@labyrinthe/otp-widget 0.0.0-stage → 1.2.0

package/dist/server.js

@@ -0,0 +1,610 @@
+// src/phone.ts
+var DEFAULT_COUNTRY_CODE = "243";
+function normalizePhone(raw, defaultCountryCode = DEFAULT_COUNTRY_CODE) {
+  if (!isCountryCode(defaultCountryCode)) {
+    return null;
+  }
+  const input = raw.trim();
+  if (input === "") {
+    return null;
+  }
+  const explicitInternational = input.startsWith("+") || input.startsWith("00");
+  let digits = input.replace(/\D/g, "");
+  if (explicitInternational) {
+    digits = input.startsWith("00") ? digits.slice(2) : digits;
+  } else if (digits.startsWith(defaultCountryCode) && digits.length > 10) ; else if (digits.length >= 11 && !digits.startsWith("0")) ; else {
+    digits = defaultCountryCode + digits.replace(/^0+/, "");
+  }
+  return digits.length >= 8 && digits.length <= 15 ? digits : null;
+}
+function isCountryCode(value) {
+  return /^[1-9]\d{0,2}$/.test(value);
+}
+function maskPhone(phone) {
+  const digits = phone.replace(/\D/g, "");
+  if (digits.length <= 6) {
+    return "\u2022".repeat(digits.length);
+  }
+  return `+${digits.slice(0, 3)} ${digits.slice(3, 5)}${"\u2022".repeat(digits.length - 7)}${digits.slice(-2)}`;
+}
+
+// src/server/session.ts
+function memoryStore() {
+  const entries = /* @__PURE__ */ new Map();
+  return {
+    get size() {
+      return entries.size;
+    },
+    get(id) {
+      const entry = entries.get(id);
+      if (entry === void 0 || entry.until < Date.now()) {
+        entries.delete(id);
+        return null;
+      }
+      return { ...entry.state };
+    },
+    set(id, state, ttlSeconds) {
+      entries.set(id, { state: { ...state }, until: Date.now() + ttlSeconds * 1e3 });
+    },
+    delete(id) {
+      entries.delete(id);
+    }
+  };
+}
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+var TOKEN_PREFIX = "v1.";
+var IV_LENGTH = 12;
+var cryptoPromise;
+function getCrypto() {
+  const g = globalThis;
+  if (g.crypto?.subtle !== void 0) {
+    return Promise.resolve(g.crypto);
+  }
+  cryptoPromise ??= (async () => {
+    const specifier = ["node", "crypto"].join(":");
+    const mod = await import(
+      /* webpackIgnore: true */
+      /* @vite-ignore */
+      specifier
+    );
+    if (mod.webcrypto?.subtle === void 0) {
+      throw new Error("Web Crypto is not available in this runtime.");
+    }
+    return mod.webcrypto;
+  })();
+  return cryptoPromise;
+}
+var Sealer = class {
+  #key;
+  #macKey;
+  constructor(secret) {
+    const material = (async () => {
+      const crypto = await getCrypto();
+      return crypto.subtle.importKey("raw", encoder.encode(secret), "HKDF", false, ["deriveKey"]);
+    })();
+    const derive = async (info, algorithm, usages) => {
+      const crypto = await getCrypto();
+      return crypto.subtle.deriveKey(
+        { name: "HKDF", hash: "SHA-256", salt: encoder.encode("labyrinthe-otp-widget"), info: encoder.encode(info) },
+        await material,
+        algorithm,
+        false,
+        usages
+      );
+    };
+    this.#key = derive("session-cookie-v1", { name: "AES-GCM", length: 256 }, ["encrypt", "decrypt"]);
+    this.#macKey = derive("idempotency-key-v1", { name: "HMAC", hash: "SHA-256", length: 256 }, ["sign"]);
+  }
+  /** HMAC-SHA-256 de `value` en base64url (43 caractères) : identifiant stable, non devinable sans le secret. */
+  async tag(value) {
+    const crypto = await getCrypto();
+    return toBase64Url(new Uint8Array(await crypto.subtle.sign("HMAC", await this.#macKey, encoder.encode(value))));
+  }
+  /** `context` (nom du cookie) est authentifié avec le contenu : un jeton ne sert que là où il a été émis. */
+  async seal(value, context) {
+    const crypto = await getCrypto();
+    const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));
+    const cipher = await crypto.subtle.encrypt(
+      { name: "AES-GCM", iv, additionalData: encoder.encode(context) },
+      await this.#key,
+      encoder.encode(JSON.stringify(value))
+    );
+    const bytes = new Uint8Array(IV_LENGTH + cipher.byteLength);
