@guren/server 1.0.0-rc.9 → 1.0.0

package/dist/chunk-2T6JN4VR.js

@@ -0,0 +1,1563 @@
+import {
+  AuthenticationException
+} from "./chunk-DAQKYKLH.js";
+import {
+  MessageSigner,
+  deriveAppKeyring,
+  getAppKeyringFromEnv
+} from "./chunk-ONSDE37A.js";
+import {
+  hashPassword,
+  needsRehash,
+  verifyPassword
+} from "./chunk-QQKTH5KX.js";
+
+// src/http/middleware/session.ts
+import { getCookie, setCookie, deleteCookie } from "hono/cookie";
+import { createHmac, timingSafeEqual } from "crypto";
+var MemorySessionStore = class {
+  constructor(now = () => Date.now()) {
+    this.now = now;
+  }
+  store = /* @__PURE__ */ new Map();
+  async read(id) {
+    const entry = this.store.get(id);
+    if (!entry) {
+      return void 0;
+    }
+    if (entry.expiresAt <= this.now()) {
+      this.store.delete(id);
+      return void 0;
+    }
+    return { ...entry.data };
+  }
+  async write(id, data, ttlSeconds) {
+    const expiresAt = this.now() + ttlSeconds * 1e3;
+    this.store.set(id, { data: { ...data }, expiresAt });
+  }
+  async destroy(id) {
+    this.store.delete(id);
+  }
+};
+var DEFAULT_COOKIE_NAME = "guren.session";
+var DEFAULT_TTL_SECONDS = 60 * 60 * 2;
+var DEFAULT_COOKIE_SECURE = typeof process !== "undefined" ? process.env.NODE_ENV === "production" : true;
+var SESSION_CONTEXT_KEY = "guren:session";
+var SessionImpl = class {
+  constructor(id, initialData, isNew) {
+    this.isNew = isNew;
+    this.currentId = id;
+    this.originalId = id;
+    const { _flash, ...rest } = initialData;
+    this.data = { ...rest };
+    if (_flash && typeof _flash === "object") {
+      const bag = _flash;
+      this._flash = {
+        new: bag.new && typeof bag.new === "object" ? { ...bag.new } : {},
+        old: bag.old && typeof bag.old === "object" ? { ...bag.old } : {}
+      };
+    }
+  }
+  currentId;
+  originalId;
+  data;
+  dirty = false;
+  destroyed = false;
+  regenerated = false;
+  _flash = { new: {}, old: {} };
+  get id() {
+    return this.currentId;
+  }
+  get(key) {
+    return this.data[key];
+  }
+  set(key, value) {
+    this.data[key] = value;
+    this.dirty = true;
+  }
+  has(key) {
+    return Object.prototype.hasOwnProperty.call(this.data, key);
+  }
+  forget(key) {
+    if (this.has(key)) {
+      delete this.data[key];
+      this.dirty = true;
+    }
+  }
+  flush() {
+    if (Object.keys(this.data).length > 0) {
+      this.data = {};
+      this.dirty = true;
+    }
+  }
+  all() {
+    return { ...this.data };
+  }
+  regenerate() {
+    this.currentId = globalThis.crypto.randomUUID();
+    this.regenerated = true;
+    this.dirty = true;
+  }
+  invalidate() {
+    this.flush();
+    this.destroyed = true;
+  }
+  flash(key, value) {
+    this._flash.new[key] = value;
+    this.dirty = true;
+  }
+  getFlash(key) {
+    return this._flash.old[key];
+  }
+  reflash() {
+    for (const [key, value] of Object.entries(this._flash.old)) {
+      this._flash.new[key] = value;
+    }
+    this.dirty = true;
+  }
+  keep(...keys) {
+    for (const key of keys) {
+      if (key in this._flash.old) {
+        this._flash.new[key] = this._flash.old[key];
+      }
+    }
+    this.dirty = true;
+  }
+  /**
+   * Age flash data: move `new` → `old`, clear previous `old`.
+   * Called at the start of each request by the session middleware.
+   */
+  ageFlashData() {
+    this._flash.old = { ...this._flash.new };
+    this._flash.new = {};
+    this.dirty = true;
+  }
+  markTouched() {
+    this.dirty = true;
+  }
+  wasDestroyed() {
+    return this.destroyed;
+  }
+  wasRegenerated() {
+    return this.regenerated;
+  }
+  shouldPersist() {
+    return this.dirty || this.isNew;
+  }
+  snapshot() {
+    const hasFlash = Object.keys(this._flash.new).length > 0 || Object.keys(this._flash.old).length > 0;
+    return {
+      ...this.data,
+      ...hasFlash ? { _flash: { new: { ...this._flash.new }, old: { ...this._flash.old } } } : {}
+    };
+  }
+  originalSessionId() {
+    return this.originalId;
+  }
+};
+function encodeBase64Url(value) {
+  return Buffer.from(value, "utf8").toString("base64url");
+}
+function decodeBase64Url(value) {
+  return Buffer.from(value, "base64url").toString("utf8");
+}
+function createCookieSigner(cookieName, cookiePath) {
+  const keyring = deriveAppKeyring(getAppKeyringFromEnv(), "cookie-signing");
+  const keys = [keyring.current, ...keyring.previous];
+  const canonicalize = (encodedId) => `${cookieName}|${cookiePath}|${encodedId}`;
+  const sign = (sessionId) => {
+    const encodedId = encodeBase64Url(sessionId);
+    const signature = createHmac("sha256", keyring.current).update(canonicalize(encodedId)).digest("base64url");
+    return `${encodedId}.${signature}`;
+  };
+  const verify = (cookieValue) => {
+    if (!cookieValue) {
+      return null;
+    }
+    const [encodedId, signature, extra] = cookieValue.split(".");
+    if (!encodedId || !signature || extra) {
+      return null;
+    }
+    const canonical = canonicalize(encodedId);
+    const matches = keys.some((key) => {
+      const expected = createHmac("sha256", key).update(canonical).digest("base64url");
+      const actualBuffer = Buffer.from(signature, "utf8");
+      const expectedBuffer = Buffer.from(expected, "utf8");
+      if (actualBuffer.length !== expectedBuffer.length) {
+        return false;
+      }
+      return timingSafeEqual(actualBuffer, expectedBuffer);
+    });
+    if (!matches) {
+      return null;
+    }
+    try {
+      return decodeBase64Url(encodedId);
+    } catch {
+      return null;
+    }
+  };
+  return { sign, verify };
+}
+function createSessionMiddleware(options = {}) {
+  const {
+    cookieName = DEFAULT_COOKIE_NAME,
+    cookiePath = "/",
+    cookieDomain,
+    cookieSecure = DEFAULT_COOKIE_SECURE,
+    cookieSameSite = "Lax",
+    cookieHttpOnly = true,
+    cookieMaxAgeSeconds,
