@madauth/server 0.1.0

package/dist/standalone/lambda.mjs

@@ -0,0 +1,4462 @@
+import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/store/schema.ts
+var madauthSchema;
+var init_schema = __esm({
+  "src/store/schema.ts"() {
+    "use strict";
+    madauthSchema = {
+      version: 1,
+      models: {
+        user: {
+          fields: {
+            id: { type: "string", primaryKey: true },
+            email: { type: "string" },
+            emailNormalized: { type: "string", unique: true },
+            emailVerified: { type: "boolean" },
+            name: { type: "string", nullable: true },
+            sessionVersion: { type: "number" },
+            lastMailAt: { type: "number" },
+            createdAt: { type: "number" }
+          }
+        },
+        /** How a user signs in. `key` is e.g. `password:<userId>`; later `google:<sub>` or `totp:<userId>`. */
+        account: {
+          fields: {
+            id: { type: "string", primaryKey: true },
+            userId: { type: "string", index: true },
+            key: { type: "string", unique: true },
+            secret: { type: "string", nullable: true },
+            failedAttempts: { type: "number" },
+            lockedUntil: { type: "number" },
+            createdAt: { type: "number" }
+          }
+        },
+        /** A pending e-mail verification or password reset. `id` is the SHA-256 of the link token. */
+        verification: {
+          fields: {
+            id: { type: "string", primaryKey: true },
+            userId: { type: "string", index: true },
+            purpose: { type: "string" },
+            codeHash: { type: "string" },
+            attempts: { type: "number" },
+            expiresAt: { type: "number" }
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/store/sql.ts
+function tableName(model) {
+  return `madauth_${model}`;
+}
+function columnName(field) {
+  return field.replace(/[A-Z]/g, (c) => `_${c.toLowerCase()}`);
+}
+function createTablesSql(dialect, schema = madauthSchema) {
+  const statements = [];
+  for (const [model, { fields }] of Object.entries(schema.models)) {
+    const table2 = tableName(model);
+    const columns = Object.entries(fields).map(([field, def]) => {
+      const keyed = def.primaryKey || def.unique || def.index;
+      const type = dialect === "mysql" && def.type === "string" && keyed ? "VARCHAR(255)" : columnTypes[dialect][def.type];
+      const constraints = def.primaryKey ? " PRIMARY KEY" : `${def.nullable ? "" : " NOT NULL"}${def.unique ? " UNIQUE" : ""}`;
+      return `  ${columnName(field)} ${type}${constraints}`;
+    });
+    statements.push(`CREATE TABLE ${table2} (
+${columns.join(",\n")}
+);`);
+    for (const [field, def] of Object.entries(fields)) {
+      if (def.index) statements.push(`CREATE INDEX ${table2}_${columnName(field)} ON ${table2} (${columnName(field)});`);
+    }
+  }
+  return statements.join("\n");
+}
+var columnTypes;
+var init_sql = __esm({
+  "src/store/sql.ts"() {
+    "use strict";
+    init_schema();
+    columnTypes = {
+      sqlite: { string: "TEXT", number: "INTEGER", boolean: "INTEGER" },
+      // DOUBLE PRECISION keeps numbers as JavaScript numbers in most Postgres drivers (BIGINT often becomes a string).
+      postgres: { string: "TEXT", number: "DOUBLE PRECISION", boolean: "BOOLEAN" },
+      mysql: { string: "TEXT", number: "DOUBLE", boolean: "BOOLEAN" }
+    };
+  }
+});
+
+// src/store/sqlite.ts
+var sqlite_exports = {};
+__export(sqlite_exports, {
+  createSqliteAdapter: () => createSqliteAdapter
+});
+function createSqliteAdapter(path) {
+  const { DatabaseSync } = process.getBuiltinModule("node:sqlite");
+  const db = new DatabaseSync(path);
+  db.exec("PRAGMA busy_timeout = 5000");
+  if (path !== ":memory:") db.exec("PRAGMA journal_mode = WAL");
+  migrate(db);
+  const fieldsOf = (model) => {
+    const fields = madauthSchema.models[model]?.fields;
+    if (!fields) throw new Error(`Unknown model "${model}"`);
+    return fields;
+  };
+  const column = (fields, field) => {
+    if (!fields[field]) throw new Error(`Unknown field "${field}"`);
+    return columnName(field);
+  };
+  const toSql = (value) => typeof value === "boolean" ? value ? 1 : 0 : value;
+  const whereSql = (fields, where) => {
+    const parts = [];
+    const params = [];
+    for (const [field, value] of Object.entries(where)) {
+      if (value === null) {
+        parts.push(`${column(fields, field)} IS NULL`);
+      } else {
+        parts.push(`${column(fields, field)} = ?`);
+        params.push(toSql(value));
+      }
+    }
+    return { sql: parts.length ? ` WHERE ${parts.join(" AND ")}` : "", params };
+  };
+  const fromSql = (fields, raw2) => {
+    const row = {};
+    for (const [field, def] of Object.entries(fields)) {
+      const value = raw2[columnName(field)];
+      row[field] = def.type === "boolean" && value !== null ? value === 1 : value;
+    }
+    return row;
+  };
+  return {
+    async create(model, data) {
+      const fields = fieldsOf(model);
+      const names = Object.keys(data);
+      const sql = `INSERT INTO ${tableName(model)} (${names.map((f) => column(fields, f)).join(", ")}) VALUES (${names.map(() => "?").join(", ")}) ON CONFLICT DO NOTHING`;
+      return Number(db.prepare(sql).run(...names.map((f) => toSql(data[f]))).changes) === 1;
+    },
+    async findOne(model, where) {
+      const fields = fieldsOf(model);
+      const w = whereSql(fields, where);
+      const raw2 = db.prepare(`SELECT * FROM ${tableName(model)}${w.sql} LIMIT 1`).get(...w.params);
+      return raw2 ? fromSql(fields, raw2) : null;
+    },
+    async findMany(model, where, opts = {}) {
+      const fields = fieldsOf(model);
+      const w = whereSql(fields, where);
+      const limit = opts.limit === void 0 ? "" : ` LIMIT ${Math.max(0, Math.floor(opts.limit))}`;
+      return db.prepare(`SELECT * FROM ${tableName(model)}${w.sql}${limit}`).all(...w.params).map((raw2) => fromSql(fields, raw2));
+    },
+    async update(model, where, patch) {
+      const fields = fieldsOf(model);
+      const names = Object.keys(patch);
+      if (!names.length) return 0;
+      const w = whereSql(fields, where);
+      const sql = `UPDATE ${tableName(model)} SET ${names.map((f) => `${column(fields, f)} = ?`).join(", ")}${w.sql}`;
+      return Number(db.prepare(sql).run(...names.map((f) => toSql(patch[f])), ...w.params).changes);
+    },
+    async delete(model, where) {
+      const fields = fieldsOf(model);
+      const w = whereSql(fields, where);
+      return Number(db.prepare(`DELETE FROM ${tableName(model)}${w.sql}`).run(...w.params).changes);
+    }
+  };
+}
+function migrate(db) {
+  const { user_version: version } = db.prepare("PRAGMA user_version").get();
+  if (version > madauthSchema.version) {
+    throw new Error(
+      `The database uses madAuth schema version ${version}, but this madAuth only knows version ${madauthSchema.version}. Update madAuth.`
+    );
+  }
+  if (version === madauthSchema.version) return;
+  db.exec("BEGIN");
+  try {
+    db.exec(createTablesSql("sqlite"));
+    db.exec(`PRAGMA user_version = ${madauthSchema.version}`);
+    db.exec("COMMIT");
+  } catch (e) {
+    db.exec("ROLLBACK");
+    throw e;
+  }
+}
+var init_sqlite = __esm({
+  "src/store/sqlite.ts"() {
+    "use strict";
+    init_schema();
+    init_sql();
+  }
+});
+
+// ../../node_modules/hono/dist/utils/encode.js
+var encodeBase64 = (buf) => {
+  let binary = "";
+  const bytes = new Uint8Array(buf);
+  for (let i = 0, len = bytes.length; i < len; i++) binary += String.fromCharCode(bytes[i]);
+  return btoa(binary);
+};
+var decodeBase64 = (str) => {
+  const binary = atob(str);
+  const bytes = new Uint8Array(new ArrayBuffer(binary.length));
+  const half = binary.length / 2;
+  for (let i = 0, j = binary.length - 1; i <= half; i++, j--) {
+    bytes[i] = binary.charCodeAt(i);
+    bytes[j] = binary.charCodeAt(j);
+  }
+  return bytes;
+};
+
+// ../../node_modules/hono/dist/adapter/aws-lambda/handler.js
+import { pipeline } from "stream/promises";
+function sanitizeHeaderValue(value) {
+  if (!/[^\x00-\x7F]/.test(value)) return value;
+  return encodeURIComponent(value);
+}
+var getRequestContext = (event) => {
+  return event.requestContext;
+};
+var handle = (app, { isContentTypeBinary } = { isContentTypeBinary: void 0 }) => {
+  return async (event, lambdaContext) => {
+    const processor = getProcessor(event);
+    let req, requestContext;
+    try {
+      req = processor.createRequest(event);
+      requestContext = getRequestContext(event);
+    } catch (error) {
+      console.error("Error processing request:", error);
+      const errorResponse = error instanceof TypeError ? new Response("Invalid request", { status: 400 }) : new Response("Internal Server Error", { status: 500 });
+      return processor.createResult(event, errorResponse, { isContentTypeBinary });
+    }
+    const res = await app.fetch(req, {
+      event,
+      requestContext,
+      lambdaContext
+    });
+    return processor.createResult(event, res, { isContentTypeBinary });
+  };
+};
+var EventProcessor = class {
+  getHeaderValue(headers, key) {
+    return headers ? Array.isArray(headers[key]) ? headers[key][0] : headers[key] : void 0;
+  }
+  getDomainName(event) {
+    if (event.requestContext && "domainName" in event.requestContext) return event.requestContext.domainName;
+    const hostFromHeaders = this.getHeaderValue(event.headers, "host");
+    if (hostFromHeaders) return hostFromHeaders;
+    const multiValueHeaders = "multiValueHeaders" in event ? event.multiValueHeaders : {};
+    return this.getHeaderValue(multiValueHeaders, "host");
+  }
+  createRequest(event) {
+    const queryString = this.getQueryString(event);
+    const urlPath = `https://${this.getDomainName(event)}${this.getPath(event)}`;
+    const url = queryString ? `${urlPath}?${queryString}` : urlPath;
+    const headers = this.getHeaders(event);
+    const requestInit = {
+      headers,
+      method: this.getMethod(event)
+    };
+    if (event.body) {
+      const body = event.isBase64Encoded ? decodeBase64(event.body) : new TextEncoder().encode(event.body);
+      requestInit.body = body;
+      headers.set("content-length", body.length.toString());
+    }
+    return new Request(url, requestInit);
+  }
+  async createResult(event, res, options) {
+    const contentType = res.headers.get("content-type");
+    const isContentTypeBinary = options.isContentTypeBinary ?? defaultIsContentTypeBinary;
+    let isBase64Encoded = contentType && isContentTypeBinary(contentType) ? true : false;
+    if (!isBase64Encoded) {
+      const contentEncoding = res.headers.get("content-encoding");
+      isBase64Encoded = isContentEncodingBinary(contentEncoding);
+    }
+    const result = {
+      body: isBase64Encoded ? encodeBase64(await res.arrayBuffer()) : await res.text(),
+      statusCode: res.status,
+      isBase64Encoded,
+      ..."multiValueHeaders" in event && event.multiValueHeaders ? { multiValueHeaders: {} } : { headers: {} }
+    };
+    this.setCookies(event, res, result);
+    if (result.multiValueHeaders) res.headers.forEach((value, key) => {
+      result.multiValueHeaders[key] = [value];
+    });
+    else res.headers.forEach((value, key) => {
+      result.headers[key] = value;
+    });
+    return result;
+  }
+  setCookies(_event, res, result) {
+    if (res.headers.has("set-cookie")) {
+      const cookies = res.headers.getSetCookie ? res.headers.getSetCookie() : Array.from(res.headers.entries()).filter(([k]) => k === "set-cookie").map(([, v]) => v);
+      if (Array.isArray(cookies)) {
+        this.setCookiesToResult(result, cookies);
+        res.headers.delete("set-cookie");
+      }
+    }
+  }
+};
+var EventV2Processor = class extends EventProcessor {
+  getPath(event) {
+    return event.rawPath;
+  }
+  getMethod(event) {
+    return event.requestContext.http.method;
+  }
+  getQueryString(event) {
+    return event.rawQueryString;
+  }
+  getCookies(event, headers) {
+    if (Array.isArray(event.cookies)) headers.set("Cookie", event.cookies.join("; "));
+  }
+  setCookiesToResult(result, cookies) {
+    result.cookies = cookies;
+  }
+  getHeaders(event) {
+    const headers = new Headers();
+    this.getCookies(event, headers);
+    if (event.headers) {
+      for (const [k, v] of Object.entries(event.headers)) if (v) headers.set(k, v);
+    }
+    return headers;
+  }
+};
+var v2Processor = new EventV2Processor();
+var EventV1Processor = class extends EventProcessor {
+  getPath(event) {
+    return event.path;
+  }
+  getMethod(event) {
+    return event.httpMethod;
+  }
+  getQueryString(event) {
+    if (event.multiValueQueryStringParameters) return Object.entries(event.multiValueQueryStringParameters || {}).filter(([, value]) => value).map(([key, values]) => values.map((value) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&")).join("&");
+    else return Object.entries(event.queryStringParameters || {}).filter(([, value]) => value !== void 0).map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value || "")}`).join("&");
+  }
+  getCookies(_event, _headers) {
+  }
+  getHeaders(event) {
+    const headers = new Headers();
+    this.getCookies(event, headers);
+    if (event.multiValueHeaders) {
+      for (const [k, values] of Object.entries(event.multiValueHeaders)) if (values) values.forEach((v) => headers.append(k, sanitizeHeaderValue(v)));
+    }
+    if (event.headers) {
+      for (const [k, v] of Object.entries(event.headers)) if (v && !headers.has(k)) headers.set(k, sanitizeHeaderValue(v));
+    }
+    return headers;
+  }
+  setCookiesToResult(result, cookies) {
+    result.multiValueHeaders = { "set-cookie": cookies };
+  }
+};
+var v1Processor = new EventV1Processor();
+var ALBProcessor = class extends EventProcessor {
+  getHeaders(event) {
+    const headers = new Headers();
+    if (event.multiValueHeaders) {
+      for (const [key, values] of Object.entries(event.multiValueHeaders)) if (values && Array.isArray(values)) {
+        const sanitizedValue = sanitizeHeaderValue(values.join("; "));
+        headers.set(key, sanitizedValue);
+      }
+    } else for (const [key, value] of Object.entries(event.headers ?? {})) if (value) headers.set(key, sanitizeHeaderValue(value));
+    return headers;
+  }
+  getPath(event) {
+    return event.path;
+  }
+  getMethod(event) {
+    return event.httpMethod;
+  }
+  getQueryString(event) {
+    if (event.multiValueQueryStringParameters) return Object.entries(event.multiValueQueryStringParameters || {}).filter(([, value]) => value).map(([key, value]) => `${key}=${value.join(`&${key}=`)}`).join("&");
+    else return Object.entries(event.queryStringParameters || {}).filter(([, value]) => value !== void 0).map(([key, value]) => `${key}=${value}`).join("&");
+  }
+  getCookies(event, headers) {
+    let cookie;
+    if (event.multiValueHeaders) cookie = event.multiValueHeaders["cookie"]?.join("; ");
+    else cookie = event.headers ? event.headers["cookie"] : void 0;
+    if (cookie) headers.append("Cookie", cookie);
+  }
+  setCookiesToResult(result, cookies) {
+    if (result.multiValueHeaders) result.multiValueHeaders["set-cookie"] = cookies;
+    else result.headers["set-cookie"] = cookies[0];
+  }
+};
+var albProcessor = new ALBProcessor();
+var LatticeV2Processor = class extends EventProcessor {
+  getPath(event) {
+    return event.path;
+  }
+  getMethod(event) {
+    return event.method;
+  }
+  getQueryString() {
+    return "";
+  }
+  getHeaders(event) {
+    const headers = new Headers();
+    if (event.headers) {
+      for (const [k, values] of Object.entries(event.headers)) if (values) values.forEach((v) => headers.append(k, sanitizeHeaderValue(v)));
+    }
+    return headers;
+  }
+  getCookies() {
+  }
+  setCookiesToResult(result, cookies) {
+    result.headers = {
+      ...result.headers,
+      "set-cookie": cookies
+    };
+  }
+};
+var latticeV2Processor = new LatticeV2Processor();
+var getProcessor = (event) => {
+  if (isProxyEventALB(event)) return albProcessor;
+  if (isProxyEventV2(event)) return v2Processor;
+  if (isLatticeEventV2(event)) return latticeV2Processor;
+  return v1Processor;
+};
+var isProxyEventALB = (event) => {
+  if (event.requestContext) return Object.hasOwn(event.requestContext, "elb");
+  return false;
+};
+var isProxyEventV2 = (event) => {
+  return Object.hasOwn(event, "rawPath") && Object.hasOwn(event.requestContext ?? {}, "http");
+};
+var isLatticeEventV2 = (event) => {
+  if (event.requestContext) return Object.hasOwn(event.requestContext, "serviceArn");
+  return false;
+};
+var defaultIsContentTypeBinary = (contentType) => {
+  if (/^application\/vnd\.(?:apple\.installer|mozilla\.xul)\+xml\s*(?:;|$)/i.test(contentType)) return true;
+  return !/^text\/(?:plain|html|css|javascript|csv)|(?:\/|\+)(?:json|xml)\s*(?:;|$)/i.test(contentType);
+};
+var isContentEncodingBinary = (contentEncoding) => {
+  return !!contentEncoding && !/^identity$/i.test(contentEncoding);
+};
+
+// ../../node_modules/hono/dist/request/constants.js
+var GET_MATCH_RESULT = /* @__PURE__ */ Symbol();
+
+// ../../node_modules/hono/dist/utils/buffer.js
+var bufferToFormData = (arrayBuffer, contentType) => {
+  return new Response(arrayBuffer, { headers: { "Content-Type": contentType.replace(/^[^;]+/, (mediaType) => mediaType.toLowerCase()) } }).formData();
+};
+
+// ../../node_modules/hono/dist/utils/body.js
+var MAX_NESTED_OBJECTS = 1e4;
+var isRawRequest = (request) => "headers" in request;
+var parseBody = async (request, options = /* @__PURE__ */ Object.create(null)) => {
+  const { all = false, dot = false } = options;
+  const mediaType = (isRawRequest(request) ? request.headers : request.raw.headers).get("Content-Type")?.split(";")[0].trim().toLowerCase();
+  if (mediaType === "multipart/form-data" || mediaType === "application/x-www-form-urlencoded") return parseFormData(request, {
+    all,
+    dot
+  });
+  return {};
+};
+async function parseFormData(request, options) {
+  if (!isRawRequest(request) && request.bodyCache.formData) return convertFormDataToBodyData(await request.bodyCache.formData, options);
+  const headers = isRawRequest(request) ? request.headers : request.raw.headers;
+  const arrayBuffer = await request.arrayBuffer();
+  const formDataPromise = bufferToFormData(arrayBuffer, headers.get("Content-Type") || "");
+  if (!isRawRequest(request)) request.bodyCache.formData = formDataPromise;
+  const formData = await formDataPromise;
+  if (formData) return convertFormDataToBodyData(formData, options);
+  return {};
+}
+function convertFormDataToBodyData(formData, options) {
+  const form = /* @__PURE__ */ Object.create(null);
+  const nestingState = { count: 0 };
+  formData.forEach((value, key) => {
+    if (!(options.all || key.endsWith("[]"))) form[key] = value;
+    else handleParsingAllValues(form, key, value);
+  });
+  if (options.dot) Object.entries(form).forEach(([key, value]) => {
+    if (key.includes(".")) {
+      handleParsingNestedValues(form, key, value, nestingState);
+      delete form[key];
+    }
+  });
+  return form;
+}
+var handleParsingAllValues = (form, key, value) => {
+  if (form[key] !== void 0) {
+    if (Array.isArray(form[key])) form[key].push(value);
+    else form[key] = [form[key], value];
+  } else if (!key.endsWith("[]")) form[key] = value;
+  else form[key] = [value];
+};
+var handleParsingNestedValues = (form, key, value, state) => {
+  if (/(?:^|\.)__proto__\./.test(key)) return;
+  let nestedForm = form;
+  const keys = key.split(".", 34);
+  if (keys.length > 33) throwNestingLimitExceeded();
+  keys.forEach((key2, index) => {
+    if (index === keys.length - 1) nestedForm[key2] = value;
+    else {
+      if (!nestedForm[key2] || typeof nestedForm[key2] !== "object" || Array.isArray(nestedForm[key2]) || nestedForm[key2] instanceof File) {
+        if (state.count++ >= MAX_NESTED_OBJECTS) throwNestingLimitExceeded();
+        nestedForm[key2] = /* @__PURE__ */ Object.create(null);
+      }
+      nestedForm = nestedForm[key2];
+    }
+  });
+};
+var throwNestingLimitExceeded = () => {
+  throw new Error("Nesting limit exceeded");
+};
+
