@shaferllc/keel 0.58.0 → 0.66.0

package/dist/core/crypto.js

@@ -7,6 +7,9 @@
  *
  *   const token = await encryption.encrypt({ userId: 1 });
  *   await encryption.decrypt(token);             // { userId: 1 } | null
+ *
+ *   const token = await jwt.sign({ sub: "42" }, { expiresIn: "1h" });
+ *   await jwt.verify(token);                      // { sub: "42", iat, exp } | null
  */
 import { config } from "./helpers.js";
 /* --------------------------- shared utilities -------------------------- */
@@ -39,6 +42,9 @@ function appKey() {
 }
 /* ------------------------------- hashing ------------------------------- */
 const DEFAULT_ITERATIONS = 100_000;
+/** When true, `hash` skips PBKDF2 for a trivial (insecure) scheme — tests only. */
+let faking = false;
+const FAKE_PREFIX = "fake$";
 async function pbkdf2(password, salt, iterations) {
     const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(password), "PBKDF2", false, ["deriveBits"]);
     const bits = await crypto.subtle.deriveBits({ name: "PBKDF2", salt: salt, iterations, hash: "SHA-256" }, key, 256);
@@ -47,12 +53,16 @@ async function pbkdf2(password, salt, iterations) {
 export const hash = {
     /** Hash a password (PBKDF2-SHA256 with a random salt). */
     async make(password, iterations = DEFAULT_ITERATIONS) {
+        if (faking)
+            return `${FAKE_PREFIX}${password}`;
         const salt = crypto.getRandomValues(new Uint8Array(16));
         const derived = await pbkdf2(password, salt, iterations);
         return `pbkdf2_sha256$${iterations}$${b64(salt)}$${b64(derived)}`;
     },
     /** Verify a password against a stored hash. Returns false for any malformed hash. */
     async verify(hashed, password) {
+        if (faking)
+            return hashed === `${FAKE_PREFIX}${password}`;
         const [algo, iter, salt64, hash64] = hashed.split("$");
         if (algo !== "pbkdf2_sha256" || !iter || !salt64 || !hash64)
             return false;
@@ -70,9 +80,35 @@ export const hash = {
     },
     /** Whether a hash was made with fewer iterations than the current default. */
     needsRehash(hashed, iterations = DEFAULT_ITERATIONS) {
+        if (faking)
+            return false;
         const iter = Number(hashed.split("$")[1]);
         return !iter || iter < iterations;
     },
+    /**
+     * Swap real hashing for a trivial, **insecure** scheme so tests that create
+     * many users don't pay for PBKDF2. `make` returns `fake$<password>` and
+     * `verify` just compares — near-instant. Call in a test setup hook; undo with
+     * `restore()`. Never use outside tests.
+     */
+    fake() {
+        faking = true;
+    },
+    /** Restore real PBKDF2 hashing after `fake()`. */
+    restore() {
+        faking = false;
+    },
+    /**
+     * A valid dummy hash (of a random secret) at the default cost. Compare against
+     * it when a user *isn't* found so login spends the same time as a wrong
+     * password — otherwise a fast "no such user" response leaks which emails are
+     * registered (a timing/enumeration attack).
+     *
+     *   const user = await findUserByEmail(email);
+     *   const ok = await hash.verify(user?.password ?? hash.dummy, password);
+     *   if (ok && user) auth().login(user.id);   // `user &&` so the dummy never authenticates
+     */
+    dummy: "pbkdf2_sha256$100000$7uVVFNW3RCry5kPKJQUgTw==$fOfxeFDnxv5A3rhl6bcWGKJQhmcK8x6XNfe9Z88WO/A=",
 };
 /* ----------------------------- encryption ------------------------------ */
 async function aesKey() {
@@ -80,24 +116,132 @@ async function aesKey() {
     return crypto.subtle.importKey("raw", digest, "AES-GCM", false, ["encrypt", "decrypt"]);
 }
 export const encryption = {
-    /** Encrypt any JSON-serializable value (AES-GCM), keyed by config('app.key'). */
-    async encrypt(value) {
+    /**
+     * Encrypt any JSON-serializable value (AES-GCM), keyed by `config('app.key')`.
+     * `expiresIn` makes the token self-expire; `purpose` binds it to a context
+     * (e.g. `"password-reset"`) so a token minted for one use can't be replayed for
+     * another.
+     */
+    async encrypt(value, options = {}) {
+        // Wrap in a small envelope so expiry/purpose travel inside the ciphertext.
+        const envelope = { __k: 1, v: value };
+        if (options.expiresIn != null)
+            envelope.exp = Date.now() + seconds(options.expiresIn) * 1000;
+        if (options.purpose != null)
+            envelope.p = options.purpose;
         const iv = crypto.getRandomValues(new Uint8Array(12));
-        const data = new TextEncoder().encode(JSON.stringify(value));
+        const data = new TextEncoder().encode(JSON.stringify(envelope));
         const cipher = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv: iv }, await aesKey(), data));
         const packed = new Uint8Array(iv.length + cipher.length);
         packed.set(iv);
         packed.set(cipher, iv.length);
         return b64(packed);
