@madauth/server 0.1.0

package/dist/chunk-V2XKGETK.js

@@ -0,0 +1,386 @@
+import {
+  assertPrivateSigningJwk,
+  generateSigningKey
+} from "./chunk-JDQLSL36.js";
+import {
+  WEBHOOK_TYPES,
+  checkWebhookSecret,
+  generateWebhookSecret
+} from "./chunk-AVZE6FFR.js";
+
+// src/config.ts
+var envVars = {
+  MADAUTH_ISSUER: true,
+  MADAUTH_SIGNING_KEY: true,
+  ALLOWED_ORIGINS: true,
+  GOOGLE_CLIENT_ID: false,
+  GOOGLE_CLIENT_SECRET: false,
+  DATABASE_URL: false,
+  PASSWORD_MIN_LENGTH: false,
+  WEBHOOK_URL: false,
+  WEBHOOK_SECRET: false,
+  WEBHOOK_EVENTS: false,
+  SESSION_TTL: false,
+  COOKIE_DOMAIN: false
+};
+var DEFAULT_SESSION_TTL = 8 * 60 * 60;
+var DEFAULT_PASSWORD_MIN_LENGTH = 8;
+var ConfigError = class extends Error {
+  constructor() {
+    super(...arguments);
+    this.name = "ConfigError";
+  }
+};
+function parseOrigin(name, value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new ConfigError(`${name}: "${value}" is not a URL.`);
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw new ConfigError(`${name}: "${value}" must be an http(s) URL.`);
+  }
+  return url.origin;
+}
+function readEnv(env, name) {
+  return env[name]?.trim().replace(/^(['"])(.*)\1$/s, "$2").trim() || void 0;
+}
+async function loadConfig(env, overrides = {}) {
+  const read = (name) => readEnv(env, name);
+  const require2 = (name) => {
+    const value = read(name);
+    if (!value) throw new ConfigError(`${name} is not set. See docs/server.md.`);
+    return value;
+  };
+  const issuerValue = require2("MADAUTH_ISSUER");
+  parseOrigin("MADAUTH_ISSUER", issuerValue);
+  const issuer = issuerValue.replace(/\/+$/, "");
+  const keyValue = read("MADAUTH_SIGNING_KEY");
+  if (!keyValue) {
+    const key = await generateSigningKey();
+    throw new ConfigError(
+      `MADAUTH_SIGNING_KEY is not set. Here is a newly generated key you can use (keep it secret and use the same key on every instance):
+
+MADAUTH_SIGNING_KEY='${JSON.stringify(key)}'
+`
+    );
+  }
+  let signingKey;
+  try {
+    signingKey = JSON.parse(keyValue);
+    assertPrivateSigningJwk(signingKey);
+  } catch (e) {
+    const reason = e instanceof SyntaxError ? "is not valid JSON" : e.message;
+    throw new ConfigError(`MADAUTH_SIGNING_KEY ${reason}. Generate one with: npx @madauth/server generate-key`);
+  }
+  const allowedOrigins = require2("ALLOWED_ORIGINS").split(",").map((o) => o.trim()).filter(Boolean).map((o) => parseOrigin("ALLOWED_ORIGINS", o));
+  const clientId = read("GOOGLE_CLIENT_ID");
+  if (clientId && !clientId.endsWith(".apps.googleusercontent.com")) {
+    throw new ConfigError(`GOOGLE_CLIENT_ID must end with ".apps.googleusercontent.com" but is "${clientId}".`);
+  }
+  const webhook = webhookFromEnv(read("WEBHOOK_URL"), read("WEBHOOK_SECRET"), read("WEBHOOK_EVENTS"));
+  const store = overrides.store ?? await storeFromDatabaseUrl(read("DATABASE_URL"));
+  let password;
+  if (store) {
+    if (!webhook) {
+      throw new ConfigError(
+        'WEBHOOK_URL is not set. E-mail & password sign-in sends its e-mails through your webhook. For development, run the example receiver (npm run dev:webhooks) and set WEBHOOK_URL=http://localhost:8790/webhook. See "Webhooks" in docs/server.md.'
+      );
+    }
+    password = { minLength: passwordMinLength(read("PASSWORD_MIN_LENGTH")), store };
+  }
+  if (!clientId && !password) {
+    throw new ConfigError(
+      "No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in and/or DATABASE_URL (e.g. sqlite:./madauth.db) for e-mail & password sign-in. See docs/server.md."
+    );
+  }
+  const ttlValue = read("SESSION_TTL");
+  const sessionTtlSeconds = ttlValue ? Number(ttlValue) : DEFAULT_SESSION_TTL;