+// ../../node_modules/hono/dist/utils/url.js
+var splitPath = (path) => {
+  const paths = path.split("/");
+  if (paths[0] === "") paths.shift();
+  return paths;
+};
+var splitRoutingPath = (routePath) => {
+  const { groups, path } = extractGroupsFromPath(routePath);
+  const paths = splitPath(path);
+  return replaceGroupMarks(paths, groups);
+};
+var extractGroupsFromPath = (path) => {
+  const groups = [];
+  path = path.replace(/\{[^}]+\}/g, (match2, index) => {
+    const mark = `@${index}`;
+    groups.push([mark, match2]);
+    return mark;
+  });
+  return {
+    groups,
+    path
+  };
+};
+var replaceGroupMarks = (paths, groups) => {
+  for (let i = groups.length - 1; i >= 0; i--) {
+    const [mark] = groups[i];
+    for (let j = paths.length - 1; j >= 0; j--) if (paths[j].includes(mark)) {
+      paths[j] = paths[j].replace(mark, groups[i][1]);
+      break;
+    }
+  }
+  return paths;
+};
+var patternCache = {};
+var getPattern = (label, next) => {
+  if (label === "*") return "*";
+  const match2 = label.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);
+  if (match2) {
+    const cacheKey = `${label}#${next}`;
+    if (!patternCache[cacheKey]) {
+      if (match2[2]) patternCache[cacheKey] = next && next[0] !== ":" && next[0] !== "*" ? [
+        cacheKey,
+        match2[1],
+        new RegExp(`^${match2[2]}(?=/${next})`)
+      ] : [
+        label,
+        match2[1],
+        new RegExp(`^${match2[2]}$`)
+      ];
+      else patternCache[cacheKey] = [
+        label,
+        match2[1],
+        true
+      ];
+    }
+    return patternCache[cacheKey];
+  }
+  return null;
+};
+var tryDecode = (str, decoder2) => {
+  try {
+    return decoder2(str);
+  } catch {
+    return str.replace(/(?:%[0-9A-Fa-f]{2})+/g, (match2) => {
+      try {
+        return decoder2(match2);
+      } catch {
+        return match2;
+      }
+    });
+  }
+};
+var tryDecodeURI = (str) => tryDecode(str, decodeURI);
+var getPath = (request) => {
+  const url = request.url;
+  const start = url.indexOf("/", url.indexOf(":") + 4);
+  let i = start;
+  for (; i < url.length; i++) {
+    const charCode = url.charCodeAt(i);
+    if (charCode === 37) {
+      const queryIndex = url.indexOf("?", i);
+      const hashIndex = url.indexOf("#", i);
+      const end = queryIndex === -1 ? hashIndex === -1 ? void 0 : hashIndex : hashIndex === -1 ? queryIndex : Math.min(queryIndex, hashIndex);
+      const path = url.slice(start, end);
+      return tryDecodeURI(path.includes("%25") ? path.replace(/%25/g, "%2525") : path);
+    } else if (charCode === 63 || charCode === 35) break;
+  }
+  return url.slice(start, i);
+};
+var getPathNoStrict = (request) => {
+  const result = getPath(request);
+  return result.length > 1 && result.at(-1) === "/" ? result.slice(0, -1) : result;
+};
+var mergePath = (base, sub, ...rest) => {
+  if (rest.length) sub = mergePath(sub, ...rest);
+  return `${base?.[0] === "/" ? "" : "/"}${base}${sub === "/" ? "" : `${base?.at(-1) === "/" ? "" : "/"}${sub?.[0] === "/" ? sub.slice(1) : sub}`}`;
+};
+var checkOptionalParameter = (path) => {
+  if (path.charCodeAt(path.length - 1) !== 63 || !path.includes(":")) return null;
+  const segments = path.split("/");
+  const results = [];
+  let basePath = "";
+  segments.forEach((segment) => {
+    if (segment !== "" && !/\:/.test(segment)) basePath += "/" + segment;
+    else if (/\:/.test(segment)) {
+      if (segment.charCodeAt(segment.length - 1) === 63) {
+        if (results.length === 0 && basePath === "") results.push("/");
+        else results.push(basePath);
+        const optionalSegment = segment.slice(0, -1);
+        basePath += "/" + optionalSegment;
+        results.push(basePath);
+      } else basePath += "/" + segment;
+    }
+  });
+  return results.filter((v, i, a) => a.indexOf(v) === i);
+};
+var tryDecodeURIComponent = (str) => str.indexOf("%") !== -1 ? tryDecode(str, decodeURIComponent_) : str;
+var _decodeURI = (value) => {
+  if (value.indexOf("+") !== -1) value = value.replace(/\+/g, " ");
+  return tryDecodeURIComponent(value);
+};
+var _getQueryParam = (url, key, multiple) => {
+  const hashIndex = url.indexOf("#", 8);
+  if (hashIndex !== -1) url = url.slice(0, hashIndex);
+  let encoded;
+  if (!multiple && key && key.indexOf("%") === -1 && key.indexOf("+") === -1) {
+    let keyIndex2 = url.indexOf("?", 8);
+    if (keyIndex2 === -1) return;
+    if (!url.startsWith(key, keyIndex2 + 1)) keyIndex2 = url.indexOf(`&${key}`, keyIndex2 + 1);
+    while (keyIndex2 !== -1) {
+      const trailingKeyCode = url.charCodeAt(keyIndex2 + key.length + 1);
+      if (trailingKeyCode === 61) {
+        const valueIndex = keyIndex2 + key.length + 2;
+        const endIndex = url.indexOf("&", valueIndex);
+        return _decodeURI(url.slice(valueIndex, endIndex === -1 ? void 0 : endIndex));
+      } else if (trailingKeyCode == 38 || isNaN(trailingKeyCode)) return "";
+      keyIndex2 = url.indexOf(`&${key}`, keyIndex2 + 1);
+    }
+    encoded = /[%+]/.test(url);
+    if (!encoded) return;
+  }
+  const results = /* @__PURE__ */ Object.create(null);
+  encoded ??= /[%+]/.test(url);
+  let keyIndex = url.indexOf("?", 8);
+  while (keyIndex !== -1) {
+    const nextKeyIndex = url.indexOf("&", keyIndex + 1);
+    let valueIndex = url.indexOf("=", keyIndex);
+    if (valueIndex > nextKeyIndex && nextKeyIndex !== -1) valueIndex = -1;
+    let name = url.slice(keyIndex + 1, valueIndex === -1 ? nextKeyIndex === -1 ? void 0 : nextKeyIndex : valueIndex);
+    if (encoded) name = _decodeURI(name);
+    keyIndex = nextKeyIndex;
+    if (name === "") continue;
+    let value;
+    if (valueIndex === -1) value = "";
+    else {
+      value = url.slice(valueIndex + 1, nextKeyIndex === -1 ? void 0 : nextKeyIndex);
+      if (encoded) value = _decodeURI(value);
+    }
+    if (multiple) {
+      if (!(results[name] && Array.isArray(results[name]))) results[name] = [];
+      results[name].push(value);
+    } else results[name] ??= value;
+  }
+  return key ? results[key] : results;
+};
+var getQueryParam = _getQueryParam;
+var getQueryParams = (url, key) => {
+  return _getQueryParam(url, key, true);
+};
+var decodeURIComponent_ = decodeURIComponent;
+
+// ../../node_modules/hono/dist/request.js
+var HonoRequest = class {
+  /**
+  * `.raw` can get the raw Request object.
+  *
+  * @see {@link https://hono.dev/docs/api/request#raw}
+  *
+  * @example
+  * ```ts
+  * // For Cloudflare Workers
+  * app.post('/', async (c) => {
+  *   const metadata = c.req.raw.cf?.hostMetadata?
+  *   ...
+  * })
+  * ```
+  */
+  raw;
+  #validatedData;
+  #matchResult;
+  routeIndex = 0;
+  /**
+  * `.path` can get the pathname of the request.
+  *
+  * @see {@link https://hono.dev/docs/api/request#path}
+  *
+  * @example
+  * ```ts
+  * app.get('/about/me', (c) => {
+  *   const pathname = c.req.path // `/about/me`
+  * })
+  * ```
+  */
+  path;
+  bodyCache = {};
+  constructor(request, path = "/", matchResult = [[]]) {
+    this.raw = request;
+    this.path = path;
+    this.#matchResult = matchResult;
+  }
+  param(key) {
+    return key ? this.#getDecodedParam(key) : this.#getAllDecodedParams();
+  }
+  #getDecodedParam(key) {
+    const paramKey = this.#matchResult[0][this.routeIndex]?.[1][key];
+    const param = this.#getParamValue(paramKey);
+    return param && tryDecodeURIComponent(param);
+  }
+  #getAllDecodedParams() {
+    const decoded = {};
+    const keys = Object.keys(this.#matchResult[0][this.routeIndex]?.[1] ?? {});
+    for (const key of keys) {
+      const value = this.#getParamValue(this.#matchResult[0][this.routeIndex][1][key]);
+      if (value !== void 0) decoded[key] = tryDecodeURIComponent(value);
+    }
+    return decoded;
+  }
+  #getParamValue(paramKey) {
+    return this.#matchResult[1] ? this.#matchResult[1][paramKey] : paramKey;
+  }
+  query(key) {
+    return getQueryParam(this.url, key);
+  }
+  queries(key) {
+    return getQueryParams(this.url, key);
+  }
+  header(name) {
+    if (name) return this.raw.headers.get(name) ?? void 0;
+    const headerData = /* @__PURE__ */ Object.create(null);
+    this.raw.headers.forEach((value, key) => {
+      headerData[key] = value;
+    });
+    return headerData;
+  }
+  async parseBody(options) {
+    return parseBody(this, options);
+  }
+  #cachedBody = (key) => {
+    const { bodyCache, raw: raw2 } = this;
+    const cachedBody = bodyCache[key];
+    if (cachedBody) return cachedBody;
+    for (const anyCachedKey in bodyCache) return bodyCache[anyCachedKey].then((body) => {
+      if (anyCachedKey === "json") body = JSON.stringify(body);
+      const contentType = anyCachedKey === "formData" ? void 0 : raw2.headers.get("content-type");
+      return new Response(body, { headers: contentType ? { "Content-Type": contentType } : void 0 })[key]();
+    });
+    return bodyCache[key] = raw2[key]();
+  };
+  /**
+  * `.json()` can parse Request body of type `application/json`
+  *
+  * @see {@link https://hono.dev/docs/api/request#json}
+  *
+  * @example
+  * ```ts
+  * app.post('/entry', async (c) => {
+  *   const body = await c.req.json()
+  * })
+  * ```
+  */
+  json() {
+    return this.#cachedBody("text").then((text) => JSON.parse(text));
+  }
+  /**
+  * `.text()` can parse Request body of type `text/plain`
+  *
+  * @see {@link https://hono.dev/docs/api/request#text}
+  *
+  * @example
+  * ```ts
+  * app.post('/entry', async (c) => {
+  *   const body = await c.req.text()
+  * })
+  * ```
+  */
+  text() {
+    return this.#cachedBody("text");
+  }
+  /**
+  * `.arrayBuffer()` parse Request body as an `ArrayBuffer`
+  *
+  * @see {@link https://hono.dev/docs/api/request#arraybuffer}
+  *
+  * @example
+  * ```ts
+  * app.post('/entry', async (c) => {
+  *   const body = await c.req.arrayBuffer()
+  * })
+  * ```
+  */
+  arrayBuffer() {
+    return this.#cachedBody("arrayBuffer");
+  }
+  /**
+  * `.bytes()` parses the request body as a `Uint8Array`.
+  *
+  * @see {@link https://hono.dev/docs/api/request#bytes}
+  *
+  * @example
+  * ```ts
+  * app.post('/entry', async (c) => {
+  *   const body = await c.req.bytes()
+  * })
+  * ```
+  */
+  bytes() {
+    return this.#cachedBody("arrayBuffer").then((buffer) => new Uint8Array(buffer));
+  }
+  /**
+  * Parses the request body as a `Blob`.
+  * @example
+  * ```ts
+  * app.post('/entry', async (c) => {
+  *   const body = await c.req.blob();
+  * });
+  * ```
+  * @see https://hono.dev/docs/api/request#blob
+  */
+  blob() {
+    return this.#cachedBody("blob");
+  }
+  /**
+  * Parses the request body as `FormData`.
+  * @example
+  * ```ts
+  * app.post('/entry', async (c) => {
+  *   const body = await c.req.formData();
+  * });
+  * ```
+  * @see https://hono.dev/docs/api/request#formdata
+  */
+  formData() {
+    return this.#cachedBody("formData");
+  }
+  /**
+  * Adds validated data to the request.
+  *
+  * @param target - The target of the validation.
+  * @param data - The validated data to add.
+  */
+  addValidatedData(target, data) {
+    (this.#validatedData ??= {})[target] = data;
+  }
+  valid(target) {
+    return this.#validatedData?.[target];
+  }
+  /**
+  * `.url()` can get the request url strings.
+  *
+  * @see {@link https://hono.dev/docs/api/request#url}
+  *
+  * @example
+  * ```ts
+  * app.get('/about/me', (c) => {
+  *   const url = c.req.url // `http://localhost:8787/about/me`
+  *   ...
+  * })
+  * ```
+  */
+  get url() {
+    return this.raw.url;
+  }
+  /**
+  * `.method()` can get the method name of the request.
+  *
+  * @see {@link https://hono.dev/docs/api/request#method}
+  *
+  * @example
+  * ```ts
+  * app.get('/about/me', (c) => {
+  *   const method = c.req.method // `GET`
+  * })
+  * ```
+  */
+  get method() {
+    return this.raw.method;
+  }
+  get [GET_MATCH_RESULT]() {
+    return this.#matchResult;
+  }
+  /**
+  * `.matchedRoutes()` can return a matched route in the handler
+  *
+  * @deprecated
+  *
+  * Use matchedRoutes helper defined in "hono/route" instead.
+  *
+  * @see {@link https://hono.dev/docs/api/request#matchedroutes}
+  *
+  * @example
+  * ```ts
+  * app.use('*', async function logger(c, next) {
+  *   await next()
+  *   c.req.matchedRoutes.forEach(({ handler, method, path }, i) => {
+  *     const name = handler.name || (handler.length < 2 ? '[handler]' : '[middleware]')
+  *     console.log(
+  *       method,
+  *       ' ',
+  *       path,
+  *       ' '.repeat(Math.max(10 - path.length, 0)),
+  *       name,
+  *       i === c.req.routeIndex ? '<- respond from here' : ''
+  *     )
+  *   })
+  * })
+  * ```
+  */
+  get matchedRoutes() {
+    return this.#matchResult[0].map(([[, route]]) => route);
+  }
+  /**
+  * `routePath()` can retrieve the path registered within the handler
+  *
+  * @deprecated
+  *
+  * Use routePath helper defined in "hono/route" instead.
+  *
+  * @see {@link https://hono.dev/docs/api/request#routepath}
+  *
+  * @example
+  * ```ts
+  * app.get('/posts/:id', (c) => {
+  *   return c.json({ path: c.req.routePath })
+  * })
+  * ```
+  */
+  get routePath() {
+    return this.#matchResult[0].map(([[, route]]) => route)[this.routeIndex].path;
+  }
+};
+
+// ../../node_modules/hono/dist/utils/html.js
+var HtmlEscapedCallbackPhase = {
+  Stringify: 1,
+  BeforeStream: 2,
+  Stream: 3
+};
+var raw = (value, callbacks) => {
+  const escapedString = new String(value);
+  escapedString.isEscaped = true;
+  escapedString.callbacks = callbacks;
+  return escapedString;
+};
+var resolveCallback = async (str, phase, preserveCallbacks, context, buffer) => {
+  if (typeof str === "object" && !(str instanceof String)) {
+    if (!(str instanceof Promise)) str = str.toString();
+    if (str instanceof Promise) str = await str;
+  }
+  const callbacks = str.callbacks;
+  if (!callbacks?.length) return Promise.resolve(str);
+  if (buffer) buffer[0] += str;
+  else buffer = [str];
+  const resStr = Promise.all(callbacks.map((c) => c({
+    phase,
+    buffer,
+    context
+  }))).then((res) => Promise.all(res.filter(Boolean).map((str2) => resolveCallback(str2, phase, false, context, buffer))).then(() => buffer[0]));
+  if (preserveCallbacks) return raw(await resStr, callbacks);
+  else return resStr;
+};
+
+// ../../node_modules/hono/dist/context.js
+var TEXT_PLAIN = "text/plain; charset=UTF-8";
+var setDefaultContentType = (contentType, headers) => {
+  return {
+    "Content-Type": contentType,
+    ...headers
+  };
+};
+var createResponseInstance = (body, init) => new Response(body, init);
+var Context = class {
+  #rawRequest;
+  #req;
+  /**
+  * `.env` can get bindings (environment variables, secrets, KV namespaces, D1 database, R2 bucket etc.) in Cloudflare Workers.
+  *
+  * @see {@link https://hono.dev/docs/api/context#env}
+  *
+  * @example
+  * ```ts
+  * // Environment object for Cloudflare Workers
+  * app.get('*', async c => {
+  *   const counter = c.env.COUNTER
+  * })
+  * ```
+  */
+  env = {};
+  #var;
+  finalized = false;
+  /**
+  * `.error` can get the error object from the middleware if the Handler throws an error.
+  *
+  * @see {@link https://hono.dev/docs/api/context#error}
+  *
+  * @example
+  * ```ts
+  * app.use('*', async (c, next) => {
+  *   await next()
+  *   if (c.error) {
+  *     // do something...
+  *   }
+  * })
+  * ```
+  */
+  error;
+  #status;
+  #executionCtx;
+  #res;
+  #layout;
+  #renderer;
+  #notFoundHandler;
+  #preparedHeaders;
+  #matchResult;
+  #path;
+  /**
+  * Creates an instance of the Context class.
+  *
+  * @param req - The Request object.
+  * @param options - Optional configuration options for the context.
+  */
+  constructor(req, options) {
+    this.#rawRequest = req;
+    if (options) {
+      this.#executionCtx = options.executionCtx;
+      this.env = options.env;
+      this.#notFoundHandler = options.notFoundHandler;
+      this.#path = options.path;
+      this.#matchResult = options.matchResult;
+    }
+  }
+  /**
+  * `.req` is the instance of {@link HonoRequest}.
+  */
+  get req() {
+    this.#req ??= new HonoRequest(this.#rawRequest, this.#path, this.#matchResult);
+    return this.#req;
+  }
+  /**
+  * @see {@link https://hono.dev/docs/api/context#event}
+  * The FetchEvent associated with the current request.
+  *
+  * @throws Will throw an error if the context does not have a FetchEvent.
+  */
+  get event() {
+    if (this.#executionCtx && "respondWith" in this.#executionCtx) return this.#executionCtx;
+    else throw Error("This context has no FetchEvent");
+  }
+  /**
+  * @see {@link https://hono.dev/docs/api/context#executionctx}
+  * The ExecutionContext associated with the current request.
+  *
+  * @throws Will throw an error if the context does not have an ExecutionContext.
+  */
+  get executionCtx() {
+    if (this.#executionCtx) return this.#executionCtx;
+    else throw Error("This context has no ExecutionContext");
+  }
+  /**
+  * @see {@link https://hono.dev/docs/api/context#res}
+  * The Response object for the current request.
+  */
+  get res() {
+    return this.#res ||= createResponseInstance(null, { headers: this.#preparedHeaders ??= new Headers() });
+  }
+  /**
+  * Sets the Response object for the current request.
+  *
+  * @param _res - The Response object to set.
+  */
+  set res(_res) {
+    if (this.#res && _res) {
+      _res = createResponseInstance(_res.body, _res);
+      for (const [k, v] of this.#res.headers.entries()) {
+        if (k === "content-type") continue;
+        if (k === "set-cookie") {
+          const cookies = this.#res.headers.getSetCookie();
+          _res.headers.delete("set-cookie");
+          for (const cookie of cookies) _res.headers.append("set-cookie", cookie);
+        } else _res.headers.set(k, v);
+      }
+    }
+    this.#res = _res;
+    this.finalized = true;
+  }
+  /**
+  * `.render()` can create a response within a layout.
+  *
+  * @see {@link https://hono.dev/docs/api/context#render-setrenderer}
+  *
+  * @example
+  * ```ts
+  * app.get('/', (c) => {
+  *   return c.render('Hello!')
+  * })
+  * ```
+  */
+  render = (...args) => {
+    this.#renderer ??= (content) => this.html(content);
+    return this.#renderer(...args);
+  };
+  /**
+  * Sets the layout for the response.
+  *
+  * @param layout - The layout to set.
+  * @returns The layout function.
+  */
+  setLayout = (layout) => this.#layout = layout;
+  /**
+  * Gets the current layout for the response.
+  *
+  * @returns The current layout function.
+  */
+  getLayout = () => this.#layout;
+  /**
+  * `.setRenderer()` can set the layout in the custom middleware.
+  *
+  * @see {@link https://hono.dev/docs/api/context#render-setrenderer}
+  *
+  * @example
+  * ```tsx
+  * app.use('*', async (c, next) => {
+  *   c.setRenderer((content) => {
+  *     return c.html(
+  *       <html>
+  *         <body>
+  *           <p>{content}</p>
+  *         </body>
+  *       </html>
+  *     )
+  *   })
+  *   await next()
+  * })
+  * ```
+  */
+  setRenderer = (renderer) => {
+    this.#renderer = renderer;
+  };
+  /**
+  * `.header()` can set headers.
+  *
+  * @see {@link https://hono.dev/docs/api/context#header}
+  *
+  * @example
+  * ```ts
+  * app.get('/welcome', (c) => {
+  *   // Set headers
+  *   c.header('X-Message', 'Hello!')
+  *   c.header('Content-Type', 'text/plain')
+  *
+  *   // Append multiple headers using the append option (e.g. Vary)
+  *   c.header('Vary', 'Accept-Encoding', { append: true })
+  *   c.header('Vary', 'User-Agent', { append: true })
+  *
+  *   return c.body('Thank you for coming')
+  * })
+  * ```
+  */
+  header = (name, value, options) => {
+    if (this.finalized) this.#res = createResponseInstance(this.#res.body, this.#res);
+    const headers = this.#res ? this.#res.headers : this.#preparedHeaders ??= new Headers();
+    if (value === void 0) headers.delete(name);
+    else if (options?.append) headers.append(name, value);
+    else headers.set(name, value);
+  };
+  status = (status) => {
+    this.#status = status;
+  };
+  /**
+  * `.set()` can set the value specified by the key.
+  *
+  * @see {@link https://hono.dev/docs/api/context#set-get}
+  *
+  * @example
+  * ```ts
+  * app.use('*', async (c, next) => {
+  *   c.set('message', 'Hono is hot!!')