+    ttlSeconds = DEFAULT_TTL_SECONDS,
+    store = new MemorySessionStore()
+  } = options;
+  const signer = createCookieSigner(cookieName, cookiePath);
+  return async (ctx, next) => {
+    const existingId = signer.verify(getCookie(ctx, cookieName));
+    const sessionId = existingId ?? globalThis.crypto.randomUUID();
+    const isNew = !existingId;
+    const initialData = existingId ? await store.read(existingId) ?? {} : {};
+    const session = new SessionImpl(sessionId, initialData, isNew);
+    session.ageFlashData();
+    ctx.set(SESSION_CONTEXT_KEY, session);
+    try {
+      await next();
+    } finally {
+      if (session.wasDestroyed()) {
+        await store.destroy(session.originalSessionId());
+        deleteCookie(ctx, cookieName, {
+          path: cookiePath,
+          domain: cookieDomain,
+          secure: cookieSecure,
+          sameSite: cookieSameSite,
+          httpOnly: cookieHttpOnly
+        });
+        return;
+      }
+      if (!session.shouldPersist()) {
+        if (existingId) {
+          await store.write(existingId, session.snapshot(), ttlSeconds);
+          setCookie(ctx, cookieName, signer.sign(existingId), {
+            path: cookiePath,
+            domain: cookieDomain,
+            secure: cookieSecure,
+            sameSite: cookieSameSite,
+            httpOnly: cookieHttpOnly,
+            maxAge: cookieMaxAgeSeconds ?? ttlSeconds
+          });
+        }
+        return;
+      }
+      const nextId = session.id;
+      await store.write(nextId, session.snapshot(), ttlSeconds);
+      if (session.wasRegenerated() && session.originalSessionId() !== nextId) {
+        await store.destroy(session.originalSessionId());
+      }
+      setCookie(ctx, cookieName, signer.sign(nextId), {
+        path: cookiePath,
+        domain: cookieDomain,
+        secure: cookieSecure,
+        sameSite: cookieSameSite,
+        httpOnly: cookieHttpOnly,
+        maxAge: cookieMaxAgeSeconds ?? ttlSeconds
+      });
+    }
+  };
+}
+function getSessionFromContext(ctx) {
+  return ctx.get(SESSION_CONTEXT_KEY);
+}
+
+// src/auth/RequestAuthContext.ts
+var RequestAuthContext = class {
+  constructor(manager, ctx, resolveSession, resolveGuard) {
+    this.manager = manager;
+    this.ctx = ctx;
+    this.resolveSession = resolveSession;
+    this.resolveGuard = resolveGuard;
+  }
+  guardCache = /* @__PURE__ */ new Map();
+  guard(name) {
+    const key = name ?? this.manager.getDefaultGuard();
+    if (!this.guardCache.has(key)) {
+      const guard = this.resolveGuard(name);
+      this.guardCache.set(key, guard);
+    }
+    return this.guardCache.get(key);
+  }
+  session() {
+    return this.resolveSession();
+  }
+  async check() {
+    return this.guard().check();
+  }
+  async guest() {
+    return this.guard().guest();
+  }
+  async user() {
+    return this.guard().user();
+  }
+  async userOrFail() {
+    const u = await this.user();
+    if (!u) throw new AuthenticationException();
+    return u;
+  }
+  async id() {
+    return this.guard().id();
+  }
+  async login(user, remember) {
+    await this.guard().login(user, remember);
+  }
+  async attempt(credentials, remember) {
+    return this.guard().attempt(credentials, remember);
+  }
+  async logout() {
+    await this.guard().logout();
+  }
+};
+
+// src/auth/password/ScryptHasher.ts
+var ScryptHasher = class {
+  algorithm;
+  memoryCost;
+  timeCost;
+  cost;
+  constructor(options = {}) {
+    this.algorithm = options.algorithm ?? "argon2id";
+    this.memoryCost = options.memoryCost;
+    this.timeCost = options.timeCost;
+    this.cost = options.cost;
+  }
+  async hash(plain) {
+    if (this.algorithm === "bcrypt") {
+      return Bun.password.hash(plain, {
+        algorithm: "bcrypt",
+        cost: this.cost
+      });
+    }
+    return Bun.password.hash(plain, {
+      algorithm: this.algorithm,
+      memoryCost: this.memoryCost,
+      timeCost: this.timeCost
+    });
+  }
+  async verify(hashed, plain) {
+    return Bun.password.verify(plain, hashed);
+  }
+  needsRehash(hashed) {
+    if (this.algorithm === "bcrypt") {
+      if (!hashed.startsWith("$2")) {
+        return true;
+      }
+      if (this.cost != null) {
+        const costSegment = hashed.slice(4, 6);
+        const parsedCost = Number.parseInt(costSegment, 10);
+        if (!Number.isNaN(parsedCost) && parsedCost !== this.cost) {
+          return true;
+        }
+      }
+      return false;
+    }
+    if (!hashed.startsWith(`$${this.algorithm}$`)) {
+      return true;
+    }
+    const [, , , parameterSegment] = hashed.split("$");
+    if (!parameterSegment) {
+      return false;
+    }
+    const params = Object.fromEntries(
+      parameterSegment.split(",").map((pair) => pair.split("=")).filter((parts) => parts.length === 2)
+    );
+    if (this.memoryCost != null) {
+      const memory = Number(params.m);
+      if (!Number.isNaN(memory) && memory !== this.memoryCost) {
+        return true;
+      }
+    }
+    if (this.timeCost != null) {
+      const time = Number(params.t);
+      if (!Number.isNaN(time) && time !== this.timeCost) {
+        return true;
+      }
+    }
+    return false;
+  }
+};
+
+// src/auth/providers/UserProvider.ts
+var BaseUserProvider = class {
+  async setRememberToken(user, token) {
+    if (typeof user.setRememberToken === "function") {
+      await user.setRememberToken(token);
+    }
+  }
+  async getRememberToken(user) {
+    if (typeof user.getRememberToken === "function") {
+      return await user.getRememberToken() ?? null;
+    }
+    return null;
+  }
+};
+
+// src/auth/providers/ModelUserProvider.ts
+var ModelUserProvider = class extends BaseUserProvider {
+  constructor(model, options = {}) {
+    super();
+    this.model = model;
+    this.idColumn = options.idColumn ?? "id";
+    this.usernameColumn = options.usernameColumn ?? "email";
