@shaferllc/keel 0.36.0 → 0.59.0

package/dist/core/exceptions.js

@@ -6,14 +6,20 @@
 export const STATUS_TEXT = {
     400: "Bad Request",
     401: "Unauthorized",
+    402: "Payment Required",
     403: "Forbidden",
     404: "Not Found",
     405: "Method Not Allowed",
+    406: "Not Acceptable",
+    408: "Request Timeout",
     409: "Conflict",
+    411: "Length Required",
     419: "Page Expired",
     422: "Unprocessable Entity",
     429: "Too Many Requests",
     500: "Internal Server Error",
+    501: "Not Implemented",
+    502: "Bad Gateway",
     503: "Service Unavailable",
 };
 /**
@@ -29,37 +35,189 @@ export class HttpException extends Error {
     headers;
     /** A machine-readable error code, e.g. "E_VALIDATION". */
     code;
-    constructor(status, message, headers) {
+    /** Structured context attached to the error; surfaced in the JSON body as `data`. */
+    data;
+    constructor(status, message, headers, data) {
         super(message ?? STATUS_TEXT[status] ?? "Error");
         this.name = "HttpException";
         this.status = status;
         this.headers = headers;
+        this.data = data;
+    }
+    /**
+     * The error as a plain object, matching the JSON body the HTTP kernel renders:
+     * `{ error, status }` plus `code` and `data` when present. Subclasses that add
+     * fields (e.g. `ValidationException.errors`) override this to include them.
+     */
+    toJSON() {
+        const body = { error: this.message, status: this.status };
+        if (this.code)
+            body.code = this.code;
+        if (this.data !== undefined)
+            body.data = this.data;
+        return body;
     }
 }
-export class NotFoundException extends HttpException {
-    constructor(message = "Not Found") {
-        super(404, message);
-        this.name = "NotFoundException";
+/*
+ * The standard HTTP error family. Each carries a fixed status and a stable
+ * `code`, and takes an optional `data` bag that lands in the JSON body. Throw
+ * any of them from a handler, middleware, or service to short-circuit with the
+ * right status. Ordered by status code.
+ */
+/** 400 — the request was malformed or failed validation. */
+export class BadRequestException extends HttpException {
+    constructor(message = "Bad Request", data) {
+        super(400, message, undefined, data);
+        this.name = "BadRequestException";
+        this.code = "E_BAD_REQUEST";
     }
 }
 export class UnauthorizedException extends HttpException {
-    constructor(message = "Unauthorized") {
-        super(401, message);
+    constructor(message = "Unauthorized", data) {
+        super(401, message, undefined, data);
         this.name = "UnauthorizedException";
+        this.code = "E_UNAUTHORIZED";
+    }
+}
+/** 402 — payment is required to access the resource. */
+export class PaymentRequiredException extends HttpException {
+    constructor(message = "Payment Required", data) {
+        super(402, message, undefined, data);
+        this.name = "PaymentRequiredException";
+        this.code = "E_PAYMENT_REQUIRED";
     }
 }
 export class ForbiddenException extends HttpException {
-    constructor(message = "Forbidden") {
-        super(403, message);
+    constructor(message = "Forbidden", data) {
+        super(403, message, undefined, data);
         this.name = "ForbiddenException";
+        this.code = "E_FORBIDDEN";
+    }
+}
+export class NotFoundException extends HttpException {
+    constructor(message = "Not Found", data) {
+        super(404, message, undefined, data);
+        this.name = "NotFoundException";
+        this.code = "E_NOT_FOUND";
     }
 }
-/** 422 with per-field messages. Pairs with a future validation layer. */
+/** 405 — the HTTP method isn't allowed for this resource. */
+export class MethodNotAllowedException extends HttpException {
+    constructor(message = "Method Not Allowed", data) {
+        super(405, message, undefined, data);
+        this.name = "MethodNotAllowedException";
+        this.code = "E_METHOD_NOT_ALLOWED";
+    }
+}
+/** 406 — no representation matches the request's `Accept` header. */
+export class NotAcceptableException extends HttpException {
+    constructor(message = "Not Acceptable", data) {
+        super(406, message, undefined, data);
+        this.name = "NotAcceptableException";