     },
-    /** Decrypt a value; returns null if the payload is tampered or invalid. */
-    async decrypt(payload) {
+    /**
+     * Decrypt a value; returns `null` if the payload is tampered, invalid, expired,
+     * or minted for a different `purpose`. Never throws.
+     */
+    async decrypt(payload, options = {}) {
         try {
             const bytes = fromB64(payload);
             const iv = bytes.slice(0, 12);
             const cipher = bytes.slice(12);
             const plain = await crypto.subtle.decrypt({ name: "AES-GCM", iv: iv }, await aesKey(), cipher);
-            return JSON.parse(new TextDecoder().decode(plain));
+            const parsed = JSON.parse(new TextDecoder().decode(plain));
+            // Envelope (new format): enforce expiry + purpose.
+            if (parsed && typeof parsed === "object" && parsed.__k === 1) {
+                const env = parsed;
+                if (typeof env.exp === "number" && Date.now() >= env.exp)
+                    return null;
+                if ((options.purpose ?? null) !== (env.p ?? null))
+                    return null;
+                return env.v;
+            }
+            // Legacy plain value (encrypted before envelopes). A required purpose can't match.
+            if (options.purpose != null)
+                return null;
+            return parsed;
+        }
+        catch {
+            return null;
+        }
+    },
+};
+const DURATION = /^(\d+)\s*(s|m|h|d)$/;
+const UNIT = { s: 1, m: 60, h: 3600, d: 86400 };
+/** Coerce a lifetime to seconds — a bare number passes through; `"1h"` → 3600. */
+function seconds(value) {
+    if (typeof value === "number")
+        return value;
+    const match = DURATION.exec(value.trim());
+    if (!match)
+        throw new Error(`Invalid duration "${value}" (use e.g. 30, "30s", "15m", "1h", "7d").`);
+    return Number(match[1]) * UNIT[match[2]];
+}
+/* base64url — JWT segments use the URL-safe alphabet with no padding. */
+function b64url(bytes) {
+    return b64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromB64url(str) {
+    const pad = str.length % 4 ? "=".repeat(4 - (str.length % 4)) : "";
+    return fromB64(str.replace(/-/g, "+").replace(/_/g, "/") + pad);
+}
+function b64urlJson(value) {
+    return b64url(new TextEncoder().encode(JSON.stringify(value)));
+}
+/** HMAC-SHA256 the signing input, returned base64url — the JWT signature. */
+async function hmacSha256(data, secret) {
+    const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(data));
+    return b64url(new Uint8Array(sig));
+}
+const JWT_HEADER = b64urlJson({ alg: "HS256", typ: "JWT" });
+export const jwt = {
+    /** Sign a payload into an HS256 JWT. Adds `iat`, and `exp` when `expiresIn` is set. */
+    async sign(payload, options = {}) {
+        const now = Math.floor(Date.now() / 1000);
+        const claims = { ...payload, iat: now };
+        if (options.subject !== undefined)
+            claims.sub = options.subject;
+        if (options.issuer !== undefined)
+            claims.iss = options.issuer;
+        if (options.audience !== undefined)
+            claims.aud = options.audience;
+        if (options.expiresIn !== undefined)
+            claims.exp = now + seconds(options.expiresIn);
+        const body = `${JWT_HEADER}.${b64urlJson(claims)}`;
+        const sig = await hmacSha256(body, options.secret ?? appKey());
+        return `${body}.${sig}`;
+    },
+    /**
+     * Verify an HS256 JWT and return its payload, or `null` if the token is
+     * malformed, tampered, expired, not-yet-valid, or fails an issuer/audience
+     * check. Only HS256 is accepted — `alg: none` and asymmetric algs are refused,
+     * closing the classic JWT algorithm-confusion hole.
+     */
+    async verify(token, options = {}) {
+        try {
+            const parts = token.split(".");
+            if (parts.length !== 3)
+                return null;
+            const [header, body, sig] = parts;
+            const alg = JSON.parse(new TextDecoder().decode(fromB64url(header))).alg;
+            if (alg !== "HS256")
+                return null;
+            const expected = await hmacSha256(`${header}.${body}`, options.secret ?? appKey());
+            if (!safeEqual(sig, expected))
+                return null;
+            const claims = JSON.parse(new TextDecoder().decode(fromB64url(body)));
+            const now = Math.floor(Date.now() / 1000);
+            if (typeof claims.exp === "number" && now >= claims.exp)
+                return null;
+            if (typeof claims.nbf === "number" && now < claims.nbf)
+                return null;
+            if (options.issuer !== undefined && claims.iss !== options.issuer)
+                return null;
+            if (options.audience !== undefined && claims.aud !== options.audience)
+                return null;
+            return claims;
         }
         catch {
             return null;