+    bytes.set(iv, 0);
+    bytes.set(new Uint8Array(cipher), IV_LENGTH);
+    return TOKEN_PREFIX + toBase64Url(bytes);
+  }
+  /** null si le jeton est absent, altéré, émis avec un autre secret ou illisible. */
+  async open(token, context) {
+    if (typeof token !== "string" || !token.startsWith(TOKEN_PREFIX) || token.length > 4096) {
+      return null;
+    }
+    try {
+      const bytes = fromBase64Url(token.slice(TOKEN_PREFIX.length));
+      if (bytes.length <= IV_LENGTH) {
+        return null;
+      }
+      const crypto = await getCrypto();
+      const plain = await crypto.subtle.decrypt(
+        { name: "AES-GCM", iv: bytes.slice(0, IV_LENGTH), additionalData: encoder.encode(context) },
+        await this.#key,
+        bytes.slice(IV_LENGTH)
+      );
+      return JSON.parse(decoder.decode(plain));
+    } catch {
+      return null;
+    }
+  }
+};
+async function randomId() {
+  const crypto = await getCrypto();
+  return toBase64Url(crypto.getRandomValues(new Uint8Array(32)));
+}
+function isSessionState(value) {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const v = value;
+  return typeof v["otpId"] === "string" && typeof v["phone"] === "string" && typeof v["expiresAt"] === "number" && (v["attemptsLeft"] === null || typeof v["attemptsLeft"] === "number");
+}
+function toBase64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromBase64Url(value) {
+  if (!/^[A-Za-z0-9_-]*$/.test(value)) {
+    throw new Error("invalid base64url");
+  }
+  const binary = atob(value.replace(/-/g, "+").replace(/_/g, "/"));
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+function readCookie(header, name) {
+  if (header === null) {
+    return null;
+  }
+  for (const part of header.split(";")) {
+    const index = part.indexOf("=");
+    if (index > 0 && part.slice(0, index).trim() === name) {
+      return part.slice(index + 1).trim();
+    }
+  }
+  return null;
+}
+function serializeCookie(name, value, maxAgeSeconds, options) {
+  let cookie = `${name}=${value}; Max-Age=${String(Math.max(0, Math.floor(maxAgeSeconds)))}; Path=${options.path}; HttpOnly; SameSite=${options.sameSite}`;
+  if (options.domain !== void 0) {
+    cookie += `; Domain=${options.domain}`;
+  }
+  if (options.secure) {
+    cookie += "; Secure";
+  }
+  return cookie;
+}
+
+// src/server/index.ts
+var MAX_BODY_BYTES = 4096;
+var MAX_CODE_LENGTH = 20;
+var DEFAULT_RESEND_AFTER = 60;
+var COOKIE_GRACE_SECONDS = 300;
+var HttpError = class extends Error {
+  constructor(status, code, message, retryAfterSeconds, maintenance2) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.retryAfterSeconds = retryAfterSeconds;
+    this.maintenance = maintenance2;
+  }
+  status;
+  code;
+  retryAfterSeconds;
+  maintenance;
+};
+function createOtpHandlers(options) {
+  const secret = options.secret ?? readEnv("LABYRINTHE_OTP_SECRET");
+  if (secret === void 0 || secret.length < 32) {
+    throw new Error("createOtpHandlers: `secret` (or LABYRINTHE_OTP_SECRET) must be at least 32 characters.");
+  }
+  if (typeof options.onVerified !== "function") {
+    throw new Error("createOtpHandlers: `onVerified` is required (it is where the verified phone number is trusted).");
+  }
+  if (options.exposeTestCode === true && readEnv("NODE_ENV") === "production") {
+    throw new Error('createOtpHandlers: `exposeTestCode` is for development only and is refused when NODE_ENV is "production".');
+  }
+  const defaultCountryCode = options.defaultCountryCode ?? DEFAULT_COUNTRY_CODE;
+  if (!isCountryCode(defaultCountryCode)) {
+    throw new Error('createOtpHandlers: `defaultCountryCode` must be 1 to 3 digits without "+".');
+  }
+  if (options.template !== void 0 && !options.template.includes("{code}")) {
+    throw new Error("createOtpHandlers: `template` must contain the {code} token.");
+  }
+  if (options.webOtpDomain !== void 0 && !WEB_OTP_DOMAIN.test(options.webOtpDomain)) {
+    throw new Error('createOtpHandlers: `webOtpDomain` must be a host name such as "app.example.com" (no scheme, port or path).');