+  *   await next()
+  * })
+  * ```
+  */
+  set = (key, value) => {
+    this.#var ??= /* @__PURE__ */ new Map();
+    this.#var.set(key, value);
+  };
+  /**
+  * `.get()` can use the value specified by the key.
+  *
+  * @see {@link https://hono.dev/docs/api/context#set-get}
+  *
+  * @example
+  * ```ts
+  * app.get('/', (c) => {
+  *   const message = c.get('message')
+  *   return c.text(`The message is "${message}"`)
+  * })
+  * ```
+  */
+  get = (key) => {
+    return this.#var ? this.#var.get(key) : void 0;
+  };
+  /**
+  * `.var` can access the value of a variable.
+  *
+  * @see {@link https://hono.dev/docs/api/context#var}
+  *
+  * @example
+  * ```ts
+  * const result = c.var.client.oneMethod()
+  * ```
+  */
+  get var() {
+    if (!this.#var) return {};
+    return Object.fromEntries(this.#var);
+  }
+  #newResponse(data, arg, headers) {
+    let responseHeaders = this.#res ? new Headers(this.#res.headers) : this.#preparedHeaders;
+    if (typeof arg === "object" && arg.headers) {
+      responseHeaders ??= new Headers();
+      for (const [key, value] of new Headers(arg.headers)) if (key === "set-cookie") responseHeaders.append(key, value);
+      else responseHeaders.set(key, value);
+    }
+    if (headers) {
+      if (!responseHeaders) {
+        let count = 0;
+        for (const k in headers) if (++count > 1 || typeof headers[k] !== "string") {
+          responseHeaders = new Headers();
+          break;
+        }
+      }
+      if (responseHeaders) for (const k in headers) {
+        const v = headers[k];
+        if (typeof v === "string") responseHeaders.set(k, v);
+        else {
+          responseHeaders.delete(k);
+          for (const v2 of v) responseHeaders.append(k, v2);
+        }
+      }
+    }
+    const status = typeof arg === "number" ? arg : arg?.status ?? this.#status;
+    return createResponseInstance(data, {
+      status,
+      headers: responseHeaders ?? headers
+    });
+  }
+  newResponse = (...args) => this.#newResponse(...args);
+  /**
+  * `.body()` can return the HTTP response.
+  * You can set headers with `.header()` and set HTTP status code with `.status`.
+  * This can also be set in `.text()`, `.json()` and so on.
+  *
+  * @see {@link https://hono.dev/docs/api/context#body}
+  *
+  * @example
+  * ```ts
+  * app.get('/welcome', (c) => {
+  *   // Set headers
+  *   c.header('X-Message', 'Hello!')
+  *   c.header('Content-Type', 'text/plain')
+  *   // Set HTTP status code
+  *   c.status(201)
+  *
+  *   // Return the response body
+  *   return c.body('Thank you for coming')
+  * })
+  * ```
+  */
+  body = (data, arg, headers) => this.#newResponse(data, arg, headers);
+  /**
+  * `.text()` can render text as `Content-Type:text/plain`.
+  *
+  * @see {@link https://hono.dev/docs/api/context#text}
+  *
+  * @example
+  * ```ts
+  * app.get('/say', (c) => {
+  *   return c.text('Hello!')
+  * })
+  * ```
+  */
+  text = (text, arg, headers) => {
+    return !this.#preparedHeaders && !this.#status && !arg && !headers && !this.finalized ? new Response(text) : this.#newResponse(text, arg, setDefaultContentType(TEXT_PLAIN, headers));
+  };
+  /**
+  * `.json()` can render JSON as `Content-Type:application/json`.
+  *
+  * @see {@link https://hono.dev/docs/api/context#json}
+  *
+  * @example
+  * ```ts
+  * app.get('/api', (c) => {
+  *   return c.json({ message: 'Hello!' })
+  * })
+  * ```
+  */
+  json = (object, arg, headers) => {
+    return this.#newResponse(JSON.stringify(object), arg, setDefaultContentType("application/json", headers));
+  };
+  html = (html, arg, headers) => {
+    const res = (html2) => this.#newResponse(html2, arg, setDefaultContentType("text/html; charset=UTF-8", headers));
+    return typeof html === "object" ? resolveCallback(html, HtmlEscapedCallbackPhase.Stringify, false, {}).then(res) : res(html);
+  };
+  /**
+  * `.redirect()` can Redirect, default status code is 302.
+  *
+  * @see {@link https://hono.dev/docs/api/context#redirect}
+  *
+  * @example
+  * ```ts
+  * app.get('/redirect', (c) => {
+  *   return c.redirect('/')
+  * })
+  * app.get('/redirect-permanently', (c) => {
+  *   return c.redirect('/', 301)
+  * })
+  * ```
+  */
+  redirect = (location, status) => {
+    const locationString = String(location);
+    this.header("Location", !/[^\x00-\xFF]/.test(locationString) ? locationString : encodeURI(locationString));
+    return this.newResponse(null, status ?? 302);
+  };
+  /**
+  * `.notFound()` can return the Not Found Response.
+  *
+  * @see {@link https://hono.dev/docs/api/context#notfound}
+  *
+  * @example
+  * ```ts
+  * app.get('/notfound', (c) => {
+  *   return c.notFound()
+  * })
+  * ```
+  */
+  notFound = () => {
+    this.#notFoundHandler ??= () => createResponseInstance();
+    return this.#notFoundHandler(this);
+  };
+};
+
+// ../../node_modules/hono/dist/compose.js
+var compose = (middleware, onError, onNotFound) => {
+  return (context, next) => {
+    let index = -1;
+    return dispatch(0);
+    async function dispatch(i) {
+      if (i <= index) throw new Error("next() called multiple times");
+      index = i;
+      let res;
+      let isError = false;
+      let handler2;
+      if (middleware[i]) {
+        handler2 = middleware[i][0][0];
+        context.req.routeIndex = i;
+      } else handler2 = i === middleware.length && next || void 0;
+      if (handler2) try {
+        res = await handler2(context, () => dispatch(i + 1));
+      } catch (err) {
+        if (err instanceof Error && onError) {
+          context.error = err;
+          res = await onError(err, context);
+          isError = true;
+        } else throw err;
+      }
+      else if (context.finalized === false && onNotFound) res = await onNotFound(context);
+      if (res && (context.finalized === false || isError)) context.res = res;
+      return context;
+    }
+  };
+};
+
+// ../../node_modules/hono/dist/router.js
+var METHODS = [
+  "get",
+  "post",
+  "put",
+  "delete",
+  "options",
+  "patch",
+  "query"
+];
+var MESSAGE_MATCHER_IS_ALREADY_BUILT = "Can not add a route since the matcher is already built.";
+var UnsupportedPathError = class extends Error {
+};
+
+// ../../node_modules/hono/dist/utils/constants.js
+var COMPOSED_HANDLER = "__COMPOSED_HANDLER";
+
+// ../../node_modules/hono/dist/hono-base.js
+var notFoundHandler = (c) => {
+  return c.text("404 Not Found", 404);
+};
+var errorHandler = (err, c) => {
+  if ("getResponse" in err) {
+    const res = err.getResponse();
+    return c.newResponse(res.body, res);
+  }
+  console.error(err);
+  return c.text("Internal Server Error", 500);
+};
+var Hono = class Hono2 {
+  get;
+  post;
+  put;
+  delete;
+  options;
+  patch;
+  query;
+  all;
+  on;
+  use;
+  router;
+  getPath;
+  _basePath = "/";
+  #path = "/";
+  routes = [];
+  constructor(options = {}) {
+    [...METHODS, "all"].forEach((method) => {
+      this[method] = (args1, ...args) => {
+        const methodName = method.toUpperCase();
+        if (typeof args1 === "string") this.#path = args1;
+        else this.#addRoute(methodName, this.#path, args1);
+        args.forEach((handler2) => {
+          this.#addRoute(methodName, this.#path, handler2);
+        });
+        return this;
+      };
+    });
+    this.on = (method, path, ...handlers) => {
+      for (const p of [path].flat()) {
+        this.#path = p;
+        for (const m of [method].flat()) {
+          const methodName = m.toUpperCase();
+          for (const handler2 of handlers) this.#addRoute(methodName, this.#path, handler2);
+        }
+      }
+      return this;
+    };
+    this.use = (arg1, ...handlers) => {
+      if (typeof arg1 === "string") this.#path = arg1;
+      else {
+        this.#path = "*";
+        handlers.unshift(arg1);
+      }
+      handlers.forEach((handler2) => {
+        this.#addRoute("ALL", this.#path, handler2);
+      });
+      return this;
+    };
+    const { strict, ...optionsWithoutStrict } = options;
+    Object.assign(this, optionsWithoutStrict);
+    this.getPath = strict ?? true ? options.getPath ?? getPath : getPathNoStrict;
+  }
+  #clone() {
+    const clone = new Hono2({
+      router: this.router,
+      getPath: this.getPath
+    });
+    clone.errorHandler = this.errorHandler;
+    clone.#notFoundHandler = this.#notFoundHandler;
+    clone.routes = this.routes;
+    return clone;
+  }
+  #notFoundHandler = notFoundHandler;
+  errorHandler = errorHandler;
+  /**
+  * `.route()` allows grouping other Hono instance in routes.
+  *
+  * @see {@link https://hono.dev/docs/api/routing#grouping}
+  *
+  * @param {string} path - base Path
+  * @param {Hono} app - other Hono instance
+  * @returns {Hono} routed Hono instance
+  *
+  * @example
+  * ```ts
+  * const app = new Hono()
+  * const app2 = new Hono()
+  *
+  * app2.get("/user", (c) => c.text("user"))
+  * app.route("/api", app2) // GET /api/user
+  * ```
+  */
+  route(path, app) {
+    const subApp = this.basePath(path);
+    app.routes.map((r) => {
+      let handler2;
+      if (app.errorHandler === errorHandler) handler2 = r.handler;
+      else {
+        handler2 = async (c, next) => (await compose([], app.errorHandler)(c, () => r.handler(c, next))).res;
+        handler2[COMPOSED_HANDLER] = r.handler;
+      }
+      subApp.#addRoute(r.method, r.path, handler2, r.basePath);
+    });
+    return this;
+  }
+  /**
+  * `.basePath()` allows base paths to be specified.
+  *
+  * @see {@link https://hono.dev/docs/api/routing#base-path}
+  *
+  * @param {string} path - base Path
+  * @returns {Hono} changed Hono instance
+  *
+  * @example
+  * ```ts
+  * const api = new Hono().basePath('/api')
+  * ```
+  */
+  basePath(path) {
+    const subApp = this.#clone();
+    subApp._basePath = mergePath(this._basePath, path);
+    return subApp;
+  }
+  /**
+  * `.onError()` handles an error and returns a customized Response.
+  *
+  * @see {@link https://hono.dev/docs/api/hono#error-handling}
+  *
+  * @param {ErrorHandler} handler - request Handler for error
+  * @returns {Hono} changed Hono instance
+  *
+  * @example
+  * ```ts
+  * app.onError((err, c) => {
+  *   console.error(`${err}`)
+  *   return c.text('Custom Error Message', 500)
+  * })
+  * ```
+  */
+  onError = (handler2) => {
+    this.errorHandler = handler2;
+    return this;
+  };
+  /**
+  * `.notFound()` allows you to customize a Not Found Response.
+  *
+  * @see {@link https://hono.dev/docs/api/hono#not-found}
+  *
+  * @param {NotFoundHandler} handler - request handler for not-found
+  * @returns {Hono} changed Hono instance
+  *
+  * @example
+  * ```ts
+  * app.notFound((c) => {
+  *   return c.text('Custom 404 Message', 404)
+  * })
+  * ```
+  */
+  notFound = (handler2) => {
+    this.#notFoundHandler = handler2;
+    return this;
+  };
+  /**
+  * `.mount()` allows you to mount applications built with other frameworks into your Hono application.
+  *
+  * @see {@link https://hono.dev/docs/api/hono#mount}
+  *
+  * @param {string} path - base Path
+  * @param {Function} applicationHandler - other Request Handler
+  * @param {MountOptions} [options] - options of `.mount()`
+  * @returns {Hono} mounted Hono instance
+  *
+  * @example
+  * ```ts
+  * import { Router as IttyRouter } from 'itty-router'
+  * import { Hono } from 'hono'
+  * // Create itty-router application
+  * const ittyRouter = IttyRouter()
+  * // GET /itty-router/hello
+  * ittyRouter.get('/hello', () => new Response('Hello from itty-router'))
+  *
+  * const app = new Hono()
+  * app.mount('/itty-router', ittyRouter.handle)
+  * ```
+  *
+  * @example
+  * ```ts
+  * const app = new Hono()
+  * // Send the request to another application without modification.
+  * app.mount('/app', anotherApp, {
+  *   replaceRequest: (req) => req,
+  * })
+  * ```
+  */
+  mount(path, applicationHandler, options) {
+    let replaceRequest;
+    let optionHandler;
+    if (options) {
+      if (typeof options === "function") optionHandler = options;
+      else {
+        optionHandler = options.optionHandler;
+        if (options.replaceRequest === false) replaceRequest = (request) => request;
+        else replaceRequest = options.replaceRequest;
+      }
+    }
+    const getOptions = optionHandler ? (c) => {
+      const options2 = optionHandler(c);
+      return Array.isArray(options2) ? options2 : [options2];
+    } : (c) => {
+      let executionContext = void 0;
+      try {
+        executionContext = c.executionCtx;
+      } catch {
+      }
+      return [c.env, executionContext];
+    };
+    replaceRequest ||= (() => {
+      const mergedPath = mergePath(this._basePath, path);
+      const pathPrefixLength = mergedPath === "/" ? 0 : mergedPath.length;
+      return (request) => {
+        const url = new URL(request.url);
+        url.pathname = this.getPath(request).slice(pathPrefixLength) || "/";
+        return new Request(url, request);
+      };
+    })();
+    const handler2 = async (c, next) => {
+      const res = await applicationHandler(replaceRequest(c.req.raw), ...getOptions(c));
+      if (res) return res;
+      await next();
+    };
+    this.#addRoute("ALL", mergePath(path, "*"), handler2);
+    return this;
+  }
+  #addRoute(method, path, handler2, baseRoutePath) {
+    path = mergePath(this._basePath, path);
+    const r = {
+      basePath: baseRoutePath !== void 0 ? mergePath(this._basePath, baseRoutePath) : this._basePath,
+      path,
+      method,
+      handler: handler2
+    };
+    this.router.add(method, path, [handler2, r]);
+    this.routes.push(r);
+  }
+  #handleError(err, c) {
+    if (err instanceof Error) return this.errorHandler(err, c);
+    throw err;
+  }
+  #dispatch(request, executionCtx, env, method) {
+    if (method === "HEAD") return (async () => new Response(null, await this.#dispatch(request, executionCtx, env, "GET")))();
+    const path = this.getPath(request, { env });
+    const matchResult = this.router.match(method, path);
+    const c = new Context(request, {
+      path,
+      matchResult,
+      env,
+      executionCtx,
+      notFoundHandler: this.#notFoundHandler
+    });
+    if (matchResult[0].length === 1) {
+      let res;
+      try {
+        res = matchResult[0][0][0][0](c, async () => {
+          c.res = await this.#notFoundHandler(c);
+        });
+      } catch (err) {
+        return this.#handleError(err, c);
+      }
+      return res instanceof Promise ? res.then((resolved) => resolved || (c.finalized ? c.res : this.#notFoundHandler(c))).catch((err) => this.#handleError(err, c)) : res ?? this.#notFoundHandler(c);
+    }
+    const composed = compose(matchResult[0], this.errorHandler, this.#notFoundHandler);
+    return (async () => {
+      try {
+        const context = await composed(c);
+        if (!context.finalized) throw new Error("Context is not finalized. Did you forget to return a Response object or `await next()`?");
+        return context.res;
+      } catch (err) {
+        return this.#handleError(err, c);
+      }
+    })();
+  }
+  /**
+  * `.fetch()` will be entry point of your app.
+  *
+  * @see {@link https://hono.dev/docs/api/hono#fetch}
+  *
+  * @param {Request} request - request Object of request
+  * @param {Env} env - env Object
+  * @param {ExecutionContext} executionCtx - context of execution
+  * @returns {Response | Promise<Response>} response of request
+  *
+  */
+  fetch = (request, ...rest) => {
+    return this.#dispatch(request, rest[1], rest[0], request.method);
+  };
+  /**
+  * `.request()` is a useful method for testing.
+  * You can pass a URL or pathname to send a GET request.
+  * app will return a Response object.
+  * ```ts
+  * test('GET /hello is ok', async () => {
+  *   const res = await app.request('/hello')
+  *   expect(res.status).toBe(200)
+  * })
+  * ```
+  * @see https://hono.dev/docs/api/hono#request
+  */
+  request = (input, requestInit, Env, executionCtx) => {
+    if (input instanceof Request) return this.fetch(requestInit ? new Request(input, requestInit) : input, Env, executionCtx);
+    input = input.toString();
+    return this.fetch(new Request(/^https?:\/\//.test(input) ? input : `http://localhost${mergePath("/", input)}`, requestInit), Env, executionCtx);
+  };
+  /**
+  * `.fire()` automatically adds a global fetch event listener.
+  * This can be useful for environments that adhere to the Service Worker API, such as non-ES module Cloudflare Workers.
+  * @deprecated
+  * Use `fire` from `hono/service-worker` instead.
+  * ```ts
+  * import { Hono } from 'hono'
+  * import { fire } from 'hono/service-worker'
+  *
+  * const app = new Hono()
+  * // ...