package/dist/core/csrf.d.ts

@@ -0,0 +1,25 @@
+/**
+ * CSRF protection for server-rendered apps. A synchronizer token lives in the
+ * session; state-changing requests (`POST`/`PUT`/`PATCH`/`DELETE`) must echo it
+ * back, or they're rejected with `419 Page Expired`. Needs `sessionMiddleware()`.
+ *
+ *   this.use(sessionMiddleware());
+ *   this.use(csrf());
+ *
+ * Put the token in forms with `csrfField()`; SPAs get it for free — `csrf()` also
+ * writes an `XSRF-TOKEN` cookie that axios/fetch libraries send back as the
+ * `X-XSRF-TOKEN` header automatically. The token is also read from a `_token` or
+ * `_csrf` field, or the `X-CSRF-Token` header.
+ */
+import type { MiddlewareHandler } from "hono";
+/** The current request's CSRF token, minting and storing one if absent. */
+export declare function csrfToken(): string;
+/** A hidden form input carrying the CSRF token — drop it into any `<form method="POST">`. */
+export declare function csrfField(): string;
+export interface CsrfOptions {
+    /** Paths exempt from verification (webhooks, callbacks). Trailing `*` matches a prefix. */
+    except?: (string | RegExp)[];
+    /** Write the readable `XSRF-TOKEN` cookie for SPA libraries. Default true. */
+    cookie?: boolean;
+}
+export declare function csrf(options?: CsrfOptions): MiddlewareHandler;

package/dist/core/csrf.js

@@ -0,0 +1,78 @@
+/**
+ * CSRF protection for server-rendered apps. A synchronizer token lives in the
+ * session; state-changing requests (`POST`/`PUT`/`PATCH`/`DELETE`) must echo it
+ * back, or they're rejected with `419 Page Expired`. Needs `sessionMiddleware()`.
+ *
+ *   this.use(sessionMiddleware());
+ *   this.use(csrf());
+ *
+ * Put the token in forms with `csrfField()`; SPAs get it for free — `csrf()` also
+ * writes an `XSRF-TOKEN` cookie that axios/fetch libraries send back as the
+ * `X-XSRF-TOKEN` header automatically. The token is also read from a `_token` or
+ * `_csrf` field, or the `X-CSRF-Token` header.
+ */
+import { setCookie } from "hono/cookie";
+import { HttpException } from "./exceptions.js";
+import { session } from "./session.js";
+import { request } from "./request.js";
+const KEY = "_csrf";
+const UNSAFE = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+function randomToken() {
+    const bytes = crypto.getRandomValues(new Uint8Array(32));
+    let s = "";
+    for (const b of bytes)
+        s += String.fromCharCode(b);
+    return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function safeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let result = 0;
+    for (let i = 0; i < a.length; i++)
+        result |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return result === 0;
+}
+/** The current request's CSRF token, minting and storing one if absent. */
+export function csrfToken() {
+    const sess = session();
+    let token = sess.get(KEY, undefined);
+    if (!token) {
+        token = randomToken();
+        sess.put(KEY, token);
+    }
+    return token;
+}
+/** A hidden form input carrying the CSRF token — drop it into any `<form method="POST">`. */
+export function csrfField() {
+    return `<input type="hidden" name="_token" value="${csrfToken()}">`;
+}
+async function submitted(c) {
+    const header = c.req.header("x-csrf-token") ?? c.req.header("x-xsrf-token");
+    if (header)
+        return header;
+    const all = await request.all(); // shares keel's body cache — safe to read
+    return (all._token ?? all._csrf);
+}
+function isExcepted(path, except) {
+    return except.some((rule) => typeof rule === "string"
+        ? rule.endsWith("*")
+            ? path.startsWith(rule.slice(0, -1))
+            : path === rule
+        : rule.test(path));
+}
+export function csrf(options = {}) {
+    const except = options.except ?? [];
+    return async (c, next) => {
+        const token = csrfToken(); // ensures a token exists in the session
+        if (options.cookie !== false) {
+            setCookie(c, "XSRF-TOKEN", token, { path: "/", sameSite: "Lax" }); // readable by JS on purpose
+        }
+        if (UNSAFE.has(c.req.method.toUpperCase()) && !isExcepted(c.req.path, except)) {
+            const provided = await submitted(c);
+            if (!provided || !safeEqual(provided, token)) {
+                throw new HttpException(419, "CSRF token mismatch");
+            }
+        }
+        await next();
+    };
+}

