@guren/server 1.0.0-rc.17 → 1.0.0-rc.18

package/dist/auth/index.js

@@ -1,1553 +1,63 @@
-// src/http/middleware/session.ts
-import { getCookie, setCookie, deleteCookie } from "hono/cookie";
-import { createHmac, timingSafeEqual } from "crypto";
-
-// src/encryption/app-key.ts
-import { hkdfSync, randomBytes } from "crypto";
-var APP_KEY_PREFIX = "base64:";
-var APP_KEY_BYTES = 32;
-function decodeAppKey(rawKey, envName) {
-  const trimmed = rawKey.trim();
-  if (!trimmed) {
-    throw new Error(`${envName} is required and must be a base64-encoded 32-byte key.`);
-  }
-  const encoded = trimmed.startsWith(APP_KEY_PREFIX) ? trimmed.slice(APP_KEY_PREFIX.length) : trimmed;
-  const decoded = Buffer.from(encoded, "base64");
-  if (decoded.length !== APP_KEY_BYTES || decoded.toString("base64") !== encoded.replace(/\s+/gu, "")) {
-    throw new Error(`${envName} must be a base64-encoded 32-byte key.`);
-  }
-  return decoded;
-}
-function parseAppKey(rawKey, envName = "APP_KEY") {
-  return decodeAppKey(rawKey, envName);
-}
-function parsePreviousAppKeys(rawKeys, envName = "APP_PREVIOUS_KEYS") {
-  if (!rawKeys) {
-    return [];
-  }
-  return rawKeys.split(",").map((value) => value.trim()).filter(Boolean).map((value, index) => decodeAppKey(value, `${envName}[${index}]`));
-}
-function getAppKeyringFromEnv(env = process.env) {
-  return {
-    current: parseAppKey(env.APP_KEY ?? "", "APP_KEY"),
-    previous: parsePreviousAppKeys(env.APP_PREVIOUS_KEYS)
-  };
-}
-function deriveAppKey(rootKey, purpose) {
-  return Buffer.from(
-    hkdfSync("sha256", rootKey, Buffer.alloc(0), Buffer.from(`guren:${purpose}`, "utf8"), APP_KEY_BYTES)
-  );
-}
-function deriveAppKeyring(keyring, purpose) {
-  return {
-    current: deriveAppKey(keyring.current, purpose),
-    previous: keyring.previous.map((key) => deriveAppKey(key, purpose))
-  };
-}
-
-// src/http/middleware/session.ts
-var DEFAULT_TTL_SECONDS = 60 * 60 * 2;
-var DEFAULT_COOKIE_SECURE = typeof process !== "undefined" ? process.env.NODE_ENV === "production" : true;
-var SESSION_CONTEXT_KEY = "guren:session";
-function getSessionFromContext(ctx) {
-  return ctx.get(SESSION_CONTEXT_KEY);
-}
-
-// src/errors/HttpException.ts
-var HttpException = class _HttpException extends Error {
-  /**
-   * HTTP status code.
-   */
-  statusCode;
-  /**
-   * Validation or field-specific errors.
-   */
-  errors;
-  /**
-   * Additional error data.
-   */
-  data;
-  constructor(statusCode, message, errors, data) {
-    super(message);
-    this.name = this.constructor.name;
-    this.statusCode = statusCode;
-    this.errors = errors;
-    this.data = data;
-    if (Error.captureStackTrace) {
-      Error.captureStackTrace(this, this.constructor);
-    }
-  }
-  /**
-   * Convert to response format.
-   */
-  toResponse(debug = false) {
-    const body = {
-      message: this.message
-    };
-    if (this.errors) {
-      body.errors = this.errors;
-    }
-    if (debug) {
-      body.exception = this.name;
-      body.stack = this.stack;
-    }
-    return {
-      status: this.statusCode,
-      body
-    };
-  }
-  /**
-   * Convert to JSON.
-   */
-  toJSON() {
-    return {
-      name: this.name,
-      message: this.message,
-      statusCode: this.statusCode,
-      errors: this.errors,
-      data: this.data
-    };
-  }
-  // Factory methods
-  /**
-   * Create a 400 Bad Request exception.
-   */
-  static badRequest(message = "Bad Request") {
-    return new _HttpException(400, message);
-  }
-  /**
-   * Create a 401 Unauthorized exception.
-   */
-  static unauthorized(message = "Unauthorized") {
-    return new _HttpException(401, message);
-  }
-  /**
-   * Create a 403 Forbidden exception.
-   */
-  static forbidden(message = "Forbidden") {
-    return new _HttpException(403, message);
-  }
-  /**
-   * Create a 404 Not Found exception.
-   */
-  static notFound(message = "Not Found") {
-    return new _HttpException(404, message);
-  }
-  /**
-   * Create a 405 Method Not Allowed exception.
-   */
-  static methodNotAllowed(message = "Method Not Allowed") {
-    return new _HttpException(405, message);
-  }
-  /**
-   * Create a 409 Conflict exception.
-   */
-  static conflict(message = "Conflict") {
-    return new _HttpException(409, message);
-  }
-  /**
-   * Create a 410 Gone exception.
-   */
-  static gone(message = "Gone") {
-    return new _HttpException(410, message);
-  }
-  /**
-   * Create a 422 Unprocessable Entity exception.
-   */
-  static unprocessable(message = "Unprocessable Entity", errors) {
-    return new _HttpException(422, message, errors);
-  }
-  /**
-   * Create a 429 Too Many Requests exception.
-   */
-  static tooManyRequests(message = "Too Many Requests") {
-    return new _HttpException(429, message);
-  }
-  /**
-   * Create a 500 Internal Server Error exception.
-   */
-  static internal(message = "Internal Server Error") {
-    return new _HttpException(500, message);
-  }
-  /**
-   * Create a 501 Not Implemented exception.
-   */
-  static notImplemented(message = "Not Implemented") {
-    return new _HttpException(501, message);
-  }
-  /**
-   * Create a 502 Bad Gateway exception.
-   */
-  static badGateway(message = "Bad Gateway") {
-    return new _HttpException(502, message);
-  }
-  /**
-   * Create a 503 Service Unavailable exception.
-   */
-  static serviceUnavailable(message = "Service Unavailable") {
-    return new _HttpException(503, message);
-  }
-  /**
-   * Create a 504 Gateway Timeout exception.
-   */
-  static gatewayTimeout(message = "Gateway Timeout") {
-    return new _HttpException(504, message);
-  }
-  /**
-   * Check if an error is an HTTP exception.
-   */
-  static isHttpException(error) {
-    return error instanceof _HttpException || typeof error === "object" && error !== null && "statusCode" in error && typeof error.statusCode === "number" && "toResponse" in error && typeof error.toResponse === "function";
-  }
-};
-
-// src/errors/exceptions/AuthenticationException.ts
-var AuthenticationException = class _AuthenticationException extends HttpException {
-  /**
-   * The guard that threw the exception.