+        this.code = "E_NOT_ACCEPTABLE";
+    }
+}
+/** 408 — the client took too long to send the request. */
+export class RequestTimeoutException extends HttpException {
+    constructor(message = "Request Timeout", data) {
+        super(408, message, undefined, data);
+        this.name = "RequestTimeoutException";
+        this.code = "E_REQUEST_TIMEOUT";
+    }
+}
+/** 409 — the request conflicts with the current state (e.g. a duplicate). */
+export class ConflictException extends HttpException {
+    constructor(message = "Conflict", data) {
+        super(409, message, undefined, data);
+        this.name = "ConflictException";
+        this.code = "E_CONFLICT";
+    }
+}
+/** 411 — a `Content-Length` header is required and was missing. */
+export class LengthRequiredException extends HttpException {
+    constructor(message = "Length Required", data) {
+        super(411, message, undefined, data);
+        this.name = "LengthRequiredException";
+        this.code = "E_LENGTH_REQUIRED";
+    }
+}
+/** 422 with per-field messages. Pairs with the validation layer. */
 export class ValidationException extends HttpException {
     errors;
     constructor(errors, message = "The given data was invalid.") {
         super(422, message);
         this.name = "ValidationException";
+        this.code = "E_VALIDATION";
         this.errors = errors;
     }
+    toJSON() {
+        return { ...super.toJSON(), errors: this.errors };
+    }
+}
+/** 429 — the client has sent too many requests in a given window. */
+export class TooManyRequestsException extends HttpException {
+    constructor(message = "Too Many Requests", data) {
+        super(429, message, undefined, data);
+        this.name = "TooManyRequestsException";
+        this.code = "E_TOO_MANY_REQUESTS";
+    }
+}
+/** 500 — a catch-all server error you want to raise deliberately. */
+export class ServerErrorException extends HttpException {
+    constructor(message = "Internal Server Error", data) {
+        super(500, message, undefined, data);
+        this.name = "ServerErrorException";
+        this.code = "E_SERVER_ERROR";
+    }
+}
+/** 501 — the requested functionality isn't implemented. */
+export class NotImplementedException extends HttpException {
+    constructor(message = "Not Implemented", data) {
+        super(501, message, undefined, data);
+        this.name = "NotImplementedException";
+        this.code = "E_NOT_IMPLEMENTED";
+    }
+}
+/** 502 — an upstream server returned an invalid response. */
+export class BadGatewayException extends HttpException {
+    constructor(message = "Bad Gateway", data) {
+        super(502, message, undefined, data);
+        this.name = "BadGatewayException";
+        this.code = "E_BAD_GATEWAY";
+    }
+}
+/** 503 — the service is temporarily unavailable (down, overloaded). */
+export class ServiceUnavailableException extends HttpException {
+    constructor(message = "Service Unavailable", data) {
+        super(503, message, undefined, data);
+        this.name = "ServiceUnavailableException";
+        this.code = "E_SERVICE_UNAVAILABLE";
+    }
+}
+/**
+ * Mint a reusable, coded `HttpException` subclass — the ergonomic way to define
+ * app-specific errors with a stable, machine-readable `code`. Inspired by
+ * `@fastify/error`. The `message` may carry `%s` placeholders, filled in order
+ * from the constructor arguments.
+ *
+ *   const InsufficientFunds = createError("E_FUNDS", "Balance too low: need %s", 402);
+ *   throw new InsufficientFunds("$40");
+ *   // → 402  { error: "Balance too low: need $40", status: 402, code: "E_FUNDS" }
+ *
+ * The returned class extends `HttpException`, so it renders through the same
+ * path — `code` lands in the JSON body — and passes `instanceof HttpException`.
+ */
+export function createError(code, message, status = 500) {
+    return class extends HttpException {
+        constructor(...args) {
+            super(status, formatMessage(message, args));
+            this.name = code;
+            this.code = code;
+        }
+    };
+}
+/** printf-lite: replace each `%s` with the next argument, in order. */
+function formatMessage(template, args) {
+    let index = 0;
+    return template.replace(/%s/g, () => (index < args.length ? String(args[index++]) : "%s"));
 }

