bytes, type.mime) : void 0 };
+    });
+    inspections.set(file, inspection);
+  }
+  return inspection;
+}
+function clientExtension(file) {
+  const name = file.clientName.slice(Math.max(file.clientName.lastIndexOf("/"), file.clientName.lastIndexOf("\\")) + 1);
+  const dot = name.lastIndexOf(".");
+  return dot === -1 ? "" : name.slice(dot + 1).trim().toLowerCase();
+}
+var PHP_EXTENSIONS = /* @__PURE__ */ new Set(["php", "php3", "php4", "php5", "php7", "php8", "phtml", "phar"]);
+var blocksPhp = (file, allowed) => !allowed.includes("php") && PHP_EXTENSIONS.has(clientExtension(file));
+var TEXT_FORMATS = /* @__PURE__ */ new Set(["txt", "text", "csv", "tsv", "json", "md"]);
+var RECOGNISED_EXTENSIONS = new Set(BINARY_AND_MARKUP_TYPES.flatMap(({ extensions }) => extensions));
+var lower = (values) => values.map((value) => value.trim().toLowerCase());
+function meetsMimes(type, extension, allowed) {
+  if (type === EMPTY) return false;
+  if (type === TEXT && allowed.has("txt")) return true;
+  if (type !== TEXT && type.extensions.length > 0) return type.extensions.some((name) => allowed.has(name));
+  if (!allowed.has(extension) || RECOGNISED_EXTENSIONS.has(extension)) return false;
+  return type === TEXT || !TEXT_FORMATS.has(extension);
+}
+function allowedExtensions(ctx) {
+  const allowed = new Set(lower(ctx.parameters));
+  if (allowed.has("jpg") || allowed.has("jpeg")) allowed.add("jpg").add("jpeg");
+  return allowed;
+}
+var listed2 = (ctx) => ({ values: ctx.parameters.join(", ") });
+var DIMENSION_KEYS = ["width", "height", "min_width", "min_height", "max_width", "max_height", "ratio"];
+function namedParameter(parameter) {
+  const at = parameter.indexOf("=");
+  return at === -1 ? [parameter, ""] : [parameter.slice(0, at), parameter.slice(at + 1)];
+}
+function parseRatio(value) {
+  const match = /^(\d+(?:\.\d+)?|\.\d+)(?:\/(\d+))?$/.exec(value.trim());
+  if (!match) return void 0;
+  const ratio = Number(match[1]) / Number(match[2] ?? 1);
+  return Number.isFinite(ratio) && ratio > 0 ? ratio : void 0;
+}
+function dimensionConstraints(parameters) {
+  if (parameters.length === 0) throw new InvalidRuleParameterError("dimensions", "", `expected one or more of ${DIMENSION_KEYS.join(", ")}`);
+  const constraints = {};
+  for (const parameter of parameters) {
+    const [key, value] = namedParameter(parameter);
+    if (!DIMENSION_KEYS.includes(key)) {
+      throw new InvalidRuleParameterError("dimensions", parameter, `expected one of ${DIMENSION_KEYS.join(", ")}`);
+    }
+    const number = key === "ratio" ? parseRatio(value) : /^\d+$/.test(value) ? Number(value) : void 0;
+    if (number === void 0) {
+      throw new InvalidRuleParameterError("dimensions", parameter, key === "ratio" ? "expected a ratio such as 3/2 or 1.5" : "expected a whole number of pixels");
+    }
+    constraints[key] = number;
+  }
+  return constraints;
+}
+function meetsDimensions(constraints, { width, height }) {
+  const { width: exactWidth, height: exactHeight, min_width, max_width, min_height, max_height, ratio } = constraints;
+  if (exactWidth !== void 0 && width !== exactWidth) return false;
+  if (exactHeight !== void 0 && height !== exactHeight) return false;
+  if (min_width !== void 0 && width < min_width) return false;
+  if (max_width !== void 0 && width > max_width) return false;
+  if (min_height !== void 0 && height < min_height) return false;
+  if (max_height !== void 0 && height > max_height) return false;
+  return ratio === void 0 || Math.abs(ratio - width / height) <= 1 / (Math.max((width + height) / 2, height) + 1);
+}
+var fileRules = {
+  file: { validate: (ctx) => isUploadedFileLike(ctx.value), messageKey: () => "file" },
+  /** A JPEG, PNG, GIF, WebP, AVIF or BMP by its bytes; SVG only as `image:allow_svg` (Laravel 12). */
+  image: {
+    validate: async (ctx) => {
+      if (!isUploadedFileLike(ctx.value) || blocksPhp(ctx.value, [])) return false;
+      const { type } = await inspect(ctx.value);
+      return RASTER_IMAGES.has(type.mime) || type === SVG && ctx.parameters.includes("allow_svg");
+    },
+    messageKey: () => "image"
+  },
+  mimes: {
+    validate: async (ctx) => {
+      if (!isUploadedFileLike(ctx.value)) return false;
+      const allowed = allowedExtensions(ctx);
+      if (blocksPhp(ctx.value, [...allowed])) return false;
+      return meetsMimes((await inspect(ctx.value)).type, clientExtension(ctx.value), allowed);
+    },
+    messageKey: () => "mimes",
+    replacements: listed2
+  },
+  /**
+   * The detected MIME type is listed, or its `type/*` wildcard is. `image/*` includes SVG (`image/svg+xml`), as in
+   * Laravel: the rule for photos is `image`.
+   */
+  mimetypes: {
+    validate: async (ctx) => {
+      if (!isUploadedFileLike(ctx.value)) return false;
+      const allowed = lower(ctx.parameters);
+      if (blocksPhp(ctx.value, allowed)) return false;
+      const { mime } = (await inspect(ctx.value)).type;
+      return allowed.includes(mime) || allowed.includes(`${mime.split("/")[0]}/*`);
+    },
+    messageKey: () => "mimetypes",
+    replacements: listed2
+  },
+  /**
+   * The pixel size read from the image's header meets every constraint: width, height, min_width, max_width,
+   * min_height, max_height, ratio. SVG and images whose header can't be read fail.
+   */
+  dimensions: {
+    validate: async (ctx) => {
+      const constraints = dimensionConstraints(ctx.parameters);
+      if (!isUploadedFileLike(ctx.value)) return false;
+      const { dimensions } = await inspect(ctx.value);
+      return dimensions !== void 0 && meetsDimensions(constraints, dimensions);
+    },
+    messageKey: () => "dimensions",
+    replacements: (ctx) => Object.fromEntries(ctx.parameters.map(namedParameter))
+  },
+  /** The client file name's extension is listed (Laravel 11). It checks the name only: pair it with mimes or image. */
+  extensions: {
+    validate: (ctx) => {
+      if (!isUploadedFileLike(ctx.value)) return false;
+      const allowed = lower(ctx.parameters);
+      return !blocksPhp(ctx.value, allowed) && allowed.includes(clientExtension(ctx.value));
+    },
+    messageKey: () => "extensions",
+    replacements: listed2
+  }
+};
+
+// rules/format.ts
+import { Arr as Arr7, Str as Str2 } from "@orieljs/support";
+var ASCII_RE = /^[\x09\x10\x13\x0A\x0D\x20-\x7E]*$/;
+var HEX_COLOR_RE = /^#(?:(?:[0-9a-f]{3}){1,2}|(?:[0-9a-f]{4}){1,2})$/i;
+var ALPHA_RE = /^[A-Za-z]+$/;
+var ALPHA_NUM_RE = /^[A-Za-z0-9]+$/;
+var ALPHA_DASH_RE = /^[A-Za-z0-9_-]+$/;
+function isEmail(value) {
+  const at = value.indexOf("@");
+  if (at < 1 || value.includes("@", at + 1) || /\s/.test(value)) return false;
+  return value.slice(at + 2, -1).includes(".");
+}
+function isUuid(value, version) {
+  if (!Str2.isUuid(value)) return false;
+  if (version === void 0) return true;
+  const hex = value.replaceAll("-", "").toLowerCase();
+  if (version === "nil" || version === "0") return /^0+$/.test(hex);
+  if (version === "max") return /^f+$/.test(hex);
+  return !/^0+$|^f+$/.test(hex) && hex[12] === version && "89ab".includes(hex[16]);
+}