-   */
-  guard;
-  /**
-   * URL to redirect to for authentication.
-   */
-  redirectTo;
-  constructor(message = "Unauthenticated.", guard, redirectTo) {
-    super(401, message);
-    this.name = "AuthenticationException";
-    this.guard = guard;
-    this.redirectTo = redirectTo;
-  }
-  /**
-   * Create exception with redirect URL.
-   */
-  static withRedirect(redirectTo, message) {
-    return new _AuthenticationException(message, void 0, redirectTo);
-  }
-  /**
-   * Create exception for a specific guard.
-   */
-  static forGuard(guard, message) {
-    return new _AuthenticationException(message, guard);
-  }
-};
-
-// src/auth/RequestAuthContext.ts
-var RequestAuthContext = class {
-  constructor(manager, ctx, currentSession, resolveGuard) {
-    this.manager = manager;
-    this.ctx = ctx;
-    this.currentSession = currentSession;
-    this.resolveGuard = resolveGuard;
-  }
-  guardCache = /* @__PURE__ */ new Map();
-  guard(name) {
-    const key = name ?? this.manager.getDefaultGuard();
-    if (!this.guardCache.has(key)) {
-      const guard = this.resolveGuard(name);
-      this.guardCache.set(key, guard);
-    }
-    return this.guardCache.get(key);
-  }
-  session() {
-    return this.currentSession;
-  }
-  async check() {
-    return this.guard().check();
-  }
-  async guest() {
-    return this.guard().guest();
-  }
-  async user() {
-    return this.guard().user();
-  }
-  async userOrFail() {
-    const u = await this.user();
-    if (!u) throw new AuthenticationException();
-    return u;
-  }
-  async id() {
-    return this.guard().id();
-  }
-  async login(user, remember) {
-    await this.guard().login(user, remember);
-  }
-  async attempt(credentials, remember) {
-    return this.guard().attempt(credentials, remember);
-  }
-  async logout() {
-    await this.guard().logout();
-  }
-};
-
-// src/auth/password/ScryptHasher.ts
-var ScryptHasher = class {
-  algorithm;
-  memoryCost;
-  timeCost;
-  cost;
-  constructor(options = {}) {
-    this.algorithm = options.algorithm ?? "argon2id";
-    this.memoryCost = options.memoryCost;
-    this.timeCost = options.timeCost;
-    this.cost = options.cost;
-  }
-  async hash(plain) {
-    if (this.algorithm === "bcrypt") {
-      return Bun.password.hash(plain, {
-        algorithm: "bcrypt",
-        cost: this.cost
-      });
-    }
-    return Bun.password.hash(plain, {
-      algorithm: this.algorithm,
-      memoryCost: this.memoryCost,
-      timeCost: this.timeCost
-    });
-  }
-  async verify(hashed, plain) {
-    return Bun.password.verify(plain, hashed);
-  }
-  needsRehash(hashed) {
-    if (this.algorithm === "bcrypt") {
-      if (!hashed.startsWith("$2")) {
-        return true;
-      }
-      if (this.cost != null) {
-        const costSegment = hashed.slice(4, 6);
-        const parsedCost = Number.parseInt(costSegment, 10);
-        if (!Number.isNaN(parsedCost) && parsedCost !== this.cost) {
-          return true;
-        }
-      }
-      return false;
-    }
-    if (!hashed.startsWith(`$${this.algorithm}$`)) {
-      return true;
-    }
-    const [, , , parameterSegment] = hashed.split("$");
-    if (!parameterSegment) {
-      return false;
-    }
-    const params = Object.fromEntries(
-      parameterSegment.split(",").map((pair) => pair.split("=")).filter((parts) => parts.length === 2)
-    );
-    if (this.memoryCost != null) {
-      const memory = Number(params.m);
-      if (!Number.isNaN(memory) && memory !== this.memoryCost) {
-        return true;
-      }
-    }
-    if (this.timeCost != null) {
-      const time = Number(params.t);
-      if (!Number.isNaN(time) && time !== this.timeCost) {
-        return true;
-      }
-    }
-    return false;
-  }
-};
-
-// src/auth/providers/UserProvider.ts
-var BaseUserProvider = class {
-  async setRememberToken(user, token) {
-    if (typeof user.setRememberToken === "function") {
-      await user.setRememberToken(token);
-    }
-  }
-  async getRememberToken(user) {
-    if (typeof user.getRememberToken === "function") {
-      return await user.getRememberToken() ?? null;
-    }
-    return null;
-  }
-};
-
-// src/auth/providers/ModelUserProvider.ts
-var ModelUserProvider = class extends BaseUserProvider {
-  constructor(model, options = {}) {
-    super();
-    this.model = model;
-    this.idColumn = options.idColumn ?? "id";
-    this.usernameColumn = options.usernameColumn ?? "email";
-    this.passwordColumn = options.passwordColumn ?? "password";
-    this.rememberTokenColumn = options.rememberTokenColumn ?? "remember_token";
-    this.hasher = options.hasher ?? new ScryptHasher();
-    this.credentialsPasswordField = options.credentialsPasswordField ?? "password";
-  }
-  idColumn;
-  usernameColumn;
-  passwordColumn;
-  rememberTokenColumn;
-  hasher;
-  credentialsPasswordField;
-  cast(record) {
-    if (record && typeof record === "object") {
-      return record;
-    }
-    return null;
-  }
-  async retrieveById(identifier) {
-    const record = await this.model.find(identifier, this.idColumn);
-    return this.cast(record);
-  }
-  async retrieveByCredentials(credentials) {
-    const rememberToken = credentials["rememberToken"] ?? credentials["remember_token"];
-    if (rememberToken != null) {
-      const records2 = await this.model.where({ [this.rememberTokenColumn]: rememberToken });
-      return this.cast(records2[0] ?? null);
-    }
-    const username = credentials[this.usernameColumn];
-    if (username == null) {
-      return null;
-    }
-    const records = await this.model.where({ [this.usernameColumn]: username });
-    return this.cast(records[0] ?? null);
-  }
-  async validateCredentials(user, credentials) {
-    const plain = credentials[this.credentialsPasswordField];
-    if (typeof plain !== "string") {
-      return false;
-    }
-    const hashed = user[this.passwordColumn];
-    if (typeof hashed !== "string") {
-      await this.hasher.hash("dummy-timing-equalization");
-      return false;
-    }
-    return this.hasher.verify(hashed, plain);
-  }
-  getId(user) {
-    return user[this.idColumn];
-  }
-  async setRememberToken(user, token) {
-    if (typeof user[this.rememberTokenColumn] !== "undefined") {
-      ;
-      user[this.rememberTokenColumn] = token;
-      await this.model.update({ [this.idColumn]: this.getId(user) }, { [this.rememberTokenColumn]: token });
-    }
-  }
-  async getRememberToken(user) {
-    const token = user[this.rememberTokenColumn];
-    if (token == null) {
-      return null;
-    }
-    return String(token);
-  }
-};
-
-// src/auth/utils.ts
-import { randomBytes as randomBytes2, createHash, timingSafeEqual as timingSafeEqual2 } from "crypto";
-function hashToken(token, algorithm = "sha256") {
-  return createHash(algorithm).update(token).digest("hex");
-}
-function generateToken(length = 32) {
-  return randomBytes2(length).toString("hex");
-}
-function generateId() {
-  return randomBytes2(16).toString("hex");
-}
-function secureCompare(a, b) {