package/dist/core/database.d.ts

@@ -31,16 +31,40 @@ export interface Connection {
 }
 export type Dialect = "sqlite" | "mysql" | "postgres";
 export type Operator = "=" | "!=" | "<" | "<=" | ">" | ">=" | "like";
-/** Register the database connection (and dialect) used by `db()`. */
+/** A registered connection — the driver bridge plus its SQL dialect. */
+interface Source {
+    conn: Connection;
+    dialect: Dialect;
+}
+/** Register the default connection (and dialect) used by `db()`. */
 export declare function setConnection(conn: Connection, driverDialect?: Dialect): void;
+/**
+ * Register a *named* connection alongside any others — the way to use more than
+ * one database. Point a query or model at it by name; nothing else changes.
+ *
+ *   addConnection("reporting", pgConn, "postgres");
+ *   await db("events", "reporting").where("kind", "signup").count();
+ */
+export declare function addConnection(name: string, conn: Connection, driverDialect?: Dialect): void;
+/** Choose which registered connection `db()` and models use when none is named. */
+export declare function setDefaultConnection(name: string): void;
+/** The names of every registered connection. */
+export declare function connectionNames(): string[];
+/** Unregister every connection — a test helper for a clean slate. */
+export declare function clearConnections(): void;
 export declare class QueryBuilder<T extends Row = Row> {
     private table;
+    private getSource;
     private wheres;
     private orders;
     private columns;
     private _limit?;
     private _offset?;
-    constructor(table: string);
+    constructor(table: string, getSource: () => Source);
+    /** Run a row-returning query on this builder's connection, dialect-adjusted. */
+    private runSelect;
+    /** Run a write on this builder's connection, dialect-adjusted. */
+    private runWrite;
     select(...columns: string[]): this;
     where(column: string, value: unknown): this;
     where(column: string, operator: Operator, value: unknown): this;
@@ -79,5 +103,26 @@ export declare class QueryBuilder<T extends Row = Row> {
     update(data: Row): Promise<WriteResult>;
     delete(): Promise<WriteResult>;
 }
-/** Start a query against a table. */
-export declare function db<T extends Row = Row>(table: string): QueryBuilder<T>;
+/** Start a query against a table, on the default connection or a named one. */
+export declare function db<T extends Row = Row>(table: string, connectionName?: string): QueryBuilder<T>;
+/** A handle to one registered connection — query it, or run raw SQL on it. */
+export interface ConnectionHandle {
+    /** Start a query against a table on this connection. */
+    table<T extends Row = Row>(table: string): QueryBuilder<T>;
+    /** Run a raw row-returning query (`?` placeholders, dialect-adjusted). */
+    select(sql: string, bindings?: unknown[]): Promise<Row[]>;
+    /** Run a raw write (`?` placeholders, dialect-adjusted). */
+    write(sql: string, bindings?: unknown[]): Promise<WriteResult>;
+    /** This connection's SQL dialect. */
+    readonly dialect: Dialect;
+}
+/**
+ * Get a handle to a named connection (or the default). Use it to run several
+ * queries against one database without repeating the name, or to reach the raw
+ * `select`/`write` bridge.
+ *
+ *   const reporting = connection("reporting");
+ *   await reporting.table("events").where("kind", "signup").count();
+ */
+export declare function connection(name?: string): ConnectionHandle;
+export {};