+var URL_PROTOCOLS = "aaa|aaas|about|acap|acct|acd|acr|adiumxtra|adt|afp|afs|aim|amss|android|appdata|apt|ark|attachment|aw|barion|beshare|bitcoin|bitcoincash|blob|bolo|browserext|calculator|callto|cap|cast|casts|chrome|chrome-extension|cid|coap|coap\\+tcp|coap\\+ws|coaps|coaps\\+tcp|coaps\\+ws|com-eventbrite-attendee|content|conti|crid|cvs|dab|data|dav|diaspora|dict|did|dis|dlna-playcontainer|dlna-playsingle|dns|dntp|dpp|drm|drop|dtn|dvb|ed2k|elsi|example|facetime|fax|feed|feedready|file|filesystem|finger|first-run-pen-experience|fish|fm|ftp|fuchsia-pkg|geo|gg|git|gizmoproject|go|gopher|graph|gtalk|h323|ham|hcap|hcp|http|https|hxxp|hxxps|hydrazone|iax|icap|icon|im|imap|info|iotdisco|ipn|ipp|ipps|irc|irc6|ircs|iris|iris\\.beep|iris\\.lwz|iris\\.xpc|iris\\.xpcs|isostore|itms|jabber|jar|jms|keyparc|lastfm|ldap|ldaps|leaptofrogans|lorawan|lvlt|magnet|mailserver|mailto|maps|market|message|mid|mms|modem|mongodb|moz|ms-access|ms-browser-extension|ms-calculator|ms-drive-to|ms-enrollment|ms-excel|ms-eyecontrolspeech|ms-gamebarservices|ms-gamingoverlay|ms-getoffice|ms-help|ms-infopath|ms-inputapp|ms-lockscreencomponent-config|ms-media-stream-id|ms-mixedrealitycapture|ms-mobileplans|ms-officeapp|ms-people|ms-project|ms-powerpoint|ms-publisher|ms-restoretabcompanion|ms-screenclip|ms-screensketch|ms-search|ms-search-repair|ms-secondary-screen-controller|ms-secondary-screen-setup|ms-settings|ms-settings-airplanemode|ms-settings-bluetooth|ms-settings-camera|ms-settings-cellular|ms-settings-cloudstorage|ms-settings-connectabledevices|ms-settings-displays-topology|ms-settings-emailandaccounts|ms-settings-language|ms-settings-location|ms-settings-lock|ms-settings-nfctransactions|ms-settings-notifications|ms-settings-power|ms-settings-privacy|ms-settings-proximity|ms-settings-screenrotation|ms-settings-wifi|ms-settings-workplace|ms-spd|ms-sttoverlay|ms-transit-to|ms-useractivityset|ms-virtualtouchpad|ms-visio|ms-walk-to|ms-whiteboard|ms-whiteboard-cmd|ms-word|msnim|msrp|msrps|mss|mtqp|mumble|mupdate|mvn|news|nfs|ni|nih|nntp|notes|ocf|oid|onenote|onenote-cmd|opaquelocktoken|openpgp4fpr|pack|palm|paparazzi|payto|pkcs11|platform|pop|pres|prospero|proxy|pwid|psyc|pttp|qb|query|redis|rediss|reload|res|resource|rmi|rsync|rtmfp|rtmp|rtsp|rtsps|rtspu|s3|secondlife|service|session|sftp|sgn|shttp|sieve|simpleledger|sip|sips|skype|smb|sms|smtp|snews|snmp|soap\\.beep|soap\\.beeps|soldat|spiffe|spotify|ssh|steam|stun|stuns|submit|svn|tag|teamspeak|tel|teliaeid|telnet|tftp|tg|things|thismessage|tip|tn3270|tool|ts3server|turn|turns|tv|udp|unreal|urn|ut2004|v-event|vemmi|ventrilo|videotex|vnc|view-source|wais|webcal|wpid|ws|wss|wtai|wyciwyg|xcon|xcon-userid|xfire|xmlrpc\\.beep|xmlrpc\\.beeps|xmpp|xri|ymsgr|z39\\.50|z39\\.50r|z39\\.50s";
+var H16 = "[0-9a-f]{1,4}";
+var OCTET = "(?:25[0-5]|(?:[1-9]|1[0-9]|2[0-4])?[0-9])";
+var LS32 = `(?:${H16}:${H16}|(?:${OCTET}\\.){3}${OCTET})`;
+var IPV6 = [
+  `(?:${H16}:){6}${LS32}`,
+  `::(?:${H16}:){5}${LS32}`,
+  `(?:${H16})?::(?:${H16}:){4}${LS32}`,
+  `(?:(?:${H16}:){0,1}${H16})?::(?:${H16}:){3}${LS32}`,
+  `(?:(?:${H16}:){0,2}${H16})?::(?:${H16}:){2}${LS32}`,
+  `(?:(?:${H16}:){0,3}${H16})?::${H16}:${LS32}`,
+  `(?:(?:${H16}:){0,4}${H16})?::${LS32}`,
+  `(?:(?:${H16}:){0,5}${H16})?::${H16}`,
+  `(?:(?:${H16}:){0,6}${H16})?::`
+].join("|");
+var URL_USER = "(?:[_.\\p{L}\\p{N}-]|%[0-9A-Fa-f]{2})+";
+var URL_DOMAIN = "(?=(?<domain>[\\p{L}\\p{N}\\p{S}\\-_.]+))\\k<domain>(?<=[\\p{L}\\p{N}\\p{S}\\-_.](?:[\\p{L}\\p{N}]|xn--[\\p{L}\\p{N}-]+)\\.?)";
+function urlPattern(protocols) {
+  return new RegExp(
+    `^(?:${protocols})://(?:(?:${URL_USER}:)?${URL_USER}@)?(?:${URL_DOMAIN}|\\p{Nd}{1,3}\\.\\p{Nd}{1,3}\\.\\p{Nd}{1,3}\\.\\p{Nd}{1,3}|\\[(?:${IPV6})\\])(?::[0-9]+)?(?:/(?:[\\p{L}\\p{N}\\-._~!$&'()*+,;=:@]|%[0-9A-Fa-f]{2})*)*(?:\\?(?:[\\p{L}\\p{N}\\-._~!$&'\\[\\]()*+,;=:@/?]|%[0-9A-Fa-f]{2})*)?(?:#(?:[\\p{L}\\p{N}\\-._~!$&'()*+,;=:@/?]|%[0-9A-Fa-f]{2})*)?\\n?$`,
+    "iu"
+  );
+}
+var URL_RE = urlPattern(URL_PROTOCOLS);
+var urlPatterns = /* @__PURE__ */ new Map();
+function isUrl(value, protocols) {
+  if (typeof value !== "string") return false;
+  if (protocols.length === 0) return URL_RE.test(value);
+  const list = protocols.join("|");
+  let pattern = urlPatterns.get(list);
+  if (pattern === void 0) {
+    try {
+      pattern = urlPattern(list);
+    } catch (error) {
+      throw new InvalidRuleParameterError(
+        "url",
+        protocols.join(","),
+        error instanceof Error ? error.message : String(error)
+      );
+    }
+    urlPatterns.set(list, pattern);
+  }
+  return pattern.test(value);
+}
+function edges(value, parameters, end) {
+  if (typeof value !== "string" && typeof value !== "number") return false;
+  const text = String(value);
+  return parameters.some((needle) => needle !== "" && (end ? text.endsWith(needle) : text.startsWith(needle)));
+}
+var isText = (value) => typeof value === "string" || typeof value === "number";
+var listed3 = (ctx) => ({ values: ctx.parameters.join(", ") });
+function compileRegex(raw) {
+  const match = /^\/(.*)\/([a-z]*)$/.exec(raw);
+  try {
+    return match ? new RegExp(match[1], match[2]) : new RegExp(raw);
+  } catch (error) {
+    throw new InvalidRuleParameterError("regex", raw, error instanceof Error ? error.message : String(error));
+  }
 }
 var formatRules = {
-  email: { validate: (ctx) => typeof ctx.value === "string" && EMAIL_RE.test(ctx.value), messageKey: () => "email" },
-  url: {
+  email: { validate: (ctx) => typeof ctx.value === "string" && isEmail(ctx.value), messageKey: () => "email" },
+  url: { validate: (ctx) => isUrl(ctx.value, ctx.parameters), messageKey: () => "url" },
+  uuid: { validate: (ctx) => isUuid(ctx.value, ctx.parameters[0]), messageKey: () => "uuid" },
+  ulid: { validate: (ctx) => Str2.isUlid(ctx.value), messageKey: () => "ulid" },
+  ascii: { validate: (ctx) => isText(ctx.value) && ASCII_RE.test(String(ctx.value)), messageKey: () => "ascii" },
+  hex_color: { validate: (ctx) => typeof ctx.value === "string" && HEX_COLOR_RE.test(ctx.value), messageKey: () => "hex_color" },
+  /** Text that parses as JSON (a JSON body's own numbers and objects are not "a JSON string"). */
+  json: {
     validate: (ctx) => {
       if (typeof ctx.value !== "string") return false;
       try {
-        new URL(ctx.value);
+        JSON.parse(ctx.value);
         return true;
       } catch {
         return false;
       }
     },
-    messageKey: () => "url"
+    messageKey: () => "json"
+  },
+  starts_with: { validate: (ctx) => edges(ctx.value, ctx.parameters, false), messageKey: () => "starts_with", replacements: listed3 },
+  ends_with: { validate: (ctx) => edges(ctx.value, ctx.parameters, true), messageKey: () => "ends_with", replacements: listed3 },
+  doesnt_start_with: {
+    validate: (ctx) => isText(ctx.value) && !edges(ctx.value, ctx.parameters, false),
+    messageKey: () => "doesnt_start_with",
+    replacements: listed3
+  },
+  doesnt_end_with: {
+    validate: (ctx) => isText(ctx.value) && !edges(ctx.value, ctx.parameters, true),
+    messageKey: () => "doesnt_end_with",
+    replacements: listed3
   },
-  uuid: { validate: (ctx) => typeof ctx.value === "string" && UUID_RE.test(ctx.value), messageKey: () => "uuid" },
   alpha: { validate: (ctx) => typeof ctx.value === "string" && ALPHA_RE.test(ctx.value), messageKey: () => "alpha" },
   alpha_num: {
     validate: (ctx) => typeof ctx.value === "string" && ALPHA_NUM_RE.test(ctx.value),
@@ -394,50 +1395,132 @@ var formatRules = {
     validate: (ctx) => typeof ctx.value === "string" && ALPHA_DASH_RE.test(ctx.value),
     messageKey: () => "alpha_dash"
   },
+  lowercase: {
+    validate: (ctx) => (typeof ctx.value === "string" || typeof ctx.value === "number") && String(ctx.value).toLowerCase() === String(ctx.value),
+    messageKey: () => "lowercase"
+  },
+  uppercase: {
+    validate: (ctx) => (typeof ctx.value === "string" || typeof ctx.value === "number") && String(ctx.value).toUpperCase() === String(ctx.value),
+    messageKey: () => "uppercase"
+  },
   regex: {