+    this.passwordColumn = options.passwordColumn ?? "password";
+    this.rememberTokenColumn = options.rememberTokenColumn ?? "remember_token";
+    this.hasher = options.hasher ?? new ScryptHasher();
+    this.credentialsPasswordField = options.credentialsPasswordField ?? "password";
+  }
+  idColumn;
+  usernameColumn;
+  passwordColumn;
+  rememberTokenColumn;
+  hasher;
+  credentialsPasswordField;
+  cast(record) {
+    if (record && typeof record === "object") {
+      return record;
+    }
+    return null;
+  }
+  async retrieveById(identifier) {
+    const record = await this.model.find(identifier, this.idColumn);
+    return this.cast(record);
+  }
+  async retrieveByCredentials(credentials) {
+    const rememberToken = credentials["rememberToken"] ?? credentials["remember_token"];
+    if (rememberToken != null) {
+      const records2 = await this.model.where({ [this.rememberTokenColumn]: rememberToken });
+      return this.cast(records2[0] ?? null);
+    }
+    const username = credentials[this.usernameColumn];
+    if (username == null) {
+      return null;
+    }
+    const records = await this.model.where({ [this.usernameColumn]: username });
+    return this.cast(records[0] ?? null);
+  }
+  async validateCredentials(user, credentials) {
+    const plain = credentials[this.credentialsPasswordField];
+    if (typeof plain !== "string") {
+      return false;
+    }
+    const hashed = user[this.passwordColumn];
+    if (typeof hashed !== "string") {
+      await this.hasher.hash("dummy-timing-equalization");
+      return false;
+    }
+    return this.hasher.verify(hashed, plain);
+  }
+  getId(user) {
+    return user[this.idColumn];
+  }
+  /**
+   * Strip the password hash, remember token, and the model's `hidden`
+   * fields before the record leaves the auth layer. Credential
+   * validation happens on the raw record before sanitizing, so this
+   * never affects login — only what `auth.user()` exposes.
+   */
+  sanitize(user) {
+    const blocked = /* @__PURE__ */ new Set([
+      this.passwordColumn,
+      this.rememberTokenColumn,
+      ...this.model.hidden ?? []
+    ]);
+    const clean = {};
+    for (const [key, value] of Object.entries(user)) {
+      if (!blocked.has(key)) {
+        clean[key] = value;
+      }
+    }
+    return clean;
+  }
+  async setRememberToken(user, token) {
+    if (typeof user[this.rememberTokenColumn] !== "undefined") {
+      ;
+      user[this.rememberTokenColumn] = token;
+      await this.model.forceUpdate({ [this.idColumn]: this.getId(user) }, { [this.rememberTokenColumn]: token });
+    }
+  }
+  async getRememberToken(user) {
+    const token = user[this.rememberTokenColumn];
+    if (token == null) {
+      return null;
+    }
+    return String(token);
+  }
+};
+
+// src/auth/utils.ts
+import { randomBytes, createHash, timingSafeEqual as timingSafeEqual2 } from "crypto";
+function hashToken(token, algorithm = "sha256") {
+  return createHash(algorithm).update(token).digest("hex");
+}
+function generateToken(length = 32) {
+  return randomBytes(length).toString("hex");
+}
+function generateId() {
+  return randomBytes(16).toString("hex");
+}
+function secureCompare(a, b) {
+  if (a.length !== b.length) return false;
+  try {
+    return timingSafeEqual2(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
+  } catch {
+    return false;
+  }
+}
+function secureStringCompare(a, b) {
+  const bufA = Buffer.from(a, "utf8");
+  const bufB = Buffer.from(b, "utf8");
+  if (bufA.length !== bufB.length) return false;
+  return timingSafeEqual2(bufA, bufB);
+}
+function buildTokenUrl(baseUrl, token, email) {
+  const url = new URL(baseUrl);
+  url.searchParams.set("token", token);
+  if (email) {
+    url.searchParams.set("email", email);
+  }
+  return url.toString();
+}
+function parseTokenUrl(url) {
+  try {
+    const parsed = new URL(url);
+    return {
+      token: parsed.searchParams.get("token"),
+      email: parsed.searchParams.get("email")
+    };
+  } catch {
+    return { token: null, email: null };
+  }
+}
+
+// src/auth/SessionGuard.ts
+var DEFAULT_SESSION_KEY = "auth:user_id";
+var DEFAULT_REMEMBER_KEY = "auth:remember_token";
+var SessionGuard = class {
+  constructor(options) {
+    this.options = options;
+  }
+  cachedUser;
+  get currentSession() {
+    return this.options.session;
+  }
+  get provider() {
+    return this.options.provider;
+  }
+  sessionKey() {
+    return this.options.sessionKey ?? DEFAULT_SESSION_KEY;
+  }
+  rememberSessionKey() {
+    return this.options.rememberSessionKey ?? DEFAULT_REMEMBER_KEY;
+  }
+  async loadRememberedUser() {
+    if (!this.currentSession || !this.provider.getRememberToken) {
+      return null;
+    }
+    const rememberToken = this.currentSession.get(this.rememberSessionKey());
+    if (!rememberToken) {
+      return null;
+    }
+    const user = await this.provider.retrieveByCredentials({ rememberToken });
+    if (!user) {
+      this.currentSession.forget(this.rememberSessionKey());
+      return null;
+    }
+    const providerToken = await this.provider.getRememberToken?.(user);
+    if (!providerToken || !secureStringCompare(providerToken, rememberToken)) {
+      this.currentSession.forget(this.rememberSessionKey());
+      return null;
+    }
+    await this.provider.setRememberToken?.(user, rememberToken);
+    const sanitized = this.sanitizeUser(user);
+    this.cachedUser = sanitized;
+    return sanitized;
+  }
+  /** Strip auth-internal fields before a record is cached or exposed. */
+  sanitizeUser(user) {
+    return this.provider.sanitize ? this.provider.sanitize(user) : user;
+  }
+  async resolveUser() {
+    if (this.cachedUser !== void 0) {
+      return this.cachedUser;
+    }
+    const session = this.currentSession;
+    if (!session) {
+      this.cachedUser = null;
+      return null;
+    }