-  if (a.length !== b.length) return false;
-  try {
-    return timingSafeEqual2(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
-  } catch {
-    return false;
-  }
-}
-function secureStringCompare(a, b) {
-  const bufA = Buffer.from(a, "utf8");
-  const bufB = Buffer.from(b, "utf8");
-  if (bufA.length !== bufB.length) return false;
-  return timingSafeEqual2(bufA, bufB);
-}
-function buildTokenUrl(baseUrl, token, email) {
-  const url = new URL(baseUrl);
-  url.searchParams.set("token", token);
-  if (email) {
-    url.searchParams.set("email", email);
-  }
-  return url.toString();
-}
-function parseTokenUrl(url) {
-  try {
-    const parsed = new URL(url);
-    return {
-      token: parsed.searchParams.get("token"),
-      email: parsed.searchParams.get("email")
-    };
-  } catch {
-    return { token: null, email: null };
-  }
-}
-
-// src/auth/SessionGuard.ts
-var DEFAULT_SESSION_KEY = "auth:user_id";
-var DEFAULT_REMEMBER_KEY = "auth:remember_token";
-var SessionGuard = class {
-  constructor(options) {
-    this.options = options;
-  }
-  cachedUser;
-  get currentSession() {
-    return this.options.session;
-  }
-  get provider() {
-    return this.options.provider;
-  }
-  sessionKey() {
-    return this.options.sessionKey ?? DEFAULT_SESSION_KEY;
-  }
-  rememberSessionKey() {
-    return this.options.rememberSessionKey ?? DEFAULT_REMEMBER_KEY;
-  }
-  async loadRememberedUser() {
-    if (!this.currentSession || !this.provider.getRememberToken) {
-      return null;
-    }
-    const rememberToken = this.currentSession.get(this.rememberSessionKey());
-    if (!rememberToken) {
-      return null;
-    }
-    const user = await this.provider.retrieveByCredentials({ rememberToken });
-    if (!user) {
-      this.currentSession.forget(this.rememberSessionKey());
-      return null;
-    }
-    const providerToken = await this.provider.getRememberToken?.(user);
-    if (!providerToken || !secureStringCompare(providerToken, rememberToken)) {
-      this.currentSession.forget(this.rememberSessionKey());
-      return null;
-    }
-    this.cachedUser = user;
-    await this.provider.setRememberToken?.(user, rememberToken);
-    return user;
-  }
-  async resolveUser() {
-    if (this.cachedUser !== void 0) {
-      return this.cachedUser;
-    }
-    const session = this.currentSession;
-    if (!session) {
-      this.cachedUser = null;
-      return null;
-    }
-    const identifier = session.get(this.sessionKey());
-    if (identifier == null) {
-      const remembered = await this.loadRememberedUser();
-      this.cachedUser = remembered;
-      return remembered;
-    }
-    const user = await this.provider.retrieveById(identifier);
-    if (!user) {
-      session.forget(this.sessionKey());
-      this.cachedUser = null;
-      return null;
-    }
-    this.cachedUser = user;
-    return user;
-  }
-  async check() {
-    return await this.resolveUser() !== null;
-  }
-  async guest() {
-    return !await this.check();
-  }
-  async user() {
-    const user = await this.resolveUser();
-    return user ?? null;
-  }
-  async id() {
-    const session = this.currentSession;
-    if (!session) {
-      return null;
-    }
-    return session.get(this.sessionKey()) ?? null;
-  }
-  async remember(user) {
-    if (!this.currentSession || !this.provider.setRememberToken) {
-      return;
-    }
-    const token = generateToken(32);
-    await this.provider.setRememberToken?.(user, token);
-    this.currentSession.set(this.rememberSessionKey(), token);
-  }
-  async login(user, remember = false) {
-    const castUser = user;
-    const session = this.currentSession;
-    if (!session) {
-      throw new Error("SessionGuard: session middleware is required to use the session guard.");
-    }
-    session.regenerate();
-    const identifier = this.provider.getId(castUser);
-    session.set(this.sessionKey(), identifier);
-    this.cachedUser = castUser;
-    if (remember) {
-      await this.remember(castUser);
-    } else {
-      session.forget(this.rememberSessionKey());
-    }
-  }
-  async logout() {
-    const session = this.currentSession;
-    if (!session) {
-      return;
-    }
-    session.forget(this.sessionKey());
-    session.forget(this.rememberSessionKey());
-    this.cachedUser = null;
-  }
-  async attempt(credentials, remember = false) {
-    const user = await this.validate(credentials);
-    if (!user) {
-      return false;
-    }
-    await this.login(user, remember);
-    return true;
-  }
-  async validate(credentials) {
-    const user = await this.provider.retrieveByCredentials(credentials);
-    if (!user) {
-      await new Promise((resolve) => setTimeout(resolve, 100));
-      return null;
-    }
-    const valid = await this.provider.validateCredentials(user, credentials);
-    if (!valid) {
-      return null;
-    }
-    return user;
-  }
-  session() {
-    return this.currentSession;
-  }
-};
-
-// src/auth/AuthManager.ts
-var DEFAULT_GUARD = "web";
-var AuthManager = class {
-  guards = /* @__PURE__ */ new Map();
-  providers = /* @__PURE__ */ new Map();
-  defaultGuard;
-  constructor(options = {}) {
-    this.defaultGuard = options.defaultGuard ?? DEFAULT_GUARD;
-  }
-  registerGuard(name, factory) {
-    this.guards.set(name, { factory });
-  }
-  registerProvider(name, factory) {
-    this.providers.set(name, { factory });
-  }
-  getProvider(name) {
-    const entry = this.providers.get(name);
-    if (!entry) {
-      throw new Error(`AuthManager: provider "${name}" has not been registered.`);
-    }
-    if (!entry.instance) {
-      const instance = entry.factory(this);
-      entry.instance = instance;
-      this.providers.set(name, entry);
-    }
-    return entry.instance;
-  }
-  createGuard(name, context) {
-    const entry = this.guards.get(name);
-    if (!entry) {
-      throw new Error(`AuthManager: guard "${name}" has not been registered.`);
-    }
-    return entry.factory(context);
-  }
-  guardNames() {
-    return Array.from(this.guards.keys());
-  }
-  setDefaultGuard(name) {
-    if (!this.guards.has(name)) {
-      throw new Error(`AuthManager: cannot set default guard to unregistered guard "${name}".`);
-    }
-    this.defaultGuard = name;
-  }
-  getDefaultGuard() {
-    return this.defaultGuard;
-  }
-  createAuthContext(ctx, options = {}) {
-    const guardName = options.guard ?? this.defaultGuard;
-    const session = getSessionFromContext(ctx);
-    const guardFactory = (name) => {
-      const targetName = name ?? guardName;
-      return this.createGuard(targetName, {
-        ctx,
-        session,
-        manager: this
-      });
-    };
-    return new RequestAuthContext(this, ctx, session, guardFactory);
-  }
-  async attempt(name, ctx, credentials, remember) {
-    const guard = this.createAuthContext(ctx, { guard: name }).guard(name);
-    return guard.attempt(credentials, remember);
-  }
-  /**
-   * Shorthand method to register a model-based authentication provider and session guard.