package/dist/core/helpers.d.ts

@@ -17,6 +17,12 @@ import { Logger } from "./logger.js";
 export declare function setApplication(app: Application): void;
 /** The active application container. Throws if none has been created. */
 export declare function app(): Application;
+/** Run a callback once the active application has booted (see `Application.onReady`). */
+export declare function onReady(hook: (app: Application) => void | Promise<void>): void;
+/** Register a graceful-shutdown hook on the active application (see `Application.onShutdown`). */
+export declare function onShutdown(hook: (app: Application) => void | Promise<void>): void;
+/** Gracefully terminate the active application, running its shutdown hooks. */
+export declare function terminate(): Promise<void>;
 /**
  * Read configuration with dot notation: `config('app.name')`, or with a
  * fallback: `config('app.port', 3000)`.

package/dist/core/helpers.js

@@ -24,6 +24,18 @@ export function app() {
     }
     return current;
 }
+/** Run a callback once the active application has booted (see `Application.onReady`). */
+export function onReady(hook) {
+    app().onReady(hook);
+}
+/** Register a graceful-shutdown hook on the active application (see `Application.onShutdown`). */
+export function onShutdown(hook) {
+    app().onShutdown(hook);
+}
+/** Gracefully terminate the active application, running its shutdown hooks. */
+export function terminate() {
+    return app().terminate();
+}
 /**
  * Read configuration with dot notation: `config('app.name')`, or with a
  * fallback: `config('app.port', 3000)`.

package/dist/core/http/kernel.js

@@ -101,8 +101,18 @@ export class HttpKernel {
         }
         for (const route of routes) {
             const fn = router.resolve(route.handler);
+            // Set the matched-route context *before* this route's middleware, so both
+            // route middleware and the handler can read `request.route` (incl. config).
+            const setRoute = async (c, next) => {
+                c.set("route", {
+                    name: route.name,
+                    pattern: route.path,
+                    methods: route.methods,
+                    config: route.config,
+                });
+                await next();
+            };
             const honoHandler = async (c) => {
-                c.set("route", { name: route.name, pattern: route.path, methods: route.methods });
                 const result = await fn(c);
                 return typeof result === "string" ? c.html(result) : result;
             };
@@ -111,7 +121,7 @@ export class HttpKernel {
             for (const [param, rgx] of Object.entries(route.wheres)) {
                 path = path.replace(new RegExp(`:${param}(\\??)`), `:${param}{${rgx}}$1`);
             }
-            const middleware = route.middleware.map((m) => router.resolveMiddleware(m));
+            const middleware = [setRoute, ...route.middleware.map((m) => router.resolveMiddleware(m))];
             hono.on(route.methods, [path], ...middleware, honoHandler);
         }
         hono.notFound((c) => this.handle(new NotFoundException(`No route for ${c.req.method} ${c.req.path}`), c));
@@ -159,6 +169,8 @@ export class HttpKernel {
         const body = { error: message, status };
         if (isHttp && err.code)
             body.code = err.code;
+        if (isHttp && err.data !== undefined)
+            body.data = err.data;
         if (err instanceof ValidationException)
             body.errors = err.errors;
         if (debug && !isHttp && err instanceof Error) {

package/dist/core/http/router.d.ts

@@ -53,6 +53,8 @@ export interface RouteDefinition {
     wheres: Record<string, string>;
     /** Host pattern this route is bound to, e.g. ":tenant.example.com". */
     domain?: string;
+    /** Arbitrary per-route metadata, readable in the handler via `request.route.config`. */
+    config: Record<string, unknown>;
 }
 /** A single registered route — chain to name it, guard it, or constrain params. */
 export declare class Route {
@@ -70,6 +72,8 @@ export declare class Route {
     where(param: string, matcher: Matcher): this;
     /** Bind this route to a host pattern (supports `:subdomain` segments). */
     domain(pattern: string): this;
+    /** Attach arbitrary metadata to the route — read it via `request.route.config`. */
+    config(data: Record<string, unknown>): this;
 }
 /** A group of routes sharing a prefix, middleware, and/or name prefix. */
 export declare class RouteGroup {
@@ -79,6 +83,8 @@ export declare class RouteGroup {
     middleware(mw: MiddlewareRef | MiddlewareRef[]): this;
     /** Alias for middleware(), matching AdonisJS. */
     use(mw: MiddlewareRef | MiddlewareRef[]): this;
+    /** Attach metadata to every route in the group (a route's own config wins). */
+    config(data: Record<string, unknown>): this;
     /** Constrain a parameter across every route in the group. */
     where(param: string, matcher: Matcher): this;
     as(namePrefix: string): this;
@@ -165,6 +171,14 @@ export declare class Router {
      */
     resource(name: string, controller: ControllerRef): RouteResource;
     private add;
+    private routeHooks;
+    /**
+     * Observe route registration — called with each route's definition as it's
+     * added (and replayed for routes already registered). Handy for logging or
+     * building an API map. The `def` is live, so reading it later reflects fluent
+     * config (`.name()`, `.middleware()`) applied after registration.
+     */
+    onRoute(hook: (def: RouteDefinition) => void): this;
     /** Register a global parameter constraint, applied to every matching route. */
     where(param: string, matcher: Matcher): this;
     /** All registered routes (excluding those trimmed to zero methods). */