+  * fire(app)
+  * ```
+  * @see https://hono.dev/docs/api/hono#fire
+  * @see https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API
+  * @see https://developers.cloudflare.com/workers/reference/migrate-to-module-workers/
+  */
+  fire = () => {
+    addEventListener("fetch", (event) => {
+      event.respondWith(this.#dispatch(event.request, event, void 0, event.request.method));
+    });
+  };
+};
+
+// ../../node_modules/hono/dist/router/utils.js
+var createNullObject = () => /* @__PURE__ */ Object.create(null);
+
+// ../../node_modules/hono/dist/router/reg-exp-router/matcher.js
+var emptyParam = [];
+function match(method, path) {
+  const matchers = this.buildAllMatchers();
+  const match2 = ((method2, path2) => {
+    const matcher = matchers[method2] || matchers["ALL"];
+    const staticMatch = matcher[2][path2];
+    if (staticMatch) return staticMatch;
+    const match3 = path2.match(matcher[0]);
+    if (!match3) return [[], emptyParam];
+    const index = match3.indexOf("", 1);
+    return [matcher[1][index], match3];
+  });
+  this.match = match2;
+  return match2(method, path);
+}
+
+// ../../node_modules/hono/dist/router/reg-exp-router/node.js
+var LABEL_REG_EXP_STR = "[^/]+";
+var TAIL_WILDCARD_REG_EXP_STR = "(?:|/.*)";
+var PATH_ERROR = /* @__PURE__ */ Symbol();
+var regExpMetaChars = /* @__PURE__ */ new Set(".\\+*[^]$()");
+function compareKey(a, b) {
+  if (a.length === 1) return b.length === 1 ? a < b ? -1 : 1 : -1;
+  if (b.length === 1) return 1;
+  if (a === ".*" || a === "(?:|/.*)") return b === "(?:|/.*)" ? -1 : 1;
+  else if (b === ".*" || b === "(?:|/.*)") return -1;
+  if (a === "[^/]+") return 1;
+  else if (b === "[^/]+") return -1;
+  return a.length === b.length ? a < b ? -1 : 1 : b.length - a.length;
+}
+var Node = class Node2 {
+  #index;
+  #varIndex;
+  #children = createNullObject();
+  insert(tokens, index, paramMap, context, isStatic) {
+    let node = this;
+    for (let i = 0, len = tokens.length; i < len; i++) {
+      const token = tokens[i];
+      const pattern = token.length === 1 ? token === "*" ? i === len - 1 ? [
+        "",
+        "",
+        ".*"
+      ] : [
+        "",
+        "",
+        LABEL_REG_EXP_STR
+      ] : null : token === "/*" ? [
+        "",
+        "",
+        TAIL_WILDCARD_REG_EXP_STR
+      ] : token.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);
+      let nextNode;
+      if (pattern) {
+        const name = pattern[1];
+        let regexpStr = pattern[2] || "[^/]+";
+        if (name && pattern[2]) {
+          if (regexpStr === ".*") throw PATH_ERROR;
+          regexpStr = regexpStr.replace(/^\((?!\?:)(?=[^)]+\)$)/, "(?:");
+          if (/\((?!\?:)/.test(regexpStr)) throw PATH_ERROR;
+          if (regexpStr.length === 1 && regExpMetaChars.has(regexpStr)) throw PATH_ERROR;
+        }
+        nextNode = node.#children[regexpStr];
+        if (!nextNode) {
+          if (regexpStr !== ".*" && regexpStr !== "(?:|/.*)") {
+            for (const k in node.#children) if ((regexpStr.length > 1 || k.length > 1) && k !== ".*" && k !== "(?:|/.*)") throw PATH_ERROR;
+          }
+          nextNode = node.#children[regexpStr] = new Node2();
+        }
+        if (name !== "") {
+          nextNode.#varIndex ??= context.varIndex++;
+          paramMap.push([name, nextNode.#varIndex]);
+        }
+      } else {
+        nextNode = node.#children[token];
+        if (!nextNode) {
+          for (const k in node.#children) if (k.length > 1 && k !== ".*" && k !== "(?:|/.*)") throw PATH_ERROR;
+          nextNode = node.#children[token] = new Node2();
+        }
+      }
+      node = nextNode;
+    }
+    if (node.#index !== void 0) throw PATH_ERROR;
+    node.#index = isStatic ? -1 : index;
+  }
+  buildRegExpStr() {
+    const strList = Object.keys(this.#children).sort(compareKey).map((k) => {
+      const c = this.#children[k];
+      const childStr = c.buildRegExpStr();
+      return childStr === "" ? "" : (typeof c.#varIndex === "number" ? `(${k})@${c.#varIndex}` : regExpMetaChars.has(k) ? `\\${k}` : k) + childStr;
+    }).filter(Boolean);
+    if (typeof this.#index === "number" && this.#index !== -1) strList.unshift(`#${this.#index}`);
+    if (strList.length === 0) return "";
+    if (strList.length === 1) return strList[0];
+    return "(?:" + strList.join("|") + ")";
+  }
+};
+
+// ../../node_modules/hono/dist/router/reg-exp-router/trie.js
+var Trie = class {
+  #context = { varIndex: 0 };
+  #root = new Node();
+  #index = 0;
+  paths = createNullObject();
+  insert(path, isStatic) {
+    if (isStatic) {
+      this.#root.insert(path.split(""), 0, [], this.#context, true);
+      return;
+    }
+    const paramAssoc = [];
+    const groups = [];
+    let markedPath = path;
+    for (let i = 0; ; ) {
+      let replaced = false;
+      markedPath = markedPath.replace(/\{[^}]+\}/g, (m) => {
+        const mark = `@\\${i}`;
+        groups[i] = [mark, m];
+        i++;
+        replaced = true;
+        return mark;
+      });
+      if (!replaced) break;
+    }
+    const tokens = markedPath.match(/(?::[^\/]+)|(?:\/\*$)|./g) || [];
+    for (let i = groups.length - 1; i >= 0; i--) {
+      const [mark] = groups[i];
+      for (let j = tokens.length - 1; j >= 0; j--) if (tokens[j].indexOf(mark) !== -1) {
+        tokens[j] = tokens[j].replace(mark, groups[i][1]);
+        break;
+      }
+    }
+    this.#root.insert(tokens, this.#index, paramAssoc, this.#context, false);
+    this.paths[path] = [this.#index++, paramAssoc];
+  }
+  buildRegExp() {
+    let regexp = this.#root.buildRegExpStr();
+    if (regexp === "") return [
+      /^$/,
+      [],
+      []
+    ];
+    let captureIndex = 0;
+    const indexReplacementMap = [];
+    const paramReplacementMap = [];
+    regexp = regexp.replace(/#(\d+)|@(\d+)|\.\*\$/g, (_, handlerIndex, paramIndex) => {
+      if (handlerIndex !== void 0) {
+        indexReplacementMap[++captureIndex] = Number(handlerIndex);
+        return "$()";
+      }
+      if (paramIndex !== void 0) {
+        paramReplacementMap[Number(paramIndex)] = ++captureIndex;
+        return "";
+      }
+      return "";
+    });
+    return [
+      new RegExp(`^${regexp}`),
+      indexReplacementMap,
+      paramReplacementMap
+    ];
+  }
+};
+
+// ../../node_modules/hono/dist/router/reg-exp-router/router.js
+var wildcardRegExpCache = createNullObject();
+function buildWildcardRegExp(path) {
+  return wildcardRegExpCache[path] ??= new RegExp(`^${path.replace(/\/:[^/{}]+(?:\{\[\^\/]\+})?(?=[/{]|$)|\/?\*$|([.\\+*[^\]$()?{}|])/g, (match2, metaChar) => metaChar ? `\\${metaChar}` : match2 === "/*" ? TAIL_WILDCARD_REG_EXP_STR : match2 === "*" ? ".*" : `/:${LABEL_REG_EXP_STR}`)}$`);
+}
+function findMiddleware(middleware, path) {
+  for (const k of Object.keys(middleware).sort((a, b) => b.length - a.length)) if (buildWildcardRegExp(k).test(path)) return [...middleware[k]];
+}
+var RegExpRouter = class {
+  name = "RegExpRouter";
+  #middleware;
+  #routes;
+  #tries;
+  constructor() {
+    this.#middleware = { ["ALL"]: createNullObject() };
+    this.#routes = { ["ALL"]: createNullObject() };
+    this.#tries = { ["ALL"]: new Trie() };
+  }
+  #insertPath(method, path) {
+    try {
+      this.#tries[method].insert(path, !/\*|\/:/.test(path));
+    } catch (e) {
+      throw e === PATH_ERROR ? new UnsupportedPathError(path) : e;
+    }
+  }
+  add(method, path, handler2) {
+    const middleware = this.#middleware;
+    const routes = this.#routes;
+    if (!middleware) throw new Error(MESSAGE_MATCHER_IS_ALREADY_BUILT);
+    if (!middleware[method]) {
+      this.#tries[method] = new Trie();
+      for (const handlerMap of [middleware, routes]) {
+        handlerMap[method] = createNullObject();
+        for (const p in handlerMap["ALL"]) {
+          handlerMap[method][p] = [...handlerMap["ALL"][p]];
+          this.#insertPath(method, p);
+        }
+      }
+    }
+    if (path === "/*") path = "*";
+    const methods = method === "ALL" ? Object.keys(middleware) : [method];
+    if (/\*$/.test(path)) {
+      const re = buildWildcardRegExp(path);
+      for (const m of methods) if (!middleware[m][path]) {
+        this.#insertPath(m, path);
+        middleware[m][path] = findMiddleware(middleware[m], path) || findMiddleware(middleware["ALL"], path) || [];
+      }
+      for (const handlerMap of [middleware, routes]) for (const m of methods) for (const p in handlerMap[m]) re.test(p) && handlerMap[m][p].push([handler2, path]);
+      return;
+    }
+    const paths = checkOptionalParameter(path) || [path];
+    for (const path2 of paths) for (const m of methods) {
+      if (!routes[m][path2]) {
+        this.#insertPath(m, path2);
+        routes[m][path2] = findMiddleware(middleware[m], path2) || findMiddleware(middleware["ALL"], path2) || [];
+      }
+      routes[m][path2].push([handler2, path2]);
+    }
+  }
+  match = match;
+  buildAllMatchers() {
+    const matchers = createNullObject();
+    for (const method of Object.keys(this.#routes)) matchers[method] = this.#buildMatcher(method);
+    this.#middleware = this.#routes = this.#tries = void 0;
+    wildcardRegExpCache = createNullObject();
+    return matchers;
+  }
+  #buildMatcher(method) {
+    const middleware = this.#middleware[method];
+    const routes = this.#routes[method];
+    const trie = this.#tries[method];
+    const staticMap = createNullObject();
+    const handlerData = [];
+    const [regexp, indexReplacementMap, paramReplacementMap] = trie.buildRegExp();
+    for (const r of [middleware, routes]) for (const path in r) {
+      const handlers = r[path];
+      const pathData = trie.paths[path];
+      if (!pathData) {
+        staticMap[path] = [handlers.map(([h]) => [h, createNullObject()]), emptyParam];
+        continue;
+      }
+      handlerData[pathData[0]] = handlers.map(([h, handlerPath]) => [h, trie.paths[handlerPath][1].reduceRight((map, [key], i) => {
+        map[key] = paramReplacementMap[pathData[1][i][1]];
+        return map;
+      }, createNullObject())]);
+    }
+    return [
+      regexp,
+      indexReplacementMap.map((i) => handlerData[i]),
+      staticMap
+    ];
+  }
+};
+
+// ../../node_modules/hono/dist/router/smart-router/router.js
+var SmartRouter = class {
+  name = "SmartRouter";
+  #routers = [];
+  #routes = [];
+  constructor(init) {
+    this.#routers = init.routers;
+  }
+  add(method, path, handler2) {
+    if (!this.#routes) throw new Error(MESSAGE_MATCHER_IS_ALREADY_BUILT);
+    this.#routes.push([
+      method,
+      path,
+      handler2
+    ]);
+  }
+  match(method, path) {
+    if (!this.#routes) throw new Error("Fatal error");
+    const routers = this.#routers;
+    const routes = this.#routes;
+    const len = routers.length;
+    let i = 0;
+    let res;
+    for (; i < len; i++) {
+      const router = routers[i];
+      try {
+        for (let i2 = 0, len2 = routes.length; i2 < len2; i2++) router.add(...routes[i2]);
+        res = router.match(method, path);
+      } catch (e) {
+        if (e instanceof UnsupportedPathError) continue;
+        throw e;
+      }
+      this.match = router.match.bind(router);
+      this.#routers = [router];
+      this.#routes = void 0;
+      break;
+    }
+    if (i === len) throw new Error("Fatal error");
+    this.name = `SmartRouter + ${this.activeRouter.name}`;
+    return res;
+  }
+  get activeRouter() {
+    if (this.#routes || this.#routers.length !== 1) throw new Error("No active router has been determined yet.");
+    return this.#routers[0];
+  }
+};
+
+// ../../node_modules/hono/dist/router/trie-router/node.js
+var emptyParams = createNullObject();
+var order = 0;
+var Node3 = class Node4 {
+  #methods = [];
+  #children = createNullObject();
+  #patterns = [];
+  #pattern;
+  #params = emptyParams;
+  insert(method, path, handler2) {
+    let curNode = this;
+    const parts = splitRoutingPath(path);
+    const possibleKeys = /* @__PURE__ */ new Set();
+    let i = 0;
+    for (const p of parts) {
+      const nextP = parts[++i];
+      const pattern = getPattern(p, nextP) || (nextP === void 0 && p && p.indexOf("*") === p.length - 1 ? p : null);
+      const isParam = Array.isArray(pattern);
+      const key = isParam ? pattern[0] : pattern || p;
+      const child = curNode.#children[key] ||= new Node4();
+      if (pattern && !child.#pattern) {
+        child.#pattern = pattern;
+        curNode.#patterns.push(child);
+      }
+      curNode = child;
+      if (isParam) possibleKeys.add(pattern[1]);
+    }
+    curNode.#methods.push({ [method]: {
+      handler: handler2,
+      possibleKeys: [...possibleKeys],
+      score: ++order
+    } });
+  }
+  #pushHandlerSets(handlerSets, node, method, nodeParams, params) {
+    for (let i = 0, len = node.#methods.length; i < len; i++) {
+      const m = node.#methods[i];
+      const handlerSet = m[method] || m["ALL"];
+      if (handlerSet) {
+        handlerSet.params = createNullObject();
+        handlerSets.push(handlerSet);
+        for (let i2 = 0, len2 = handlerSet.possibleKeys.length; i2 < len2; i2++) {
+          const key = handlerSet.possibleKeys[i2];
+          handlerSet.params[key] = params?.[key] && !i2 ? params[key] : nodeParams[key] ?? params?.[key];
+        }
+      }
+    }
+  }
+  search(method, path) {
+    const handlerSets = [];
+    this.#params = emptyParams;
+    let curNodes = [this];
+    const parts = splitPath(path);
+    const curNodesQueue = [];
+    const len = parts.length;
+    let partOffsets = null;
+    for (let i = 0; i < len; i++) {
+      const part = parts[i];
+      const isLast = i === len - 1;
+      const tempNodes = [];
+      for (let j = 0, len2 = curNodes.length; j < len2; j++) {
+        const node = curNodes[j];
+        const nextNode = node.#children[part];
+        if (nextNode) {
+          nextNode.#params = node.#params;
+          if (isLast) {
+            if (nextNode.#children["*"]) this.#pushHandlerSets(handlerSets, nextNode.#children["*"], method, node.#params);
+            this.#pushHandlerSets(handlerSets, nextNode, method, node.#params);
+          } else tempNodes.push(nextNode);
+        }
+        for (const child of node.#patterns) {
+          const pattern = child.#pattern;
+          const params = node.#params === emptyParams ? {} : { ...node.#params };
+          if (typeof pattern === "string") {
+            if (pattern === "*" || part.startsWith(pattern.slice(0, -1))) {
+              this.#pushHandlerSets(handlerSets, child, method, node.#params);
+              if (pattern === "*") {
+                child.#params = params;
+                tempNodes.push(child);
+              }
+            }
+            continue;
+          }
+          const [, name, matcher] = pattern;
+          if (!part && matcher === true) continue;
+          if (matcher !== true) {
+            if (!partOffsets) {
+              partOffsets = [];
+              let offset = path[0] === "/" ? 1 : 0;
+              for (let p = 0; p < len; p++) {
+                partOffsets[p] = offset;
+                offset += parts[p].length + 1;
+              }
+            }
+            const restPathString = path.slice(partOffsets[i]);
+            const m = matcher.exec(restPathString);
+            if (m) {
+              params[name] = m[0];
+              this.#pushHandlerSets(handlerSets, child, method, node.#params, params);
+              if (m[0].length === restPathString.length && child.#children["*"]) this.#pushHandlerSets(handlerSets, child.#children["*"], method, node.#params, params);
+              for (const _ in child.#children) {
+                child.#params = params;
+                const componentCount = m[0].match(/\//g)?.length ?? 0;
+                (curNodesQueue[componentCount] ||= []).push(child);
+                break;
+              }
+              continue;
+            }
+          }
+          if (matcher === true || matcher.test(part)) {
+            params[name] = part;
+            if (isLast) {
+              this.#pushHandlerSets(handlerSets, child, method, params, node.#params);
+              if (child.#children["*"]) this.#pushHandlerSets(handlerSets, child.#children["*"], method, params, node.#params);
+            } else {
+              child.#params = params;
+              tempNodes.push(child);
+            }
+          }
+        }
+      }
+      const shifted = curNodesQueue.shift();
+      curNodes = shifted ? tempNodes.concat(shifted) : tempNodes;
+    }
+    if (handlerSets[1]) handlerSets.sort((a, b) => {
+      return a.score - b.score;
+    });
+    return [handlerSets.map(({ handler: handler2, params }) => [handler2, params])];
+  }
+};
+
+// ../../node_modules/hono/dist/router/trie-router/router.js
+var TrieRouter = class {
+  name = "TrieRouter";
+  #node = new Node3();
+  add(method, path, handler2) {
+    for (const result of checkOptionalParameter(path) || [path]) this.#node.insert(method, result, handler2);
+  }
+  match(method, path) {
+    return this.#node.search(method, path);
+  }
+};
+
+// ../../node_modules/hono/dist/hono.js
+var Hono3 = class extends Hono {
+  /**
+  * Creates an instance of the Hono class.
+  *
+  * @param options - Optional configuration options for the Hono instance.
+  */
+  constructor(options = {}) {
+    super(options);
+    this.router = options.router ?? new SmartRouter({ routers: [new RegExpRouter(), new TrieRouter()] });
+  }
+};
+
+// ../../node_modules/hono/dist/utils/cookie.js
+var validCookieNameRegEx = /^[\w!#$%&'*.^`|~+-]+$/;
+var relaxedCookieNameRegEx = /^[!#-:<>-[\]-~]+$/;
+var validCookieValueRegEx = /^[ !#-:<-[\]-~]*$/;
+var trimCookieWhitespace = (value) => {
+  let start = 0;
+  let end = value.length;
+  while (start < end) {
+    const charCode = value.charCodeAt(start);
+    if (charCode !== 32 && charCode !== 9) break;
+    start++;
+  }
+  while (end > start) {
+    const charCode = value.charCodeAt(end - 1);
+    if (charCode !== 32 && charCode !== 9) break;
+    end--;
+  }
+  return start === 0 && end === value.length ? value : value.slice(start, end);
+};
+var parse = (cookie, name) => {
+  if (name && cookie.indexOf(name) === -1) return {};
+  const pairs = cookie.split(";");
+  const parsedCookie = /* @__PURE__ */ Object.create(null);
+  for (const pairStr of pairs) {
+    const valueStartPos = pairStr.indexOf("=");
+    if (valueStartPos === -1) continue;
+    const cookieName = trimCookieWhitespace(pairStr.substring(0, valueStartPos));
+    if (name && name !== cookieName || !relaxedCookieNameRegEx.test(cookieName) || cookieName in parsedCookie) continue;
+    let cookieValue = trimCookieWhitespace(pairStr.substring(valueStartPos + 1));
+    if (cookieValue.startsWith('"') && cookieValue.endsWith('"')) cookieValue = cookieValue.slice(1, -1);
+    if (validCookieValueRegEx.test(cookieValue)) {
+      parsedCookie[cookieName] = tryDecodeURIComponent(cookieValue);
+      if (name) break;
+    }
+  }
+  return parsedCookie;
+};
+var _serialize = (name, value, opt = {}) => {
+  if (!validCookieNameRegEx.test(name)) throw new Error("Invalid cookie name");
+  let cookie = `${name}=${value}`;
+  if (name.startsWith("__Secure-") && !opt.secure) throw new Error("__Secure- Cookie must have Secure attributes");
+  if (name.startsWith("__Host-")) {
+    if (!opt.secure) throw new Error("__Host- Cookie must have Secure attributes");
+    if (opt.path !== "/") throw new Error('__Host- Cookie must have Path attributes with "/"');
+    if (opt.domain) throw new Error("__Host- Cookie must not have Domain attributes");
+  }
+  for (const key of [
+    "domain",
+    "path",
+    "sameSite",
+    "priority"
+  ]) if (opt[key] && /[;\r\n]/.test(opt[key])) throw new Error(`${key} must not contain ";", "\\r", or "\\n"`);
+  if (opt && typeof opt.maxAge === "number" && opt.maxAge >= 0) {
+    if (opt.maxAge > 3456e4) throw new Error("Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration.");
+    cookie += `; Max-Age=${opt.maxAge | 0}`;
+  }
+  if (opt.domain && opt.prefix !== "host") cookie += `; Domain=${opt.domain}`;
+  if (opt.path) cookie += `; Path=${opt.path}`;
+  if (opt.expires) {
+    if (opt.expires.getTime() - Date.now() > 3456e7) throw new Error("Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future.");
+    cookie += `; Expires=${opt.expires.toUTCString()}`;
+  }
+  if (opt.httpOnly) cookie += "; HttpOnly";
+  if (opt.secure) cookie += "; Secure";
+  if (opt.sameSite) cookie += `; SameSite=${opt.sameSite.charAt(0).toUpperCase() + opt.sameSite.slice(1)}`;
+  if (opt.priority) cookie += `; Priority=${opt.priority.charAt(0).toUpperCase() + opt.priority.slice(1)}`;
+  if (opt.partitioned) {
+    if (!opt.secure) throw new Error("Partitioned Cookie must have Secure attributes");
+    cookie += "; Partitioned";
+  }
+  return cookie;
+};
+var serialize = (name, value, opt) => {
+  value = encodeURIComponent(value);
+  return _serialize(name, value, opt);
+};
+
+// ../../node_modules/hono/dist/helper/cookie/index.js
+var getCookie = (c, key, prefix) => {
+  const cookie = c.req.raw.headers.get("Cookie");
+  if (typeof key === "string") {
+    if (!cookie) return;
+    let finalKey = key;
+    if (prefix === "secure") finalKey = "__Secure-" + key;
+    else if (prefix === "host") finalKey = "__Host-" + key;
+    return parse(cookie, finalKey)[finalKey];
+  }
+  if (!cookie) return {};
+  return parse(cookie);
+};
+var generateCookie = (name, value, opt) => {
+  let cookie;
+  if (opt?.prefix === "secure") cookie = serialize("__Secure-" + name, value, {
+    path: "/",
+    ...opt,
+    secure: true
+  });
+  else if (opt?.prefix === "host") cookie = serialize("__Host-" + name, value, {
+    ...opt,
+    path: "/",
+    secure: true,
+    domain: void 0
+  });
+  else cookie = serialize(name, value, {
+    path: "/",
+    ...opt
+  });
+  return cookie;
+};
+var setCookie = (c, name, value, opt) => {
+  const cookie = generateCookie(name, value, opt);
+  c.header("Set-Cookie", cookie, { append: true });
+};
+var deleteCookie = (c, name, opt) => {
+  const deletedCookie = getCookie(c, name, opt?.prefix);
+  setCookie(c, name, "", {
+    ...opt,
+    maxAge: 0
+  });
+  return deletedCookie;
+};
+
+// ../../node_modules/hono/dist/middleware/cors/index.js
+var cors = (options) => {
+  const opts = {
+    origin: "*",
+    allowMethods: [
+      "GET",
+      "HEAD",
+      "PUT",
+      "POST",
+      "DELETE",
+      "PATCH",
+      "QUERY"
+    ],
+    allowHeaders: [],
+    exposeHeaders: [],
+    ...options
+  };
+  const exposeHeadersStr = opts.exposeHeaders?.length ? opts.exposeHeaders.join(",") : void 0;
+  const allowHeadersStr = opts.allowHeaders?.length ? opts.allowHeaders.join(",") : void 0;
+  const findAllowOrigin = ((optsOrigin) => {
+    if (typeof optsOrigin === "string") {
+      if (optsOrigin === "*") return () => optsOrigin;
+      else return (origin) => optsOrigin === origin ? origin : null;
+    } else if (typeof optsOrigin === "function") return optsOrigin;
+    else return (origin) => optsOrigin.includes(origin) ? origin : null;
+  })(opts.origin);
+  const findAllowMethods = ((optsAllowMethods) => {
+    if (typeof optsAllowMethods === "function") return async (origin, c) => (await optsAllowMethods(origin, c)).join(",");
+    else if (Array.isArray(optsAllowMethods)) {
+      const methodsStr = optsAllowMethods.join(",");
+      return () => methodsStr;
+    } else return () => "";
+  })(opts.allowMethods);
+  return async function cors2(c, next) {
+    function set(key, value) {
+      c.res.headers.set(key, value);
+    }
+    const allowOrigin = await findAllowOrigin(c.req.header("origin") || "", c);
+    if (allowOrigin) set("Access-Control-Allow-Origin", allowOrigin);