+    const identifier = session.get(this.sessionKey());
+    if (identifier == null) {
+      const remembered = await this.loadRememberedUser();
+      this.cachedUser = remembered;
+      return remembered;
+    }
+    const user = await this.provider.retrieveById(identifier);
+    if (!user) {
+      session.forget(this.sessionKey());
+      this.cachedUser = null;
+      return null;
+    }
+    const sanitized = this.sanitizeUser(user);
+    this.cachedUser = sanitized;
+    return sanitized;
+  }
+  async check() {
+    return await this.resolveUser() !== null;
+  }
+  async guest() {
+    return !await this.check();
+  }
+  async user() {
+    const user = await this.resolveUser();
+    return user ?? null;
+  }
+  async id() {
+    const session = this.currentSession;
+    if (!session) {
+      return null;
+    }
+    return session.get(this.sessionKey()) ?? null;
+  }
+  async remember(user) {
+    if (!this.currentSession || !this.provider.setRememberToken) {
+      return;
+    }
+    const token = generateToken(32);
+    await this.provider.setRememberToken?.(user, token);
+    this.currentSession.set(this.rememberSessionKey(), token);
+  }
+  async login(user, remember = false) {
+    const castUser = user;
+    const session = this.currentSession;
+    if (!session) {
+      throw new Error("SessionGuard: session middleware is required to use the session guard.");
+    }
+    session.regenerate();
+    const identifier = this.provider.getId(castUser);
+    session.set(this.sessionKey(), identifier);
+    this.cachedUser = this.sanitizeUser(castUser);
+    if (remember) {
+      await this.remember(castUser);
+    } else {
+      session.forget(this.rememberSessionKey());
+    }
+  }
+  async logout() {
+    const session = this.currentSession;
+    if (!session) {
+      return;
+    }
+    session.forget(this.sessionKey());
+    session.forget(this.rememberSessionKey());
+    this.cachedUser = null;
+  }
+  async attempt(credentials, remember = false) {
+    const user = await this.validate(credentials);
+    if (!user) {
+      return false;
+    }
+    await this.login(user, remember);
+    return true;
+  }
+  async validate(credentials) {
+    const user = await this.provider.retrieveByCredentials(credentials);
+    if (!user) {
+      await new Promise((resolve) => setTimeout(resolve, 100));
+      return null;
+    }
+    const valid = await this.provider.validateCredentials(user, credentials);
+    if (!valid) {
+      return null;
+    }
+    return user;
+  }
+  session() {
+    return this.currentSession;
+  }
+};
+
+// src/auth/AuthManager.ts
+var DEFAULT_GUARD = "web";
+var AuthManager = class {
+  guards = /* @__PURE__ */ new Map();
+  providers = /* @__PURE__ */ new Map();
+  defaultGuard;
+  constructor(options = {}) {
+    this.defaultGuard = options.defaultGuard ?? DEFAULT_GUARD;
+  }
+  registerGuard(name, factory) {
+    this.guards.set(name, { factory });
+  }
+  registerProvider(name, factory) {
+    this.providers.set(name, { factory });
+  }
+  getProvider(name) {
+    const entry = this.providers.get(name);
+    if (!entry) {
+      throw new Error(`AuthManager: provider "${name}" has not been registered.`);
+    }
+    if (!entry.instance) {
+      const instance = entry.factory(this);
+      entry.instance = instance;
+      this.providers.set(name, entry);
+    }
+    return entry.instance;
+  }
+  createGuard(name, context) {
+    const entry = this.guards.get(name);
+    if (!entry) {
+      throw new Error(`AuthManager: guard "${name}" has not been registered.`);
+    }
+    return entry.factory(context);
+  }
+  guardNames() {
+    return Array.from(this.guards.keys());
+  }
+  setDefaultGuard(name) {
+    if (!this.guards.has(name)) {
+      throw new Error(`AuthManager: cannot set default guard to unregistered guard "${name}".`);
+    }
+    this.defaultGuard = name;
+  }
+  getDefaultGuard() {
+    return this.defaultGuard;
+  }
+  createAuthContext(ctx, options = {}) {
+    const guardName = options.guard ?? this.defaultGuard;
+    const resolveSession = () => getSessionFromContext(ctx);
+    const guardFactory = (name) => {
+      const targetName = name ?? guardName;
+      return this.createGuard(targetName, {
+        ctx,
+        session: resolveSession(),
+        manager: this
+      });
+    };
+    return new RequestAuthContext(this, ctx, resolveSession, guardFactory);
+  }
+  async attempt(name, ctx, credentials, remember) {
+    const guard = this.createAuthContext(ctx, { guard: name }).guard(name);
+    return guard.attempt(credentials, remember);
+  }
+  /**
+   * Shorthand method to register a model-based authentication provider and session guard.
+   * This simplifies the common case of authenticating users via a database model.
+   *
+   * @param model - The model class to use for user authentication
+   * @param options - Options for the ModelUserProvider (partial, with defaults)
+   * @param providerName - Name for the provider (defaults to 'users')
+   * @param guardName - Name for the guard (defaults to 'web')
+   */
+  useModel(model, options = {}, providerName = "users", guardName = "web") {
+    const defaultOptions = {
+      usernameColumn: "email",
+      passwordColumn: "passwordHash",
+      rememberTokenColumn: "rememberToken",
+      credentialsPasswordField: "password",
+      hasher: new ScryptHasher(),
+      ...options
+    };
+    this.registerProvider(providerName, () => new ModelUserProvider(model, defaultOptions));
+    this.registerGuard(guardName, ({ session, manager }) => {
+      const provider = manager.getProvider(providerName);
+      return new SessionGuard({ provider, session });
+    });
+    this.setDefaultGuard(guardName);
+  }
+};
+
+// src/auth/password/NodeHasher.ts
+var NodeHasher = class {
+  options;
+  constructor(options = {}) {
+    this.options = {