+  if (!Number.isInteger(sessionTtlSeconds) || sessionTtlSeconds < 60) {
+    throw new ConfigError(`SESSION_TTL must be a whole number of seconds (at least 60) but is "${ttlValue}".`);
+  }
+  return {
+    issuer,
+    signingKey,
+    allowedOrigins,
+    sessionTtlSeconds,
+    cookieDomain: read("COOKIE_DOMAIN"),
+    google: clientId ? { clientId, clientSecret: read("GOOGLE_CLIENT_SECRET") } : void 0,
+    password,
+    webhook
+  };
+}
+async function loadUserStoreConfig(env) {
+  const store = await storeFromDatabaseUrl(readEnv(env, "DATABASE_URL"));
+  if (!store) throw new ConfigError("Set DATABASE_URL to manage users.");
+  return { store, minLength: passwordMinLength(readEnv(env, "PASSWORD_MIN_LENGTH")) };
+}
+function passwordMinLength(value) {
+  const minLength = value ? Number(value) : DEFAULT_PASSWORD_MIN_LENGTH;
+  if (!Number.isInteger(minLength) || minLength < 1 || minLength > 128) {
+    throw new ConfigError(`PASSWORD_MIN_LENGTH must be a whole number from 1 to 128 but is "${value}".`);
+  }
+  return minLength;
+}
+async function storeFromDatabaseUrl(url) {
+  if (!url) return void 0;
+  if (!url.startsWith("sqlite:")) {
+    throw new ConfigError(
+      `DATABASE_URL must start with "sqlite:" (e.g. sqlite:/data/madauth.db) but is "${url}". For other databases, pass your own store adapter (see "Custom store adapter" in docs/server.md).`
+    );
+  }
+  const path = url.slice("sqlite:".length);
+  if (!path) throw new ConfigError("DATABASE_URL needs a file path, e.g. sqlite:/data/madauth.db");
+  const { createSqliteAdapter } = await import("./sqlite.js");
+  try {
+    return createSqliteAdapter(path);
+  } catch (e) {
+    throw new ConfigError(`DATABASE_URL: could not open "${path}": ${e.message}`);
+  }
+}
+var LOCAL_HOSTS = ["localhost", "127.0.0.1", "[::1]", "host.docker.internal"];
+function webhookFromEnv(url, secret, events) {
+  if (!url) {
+    if (secret || events) throw new ConfigError("WEBHOOK_SECRET and WEBHOOK_EVENTS need WEBHOOK_URL.");
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new ConfigError(`WEBHOOK_URL: "${url}" is not a URL.`);
+  }
+  if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && LOCAL_HOSTS.includes(parsed.hostname))) {
+    throw new ConfigError(`WEBHOOK_URL must be an https URL (http only for localhost) but is "${url}".`);
+  }
+  if (!secret) {
+    throw new ConfigError(
+      `WEBHOOK_SECRET is not set. Here is a newly generated secret you can use (keep it secret; your webhook receiver needs the same one):
+
+WEBHOOK_SECRET=${generateWebhookSecret()}
+`
+    );
+  }
+  const problem = checkWebhookSecret(secret);
+  if (problem) {
+    throw new ConfigError(`WEBHOOK_SECRET ${problem}. Generate one with: npx @madauth/server generate-webhook-secret`);
+  }
+  let selected = null;
+  if (events) {
+    selected = new Set(events.split(",").map((e) => e.trim()).filter(Boolean));
+    const unknown = [...selected].filter((e) => !WEBHOOK_TYPES.includes(e));
+    if (unknown.length) {
+      throw new ConfigError(`WEBHOOK_EVENTS: unknown type ${unknown.join(", ")}. Known types: ${WEBHOOK_TYPES.join(", ")}.`);
+    }
+  }
+  return { url: parsed.href, secret, events: selected };
+}
+
+// src/password.ts
+import { createHash, createHmac, hkdfSync, randomBytes, randomInt, scrypt, timingSafeEqual } from "crypto";
+var HASH_PARAMS = { logN: 15, r: 8, p: 3 };
+var KEY_LENGTH = 64;
+var SALT_LENGTH = 16;
+var MAX_PASSWORD_LENGTH = 256;
+var MAX_EMAIL_LENGTH = 254;
+function derive(password, salt, { logN, r, p }) {
+  const N = 2 ** logN;
+  return new Promise(
+    (resolve, reject) => scrypt(
+      password.normalize("NFC"),
+      salt,
