@madauth/server 0.3.0-beta.2 → 0.5.0-beta.1

package/dist/chunk-7DHKDRGY.js

@@ -0,0 +1,1706 @@
+import {
+  EXPIRY_COOKIE,
+  RENEWAL_COOKIE,
+  RENEWAL_TYP,
+  SESSION_COOKIE,
+  SESSION_TYP,
+  randomString,
+  readToken,
+  signRenewal,
+  signSession,
+  signToken,
+  userFromClaims
+} from "./chunk-A7UYZRBL.js";
+import {
+  ADMIN_ROLE,
+  DEFAULT_PASSWORD_RULES,
+  MAX_MIN_LENGTH,
+  MAX_PASSWORD_LENGTH,
+  METHODS,
+  METHODS_WITH_SECOND_FACTOR,
+  SIGN_IN_METHODS,
+  Settings,
+  Users,
+  anyOn,
+  authenticatorOn,
+  canSignUp,
+  checkPasswordPolicy,
+  claimsFromJson,
+  deriveCodeKey,
+  emailLinkAccountKey,
+  githubAccountKey,
+  googleAccountKey,
+  hasSecondFactor,
+  hashCode,
+  hashPassword,
+  initialMethods,
+  isAdmin,
+  isConfigured,
+  isOn,
+  isValidEmail,
+  methodConfig,
+  newId,
+  normalizeEmail,
+  parseClaims,
+  parseMethodSettings,
+  parsePasswordRules,
+  passwordAccountKey,
+  policyOf,
+  safeEqual,
+  sameClaims,
+  sendsVerificationEmails,
+  smsAccountKey,
+  toMadauthUser,
+  totpAccountKey,
+  verifyAgainstDummy,
+  verifyPassword
+} from "./chunk-NYIEFI4B.js";
+import {
+  importSigningKeys
+} from "./chunk-JDQLSL36.js";
+import {
+  WEBHOOK_TIMEOUT_MS,
+  createWebhookClient,
+  localeOf
+} from "./chunk-SISM7YUZ.js";
+
+// src/routes/oauth.ts
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
+import { base64url } from "jose";
+var REDIRECT_ERROR_PARAM = "madauth_error";
+var REDIRECT_NEXT_PARAM = "madauth_next";
+var REDIRECT_FACTORS_PARAM = "madauth_factors";
+var REDIRECT_METHOD_PARAM = "madauth_method";
+var OAUTH_COOKIE = "madauth_oauth";
+var OAUTH_TYP = "madauth-oauth-state+jwt";
+var OAUTH_TTL = 10 * 60;
+async function pkceChallenge(verifier) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return base64url.encode(new Uint8Array(digest));
+}
+async function startOAuth(c, ctx, cookiePath, returnTo) {
+  const oauth = {
+    state: randomString(),
+    nonce: randomString(),
+    verifier: randomString(),
+    returnTo: returnTo.href,
+    locale: localeOf(c.req.query("locale"))
+  };
+  const token = await signToken(await ctx.keys, ctx.config.issuer, OAUTH_TYP, { ...oauth }, OAUTH_TTL);
+  setCookie(c, OAUTH_COOKIE, token, {
+    path: cookiePath,
+    httpOnly: true,
+    secure: ctx.secure,
+    sameSite: "Lax",
+    maxAge: OAUTH_TTL
+  });
+  return oauth;
+}
+async function takeOAuthState(c, ctx, cookiePath) {
+  const oauth = await readToken(await ctx.keys, ctx.config.issuer, OAUTH_TYP, getCookie(c, OAUTH_COOKIE));
+  if (!oauth) return null;
+  deleteCookie(c, OAUTH_COOKIE, { path: cookiePath, secure: ctx.secure });
+  return {
+    state: oauth.state,
+    nonce: oauth.nonce,
+    verifier: oauth.verifier,
+    returnTo: oauth.returnTo,
+    ...typeof oauth.locale === "string" ? { locale: oauth.locale } : {}
+  };
+}
+function redirectBack(c, returnTo, method) {
+  return (error2, next, factors = []) => {
+    const url = new URL(returnTo);
+    if (error2) url.hash = `${REDIRECT_ERROR_PARAM}=${error2}&${REDIRECT_METHOD_PARAM}=${method}`;
+    if (next) url.hash = `${REDIRECT_NEXT_PARAM}=${next}${factors.length ? `&${REDIRECT_FACTORS_PARAM}=${factors.join(",")}` : ""}&${REDIRECT_METHOD_PARAM}=${method}`;
+    return c.redirect(url.href, 302);
+  };
+}
+var METHOD_NAMES = {
+  google: "Google",
+  github: "GitHub",
+  password: "a password",
+  totp: "an authenticator app",
+  "email-link": "an e-mail link"
+};