+      cost: options.cost,
+      memory: options.memory,
+      saltLength: options.saltLength,
+      keyLength: options.keyLength
+    };
+  }
+  async hash(plain) {
+    return hashPassword(plain, this.options);
+  }
+  async verify(hashed, plain) {
+    return verifyPassword(plain, hashed);
+  }
+  needsRehash(hashed) {
+    return needsRehash(hashed, this.options);
+  }
+};
+
+// src/auth/AuthenticatableModel.ts
+import { Model } from "@guren/orm";
+var AuthenticatableModel = class extends Model {
+  static createType = void 0;
+  static passwordField = "password";
+  static passwordHashField = "passwordHash";
+  static passwordHasher = null;
+  static resolvePasswordField() {
+    return this.passwordField ?? "password";
+  }
+  static resolvePasswordHashField() {
+    return this.passwordHashField ?? "passwordHash";
+  }
+  static resolvePasswordHasher() {
+    if (this.passwordHasher) {
+      return this.passwordHasher;
+    }
+    const hasher = new ScryptHasher();
+    this.passwordHasher = hasher;
+    return hasher;
+  }
+  static async preparePersistencePayload(data) {
+    const basePayload = await super.preparePersistencePayload(data);
+    const passwordField = this.resolvePasswordField();
+    if (!(passwordField in basePayload)) {
+      return basePayload;
+    }
+    const payload = { ...basePayload };
+    const plainPassword = payload[passwordField];
+    const hashField = this.resolvePasswordHashField();
+    if (typeof plainPassword === "string" && plainPassword.length > 0) {
+      const hasher = this.resolvePasswordHasher();
+      payload[hashField] = await hasher.hash(plainPassword);
+    }
+    if (passwordField !== hashField) {
+      delete payload[passwordField];
+    }
+    return payload;
+  }
+};
+
+// src/auth/password-reset.ts
+var MemoryPasswordResetStore = class {
+  tokens = /* @__PURE__ */ new Map();
+  async store(tokenId, email, expiresAt) {
+    this.tokens.set(tokenId, { email, expiresAt });
+  }
+  async find(tokenId) {
+    const record = this.tokens.get(tokenId);
+    if (!record) return null;
+    if (record.expiresAt < /* @__PURE__ */ new Date()) {
+      this.tokens.delete(tokenId);
+      return null;
+    }
+    return record;
+  }
+  async delete(tokenId) {
+    this.tokens.delete(tokenId);
+  }
+  async deleteForEmail(email) {
+    for (const [hash, record] of this.tokens) {
+      if (record.email === email) {
+        this.tokens.delete(hash);
+      }
+    }
+  }
+  /** Clear all tokens (useful for testing) */
+  clear() {
+    this.tokens.clear();
+  }
+};
+var DEFAULT_EXPIRES_IN = 60 * 60 * 1e3;
+var DEFAULT_TOKEN_LENGTH = 32;
+var PASSWORD_RESET_PURPOSE = "password-reset";
+function createPasswordResetSigner() {
+  return new MessageSigner(deriveAppKeyring(getAppKeyringFromEnv(), "password-reset-signing"));
+}
+async function createPasswordResetToken(email, store, config = {}) {
+  const expiresIn = config.expiresIn ?? DEFAULT_EXPIRES_IN;
+  const tokenLength = config.tokenLength ?? DEFAULT_TOKEN_LENGTH;
+  await store.deleteForEmail(email);
+  const tokenId = generateId();
+  const expiresAt = new Date(Date.now() + expiresIn);
+  const signer = createPasswordResetSigner();
+  const token = signer.sign(
+    {
+      id: tokenId,
+      email: email.toLowerCase(),
+      bytes: tokenLength
+    },
+    {
+      purpose: PASSWORD_RESET_PURPOSE,
+      expiresIn
+    }
+  );
+  await store.store(tokenId, email.toLowerCase(), expiresAt);
+  return { token, tokenId, expiresAt };
+}
+async function verifyPasswordResetToken(token, store, _config = {}) {
+  const signer = createPasswordResetSigner();
+  const payload = signer.verify(token, {
+    purpose: PASSWORD_RESET_PURPOSE,
+    allowExpired: true
+  });
+  if (!payload?.id || !payload.email) {
+    return null;
+  }
+  if (typeof payload.exp === "number" && payload.exp < Math.floor(Date.now() / 1e3)) {
+    await store.delete(payload.id);
+    return null;
+  }
+  const record = await store.find(payload.id);
+  if (!record) return null;
+  return record.email.toLowerCase() === payload.email.toLowerCase() ? record.email : null;
+}
+async function completePasswordReset(token, newPassword, store, provider, updatePassword, _config = {}) {
+  const signer = createPasswordResetSigner();
+  const payload = signer.verify(token, {
+    purpose: PASSWORD_RESET_PURPOSE,
+    allowExpired: true
+  });
+  if (!payload?.id || !payload.email) {
+    return null;
+  }
+  if (typeof payload.exp === "number" && payload.exp < Math.floor(Date.now() / 1e3)) {
+    await store.delete(payload.id);
+    return null;
+  }
+  const record = await store.find(payload.id);
+  if (!record) return null;
+  if (record.email.toLowerCase() !== payload.email.toLowerCase()) {
+    return null;
+  }
+  const user = await provider.retrieveByCredentials({ email: record.email });
+  if (!user) {
+    await store.delete(payload.id);
+    return null;
+  }
+  await updatePassword(user, newPassword);
+  await store.delete(payload.id);
+  return user;
+}
+var buildPasswordResetUrl = buildTokenUrl;
+var parsePasswordResetUrl = parseTokenUrl;
+
+// src/auth/email-verification.ts
+var MemoryEmailVerificationStore = class {
+  tokens = /* @__PURE__ */ new Map();
+  async store(token) {
+    this.tokens.set(token.tokenId, token);
+  }
+  async findByTokenId(tokenId) {
+    return this.tokens.get(tokenId) ?? null;
+  }
+  async delete(tokenId) {
+    this.tokens.delete(tokenId);
+  }
+  async deleteForEmail(email) {
+    const normalizedEmail = email.toLowerCase();
+    for (const [key, token] of this.tokens.entries()) {
+      if (token.email.toLowerCase() === normalizedEmail) {
+        this.tokens.delete(key);
+      }
+    }
+  }
+  /**
+   * Clear all tokens (useful for testing).
+   */
+  clear() {
+    this.tokens.clear();
+  }
+  /**
+   * Get the count of stored tokens (useful for testing).