-   * This simplifies the common case of authenticating users via a database model.
-   *
-   * @param model - The model class to use for user authentication
-   * @param options - Options for the ModelUserProvider (partial, with defaults)
-   * @param providerName - Name for the provider (defaults to 'users')
-   * @param guardName - Name for the guard (defaults to 'web')
-   */
-  useModel(model, options = {}, providerName = "users", guardName = "web") {
-    const defaultOptions = {
-      usernameColumn: "email",
-      passwordColumn: "passwordHash",
-      rememberTokenColumn: "rememberToken",
-      credentialsPasswordField: "password",
-      hasher: new ScryptHasher(),
-      ...options
-    };
-    this.registerProvider(providerName, () => new ModelUserProvider(model, defaultOptions));
-    this.registerGuard(guardName, ({ session, manager }) => {
-      const provider = manager.getProvider(providerName);
-      return new SessionGuard({ provider, session });
-    });
-    this.setDefaultGuard(guardName);
-  }
-};
-
-// src/encryption/Hash.ts
 import {
-  createHash as createHash2,
-  createHmac as createHmac2,
-  randomBytes as randomBytes3,
-  scrypt,
-  timingSafeEqual as timingSafeEqual3
-} from "crypto";
-import { promisify } from "util";
-var scryptAsync = promisify(scrypt);
-async function hashPassword(password, options = {}) {
-  const {
-    cost = 16384,
-    // N
-    memory = 8,
-    // r (block size)
-    saltLength = 16,
-    keyLength = 64
-  } = options;
-  const salt = randomBytes3(saltLength);
-  const derived = await scryptAsync(password, salt, keyLength, {
-    N: cost,
-    r: memory,
-    p: 1
-  });
-  const params = `N=${cost},r=${memory},p=1`;
-  return `$scrypt$${params}$${salt.toString("base64")}$${derived.toString("base64")}`;
-}
-async function verifyPassword(password, hash) {
-  if (!hash.startsWith("$scrypt$")) {
-    throw new Error("Invalid password hash format.");
-  }
-  const parts = hash.split("$");
-  if (parts.length !== 5) {
-    throw new Error("Invalid password hash format.");
-  }
-  const [, , paramsStr, saltB64, hashB64] = parts;
-  const params = {};
-  for (const param of paramsStr.split(",")) {
-    const [key, value] = param.split("=");
-    params[key] = parseInt(value, 10);
-  }
-  const salt = Buffer.from(saltB64, "base64");
-  const expectedHash = Buffer.from(hashB64, "base64");
-  const derived = await scryptAsync(password, salt, expectedHash.length, {
-    N: params.N,
-    r: params.r,
-    p: params.p ?? 1
-  });
-  return timingSafeEqual3(derived, expectedHash);
-}
-function needsRehash(hash, options = {}) {
-  const { cost = 16384, memory = 8 } = options;
-  if (!hash.startsWith("$scrypt$")) {
-    return true;
-  }
-  const parts = hash.split("$");
-  if (parts.length !== 5) {
-    return true;
-  }
-  const paramsStr = parts[2];
-  const params = {};
-  for (const param of paramsStr.split(",")) {
-    const [key, value] = param.split("=");
-    params[key] = parseInt(value, 10);
-  }
-  return params.N !== cost || params.r !== memory;
-}
-
-// src/auth/password/NodeHasher.ts
-var NodeHasher = class {
-  options;
-  constructor(options = {}) {
-    this.options = {
-      cost: options.cost,
-      memory: options.memory,
-      saltLength: options.saltLength,
-      keyLength: options.keyLength
-    };
-  }
-  async hash(plain) {
-    return hashPassword(plain, this.options);
-  }
-  async verify(hashed, plain) {
-    return verifyPassword(plain, hashed);
-  }
-  needsRehash(hashed) {
-    return needsRehash(hashed, this.options);
-  }
-};
-
-// src/auth/AuthenticatableModel.ts
-import { Model } from "@guren/orm";
-var AuthenticatableModel = class extends Model {
-  static createType = void 0;
-  static passwordField = "password";
-  static passwordHashField = "passwordHash";
-  static passwordHasher = null;
-  static resolvePasswordField() {
-    return this.passwordField ?? "password";
-  }
-  static resolvePasswordHashField() {
-    return this.passwordHashField ?? "passwordHash";
-  }
-  static resolvePasswordHasher() {
-    if (this.passwordHasher) {
-      return this.passwordHasher;
-    }
-    const hasher = new ScryptHasher();
-    this.passwordHasher = hasher;
-    return hasher;
-  }
-  static async preparePersistencePayload(data) {
-    const basePayload = await super.preparePersistencePayload(data);
-    const passwordField = this.resolvePasswordField();
-    if (!(passwordField in basePayload)) {
-      return basePayload;
-    }
-    const payload = { ...basePayload };
-    const plainPassword = payload[passwordField];
-    const hashField = this.resolvePasswordHashField();
-    if (typeof plainPassword === "string" && plainPassword.length > 0) {
-      const hasher = this.resolvePasswordHasher();
-      payload[hashField] = await hasher.hash(plainPassword);
-    }
-    if (passwordField !== hashField) {
-      delete payload[passwordField];
-    }
-    return payload;
-  }
-};
-
-// src/encryption/MessageSigner.ts
-import { createHmac as createHmac3, timingSafeEqual as timingSafeEqual4 } from "crypto";
-function encodeBase64Url(value) {
-  return Buffer.from(value).toString("base64url");
-}
-function decodeBase64Url(value) {
-  return Buffer.from(value, "base64url").toString("utf8");
-}
-function createSignature(input, key) {
-  return encodeBase64Url(createHmac3("sha256", key).update(input).digest());
-}
-function signaturesMatch(actual, expected) {
-  const actualBuffer = Buffer.from(actual, "utf8");
-  const expectedBuffer = Buffer.from(expected, "utf8");
-  if (actualBuffer.length !== expectedBuffer.length) {