+async function resolveProviderUser(ctx, provider, profile, locale) {
+  const { users } = ctx;
+  const { key } = profile;
+  const emailNormalized = normalizeEmail(profile.email);
+  const signedIn = (user) => ({ ok: true, user });
+  const account = await users.findAccountByKey(key);
+  if (account) {
+    const user = await users.findById(account.userId);
+    if (user) {
+      const patch = {
+        ...account.email !== profile.email ? { email: profile.email } : {},
+        ...profile.secret ? { secret: profile.secret } : {}
+      };
+      if (Object.keys(patch).length) await users.updateAccount(account.id, patch);
+      return signedIn(user);
+    }
+    await users.deleteAccount(account.id);
+  }
+  for (let attempt = 0; attempt < 2; attempt++) {
+    const existing = await users.findByEmail(emailNormalized);
+    if (existing) {
+      if (existing.emailVerified && await users.hasSignInMethod(existing.id)) {
+        const methods = await users.signInMethods(existing.id, await ctx.settings.methods());
+        const how = methods.map((method) => METHOD_NAMES[method]).join(" or ");
+        return {
+          ok: false,
+          error: "other_method",
+          message: `This e-mail address signs in with ${how || "another method"}. Use that instead of ${provider.name}.`,
+          methods
+        };
+      }
+      const taken = await users.reopenSignUp(existing);
+      await users.verifyByProvider(taken);
+      if (!await users.linkAccount(taken.id, { key, email: profile.email, secret: profile.secret })) {
+        const linked = await users.findAccountByKey(key);
+        const owner = linked && await users.findById(linked.userId);
+        if (!owner) return { ok: false, error: "temporarily_unavailable", message: "Please try again." };
+        return signedIn(owner);
+      }
+      return signedIn({ ...taken, emailVerified: true });
+    }
+    if (attempt === 0) {
+      const check = await ctx.checkSignup({ email: profile.email, name: profile.name, locale, method: provider.method });
+      if (!check.ok) {
+        return check.reason === "rejected" ? { ok: false, error: "signup_rejected", message: check.message } : { ok: false, error: "temporarily_unavailable", message: "Signing up is not possible right now. Please try again later." };
+      }
+    }
+    const user = await users.createUser({
+      email: profile.email,
+      emailNormalized,
+      name: profile.name ?? null,
+      emailVerified: true,
+      account: { key, email: profile.email, secret: profile.secret }
+    });
+    if (user) return signedIn(user);
+  }
+  return { ok: false, error: "temporarily_unavailable", message: "Please try again." };
+}
+
+// src/app.ts
+import { Hono } from "hono";
+import { deleteCookie as deleteCookie6, getCookie as getCookie6, setCookie as setCookie6 } from "hono/cookie";
+import { cors } from "hono/cors";
+
+// src/routes/helpers.ts
+async function body(c) {
+  const data = await c.req.json().catch(() => null);
+  return data && typeof data === "object" ? data : {};
+}
+function error(c, status, code, message) {
+  return c.json({ error: code, message }, status);
+}
+var unavailable = (c) => error(c, 503, "temporarily_unavailable", "E-mails can not be sent right now. Please try again later.");
+var smsUnavailable = (c) => error(c, 503, "temporarily_unavailable", "The SMS can not be sent right now. Please try again later.");
+function originHost(ctx, c) {
+  const origin = c.req.header("origin");