package/dist/core/database.js

@@ -9,20 +9,56 @@
  *   const user = await db("users").where("id", 1).first();
  *   await db("users").insert({ email });
  */
-let connection;
-let dialect = "sqlite";
-/** Register the database connection (and dialect) used by `db()`. */
+/**
+ * The connection registry. An app can talk to several databases at once —
+ * register each by name, then route a query with `db(table, name)`, a whole
+ * model with `static connection`, or a handle from `connection(name)`. The
+ * unnamed default lives under `"default"` so `db(table)` and `setConnection()`
+ * keep working unchanged.
+ */
+const registry = new Map();
+let defaultConnection = "default";
+/** Register the default connection (and dialect) used by `db()`. */
 export function setConnection(conn, driverDialect = "sqlite") {
-    connection = conn;
-    dialect = driverDialect;
+    registry.set("default", { conn, dialect: driverDialect });
+    defaultConnection = "default";
+}
+/**
+ * Register a *named* connection alongside any others — the way to use more than
+ * one database. Point a query or model at it by name; nothing else changes.
+ *
+ *   addConnection("reporting", pgConn, "postgres");
+ *   await db("events", "reporting").where("kind", "signup").count();
+ */
+export function addConnection(name, conn, driverDialect = "sqlite") {
+    registry.set(name, { conn, dialect: driverDialect });
+}
+/** Choose which registered connection `db()` and models use when none is named. */
+export function setDefaultConnection(name) {
+    if (!registry.has(name))
+        throw new Error(`No database connection "${name}" to make default.`);
+    defaultConnection = name;
+}
+/** The names of every registered connection. */
+export function connectionNames() {
+    return [...registry.keys()];
 }
-function conn() {
-    if (!connection)
-        throw new Error("No database connection. Call setConnection(conn, dialect).");
-    return connection;
+/** Unregister every connection — a test helper for a clean slate. */
+export function clearConnections() {
+    registry.clear();
+    defaultConnection = "default";
 }
-/** Render `?` placeholders for the active dialect (Postgres uses $1, $2, …). */
-function placeholders(sql) {
+/** Resolve a connection by name (or the default); throws if it isn't registered. */
+function resolve(name) {
+    const source = registry.get(name ?? defaultConnection);
+    if (!source) {
+        throw new Error(`No database connection${name ? ` "${name}"` : ""}. ` +
+            `Call setConnection(conn, dialect) or addConnection(name, conn, dialect).`);
+    }
+    return source;
+}
+/** Render `?` placeholders for a dialect (Postgres uses $1, $2, …). */
+function placeholders(sql, dialect) {
     if (dialect !== "postgres")
         return sql;
     let i = 0;
@@ -30,13 +66,28 @@ function placeholders(sql) {
 }
 export class QueryBuilder {
     table;
+    getSource;
     wheres = [];
     orders = [];
     columns = "*";
     _limit;
     _offset;
-    constructor(table) {
+    // The connection is resolved lazily, when a query actually runs — so building
+    // a query never throws, and an unregistered connection surfaces as a rejected
+    // read/write rather than a synchronous error at construction.
+    constructor(table, getSource) {
         this.table = table;
+        this.getSource = getSource;
+    }
+    /** Run a row-returning query on this builder's connection, dialect-adjusted. */
+    runSelect(sql, bindings) {
+        const source = this.getSource();
+        return source.conn.select(placeholders(sql, source.dialect), bindings);
+    }
+    /** Run a write on this builder's connection, dialect-adjusted. */
+    runWrite(sql, bindings) {
+        const source = this.getSource();
+        return source.conn.write(placeholders(sql, source.dialect), bindings);
     }
     select(...columns) {
         this.columns = columns.length ? columns.join(", ") : "*";
@@ -114,7 +165,7 @@ export class QueryBuilder {
             sql += ` LIMIT ${this._limit}`;
         if (this._offset != null)
             sql += ` OFFSET ${this._offset}`;
-        return (await conn().select(placeholders(sql), where.bindings));
+        return (await this.runSelect(sql, where.bindings));
     }
     async first() {
         this._limit = 1;
@@ -123,7 +174,7 @@ export class QueryBuilder {
     }
     async count() {
         const where = this.whereClause();
-        const rows = (await conn().select(placeholders(`SELECT COUNT(*) AS count FROM ${this.table}${where.sql}`), where.bindings));
+        const rows = (await this.runSelect(`SELECT COUNT(*) AS count FROM ${this.table}${where.sql}`, where.bindings));
         return Number(rows[0]?.count ?? 0);
     }
     async exists() {
@@ -131,7 +182,7 @@ export class QueryBuilder {
     }
     async aggregate(fn, column) {
         const where = this.whereClause();
-        const rows = (await conn().select(placeholders(`SELECT ${fn}(${column}) AS agg FROM ${this.table}${where.sql}`), where.bindings));
+        const rows = (await this.runSelect(`SELECT ${fn}(${column}) AS agg FROM ${this.table}${where.sql}`, where.bindings));
         return Number(rows[0]?.agg ?? 0);
     }
     sum(column) {
@@ -178,7 +229,7 @@ export class QueryBuilder {
         const sql = `INSERT INTO ${this.table} (${keys.join(", ")}) VALUES (${keys
             .map(() => "?")
             .join(", ")})`;
-        return conn().write(placeholders(sql), Object.values(data));
+        return this.runWrite(sql, Object.values(data));
     }
     async insertGetId(data) {
         return (await this.insert(data)).insertId;
@@ -187,17 +238,34 @@ export class QueryBuilder {
         const keys = Object.keys(data);
         const set = keys.map((k) => `${k} = ?`).join(", ");
         const where = this.whereClause();
-        return conn().write(placeholders(`UPDATE ${this.table} SET ${set}${where.sql}`), [
+        return this.runWrite(`UPDATE ${this.table} SET ${set}${where.sql}`, [
             ...Object.values(data),
             ...where.bindings,
         ]);
     }
     async delete() {
         const where = this.whereClause();
-        return conn().write(placeholders(`DELETE FROM ${this.table}${where.sql}`), where.bindings);
+        return this.runWrite(`DELETE FROM ${this.table}${where.sql}`, where.bindings);
     }
 }
-/** Start a query against a table. */
-export function db(table) {
-    return new QueryBuilder(table);
+/** Start a query against a table, on the default connection or a named one. */
+export function db(table, connectionName) {
+    return new QueryBuilder(table, () => resolve(connectionName));
+}
+/**
+ * Get a handle to a named connection (or the default). Use it to run several
+ * queries against one database without repeating the name, or to reach the raw
+ * `select`/`write` bridge.
+ *
+ *   const reporting = connection("reporting");
+ *   await reporting.table("events").where("kind", "signup").count();
+ */
+export function connection(name) {
+    const source = resolve(name);
+    return {
+        table: (t) => new QueryBuilder(t, () => source),
+        select: (sql, bindings = []) => source.conn.select(placeholders(sql, source.dialect), bindings),
+        write: (sql, bindings = []) => source.conn.write(placeholders(sql, source.dialect), bindings),
+        dialect: source.dialect,
+    };
 }