+      KEY_LENGTH,
+      { N, r, p, maxmem: 256 * N * r + 1024 * 1024 },
+      (err, key) => err ? reject(err) : resolve(key)
+    )
+  );
+}
+async function hashPassword(password, params = HASH_PARAMS) {
+  const salt = randomBytes(SALT_LENGTH);
+  const key = await derive(password, salt, params);
+  return ["scrypt", params.logN, params.r, params.p, salt.toString("base64url"), key.toString("base64url")].join("$");
+}
+async function verifyPassword(password, stored) {
+  const [scheme, logN, r, p, salt, hash] = stored.split("$");
+  const params = { logN: Number(logN), r: Number(r), p: Number(p) };
+  if (scheme !== "scrypt" || !salt || !hash || !Object.values(params).every((n) => Number.isInteger(n) && n > 0)) {
+    return { ok: false, needsRehash: false };
+  }
+  const expected = Buffer.from(hash, "base64url");
+  const key = await derive(password, Buffer.from(salt, "base64url"), params);
+  const ok = key.length === expected.length && timingSafeEqual(key, expected);
+  const needsRehash = params.logN !== HASH_PARAMS.logN || params.r !== HASH_PARAMS.r || params.p !== HASH_PARAMS.p;
+  return { ok, needsRehash };
+}
+var dummyHash;
+async function verifyAgainstDummy(password) {
+  dummyHash ??= hashPassword(randomBytes(16).toString("hex"));
+  await verifyPassword(password, await dummyHash);
+}
+function checkPasswordPolicy(password, minLength) {
+  if (typeof password !== "string") return "password is missing";
+  const length = [...password].length;
+  if (length < minLength) return `The password must have at least ${minLength} characters.`;
+  if (length > MAX_PASSWORD_LENGTH) return `The password must have at most ${MAX_PASSWORD_LENGTH} characters.`;
+  return null;
+}
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}
+function isValidEmail(email) {
+  return typeof email === "string" && email.trim().length <= MAX_EMAIL_LENGTH && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email.trim());
+}
+function generateLinkToken() {
+  return randomBytes(32).toString("base64url");
+}
+function hashLinkToken(token) {
+  return createHash("sha256").update(token).digest("base64url");
+}
+function generateCode() {
+  return randomInt(0, 1e6).toString().padStart(6, "0");
+}
+function deriveCodeKey(signingKeyD) {
+  return Buffer.from(hkdfSync("sha256", Buffer.from(signingKeyD, "base64url"), "", "madauth e-mail code", 32));
+}
+function hashCode(key, code) {
+  return createHmac("sha256", key).update(code).digest("base64url");
+}
+function safeEqual(a, b) {
+  const x = Buffer.from(a);
+  const y = Buffer.from(b);
+  return x.length === y.length && timingSafeEqual(x, y);
+}
+
+// src/users.ts
+import { randomBytes as randomBytes2 } from "crypto";
+var MAX_CODE_ATTEMPTS = 5;
+var newId = (prefix) => `${prefix}_${randomBytes2(16).toString("base64url")}`;
+function passwordAccountKey(userId) {
+  return `password:${userId}`;
+}
+var Users = class {
+  /** `codeKey` keys the e-mail codes (see deriveCodeKey); only needed to issue and check them. */
+  constructor(store, codeKey) {
+    this.store = store;
+    this.codeKey = codeKey;
+  }
+  get key() {
+    if (!this.codeKey) throw new Error("Users needs a code key to issue or check e-mail codes.");
+    return this.codeKey;
+  }
+  async findByEmail(emailNormalized) {
+    return await this.store.findOne("user", { emailNormalized });
+  }
+  async findById(id) {
+    return await this.store.findOne("user", { id });
+  }
+  async passwordAccount(userId) {
+    return await this.store.findOne("account", { key: passwordAccountKey(userId) });
+  }
+  /** Creates a user with a password. Resolves to null if the e-mail address is taken. */
+  async createPasswordUser(data) {