-    return false;
-  }
-  return timingSafeEqual4(actualBuffer, expectedBuffer);
-}
-var MessageSigner = class {
-  constructor(keyring) {
-    this.keyring = keyring;
-  }
-  sign(payload, options = {}) {
-    const now = Date.now();
-    const claims = {
-      ...payload,
-      iat: Math.floor(now / 1e3),
-      ...options.purpose ? { purpose: options.purpose } : {},
-      ...typeof options.expiresIn === "number" ? { exp: Math.floor((now + options.expiresIn) / 1e3) } : {}
-    };
-    const encodedPayload = encodeBase64Url(JSON.stringify(claims));
-    const signature = createSignature(encodedPayload, this.keyring.current);
-    return `${encodedPayload}.${signature}`;
-  }
-  verify(token, options = {}) {
-    const [encodedPayload, signature, extra] = token.split(".");
-    if (!encodedPayload || !signature || extra) {
-      return null;
-    }
-    const verified = [this.keyring.current, ...this.keyring.previous].some(
-      (key) => signaturesMatch(signature, createSignature(encodedPayload, key))
-    );
-    if (!verified) {
-      return null;
-    }
-    let payload;
-    try {
-      payload = JSON.parse(decodeBase64Url(encodedPayload));
-    } catch {
-      return null;
-    }
-    if (options.purpose && payload.purpose !== options.purpose) {
-      return null;
-    }
-    if (typeof payload.exp === "number" && Math.floor(Date.now() / 1e3) > payload.exp && options.allowExpired !== true) {
-      return null;
-    }
-    return payload;
-  }
-};
-
-// src/auth/password-reset.ts
-var MemoryPasswordResetStore = class {
-  tokens = /* @__PURE__ */ new Map();
-  async store(tokenId, email, expiresAt) {
-    this.tokens.set(tokenId, { email, expiresAt });
-  }
-  async find(tokenId) {
-    const record = this.tokens.get(tokenId);
-    if (!record) return null;
-    if (record.expiresAt < /* @__PURE__ */ new Date()) {
-      this.tokens.delete(tokenId);
-      return null;
-    }
-    return record;
-  }
-  async delete(tokenId) {
-    this.tokens.delete(tokenId);
-  }
-  async deleteForEmail(email) {
-    for (const [hash, record] of this.tokens) {
-      if (record.email === email) {
-        this.tokens.delete(hash);
-      }
-    }
-  }
-  /** Clear all tokens (useful for testing) */
-  clear() {
-    this.tokens.clear();
-  }
-};
-var DEFAULT_EXPIRES_IN = 60 * 60 * 1e3;
-var DEFAULT_TOKEN_LENGTH = 32;
-var PASSWORD_RESET_PURPOSE = "password-reset";
-function createPasswordResetSigner() {
-  return new MessageSigner(deriveAppKeyring(getAppKeyringFromEnv(), "password-reset-signing"));
-}
-async function createPasswordResetToken(email, store, config = {}) {
-  const expiresIn = config.expiresIn ?? DEFAULT_EXPIRES_IN;
-  const tokenLength = config.tokenLength ?? DEFAULT_TOKEN_LENGTH;
-  await store.deleteForEmail(email);
-  const tokenId = generateId();
-  const expiresAt = new Date(Date.now() + expiresIn);
-  const signer = createPasswordResetSigner();
-  const token = signer.sign(
-    {
-      id: tokenId,
-      email: email.toLowerCase(),
-      bytes: tokenLength
-    },
-    {
-      purpose: PASSWORD_RESET_PURPOSE,
-      expiresIn
-    }
-  );
-  await store.store(tokenId, email.toLowerCase(), expiresAt);
-  return { token, tokenId, expiresAt };
-}
-async function verifyPasswordResetToken(token, store, _config = {}) {
-  const signer = createPasswordResetSigner();
-  const payload = signer.verify(token, {
-    purpose: PASSWORD_RESET_PURPOSE,
-    allowExpired: true
-  });
-  if (!payload?.id || !payload.email) {
-    return null;
-  }
-  if (typeof payload.exp === "number" && payload.exp < Math.floor(Date.now() / 1e3)) {
-    await store.delete(payload.id);
-    return null;
-  }
-  const record = await store.find(payload.id);
-  if (!record) return null;
-  return record.email.toLowerCase() === payload.email.toLowerCase() ? record.email : null;
-}
-async function completePasswordReset(token, newPassword, store, provider, updatePassword, _config = {}) {
-  const signer = createPasswordResetSigner();
-  const payload = signer.verify(token, {
-    purpose: PASSWORD_RESET_PURPOSE,
-    allowExpired: true
-  });
-  if (!payload?.id || !payload.email) {
-    return null;
-  }
-  if (typeof payload.exp === "number" && payload.exp < Math.floor(Date.now() / 1e3)) {
-    await store.delete(payload.id);
-    return null;
-  }
-  const record = await store.find(payload.id);
-  if (!record) return null;
-  if (record.email.toLowerCase() !== payload.email.toLowerCase()) {
-    return null;
-  }
-  const user = await provider.retrieveByCredentials({ email: record.email });
-  if (!user) {
-    await store.delete(payload.id);
-    return null;
-  }
-  await updatePassword(user, newPassword);
-  await store.delete(payload.id);
-  return user;
-}
-var buildPasswordResetUrl = buildTokenUrl;
-var parsePasswordResetUrl = parseTokenUrl;
-
-// src/auth/email-verification.ts
-var MemoryEmailVerificationStore = class {
-  tokens = /* @__PURE__ */ new Map();
-  async store(token) {
-    this.tokens.set(token.tokenId, token);
-  }
-  async findByTokenId(tokenId) {
-    return this.tokens.get(tokenId) ?? null;
-  }
-  async delete(tokenId) {
-    this.tokens.delete(tokenId);
-  }
-  async deleteForEmail(email) {
-    const normalizedEmail = email.toLowerCase();
-    for (const [key, token] of this.tokens.entries()) {
-      if (token.email.toLowerCase() === normalizedEmail) {
-        this.tokens.delete(key);
-      }
-    }
-  }
-  /**
-   * Clear all tokens (useful for testing).
-   */
-  clear() {
-    this.tokens.clear();
-  }
-  /**
-   * Get the count of stored tokens (useful for testing).