     validate: (ctx) => typeof ctx.value === "string" && compileRegex(ctx.parameters[0] ?? "").test(ctx.value),
     messageKey: () => "regex"
   },
+  /** Laravel's validateNotRegex(): text or a number that the pattern does not match. */
+  not_regex: {
+    validate: (ctx) => isText(ctx.value) && !compileRegex(ctx.parameters[0] ?? "").test(String(ctx.value)),
+    messageKey: () => "not_regex"
+  },
+  /** `confirmed` matches `<field>_confirmation`; `confirmed:repeat_password` names the other field (Laravel 12). */
   confirmed: {
-    validate: (ctx) => ctx.value === Arr2.get(ctx.data, `${ctx.attribute}_confirmation`),
+    validate: (ctx) => ctx.value === Arr7.get(ctx.data, ctx.parameters[0] || `${ctx.attribute}_confirmation`),
     messageKey: () => "confirmed"
   },
   same: {
-    validate: (ctx) => ctx.value === Arr2.get(ctx.data, ctx.parameters[0] ?? ""),
+    validate: (ctx) => ctx.value === Arr7.get(ctx.data, ctx.parameters[0] ?? ""),
     messageKey: () => "same",
-    replacements: (ctx) => ({ other: defaultAttributeName(ctx.parameters[0] ?? "") })
+    replacements: (ctx) => ({ other: displayName(ctx, ctx.parameters[0] ?? "") })
   },
   different: {
-    validate: (ctx) => ctx.value !== Arr2.get(ctx.data, ctx.parameters[0] ?? ""),
+    validate: (ctx) => ctx.value !== Arr7.get(ctx.data, ctx.parameters[0] ?? ""),
     messageKey: () => "different",
-    replacements: (ctx) => ({ other: defaultAttributeName(ctx.parameters[0] ?? "") })
+    replacements: (ctx) => ({ other: displayName(ctx, ctx.parameters[0] ?? "") })
   },
-  accepted: { implicit: true, validate: (ctx) => ACCEPTED_VALUES.includes(ctx.value), messageKey: () => "accepted" },
   digits: {
     validate: (ctx) => typeof ctx.value !== "object" && new RegExp(`^\\d{${ctx.parameters[0]}}$`).test(String(ctx.value)),
     messageKey: () => "digits",
     replacements: (ctx) => ({ digits: ctx.parameters[0] ?? "" })
+  }
+};
+
+// rules/network.ts
+import { lookup } from "dns/promises";
+import { isIP, isIPv4, isIPv6 } from "net";
+var MAC_RE = /^(?:[0-9a-f]{2}([-:])(?:[0-9a-f]{2}\1){4}[0-9a-f]{2}|[0-9a-f]{4}\.[0-9a-f]{4}\.[0-9a-f]{4})$/i;
+var resolver = { lookup };
+async function hasAddress(value) {
+  if (typeof value !== "string") return false;
+  let host;
+  try {
+    host = new URL(value).hostname;
+  } catch {
+    return false;
+  }
+  if (host === "") return false;
+  try {
+    return (await resolver.lookup(host.replace(/^\[|\]$/g, ""), { all: true })).length > 0;
+  } catch {
+    return false;
+  }
+}
+var networkRules = {
+  ip: { validate: (ctx) => typeof ctx.value === "string" && isIP(ctx.value) !== 0, messageKey: () => "ip" },
+  ipv4: { validate: (ctx) => typeof ctx.value === "string" && isIPv4(ctx.value), messageKey: () => "ipv4" },
+  ipv6: { validate: (ctx) => typeof ctx.value === "string" && isIPv6(ctx.value), messageKey: () => "ipv6" },
+  mac_address: { validate: (ctx) => typeof ctx.value === "string" && MAC_RE.test(ctx.value), messageKey: () => "mac_address" },
+  active_url: { validate: (ctx) => hasAddress(ctx.value), messageKey: () => "active_url" }
+};
+
+// rules/numeric.ts
+var onlyDigits = (value) => (typeof value === "string" || typeof value === "number") && /^\d+$/.test(String(value));
+var MAX_EXPONENT = 1e3;
+function decimal(text) {
+  const [, sign = "", whole = "", fraction = "", power = "0"] = /^\s*([+-]?)(\d*)(?:\.(\d*))?(?:[eE]([+-]?\d+))?\s*$/.exec(text) ?? [];
+  if (Math.abs(Number(power)) > MAX_EXPONENT) return void 0;
+  return { digits: BigInt(`${sign}${whole}${fraction}` || "0"), exponent: Number(power) - fraction.length };
+}
+function isMultipleOf(value, divisor) {
+  if (!isNumeric(value) || !isNumeric(divisor)) return false;
+  const a = decimal(String(value));
+  const b = decimal(divisor);
+  if (a === void 0 || b === void 0) return false;
+  const exponent = Math.min(a.exponent, b.exponent);
+  const numerator = a.digits * 10n ** BigInt(a.exponent - exponent);
+  const denominator = b.digits * 10n ** BigInt(b.exponent - exponent);
+  if (denominator === 0n) return false;
+  return numerator % denominator === 0n;
+}
+function hasDecimals(value, min, max) {
+  if (!isNumeric(value)) return false;
+  const match = /^[+-]?\d*(?:\.(\d*))?$/.exec(String(value).trim());
+  if (match === null) return false;
+  const places = match[1] ?? "";
+  return max === void 0 ? places.length === Number(min) : places.length >= Number(min) && places.length <= Number(max);
+}
+var length = (value) => String(value).length;
+var numericRules = {
+  decimal: {
+    validate: (ctx) => hasDecimals(ctx.value, ctx.parameters[0] ?? "", ctx.parameters[1]),
+    messageKey: () => "decimal",
+    replacements: (ctx) => ({ decimal: ctx.parameters[1] === void 0 ? ctx.parameters[0] ?? "" : `${ctx.parameters[0]}-${ctx.parameters[1]}` })
   },
-  date: {
-    validate: (ctx) => typeof ctx.value === "string" && !Number.isNaN(parseDate(ctx.value)),
-    messageKey: () => "date"
+  digits_between: {
+    validate: (ctx) => onlyDigits(ctx.value) && length(ctx.value) >= Number(ctx.parameters[0]) && length(ctx.value) <= Number(ctx.parameters[1]),
+    messageKey: () => "digits_between",
+    replacements: (ctx) => ({ min: ctx.parameters[0] ?? "", max: ctx.parameters[1] ?? "" })
   },
-  before: {
-    validate: (ctx) => compareDate(ctx, "before"),
-    messageKey: () => "before",
-    replacements: (ctx) => ({ date: ctx.parameters[0] ?? "" })
+  max_digits: {
+    validate: (ctx) => onlyDigits(ctx.value) && length(ctx.value) <= Number(ctx.parameters[0]),
+    messageKey: () => "max_digits",
+    replacements: (ctx) => ({ max: ctx.parameters[0] ?? "" })
   },
-  after: {
-    validate: (ctx) => compareDate(ctx, "after"),
-    messageKey: () => "after",
-    replacements: (ctx) => ({ date: ctx.parameters[0] ?? "" })
+  min_digits: {
+    validate: (ctx) => onlyDigits(ctx.value) && length(ctx.value) >= Number(ctx.parameters[0]),
+    messageKey: () => "min_digits",
+    replacements: (ctx) => ({ min: ctx.parameters[0] ?? "" })
+  },
+  multiple_of: {
+    validate: (ctx) => isMultipleOf(ctx.value, ctx.parameters[0] ?? ""),
+    messageKey: () => "multiple_of",
+    replacements: (ctx) => ({ value: ctx.parameters[0] ?? "" })
   }
 };
 
 // rules/presence.ts
-import { Arr as Arr3 } from "@orieljs/support";
+import { Arr as Arr8 } from "@orieljs/support";
 function isFieldPresent(field, data) {
-  return Arr3.has(data, field) && !isEmptyValue(Arr3.get(data, field));
+  return Arr8.has(data, field) && !isEmptyValue(Arr8.get(data, field));
 }
 function anyPresent(fields, data) {
   return fields.some((field) => isFieldPresent(field, data));
@@ -445,6 +1528,13 @@ function anyPresent(fields, data) {
 function allPresent(fields, data) {
   return fields.every((field) => isFieldPresent(field, data));
 }
+var hasAnyKey = (fields, data) => fields.some((field) => Arr8.has(data, field));
+var hasEveryKey = (fields, data) => fields.length > 0 && fields.every((field) => Arr8.has(data, field));
+var otherAndFirstValue = (ctx) => ({
+  other: displayName(ctx, ctx.parameters[0] ?? ""),
+  value: displayableValue(ctx.parameters[1])
+});
+var otherName = (ctx) => ({ other: displayName(ctx, ctx.parameters[0] ?? "") });
 var presenceRules = {
   required: {
     implicit: true,
@@ -453,89 +1543,160 @@ var presenceRules = {
   },
   required_if: {
     implicit: true,
-    validate: (ctx) => {
-      const [other, ...values] = ctx.parameters;
-      const applies = values.includes(String(Arr3.get(ctx.data, other)));
-      return !applies || !isEmptyValue(ctx.value);
-    },
+    // Laravel: nothing is required while the other field is missing.