+   */
+  get size() {
+    return this.tokens.size;
+  }
+};
+var DEFAULT_CONFIG = {
+  expiresIn: 24 * 60 * 60 * 1e3,
+  // 24 hours
+  tokenLength: 32
+};
+var EMAIL_VERIFICATION_PURPOSE = "email-verification";
+function createEmailVerificationSigner() {
+  return new MessageSigner(deriveAppKeyring(getAppKeyringFromEnv(), "email-verification-signing"));
+}
+async function createEmailVerificationToken(email, store, config = {}) {
+  const { expiresIn, tokenLength } = { ...DEFAULT_CONFIG, ...config };
+  await store.deleteForEmail(email);
+  const tokenId = generateId();
+  const now = /* @__PURE__ */ new Date();
+  const expiresAt = new Date(now.getTime() + expiresIn);
+  const signer = createEmailVerificationSigner();
+  const token = signer.sign(
+    {
+      id: tokenId,
+      email: email.toLowerCase(),
+      bytes: tokenLength
+    },
+    {
+      purpose: EMAIL_VERIFICATION_PURPOSE,
+      expiresIn
+    }
+  );
+  await store.store({
+    email: email.toLowerCase(),
+    tokenId,
+    expiresAt,
+    createdAt: now
+  });
+  return { token, expiresAt };
+}
+async function verifyEmailToken(token, store, _config = {}) {
+  const signer = createEmailVerificationSigner();
+  const payload = signer.verify(token, {
+    purpose: EMAIL_VERIFICATION_PURPOSE,
+    allowExpired: true
+  });
+  if (!payload?.id || !payload.email) {
+    return null;
+  }
+  if (typeof payload.exp === "number" && payload.exp < Math.floor(Date.now() / 1e3)) {
+    await store.delete(payload.id);
+    return null;
+  }
+  const storedToken = await store.findByTokenId(payload.id);
+  if (!storedToken) {
+    return null;
+  }
+  if (/* @__PURE__ */ new Date() > storedToken.expiresAt) {
+    await store.delete(payload.id);
+    return null;
+  }
+  return storedToken.email.toLowerCase() === payload.email.toLowerCase() ? storedToken.email : null;
+}
+async function completeEmailVerification(token, store, markVerified) {
+  const signer = createEmailVerificationSigner();
+  const payload = signer.verify(token, {
+    purpose: EMAIL_VERIFICATION_PURPOSE,
+    allowExpired: true
+  });
+  if (!payload?.id || !payload.email) {
+    return null;
+  }
+  if (typeof payload.exp === "number" && payload.exp < Math.floor(Date.now() / 1e3)) {
+    await store.delete(payload.id);
+    return null;
+  }
+  const storedToken = await store.findByTokenId(payload.id);
+  if (!storedToken) {
+    return null;
+  }
+  if (/* @__PURE__ */ new Date() > storedToken.expiresAt) {
+    await store.delete(payload.id);
+    return null;
+  }
+  if (storedToken.email.toLowerCase() !== payload.email.toLowerCase()) {
+    return null;
+  }
+  const result = await markVerified(storedToken.email);
+  await store.delete(payload.id);
+  return result;
+}
+var buildVerificationUrl = buildTokenUrl;
+var parseVerificationUrl = parseTokenUrl;
+function isEmailVerified(user) {
+  return user?.emailVerifiedAt != null;
+}
+function requireVerifiedEmail(options = {}) {
+  const { redirectTo = "/verify-email" } = options;
+  return async (ctx, next) => {
+    const getUser = options.getUser ?? (async (c) => {
+      const auth = c.get("guren:auth");
+      return auth?.user?.() ?? null;
+    });
+    const user = await getUser(ctx);
+    if (!isEmailVerified(user)) {
+      return ctx.redirect(redirectTo);
+    }
+    await next();
+  };
+}
+
+// src/auth/api-token.ts
+var MemoryApiTokenStore = class {
+  tokens = /* @__PURE__ */ new Map();
+  byHash = /* @__PURE__ */ new Map();
+  // hash -> id
+  async store(token) {
+    this.tokens.set(token.id, token);
+    this.byHash.set(token.hashedToken, token.id);
+  }
+  async findByHashedToken(hashedToken) {
+    const id = this.byHash.get(hashedToken);
+    if (!id) return null;
+    return this.tokens.get(id) ?? null;
+  }
+  async findByUserId(userId) {
+    const userIdStr = String(userId);
+    return Array.from(this.tokens.values()).filter(
+      (t) => String(t.userId) === userIdStr
+    );
+  }
+  async delete(id) {
+    const token = this.tokens.get(id);
+    if (token) {
+      this.byHash.delete(token.hashedToken);
+      this.tokens.delete(id);
+    }
+  }
+  async deleteForUser(userId) {
+    const userIdStr = String(userId);
+    for (const [id, token] of this.tokens.entries()) {
+      if (String(token.userId) === userIdStr) {
+        this.byHash.delete(token.hashedToken);
+        this.tokens.delete(id);
+      }
+    }
+  }
+  async updateLastUsed(id, timestamp) {
+    const token = this.tokens.get(id);
+    if (token) {
+      token.lastUsedAt = timestamp;
+    }
+  }
+  /**
+   * Clear all tokens (useful for testing).
+   */
+  clear() {
+    this.tokens.clear();
+    this.byHash.clear();
+  }
+  /**
+   * Get the number of stored tokens.
+   */
+  get size() {
+    return this.tokens.size;
+  }
+};
+async function createApiToken(store, options) {
+  const {
+    name,
+    userId,
+    abilities = ["*"],
+    expiresIn = null,
+    tokenLength = 32
+  } = options;
+  const id = generateId();
+  const plainToken = generateToken(tokenLength);
+  const hashedToken = hashToken(plainToken);
+  const now = /* @__PURE__ */ new Date();
+  const token = {
+    id,
+    name,
+    hashedToken,
+    userId,
+    abilities,
+    lastUsedAt: null,
+    expiresAt: expiresIn == null ? null : new Date(now.getTime() + expiresIn),
+    createdAt: now
+  };
+  await store.store(token);
+  return {
+    plainTextToken: `${id}|${plainToken}`,
+    token
+  };
+}
+function parseApiToken(plainTextToken) {
+  const parts = plainTextToken.split("|");
+  if (parts.length !== 2) return null;
+  const [id, token] = parts;
+  if (!id || !token) return null;
+  return { id, token };
+}
+async function verifyApiToken(plainTextToken, store, options = {}) {
+  const { updateLastUsed = true } = options;
+  const parsed = parseApiToken(plainTextToken);
+  if (!parsed) return null;
+  const hashedToken = hashToken(parsed.token);
+  const token = await store.findByHashedToken(hashedToken);
+  if (!token) return null;
+  if (token.id !== parsed.id) return null;
+  if (token.expiresAt && /* @__PURE__ */ new Date() > token.expiresAt) {
+    return null;
+  }
+  if (!secureCompare(token.hashedToken, hashedToken)) {
+    return null;