+    if (opts.credentials) set("Access-Control-Allow-Credentials", "true");
+    if (exposeHeadersStr) set("Access-Control-Expose-Headers", exposeHeadersStr);
+    if (c.req.method === "OPTIONS") {
+      if (opts.origin !== "*") c.res.headers.append("Vary", "Origin");
+      if (opts.maxAge != null) set("Access-Control-Max-Age", opts.maxAge.toString());
+      const allowMethods = await findAllowMethods(c.req.header("origin") || "", c);
+      if (allowMethods) set("Access-Control-Allow-Methods", allowMethods);
+      let headersStr = allowHeadersStr;
+      if (!headersStr) {
+        const requestHeaders = c.req.header("Access-Control-Request-Headers");
+        if (requestHeaders) headersStr = requestHeaders.split(",").map((h) => h.trim()).join(",");
+      }
+      if (headersStr) {
+        set("Access-Control-Allow-Headers", headersStr);
+        c.res.headers.append("Vary", "Access-Control-Request-Headers");
+      }
+      c.res.headers.delete("Content-Length");
+      c.res.headers.delete("Content-Type");
+      return new Response(null, {
+        headers: c.res.headers,
+        status: 204,
+        statusText: "No Content"
+      });
+    }
+    await next();
+    if (opts.origin !== "*") c.header("Vary", "Origin", { append: true });
+  };
+};
+
+// ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+var strictDecoder = new TextDecoder("utf-8", { fatal: true });
+var MAX_INT32 = 2 ** 32;
+function concat(...buffers) {
+  const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);
+  let i = 0;
+  for (const buffer of buffers)
+    buf.set(buffer, i), i += buffer.length;
+  return buf;
+}
+var NON_ASCII = /[^\x00-\x7f]/;
+function encode(string) {
+  if (typeof string == "string" && string.length >= 128) {
+    if (NON_ASCII.test(string))
+      throw new TypeError("non-ASCII string encountered in encode()");
+    return encoder.encode(string);
+  }
+  const bytes = new Uint8Array(string.length);
+  for (let i = 0; i < string.length; i++) {
+    const code = string.charCodeAt(i);
+    if (code > 127)
+      throw new TypeError("non-ASCII string encountered in encode()");
+    bytes[i] = code;
+  }
+  return bytes;
+}
+function encodeBase642(input, url = false) {
+  if (Uint8Array.prototype.toBase64)
+    return input.toBase64({ alphabet: url ? "base64url" : "base64", omitPadding: url });
+  const CHUNK_SIZE = 32768, arr = [];
+  for (let i = 0; i < input.length; i += CHUNK_SIZE)
+    arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
+  const encoded = btoa(arr.join(""));
+  return url ? encoded.replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_") : encoded;
+}
+function decodeBase642(encoded, url = false) {
+  if (Uint8Array.fromBase64)
+    return Uint8Array.fromBase64(encoded, { alphabet: url ? "base64url" : "base64" });
+  if (url) {
+    if (encoded.includes("+") || encoded.includes("/"))
+      throw new TypeError("Invalid base64url");
+    encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
+  }
+  const binary = atob(encoded), bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++)
+    bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+async function digest(algorithm, data) {
+  const subtleDigest = `SHA-${algorithm.slice(-3)}`;
+  return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));
+}
+
+// ../../node_modules/jose/dist/webapi/util/errors.js
+var JOSEError = class extends Error {
+  static code = "ERR_JOSE_GENERIC";
+  code = "ERR_JOSE_GENERIC";
+  constructor(message2, options) {
+    super(message2, options), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);
+  }
+};
+var JWTClaimValidationFailed = class extends JOSEError {
+  static code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+  code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+  claim;
+  reason;
+  payload;
+  constructor(message2, payload, claim = "unspecified", reason = "unspecified") {
+    super(message2, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;
+  }
+};
+var JWTExpired = class extends JOSEError {
+  static code = "ERR_JWT_EXPIRED";
+  code = "ERR_JWT_EXPIRED";
+  claim;
+  reason;
+  payload;
+  constructor(message2, payload, claim = "unspecified", reason = "unspecified") {
+    super(message2, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;
+  }
+};
+var JOSEAlgNotAllowed = class extends JOSEError {
+  static code = "ERR_JOSE_ALG_NOT_ALLOWED";
+  code = "ERR_JOSE_ALG_NOT_ALLOWED";
+};
+var JOSENotSupported = class extends JOSEError {
+  static code = "ERR_JOSE_NOT_SUPPORTED";
+  code = "ERR_JOSE_NOT_SUPPORTED";
+};
+var JWSInvalid = class extends JOSEError {
+  static code = "ERR_JWS_INVALID";
+  code = "ERR_JWS_INVALID";
+};
+var JWTInvalid = class extends JOSEError {
+  static code = "ERR_JWT_INVALID";
+  code = "ERR_JWT_INVALID";
+};
+var JWKInvalid = class extends JOSEError {
+  static code = "ERR_JWK_INVALID";
+  code = "ERR_JWK_INVALID";
+};
+var JWKSInvalid = class extends JOSEError {
+  static code = "ERR_JWKS_INVALID";
+  code = "ERR_JWKS_INVALID";
+};
+var JWKSNoMatchingKey = class extends JOSEError {
+  static code = "ERR_JWKS_NO_MATCHING_KEY";
+  code = "ERR_JWKS_NO_MATCHING_KEY";
+  constructor(message2 = "no applicable key found in the JSON Web Key Set", options) {
+    super(message2, options);
+  }
+};
+var JWKSMultipleMatchingKeys = class extends JOSEError {
+  [Symbol.asyncIterator] = async function* () {
+  };
+  static code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+  code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+  constructor(message2 = "multiple matching keys found in the JSON Web Key Set", options) {
+    super(message2, options);
+  }
+};
+var JWKSTimeout = class extends JOSEError {
+  static code = "ERR_JWKS_TIMEOUT";
+  code = "ERR_JWKS_TIMEOUT";
+  constructor(message2 = "request timed out", options) {
+    super(message2, options);
+  }
+};
+var JWSSignatureVerificationFailed = class extends JOSEError {
+  static code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+  code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+  constructor(message2 = "signature verification failed", options) {
+    super(message2, options);
+  }
+};
+
+// ../../node_modules/jose/dist/webapi/util/base64url.js
+var base64url_exports = {};
+__export(base64url_exports, {
+  decode: () => decode,
+  encode: () => encode2
+});
+var invalid = "The input to be decoded is not correctly encoded.";
+function decode(input) {
+  try {
+    return decodeBase642(typeof input == "string" ? input : decoder.decode(input), true);
+  } catch (cause) {
+    throw new TypeError(invalid, { cause });
+  }
+}
+function encode2(input) {
+  return encodeBase642(typeof input == "string" ? encoder.encode(input) : input, true);
+}
+
+// ../../node_modules/jose/dist/webapi/lib/validate.js
+function isObject(input) {
+  if (typeof input != "object" || input === null || Object.prototype.toString.call(input) !== "[object Object]")
+    return false;
+  const prototype = Object.getPrototypeOf(input);
+  return prototype === null || Object.getPrototypeOf(prototype) === null;
+}
+function isJwkSet(input) {
+  return isObject(input) && Array.isArray(input.keys) && Array.from(input.keys).every(isObject);
+}
+function isDisjoint(...headers) {
+  const parameters = /* @__PURE__ */ new Set();
+  for (const header of headers)
+    if (header)
+      for (const parameter of Object.keys(header)) {
+        if (parameters.has(parameter))
+          return false;
+        parameters.add(parameter);
+      }
+  return true;
+}
+function assertNotSet(value, name) {
+  if (value !== void 0)
+    throw new TypeError(`${name} can only be called once`);
+}
+function decodeBase64url(value, label, ErrorClass) {
+  try {
+    return decode(value);
+  } catch {
+    throw new ErrorClass(`Failed to base64url decode the ${label}`);
+  }
+}
+function encodeBase64url(value, label, ErrorClass) {
+  try {
+    return encode(value);
+  } catch {
+    throw new ErrorClass(`The ${label} is not a valid base64url string`);
+  }
+}
+function parseJoseHeader(b64, ErrorClass, message2) {
+  let parsed;
+  try {
+    parsed = JSON.parse(strictDecoder.decode(decode(b64)));
+  } catch {
+    throw new ErrorClass(message2);
+  }
+  if (!isObject(parsed))
+    throw new ErrorClass(message2);
+  return parsed;
+}
+var JWS_RECOGNIZED = { __proto__: null, b64: true };
+function validateAlgorithms(option, algorithms) {
+  if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s != "string")))
+    throw new TypeError(`"${option}" option must be an array of strings`);
+  return algorithms === void 0 ? void 0 : new Set(algorithms);
+}
+function validateCritDuplicates(Err, protectedHeader) {
+  const { crit } = protectedHeader ?? {};
+  if (Array.isArray(crit) && new Set(crit).size !== crit.length)
+    throw new Err('"crit" (Critical) Header Parameter MUST NOT contain duplicate values');
+}
+function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
+  if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0)
+    throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
+  if (!protectedHeader || protectedHeader.crit === void 0)
+    return [];
+  if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input != "string" || input.length === 0))
+    throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
+  const recognized = recognizedOption === void 0 ? recognizedDefault : { __proto__: null, ...recognizedOption, ...recognizedDefault };
+  for (const parameter of protectedHeader.crit) {
+    if (!(parameter in recognized))
+      throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
+    if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0)
+      throw new Err(`Extension Header Parameter "${parameter}" is missing`);
+    if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0))
+      throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
+  }
+  return protectedHeader.crit;
+}
+function validateB64(protectedHeader, extensions) {
+  if (extensions.includes("b64")) {
+    const b64 = protectedHeader.b64;
+    if (typeof b64 != "boolean")
+      throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
+    return b64;
+  }
+  return true;
+}
+function serializeJoseHeader(Err, header) {
+  let serialized, parsed;
+  try {
+    serialized = JSON.stringify(header), parsed = JSON.parse(serialized);
+  } catch (cause) {
+    throw new Err("JOSE Header is not valid JSON", { cause });
+  }
+  if (!isObject(parsed))
+    throw new Err("JOSE Header is not a JSON object");
+  return [parsed, serialized];
+}
+
+// ../../node_modules/jose/dist/webapi/lib/key.js
+var tag = (key) => key[Symbol.toStringTag];
+var jwkMatchesOp = (entry, key, usage) => {
+  const { alg } = entry;
+  if (key.use !== void 0) {
+    const expected = usage === "sign" || usage === "verify" ? "sig" : "enc";
+    if (key.use !== expected)
+      throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
+  }
+  if (key.alg !== void 0 && key.alg !== alg)
+    throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
+  if (Array.isArray(key.key_ops)) {
+    const expectedKeyOp = usage === "encrypt" || usage === "decrypt" ? entry.ops?.[usage === "encrypt" ? 0 : 1] : usage;
+    if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp))
+      throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
+  }
+};
+async function prepareKey(entry, key, usage) {
+  const { alg, secret } = entry, privateKey = usage === "decrypt" || usage === "sign";
+  if (secret && key instanceof Uint8Array)
+    return key;
+  let normalized, keyObject;
+  if (isObject(key)) {
+    if (normalized = normalizeJwk(key), typeof normalized.kty != "string")
+      throw invalidKeyType(alg, key, secret);
+    if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === void 0 && normalized.priv === void 0)))
+      throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present' : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
+    if (jwkMatchesOp(entry, normalized, usage), normalized.kty === "oct")
+      return decode(normalized.k);
+    if (!Object.isFrozen(key)) {
+      const { key_ops } = key;
+      Array.isArray(key_ops) && Object.freeze(key_ops), Object.freeze(key);
+    }
+  } else {
+    if (!isKeyLike(key))
+      throw invalidKeyType(alg, key, secret);
+    const expectedType = secret ? "secret" : privateKey ? "private" : "public";
+    if (key.type !== expectedType && (secret || ["secret", "public", "private"].includes(key.type)))
+      throw new TypeError(`${tag(key)} instances must be of type "${expectedType}" for the ${alg} algorithm`);
+    if (isCryptoKey(key))
+      return key;
+    if (keyObject = key, keyObject.type === "secret")
+      return keyObject.export();
+  }
+  cache ||= /* @__PURE__ */ new WeakMap();
+  const cacheKey = key;
+  let cached = cache.get(cacheKey);
+  if (cached?.[alg])
+    return cached[alg];
+  if (cached || cache.set(cacheKey, cached = {}), keyObject && typeof keyObject.toCryptoKey == "function") {
+    const isPublic = keyObject.type === "public", crv = nist[keyObject.asymmetricKeyDetails?.namedCurve], params = entry.resolve?.({ crv, asymmetricKeyType: keyObject.asymmetricKeyType }) ?? entry.subtle;
+    return cached[alg] = keyObject.toCryptoKey(params, isPublic, entry.usages[isPublic ? 0 : 1]);
+  }
+  return normalized ??= keyObject.export({ format: "jwk" }), normalized.alg = alg, cached[alg] = await jwkToKey(entry, normalized);
+}
+var cache;
+var nist = {
+  __proto__: null,
+  prime256v1: "P-256",
+  secp384r1: "P-384",
+  secp521r1: "P-521"
+};
+var isCryptoKey = (key) => {
+  if (key?.[Symbol.toStringTag] === "CryptoKey")
+    return true;
+  try {
+    return key instanceof CryptoKey;
+  } catch {
+    return false;
+  }
+};
+var isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject";
+var isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
+function message(msg, actual, ...types) {
+  if (types.length > 2) {
+    const last = types.pop();
+    msg += `one of type ${types.join(", ")}, or ${last}.`;
+  } else types.length === 2 ? msg += `one of type ${types[0]} or ${types[1]}.` : msg += `of type ${types[0]}.`;
+  return actual == null ? msg += ` Received ${actual}` : typeof actual == "function" && actual.name ? msg += ` Received function ${actual.name}` : typeof actual == "object" && actual != null && actual.constructor?.name && (msg += ` Received an instance of ${actual.constructor.name}`), msg;
+}
+var invalidKeyInput = (actual, ...types) => message("Key must be ", actual, ...types);
+function invalidKeyType(alg, actual, secret) {
+  const types = ["CryptoKey", "KeyObject", "JSON Web Key"];
+  return secret && types.push("Uint8Array"), new TypeError(message(`Key for the ${alg} algorithm must be `, actual, ...types));
+}
+var unusable = (name, prop = "algorithm.name") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+function checkUsage(key, usage) {
+  if (usage && !key.usages.includes(usage))
+    throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+}
+function checkModulusLength(alg, key) {
+  const { modulusLength } = key.algorithm;
+  if (typeof modulusLength != "number" || modulusLength < 2048)
+    throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
+}
+function checkCryptoKey(key, expected, usage) {
+  const algorithm = key.algorithm;
+  if (algorithm.name !== expected.name)
+    throw unusable(expected.name);
+  if (expected.hash && algorithm.hash?.name !== expected.hash)
+    throw unusable(expected.hash, "algorithm.hash");
+  if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve)
+    throw unusable(expected.namedCurve, "algorithm.namedCurve");
+  if (expected.length !== void 0 && algorithm.length !== expected.length)
+    throw unusable(expected.length, "algorithm.length");
+  checkUsage(key, usage);
+}
+function snapshotJwk(jwk) {
+  return { __proto__: null, ...jwk };
+}
+function normalizeJwk(jwk) {
+  const normalized = snapshotJwk(jwk);
+  if (normalized.ext !== void 0 && typeof normalized.ext != "boolean")
+    throw new TypeError('"ext" (Extractable) Parameter must be a boolean');
+  if (normalized.key_ops !== void 0) {
+    const value = normalized.key_ops, keyOps = Array.isArray(value) ? [...value] : void 0;
+    if (!keyOps || keyOps.some((operation) => typeof operation != "string") || new Set(keyOps).size !== keyOps.length)
+      throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');
+    normalized.key_ops = keyOps;
+  }
+  return normalized;
+}
+function validateExtractableOption(extractable) {
+  if (extractable !== void 0 && typeof extractable != "boolean")
+    throw new TypeError('"extractable" option must be a boolean');
+  return extractable;
+}
+async function jwkToKey(entry, jwk, extractable) {
+  if (!entry.kty.includes(jwk.kty))
+    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+  const algorithm = entry.resolve?.({ kty: jwk.kty, crv: jwk.crv }) ?? entry.subtle, isPrivate = !!(jwk.d || jwk.priv), keyData = { ...jwk, ext: extractable ?? jwk.ext };
+  return keyData.kty !== "AKP" && delete keyData.alg, delete keyData.use, crypto.subtle.importKey("jwk", keyData, algorithm, keyData.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);
+}
+async function rawKey(key, expected, usage, extractable = false) {
+  return key instanceof Uint8Array && (key = await crypto.subtle.importKey("raw", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;
+}
+
+// ../../node_modules/jose/dist/webapi/lib/key_descriptor.js
+function table(entries) {
+  const out = { __proto__: null };
+  for (const alg in entries)
+    out[alg] = { ...entries[alg], alg };
+  return out;
+}
+
+// ../../node_modules/jose/dist/webapi/lib/jwe_algorithms.js
+var wrap = [
+  ["encrypt", "wrapKey"],
+  ["decrypt", "unwrapKey"]
+];
+var derive = [[], ["deriveBits"]];
+var none = [[], []];
+function rsaes(bits) {
+  return {
+    kty: ["RSA"],
+    mode: "key-encryption",
+    subtle: { name: "RSA-OAEP", hash: `SHA-${bits}` },
+    usages: wrap,
+    ops: ["wrapKey", "unwrapKey"]
+  };
+}
+function ecdh(mode) {
+  return {
+    kty: ["EC", "OKP"],
+    mode,
+    subtle: { name: "ECDH" },
+    resolve: ({ kty, crv, asymmetricKeyType }) => {
+      if (crv === "X25519" || asymmetricKeyType === "x25519")
+        return { name: "X25519" };
+      if (kty === "OKP")
+        throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+      return { name: "ECDH", namedCurve: crv };
+    },
+    usages: derive,
+    ops: [void 0, "deriveBits"]
+  };
+}
+function aeskw(bits, gcm = false) {
+  return {
+    kty: ["oct"],
+    mode: "key-wrapping",
+    secret: true,
+    subtle: { name: gcm ? "AES-GCM" : "AES-KW", length: bits },
+    usages: none,
+    ops: gcm ? ["encrypt", "decrypt"] : ["wrapKey", "unwrapKey"]
+  };
+}
+function pbes2() {
+  return {
+    kty: ["oct"],
+    mode: "key-wrapping",
+    secret: true,
+    subtle: { name: "PBKDF2" },
+    usages: none,
+    ops: ["deriveBits", "deriveBits"]
+  };
+}
+var JWE = table({
+  dir: {
+    kty: ["oct"],
+    mode: "direct-encryption",
+    secret: true,
+    subtle: { name: "AES-GCM" },
+    usages: none,
+    ops: ["encrypt", "decrypt"]
+  },
+  "RSA-OAEP": rsaes(1),
+  "RSA-OAEP-256": rsaes(256),
+  "RSA-OAEP-384": rsaes(384),
+  "RSA-OAEP-512": rsaes(512),
+  "ECDH-ES": ecdh("direct-key-agreement"),
+  "ECDH-ES+A128KW": ecdh("key-agreement-with-key-wrapping"),
+  "ECDH-ES+A192KW": ecdh("key-agreement-with-key-wrapping"),
+  "ECDH-ES+A256KW": ecdh("key-agreement-with-key-wrapping"),
+  A128KW: aeskw(128),
+  A192KW: aeskw(192),
+  A256KW: aeskw(256),
+  A128GCMKW: aeskw(128, true),
+  A192GCMKW: aeskw(192, true),
+  A256GCMKW: aeskw(256, true),
+  "PBES2-HS256+A128KW": pbes2(),
+  "PBES2-HS384+A192KW": pbes2(),
+  "PBES2-HS512+A256KW": pbes2()
+});
+var contentOps = ["encrypt", "decrypt"];
+function contentEncryption(bits, cbc = false) {
+  return {
+    kty: ["oct"],
+    secret: true,
+    subtle: { name: cbc ? "AES-CBC" : "AES-GCM", length: bits },
+    usages: none,
+    ops: contentOps,
+    cekBits: bits,
+    ivBits: cbc ? 128 : 96,
+    cbc
+  };
+}
+var ENC = table({
+  A128GCM: contentEncryption(128),
+  A192GCM: contentEncryption(192),
+  A256GCM: contentEncryption(256),
+  "A128CBC-HS256": contentEncryption(256, true),
+  "A192CBC-HS384": contentEncryption(384, true),
+  "A256CBC-HS512": contentEncryption(512, true)
+});
+
+// ../../node_modules/jose/dist/webapi/lib/jws_algorithms.js
+var sig = [["verify"], ["sign"]];
+function hmac(bits) {
+  const subtle = { name: "HMAC", hash: `SHA-${bits}` };
+  return { kty: ["oct"], secret: true, subtle, signing: subtle, usages: sig };
+}
+function rsa(bits, saltLength) {
+  const subtle = { name: saltLength ? "RSA-PSS" : "RSASSA-PKCS1-v1_5", hash: `SHA-${bits}` };
+  return {
+    kty: ["RSA"],
+    subtle,
+    signing: saltLength ? { ...subtle, saltLength } : subtle,
+    usages: sig,
+    minRsaBits: 2048
+  };
+}
+function ecdsa(crv, bits) {
+  return {
+    kty: ["EC"],
+    crv,
+    subtle: { name: "ECDSA", namedCurve: crv },
+    signing: { name: "ECDSA", hash: `SHA-${bits}` },
+    usages: sig
+  };
+}
+function eddsa() {
+  const subtle = { name: "Ed25519" };
+  return {
+    kty: ["OKP"],
+    crv: "Ed25519",
+    subtle,
+    signing: subtle,
+    usages: sig
+  };
+}
+function mldsa(bits) {
+  const subtle = { name: `ML-DSA-${bits}` };
+  return {
+    kty: ["AKP"],
+    subtle,
+    signing: subtle,
+    usages: sig
+  };
+}
+var JWS = table({
+  HS256: hmac(256),
+  HS384: hmac(384),
+  HS512: hmac(512),
+  RS256: rsa(256),
+  RS384: rsa(384),
+  RS512: rsa(512),
+  PS256: rsa(256, 32),
+  PS384: rsa(384, 48),
+  PS512: rsa(512, 64),
+  ES256: ecdsa("P-256", 256),
+  ES384: ecdsa("P-384", 384),
+  ES512: ecdsa("P-521", 512),
+  EdDSA: eddsa(),
+  Ed25519: eddsa(),
+  "ML-DSA-44": mldsa(44),
+  "ML-DSA-65": mldsa(65),
+  "ML-DSA-87": mldsa(87)
+});
+function jwsAlgorithm(alg) {
+  const entry = typeof alg == "string" ? JWS[alg] : void 0;
+  if (!entry)
+    throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
+  return entry;
+}
+
+// ../../node_modules/jose/dist/webapi/lib/jws_verify.js
+function prepareVerify(options) {
+  return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
+}
+function parseProtectedHeader(encodedProtected) {
+  return encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid");
+}
+function encodeCompactUnencodedPayload(payload) {
+  try {
+    return encode(payload);
+  } catch {
+    throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters");
+  }
+}
+async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
+  const { protected: encodedProtected, header, payload: inputPayload } = jws, parsedProt = parsedProtected ?? parseProtectedHeader(encodedProtected);
+  if (!isDisjoint(parsedProt, header))
+    throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+  const joseHeader = { ...parsedProt, ...header }, b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), { alg } = joseHeader;
+  if (typeof alg != "string" || !alg)
+    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+  if (shared[0] && !shared[0].has(alg))
+    throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
+  if (b64) {
+    if (typeof inputPayload != "string")
+      throw new JWSInvalid("JWS Payload must be a string");
+  } else if (typeof inputPayload != "string" && !(inputPayload instanceof Uint8Array))
+    throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
+  const signingPayload = b64 || typeof inputPayload != "string" ? inputPayload : encodeUnencodedPayload(inputPayload);
+  let resolvedKey = false;
+  typeof key == "function" && (key = await key(parsedProt, jws), resolvedKey = true);