package/dist/core/helpers.d.ts

@@ -38,6 +38,12 @@ export declare function instance<T>(token: Token<T>, value: T): T;
 export declare function make<T>(token: Token<T>): T;
 /** Whether a token is bound or has a cached instance. */
 export declare function bound(token: Token): boolean;
+/** Register an alias token that resolves to another token. */
+export declare function alias<T>(aliasToken: Token<T>, target: Token<T>): void;
+/** Temporarily replace a binding with a fake (tests). Undo with `restore()`. */
+export declare function swap<T>(token: Token<T>, factory: Factory<T>): void;
+/** Undo a `swap()` — restore the original binding. No token restores every swap. */
+export declare function restore(token?: Token): void;
 /** The application's event emitter. */
 export declare function events(): Events;
 /** Emit an event, awaiting every listener. */

package/dist/core/helpers.js

@@ -65,6 +65,18 @@ export function make(token) {
 export function bound(token) {
     return app().bound(token);
 }
+/** Register an alias token that resolves to another token. */
+export function alias(aliasToken, target) {
+    app().alias(aliasToken, target);
+}
+/** Temporarily replace a binding with a fake (tests). Undo with `restore()`. */
+export function swap(token, factory) {
+    app().swap(token, factory);
+}
+/** Undo a `swap()` — restore the original binding. No token restores every swap. */
+export function restore(token) {
+    app().restore(token);
+}
 /* ------------------------------- events -------------------------------- */
 /** The application's event emitter. */
 export function events() {