+  }
+  if (updateLastUsed) {
+    await store.updateLastUsed(token.id, /* @__PURE__ */ new Date());
+  }
+  return {
+    token,
+    userId: token.userId,
+    abilities: token.abilities
+  };
+}
+function tokenCan(token, ability) {
+  if (token.abilities.includes("*")) return true;
+  return token.abilities.includes(ability);
+}
+function tokenCanAll(token, abilities) {
+  if (token.abilities.includes("*")) return true;
+  return abilities.every((ability) => token.abilities.includes(ability));
+}
+function tokenCanAny(token, abilities) {
+  if (token.abilities.includes("*")) return true;
+  return abilities.some((ability) => token.abilities.includes(ability));
+}
+async function revokeApiToken(id, store) {
+  await store.delete(id);
+}
+async function revokeAllApiTokens(userId, store) {
+  await store.deleteForUser(userId);
+}
+async function getUserApiTokens(userId, store) {
+  return store.findByUserId(userId);
+}
+var API_TOKEN_KEY = "guren:api-token";
+function createBearerTokenMiddleware(options) {
+  const {
+    store,
+    loadUser,
+    abilities,
+    onUnauthorized,
+    onForbidden,
+    headerName = "Authorization",
+    updateLastUsed = true
+  } = options;
+  return async (ctx, next) => {
+    const authHeader = ctx.req.header(headerName);
+    if (!authHeader) {
+      if (onUnauthorized) return onUnauthorized(ctx);
+      return ctx.json({ error: "Authentication required" }, 401);
+    }
+    const match = authHeader.match(/^Bearer\s+(.+)$/i);
+    if (!match) {
+      if (onUnauthorized) return onUnauthorized(ctx);
+      return ctx.json({ error: "Invalid authorization format" }, 401);
+    }
+    const plainTextToken = match[1];
+    const result = await verifyApiToken(plainTextToken, store, { updateLastUsed });
+    if (!result) {
+      if (onUnauthorized) return onUnauthorized(ctx);
+      return ctx.json({ error: "Invalid or expired token" }, 401);
+    }
+    if (abilities && abilities.length > 0) {
+      if (!tokenCanAll(result.token, abilities)) {
+        if (onForbidden) return onForbidden(ctx, abilities);
+        return ctx.json(
+          { error: "Token lacks required abilities", required: abilities },
+          403
+        );
+      }
+    }
+    ctx.set(API_TOKEN_KEY, result);
+    if (loadUser) {
+      const user = await loadUser(result.userId);
+      ctx.set("guren:user", user);
+    }
+    return next();
+  };
+}
+function getApiToken(ctx) {
+  return ctx.get(API_TOKEN_KEY);
+}
+function getApiTokenOrFail(ctx) {
+  const result = getApiToken(ctx);
+  if (!result) {
+    throw new AuthenticationException("Unauthenticated.");
+  }
+  return result;
+}
+
+// src/auth/oauth/index.ts
+var DEFAULT_STATE_EXPIRES_IN = 10 * 60 * 1e3;
+var DEFAULT_STATE_LENGTH = 24;
+var DEFAULT_STATE_HASH_ALGORITHM = "sha256";
+var MemoryOAuthStateStore = class {
+  states = /* @__PURE__ */ new Map();
+  maxEntries;
+  constructor(options = {}) {
+    this.maxEntries = options.maxEntries ?? 1e4;
+  }
+  async store(stateHash, payload) {
+    if (this.states.size >= this.maxEntries) {
+      this.sweepExpired();
+    }
+    while (this.states.size >= this.maxEntries) {
+      const oldest = this.states.keys().next().value;
+      if (oldest === void 0) break;
+      this.states.delete(oldest);
+    }
+    this.states.set(stateHash, payload);
+  }
+  sweepExpired() {
+    const now = Date.now();
+    for (const [hash, payload] of this.states) {
+      if (payload.expiresAt.getTime() <= now) {
+        this.states.delete(hash);
+      }
+    }
+  }
+  async find(stateHash) {
+    const payload = this.states.get(stateHash);
+    if (!payload) return null;
+    if (payload.expiresAt.getTime() <= Date.now()) {
+      this.states.delete(stateHash);
+      return null;
+    }
+    return payload;
+  }
+  async delete(stateHash) {
+    this.states.delete(stateHash);
+  }
+  clear() {
+    this.states.clear();
+  }
+};
+var OAuthManager = class {
+  providers = /* @__PURE__ */ new Map();
+  stateStore;
+  stateConfig;
+  constructor(options = {}) {
+    this.stateStore = options.stateStore ?? new MemoryOAuthStateStore();
+    this.stateConfig = {
+      expiresIn: options.stateConfig?.expiresIn ?? DEFAULT_STATE_EXPIRES_IN,
+      stateLength: options.stateConfig?.stateLength ?? DEFAULT_STATE_LENGTH,
+      hashAlgorithm: options.stateConfig?.hashAlgorithm ?? DEFAULT_STATE_HASH_ALGORITHM
+    };
+  }
+  registerProvider(name, config) {
+    this.providers.set(name, config);
+  }
+  providerNames() {
+    return Array.from(this.providers.keys()).sort((a, b) => a.localeCompare(b));
+  }
+  getProvider(name) {
+    const provider = this.providers.get(name);
+    if (!provider) {
+      throw new AuthenticationException(`OAuth provider "${name}" is not configured.`);
+    }
+    return provider;
+  }
+  async authorize(providerName, options = {}) {
+    const provider = this.getProvider(providerName);
+    const { state, expiresAt } = await createOAuthState(
+      providerName,
+      this.stateStore,
+      this.stateConfig,
+      options.redirectTo,
+      options.state
+    );
+    const scope = options.scope ?? provider.scopes;
+    const url = buildOAuthAuthorizeUrl(provider, state, { scope, extraParams: options.extraParams });
+    return { url, state, expiresAt };
+  }
+  async user(providerName, payload) {
+    const provider = this.getProvider(providerName);
+    const verified = await verifyOAuthState(payload.state, providerName, this.stateStore, this.stateConfig);
+    if (!verified) {
+      throw new AuthenticationException("Invalid or expired OAuth state.");
+    }
+    const token = await exchangeOAuthCode(provider, payload.code);
+    return fetchOAuthUserProfile(provider, token);
+  }
+};
+function createOAuthManager(options = {}) {
+  return new OAuthManager(options);
+}
+async function createOAuthState(provider, store, config = {}, redirectTo, fixedState) {
+  const state = fixedState ?? generateToken(config.stateLength ?? DEFAULT_STATE_LENGTH);
+  const hashAlgorithm = config.hashAlgorithm ?? DEFAULT_STATE_HASH_ALGORITHM;
+  const expiresAt = new Date(Date.now() + (config.expiresIn ?? DEFAULT_STATE_EXPIRES_IN));
+  const stateHash = hashToken(state, hashAlgorithm);