-   */
-  get size() {
-    return this.tokens.size;
-  }
-};
-var DEFAULT_CONFIG = {
-  expiresIn: 24 * 60 * 60 * 1e3,
-  // 24 hours
-  tokenLength: 32
-};
-var EMAIL_VERIFICATION_PURPOSE = "email-verification";
-function createEmailVerificationSigner() {
-  return new MessageSigner(deriveAppKeyring(getAppKeyringFromEnv(), "email-verification-signing"));
-}
-async function createEmailVerificationToken(email, store, config = {}) {
-  const { expiresIn, tokenLength } = { ...DEFAULT_CONFIG, ...config };
-  await store.deleteForEmail(email);
-  const tokenId = generateId();
-  const now = /* @__PURE__ */ new Date();
-  const expiresAt = new Date(now.getTime() + expiresIn);
-  const signer = createEmailVerificationSigner();
-  const token = signer.sign(
-    {
-      id: tokenId,
-      email: email.toLowerCase(),
-      bytes: tokenLength
-    },
-    {
-      purpose: EMAIL_VERIFICATION_PURPOSE,
-      expiresIn
-    }
-  );
-  await store.store({
-    email: email.toLowerCase(),
-    tokenId,
-    expiresAt,
-    createdAt: now
-  });
-  return { token, expiresAt };
-}
-async function verifyEmailToken(token, store, _config = {}) {
-  const signer = createEmailVerificationSigner();
-  const payload = signer.verify(token, {
-    purpose: EMAIL_VERIFICATION_PURPOSE,
-    allowExpired: true
-  });
-  if (!payload?.id || !payload.email) {
-    return null;
-  }
-  if (typeof payload.exp === "number" && payload.exp < Math.floor(Date.now() / 1e3)) {
-    await store.delete(payload.id);
-    return null;
-  }
-  const storedToken = await store.findByTokenId(payload.id);
-  if (!storedToken) {
-    return null;
-  }
-  if (/* @__PURE__ */ new Date() > storedToken.expiresAt) {
-    await store.delete(payload.id);
-    return null;
-  }
-  return storedToken.email.toLowerCase() === payload.email.toLowerCase() ? storedToken.email : null;
-}
-async function completeEmailVerification(token, store, markVerified) {
-  const signer = createEmailVerificationSigner();
-  const payload = signer.verify(token, {
-    purpose: EMAIL_VERIFICATION_PURPOSE,
-    allowExpired: true
-  });
-  if (!payload?.id || !payload.email) {
-    return null;
-  }
-  if (typeof payload.exp === "number" && payload.exp < Math.floor(Date.now() / 1e3)) {
-    await store.delete(payload.id);
-    return null;
-  }
-  const storedToken = await store.findByTokenId(payload.id);
-  if (!storedToken) {
-    return null;
-  }
-  if (/* @__PURE__ */ new Date() > storedToken.expiresAt) {
-    await store.delete(payload.id);
-    return null;
-  }
-  if (storedToken.email.toLowerCase() !== payload.email.toLowerCase()) {
-    return null;
-  }
-  const result = await markVerified(storedToken.email);
-  await store.delete(payload.id);
-  return result;
-}
-var buildVerificationUrl = buildTokenUrl;
-var parseVerificationUrl = parseTokenUrl;
-function isEmailVerified(user) {
-  return user?.emailVerifiedAt != null;
-}
-function requireVerifiedEmail(options = {}) {
-  const { redirectTo = "/verify-email" } = options;
-  return async (ctx, next) => {
-    const getUser = options.getUser ?? (async (c) => {
-      const auth = c.get("guren:auth");
-      return auth?.user?.() ?? null;
-    });
-    const user = await getUser(ctx);
-    if (!isEmailVerified(user)) {
-      return ctx.redirect(redirectTo);
-    }
-    await next();
-  };
-}
-
-// src/auth/api-token.ts
-var MemoryApiTokenStore = class {
-  tokens = /* @__PURE__ */ new Map();
-  byHash = /* @__PURE__ */ new Map();
-  // hash -> id
-  async store(token) {
-    this.tokens.set(token.id, token);
-    this.byHash.set(token.hashedToken, token.id);
-  }
-  async findByHashedToken(hashedToken) {
-    const id = this.byHash.get(hashedToken);
-    if (!id) return null;
-    return this.tokens.get(id) ?? null;
-  }
-  async findByUserId(userId) {
-    const userIdStr = String(userId);
-    return Array.from(this.tokens.values()).filter(
-      (t) => String(t.userId) === userIdStr
-    );
-  }
-  async delete(id) {
-    const token = this.tokens.get(id);
-    if (token) {
-      this.byHash.delete(token.hashedToken);
-      this.tokens.delete(id);
-    }
-  }
-  async deleteForUser(userId) {
-    const userIdStr = String(userId);
-    for (const [id, token] of this.tokens.entries()) {
-      if (String(token.userId) === userIdStr) {
-        this.byHash.delete(token.hashedToken);
-        this.tokens.delete(id);
-      }
-    }
-  }
-  async updateLastUsed(id, timestamp) {
-    const token = this.tokens.get(id);
-    if (token) {
-      token.lastUsedAt = timestamp;
-    }
-  }
-  /**
-   * Clear all tokens (useful for testing).
-   */
-  clear() {
-    this.tokens.clear();
-    this.byHash.clear();
-  }
-  /**
-   * Get the number of stored tokens.