package/dist/core/http/router.js

@@ -70,6 +70,11 @@ export class Route {
         this.def.domain = pattern;
         return this;
     }
+    /** Attach arbitrary metadata to the route — read it via `request.route.config`. */
+    config(data) {
+        Object.assign(this.def.config, data);
+        return this;
+    }
 }
 /** A group of routes sharing a prefix, middleware, and/or name prefix. */
 export class RouteGroup {
@@ -93,6 +98,12 @@ export class RouteGroup {
     use(mw) {
         return this.middleware(mw);
     }
+    /** Attach metadata to every route in the group (a route's own config wins). */
+    config(data) {
+        for (const r of this.routes)
+            r.config = { ...data, ...r.config };
+        return this;
+    }
     /** Constrain a parameter across every route in the group. */
     where(param, matcher) {
         for (const r of this.routes) {
@@ -317,10 +328,26 @@ export class Router {
             handler,
             middleware: [...this.group_mw],
             wheres: {},
+            config: {},
         };
         this.routes.push(def);
+        for (const hook of this.routeHooks)
+            hook(def);
         return new Route(def);
     }
+    routeHooks = [];
+    /**
+     * Observe route registration — called with each route's definition as it's
+     * added (and replayed for routes already registered). Handy for logging or
+     * building an API map. The `def` is live, so reading it later reflects fluent
+     * config (`.name()`, `.middleware()`) applied after registration.
+     */
+    onRoute(hook) {
+        for (const def of this.routes)
+            hook(def);
+        this.routeHooks.push(hook);
+        return this;
+    }
     /** Register a global parameter constraint, applied to every matching route. */
     where(param, matcher) {
         this.globalWheres[param] = matcherSource(matcher);
@@ -344,7 +371,9 @@ export class Router {
             throw new Error(`No route named [${name}].`);
         let path = def.path;
         for (const [k, v] of Object.entries(params)) {
-            path = path.replace(new RegExp(`:${k}\\??`), encodeURIComponent(String(v)));
+            // Global + word-boundary: replace every `:k` occurrence, and don't let
+            // `:id` match inside `:idx`.
+            path = path.replace(new RegExp(`:${k}\\b\\??`, "g"), encodeURIComponent(String(v)));
         }
         path = path.replace(/\/:[^/]+\?/g, "").replace(/:[^/]+/g, "");
         if (options.qs && Object.keys(options.qs).length) {