+  }
+  const sealer = new Sealer(secret);
+  const cookieName = options.cookie?.name ?? "labyrinthe_otp";
+  let client;
+  const getClient = () => client ??= typeof options.client === "function" ? options.client() : options.client;
+  const cookieAttributes = (request) => ({
+    path: options.cookie?.path ?? "/",
+    domain: options.cookie?.domain,
+    sameSite: options.cookie?.sameSite ?? "Strict",
+    secure: options.cookie?.secure ?? (isHttps(request) || readEnv("NODE_ENV") === "production")
+  });
+  async function loadState(request) {
+    const payload = await sealer.open(readCookie(request.header("cookie"), cookieName), cookieName);
+    if (payload === null || typeof payload !== "object") {
+      return { state: null, sid: null };
+    }
+    if (options.store !== void 0) {
+      if (typeof payload.sid !== "string") {
+        return { state: null, sid: null };
+      }
+      const stored = await options.store.get(payload.sid);
+      return { state: isSessionState(stored) ? stored : null, sid: payload.sid };
+    }
+    return { state: isSessionState(payload.s) ? payload.s : null, sid: null };
+  }
+  async function saveState(request, result, state, sid) {
+    const ttl = Math.max(1, Math.ceil((state.expiresAt - Date.now()) / 1e3) + COOKIE_GRACE_SECONDS);
+    let payload;
+    if (options.store !== void 0) {
+      const id = sid ?? await randomId();
+      await options.store.set(id, state, ttl);
+      payload = { sid: id };
+    } else {
+      payload = { s: state };
+    }
+    result.cookies.push(serializeCookie(cookieName, await sealer.seal(payload, cookieName), ttl, cookieAttributes(request)));
+  }
+  async function clearState(request, result, sid) {
+    if (sid !== null && options.store !== void 0) {
+      await options.store.delete(sid);
+    }
+    result.cookies.push(serializeCookie(cookieName, "", 0, cookieAttributes(request)));
+  }
+  async function readJson(request) {
+    if (request.method !== "POST") {
+      throw new HttpError(405, "invalid_request", "Use POST.");
+    }
+    if (!originAllowed(request, options.allowedOrigins)) {
+      throw new HttpError(403, "forbidden", "Origin not allowed.");
+    }
+    if (!(request.header("content-type") ?? "").toLowerCase().includes("application/json")) {
+      throw new HttpError(415, "invalid_request", "Content-Type must be application/json.");
+    }
+    const text = await request.text();
+    if (text.length > MAX_BODY_BYTES) {
+      throw new HttpError(413, "invalid_request", "Request body too large.");
+    }
+    let body;
+    try {
+      body = JSON.parse(text);
+    } catch {
+      throw new HttpError(400, "invalid_request", "Invalid JSON.");
+    }
+    if (typeof body !== "object" || body === null || Array.isArray(body)) {
+      throw new HttpError(400, "invalid_request", "Expected a JSON object.");
+    }
+    return body;
+  }
+  async function send(request, result) {
+    const body = await readJson(request);
+    const phone = typeof body["phone"] === "string" ? normalizePhone(body["phone"], defaultCountryCode) : null;
+    if (phone === null) {
+      throw new HttpError(422, "invalid_phone", "Invalid phone number.");
+    }
+    if (options.beforeSend !== void 0 && await options.beforeSend({ phone, request: request.source }) === false) {
+      throw new HttpError(403, "forbidden", "Refused.");
+    }
+    const locale = options.locale ?? (body["locale"] === "fr" || body["locale"] === "en" ? body["locale"] : void 0);
+    const nonce = body["send_id"];
+    if (nonce !== void 0 && (typeof nonce !== "string" || !SEND_ID.test(nonce))) {
+      throw new HttpError(400, "invalid_request", "Invalid send_id.");
+    }
+    const idempotencyKey = nonce === void 0 ? void 0 : `otp-widget-${await sealer.tag(`send:${nonce}`)}`;
+    let sent;
+    try {
+      sent = await getClient().otp.send({
+        // « + » explicite : le numéro est déjà international, l'indicatif par défaut ne doit pas s'y ajouter.