+    validate: (ctx) => !Arr8.has(ctx.data, ctx.parameters[0] ?? "") || !otherFieldMatches(ctx) || !isEmptyValue(ctx.value),
     messageKey: () => "required_if",
-    replacements: (ctx) => ({ other: ctx.parameters[0] ?? "", value: ctx.parameters.slice(1).join(", ") })
+    replacements: otherAndValue
   },
   required_unless: {
     implicit: true,
-    validate: (ctx) => {
-      const [other, ...values] = ctx.parameters;
-      const applies = !values.includes(String(Arr3.get(ctx.data, other)));
-      return !applies || !isEmptyValue(ctx.value);
-    },
+    validate: (ctx) => otherFieldMatches(ctx) || !isEmptyValue(ctx.value),
     messageKey: () => "required_unless",
-    replacements: (ctx) => ({ other: ctx.parameters[0] ?? "", values: ctx.parameters.slice(1).join(", ") })
+    replacements: otherAndValues
   },
   required_with: {
     implicit: true,
     validate: (ctx) => !anyPresent(ctx.parameters, ctx.data) || !isEmptyValue(ctx.value),
     messageKey: () => "required_with",
-    replacements: (ctx) => ({ values: ctx.parameters.join(" / ") })
+    replacements: fieldList
   },
   required_with_all: {
     implicit: true,
     validate: (ctx) => !allPresent(ctx.parameters, ctx.data) || !isEmptyValue(ctx.value),
     messageKey: () => "required_with_all",
-    replacements: (ctx) => ({ values: ctx.parameters.join(" / ") })
+    replacements: fieldList
   },
   required_without: {
     implicit: true,
     validate: (ctx) => ctx.parameters.every((f) => isFieldPresent(f, ctx.data)) || !isEmptyValue(ctx.value),
     messageKey: () => "required_without",
-    replacements: (ctx) => ({ values: ctx.parameters.join(" / ") })
+    replacements: fieldList
   },
   required_without_all: {
     implicit: true,
     validate: (ctx) => anyPresent(ctx.parameters, ctx.data) || !isEmptyValue(ctx.value),
     messageKey: () => "required_without_all",
-    replacements: (ctx) => ({ values: ctx.parameters.join(" / ") })
+    replacements: fieldList
+  },
+  required_if_accepted: {
+    implicit: true,
+    validate: (ctx) => !otherAccepted(ctx.data, ctx.parameters[0]) || !isEmptyValue(ctx.value),
+    messageKey: () => "required_if_accepted",
+    replacements: otherName
+  },
+  required_if_declined: {
+    implicit: true,
+    validate: (ctx) => !otherDeclined(ctx.data, ctx.parameters[0]) || !isEmptyValue(ctx.value),
+    messageKey: () => "required_if_declined",
+    replacements: otherName
+  },
+  /** The key is there, whatever its value (null and '' included). */
+  present: { implicit: true, validate: (ctx) => Arr8.has(ctx.data, ctx.attribute), messageKey: () => "present" },
+  present_if: {
+    implicit: true,
+    validate: (ctx) => !otherFieldMatches(ctx) || Arr8.has(ctx.data, ctx.attribute),
+    messageKey: () => "present_if",
+    replacements: otherAndValue
+  },
+  present_unless: {
+    implicit: true,
+    validate: (ctx) => otherFieldMatches(ctx) || Arr8.has(ctx.data, ctx.attribute),
+    messageKey: () => "present_unless",
+    replacements: otherAndFirstValue
+  },
+  present_with: {
+    implicit: true,
+    validate: (ctx) => !hasAnyKey(ctx.parameters, ctx.data) || Arr8.has(ctx.data, ctx.attribute),
+    messageKey: () => "present_with",
+    replacements: fieldList
+  },
+  present_with_all: {
+    implicit: true,
+    validate: (ctx) => !hasEveryKey(ctx.parameters, ctx.data) || Arr8.has(ctx.data, ctx.attribute),
+    messageKey: () => "present_with_all",
+    replacements: fieldList
+  },
+  /** A key that is there must not be empty; a missing key passes. */
+  filled: { implicit: true, validate: (ctx) => !Arr8.has(ctx.data, ctx.attribute) || !isEmptyValue(ctx.value), messageKey: () => "filled" },
+  /** The key is not there at all (null counts as there). */
+  missing: { implicit: true, validate: (ctx) => !Arr8.has(ctx.data, ctx.attribute), messageKey: () => "missing" },
+  missing_if: {
+    implicit: true,
+    validate: (ctx) => !otherFieldMatches(ctx) || !Arr8.has(ctx.data, ctx.attribute),
+    messageKey: () => "missing_if",
+    replacements: otherAndValue
+  },
+  missing_unless: {
+    implicit: true,
+    validate: (ctx) => otherFieldMatches(ctx) || !Arr8.has(ctx.data, ctx.attribute),
+    messageKey: () => "missing_unless",
+    replacements: otherAndFirstValue
+  },
+  missing_with: {
+    implicit: true,
+    validate: (ctx) => !hasAnyKey(ctx.parameters, ctx.data) || !Arr8.has(ctx.data, ctx.attribute),
+    messageKey: () => "missing_with",
+    replacements: fieldList
+  },
+  missing_with_all: {
+    implicit: true,
+    validate: (ctx) => !hasEveryKey(ctx.parameters, ctx.data) || !Arr8.has(ctx.data, ctx.attribute),
+    messageKey: () => "missing_with_all",
+    replacements: fieldList
   }
 };
 
-// rules/type.ts
-var BOOLEAN_VALUES = [true, false, 0, 1, "0", "1"];
-var NUMERIC_STRING_RE = /^\s*[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?\s*$/;
-function isNumeric(value) {
-  if (typeof value === "number") return Number.isFinite(value);
-  return typeof value === "string" && NUMERIC_STRING_RE.test(value);
-}
-var typeRules = {
-  string: { validate: (ctx) => typeof ctx.value === "string", messageKey: () => "string" },
-  integer: {
-    validate: (ctx) => typeof ctx.value !== "object" && /^-?\d+$/.test(String(ctx.value).trim()),
-    messageKey: () => "integer"
+// rules/prohibited.ts
+import { Arr as Arr9 } from "@orieljs/support";
+var prohibitedRules = {
+  prohibited: { validate: (ctx) => isEmptyValue(ctx.value), messageKey: () => "prohibited" },
+  prohibited_if: {
+    validate: (ctx) => !otherFieldMatches(ctx) || isEmptyValue(ctx.value),
+    messageKey: () => "prohibited_if",
+    replacements: otherAndValue
   },
-  numeric: {
-    validate: (ctx) => isNumeric(ctx.value),
-    messageKey: () => "numeric"
+  prohibited_unless: {
+    validate: (ctx) => otherFieldMatches(ctx) || isEmptyValue(ctx.value),
+    messageKey: () => "prohibited_unless",
+    replacements: otherAndValues
+  },
+  prohibited_if_accepted: {
+    validate: (ctx) => !otherAccepted(ctx.data, ctx.parameters[0]) || isEmptyValue(ctx.value),
+    messageKey: () => "prohibited_if_accepted",
+    replacements: (ctx) => ({ other: displayName(ctx, ctx.parameters[0] ?? "") })
   },
-  boolean: { validate: (ctx) => BOOLEAN_VALUES.includes(ctx.value), messageKey: () => "boolean" },
-  array: { validate: (ctx) => Array.isArray(ctx.value), messageKey: () => "array" }
+  prohibited_if_declined: {
+    validate: (ctx) => !otherDeclined(ctx.data, ctx.parameters[0]) || isEmptyValue(ctx.value),
+    messageKey: () => "prohibited_if_declined",
+    replacements: (ctx) => ({ other: displayName(ctx, ctx.parameters[0] ?? "") })
+  },
+  /** While this field has a value, every field named must be missing or empty. */
+  prohibits: {
+    validate: (ctx) => isEmptyValue(ctx.value) || ctx.parameters.every((field) => isEmptyValue(Arr9.get(ctx.data, field))),
+    messageKey: () => "prohibits",
+    replacements: (ctx) => ({ other: fieldList(ctx).values })
+  }
 };
 
 // rules/size.ts
+import { Arr as Arr10 } from "@orieljs/support";
 function hasAny(ctx, names) {
   return names.some((name) => ctx.ruleNames.includes(name));
 }
-function isPlainObject(value) {
+var NUMERIC_RULES = ["numeric", "integer", "decimal"];
+function isPlainObject2(value) {
   if (typeof value !== "object" || value === null) return false;
   const proto = Object.getPrototypeOf(value);
   return proto === Object.prototype || proto === null;
 }
-function measure(ctx) {
-  const { value } = ctx;
-  if (hasAny(ctx, ["numeric", "integer"])) {
+function measure(ctx, value = ctx.value, numeric = hasAny(ctx, NUMERIC_RULES)) {
+  if (numeric) {
     return { type: "numeric", size: isNumeric(value) ? Number(value) : stringLength(value) };
   }
   if (Array.isArray(value)) return { type: "array", size: value.length };
   if (isUploadedFileLike(value)) return { type: "file", size: value.size / 1024 };
   if (hasAny(ctx, ["file", "image"])) return { type: "file", size: Number.NaN };