+  const entry = jwsAlgorithm(alg), data = concat(encodedProtected !== void 0 ? encode(encodedProtected) : new Uint8Array(), encode("."), typeof signingPayload == "string" ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), k = await prepareKey(entry, key, "verify"), cryptoKey = await rawKey(k, entry.subtle, "verify");
+  entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);
+  let verified = false;
+  try {
+    verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);
+  } catch {
+  }
+  if (!verified)
+    throw new JWSSignatureVerificationFailed();
+  const result = { payload: typeof signingPayload == "string" ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload };
+  return encodedProtected !== void 0 && (result.protectedHeader = parsedProt), header !== void 0 && (result.unprotectedHeader = header), resolvedKey ? [{ ...result, key: k }, b64] : [result, b64];
+}
+async function verifyCompact(jws, shared, key) {
+  if (jws instanceof Uint8Array && (jws = decoder.decode(jws)), typeof jws != "string")
+    throw new JWSInvalid("Compact JWS must be a string or Uint8Array");
+  const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(".");
+  if (length !== 3)
+    throw new JWSInvalid("Invalid Compact JWS");
+  return verifySignature({ payload, protected: protectedHeader, signature }, shared, key, encodeCompactUnencodedPayload);
+}
+
+// ../../node_modules/jose/dist/webapi/lib/jwt_claims_set.js
+var epoch = (date) => Math.floor(date.getTime() / 1e3);
+var multipliers = {
+  s: 1,
+  m: 60,
+  h: 3600,
+  d: 86400,
+  w: 604800,
+  y: 31557600
+};
+var REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
+var checkFailed = "check_failed";
+function invalidDuration() {
+  throw new TypeError("Invalid time period format");
+}
+function secs(str) {
+  typeof str != "string" && invalidDuration();
+  const matched = REGEX.exec(str);
+  (!matched || matched[4] && matched[1]) && invalidDuration();
+  const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+  return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -numericDate2 : numericDate2;
+}
+function validateInput(label, input) {
+  if (!Number.isFinite(input))
+    throw new TypeError(`Invalid ${label} input`);
+  return input;
+}
+function validateStringClaim(claim, value) {
+  if (typeof value != "string")
+    throw new TypeError(`"${claim}" claim must be a string`);
+}
+function validateAudienceClaim(value) {
+  if (typeof value != "string" && (!Array.isArray(value) || Array.from(value).some((member) => typeof member != "string")))
+    throw new TypeError('"aud" claim must be a string or an array of strings');
+}
+function numericDate(value, label) {
+  return typeof value == "number" ? validateInput(label, value) : value instanceof Date ? validateInput(label, epoch(value)) : epoch(/* @__PURE__ */ new Date()) + secs(value);
+}
+var normalizeTyp = (value) => {
+  const normalized = value.toLowerCase();
+  return value.includes("/") ? normalized : `application/${normalized}`;
+};
+var checkAudiencePresence = (audPayload, audOption) => typeof audPayload == "string" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : false;
+function validateNumericDate(payload, claim, required = false) {
+  const value = payload[claim];
+  if (!(value === void 0 && !required)) {
+    if (typeof value != "number")
+      throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, payload, claim, "invalid");
+    return value;
+  }
+}
+function unexpectedClaim(payload, claim) {
+  throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, payload, claim, checkFailed);
+}
+function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
+  let payload;
+  try {
+    payload = JSON.parse(strictDecoder.decode(encodedPayload));
+  } catch {
+  }
+  if (!isObject(payload))
+    throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
+  const { typ } = options;
+  if (typ !== void 0 && (typeof protectedHeader.typ != "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ)))
+    throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, "typ", checkFailed);
+  const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];
+  maxTokenAge !== void 0 && presenceCheck.push("iat"), audience !== void 0 && presenceCheck.push("aud"), subject !== void 0 && presenceCheck.push("sub"), issuer !== void 0 && presenceCheck.push("iss");
+  for (const claim of new Set(presenceCheck.reverse()))
+    if (!Object.hasOwn(payload, claim))
+      throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
+  issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, "iss"), subject !== void 0 && payload.sub !== subject && unexpectedClaim(payload, "sub"), audience !== void 0 && !checkAudiencePresence(payload.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(payload, "aud");
+  const { clockTolerance } = options;
+  let tolerance = 0;
+  if (typeof clockTolerance == "string")
+    tolerance = secs(clockTolerance);
+  else if (clockTolerance !== void 0) {
+    if (typeof clockTolerance != "number")
+      throw new TypeError("Invalid clockTolerance option type");
+    tolerance = clockTolerance;
+  }
+  validateInput("clockTolerance option", tolerance);
+  const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(payload, "iat", maxTokenAge !== void 0), nbf = validateNumericDate(payload, "nbf");
+  if (nbf !== void 0 && nbf > now + tolerance)
+    throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, "nbf", checkFailed);
+  const exp = validateNumericDate(payload, "exp");
+  if (exp !== void 0 && exp <= now - tolerance)
+    throw new JWTExpired('"exp" claim timestamp check failed', payload, "exp", checkFailed);
+  if (maxTokenAge !== void 0) {
+    const age = now - iat, max = validateInput("maxTokenAge option", typeof maxTokenAge == "number" ? maxTokenAge : secs(maxTokenAge));
+    if (age - tolerance > max)
+      throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, "iat", checkFailed);
+    if (age < -tolerance)
+      throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, "iat", checkFailed);
+  }
+  return payload;
+}
+var producerPayloads;
+function producerPayload(producer) {
+  return producerPayloads.get(producer);
+}
+function jwtData(producer) {
+  const payload = producerPayload(producer);
+  for (const claim of ["iat", "nbf", "exp"]) {
+    const value = payload[claim];
+    if (typeof value == "number" && !Number.isFinite(value))
+      throw new TypeError(`"${claim}" claim must be a finite number`);
+  }
+  return encoder.encode(JSON.stringify(payload));
+}
+var JWTClaimsBuilder = class {
+  constructor(payload = {}) {
+    if (!isObject(payload))
+      throw new TypeError("JWT Claims Set MUST be an object");
+    (producerPayloads ||= /* @__PURE__ */ new WeakMap()).set(this, structuredClone(payload));
+  }
+  setIssuer(value) {
+    return validateStringClaim("iss", value), producerPayload(this).iss = value, this;
+  }
+  setSubject(value) {
+    return validateStringClaim("sub", value), producerPayload(this).sub = value, this;
+  }
+  setAudience(value) {
+    return validateAudienceClaim(value), producerPayload(this).aud = value, this;
+  }
+  setJti(value) {
+    return validateStringClaim("jti", value), producerPayload(this).jti = value, this;
+  }
+  setNotBefore(value) {
+    return producerPayload(this).nbf = numericDate(value, "setNotBefore"), this;
+  }
+  setExpirationTime(value) {
+    return producerPayload(this).exp = numericDate(value, "setExpirationTime"), this;
+  }
+  setIssuedAt(value) {
+    const payload = producerPayload(this);
+    return value === void 0 ? payload.iat = epoch(/* @__PURE__ */ new Date()) : typeof value == "string" ? payload.iat = validateInput("setIssuedAt", epoch(/* @__PURE__ */ new Date()) + secs(value)) : payload.iat = numericDate(value, "setIssuedAt"), this;
+  }
+};
+
+// ../../node_modules/jose/dist/webapi/jwt/verify.js
+async function jwtVerify(jwt, key, options) {
+  const [verified, b64] = await verifyCompact(jwt, prepareVerify(options), key);
+  if (!b64)
+    throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+  const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);
+  return { ...verified, payload };
+}
+
+// ../../node_modules/jose/dist/webapi/lib/jws_sign.js
+async function createSignature(input, key, rejectUnencoded) {
+  let [payload, protectedHeader, unprotectedHeader, crit] = input, protectedHeaderString = "";
+  if (protectedHeader !== void 0) {
+    const normalized = serializeJoseHeader(JWSInvalid, protectedHeader);
+    protectedHeader = normalized[0], protectedHeaderString = encode2(normalized[1]);
+  }
+  if (unprotectedHeader !== void 0 && (unprotectedHeader = serializeJoseHeader(JWSInvalid, unprotectedHeader)[0]), !protectedHeader && !unprotectedHeader)
+    throw new JWSInvalid("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");
+  if (!isDisjoint(protectedHeader, unprotectedHeader))
+    throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+  const joseHeader = { ...protectedHeader, ...unprotectedHeader };
+  validateCritDuplicates(JWSInvalid, protectedHeader);
+  const b64 = validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, crit, protectedHeader, joseHeader));
+  b64 || rejectUnencoded?.();
+  const { alg } = joseHeader;
+  if (typeof alg != "string" || !alg)
+    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+  const entry = jwsAlgorithm(alg);
+  let payloadS = "", payloadB = payload, data;
+  if (b64) {
+    const encoded = input[4];
+    encoded ? (payloadS = encoded[0] ??= encode2(payload), payloadB = encoded[1] ??= encode(payloadS)) : (payloadS = encode2(payload), data = encoder.encode(`${protectedHeaderString}.${payloadS}`));
+  }
+  data ??= concat(encode(protectedHeaderString), encode("."), payloadB);
+  const k = await rawKey(await prepareKey(entry, key, "sign"), entry.subtle, "sign");
+  entry.minRsaBits && checkModulusLength(entry.alg, k);
+  const jws = {
+    signature: encode2(new Uint8Array(await crypto.subtle.sign(entry.signing, k, data))),
+    payload: payloadS
+  };
+  return protectedHeader && (jws.protected = protectedHeaderString), unprotectedHeader && (jws.header = unprotectedHeader), [jws, b64];
+}
+async function createCompactSignature(payload, protectedHeader, crit, key, rejectUnencoded) {
+  const [jws] = await createSignature([payload, protectedHeader, void 0, crit], key, rejectUnencoded);
+  return `${jws.protected}.${jws.payload}.${jws.signature}`;
+}
+
+// ../../node_modules/jose/dist/webapi/jwt/sign.js
+var SignJWT_base = JWTClaimsBuilder;
+var SignJWT = class extends SignJWT_base {
+  #protectedHeader;
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
+  }
+  async sign(key, options) {
+    return createCompactSignature(jwtData(this), this.#protectedHeader, options?.crit, key, () => {
+      throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+    });
+  }
+};
+
+// ../../node_modules/jose/dist/webapi/lib/key_algorithm.js
+var algArgument = '"alg" (Algorithm)';
+function unsupportedAlg(source = 'JWK "alg" (Algorithm) Parameter') {
+  throw new JOSENotSupported(`Invalid or unsupported ${source} value`);
+}
+function keyAlgorithm(alg, source) {
+  return (typeof alg == "string" ? JWS[alg] ?? JWE[alg] : void 0) ?? unsupportedAlg(source);
+}
+
+// ../../node_modules/jose/dist/webapi/key/export.js
+async function exportJWK(key) {
+  if (isKeyObject(key))
+    if (key.type === "secret")
+      key = key.export();
+    else
+      return key.export({ format: "jwk" });
+  if (key instanceof Uint8Array)
+    return {
+      kty: "oct",
+      k: encode2(key)
+    };
+  if (!isCryptoKey(key))
+    throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "Uint8Array"));
+  if (!key.extractable)
+    throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");
+  const jwk = await crypto.subtle.exportKey("jwk", key);
+  delete jwk.ext, delete jwk.key_ops, delete jwk.use, jwk.kty !== "AKP" && delete jwk.alg;
+  for (const parameter of Object.keys(jwk))
+    jwk[parameter] === void 0 && delete jwk[parameter];
+  return jwk;
+}
+
+// ../../node_modules/jose/dist/webapi/jwk/thumbprint.js
+var check = (value, description) => {
+  if (typeof value != "string" || !value)
+    throw new JWKInvalid(`${description} missing or invalid`);
+};
+async function calculateJwkThumbprint(key, digestAlgorithm) {
+  let jwk;
+  if (isObject(key)) {
+    if (jwk = snapshotJwk(key), typeof jwk.kty != "string")
+      throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
+  } else if (isKeyLike(key))
+    jwk = snapshotJwk(await exportJWK(key));
+  else
+    throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
+  if (digestAlgorithm ??= "sha256", digestAlgorithm !== "sha256" && digestAlgorithm !== "sha384" && digestAlgorithm !== "sha512")
+    throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');
+  let components;
+  switch (jwk.kty) {
+    case "AKP":
+      check(jwk.alg, '"alg" (Algorithm) Parameter'), check(jwk.pub, '"pub" (Public key) Parameter'), components = { alg: jwk.alg, kty: jwk.kty, pub: jwk.pub };
+      break;
+    case "EC":
+      check(jwk.crv, '"crv" (Curve) Parameter'), check(jwk.x, '"x" (X Coordinate) Parameter'), check(jwk.y, '"y" (Y Coordinate) Parameter'), components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y };
+      break;
+    case "OKP":
+      check(jwk.crv, '"crv" (Subtype of Key Pair) Parameter'), check(jwk.x, '"x" (Public Key) Parameter'), components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x };
+      break;
+    case "RSA":
+      check(jwk.e, '"e" (Exponent) Parameter'), check(jwk.n, '"n" (Modulus) Parameter'), components = { e: jwk.e, kty: jwk.kty, n: jwk.n };
+      break;
+    case "oct":
+      if (typeof jwk.k != "string")
+        throw new JWKInvalid('"k" (Key Value) Parameter missing or invalid');
+      components = { k: jwk.k, kty: jwk.kty };
+      break;
+    default:
+      throw new JOSENotSupported('"kty" (Key Type) Parameter missing or unsupported');
+  }
+  const data = encode(JSON.stringify(components));
+  return encode2(await digest(digestAlgorithm, data));
+}
+
+// ../../node_modules/jose/dist/webapi/jwks/local.js
+function isUsableJWK(jwk, entry, alg, kid) {
+  const { kty, key_ops: keyOps, ext, kid: jwkKid, alg: jwkAlg, use, crv } = jwk;
+  return (ext === void 0 || typeof ext == "boolean") && (keyOps === void 0 || Array.isArray(keyOps) && keyOps.every((operation, index) => typeof operation == "string" && keyOps.indexOf(operation) === index) && keyOps.includes("verify")) && entry.kty.includes(kty) && (kid === void 0 || typeof kid == "string" && kid === jwkKid) && (jwkAlg === void 0 ? kty !== "AKP" : alg === jwkAlg) && (use === void 0 || use === "sig") && (!entry.crv || crv === entry.crv);
+}
+async function importWithAlgCache(cache2, jwk, entry) {
+  const cached = cache2.get(jwk) || cache2.set(jwk, {}).get(jwk), { alg } = entry;
+  if (cached[alg] === void 0) {
+    const pending = jwkToKey(entry, jwk, true).then((key) => {
+      if (key.type !== "public")
+        throw new JWKSInvalid("JSON Web Key Set members must be public keys");
+      return cached[alg] = key, key;
+    }).catch((error) => {
+      throw cached[alg] === pending && delete cached[alg], error;
+    });
+    cached[alg] = pending;
+  }
+  return cached[alg];
+}
+function createLocalJWKSet(jwks) {
+  let snapshot;
+  try {
+    snapshot = structuredClone(jwks);
+  } catch {
+  }
+  if (!isJwkSet(snapshot))
+    throw new JWKSInvalid("JSON Web Key Set malformed");
+  const metadata = snapshot.keys.map((jwk) => {
+    const normalized = snapshotJwk(jwk);
+    return Array.isArray(normalized.key_ops) && (normalized.key_ops = [...normalized.key_ops]), normalized;
+  }), cached = /* @__PURE__ */ new WeakMap();
+  return Object.defineProperty(async (protectedHeader, token) => {
+    const { alg, kid } = { ...protectedHeader, ...token?.header }, entry = typeof alg == "string" ? JWS[alg] : void 0;
+    if (!entry || entry.secret)
+      throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
+    const candidates = snapshot.keys.filter((_, index) => isUsableJWK(metadata[index], entry, alg, kid)), { 0: jwk, length } = candidates;
+    if (!length)
+      throw new JWKSNoMatchingKey();
+    if (length !== 1) {
+      const error = new JWKSMultipleMatchingKeys();
+      throw error[Symbol.asyncIterator] = async function* () {
+        for (const jwk2 of candidates)
+          try {
+            yield await importWithAlgCache(cached, jwk2, entry);
+          } catch {
+          }
+      }, error;
+    }
+    return importWithAlgCache(cached, jwk, entry);
+  }, "jwks", {
+    value: () => structuredClone(snapshot)
+  });
+}
+
+// ../../node_modules/jose/dist/webapi/jwks/remote.js
+function isCloudflareWorkers() {
+  return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
+}
+var USER_AGENT;
+(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.12");
+var customFetch = /* @__PURE__ */ Symbol();
+async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
+  const response = await fetchImpl(url, {
+    method: "GET",
+    signal,
+    redirect: "manual",
+    headers
+  }).catch((err) => {
+    throw err.name === "TimeoutError" ? new JWKSTimeout() : err;
+  });
+  if (response.status !== 200)
+    throw new JOSEError("Expected 200 OK from the JSON Web Key Set HTTP response");
+  try {
+    return await response.json();
+  } catch {
+    throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON");
+  }
+}
+var jwksCache = /* @__PURE__ */ Symbol();
+function isFreshFor(timestamp, duration) {
+  return Number.isFinite(timestamp) && Date.now() < timestamp + duration;
+}
+function validateDuration(value, fallback, option) {
+  if (Number.isNaN(value))
+    throw new TypeError(`"${option}" option must not be NaN`);
+  return typeof value == "number" ? value : fallback;
+}
+function createRemoteJWKSet(url, options) {
+  if (!(url instanceof URL))
+    throw new TypeError("url must be an instance of URL");
+  const href = new URL(url.href).href, opts = options ?? {}, timeoutOption = opts.timeoutDuration;
+  if (typeof timeoutOption == "number" && (!Number.isInteger(timeoutOption) || timeoutOption < 0))
+    throw new TypeError('"timeoutDuration" option must be a non-negative integer');
+  const timeoutDuration = typeof timeoutOption == "number" ? timeoutOption : 5e3, cooldownDuration = validateDuration(opts.cooldownDuration, 3e4, "cooldownDuration"), cacheMaxAge = validateDuration(opts.cacheMaxAge, 6e5, "cacheMaxAge"), headers = new Headers(opts.headers);
+  USER_AGENT && !headers.has("User-Agent") && headers.set("User-Agent", USER_AGENT), headers.has("accept") || headers.set("accept", "application/json, application/jwk-set+json");
+  const fetchImpl = opts[customFetch], cache2 = opts[jwksCache];
+  let jwksTimestamp, pendingFetch, reloadSequence = 0, appliedSequence = 0, local;
+  if (cache2 && typeof cache2 == "object") {
+    const { uat, jwks } = cache2;
+    isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks) && (jwksTimestamp = uat, local = createLocalJWKSet(jwks));
+  }
+  const reload = async () => {
+    if (pendingFetch && isCloudflareWorkers() && (pendingFetch = void 0), !pendingFetch) {
+      const sequence = ++reloadSequence, current = pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl).then((json) => {
+        const next = createLocalJWKSet(json);
+        if (sequence <= appliedSequence)
+          return;
+        local = next;
+        const updatedAt = Date.now();
+        cache2 && (cache2.uat = updatedAt, cache2.jwks = json), jwksTimestamp = updatedAt, appliedSequence = sequence;
+      }).finally(() => {
+        pendingFetch === current && (pendingFetch = void 0);
+      });
+    }
+    await pendingFetch;
+  };
+  return Object.defineProperties(async (protectedHeader, token) => {
+    (!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) && await reload();
+    try {
+      return await local(protectedHeader, token);
+    } catch (err) {
+      if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration))
+        return await reload(), local(protectedHeader, token);
+      throw err;
+    }
+  }, {
+    coolingDown: {
+      get: () => isFreshFor(jwksTimestamp, cooldownDuration),
+      enumerable: true
+    },
+    fresh: {
+      get: () => isFreshFor(jwksTimestamp, cacheMaxAge),
+      enumerable: true
+    },
+    reload: {
+      value: reload,
+      enumerable: true
+    },
+    reloading: {
+      get: () => !!pendingFetch,
+      enumerable: true
+    },
+    jwks: {
+      value: () => local?.jwks(),
+      enumerable: true
+    }
+  });
+}
+
+// ../../node_modules/jose/dist/webapi/key/import.js
+async function importJWK(jwk, alg, options) {
+  if (!isObject(jwk))
+    throw new TypeError("JWK must be an object");
+  const normalized = normalizeJwk(jwk), extractable = validateExtractableOption(options?.extractable), { alg: jwkAlg } = normalized;
+  if (alg ??= jwkAlg, normalized.kty !== "oct" && !alg)
+    throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
+  switch (normalized.kty) {
+    case "oct":
+      if (typeof normalized.k != "string")
+        throw new TypeError('missing "k" (Key Value) Parameter value');
+      return decode(normalized.k);
+    case "AKP": {
+      if (typeof jwkAlg != "string" || !jwkAlg)
+        throw new TypeError('missing "alg" (Algorithm) Parameter value');
+      if (alg !== jwkAlg)
+        throw new TypeError("JWK alg and alg option value mismatch");
+      return jwkToKey(keyAlgorithm(alg), normalized, extractable);
+    }
+    case "RSA":
+    case "EC":
+    case "OKP":
+      return jwkToKey(keyAlgorithm(alg), normalized, extractable);
+    default:
+      throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
+  }
+}
+
+// ../../node_modules/jose/dist/webapi/key/generate_key_pair.js
+function getModulusLengthOption(options) {
+  const modulusLength = options?.modulusLength ?? 2048;
+  if (typeof modulusLength != "number" || !Number.isInteger(modulusLength) || modulusLength < 2048)
+    throw new JOSENotSupported("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");
+  return modulusLength;
+}
+async function generateKeyPair(alg, options) {
+  const extractable = validateExtractableOption(options?.extractable), entry = keyAlgorithm(alg, algArgument);
+  entry.secret && unsupportedAlg(algArgument);
+  let algorithm;
+  if (entry.resolve) {
+    const crv = options?.crv ?? "P-256";
+    if (!["P-256", "P-384", "P-521", "X25519"].includes(crv))
+      throw new JOSENotSupported("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519");
+    algorithm = entry.resolve({ crv });
+  } else {
+    if (entry.crv !== void 0 && options?.crv !== void 0 && options.crv !== entry.crv)
+      throw new JOSENotSupported(`Invalid or unsupported crv option provided, the only supported value for ${alg} is ${entry.crv}`);
+    algorithm = entry.kty[0] === "RSA" ? {
+      ...entry.subtle,
+      publicExponent: Uint8Array.of(1, 0, 1),
+      modulusLength: getModulusLengthOption(options)
+    } : entry.subtle;
+  }
+  return crypto.subtle.generateKey(algorithm, extractable ?? false, [
+    ...entry.usages[1],
+    ...entry.usages[0]
+  ]);
+}
+
+// src/keys.ts
+var SIGNING_ALG = "ES256";
+async function generateSigningKey() {
+  const { privateKey } = await generateKeyPair(SIGNING_ALG, { extractable: true });
+  const jwk = await exportJWK(privateKey);
+  return { ...jwk, alg: SIGNING_ALG, kid: await calculateJwkThumbprint(jwk) };
+}
+function assertPrivateSigningJwk(jwk) {
+  if (jwk.kty !== "EC" || jwk.crv !== "P-256" || !jwk.d || !jwk.x || !jwk.y) {
+    throw new Error('must be a private EC P-256 JWK (kty "EC", crv "P-256", with d, x and y)');
+  }
+}
+async function importSigningKeys(jwk) {
+  assertPrivateSigningJwk(jwk);