-   */
-  get size() {
-    return this.tokens.size;
-  }
-};
-async function createApiToken(store, options) {
-  const {
-    name,
-    userId,
-    abilities = ["*"],
-    expiresIn = null,
-    tokenLength = 32
-  } = options;
-  const id = generateId();
-  const plainToken = generateToken(tokenLength);
-  const hashedToken = hashToken(plainToken);
-  const now = /* @__PURE__ */ new Date();
-  const token = {
-    id,
-    name,
-    hashedToken,
-    userId,
-    abilities,
-    lastUsedAt: null,
-    expiresAt: expiresIn == null ? null : new Date(now.getTime() + expiresIn),
-    createdAt: now
-  };
-  await store.store(token);
-  return {
-    plainTextToken: `${id}|${plainToken}`,
-    token
-  };
-}
-function parseApiToken(plainTextToken) {
-  const parts = plainTextToken.split("|");
-  if (parts.length !== 2) return null;
-  const [id, token] = parts;
-  if (!id || !token) return null;
-  return { id, token };
-}
-async function verifyApiToken(plainTextToken, store, options = {}) {
-  const { updateLastUsed = true } = options;
-  const parsed = parseApiToken(plainTextToken);
-  if (!parsed) return null;
-  const hashedToken = hashToken(parsed.token);
-  const token = await store.findByHashedToken(hashedToken);
-  if (!token) return null;
-  if (token.id !== parsed.id) return null;
-  if (token.expiresAt && /* @__PURE__ */ new Date() > token.expiresAt) {
-    return null;
-  }
-  if (!secureCompare(token.hashedToken, hashedToken)) {
-    return null;
-  }
-  if (updateLastUsed) {
-    await store.updateLastUsed(token.id, /* @__PURE__ */ new Date());
-  }
-  return {
-    token,
-    userId: token.userId,
-    abilities: token.abilities
-  };
-}
-function tokenCan(token, ability) {
-  if (token.abilities.includes("*")) return true;
-  return token.abilities.includes(ability);
-}
-function tokenCanAll(token, abilities) {
-  if (token.abilities.includes("*")) return true;
-  return abilities.every((ability) => token.abilities.includes(ability));
-}
-function tokenCanAny(token, abilities) {
-  if (token.abilities.includes("*")) return true;
-  return abilities.some((ability) => token.abilities.includes(ability));
-}
-async function revokeApiToken(id, store) {
-  await store.delete(id);
-}
-async function revokeAllApiTokens(userId, store) {
-  await store.deleteForUser(userId);
-}
-async function getUserApiTokens(userId, store) {
-  return store.findByUserId(userId);
-}
-var API_TOKEN_KEY = "guren:api-token";
-function createBearerTokenMiddleware(options) {
-  const {
-    store,
-    loadUser,
-    abilities,
-    onUnauthorized,
-    onForbidden,
-    headerName = "Authorization",
-    updateLastUsed = true
-  } = options;
-  return async (ctx, next) => {
-    const authHeader = ctx.req.header(headerName);
-    if (!authHeader) {
-      if (onUnauthorized) return onUnauthorized(ctx);
-      return ctx.json({ error: "Authentication required" }, 401);
-    }
-    const match = authHeader.match(/^Bearer\s+(.+)$/i);
-    if (!match) {
-      if (onUnauthorized) return onUnauthorized(ctx);
-      return ctx.json({ error: "Invalid authorization format" }, 401);
-    }
-    const plainTextToken = match[1];
-    const result = await verifyApiToken(plainTextToken, store, { updateLastUsed });
-    if (!result) {
-      if (onUnauthorized) return onUnauthorized(ctx);
-      return ctx.json({ error: "Invalid or expired token" }, 401);
-    }
-    if (abilities && abilities.length > 0) {
-      if (!tokenCanAll(result.token, abilities)) {
-        if (onForbidden) return onForbidden(ctx, abilities);
-        return ctx.json(
-          { error: "Token lacks required abilities", required: abilities },
-          403
-        );
-      }
-    }
-    ctx.set(API_TOKEN_KEY, result);
-    if (loadUser) {
-      const user = await loadUser(result.userId);
-      ctx.set("guren:user", user);
-    }
-    return next();
-  };
-}
-function getApiToken(ctx) {
-  return ctx.get(API_TOKEN_KEY);
-}
-function getApiTokenOrFail(ctx) {
-  const result = getApiToken(ctx);
-  if (!result) {
-    throw new AuthenticationException("Unauthenticated.");
-  }
-  return result;
-}
-
-// src/auth/oauth/index.ts
-var DEFAULT_STATE_EXPIRES_IN = 10 * 60 * 1e3;
-var DEFAULT_STATE_LENGTH = 24;
-var DEFAULT_STATE_HASH_ALGORITHM = "sha256";
-var MemoryOAuthStateStore = class {
-  states = /* @__PURE__ */ new Map();
-  async store(stateHash, payload) {
-    this.states.set(stateHash, payload);
-  }
-  async find(stateHash) {
-    const payload = this.states.get(stateHash);
-    if (!payload) return null;
-    if (payload.expiresAt.getTime() <= Date.now()) {
-      this.states.delete(stateHash);
-      return null;
-    }
-    return payload;
-  }
-  async delete(stateHash) {
-    this.states.delete(stateHash);
-  }
-  clear() {
-    this.states.clear();
-  }
-};
-var OAuthManager = class {
-  providers = /* @__PURE__ */ new Map();
-  stateStore;
-  stateConfig;
-  constructor(options = {}) {
-    this.stateStore = options.stateStore ?? new MemoryOAuthStateStore();
-    this.stateConfig = {
-      expiresIn: options.stateConfig?.expiresIn ?? DEFAULT_STATE_EXPIRES_IN,
-      stateLength: options.stateConfig?.stateLength ?? DEFAULT_STATE_LENGTH,
-      hashAlgorithm: options.stateConfig?.hashAlgorithm ?? DEFAULT_STATE_HASH_ALGORITHM
-    };
-  }
-  registerProvider(name, config) {
-    this.providers.set(name, config);
-  }
-  providerNames() {
-    return Array.from(this.providers.keys()).sort((a, b) => a.localeCompare(b));
-  }
-  getProvider(name) {
-    const provider = this.providers.get(name);
-    if (!provider) {
-      throw new AuthenticationException(`OAuth provider "${name}" is not configured.`);
-    }
-    return provider;
-  }
-  async authorize(providerName, options = {}) {
-    const provider = this.getProvider(providerName);
-    const { state, expiresAt } = await createOAuthState(
-      providerName,
-      this.stateStore,
-      this.stateConfig,
-      options.redirectTo,
-      options.state
-    );
-    const scope = options.scope ?? provider.scopes;
-    const url = buildOAuthAuthorizeUrl(provider, state, { scope, extraParams: options.extraParams });
-    return { url, state, expiresAt };
-  }
-  async user(providerName, payload) {
-    const provider = this.getProvider(providerName);
-    const verified = await verifyOAuthState(payload.state, providerName, this.stateStore, this.stateConfig);
-    if (!verified) {
-      throw new AuthenticationException("Invalid or expired OAuth state.");
-    }
-    const token = await exchangeOAuthCode(provider, payload.code);
-    return fetchOAuthUserProfile(provider, token);
-  }
-};
-function createOAuthManager(options = {}) {
-  return new OAuthManager(options);