-  if (isPlainObject(value)) return { type: "array", size: Object.keys(value).length };
+  if (isPlainObject2(value)) return { type: "array", size: Object.keys(value).length };
   if (hasAny(ctx, ["array"])) return { type: "array", size: stringLength(value) };
   return { type: "string", size: stringLength(value) };
 }
@@ -546,6 +1707,41 @@ function stringLength(value) {
 function sizeOf(ctx) {
   return measure(ctx).size;
 }
+var COMPARE2 = {
+  gt: (a, b) => a > b,
+  gte: (a, b) => a >= b,
+  lt: (a, b) => a < b,
+  lte: (a, b) => a <= b
+};
+function kind(value) {
+  if (value === null || value === void 0) return "null";
+  if (Array.isArray(value) || isPlainObject2(value)) return "array";
+  if (typeof value === "number") return Number.isInteger(value) ? "integer" : "double";
+  return typeof value;
+}
+function compareSizes(ctx, rule) {
+  const parameter = ctx.parameters[0] ?? "";
+  const other = Arr10.get(ctx.data, parameter);
+  const numeric = hasAny(ctx, NUMERIC_RULES) || isNumeric(ctx.value);
+  if ((other === null || other === void 0) && isNumeric(ctx.value) && isNumeric(parameter)) {
+    return COMPARE2[rule](Number(String(ctx.value).trim()), Number(parameter.trim()));
+  }
+  if (isNumeric(parameter)) return false;
+  if (numeric && isNumeric(ctx.value) && isNumeric(other)) return COMPARE2[rule](Number(String(ctx.value).trim()), Number(String(other).trim()));
+  if (kind(ctx.value) !== kind(other)) return false;
+  return COMPARE2[rule](measure(ctx, ctx.value, numeric).size, measure(ctx, other, numeric).size);
+}
+function comparedValue(ctx) {
+  const parameter = ctx.parameters[0] ?? "";
+  const other = Arr10.get(ctx.data, parameter);
+  if (other === null || other === void 0) return { value: displayName(ctx, parameter) };
+  return { value: String(measure(ctx, other, hasAny(ctx, NUMERIC_RULES) || isNumeric(ctx.value)).size) };
+}
+var comparison2 = (rule) => ({
+  validate: (ctx) => compareSizes(ctx, rule),
+  messageKey: (ctx) => `${rule}.${measure(ctx, ctx.value, hasAny(ctx, NUMERIC_RULES) || isNumeric(ctx.value)).type}`,
+  replacements: comparedValue
+});
 function sizeType(ctx) {
   return measure(ctx).type;
 }
@@ -573,27 +1769,193 @@ var sizeRules = {
     messageKey: (ctx) => `size.${sizeType(ctx)}`,
     replacements: (ctx) => ({ size: ctx.parameters[0] ?? "" })
   },
-  in: { validate: (ctx) => ctx.parameters.includes(String(ctx.value)), messageKey: () => "in" },
-  not_in: { validate: (ctx) => !ctx.parameters.includes(String(ctx.value)), messageKey: () => "not_in" }
+  gt: comparison2("gt"),
+  gte: comparison2("gte"),
+  lt: comparison2("lt"),
+  lte: comparison2("lte"),
+  in: { validate: (ctx) => isListed(ctx.value, ctx.parameters, ctx.ruleNames), messageKey: () => "in" },
+  not_in: { validate: (ctx) => !isListed(ctx.value, ctx.parameters, ctx.ruleNames), messageKey: () => "not_in" }
+};
+function isListed(value, list, ruleNames) {
+  if (Array.isArray(value) && ruleNames.includes("array")) {
+    return value.every((item) => (typeof item !== "object" || item === null) && list.includes(String(item)));
+  }
+  return (typeof value !== "object" || value === null) && list.includes(String(value));
+}
+
+// rules/timezone.ts
+var REGIONS = ["Africa", "America", "Antarctica", "Arctic", "Asia", "Atlantic", "Australia", "Europe", "Indian", "Pacific"];
+var ZONE_RE = /^[A-Z][A-Za-z_-]*(?:\/[A-Z][A-Za-z0-9_+-]*)+$/;
+var ICU_NAMES = {
+  "Africa/Asmera": "Africa/Asmara",
+  "America/Buenos_Aires": "America/Argentina/Buenos_Aires",
+  "America/Catamarca": "America/Argentina/Catamarca",
+  "America/Cordoba": "America/Argentina/Cordoba",
+  "America/Jujuy": "America/Argentina/Jujuy",
+  "America/Mendoza": "America/Argentina/Mendoza",
+  "America/Coral_Harbour": "America/Atikokan",
+  "America/Indianapolis": "America/Indiana/Indianapolis",
+  "America/Louisville": "America/Kentucky/Louisville",
+  "America/Godthab": "America/Nuuk",
+  "Asia/Saigon": "Asia/Ho_Chi_Minh",
+  "Asia/Katmandu": "Asia/Kathmandu",
+  "Asia/Calcutta": "Asia/Kolkata",
+  "Asia/Rangoon": "Asia/Yangon",
+  "Atlantic/Faeroe": "Atlantic/Faroe",
+  "Europe/Kiev": "Europe/Kyiv",
+  "Pacific/Truk": "Pacific/Chuuk",
+  "Pacific/Enderbury": "Pacific/Kanton",
+  "Pacific/Ponape": "Pacific/Pohnpei"
+};
+function resolve(zone) {
+  try {
+    return new Intl.DateTimeFormat("en-US", { timeZone: zone }).resolvedOptions().timeZone;
+  } catch {
+    return void 0;
+  }
+}
+function canonical(zone) {
+  const name = resolve(zone);
+  return name === void 0 ? void 0 : ICU_NAMES[name] ?? name;
+}
+function isInOwnCase(value, name) {
+  const lower2 = value.toLowerCase();
+  for (const spelling of [name, ICU_NAMES[name]]) {
+    if (spelling !== void 0 && spelling.toLowerCase() === lower2) return spelling === value;
+  }
+  return true;
+}
+function countryZones(country) {
+  const locale = new Intl.Locale(`und-${country.toUpperCase()}`);
+  return locale.getTimeZones?.() ?? locale.timeZones ?? [];
+}
+var inRegion = (zone, region) => zone === "UTC" ? region === void 0 || region === "UTC" : ZONE_RE.test(zone) && (region === void 0 ? REGIONS : [region]).includes(zone.split("/")[0]);
+function isTimezone(value, group = "all", country) {
+  if (typeof value !== "string") return false;
+  const resolved = resolve(value);
+  if (resolved === void 0 || !isInOwnCase(value, resolved)) return false;
+  const name = group.toLowerCase();
+  if (name === "all") return inRegion(value);
+  if (name === "all_with_bc") return /^[A-Z]/.test(value);
+  if (name === "per_country") {
+    const zone = canonical(value);
+    return inRegion(value) && countryZones(country ?? "").some((candidate) => canonical(candidate) === zone);
+  }
+  const region = name === "utc" ? "UTC" : REGIONS.find((candidate) => candidate.toLowerCase() === name);
+  if (region === void 0) throw new InvalidRuleParameterError("timezone", group, "expected all, all_with_bc, per_country, utc or a region such as Europe");
+  return inRegion(value, region);
+}
+var timezoneRules = {
+  timezone: { validate: (ctx) => isTimezone(ctx.value, ctx.parameters[0], ctx.parameters[1]), messageKey: () => "timezone" }
 };
 
 // registry.ts
 var builtinRules = {
   ...presenceRules,
+  ...acceptanceRules,
+  ...prohibitedRules,
+  ...excludeRules,
   ...typeRules,
+  ...arrayRules,
   ...formatRules,
+  ...dateRules,
+  ...networkRules,
+  ...timezoneRules,
   ...sizeRules,
+  ...numericRules,
   ...fileRules,
-  ...databaseRules
+  ...databaseRules,
+  ...authRules
+};
+
+// rules/password.ts
+var defaultRule;
+function hasMixedCase(value) {
+  return value.split(/[\n\r\u2028\u2029]/).some((line) => /\p{Ll}/u.test(line) && /\p{Lu}/u.test(line));
+}
+var PasswordRule = class _PasswordRule {
+  #min;
+  #max;
+  #letters = false;
+  #mixedCase = false;
+  #numbers = false;
+  #symbols = false;
+  constructor(min = 8) {
+    this.#min = Math.max(1, min);
+  }
+  /** A password rule of at least `size` characters: PasswordRule.min(12).mixedCase(). */
+  static min(size) {
+    return new _PasswordRule(size);
+  }
+  static defaults(rule) {
+    if (rule !== void 0) {
+      defaultRule = rule ?? void 0;
+      return;
+    }
+    const resolved = typeof defaultRule === "function" ? defaultRule() : defaultRule;
+    return resolved === void 0 ? new _PasswordRule(8) : resolved.#copy();
+  }
+  min(size) {
+    this.#min = Math.max(1, size);
+    return this;
+  }
+  max(size) {
+    this.#max = size;
+    return this;
+  }
+  /** At least one letter. */
+  letters() {
+    this.#letters = true;
+    return this;
+  }
+  /** At least one uppercase and one lowercase letter. */
+  mixedCase() {
+    this.#mixedCase = true;
+    return this;
+  }
+  /** At least one number. */
+  numbers() {
+    this.#numbers = true;
+    return this;
+  }
+  /** At least one symbol (punctuation, a symbol or a space). */
+  symbols() {
+    this.#symbols = true;
+    return this;