+        phone: `+${phone}`,
+        ...options.template === void 0 ? {} : { template: options.template },
+        ...locale === void 0 ? {} : { locale },
+        ...options.webOtpDomain === void 0 ? {} : { webOtpDomain: options.webOtpDomain },
+        ...options.stripAccents === void 0 ? {} : { stripAccents: options.stripAccents },
+        ...idempotencyKey === void 0 ? {} : { idempotencyKey }
+      });
+    } catch (error) {
+      throw upstreamError(error, "send", options.onError);
+    }
+    const previous = await loadState(request);
+    const state = {
+      otpId: sent.otpId,
+      phone,
+      expiresAt: sent.expiresAt.getTime(),
+      attemptsLeft: sent.maxAttempts
+    };
+    if (previous.sid !== null && options.store !== void 0) {
+      await options.store.delete(previous.sid);
+    }
+    await saveState(request, result, state, null);
+    const codeLength = options.codeLength ?? positiveInt(sent.codeLength);
+    const codeType = options.codeType ?? (sent.codeType === "numeric" || sent.codeType === "alphanumeric" ? sent.codeType : void 0);
+    const resendAfter = options.resendAfterSeconds ?? nonNegativeInt(sent.resendAfterSeconds) ?? DEFAULT_RESEND_AFTER;
+    const response = {
+      sent: true,
+      phone_masked: maskPhone(phone),
+      expires_at: sent.expiresAt.toISOString(),
+      max_attempts: sent.maxAttempts,
+      resend_after_seconds: resendAfter,
+      ...codeLength === void 0 ? {} : { code_length: codeLength },
+      ...codeType === void 0 ? {} : { code_type: codeType }
+    };
+    const testCode = sent.testCode;
+    if (options.exposeTestCode === true && typeof testCode === "string" && testCode !== "") {
+      response.test_code = testCode;
+    }
+    result.body = response;
+  }
+  async function verify(request, result) {
+    const body = await readJson(request);
+    const code = typeof body["code"] === "string" ? body["code"].trim() : "";
+    if (code === "" || code.length > MAX_CODE_LENGTH) {
+      throw new HttpError(422, "invalid_request", `The code must be 1 to ${String(MAX_CODE_LENGTH)} characters.`);
+    }
+    const { state, sid } = await loadState(request);
+    if (state === null) {
+      await clearState(request, result, sid);
+      throw new HttpError(400, "no_pending_verification", "No pending verification: send a new code.");
+    }
+    if (state.expiresAt <= Date.now()) {
+      await clearState(request, result, sid);
+      result.body = { verified: false, reason: "expired", attempts_left: null };
+      return;
+    }
+    let checked;
+    try {
+      checked = await getClient().otp.verify({ otpId: state.otpId, code });
+    } catch (error) {
+      if (errorCode(error) === "NOT_FOUND") {
+        await clearState(request, result, sid);
+        throw new HttpError(400, "no_pending_verification", "No pending verification: send a new code.");
+      }
+      throw upstreamError(error, "verify", options.onError);
+    }
+    if (checked.verified) {
+      await clearState(request, result, sid);
+      const data = await options.onVerified({
+        phone: state.phone,
+        request: request.source,
+        responseHeaders: result.headers,
+        setCookie: (cookie) => result.cookies.push(cookie)
+      });
+      result.body = data === void 0 ? { verified: true } : { verified: true, data };
+      return;
+    }
+    const reason = checked.reason === "expired" || checked.reason === "already_used" || checked.reason === "max_attempts_reached" ? checked.reason : "invalid_code";
+    if (reason === "invalid_code") {
+      const fromApi = nonNegativeInt(checked.attemptsRemaining);
+      const attemptsLeft = fromApi ?? (state.attemptsLeft === null ? null : Math.max(0, state.attemptsLeft - 1));
+      await saveState(request, result, { ...state, attemptsLeft }, sid);
+      result.body = { verified: false, reason, attempts_left: attemptsLeft };