+    const now = Date.now();
+    const user = {
+      id: newId("usr"),
+      email: data.email,
+      emailNormalized: data.emailNormalized,
+      emailVerified: data.emailVerified,
+      name: data.name,
+      sessionVersion: 0,
+      lastMailAt: 0,
+      createdAt: now
+    };
+    if (!await this.store.create("user", user)) return null;
+    const account = {
+      id: newId("acc"),
+      userId: user.id,
+      key: passwordAccountKey(user.id),
+      secret: data.passwordHash,
+      failedAttempts: 0,
+      lockedUntil: 0,
+      createdAt: now
+    };
+    if (!await this.store.create("account", account)) {
+      await this.store.delete("user", { id: user.id });
+      return null;
+    }
+    return user;
+  }
+  async updateUser(id, patch) {
+    await this.store.update("user", { id }, patch);
+  }
+  async updateAccount(id, patch) {
+    await this.store.update("account", { id }, patch);
+  }
+  /**
+   * Counts a sign-in attempt: writes `patch` only if the account's `failedAttempts` is still the value that
+   * was read. Resolves to false if another request counted an attempt meanwhile.
+   */
+  async countAttempt(account, patch) {
+    const changed = await this.store.update("account", { id: account.id, failedAttempts: account.failedAttempts }, patch);
+    return changed === 1;
+  }
+  /** Deletes the user's pending verifications and password resets; their links and codes stop working. */
+  async clearVerifications(userId) {
+    await this.store.delete("verification", { userId });
+  }
+  /**
+   * Starts a verification or password reset: replaces the user's earlier one for the same purpose and
+   * returns the link token and the code for the e-mail. Only their hashes are stored.
+   */
+  async issueVerification(userId, purpose, ttlMs) {
+    await this.store.delete("verification", { userId, purpose });
+    const token = generateLinkToken();
+    const code = generateCode();
+    const record = {
+      id: hashLinkToken(token),
+      userId,
+      purpose,
+      codeHash: hashCode(this.key, code),
+      attempts: 0,
+      expiresAt: Date.now() + ttlMs
+    };
+    await this.store.create("verification", record);
+    return { token, code };
+  }
+  /** Uses up the verification a link token belongs to. Resolves to its user ID, or null if invalid, expired or used. */
+  async consumeLinkToken(token, purpose) {
+    const id = hashLinkToken(token);
+    const record = await this.store.findOne("verification", { id, purpose });
+    return record ? this.consume(record) : null;
+  }
+  /** Uses up the user's verification if `code` matches. Too many wrong codes delete it. */
+  async consumeCode(userId, purpose, code) {
+    const record = await this.store.findOne("verification", { userId, purpose });
+    if (!record) return null;
+    const attempts = record.attempts + 1;
+    if (await this.store.update("verification", { id: record.id, attempts: record.attempts }, { attempts }) !== 1) return null;
+    if (!safeEqual(hashCode(this.key, code), record.codeHash)) {
+      if (attempts >= MAX_CODE_ATTEMPTS) await this.store.delete("verification", { id: record.id });
+      return null;
+    }
+    return this.consume(record);
+  }
+  async consume(record) {
+    const deleted = await this.store.delete("verification", { id: record.id });
+    if (deleted !== 1 || record.expiresAt <= Date.now()) return null;
+    return record.userId;
+  }
+};
+
+export {
+  MAX_PASSWORD_LENGTH,
+  hashPassword,
+  verifyPassword,
+  verifyAgainstDummy,
+  checkPasswordPolicy,
+  normalizeEmail,
+  isValidEmail,
+  deriveCodeKey,
+  Users,
+  envVars,
+  ConfigError,
+  loadConfig,
+  loadUserStoreConfig
+};