-}
-async function createOAuthState(provider, store, config = {}, redirectTo, fixedState) {
-  const state = fixedState ?? generateToken(config.stateLength ?? DEFAULT_STATE_LENGTH);
-  const hashAlgorithm = config.hashAlgorithm ?? DEFAULT_STATE_HASH_ALGORITHM;
-  const expiresAt = new Date(Date.now() + (config.expiresIn ?? DEFAULT_STATE_EXPIRES_IN));
-  const stateHash = hashToken(state, hashAlgorithm);
-  await store.store(stateHash, { provider, redirectTo, expiresAt });
-  return { state, expiresAt };
-}
-async function verifyOAuthState(state, provider, store, config = {}) {
-  const hashAlgorithm = config.hashAlgorithm ?? DEFAULT_STATE_HASH_ALGORITHM;
-  const stateHash = hashToken(state, hashAlgorithm);
-  const payload = await store.find(stateHash);
-  if (!payload) return null;
-  await store.delete(stateHash);
-  if (payload.provider !== provider) return null;
-  return payload;
-}
-function buildOAuthAuthorizeUrl(provider, state, options = {}) {
-  const url = new URL(provider.authorizeUrl);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", provider.clientId);
-  url.searchParams.set("redirect_uri", provider.redirectUri);
-  url.searchParams.set("state", state);
-  const scopes = options.scope ?? provider.scopes;
-  if (scopes && scopes.length > 0) {
-    url.searchParams.set("scope", scopes.join(" "));
-  }
-  for (const [key, value] of Object.entries(options.extraParams ?? {})) {
-    url.searchParams.set(key, value);
-  }
-  return url.toString();
-}
-async function exchangeOAuthCode(provider, code) {
-  const params = new URLSearchParams({
-    grant_type: "authorization_code",
-    code,
-    redirect_uri: provider.redirectUri,
-    client_id: provider.clientId
-  });
-  const headers = {
-    Accept: "application/json",
-    "Content-Type": "application/x-www-form-urlencoded"
-  };
-  if (provider.tokenAuthMethod === "client_secret_basic") {
-    const credentials = Buffer.from(`${provider.clientId}:${provider.clientSecret}`).toString("base64");
-    headers.Authorization = `Basic ${credentials}`;
-  } else {
-    params.set("client_secret", provider.clientSecret);
-  }
-  const response = await fetch(provider.tokenUrl, {
-    method: "POST",
-    headers,
-    body: params.toString()
-  });
-  if (!response.ok) {
-    throw new AuthenticationException(`OAuth token exchange failed (${response.status}).`);
-  }
-  const raw = await response.json();
-  const accessToken = typeof raw.access_token === "string" ? raw.access_token : "";
-  if (!accessToken) {
-    throw new AuthenticationException("OAuth token exchange did not return an access token.");
-  }
-  return {
-    accessToken,
-    tokenType: typeof raw.token_type === "string" ? raw.token_type : void 0,
-    refreshToken: typeof raw.refresh_token === "string" ? raw.refresh_token : void 0,
-    expiresIn: typeof raw.expires_in === "number" ? raw.expires_in : void 0,
-    scope: typeof raw.scope === "string" ? raw.scope : void 0,
-    raw
-  };
-}
-async function fetchOAuthUserProfile(provider, token) {
-  const response = await fetch(provider.userInfoUrl, {
-    method: provider.userInfoMethod ?? "GET",
-    headers: {
-      Accept: "application/json",
-      Authorization: `Bearer ${token.accessToken}`,
-      "User-Agent": "guren-oauth"
-    }
-  });
-  if (!response.ok) {
-    throw new AuthenticationException(`OAuth user fetch failed (${response.status}).`);
-  }
-  const raw = await response.json();
-  if (provider.mapProfile) {
-    return provider.mapProfile(raw, token);
-  }
-  const idCandidate = raw.id ?? raw.sub;
-  const id = typeof idCandidate === "string" || typeof idCandidate === "number" ? String(idCandidate) : "";
-  if (!id) {
-    throw new AuthenticationException("OAuth user profile is missing an identifier.");
-  }
-  return {
-    id,
-    email: typeof raw.email === "string" ? raw.email : void 0,
-    name: typeof raw.name === "string" ? raw.name : void 0,
-    avatar: typeof raw.avatar_url === "string" ? raw.avatar_url : typeof raw.picture === "string" ? raw.picture : typeof raw.avatar === "string" ? raw.avatar : void 0,
-    token,
-    raw
-  };
-}
-function createGitHubOAuthProviderConfig(input) {
-  return {
-    ...input,
-    authorizeUrl: "https://github.com/login/oauth/authorize",
-    tokenUrl: "https://github.com/login/oauth/access_token",
-    userInfoUrl: "https://api.github.com/user",
-    scopes: input.scopes ?? ["read:user", "user:email"]
-  };
-}
-function createGoogleOAuthProviderConfig(input) {
-  return {
-    ...input,
-    authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
-    tokenUrl: "https://oauth2.googleapis.com/token",
-    userInfoUrl: "https://openidconnect.googleapis.com/v1/userinfo",
-    scopes: input.scopes ?? ["openid", "profile", "email"]
-  };
-}
-function createDiscordOAuthProviderConfig(input) {
-  return {
-    ...input,
-    authorizeUrl: "https://discord.com/api/oauth2/authorize",
-    tokenUrl: "https://discord.com/api/oauth2/token",
-    userInfoUrl: "https://discord.com/api/users/@me",
-    scopes: input.scopes ?? ["identify", "email"]
-  };
-}
-function buildOAuthRedirectUrl(baseUrl, token, email) {
-  return buildTokenUrl(baseUrl, token, email);
-}
-function parseOAuthRedirectUrl(url) {
-  return parseTokenUrl(url);
-}
+  API_TOKEN_KEY,
+  AuthManager,
+  AuthenticatableModel,
+  BaseUserProvider,
+  MemoryApiTokenStore,
+  MemoryEmailVerificationStore,
+  MemoryOAuthStateStore,
+  MemoryPasswordResetStore,
+  ModelUserProvider,
+  NodeHasher,
+  OAuthManager,
+  ScryptHasher,
+  SessionGuard,
+  buildOAuthAuthorizeUrl,
+  buildOAuthRedirectUrl,
+  buildPasswordResetUrl,
+  buildTokenUrl,
+  buildVerificationUrl,
+  completeEmailVerification,
+  completePasswordReset,
+  createApiToken,
+  createBearerTokenMiddleware,
+  createDiscordOAuthProviderConfig,
+  createEmailVerificationToken,
+  createGitHubOAuthProviderConfig,
+  createGoogleOAuthProviderConfig,
+  createOAuthManager,
+  createOAuthState,
+  createPasswordResetToken,
+  exchangeOAuthCode,
+  fetchOAuthUserProfile,
+  generateId,
+  generateToken,
+  getApiToken,
+  getApiTokenOrFail,
+  getUserApiTokens,
+  hashToken,
+  isEmailVerified,
+  parseApiToken,
+  parseOAuthRedirectUrl,
+  parsePasswordResetUrl,
+  parseTokenUrl,
+  parseVerificationUrl,
+  requireVerifiedEmail,
+  revokeAllApiTokens,
+  revokeApiToken,
+  secureCompare,
+  secureStringCompare,
+  tokenCan,
+  tokenCanAll,
+  tokenCanAny,
+  verifyApiToken,
+  verifyEmailToken,
+  verifyOAuthState,
+  verifyPasswordResetToken
+} from "../chunk-BJXAHGDR.js";
+import "../chunk-DAQKYKLH.js";
+import "../chunk-ONSDE37A.js";
+import "../chunk-QQKTH5KX.js";
 export {
   API_TOKEN_KEY,
   AuthManager,