+  const { d: _d, ...pub } = jwk;
+  const kid = jwk.kid ?? await calculateJwkThumbprint(pub);
+  const publicJwk = { kty: pub.kty, crv: pub.crv, x: pub.x, y: pub.y, alg: SIGNING_ALG, use: "sig", kid };
+  return {
+    privateKey: await importJWK({ ...jwk, alg: SIGNING_ALG }, SIGNING_ALG),
+    publicKey: await importJWK(publicJwk, SIGNING_ALG),
+    publicJwk,
+    kid
+  };
+}
+
+// src/password.ts
+import { createHash, createHmac, hkdfSync, randomBytes, randomInt, scrypt, timingSafeEqual } from "crypto";
+var HASH_PARAMS = { logN: 15, r: 8, p: 3 };
+var KEY_LENGTH = 64;
+var SALT_LENGTH = 16;
+var MAX_PASSWORD_LENGTH = 256;
+var MAX_EMAIL_LENGTH = 254;
+function derive2(password, salt, { logN, r, p }) {
+  const N = 2 ** logN;
+  return new Promise(
+    (resolve, reject) => scrypt(
+      password.normalize("NFC"),
+      salt,
+      KEY_LENGTH,
+      { N, r, p, maxmem: 256 * N * r + 1024 * 1024 },
+      (err, key) => err ? reject(err) : resolve(key)
+    )
+  );
+}
+async function hashPassword(password, params = HASH_PARAMS) {
+  const salt = randomBytes(SALT_LENGTH);
+  const key = await derive2(password, salt, params);
+  return ["scrypt", params.logN, params.r, params.p, salt.toString("base64url"), key.toString("base64url")].join("$");
+}
+async function verifyPassword(password, stored) {
+  const [scheme, logN, r, p, salt, hash] = stored.split("$");
+  const params = { logN: Number(logN), r: Number(r), p: Number(p) };
+  if (scheme !== "scrypt" || !salt || !hash || !Object.values(params).every((n) => Number.isInteger(n) && n > 0)) {
+    return { ok: false, needsRehash: false };
+  }
+  const expected = Buffer.from(hash, "base64url");
+  const key = await derive2(password, Buffer.from(salt, "base64url"), params);
+  const ok = key.length === expected.length && timingSafeEqual(key, expected);
+  const needsRehash = params.logN !== HASH_PARAMS.logN || params.r !== HASH_PARAMS.r || params.p !== HASH_PARAMS.p;
+  return { ok, needsRehash };
+}
+var dummyHash;
+async function verifyAgainstDummy(password) {
+  dummyHash ??= hashPassword(randomBytes(16).toString("hex"));
+  await verifyPassword(password, await dummyHash);
+}
+function checkPasswordPolicy(password, minLength) {
+  if (typeof password !== "string") return "password is missing";
+  const length = [...password].length;
+  if (length < minLength) return `The password must have at least ${minLength} characters.`;
+  if (length > MAX_PASSWORD_LENGTH) return `The password must have at most ${MAX_PASSWORD_LENGTH} characters.`;
+  return null;
+}
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}
+function isValidEmail(email) {
+  return typeof email === "string" && email.trim().length <= MAX_EMAIL_LENGTH && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email.trim());
+}
+function generateLinkToken() {
+  return randomBytes(32).toString("base64url");
+}
+function hashLinkToken(token) {
+  return createHash("sha256").update(token).digest("base64url");
+}
+function generateCode() {
+  return randomInt(0, 1e6).toString().padStart(6, "0");
+}
+function deriveCodeKey(signingKeyD) {
+  return Buffer.from(hkdfSync("sha256", Buffer.from(signingKeyD, "base64url"), "", "madauth e-mail code", 32));
+}
+function hashCode(key, code) {
+  return createHmac("sha256", key).update(code).digest("base64url");
+}
+function safeEqual(a, b) {
+  const x = Buffer.from(a);
+  const y = Buffer.from(b);
+  return x.length === y.length && timingSafeEqual(x, y);
+}
+
+// src/google.ts
+var GOOGLE_ISSUERS = ["https://accounts.google.com", "accounts.google.com"];
+var googleJwks;
+function googleKeys() {
+  googleJwks ??= createRemoteJWKSet(new URL("https://www.googleapis.com/oauth2/v3/certs"));
+  return googleJwks;
+}
+async function verifyGoogleIdToken(idToken, opts) {
+  let payload;
+  try {
+    ({ payload } = await jwtVerify(idToken, opts.keys ?? googleKeys(), {
+      issuer: GOOGLE_ISSUERS,
+      audience: opts.clientId,
+      algorithms: ["RS256", "ES256"]
+    }));
+  } catch (e) {
+    return { ok: false, error: "verification_failed", reason: e.message };
+  }
+  if (typeof payload.sub !== "string" || !payload.sub) {
+    return { ok: false, error: "verification_failed", reason: "missing sub" };
+  }
+  if (payload.nonce !== opts.nonce) {
+    return { ok: false, error: "verification_failed", reason: "nonce mismatch" };
+  }
+  if (payload.email_verified !== true) {
+    return { ok: false, error: "email_unverified", reason: "e-mail address not verified" };
+  }
+  const user = { id: `google:${payload.sub}` };
+  if (typeof payload.email === "string") user.email = payload.email;
+  if (typeof payload.name === "string") user.name = payload.name;
+  if (typeof payload.picture === "string") user.picture = payload.picture;
+  return { ok: true, user };
+}
+
+// src/user.ts
+var SESSION_COOKIE = "madauth_session";
+var SESSION_TYP = "madauth-session+jwt";
+
+// src/tokens.ts
+function randomString(bytes = 32) {
+  return base64url_exports.encode(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+async function signToken(keys, issuer, typ, claims, ttlSeconds) {
+  return new SignJWT(claims).setProtectedHeader({ alg: SIGNING_ALG, kid: keys.kid, typ }).setIssuer(issuer).setIssuedAt().setExpirationTime(`${ttlSeconds}s`).sign(keys.privateKey);
+}
+async function readToken(keys, issuer, typ, token) {
+  if (!token) return null;
+  try {
+    const { payload } = await jwtVerify(token, keys.publicKey, { issuer, typ, algorithms: [SIGNING_ALG] });
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function signSession(keys, issuer, ttlSeconds, user, amr, extra = {}) {
+  const claims = {
+    ...extra,
+    sub: user.id,
+    email: user.email,
+    email_verified: user.email ? true : void 0,
+    name: user.name,
+    picture: user.picture,
+    amr
+  };
+  return signToken(keys, issuer, SESSION_TYP, claims, ttlSeconds);
+}
+function userFromClaims(claims) {
+  const user = { id: claims.sub };
+  if (claims.email) user.email = claims.email;
+  if (claims.name) user.name = claims.name;
+  if (claims.picture) user.picture = claims.picture;
+  return user;
+}
+
+// src/routes/google.ts
+var NONCE_COOKIE = "madauth_nonce";
+var NONCE_TYP = "madauth-nonce+jwt";
+var NONCE_TTL = 5 * 60;
+var OAUTH_COOKIE = "madauth_oauth";
+var OAUTH_TYP = "madauth-oauth-state+jwt";
+var OAUTH_TTL = 10 * 60;
+var GOOGLE_AUTH_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
+var GOOGLE_TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
+var REDIRECT_ERROR_PARAM = "madauth_error";
+async function pkceChallenge(verifier) {
+  const digest2 = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return base64url_exports.encode(new Uint8Array(digest2));
+}
+function googleRoutes(app, ctx, google) {
+  const { config, keys, secure } = ctx;
+  const { issuer } = config;
+  const callbackUrl = `${issuer}/auth/google/callback`;
+  app.post("/auth/google/nonce", async (c) => {
+    const nonce = randomString();
+    const token = await signToken(await keys, issuer, NONCE_TYP, { nonce }, NONCE_TTL);
+    setCookie(c, NONCE_COOKIE, token, {
+      path: "/auth/google",
+      httpOnly: true,
+      secure,
+      sameSite: "Strict",
+      maxAge: NONCE_TTL
+    });
+    return c.json({ nonce });
+  });
+  app.post("/auth/google/verify", async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    if (typeof body.credential !== "string" || !body.credential) {
+      return c.json({ error: "verification_failed", message: "credential is missing" }, 400);
+    }
+    const nonceClaims = await readToken(await keys, issuer, NONCE_TYP, getCookie(c, NONCE_COOKIE));
+    if (!nonceClaims) {
+      return c.json({ error: "verification_failed", message: "nonce cookie missing or expired" }, 401);
+    }
+    const result = await verifyGoogleIdToken(body.credential, {
+      clientId: google.clientId,
+      nonce: nonceClaims.nonce,
+      keys: config.jwksResolver
+    });
+    if (!result.ok) {
+      return c.json({ error: result.error, message: result.reason }, result.error === "email_unverified" ? 403 : 401);
+    }
+    deleteCookie(c, NONCE_COOKIE, { path: "/auth/google", secure });
+    await ctx.startSession(c, result.user, ["google"]);
+    await ctx.emit("user.signed_in", { user: result.user, method: "google" });
+    return c.json({ user: result.user });
+  });
+  const requireCodeFlow = async (c, next) => {
+    if (!google.clientSecret) return c.json({ error: "not_found" }, 404);
+    await next();
+  };
+  app.get("/auth/google/start", requireCodeFlow, async (c) => {
+    const returnUrl = ctx.allowedUrl(c.req.query("return_to"));
+    if (!returnUrl) return c.text("return_to must be an absolute URL whose origin is in ALLOWED_ORIGINS", 400);
+    const oauth = {
+      state: randomString(),
+      nonce: randomString(),
+      verifier: randomString(),
+      returnTo: returnUrl.href
+    };
+    const token = await signToken(await keys, issuer, OAUTH_TYP, { ...oauth }, OAUTH_TTL);
+    setCookie(c, OAUTH_COOKIE, token, {
+      path: "/auth/google",
+      httpOnly: true,
+      secure,
+      sameSite: "Lax",
+      maxAge: OAUTH_TTL
+    });
+    const url = new URL(GOOGLE_AUTH_ENDPOINT);
+    url.search = new URLSearchParams({
+      client_id: google.clientId,
+      redirect_uri: callbackUrl,
+      response_type: "code",
+      scope: "openid email profile",
+      state: oauth.state,
+      nonce: oauth.nonce,
+      code_challenge: await pkceChallenge(oauth.verifier),
+      code_challenge_method: "S256"
+    }).toString();
+    return c.redirect(url.href, 302);
+  });
+  app.get("/auth/google/callback", requireCodeFlow, async (c) => {
+    const oauth = await readToken(await keys, issuer, OAUTH_TYP, getCookie(c, OAUTH_COOKIE));
+    if (!oauth) return c.text("Sign-in expired or was started in another browser. Please try again.", 400);
+    deleteCookie(c, OAUTH_COOKIE, { path: "/auth/google", secure });
+    const back = (error) => {
+      const url = new URL(oauth.returnTo);
+      if (error) url.hash = `${REDIRECT_ERROR_PARAM}=${error}`;
+      return c.redirect(url.href, 302);
+    };
+    if (c.req.query("error")) return back(c.req.query("error") === "access_denied" ? "cancelled" : "verification_failed");
+    const code = c.req.query("code");
+    if (!code || c.req.query("state") !== oauth.state) return back("verification_failed");
+    let idToken;
+    try {
+      const res = await fetch(GOOGLE_TOKEN_ENDPOINT, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          code,
+          client_id: google.clientId,
+          client_secret: google.clientSecret,
+          redirect_uri: callbackUrl,
+          grant_type: "authorization_code",
+          code_verifier: oauth.verifier
+        })
+      });
+      if (!res.ok) return back("verification_failed");
+      ({ id_token: idToken } = await res.json());
+    } catch {
+      return back("verification_failed");
+    }
+    if (typeof idToken !== "string") return back("verification_failed");
+    const result = await verifyGoogleIdToken(idToken, {
+      clientId: google.clientId,
+      nonce: oauth.nonce,
+      keys: config.jwksResolver
+    });
+    if (!result.ok) return back(result.error);
+    await ctx.startSession(c, result.user, ["google"]);
+    await ctx.emit("user.signed_in", { user: result.user, method: "google" });
+    return back();
+  });
+}
+
+// src/routes/password.ts
+var FREE_ATTEMPTS = 5;
+var MAX_LOCK_MS = 15 * 60 * 1e3;
+var MAIL_INTERVAL_MS = 60 * 1e3;
+var VERIFY_TTL_MS = 24 * 60 * 60 * 1e3;
+var RESET_TTL_MS = 30 * 60 * 1e3;
+var WEBHOOK_TIMEOUT_MS = 1e4;
+var VERIFY_LINK_PARAM = "madauth_verify";
+var RESET_LINK_PARAM = "madauth_reset";
+var MAX_NAME_LENGTH = 100;
+var MAX_LOCALE_LENGTH = 35;
+function toMadauthUser(user) {
+  const result = { id: user.id, email: user.email };
+  if (user.name) result.name = user.name;
+  return result;
+}
+function passwordRoutes(app, ctx, password, users, webhook) {
+  const { minLength } = password;
+  const body = async (c) => {
+    const data = await c.req.json().catch(() => null);
+    return data && typeof data === "object" ? data : {};
+  };
+  const error = (c, status, code, message2) => c.json({ error: code, message: message2 }, status);
+  const unavailable = (c) => error(c, 503, "temporarily_unavailable", "E-mails can not be sent right now. Please try again later.");
+  const accepted = (c) => c.json({}, 202);
+  const redirectTarget = (c, value) => {
+    const url = ctx.allowedUrl(value);
+    return url ?? error(c, 400, "invalid_options", "redirectTo must be an absolute URL whose origin is in ALLOWED_ORIGINS.");
+  };
+  const sendEmail = async (user, type, data) => {
+    if (Date.now() - user.lastMailAt < MAIL_INTERVAL_MS) return true;
+    const result = await webhook.call(type, { to: user.email, user: { id: user.id, name: user.name ?? void 0 }, ...data }, WEBHOOK_TIMEOUT_MS);
+    if (!result.ok) {
+      console.error(`[madauth] Webhook "${type}" for ${user.email} failed: ${result.reason}`);
+      return false;
+    }
+    await users.updateUser(user.id, { lastMailAt: Date.now() });
+    return true;
+  };
+  const sendLinkEmail = async (user, purpose, target, locale) => {
+    if (Date.now() - user.lastMailAt < MAIL_INTERVAL_MS) return true;
+    const ttl = purpose === "verify" ? VERIFY_TTL_MS : RESET_TTL_MS;
+    const { token, code } = await users.issueVerification(user.id, purpose, ttl);
+    const link = new URL(target);
+    link.hash = `${purpose === "verify" ? VERIFY_LINK_PARAM : RESET_LINK_PARAM}=${token}`;
+    return sendEmail(user, purpose === "verify" ? "email.verify" : "email.reset", {
+      link: link.href,
+      code,
+      expiresAt: Date.now() + ttl,
+      site: target.host,
+      locale
+    });
+  };
+  const localeOf = (data) => typeof data.locale === "string" && data.locale.length <= MAX_LOCALE_LENGTH ? data.locale : void 0;
+  const consume = async (data, purpose) => {
+    if (typeof data.token === "string" && data.token) {
+      return { userId: await users.consumeLinkToken(data.token, purpose), via: "link" };
+    }
+    if (isValidEmail(data.email) && typeof data.code === "string") {
+      const user = await users.findByEmail(normalizeEmail(data.email));
+      const code = data.code.replace(/\s/g, "");
+      return { userId: user ? await users.consumeCode(user.id, purpose, code) : null, via: "code" };
+    }
+    return { userId: null, via: "code" };
+  };
+  const invalidVerification = (c, via) => via === "link" ? error(c, 400, "link_invalid", "The link is invalid, expired or was already used.") : error(c, 400, "code_invalid", "The code is wrong or expired.");
+  app.post("/auth/password/signin", async (c) => {
+    const data = await body(c);
+    const wrong = () => error(c, 401, "invalid_credentials", "E-mail or password is wrong.");
+    const pw = typeof data.password === "string" ? data.password : "";
+    if (!isValidEmail(data.email) || !pw || pw.length > MAX_PASSWORD_LENGTH * 4) return wrong();
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    const account = user ? await users.passwordAccount(user.id) : null;
+    if (!user || !account?.secret) {
+      await verifyAgainstDummy(pw);
+      return wrong();
+    }
+    const now = Date.now();
+    if (account.lockedUntil > now) {
+      const seconds = Math.ceil((account.lockedUntil - now) / 1e3);
+      return error(c, 429, "too_many_attempts", `Too many failed attempts. Try again in ${seconds} seconds.`);
+    }
+    const failed = account.failedAttempts + 1;
+    const lockedUntil = failed >= FREE_ATTEMPTS ? now + Math.min(2 ** (failed - FREE_ATTEMPTS) * 1e3, MAX_LOCK_MS) : 0;
+    if (!await users.countAttempt(account, { failedAttempts: failed, lockedUntil })) {
+      return error(c, 429, "too_many_attempts", "Too many attempts at once. Please try again.");
+    }
+    const { ok, needsRehash } = await verifyPassword(pw, account.secret);
+    if (!ok) return wrong();
+    await users.updateAccount(account.id, {
+      failedAttempts: 0,
+      lockedUntil: 0,
+      ...needsRehash ? { secret: await hashPassword(pw) } : {}
+    });
+    if (!user.emailVerified) {
+      return error(c, 403, "email_unverified", "Please confirm your e-mail address first. We can send the e-mail again.");
+    }
+    const result = toMadauthUser(user);
+    await ctx.startSession(c, result, ["pwd"], { sv: user.sessionVersion });
+    await ctx.emit("user.signed_in", { user: result, method: "password" });
+    return c.json({ user: result });
+  });
+  app.post("/auth/password/signup", async (c) => {
+    const data = await body(c);
+    const target = redirectTarget(c, data.redirectTo);
+    if (target instanceof Response) return target;
+    if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
+    const policy = checkPasswordPolicy(data.password, minLength);
+    if (policy) return error(c, 400, "weak_password", policy);
+    const name = typeof data.name === "string" && data.name.trim() ? data.name.trim().slice(0, MAX_NAME_LENGTH) : null;
+    const email = data.email.trim();
+    const locale = localeOf(data);
+    if (webhook.wants("signup.before")) {
+      const check2 = await webhook.call("signup.before", { email, name: name ?? void 0, locale }, WEBHOOK_TIMEOUT_MS);
+      if (!check2.ok) {
+        console.error(`[madauth] Webhook "signup.before" failed: ${check2.reason}`);
+        return unavailable(c);
+      }
+      const answer = check2.body;
+      if (answer?.allow === false) {
+        const message2 = typeof answer.message === "string" && answer.message ? answer.message : "Sign-up is not possible with this e-mail address.";
+        return error(c, 403, "signup_rejected", message2);
+      }
+    }
+    const passwordHash = await hashPassword(data.password);
+    const existing = await users.findByEmail(normalizeEmail(email));
+    if (existing?.emailVerified) {
+      const sent = await sendEmail(existing, "email.already_registered", { link: target.href, site: target.host, locale });
+      return sent ? accepted(c) : unavailable(c);
+    }
+    if (existing) {
+      if (Date.now() - existing.lastMailAt < MAIL_INTERVAL_MS) return accepted(c);
+      const account = await users.passwordAccount(existing.id);
+      if (account) await users.updateAccount(account.id, { secret: passwordHash, failedAttempts: 0, lockedUntil: 0 });
+      await users.updateUser(existing.id, { name });
+      return await sendLinkEmail({ ...existing, name }, "verify", target, locale) ? accepted(c) : unavailable(c);
+    }
+    const user = await users.createPasswordUser({
+      email,
+      emailNormalized: normalizeEmail(email),
+      name,
+      passwordHash,
+      emailVerified: false
+    });
+    if (!user) return accepted(c);
+    await ctx.emit("user.created", { user: toMadauthUser(user) });
+    return await sendLinkEmail(user, "verify", target, locale) ? accepted(c) : unavailable(c);
+  });
+  app.post("/auth/password/send-verification", async (c) => {
+    const data = await body(c);
+    const target = redirectTarget(c, data.redirectTo);
+    if (target instanceof Response) return target;
+    if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    if (user && !user.emailVerified && await users.passwordAccount(user.id)) {
+      if (!await sendLinkEmail(user, "verify", target, localeOf(data))) return unavailable(c);
+    }
+    return accepted(c);
+  });
+  app.post("/auth/password/verify-email", async (c) => {
+    const { userId, via } = await consume(await body(c), "verify");
+    const user = userId ? await users.findById(userId) : null;
+    if (!user) return invalidVerification(c, via);
+    await users.updateUser(user.id, { emailVerified: true });
+    const result = toMadauthUser(user);
+    await ctx.startSession(c, result, ["pwd"], { sv: user.sessionVersion });
+    await ctx.emit("email.verified", { user: result, via });
+    await ctx.emit("user.signed_in", { user: result, method: "password" });
+    return c.json({ user: result });
+  });
+  app.post("/auth/password/send-reset", async (c) => {
+    const data = await body(c);
+    const target = redirectTarget(c, data.redirectTo);
+    if (target instanceof Response) return target;
+    if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    if (user && await users.passwordAccount(user.id)) {
+      if (!await sendLinkEmail(user, "reset", target, localeOf(data))) return unavailable(c);
+    }
+    return accepted(c);
+  });
+  app.post("/auth/password/reset", async (c) => {
+    const data = await body(c);
+    const policy = checkPasswordPolicy(data.password, minLength);
+    if (policy) return error(c, 400, "weak_password", policy);
+    const { userId, via } = await consume(data, "reset");
+    const user = userId ? await users.findById(userId) : null;
+    const account = user ? await users.passwordAccount(user.id) : null;
+    if (!user || !account) return invalidVerification(c, via);
+    await users.updateAccount(account.id, { secret: await hashPassword(data.password), failedAttempts: 0, lockedUntil: 0 });
+    const sessionVersion = user.sessionVersion + 1;
+    await users.updateUser(user.id, { emailVerified: true, sessionVersion });
+    await users.clearVerifications(user.id);
+    const result = toMadauthUser(user);
+    await ctx.startSession(c, result, ["pwd"], { sv: sessionVersion });
+    await ctx.emit("password.reset", { user: result });
+    await ctx.emit("user.signed_in", { user: result, method: "password" });
+    return c.json({ user: result });
+  });
+}
+
+// src/users.ts
+import { randomBytes as randomBytes2 } from "crypto";
+var MAX_CODE_ATTEMPTS = 5;
+var newId = (prefix) => `${prefix}_${randomBytes2(16).toString("base64url")}`;
+function passwordAccountKey(userId) {
+  return `password:${userId}`;
+}
+var Users = class {
+  /** `codeKey` keys the e-mail codes (see deriveCodeKey); only needed to issue and check them. */
+  constructor(store, codeKey) {
+    this.store = store;
+    this.codeKey = codeKey;
+  }
+  get key() {
+    if (!this.codeKey) throw new Error("Users needs a code key to issue or check e-mail codes.");
+    return this.codeKey;
+  }
+  async findByEmail(emailNormalized) {
+    return await this.store.findOne("user", { emailNormalized });
+  }
+  async findById(id) {
+    return await this.store.findOne("user", { id });
+  }
+  async passwordAccount(userId) {
+    return await this.store.findOne("account", { key: passwordAccountKey(userId) });
+  }
+  /** Creates a user with a password. Resolves to null if the e-mail address is taken. */
+  async createPasswordUser(data) {
+    const now = Date.now();
+    const user = {
+      id: newId("usr"),
+      email: data.email,
+      emailNormalized: data.emailNormalized,
+      emailVerified: data.emailVerified,
+      name: data.name,
+      sessionVersion: 0,
+      lastMailAt: 0,
+      createdAt: now
+    };
+    if (!await this.store.create("user", user)) return null;
+    const account = {
+      id: newId("acc"),
+      userId: user.id,
+      key: passwordAccountKey(user.id),
+      secret: data.passwordHash,
+      failedAttempts: 0,
+      lockedUntil: 0,
+      createdAt: now
+    };
+    if (!await this.store.create("account", account)) {
+      await this.store.delete("user", { id: user.id });
+      return null;
+    }
+    return user;
+  }
+  async updateUser(id, patch) {
+    await this.store.update("user", { id }, patch);
+  }
+  async updateAccount(id, patch) {
+    await this.store.update("account", { id }, patch);
+  }
+  /**
+   * Counts a sign-in attempt: writes `patch` only if the account's `failedAttempts` is still the value that
+   * was read. Resolves to false if another request counted an attempt meanwhile.