package/dist/config-KQvE2imU.d.ts

@@ -0,0 +1,65 @@
+import { JWK, JWTVerifyGetKey } from 'jose';
+import { S as StoreAdapter } from './schema-Dotc6LU7.js';
+import { W as WebhookSettings } from './webhook-CT80emTQ.js';
+
+interface MadauthConfig {
+    /** Public base URL of the server (MADAUTH_ISSUER). */
+    issuer: string;
+    /** Private ES256 JWK (MADAUTH_SIGNING_KEY). */
+    signingKey: JWK;
+    /** App origins allowed to call the server (ALLOWED_ORIGINS). */
+    allowedOrigins: string[];
+    /** Session lifetime in seconds (SESSION_TTL). */
+    sessionTtlSeconds: number;
+    /** Cookie domain, e.g. `.example.com` (COOKIE_DOMAIN). */
+    cookieDomain?: string;
+    /** Google sign-in; off when GOOGLE_CLIENT_ID is not set. */
+    google?: {
+        /** OAuth web client ID (GOOGLE_CLIENT_ID). */
+        clientId: string;
+        /** Enables the server-side code flow (GOOGLE_CLIENT_SECRET). */
+        clientSecret?: string;
+    };
+    /** E-mail & password sign-in; off without a store (DATABASE_URL or the `store` option). */
+    password?: {
+        /** PASSWORD_MIN_LENGTH. */
+        minLength: number;
+        store: StoreAdapter;
+    };
+    /** Where madAuth sends e-mails, sign-up checks and events (WEBHOOK_URL); required for password sign-in. */
+    webhook?: WebhookSettings;
+    /** Test hook: resolves Google's signing keys. Defaults to Google's published JWKS. */
+    jwksResolver?: JWTVerifyGetKey;
+    /** Test hook: the fetch used for webhook calls. */
+    webhookFetch?: typeof fetch;
+}
+/** Every environment variable read by {@link loadConfig}, with whether it is required. */
+declare const envVars: {
+    readonly MADAUTH_ISSUER: true;
+    readonly MADAUTH_SIGNING_KEY: true;
+    readonly ALLOWED_ORIGINS: true;
+    readonly GOOGLE_CLIENT_ID: false;
+    readonly GOOGLE_CLIENT_SECRET: false;
+    readonly DATABASE_URL: false;
+    readonly PASSWORD_MIN_LENGTH: false;
+    readonly WEBHOOK_URL: false;
+    readonly WEBHOOK_SECRET: false;
+    readonly WEBHOOK_EVENTS: false;
+    readonly SESSION_TTL: false;
+    readonly COOKIE_DOMAIN: false;
+};
+/** Instead of environment variables: your own store adapter. */
+interface ConfigOverrides {
+    /** Stores users; replaces DATABASE_URL. */
+    store?: StoreAdapter;
+}
+declare class ConfigError extends Error {
+    name: string;
+}
+/**
+ * Reads and validates the madAuth configuration from environment variables.
+ * Throws a {@link ConfigError} naming the variable that is missing or invalid.
+ */
+declare function loadConfig(env: Record<string, string | undefined>, overrides?: ConfigOverrides): Promise<MadauthConfig>;
+
+export { type ConfigOverrides as C, type MadauthConfig as M, ConfigError as a, envVars as e, loadConfig as l };

package/dist/entry/azure.d.ts

@@ -0,0 +1,13 @@
+import { C as ConfigOverrides } from '../config-KQvE2imU.js';
+import 'jose';
+import '../schema-Dotc6LU7.js';
+import '../webhook-CT80emTQ.js';
+
+/**
+ * Registers madAuth as an Azure Functions v4 HTTP function that handles every route. Pass `store` to use your
+ * own store adapter.
+ * Set `"routePrefix": ""` in host.json so the routes are served at /auth/... (see docs/server.md).
+ */
+declare function register(overrides?: ConfigOverrides): void;
+
+export { register };