package/dist/core/index.d.ts

@@ -4,7 +4,7 @@ export type { Token, Constructor, Factory } from "./container.js";
 export { Application } from "./application.js";
 export type { BootOptions, LifecycleHook, Configurator } from "./application.js";
 export { Config, env } from "./config.js";
-export { app, config, view, bind, singleton, instance, make, bound, events, emit, listen, cache, logger, onReady, onShutdown, terminate, } from "./helpers.js";
+export { app, config, view, bind, singleton, instance, make, bound, alias, swap, restore, events, emit, listen, cache, logger, onReady, onShutdown, terminate, } from "./helpers.js";
 export { Logger } from "./logger.js";
 export type { LogLevel, LoggerOptions } from "./logger.js";
 export { requestLogger, requestLog } from "./request-logger.js";
@@ -18,11 +18,18 @@ export type { StaticOptions } from "./static.js";
 export { Storage, MemoryDisk, storage, setDisk } from "./storage.js";
 export type { Disk, Contents } from "./storage.js";
 export { dump, dd } from "./debug.js";
-export { hash, encryption } from "./crypto.js";
+export { hash, encryption, jwt } from "./crypto.js";
+export type { JwtPayload, JwtSignOptions, JwtVerifyOptions, EncryptOptions } from "./crypto.js";
 export { rateLimiter } from "./rate-limit.js";
 export type { RateLimiterOptions } from "./rate-limit.js";
-export { db, setConnection, QueryBuilder } from "./database.js";
-export type { Connection, WriteResult, Row, Dialect, Operator, Paginated } from "./database.js";
+export { cors } from "./cors.js";
+export type { CorsOptions } from "./cors.js";
+export { securityHeaders } from "./shield.js";
+export type { SecurityHeadersOptions, HstsOptions } from "./shield.js";
+export { csrf, csrfToken, csrfField } from "./csrf.js";
+export type { CsrfOptions } from "./csrf.js";
+export { db, connection, setConnection, addConnection, setDefaultConnection, connectionNames, clearConnections, QueryBuilder, } from "./database.js";
+export type { Connection, ConnectionHandle, WriteResult, Row, Dialect, Operator, Paginated } from "./database.js";
 export { Model } from "./model.js";
 export type { CastType, Casts } from "./casts.js";
 export { Relation, HasOne, HasMany, BelongsTo, BelongsToMany } from "./relations.js";
@@ -62,10 +69,14 @@ export { validate, validateRequest, validated } from "./validation.js";
 export type { Schema, RequestSchemas } from "./validation.js";
 export { Session, session, sessionMiddleware } from "./session.js";
 export type { SessionOptions } from "./session.js";
-export { Auth, auth, authGuard, setUserProvider } from "./auth.js";
-export type { UserProvider } from "./auth.js";
-export { define, policy, gateBefore, setUserResolver, clearAuthorization, can, cannot, canFor, authorize, authorizeFor, } from "./authorization.js";
-export type { GateCallback, BeforeCallback } from "./authorization.js";
+export { Auth, auth, authGuard, bearerAuth, basicAuth, tokenAuth, token, tokenCan, setUserProvider } from "./auth.js";
+export type { UserProvider, BasicVerifier } from "./auth.js";
+export { createToken, verifyToken, revokeToken, revokeTokens, listTokens, tokenAllows, tokenDenies, setTokensTable, } from "./tokens.js";
+export type { AccessToken, CreateTokenOptions, IssuedToken } from "./tokens.js";
+export { social, github, google, discord, oauthDriver, oauthState, OAuthDriver, OAuthError, twitter, oauth1Driver, oauth1Signature, OAuth1Driver, } from "./social.js";
+export type { SocialUser, OAuthToken, OAuthConfig, ProviderSpec, RedirectOptions, OAuth1Config, OAuth1Token, OAuth1ProviderSpec, } from "./social.js";
+export { define, policy, gateBefore, gateAfter, setUserResolver, clearAuthorization, can, cannot, canFor, authorize, authorizeFor, } from "./authorization.js";
+export type { GateCallback, BeforeCallback, AfterCallback } from "./authorization.js";
 export { Transformer } from "./transformer.js";
 export type { Attributes, DocumentOptions } from "./transformer.js";
 export { Broker, Service, LocalTransporter, ServiceNotFoundError, RequestTimeoutError, broker, setBroker, } from "./broker.js";