+  }
+  validate(_attribute, value, fail) {
+    const say = (key, replacements = {}) => fail(applyReplacements(DEFAULT_MESSAGES[key], replacements));
+    if (typeof value !== "string") return say("string");
+    const length2 = [...value].length;
+    if (length2 < this.#min) say("min.string", { min: String(this.#min) });
+    if (this.#max !== void 0 && length2 > this.#max) say("max.string", { max: String(this.#max) });
+    if (this.#mixedCase && !hasMixedCase(value)) say("password.mixed");
+    if (this.#letters && !/\p{L}/u.test(value)) say("password.letters");
+    if (this.#symbols && !/\p{Z}|\p{S}|\p{P}/u.test(value)) say("password.symbols");
+    if (this.#numbers && !/\p{N}/u.test(value)) say("password.numbers");
+  }
+  #copy() {
+    const copy = new _PasswordRule(this.#min);
+    copy.#max = this.#max;
+    copy.#letters = this.#letters;
+    copy.#mixedCase = this.#mixedCase;
+    copy.#numbers = this.#numbers;
+    copy.#symbols = this.#symbols;
+    return copy;
+  }
 };
 
 // Rule.ts
 var BuiltinRuleObject = class {
+  /** The parameters its message shows (`:values` of Rule.doesntContain()), as the string rule's would be. */
+  messageParameters() {
+    return [];
+  }
   // Declares all 4 contract parameters so a subclass's inferred type (from `Rule.in(...)` etc.) still accepts a
   // call with the full 4-arg ValidationRule.validate signature, as Rule.test.ts makes.
   async validate(attribute, value, fail, data, expandedFromWildcard = false) {
     if (await this.passes(attribute, value, data, expandedFromWildcard)) return;
-    fail(applyReplacements(DEFAULT_MESSAGES[this.ruleName], { attribute: defaultAttributeName(attribute) }));
+    fail(applyReplacements(DEFAULT_MESSAGES[this.ruleName], { attribute: defaultAttributeName(attribute), values: this.messageParameters().join(", ") }));
   }
 };
 var InRule = class extends BuiltinRuleObject {
@@ -603,8 +1965,145 @@ var InRule = class extends BuiltinRuleObject {
   }
   values;
   ruleName = "in";
+  passes(_attribute, value, _data, _expanded, ruleNames = []) {
+    return isListed(value, this.values.map(String), ruleNames);
+  }
+};
+var NotInRule = class extends BuiltinRuleObject {
+  constructor(values) {
+    super();
+    this.values = values;
+  }
+  values;
+  ruleName = "not_in";
+  passes(_attribute, value, _data, _expanded, ruleNames = []) {
+    return !isListed(value, this.values.map(String), ruleNames);
+  }
+};
+var enumValues = (type) => Object.entries(type).filter(([key, value]) => !(typeof value === "string" && typeof type[value] === "number" && String(type[value]) === key)).map(([, value]) => value);
+var EnumRule = class extends BuiltinRuleObject {
+  constructor(type) {
+    super();
+    this.type = type;
+  }
+  type;
+  ruleName = "enum";
+  #only = [];
+  #except = [];
+  only(values) {
+    this.#only = Array.isArray(values) ? [...values] : [values];
+    return this;
+  }
+  except(values) {
+    this.#except = Array.isArray(values) ? [...values] : [values];
+    return this;
+  }
   passes(_attribute, value) {
-    return this.values.map(String).includes(String(value));
+    const match = enumValues(this.type).find((candidate) => candidate === value || typeof candidate === "number" && typeof value === "string" && String(candidate) === value);
+    if (match === void 0) return false;
+    return this.#only.length > 0 ? this.#only.includes(match) : !this.#except.includes(match);
+  }
+};
+var ContainsRule = class extends BuiltinRuleObject {
+  constructor(ruleName, values) {
+    super();
+    this.ruleName = ruleName;
+    this.values = values;
+  }
+  ruleName;
+  values;
+  passes(_attribute, value) {
+    if (!Array.isArray(value)) return false;
+    const found = (needle) => value.some((item) => alike(item, needle));
+    return this.ruleName === "contains" ? this.values.every(found) : !this.values.some(found);
+  }
+  messageParameters() {
+    return this.values.map(String);
+  }
+};
+var ExpandingRuleObject = class {
+  validate() {
+    throw new Error(`${this.constructor.name} stands for string rules: use it in a Validator's rules.`);
+  }
+};
+var ConditionalRule = class extends ExpandingRuleObject {
+  constructor(rule, condition) {
+    super();
+    this.rule = rule;
+    this.condition = condition;
+  }
+  rule;
+  condition;
+  expandRules() {
+    return (typeof this.condition === "function" ? this.condition() : this.condition) ? this.rule : "";
+  }
+};
+var ConditionalRules = class extends ExpandingRuleObject {
+  constructor(condition, rules, defaultRules, negate = false) {
+    super();
+    this.condition = condition;
+    this.rules = rules;
+    this.defaultRules = defaultRules;
+    this.negate = negate;
+  }
+  condition;
+  rules;
+  defaultRules;
+  negate;
+  expandRules(data) {
+    const holds = (typeof this.condition === "function" ? this.condition(data) : this.condition) !== this.negate;
+    const chosen = holds ? this.rules : this.defaultRules;
+    return typeof chosen === "function" ? chosen(data) : chosen;
+  }
+};
+var ArrayRule = class extends ExpandingRuleObject {
+  constructor(keys) {
+    super();
+    this.keys = keys;
+  }
+  keys;
+  expandRules() {
+    return this.keys.length === 0 ? "array" : `array:${this.keys.join(",")}`;
+  }
+};
+var DimensionsRule = class extends ExpandingRuleObject {
+  #constraints;
+  constructor(constraints) {
+    super();
+    this.#constraints = { ...constraints };
+  }
+  width(pixels) {
+    return this.set("width", pixels);
+  }
+  height(pixels) {
+    return this.set("height", pixels);
+  }
+  minWidth(pixels) {
+    return this.set("min_width", pixels);
+  }
+  minHeight(pixels) {
+    return this.set("min_height", pixels);
+  }
+  maxWidth(pixels) {
+    return this.set("max_width", pixels);
+  }
+  maxHeight(pixels) {
+    return this.set("max_height", pixels);
+  }
+  /** Width over height: `ratio(3 / 2)`. */
+  ratio(ratio) {
+    return this.set("ratio", ratio);
+  }
+  /** `dimensions:max_width=1000,ratio=1.5`, Laravel's __toString(). */
+  toString() {
+    return `dimensions:${Object.entries(this.#constraints).map(([key, value]) => `${key}=${value}`).join(",")}`;
+  }
+  expandRules() {
+    return this.toString();
+  }
+  set(key, value) {
+    this.#constraints[key] = value;
+    return this;
   }
 };
 function isModelInstance(value) {
@@ -657,14 +2156,95 @@ var ExistsRule = class extends BuiltinRuleObject {
   }
 };
 var Rule = {
+  /** One of `values`, compared as text (as `in:a,b`); typed as those values: `Rule.in(['draft', 'publish'])`. */
   in: (values) => new InRule(values),
+  /** None of `values`, compared as text (as `not_in:a,b`). */
+  notIn: (values) => new NotInRule(values),
+  /** One of a TypeScript enum's values (or an `as const` object's): `Rule.enum(Status)`, `.only([…])`, `.except([…])`. */
+  enum: (type) => new EnumRule(type),
+  /** An array holding every one of `values`. */
+  contains: (values) => new ContainsRule("contains", values),
+  /** An array holding none of `values`. */
+  doesntContain: (values) => new ContainsRule("doesnt_contain", values),
+  /** `required` when the condition (or the callback) holds. */
+  requiredIf: (condition) => new ConditionalRule("required", condition),
+  /** `exclude` when the condition (or the callback) holds; the key is optional, as `exclude_if` makes it. */
+  excludeIf: (condition) => new ConditionalRule("exclude", condition),
+  /** `prohibited` when the condition (or the callback) holds. */
+  prohibitedIf: (condition) => new ConditionalRule("prohibited", condition),
+  /** `rules` when the condition (or the callback, given the data) holds, else `defaultRules`. */
+  when: (condition, rules, defaultRules = []) => new ConditionalRules(condition, rules, defaultRules),
+  /** `rules` unless the condition (or the callback, given the data) holds, else `defaultRules`. */
+  unless: (condition, rules, defaultRules = []) => new ConditionalRules(condition, rules, defaultRules, true),