package/dist/core/index.d.ts

@@ -2,23 +2,28 @@
 export { Container } from "./container.js";
 export type { Token, Constructor, Factory } from "./container.js";
 export { Application } from "./application.js";
-export type { BootOptions } from "./application.js";
+export type { BootOptions, LifecycleHook, Configurator } from "./application.js";
 export { Config, env } from "./config.js";
-export { app, config, view, bind, singleton, instance, make, bound, events, emit, listen, cache, logger, } from "./helpers.js";
+export { app, config, view, bind, singleton, instance, make, bound, events, emit, listen, cache, logger, onReady, onShutdown, terminate, } from "./helpers.js";
 export { Logger } from "./logger.js";
 export type { LogLevel, LoggerOptions } from "./logger.js";
+export { requestLogger, requestLog } from "./request-logger.js";
+export type { RequestLoggerOptions } from "./request-logger.js";
 export { Events } from "./events.js";
 export type { Listener } from "./events.js";
 export { Cache, MemoryStore } from "./cache.js";
 export type { CacheStore } from "./cache.js";
 export { serveStatic } from "./static.js";
 export type { StaticOptions } from "./static.js";
+export { Storage, MemoryDisk, storage, setDisk } from "./storage.js";
+export type { Disk, Contents } from "./storage.js";
 export { dump, dd } from "./debug.js";
-export { hash, encryption } from "./crypto.js";
+export { hash, encryption, jwt } from "./crypto.js";
+export type { JwtPayload, JwtSignOptions, JwtVerifyOptions } from "./crypto.js";
 export { rateLimiter } from "./rate-limit.js";
 export type { RateLimiterOptions } from "./rate-limit.js";
 export { db, setConnection, QueryBuilder } from "./database.js";
-export type { Connection, WriteResult, Row, Dialect, Operator } from "./database.js";
+export type { Connection, WriteResult, Row, Dialect, Operator, Paginated } from "./database.js";
 export { Model } from "./model.js";
 export type { CastType, Casts } from "./casts.js";
 export { Relation, HasOne, HasMany, BelongsTo, BelongsToMany } from "./relations.js";
@@ -28,14 +33,23 @@ export { Mailer, PendingMail, ArrayTransport, LogTransport, fetchTransport, mail
 export type { Message, Transport, MailerOptions, FetchTransportOptions } from "./mail.js";
 export { Job, Queue, SyncDriver, MemoryDriver, dispatch, work, setQueue, getQueue, } from "./queue.js";
 export type { Dispatchable, JobOptions, QueueDriver, Drainable, QueuedJob } from "./queue.js";
+export { Scheduler, ScheduledTask, scheduler, setScheduler, schedule, cronMatches } from "./scheduler.js";
+export { MemoryBroadcaster, broadcast, setBroadcaster, getBroadcaster, channelAuth, authorizeChannel, clearChannels, } from "./broadcasting.js";
+export type { Broadcaster, Subscriber, ChannelAuthorizer } from "./broadcasting.js";
+export { Redis, MemoryRedis, redis, setRedis, redisStore } from "./redis.js";
+export type { RedisConnection, SetOptions } from "./redis.js";
 export { Notification, Notifier, MailChannel, DatabaseChannel, ArrayChannel, routeFor, notify, setNotifier, getNotifier, } from "./notification.js";
 export type { Notifiable, MailContent, Channel } from "./notification.js";
 export { SchemaBuilder, Migrator, TableBuilder, Column } from "./migrations.js";
 export type { Migration } from "./migrations.js";
 export { ctx, json, text, html, redirect, param, query, header, body, request, response, } from "./request.js";
+export { decorateRequest, hasRequestDecorator, decorated, setRequestValue, clearRequestDecorators, } from "./decorators.js";
+export type { RequestResolver } from "./decorators.js";
 export type { ConfigData } from "./config.js";
 export { View } from "./view.js";
 export type { Renderable, ViewConfig } from "./view.js";
+export { TemplateEngine, escapeHtml, templates, setTemplateEngine, render, } from "./template.js";
+export type { Filter, RenderContext } from "./template.js";
 export { ServiceProvider } from "./provider.js";
 export type { ProviderClass } from "./provider.js";
 export { Router, Route, RouteGroup, RouteResource, matchers } from "./http/router.js";
@@ -43,10 +57,19 @@ export type { Ctx, RouteHandler, RouteDefinition, Method, Matcher, MiddlewareRef
 export { Inertia, inertia, inertiaPageAttr } from "./inertia.js";
 export type { InertiaPage, InertiaOptions } from "./inertia.js";
 export { HttpKernel } from "./http/kernel.js";
-export { HttpException, NotFoundException, UnauthorizedException, ForbiddenException, ValidationException, STATUS_TEXT, } from "./exceptions.js";
-export { validate } from "./validation.js";
-export type { Schema } from "./validation.js";
+export { TestClient, TestResponse, testClient } from "./testing.js";
+export { HttpException, BadRequestException, UnauthorizedException, PaymentRequiredException, ForbiddenException, NotFoundException, MethodNotAllowedException, NotAcceptableException, RequestTimeoutException, ConflictException, LengthRequiredException, ValidationException, TooManyRequestsException, ServerErrorException, NotImplementedException, BadGatewayException, ServiceUnavailableException, createError, STATUS_TEXT, } from "./exceptions.js";
+export { validate, validateRequest, validated } from "./validation.js";
+export type { Schema, RequestSchemas } from "./validation.js";
 export { Session, session, sessionMiddleware } from "./session.js";
 export type { SessionOptions } from "./session.js";
-export { Auth, auth, authGuard, setUserProvider } from "./auth.js";
+export { Auth, auth, authGuard, bearerAuth, setUserProvider } from "./auth.js";
 export type { UserProvider } from "./auth.js";
+export { define, policy, gateBefore, setUserResolver, clearAuthorization, can, cannot, canFor, authorize, authorizeFor, } from "./authorization.js";
+export type { GateCallback, BeforeCallback } from "./authorization.js";
+export { Transformer } from "./transformer.js";
+export type { Attributes, DocumentOptions } from "./transformer.js";
+export { Broker, Service, LocalTransporter, ServiceNotFoundError, RequestTimeoutError, broker, setBroker, } from "./broker.js";
+export type { ServiceSchema, Context, ActionHandler, EventHandler, ActionDef, ActionSchema, ActionHooks, EventSchema, ServiceHooks, Visibility, EventType, BeforeHook, AfterHook, ErrorHook, Transporter, BrokerOptions, BrokerMiddleware, CallOptions, EmitOptions, MCallDefs, MCallOptions, } from "./broker.js";
+export { Vite, viteTags, viteAsset, viteReactRefresh } from "./vite.js";
+export type { ViteOptions, Manifest, ManifestChunk, Attributes as ViteAttributes, AttrValue, } from "./vite.js";