package/dist/entry/azure.js

@@ -0,0 +1,84 @@
+import {
+  createApp
+} from "../chunk-TEMZRMFF.js";
+import "../chunk-PRRKLEW7.js";
+import {
+  loadConfig
+} from "../chunk-V2XKGETK.js";
+import "../chunk-JDQLSL36.js";
+import "../chunk-AVZE6FFR.js";
+
+// src/entry/azure.ts
+import { app } from "@azure/functions";
+
+// src/entry/azure-handler.ts
+var sameSiteValues = { strict: "Strict", lax: "Lax", none: "None" };
+function parseSetCookie(header) {
+  const [pair, ...attributes] = header.split(";").map((s) => s.trim());
+  const eq = pair.indexOf("=");
+  const cookie = { name: pair.slice(0, eq), value: pair.slice(eq + 1) };
+  for (const attribute of attributes) {
+    const [key, ...rest] = attribute.split("=");
+    const value = rest.join("=");
+    switch (key.toLowerCase()) {
+      case "domain":
+        cookie.domain = value;
+        break;
+      case "path":
+        cookie.path = value;
+        break;
+      case "expires":
+        cookie.expires = new Date(value);
+        break;
+      case "max-age":
+        cookie.maxAge = Number(value);
+        break;
+      case "secure":
+        cookie.secure = true;
+        break;
+      case "httponly":
+        cookie.httpOnly = true;
+        break;
+      case "samesite":
+        cookie.sameSite = sameSiteValues[value.toLowerCase()];
+        break;
+    }
+  }
+  return cookie;
+}
+async function handleAzureRequest(app2, request) {
+  const hasBody = request.method !== "GET" && request.method !== "HEAD";
+  const response = await app2.fetch(
+    new Request(request.url, {
+      method: request.method,
+      headers: request.headers,
+      body: hasBody ? await request.arrayBuffer() : void 0
+    })
+  );
+  const headers = new Headers(response.headers);
+  headers.delete("set-cookie");
+  return {
+    status: response.status,
+    headers,
+    cookies: response.headers.getSetCookie().map(parseSetCookie),
+    body: response.body ? new Uint8Array(await response.arrayBuffer()) : void 0
+  };
+}
+
+// src/entry/azure.ts
+function register(overrides = {}) {
+  let appPromise;
+  app.http("madauth", {
+    route: "{*path}",
+    methods: ["GET", "POST", "OPTIONS"],
+    authLevel: "anonymous",
+    handler: async (request) => {
+      appPromise ??= loadConfig(process.env, overrides).then(createApp);
+      appPromise.catch(() => appPromise = void 0);
+      return handleAzureRequest(await appPromise, request);
+    }
+  });
+}
+export {
+  register
+};

package/dist/entry/lambda.d.ts

@@ -0,0 +1,17 @@
+import { LambdaEvent, LambdaContext, handle } from 'hono/aws-lambda';
+import { C as ConfigOverrides } from '../config-KQvE2imU.js';
+import 'jose';
+import '../schema-Dotc6LU7.js';
+import '../webhook-CT80emTQ.js';
+
+type LambdaHandler = (event: LambdaEvent, context: LambdaContext) => ReturnType<ReturnType<typeof handle>>;
+/**
+ * Creates an AWS Lambda handler (Function URL, API Gateway v1/v2 or ALB). It reads the configuration from
+ * the function's environment variables on the first invocation. Pass `store` to use your own store
+ * adapter.
+ */
+declare function createHandler(overrides?: ConfigOverrides): LambdaHandler;
+/** The handler configured only by environment variables (`lambda.handler` in the standalone bundle). */
+declare const handler: LambdaHandler;
+
+export { type LambdaHandler, createHandler, handler };