+  /** `array`, or with keys `array:name,email` (an object whose keys are among those named). */
+  array: (keys = []) => new ArrayRule(keys),
+  /** The dimensions rule: `Rule.dimensions().maxWidth(1000).ratio(3 / 2)`, or `Rule.dimensions({ min_width: 100 })`. */
+  dimensions: (constraints = {}) => new DimensionsRule(constraints),
   unique: (table, column) => new UniqueRule(table, column),
-  exists: (table, column) => new ExistsRule(table, column)
+  exists: (table, column) => new ExistsRule(table, column),
+  /** Laravel's Password::defaults(): the application's password rule (at least 8 characters unless PasswordRule.defaults() changed it). */
+  password: () => PasswordRule.defaults()
 };
 
 // Validator.ts
-import { Arr as Arr4 } from "@orieljs/support";
+import { Arr as Arr11 } from "@orieljs/support";
 var SKIPPED_MODIFIERS = /* @__PURE__ */ new Set(["bail", "nullable", "sometimes"]);
+var DEPENDENT_RULES = /* @__PURE__ */ new Set([
+  "after",
+  "after_or_equal",
+  "before",
+  "before_or_equal",
+  "confirmed",
+  "different",
+  "exclude_if",
+  "exclude_unless",
+  "exclude_with",
+  "exclude_without",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "accepted_if",
+  "declined_if",
+  "required_if",
+  "required_if_accepted",
+  "required_if_declined",
+  "required_unless",
+  "required_with",
+  "required_with_all",
+  "required_without",
+  "required_without_all",
+  "present_if",
+  "present_unless",
+  "present_with",
+  "present_with_all",
+  "prohibited",
+  "prohibited_if",
+  "prohibited_if_accepted",
+  "prohibited_if_declined",
+  "prohibited_unless",
+  "prohibits",
+  "missing_if",
+  "missing_unless",
+  "missing_with",
+  "missing_with_all",
+  "same",
+  "unique"
+]);
+function wildcardKeys(pattern, field) {
+  const fieldSegments = field.split(".");
+  return pattern.split(".").flatMap((segment, index) => segment === "*" ? [fieldSegments[index] ?? "*"] : []);
+}
+function fillWildcards(parameters, keys) {
+  if (keys.length === 0) return parameters;
+  return parameters.map((parameter) => {
+    let index = 0;
+    return parameter.replace(/\*/g, () => keys[index++] ?? "*");
+  });
+}
+function patternMatcher(pattern) {
+  return new RegExp(`^${pattern.split(".").map((segment) => segment === "*" ? "[^.]+" : segment.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("\\.")}$`);
+}
 function buildNested(flat) {
   const root = {};
   const created = /* @__PURE__ */ new Set([root]);
@@ -701,6 +2281,49 @@ function cloneContainer(existing) {
   }
   return container;
 }
+var EXCLUDED = /* @__PURE__ */ Symbol("excluded");
+function withoutPaths(data, paths) {
+  const root = { ...data };
+  const copies = /* @__PURE__ */ new Set([root]);
+  for (const path of paths) {
+    const parts = path.split(".");
+    const leaf = parts.pop();
+    let node = root;
+    for (const part of parts) {
+      const child = Object.hasOwn(node, part) ? node[part] : void 0;
+      if (!isPlainContainer(child)) {
+        node = void 0;
+        break;
+      }
+      const copy = copies.has(child) ? child : Array.isArray(child) ? [...child] : { ...child };
+      copies.add(copy);
+      node[part] = copy;
+      node = copy;
+    }
+    if (node === void 0 || !Object.hasOwn(node, leaf)) continue;
+    if (Array.isArray(node)) node[Number(leaf)] = EXCLUDED;
+    else delete node[leaf];
+  }
+  return root;
+}
+function dropExcluded(node, seen = /* @__PURE__ */ new Set()) {
+  if (typeof node !== "object" || node === null || seen.has(node)) return;
+  seen.add(node);
+  if (Array.isArray(node)) {
+    if (node.includes(EXCLUDED)) {
+      let kept = 0;
+      for (const item of node) if (item !== EXCLUDED) node[kept++] = item;
+      node.length = kept;
+    }
+  } else if (isPlainContainer(node)) {
+    for (const [key, value] of Object.entries(node)) if (value === EXCLUDED) delete node[key];
+  }
+  if (isPlainContainer(node)) for (const value of Object.values(node)) dropExcluded(value, seen);
+}
+function segmentEnd(path, start) {
+  const dot = path.indexOf(".", start);
+  return dot === -1 ? path.length : dot;
+}
 function arrayify(node, created) {
   if (node === null || typeof node !== "object" || !created.has(node)) return node;
   const entries = Object.entries(node).map(([k, v]) => [k, arrayify(v, created)]);
@@ -726,11 +2349,18 @@ var ValidatorImpl = class {
   bag;
   ranPromise;
   afterCallbacks = [];
+  parsedRules;
+  /** The fields an exclude rule took out (with their children). */
+  excluded = /* @__PURE__ */ new Set();
+  /** The same fields as a tree of segment runs from the root, so a lookup reads the field once. */
+  excludedRuns = { run: "", next: /* @__PURE__ */ new Map(), excluded: false };
+  /** What the rules keep while one pass runs (RuleContext.cache); a new pass starts with a new one. */
+  cache = /* @__PURE__ */ new Map();
   after(callback) {
     this.afterCallbacks.push(callback);
     return this;
   }
-  /** Not part of the Validator contract — lets an after() hook add a failure (MessageBag itself is read-only). */
+  /** Lets an after() hook add a failure. */
   fail(field, message) {
     this.bag ??= new MessageBagImpl();
     this.bag.add(field, message);
@@ -747,39 +2377,143 @@ var ValidatorImpl = class {
   }
   async validated() {
     if (!await this.passes()) throw new ValidationErrorImpl(this.bag.toObject(), this.errorBagName);
+    const data = this.excluded.size === 0 ? this.data : withoutPaths(this.data, this.excluded);
     const flat = {};
     for (const pattern of Object.keys(this.rules)) {
       for (const field of this.fieldsFor(pattern)) {
-        if (Arr4.has(this.data, field)) flat[field] = Arr4.get(this.data, field);
+        if (!this.isExcluded(field) && Arr11.has(data, field)) flat[field] = Arr11.get(data, field);
+      }
+    }
+    for (const path of this.excluded) {
+      const parent = path.includes(".") ? path.slice(0, path.lastIndexOf(".")) : void 0;
+      if (parent === void 0 || this.isExcluded(parent) || !Arr11.has(this.data, path)) continue;
+      if (Array.isArray(Arr11.get(this.data, parent))) flat[path] = EXCLUDED;
+    }
+    const nested = buildNested(flat);
+    if (this.excluded.size > 0) dropExcluded(nested);
+    return nested;
+  }
+  /** Takes the field (with its children) out of validation and of the validated data. */
+  exclude(field) {
+    this.excluded.add(field);
+    let node = this.excludedRuns;
+    for (let start = 0; ; ) {
+      const first = field.slice(start, segmentEnd(field, start));
+      let next = node.next.get(first);
+      if (next === void 0) {
+        node.next.set(first, { run: field.slice(start), next: /* @__PURE__ */ new Map(), excluded: true });
+        return;
+      }
+      let same = 0;
+      while (same < next.run.length && start + same < field.length && next.run[same] === field[start + same]) same++;
+      const runEnds = same === next.run.length || next.run[same] === ".";
+      const fieldEnds = start + same === field.length || field[start + same] === ".";
+      if (!runEnds || !fieldEnds) same = next.run.lastIndexOf(".", same - 1);
+      if (same < next.run.length) {
+        const rest = next.run.slice(same + 1);
+        const shared = { run: next.run.slice(0, same), next: /* @__PURE__ */ new Map([[rest.slice(0, segmentEnd(rest, 0)), next]]), excluded: false };
+        next.run = rest;
+        node.next.set(first, shared);
+        next = shared;
       }
+      start += same;
+      if (start === field.length) {
+        next.excluded = true;
+        return;
+      }
+      node = next;
+      start++;
+    }
+  }
+  /**
+   * Laravel's shouldBeExcluded(): the field, or one of its parents, was taken out by an exclude rule. The field's
+   * segments are followed from the root (so `user` takes out `user.name`, not `username`) and each is read once,
+   * however many fields were excluded and however many dots the field holds.