+  await store.store(stateHash, { provider, redirectTo, expiresAt });
+  return { state, expiresAt };
+}
+async function verifyOAuthState(state, provider, store, config = {}) {
+  const hashAlgorithm = config.hashAlgorithm ?? DEFAULT_STATE_HASH_ALGORITHM;
+  const stateHash = hashToken(state, hashAlgorithm);
+  const payload = await store.find(stateHash);
+  if (!payload) return null;
+  await store.delete(stateHash);
+  if (payload.provider !== provider) return null;
+  return payload;
+}
+function buildOAuthAuthorizeUrl(provider, state, options = {}) {
+  const url = new URL(provider.authorizeUrl);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", provider.clientId);
+  url.searchParams.set("redirect_uri", provider.redirectUri);
+  url.searchParams.set("state", state);
+  const scopes = options.scope ?? provider.scopes;
+  if (scopes && scopes.length > 0) {
+    url.searchParams.set("scope", scopes.join(" "));
+  }
+  for (const [key, value] of Object.entries(options.extraParams ?? {})) {
+    url.searchParams.set(key, value);
+  }
+  return url.toString();
+}
+async function exchangeOAuthCode(provider, code) {
+  const params = new URLSearchParams({
+    grant_type: "authorization_code",
+    code,
+    redirect_uri: provider.redirectUri,
+    client_id: provider.clientId
+  });
+  const headers = {
+    Accept: "application/json",
+    "Content-Type": "application/x-www-form-urlencoded"
+  };
+  if (provider.tokenAuthMethod === "client_secret_basic") {
+    const credentials = Buffer.from(`${provider.clientId}:${provider.clientSecret}`).toString("base64");
+    headers.Authorization = `Basic ${credentials}`;
+  } else {
+    params.set("client_secret", provider.clientSecret);
+  }
+  const response = await fetch(provider.tokenUrl, {
+    method: "POST",
+    headers,
+    body: params.toString()
+  });
+  if (!response.ok) {
+    throw new AuthenticationException(`OAuth token exchange failed (${response.status}).`);
+  }
+  const raw = await response.json();
+  const accessToken = typeof raw.access_token === "string" ? raw.access_token : "";
+  if (!accessToken) {
+    throw new AuthenticationException("OAuth token exchange did not return an access token.");
+  }
+  return {
+    accessToken,
+    tokenType: typeof raw.token_type === "string" ? raw.token_type : void 0,
+    refreshToken: typeof raw.refresh_token === "string" ? raw.refresh_token : void 0,
+    expiresIn: typeof raw.expires_in === "number" ? raw.expires_in : void 0,
+    scope: typeof raw.scope === "string" ? raw.scope : void 0,
+    raw
+  };
+}
+async function fetchOAuthUserProfile(provider, token) {
+  const response = await fetch(provider.userInfoUrl, {
+    method: provider.userInfoMethod ?? "GET",
+    headers: {
+      Accept: "application/json",
+      Authorization: `Bearer ${token.accessToken}`,
+      "User-Agent": "guren-oauth"
+    }
+  });
+  if (!response.ok) {
+    throw new AuthenticationException(`OAuth user fetch failed (${response.status}).`);
+  }
+  const raw = await response.json();
+  if (provider.mapProfile) {
+    return provider.mapProfile(raw, token);
+  }
+  const idCandidate = raw.id ?? raw.sub;
+  const id = typeof idCandidate === "string" || typeof idCandidate === "number" ? String(idCandidate) : "";
+  if (!id) {
+    throw new AuthenticationException("OAuth user profile is missing an identifier.");
+  }
+  return {
+    id,
+    email: typeof raw.email === "string" ? raw.email : void 0,
+    name: typeof raw.name === "string" ? raw.name : void 0,
+    avatar: typeof raw.avatar_url === "string" ? raw.avatar_url : typeof raw.picture === "string" ? raw.picture : typeof raw.avatar === "string" ? raw.avatar : void 0,
+    token,
+    raw
+  };
+}
+function createGitHubOAuthProviderConfig(input) {
+  return {
+    ...input,
+    authorizeUrl: "https://github.com/login/oauth/authorize",
+    tokenUrl: "https://github.com/login/oauth/access_token",
+    userInfoUrl: "https://api.github.com/user",
+    scopes: input.scopes ?? ["read:user", "user:email"]
+  };
+}
+function createGoogleOAuthProviderConfig(input) {
+  return {
+    ...input,
+    authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+    tokenUrl: "https://oauth2.googleapis.com/token",
+    userInfoUrl: "https://openidconnect.googleapis.com/v1/userinfo",
+    scopes: input.scopes ?? ["openid", "profile", "email"]
+  };
+}
+function createDiscordOAuthProviderConfig(input) {
+  return {
+    ...input,
+    authorizeUrl: "https://discord.com/api/oauth2/authorize",
+    tokenUrl: "https://discord.com/api/oauth2/token",
+    userInfoUrl: "https://discord.com/api/users/@me",
+    scopes: input.scopes ?? ["identify", "email"]
+  };
+}
+function buildOAuthRedirectUrl(baseUrl, token, email) {
+  return buildTokenUrl(baseUrl, token, email);
+}
+function parseOAuthRedirectUrl(url) {
+  return parseTokenUrl(url);
+}
+
+export {
+  MemorySessionStore,
+  createSessionMiddleware,
+  getSessionFromContext,
+  ScryptHasher,
+  BaseUserProvider,
+  ModelUserProvider,
+  hashToken,
+  generateToken,
+  generateId,
+  secureCompare,
+  secureStringCompare,
+  buildTokenUrl,
+  parseTokenUrl,
+  SessionGuard,
+  AuthManager,
+  MemoryApiTokenStore,
+  createApiToken,
+  parseApiToken,
+  verifyApiToken,
+  tokenCan,
+  tokenCanAll,
+  tokenCanAny,
+  revokeApiToken,
+  revokeAllApiTokens,
+  getUserApiTokens,
+  API_TOKEN_KEY,
+  createBearerTokenMiddleware,
+  getApiToken,
+  getApiTokenOrFail,
+  MemoryOAuthStateStore,
+  OAuthManager,
+  createOAuthManager,
+  createOAuthState,
+  verifyOAuthState,
+  buildOAuthAuthorizeUrl,
+  exchangeOAuthCode,
+  fetchOAuthUserProfile,
+  createGitHubOAuthProviderConfig,
+  createGoogleOAuthProviderConfig,
+  createDiscordOAuthProviderConfig,
+  buildOAuthRedirectUrl,
+  parseOAuthRedirectUrl,
+  NodeHasher,
+  AuthenticatableModel,
+  MemoryPasswordResetStore,
+  createPasswordResetToken,
+  verifyPasswordResetToken,
+  completePasswordReset,
+  buildPasswordResetUrl,
+  parsePasswordResetUrl,
+  MemoryEmailVerificationStore,
+  createEmailVerificationToken,
+  verifyEmailToken,
+  completeEmailVerification,
+  buildVerificationUrl,
+  parseVerificationUrl,
+  isEmailVerified,
+  requireVerifiedEmail
+};