+    } else {
+      await clearState(request, result, sid);
+      result.body = { verified: false, reason, attempts_left: reason === "max_attempts_reached" ? 0 : null };
+    }
+  }
+  async function run(action, request) {
+    const result = { status: 200, body: { verified: false, reason: "invalid_code", attempts_left: null }, headers: new Headers(), cookies: [] };
+    try {
+      await (action === "send" ? send : verify)(request, result);
+    } catch (error) {
+      const httpError = error instanceof HttpError ? error : (options.onError?.(error, { action }), new HttpError(500, "server_error", "Unexpected error."));
+      result.status = httpError.status;
+      result.body = {
+        error: {
+          code: httpError.code,
+          message: httpError.message,
+          ...httpError.retryAfterSeconds === void 0 ? {} : { retry_after_seconds: httpError.retryAfterSeconds },
+          ...httpError.maintenance?.adminMessage === void 0 ? {} : { admin_message: httpError.maintenance.adminMessage },
+          ...httpError.maintenance?.until === void 0 ? {} : { until: httpError.maintenance.until }
+        }
+      };
+      if (httpError.retryAfterSeconds !== void 0) {
+        result.headers.set("Retry-After", String(httpError.retryAfterSeconds));
+      }
+    }
+    result.headers.set("Content-Type", "application/json");
+    result.headers.set("Cache-Control", "no-store");
+    return result;
+  }
+  const fetchHandler = (action) => async (request) => {
+    const result = await run(action, fromFetch(request));
+    const headers = new Headers(result.headers);
+    for (const cookie of result.cookies) {
+      headers.append("Set-Cookie", cookie);
+    }
+    return new Response(JSON.stringify(result.body), { status: result.status, headers });
+  };
+  const expressHandler = (action) => async (req, res, next) => {
+    try {
+      const result = await run(action, fromExpress(req));
+      res.statusCode = result.status;
+      result.headers.forEach((value, name) => {
+        res.setHeader(name, value);
+      });
+      if (result.cookies.length > 0) {
+        res.setHeader("Set-Cookie", result.cookies);
+      }
+      res.end(JSON.stringify(result.body));
+    } catch (error) {
+      next(error);
+    }
+  };
+  return {
+    send: fetchHandler("send"),
+    verify: fetchHandler("verify"),
+    express: { send: expressHandler("send"), verify: expressHandler("verify") }
+  };
+}
+function errorCode(error) {
+  const code = error?.code;
+  return typeof code === "string" ? code : null;
+}
+function upstreamError(error, action, onError) {
+  const code = errorCode(error);
+  switch (code) {
+    case "INVALID_ARGUMENT":
+    case "INVALID_PHONE":
+    case "RECIPIENT_NOT_SENDABLE":
+      return new HttpError(422, "invalid_phone", "This phone number cannot receive a code.");
+    case "OTP_RESEND_TOO_SOON":
+      return new HttpError(429, "resend_too_soon", "A code was sent recently.", retryAfter(error) ?? 30);
+    case "OTP_RATE_LIMITED":
+    case "TOO_MANY_REQUESTS":
+      return new HttpError(429, "rate_limited", "Too many requests.", retryAfter(error));
+    case "IDEMPOTENCY_REQUEST_IN_PROGRESS":
+      return new HttpError(429, "rate_limited", "A send is still in progress.", retryAfter(error) ?? 5);
+    case "IDEMPOTENCY_KEY_UNRESOLVED":
+      onError?.(error, { action });
+      return new HttpError(502, "send_failed", "The code may not have been sent.");
+    case "FEATURE_DISABLED":
+    case "OTP_SERVICE_DISABLED":
+      onError?.(error, { action });
+      return new HttpError(
+        503,
+        "service_unavailable",
+        "The verification service is temporarily unavailable.",
+        featureRetryAfter(error),
+        maintenance(error)
+      );
+    case "ACCOUNT_SUSPENDED":
+      onError?.(error, { action });
+      return new HttpError(503, "account_suspended", "The verification service is unavailable.");