package/dist/core/index.js

@@ -2,13 +2,15 @@
 export { Container } from "./container.js";
 export { Application } from "./application.js";
 export { Config, env } from "./config.js";
-export { app, config, view, bind, singleton, instance, make, bound, events, emit, listen, cache, logger, } from "./helpers.js";
+export { app, config, view, bind, singleton, instance, make, bound, events, emit, listen, cache, logger, onReady, onShutdown, terminate, } from "./helpers.js";
 export { Logger } from "./logger.js";
+export { requestLogger, requestLog } from "./request-logger.js";
 export { Events } from "./events.js";
 export { Cache, MemoryStore } from "./cache.js";
 export { serveStatic } from "./static.js";
+export { Storage, MemoryDisk, storage, setDisk } from "./storage.js";
 export { dump, dd } from "./debug.js";
-export { hash, encryption } from "./crypto.js";
+export { hash, encryption, jwt } from "./crypto.js";
 export { rateLimiter } from "./rate-limit.js";
 export { db, setConnection, QueryBuilder } from "./database.js";
 export { Model } from "./model.js";
@@ -16,15 +18,25 @@ export { Relation, HasOne, HasMany, BelongsTo, BelongsToMany } from "./relations
 export { Faker, Factory as ModelFactory, factory, Seeder, seed } from "./factory.js";
 export { Mailer, PendingMail, ArrayTransport, LogTransport, fetchTransport, mail, setMailer, getMailer, } from "./mail.js";
 export { Job, Queue, SyncDriver, MemoryDriver, dispatch, work, setQueue, getQueue, } from "./queue.js";
+export { Scheduler, ScheduledTask, scheduler, setScheduler, schedule, cronMatches } from "./scheduler.js";
+export { MemoryBroadcaster, broadcast, setBroadcaster, getBroadcaster, channelAuth, authorizeChannel, clearChannels, } from "./broadcasting.js";
+export { Redis, MemoryRedis, redis, setRedis, redisStore } from "./redis.js";
 export { Notification, Notifier, MailChannel, DatabaseChannel, ArrayChannel, routeFor, notify, setNotifier, getNotifier, } from "./notification.js";
 export { SchemaBuilder, Migrator, TableBuilder, Column } from "./migrations.js";
 export { ctx, json, text, html, redirect, param, query, header, body, request, response, } from "./request.js";
+export { decorateRequest, hasRequestDecorator, decorated, setRequestValue, clearRequestDecorators, } from "./decorators.js";
 export { View } from "./view.js";
+export { TemplateEngine, escapeHtml, templates, setTemplateEngine, render, } from "./template.js";
 export { ServiceProvider } from "./provider.js";
 export { Router, Route, RouteGroup, RouteResource, matchers } from "./http/router.js";
 export { Inertia, inertia, inertiaPageAttr } from "./inertia.js";
 export { HttpKernel } from "./http/kernel.js";
-export { HttpException, NotFoundException, UnauthorizedException, ForbiddenException, ValidationException, STATUS_TEXT, } from "./exceptions.js";
-export { validate } from "./validation.js";
+export { TestClient, TestResponse, testClient } from "./testing.js";
+export { HttpException, BadRequestException, UnauthorizedException, PaymentRequiredException, ForbiddenException, NotFoundException, MethodNotAllowedException, NotAcceptableException, RequestTimeoutException, ConflictException, LengthRequiredException, ValidationException, TooManyRequestsException, ServerErrorException, NotImplementedException, BadGatewayException, ServiceUnavailableException, createError, STATUS_TEXT, } from "./exceptions.js";
+export { validate, validateRequest, validated } from "./validation.js";
 export { Session, session, sessionMiddleware } from "./session.js";
-export { Auth, auth, authGuard, setUserProvider } from "./auth.js";
+export { Auth, auth, authGuard, bearerAuth, setUserProvider } from "./auth.js";
+export { define, policy, gateBefore, setUserResolver, clearAuthorization, can, cannot, canFor, authorize, authorizeFor, } from "./authorization.js";
+export { Transformer } from "./transformer.js";
+export { Broker, Service, LocalTransporter, ServiceNotFoundError, RequestTimeoutError, broker, setBroker, } from "./broker.js";
+export { Vite, viteTags, viteAsset, viteReactRefresh } from "./vite.js";