+   */
+  async countAttempt(account, patch) {
+    const changed = await this.store.update("account", { id: account.id, failedAttempts: account.failedAttempts }, patch);
+    return changed === 1;
+  }
+  /** Deletes the user's pending verifications and password resets; their links and codes stop working. */
+  async clearVerifications(userId) {
+    await this.store.delete("verification", { userId });
+  }
+  /**
+   * Starts a verification or password reset: replaces the user's earlier one for the same purpose and
+   * returns the link token and the code for the e-mail. Only their hashes are stored.
+   */
+  async issueVerification(userId, purpose, ttlMs) {
+    await this.store.delete("verification", { userId, purpose });
+    const token = generateLinkToken();
+    const code = generateCode();
+    const record = {
+      id: hashLinkToken(token),
+      userId,
+      purpose,
+      codeHash: hashCode(this.key, code),
+      attempts: 0,
+      expiresAt: Date.now() + ttlMs
+    };
+    await this.store.create("verification", record);
+    return { token, code };
+  }
+  /** Uses up the verification a link token belongs to. Resolves to its user ID, or null if invalid, expired or used. */
+  async consumeLinkToken(token, purpose) {
+    const id = hashLinkToken(token);
+    const record = await this.store.findOne("verification", { id, purpose });
+    return record ? this.consume(record) : null;
+  }
+  /** Uses up the user's verification if `code` matches. Too many wrong codes delete it. */
+  async consumeCode(userId, purpose, code) {
+    const record = await this.store.findOne("verification", { userId, purpose });
+    if (!record) return null;
+    const attempts = record.attempts + 1;
+    if (await this.store.update("verification", { id: record.id, attempts: record.attempts }, { attempts }) !== 1) return null;
+    if (!safeEqual(hashCode(this.key, code), record.codeHash)) {
+      if (attempts >= MAX_CODE_ATTEMPTS) await this.store.delete("verification", { id: record.id });
+      return null;
+    }
+    return this.consume(record);
+  }
+  async consume(record) {
+    const deleted = await this.store.delete("verification", { id: record.id });
+    if (deleted !== 1 || record.expiresAt <= Date.now()) return null;
+    return record.userId;
+  }
+};
+
+// src/webhooks.ts
+import { createHmac as createHmac2, randomBytes as randomBytes3, randomUUID, timingSafeEqual as timingSafeEqual2 } from "crypto";
+var WEBHOOK_TYPES = [
+  "email.verify",
+  "email.reset",
+  "email.already_registered",
+  "signup.before",
+  "user.created",
+  "email.verified",
+  "password.reset",
+  "user.signed_in"
+];
+var isEmailType = (type) => type.startsWith("email.") && type !== "email.verified";
+var SECRET_PREFIX = "whsec_";
+var WEBHOOK_TOLERANCE_SECONDS = 5 * 60;
+function generateWebhookSecret() {
+  return `${SECRET_PREFIX}${randomBytes3(32).toString("base64")}`;
+}
+function checkWebhookSecret(secret) {
+  if (!secret.startsWith(SECRET_PREFIX)) return `must start with "${SECRET_PREFIX}"`;
+  const key = Buffer.from(secret.slice(SECRET_PREFIX.length), "base64");
+  if (key.length < 24 || key.length > 64) return "must contain 24 to 64 bytes in base64";
+  return null;
+}
+function hmac2(secret, content) {
+  const key = Buffer.from(secret.slice(SECRET_PREFIX.length), "base64");
+  return createHmac2("sha256", key).update(content).digest("base64");
+}
+function signWebhook(secret, id, timestamp, body) {
+  return `v1,${hmac2(secret, `${id}.${timestamp}.${body}`)}`;
+}
+function createWebhookClient(settings, fetchImpl = fetch) {
+  const wants = (type) => isEmailType(type) || !settings.events || settings.events.has(type);
+  return {
+    wants,
+    async call(type, data, timeoutMs) {
+      if (!wants(type)) return { ok: true, body: void 0 };
+      const id = `msg_${randomUUID()}`;
+      const timestamp = Math.floor(Date.now() / 1e3);
+      const body = JSON.stringify({ type, data });
+      let response;
+      try {
+        response = await fetchImpl(settings.url, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "webhook-id": id,
+            "webhook-timestamp": String(timestamp),
+            "webhook-signature": signWebhook(settings.secret, id, timestamp, body)
+          },
+          body,
+          signal: AbortSignal.timeout(timeoutMs)
+        });
+      } catch (e) {
+        const reason = e.name === "TimeoutError" ? `no answer within ${timeoutMs} ms` : e.message;
+        return { ok: false, reason };
+      }
+      const text = await response.text().catch(() => "");
+      if (!response.ok) return { ok: false, reason: `HTTP ${response.status}` };
+      let parsed;
+      try {
+        parsed = text ? JSON.parse(text) : void 0;
+      } catch {
+        parsed = void 0;
+      }
+      return { ok: true, body: parsed };
+    }
+  };
+}
+
+// src/app.ts
+var EVENT_TIMEOUT_MS = 5e3;
+function createApp(config) {
+  const { issuer, allowedOrigins, sessionTtlSeconds, cookieDomain } = config;
+  const keys = importSigningKeys(config.signingKey);
+  const secure = issuer.startsWith("https:");
+  const isAllowedOrigin = (origin) => !!origin && allowedOrigins.includes(origin);
+  const ctx = {
+    config,
+    keys,
+    secure,
+    isAllowedOrigin,
+    allowedUrl(value) {
+      let url;
+      try {
+        url = new URL(typeof value === "string" ? value : "");
+      } catch {
+        return null;
+      }
+      if (!isAllowedOrigin(url.origin)) return null;
+      url.hash = "";
+      return url;
+    },
+    async startSession(c, user, amr, extra) {
+      const token = await signSession(await keys, issuer, sessionTtlSeconds, user, amr, extra);
+      setCookie(c, SESSION_COOKIE, token, {
+        path: "/",
+        domain: cookieDomain,
+        httpOnly: true,
+        secure,
+        sameSite: "Lax",
+        maxAge: sessionTtlSeconds
+      });
+    },
+    users: config.password ? new Users(config.password.store, deriveCodeKey(config.signingKey.d)) : void 0,
+    webhook: config.webhook ? createWebhookClient(config.webhook, config.webhookFetch) : void 0,
+    async emit(type, data) {
+      if (!this.webhook?.wants(type)) return;
+      const result = await this.webhook.call(type, data, EVENT_TIMEOUT_MS);
+      if (!result.ok) console.error(`[madauth] Webhook "${type}" failed: ${result.reason}`);
+    }
+  };
+  const app = new Hono3();
+  app.use(
+    "/auth/*",
+    cors({
+      origin: (origin) => isAllowedOrigin(origin) ? origin : null,
+      credentials: true,
+      allowMethods: ["GET", "POST"],
+      allowHeaders: ["Content-Type"],
+      maxAge: 600
+    })
+  );
+  app.use("/auth/*", async (c, next) => {
+    if (c.req.method === "POST" && !isAllowedOrigin(c.req.header("origin"))) {
+      return c.json({ error: "forbidden_origin" }, 403);
+    }
+    await next();
+  });
+  app.get("/health", (c) => c.text("ok"));
+  app.get("/.well-known/jwks.json", async (c) => {
+    const { publicJwk } = await keys;
+    c.header("Cache-Control", "public, max-age=3600");
+    return c.json({ keys: [publicJwk] });
+  });
+  app.get(
+    "/auth/config",
+    (c) => c.json({
+      google: config.google ? { clientId: config.google.clientId, codeFlow: !!config.google.clientSecret } : null,
+      password: config.password ? { minLength: config.password.minLength } : null
+    })
+  );
+  if (config.google) googleRoutes(app, ctx, config.google);
+  if (config.password && ctx.users && ctx.webhook) passwordRoutes(app, ctx, config.password, ctx.users, ctx.webhook);
+  app.get("/auth/session", async (c) => {
+    const claims = await readToken(await keys, issuer, SESSION_TYP, getCookie(c, SESSION_COOKIE));
+    if (!claims) return c.json({ error: "no_session" }, 401);
+    if (claims.sub.startsWith("usr_")) {
+      const stored = await ctx.users?.findById(claims.sub);
+      if (!stored || stored.sessionVersion !== claims.sv) return c.json({ error: "no_session" }, 401);
+    }
+    const user = userFromClaims(claims);
+    if (Date.now() / 1e3 - claims.iat > sessionTtlSeconds / 2) await ctx.startSession(c, user, claims.amr, { sv: claims.sv });
+    return c.json({ user });
+  });
+  app.post("/auth/logout", (c) => {
+    deleteCookie(c, SESSION_COOKIE, { path: "/", domain: cookieDomain, secure });
+    return c.body(null, 204);
+  });
+  return app;
+}
+
+// src/config.ts
+var DEFAULT_SESSION_TTL = 8 * 60 * 60;
+var DEFAULT_PASSWORD_MIN_LENGTH = 8;
+var ConfigError = class extends Error {
+  constructor() {
+    super(...arguments);
+    this.name = "ConfigError";
+  }
+};
+function parseOrigin(name, value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new ConfigError(`${name}: "${value}" is not a URL.`);
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw new ConfigError(`${name}: "${value}" must be an http(s) URL.`);
+  }
+  return url.origin;
+}
+function readEnv(env, name) {
+  return env[name]?.trim().replace(/^(['"])(.*)\1$/s, "$2").trim() || void 0;
+}
+async function loadConfig(env, overrides = {}) {
+  const read = (name) => readEnv(env, name);
+  const require2 = (name) => {
+    const value = read(name);
+    if (!value) throw new ConfigError(`${name} is not set. See docs/server.md.`);
+    return value;
+  };
+  const issuerValue = require2("MADAUTH_ISSUER");
+  parseOrigin("MADAUTH_ISSUER", issuerValue);
+  const issuer = issuerValue.replace(/\/+$/, "");
+  const keyValue = read("MADAUTH_SIGNING_KEY");
+  if (!keyValue) {
+    const key = await generateSigningKey();
+    throw new ConfigError(
+      `MADAUTH_SIGNING_KEY is not set. Here is a newly generated key you can use (keep it secret and use the same key on every instance):
+
+MADAUTH_SIGNING_KEY='${JSON.stringify(key)}'
+`
+    );
+  }
+  let signingKey;
+  try {
+    signingKey = JSON.parse(keyValue);
+    assertPrivateSigningJwk(signingKey);
+  } catch (e) {
+    const reason = e instanceof SyntaxError ? "is not valid JSON" : e.message;
+    throw new ConfigError(`MADAUTH_SIGNING_KEY ${reason}. Generate one with: npx @madauth/server generate-key`);
+  }
+  const allowedOrigins = require2("ALLOWED_ORIGINS").split(",").map((o) => o.trim()).filter(Boolean).map((o) => parseOrigin("ALLOWED_ORIGINS", o));
+  const clientId = read("GOOGLE_CLIENT_ID");
+  if (clientId && !clientId.endsWith(".apps.googleusercontent.com")) {
+    throw new ConfigError(`GOOGLE_CLIENT_ID must end with ".apps.googleusercontent.com" but is "${clientId}".`);
+  }
+  const webhook = webhookFromEnv(read("WEBHOOK_URL"), read("WEBHOOK_SECRET"), read("WEBHOOK_EVENTS"));
+  const store = overrides.store ?? await storeFromDatabaseUrl(read("DATABASE_URL"));
+  let password;
+  if (store) {
+    if (!webhook) {
+      throw new ConfigError(
+        'WEBHOOK_URL is not set. E-mail & password sign-in sends its e-mails through your webhook. For development, run the example receiver (npm run dev:webhooks) and set WEBHOOK_URL=http://localhost:8790/webhook. See "Webhooks" in docs/server.md.'
+      );
+    }
+    password = { minLength: passwordMinLength(read("PASSWORD_MIN_LENGTH")), store };
+  }
+  if (!clientId && !password) {
+    throw new ConfigError(
+      "No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in and/or DATABASE_URL (e.g. sqlite:./madauth.db) for e-mail & password sign-in. See docs/server.md."
+    );
+  }
+  const ttlValue = read("SESSION_TTL");
+  const sessionTtlSeconds = ttlValue ? Number(ttlValue) : DEFAULT_SESSION_TTL;
+  if (!Number.isInteger(sessionTtlSeconds) || sessionTtlSeconds < 60) {
+    throw new ConfigError(`SESSION_TTL must be a whole number of seconds (at least 60) but is "${ttlValue}".`);
+  }
+  return {
+    issuer,
+    signingKey,
+    allowedOrigins,
+    sessionTtlSeconds,
+    cookieDomain: read("COOKIE_DOMAIN"),
+    google: clientId ? { clientId, clientSecret: read("GOOGLE_CLIENT_SECRET") } : void 0,
+    password,
+    webhook
+  };
+}
+function passwordMinLength(value) {
+  const minLength = value ? Number(value) : DEFAULT_PASSWORD_MIN_LENGTH;
+  if (!Number.isInteger(minLength) || minLength < 1 || minLength > 128) {
+    throw new ConfigError(`PASSWORD_MIN_LENGTH must be a whole number from 1 to 128 but is "${value}".`);
+  }
+  return minLength;
+}
+async function storeFromDatabaseUrl(url) {
+  if (!url) return void 0;
+  if (!url.startsWith("sqlite:")) {
+    throw new ConfigError(
+      `DATABASE_URL must start with "sqlite:" (e.g. sqlite:/data/madauth.db) but is "${url}". For other databases, pass your own store adapter (see "Custom store adapter" in docs/server.md).`
+    );
+  }
+  const path = url.slice("sqlite:".length);
+  if (!path) throw new ConfigError("DATABASE_URL needs a file path, e.g. sqlite:/data/madauth.db");
+  const { createSqliteAdapter: createSqliteAdapter2 } = await Promise.resolve().then(() => (init_sqlite(), sqlite_exports));
+  try {
+    return createSqliteAdapter2(path);
+  } catch (e) {
+    throw new ConfigError(`DATABASE_URL: could not open "${path}": ${e.message}`);
+  }
+}
+var LOCAL_HOSTS = ["localhost", "127.0.0.1", "[::1]", "host.docker.internal"];
+function webhookFromEnv(url, secret, events) {
+  if (!url) {
+    if (secret || events) throw new ConfigError("WEBHOOK_SECRET and WEBHOOK_EVENTS need WEBHOOK_URL.");
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new ConfigError(`WEBHOOK_URL: "${url}" is not a URL.`);
+  }
+  if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && LOCAL_HOSTS.includes(parsed.hostname))) {
+    throw new ConfigError(`WEBHOOK_URL must be an https URL (http only for localhost) but is "${url}".`);
+  }
+  if (!secret) {
+    throw new ConfigError(
+      `WEBHOOK_SECRET is not set. Here is a newly generated secret you can use (keep it secret; your webhook receiver needs the same one):
+
+WEBHOOK_SECRET=${generateWebhookSecret()}
+`
+    );
+  }
+  const problem = checkWebhookSecret(secret);
+  if (problem) {
+    throw new ConfigError(`WEBHOOK_SECRET ${problem}. Generate one with: npx @madauth/server generate-webhook-secret`);
+  }
+  let selected = null;
+  if (events) {
+    selected = new Set(events.split(",").map((e) => e.trim()).filter(Boolean));
+    const unknown = [...selected].filter((e) => !WEBHOOK_TYPES.includes(e));
+    if (unknown.length) {
+      throw new ConfigError(`WEBHOOK_EVENTS: unknown type ${unknown.join(", ")}. Known types: ${WEBHOOK_TYPES.join(", ")}.`);
+    }
+  }
+  return { url: parsed.href, secret, events: selected };
+}
+
+// src/entry/lambda.ts
+function createHandler(overrides = {}) {
+  let handlerPromise;
+  return async (event, context) => {
+    handlerPromise ??= loadConfig(process.env, overrides).then((config) => handle(createApp(config)));
+    handlerPromise.catch(() => handlerPromise = void 0);
+    return (await handlerPromise)(event, context);
+  };
+}
+var handler = createHandler();
+export {
+  createHandler,
+  handler
+};