package/dist/entry/lambda.js

@@ -0,0 +1,25 @@
+import {
+  createApp
+} from "../chunk-TEMZRMFF.js";
+import "../chunk-PRRKLEW7.js";
+import {
+  loadConfig
+} from "../chunk-V2XKGETK.js";
+import "../chunk-JDQLSL36.js";
+import "../chunk-AVZE6FFR.js";
+
+// src/entry/lambda.ts
+import { handle } from "hono/aws-lambda";
+function createHandler(overrides = {}) {
+  let handlerPromise;
+  return async (event, context) => {
+    handlerPromise ??= loadConfig(process.env, overrides).then((config) => handle(createApp(config)));
+    handlerPromise.catch(() => handlerPromise = void 0);
+    return (await handlerPromise)(event, context);
+  };
+}
+var handler = createHandler();
+export {
+  createHandler,
+  handler
+};

package/dist/entry/node.d.ts

@@ -0,0 +1,16 @@
+import { C as ConfigOverrides } from '../config-KQvE2imU.js';
+import 'jose';
+import '../schema-Dotc6LU7.js';
+import '../webhook-CT80emTQ.js';
+
+interface StartOptions extends ConfigOverrides {
+    /** Environment variables to read. Default: `process.env`. */
+    env?: Record<string, string | undefined>;
+}
+/**
+ * Starts the madAuth server on Node, listening on PORT (default 8787). Used by the Docker image.
+ * Pass `store` to use your own store adapter.
+ */
+declare function start(opts?: StartOptions): Promise<void>;
+
+export { type StartOptions, start };

package/dist/entry/node.js

@@ -0,0 +1,22 @@
+import {
+  createApp
+} from "../chunk-TEMZRMFF.js";
+import "../chunk-PRRKLEW7.js";
+import {
+  loadConfig
+} from "../chunk-V2XKGETK.js";
+import "../chunk-JDQLSL36.js";
+import "../chunk-AVZE6FFR.js";
+
+// src/entry/node.ts
+import { serve } from "@hono/node-server";
+async function start(opts = {}) {
+  const { env = process.env, ...overrides } = opts;
+  const config = await loadConfig(env, overrides);
+  const port = Number(env.PORT?.trim() || 8787);
+  serve({ fetch: createApp(config).fetch, port });
+  console.log(`madAuth server listening on port ${port} (issuer ${config.issuer})`);
+}
+export {
+  start
+};

package/dist/index.d.ts

@@ -0,0 +1,30 @@
+import { Hono } from 'hono';
+import { M as MadauthConfig } from './config-KQvE2imU.js';
+export { a as ConfigError, C as ConfigOverrides, e as envVars, l as loadConfig } from './config-KQvE2imU.js';
+import { JWK } from 'jose';
+import { a as Schema } from './schema-Dotc6LU7.js';
+export { F as FieldDef, b as FieldType, R as Row, S as StoreAdapter, V as Value, W as Where, m as madauthSchema } from './schema-Dotc6LU7.js';
+export { M as MadauthUser } from './user-3DDyggFV.js';
+import './webhook-CT80emTQ.js';
+
+/** Creates a new private ES256 JWK for MADAUTH_SIGNING_KEY. */
+declare function generateSigningKey(): Promise<JWK>;
+
+/** Hash parameter that carries a sign-in error back to the app after the code flow. */
+declare const REDIRECT_ERROR_PARAM = "madauth_error";
+
+/**
+ * Creates the madAuth HTTP app. It is built on Hono's Web Standard Request/Response, so the same app runs
+ * on Node (Docker), AWS Lambda and Azure Functions (see `src/entry/`).
+ */
+declare function createApp(config: MadauthConfig): Hono;
+
+/** The SQL table that holds a model, e.g. `madauth_user`. */
+declare function tableName(model: string): string;
+/** The SQL column that holds a field, e.g. `email_normalized` for `emailNormalized`. */
+declare function columnName(field: string): string;
+type SqlDialect = 'sqlite' | 'postgres' | 'mysql';
+/** The SQL that creates madAuth's tables and indexes in an empty database. */
+declare function createTablesSql(dialect: SqlDialect, schema?: Schema): string;
+
+export { MadauthConfig, REDIRECT_ERROR_PARAM, Schema, type SqlDialect, columnName, createApp, createTablesSql, generateSigningKey, tableName };