package/dist/core/logger.d.ts

@@ -14,6 +14,11 @@ export interface LoggerOptions {
     pretty?: boolean;
     /** Fields merged into every log line. */
     bindings?: Record<string, unknown>;
+    /**
+     * Field paths to redact from log output — top-level keys (`"password"`) or dot
+     * paths (`"req.headers.authorization"`). Matched values become `"[redacted]"`.
+     */
+    redact?: string[];
 }
 export declare class Logger {
     private options;

package/dist/core/logger.js

@@ -7,6 +7,24 @@
  *   logger().error("payment failed", { orderId, error });
  */
 const LEVELS = { debug: 10, info: 20, warn: 30, error: 40 };
+const REDACTED = "[redacted]";
+/** Return a copy of `obj` with `path` (dot-separated) redacted — clones only along the path. */
+function redactPath(obj, keys) {
+    const [head, ...rest] = keys;
+    if (head === undefined || !(head in obj))
+        return obj;
+    const clone = { ...obj };
+    if (rest.length === 0) {
+        clone[head] = REDACTED;
+    }
+    else {
+        const child = clone[head];
+        if (child && typeof child === "object") {
+            clone[head] = redactPath(child, rest);
+        }
+    }
+    return clone;
+}
 export class Logger {
     options;
     threshold;
@@ -18,13 +36,17 @@ export class Logger {
         if (LEVELS[level] < this.threshold)
             return;
         const time = new Date().toISOString();
+        let fields = { ...this.options.bindings, ...context };
+        for (const path of this.options.redact ?? []) {
+            fields = redactPath(fields, path.split("."));
+        }
         if (this.options.pretty) {
-            const extra = context ? " " + JSON.stringify(context) : "";
+            const extra = Object.keys(fields).length ? " " + JSON.stringify(fields) : "";
             const fn = level === "warn" ? console.warn : level === "error" ? console.error : console.log;
             fn(`[${time}] ${level.toUpperCase().padEnd(5)} ${message}${extra}`);
         }
         else {
-            console.log(JSON.stringify({ level, time, msg: message, ...this.options.bindings, ...context }));
+            console.log(JSON.stringify({ level, time, msg: message, ...fields }));
         }
     }
     debug(message, context) {

package/dist/core/migrations.js

@@ -165,11 +165,11 @@ export class Migrator {
     /** Names of migrations already applied. */
     async ran() {
         await this.ensure();
-        const rows = await this.conn.select("SELECT name FROM migrations", []);
+        const rows = (await this.conn.select("SELECT name FROM migrations", []));
         return rows.map((r) => String(r.name));
     }
     async maxBatch() {
-        const rows = await this.conn.select("SELECT MAX(batch) AS b FROM migrations", []);
+        const rows = (await this.conn.select("SELECT MAX(batch) AS b FROM migrations", []));
         return Number(rows[0]?.b ?? 0);
     }
     /** Run all pending migrations. Returns the names applied. */
@@ -196,7 +196,7 @@ export class Migrator {
         const batch = await this.maxBatch();
         if (!batch)
             return [];
-        const rows = await this.conn.select(this.ph("SELECT name FROM migrations WHERE batch = ?"), [batch]);
+        const rows = (await this.conn.select(this.ph("SELECT name FROM migrations WHERE batch = ?"), [batch]));
         const schema = new SchemaBuilder(this.conn, this.dialect);
         const rolled = [];
         for (const name of rows.map((r) => String(r.name)).reverse()) {