+    default:
+      onError?.(error, { action });
+      return new HttpError(503, "service_unavailable", "The verification service is unavailable.");
+  }
+}
+var WEB_OTP_DOMAIN = /^(?=.{1,253}$)([A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;
+var SEND_ID = /^[A-Za-z0-9_-]{16,64}$/;
+function positiveInt(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 1 ? value : void 0;
+}
+function nonNegativeInt(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 0 ? value : void 0;
+}
+function retryAfter(error) {
+  const ms = error?.retryAfterMs;
+  if (typeof ms === "number" && ms >= 0) {
+    return Math.ceil(ms / 1e3);
+  }
+  const seconds = error?.details?.retry_after_seconds;
+  return typeof seconds === "number" && seconds >= 0 ? Math.ceil(seconds) : void 0;
+}
+function featureRetryAfter(error) {
+  const ms = error?.retryAfterMs;
+  if (typeof ms === "number" && ms >= 0) {
+    return Math.max(1, Math.ceil(ms / 1e3));
+  }
+  const header = error?.headers?.["retry-after"];
+  return typeof header === "string" && /^\d+$/.test(header.trim()) ? Math.max(1, Number(header.trim())) : void 0;
+}
+function maintenance(error) {
+  const details = error?.details ?? {};
+  const message = typeof details["message"] === "string" ? details["message"].trim().slice(0, 500) : "";
+  const until = details["until"];
+  return {
+    ...message === "" ? {} : { adminMessage: message },
+    ...typeof until === "string" && !Number.isNaN(Date.parse(until)) ? { until } : {}
+  };
+}
+function originAllowed(request, allowed) {
+  const origin = request.header("origin");
+  if (allowed !== void 0) {
+    return origin === null ? request.header("sec-fetch-site") !== "cross-site" : allowed.includes(origin);
+  }
+  if (request.header("sec-fetch-site") === "cross-site") {
+    return false;
+  }
+  if (origin === null) {
+    return true;
+  }
+  const host = request.header("x-forwarded-host") ?? request.header("host") ?? safeHost(request.url);
+  try {
+    return new URL(origin).host === host;
+  } catch {
+    return false;
+  }
+}
+function isHttps(request) {
+  const forwarded = request.header("x-forwarded-proto");
+  if (forwarded !== null) {
+    return forwarded.split(",")[0]?.trim() === "https";
+  }
+  return request.url.startsWith("https:");
+}
+function safeHost(url) {
+  try {
+    return new URL(url).host;
+  } catch {
+    return null;
+  }
+}
+function fromFetch(request) {
+  return {
+    method: request.method.toUpperCase(),
+    url: request.url,
+    header: (name) => request.headers.get(name),
+    text: () => request.text(),
+    source: request
+  };
+}
+function fromExpress(req) {
+  const header = (name) => {
+    const value = req.headers[name.toLowerCase()];
+    return Array.isArray(value) ? value.join(name.toLowerCase() === "cookie" ? "; " : ", ") : value ?? null;
+  };
+  return {
+    method: (req.method ?? "POST").toUpperCase(),
+    url: `${req.protocol ?? "http"}://${header("host") ?? "localhost"}${req.originalUrl ?? req.url ?? "/"}`,
+    header,
+    text: async () => {
+      if (typeof req.body === "string") {
+        return req.body;
+      }
+      if (req.body instanceof Uint8Array) {
+        return new TextDecoder().decode(req.body);
+      }
+      if (req.body !== void 0) {
+        return JSON.stringify(req.body);
+      }
+      const decoder2 = new TextDecoder();
+      let text = "";
+      for await (const chunk of req) {
+        text += typeof chunk === "string" ? chunk : decoder2.decode(chunk, { stream: true });
+        if (text.length > MAX_BODY_BYTES) {
+          break;
+        }
+      }
+      return text + decoder2.decode();
+    },
+    source: req
+  };
+}
+function readEnv(name) {
+  try {
+    return globalThis.process?.env?.[name];
+  } catch {
+    return void 0;
+  }
+}
+
+export { createOtpHandlers, memoryStore };