+   */
+  isExcluded(field) {
+    if (this.excluded.size === 0) return false;
+    let node = this.excludedRuns;
+    for (let start = 0; ; ) {
+      const next = node.next.get(field.slice(start, segmentEnd(field, start)));
+      if (next === void 0) return false;
+      const end = start + next.run.length;
+      if (!field.startsWith(next.run, start) || end < field.length && field[end] !== ".") return false;
+      if (next.excluded) return true;
+      if (end === field.length) return false;
+      node = next;
+      start = end + 1;
     }
-    return buildNested(flat);
   }
   fieldsFor(pattern) {
     return pattern.includes("*") ? expandWildcardKeys(pattern, this.data) : [pattern];
   }
+  parsed() {
+    this.parsedRules ??= new Map(Object.entries(this.rules).map(([pattern, spec]) => [pattern, parseRuleSpec(spec, this.data)]));
+    return this.parsedRules;
+  }
+  /** The rule key a concrete field falls under: itself, else the first wildcard key that matches it. */
+  patternOf(field) {
+    const parsed = this.parsed();
+    if (parsed.has(field)) return field;
+    for (const pattern of parsed.keys()) if (pattern.includes("*") && patternMatcher(pattern).test(field)) return pattern;
+    return void 0;
+  }
+  /** Laravel's getRule(): the parameters of rule `name` on `field`, or undefined when the field has no such rule. */
+  ruleParameters(field, name) {
+    const pattern = this.patternOf(field);
+    const rule = pattern === void 0 ? void 0 : this.parsed().get(pattern).find((r) => r.kind === "named" && r.name === name);
+    return rule?.kind === "named" ? rule.parameters : void 0;
+  }
+  /** Laravel's getDisplayableAttribute(): a custom attribute for the field or its rule key, else the humanized key. */
+  displayName(field) {
+    const pattern = this.patternOf(field);
+    return this.customAttributes[field] ?? (pattern === void 0 ? void 0 : this.customAttributes[pattern]) ?? defaultAttributeName(field);
+  }
+  context(field, pattern, value, parameters, ruleNames) {
+    return {
+      attribute: field,
+      expandedFromWildcard: pattern.includes("*"),
+      value,
+      parameters,
+      data: this.data,
+      ruleNames,
+      pattern,
+      cache: this.cache,
+      getRule: (other, name) => this.ruleParameters(other, name),
+      displayName: (other) => this.displayName(other)
+    };
+  }
   async run() {
     this.bag = new MessageBagImpl();
-    for (const [pattern, spec] of Object.entries(this.rules)) {
-      const parsed = parseRuleSpec(spec);
+    this.cache = /* @__PURE__ */ new Map();
+    for (const [pattern, parsed] of this.parsed()) {
       const names = parsed.filter((r) => r.kind === "named").map((r) => r.name);
       const bail = names.includes("bail");
       const nullable = names.includes("nullable");
       const sometimes = names.includes("sometimes");
       for (const field of this.fieldsFor(pattern)) {
-        const present = Arr4.has(this.data, field);
+        if (this.isExcluded(field)) continue;
+        const present = Arr11.has(this.data, field);
         if (sometimes && !present) continue;
-        const value = Arr4.get(this.data, field);
+        const value = Arr11.get(this.data, field);
         const isNull = value === null || value === void 0;
         const isBlank = typeof value === "string" && value.trim() === "";
         for (const rule of parsed) {
           if (rule.kind === "named" && SKIPPED_MODIFIERS.has(rule.name)) continue;
-          const implicit = rule.kind === "named" && (this.registry[rule.name]?.implicit ?? false);
+          const builtin = rule.kind === "named" ? this.registry[rule.name] : void 0;
+          if (builtin?.excludes) {
+            if (!await this.passesExcludeRule(rule, builtin, field, pattern, value, names)) {
+              this.exclude(field);
+              break;
+            }
+            continue;
+          }
+          const implicit = builtin?.implicit ?? false;
           if (!implicit && (!present || isBlank)) continue;
           if (!implicit && nullable && isNull) continue;
-          const message = await this.runRule(rule, field, pattern, value, names);
-          if (message !== void 0) {
-            this.bag.add(field, message);
+          const messages = await this.runRule(rule, field, pattern, value, names);
+          if (messages.length > 0) {
+            for (const message of messages) this.bag.add(field, message);
             if (bail || implicit) break;
           }
         }
@@ -788,30 +2522,33 @@ var ValidatorImpl = class {
     for (const callback of this.afterCallbacks) await callback(this);
     return this.bag.isEmpty();
   }
+  async passesExcludeRule(rule, builtin, field, pattern, value, ruleNames) {
+    return builtin.validate(this.context(field, pattern, value, fillWildcards(rule.parameters, wildcardKeys(pattern, field)), ruleNames));
+  }
   async runRule(rule, field, pattern, value, ruleNames) {
     const expanded = pattern.includes("*");
     if (rule.kind === "object") {
       if (rule.rule instanceof BuiltinRuleObject) {
-        if (await rule.rule.passes(field, value, this.data, expanded)) return void 0;
-        const ctx2 = { attribute: field, expandedFromWildcard: expanded, value, parameters: [], data: this.data, ruleNames };
-        return this.failureMessage(rule.rule.ruleName, this.registry[rule.rule.ruleName], ctx2, pattern);
+        if (await rule.rule.passes(field, value, this.data, expanded, ruleNames)) return [];
+        const ctx2 = this.context(field, pattern, value, rule.rule.messageParameters(), ruleNames);
+        return [this.failureMessage(rule.rule.ruleName, this.registry[rule.rule.ruleName], ctx2, pattern)];
       }
-      let failure;
-      await rule.rule.validate(field, value, (message) => {
-        failure = message;
-      }, this.data);
-      return failure;
+      const failures = [];
+      const attribute = this.displayName(field);
+      await rule.rule.validate(field, value, (message) => void failures.push(applyReplacements(message, { attribute })), this.data);
+      return failures;
     }
     const builtin = this.registry[rule.name];
     if (!builtin) throw new UnknownValidationRuleError(rule.name);
-    const ctx = { attribute: field, expandedFromWildcard: expanded, value, parameters: rule.parameters, data: this.data, ruleNames };
-    if (await builtin.validate(ctx)) return void 0;
-    return this.failureMessage(rule.name, builtin, ctx, pattern);
+    const parameters = DEPENDENT_RULES.has(rule.name) ? fillWildcards(rule.parameters, wildcardKeys(pattern, field)) : rule.parameters;
+    const ctx = this.context(field, pattern, value, parameters, ruleNames);
+    if (await builtin.validate(ctx)) return [];
+    return [this.failureMessage(rule.name, builtin, ctx, pattern)];
   }
   /** Custom message (concrete field, then wildcard pattern, then rule name) or the default, with :attribute filled. */
   failureMessage(name, builtin, ctx, pattern) {
     const field = ctx.attribute;
-    const template = this.customMessages[`${field}.${name}`] ?? this.customMessages[`${pattern}.${name}`] ?? this.customMessages[name] ?? DEFAULT_MESSAGES[builtin?.messageKey(ctx) ?? name] ?? builtin?.defaultMessage ?? "The :attribute field is invalid.";
+    const template = this.customMessages[`${field}.${name}`] ?? this.customMessages[`${pattern}.${name}`] ?? this.customMessages[name] ?? builtin?.message ?? DEFAULT_MESSAGES[builtin?.messageKey(ctx) ?? name] ?? builtin?.defaultMessage ?? "The :attribute field is invalid.";
     const display = this.customAttributes[field] ?? this.customAttributes[pattern] ?? defaultAttributeName(field);
     return applyReplacements(template, { attribute: display, ...builtin?.replacements?.(ctx) ?? {} });
   }
@@ -823,10 +2560,15 @@ var ValidationFactoryImpl = class {
   make(data, rules, messages = {}, attributes = {}) {
     return new ValidatorImpl(data, rules, messages, attributes, { ...builtinRules, ...this.extended });
   }
+  /** Every rule this factory knows, built-in and extend()ed, sorted (for editors: `oriel ide:info`). */
+  ruleNames() {
+    return [.../* @__PURE__ */ new Set([...Object.keys(builtinRules), ...Object.keys(this.extended)])].sort();
+  }
   extend(name, callback, message) {
     this.extended[name] = {
       validate: (ctx) => callback(ctx.attribute, ctx.value, ctx.parameters, ctx.data),
       messageKey: () => name,
+      ...message === void 0 ? {} : { message },
       defaultMessage: message ?? "The :attribute field is invalid."
     };
   }
@@ -852,9 +2594,11 @@ export {
   FormRequest,
   InvalidRuleParameterError,
   MessageBagImpl,
+  PasswordRule,
   Rule,
   UnknownValidationRuleError,
   ValidationErrorImpl,
+  ValidationException,
   ValidationFactoryImpl,
   ValidationServiceProvider,
   Validator,