+  return URL.canParse(origin ?? "") ? new URL(origin).hostname : new URL(ctx.config.issuer).hostname;
+}
+var accepted = (c) => c.json({}, 202);
+var noSession = (c) => error(c, 401, "no_session", "Please sign in first.");
+function redirectTarget(ctx, c, value) {
+  const url = ctx.allowedUrl(value);
+  return url ?? error(c, 400, "invalid_options", "redirectTo must be an absolute URL whose origin is in ALLOWED_ORIGINS.");
+}
+var MAX_NAME_LENGTH = 100;
+function nameOf(value) {
+  return typeof value === "string" && value.trim() ? value.trim().slice(0, MAX_NAME_LENGTH) : null;
+}
+function signInAnswer(c, step) {
+  if ("disabled" in step) return error(c, 403, "method_disabled", "This way of signing in is switched off.");
+  if ("next" in step) {
+    const rest = { method: step.method, factors: step.factors };
+    if (step.next === "totp") return c.json({ error: "totp_required", message: "Enter the code from your authenticator app to finish signing in.", ...rest }, 401);
+    if (step.next === "sms") return c.json({ error: "sms_required", message: "Enter the code we sent to your phone to finish signing in.", ...rest }, 401);
+    return c.json({ error: "totp_setup_required", message: "Set up an authenticator app to finish signing in.", ...rest }, 401);
+  }
+  return c.json({ user: step.user });
+}
+
+// src/routes/emails.ts
+var MAIL_INTERVAL_MS = 60 * 1e3;
+var VERIFY_TTL_MS = 24 * 60 * 60 * 1e3;
+var RESET_TTL_MS = 30 * 60 * 1e3;
+var SIGNIN_TTL_MS = 15 * 60 * 1e3;
+var VERIFY_LINK_PARAM = "madauth_verify";
+var RESET_LINK_PARAM = "madauth_reset";
+var SIGNIN_LINK_PARAM = "madauth_signin";
+var LINKS = {
+  verify: { ttl: VERIFY_TTL_MS, param: VERIFY_LINK_PARAM, type: "email.send_verification" },
+  reset: { ttl: RESET_TTL_MS, param: RESET_LINK_PARAM, type: "email.send_password_reset" },
+  signin: { ttl: SIGNIN_TTL_MS, param: SIGNIN_LINK_PARAM, type: "email.send_signin_link" }
+};
+function createEmails(ctx, users, webhook) {
+  const sendEmail = async (user, type, data) => {
+    if (Date.now() - user.lastMailAt < MAIL_INTERVAL_MS) return true;
+    const result = await webhook.call(type, { to: user.email, user: { id: user.id, name: user.name ?? void 0 }, ...data }, WEBHOOK_TIMEOUT_MS);
+    if (!result.ok) {
+      console.error(`[madauth] Webhook "${type}" for ${user.email} failed: ${result.reason}`);
+      return false;
+    }
+    await users.updateUser(user.id, { lastMailAt: Date.now() });
+    return true;
+  };
+  return {
+    sendEmail,
+    async sendLinkEmail(user, purpose, target, locale) {
+      if (Date.now() - user.lastMailAt < MAIL_INTERVAL_MS) return true;
+      const { ttl, param, type } = LINKS[purpose];
+      const { token, code } = await users.issueVerification(user.id, purpose, ttl);
+      const link = new URL(target);
+      link.hash = `${param}=${token}`;
+      return sendEmail(user, type, { link: link.href, code, expiresAt: Date.now() + ttl, site: target.host, locale });
+    },
+    async sendAccountEmail(user, type, target, locale) {
+      if (!webhook.wants(type)) return true;
+      const methods = await users.signInMethods(user.id, await ctx.settings.methods());
+      return sendEmail(user, type, { link: target.href, site: target.host, locale, methods });
+    },
+    async consume(data, purpose) {
+      if (typeof data.token === "string" && data.token) {
+        return { userId: await users.consumeLinkToken(data.token, purpose), via: "link" };
+      }
+      if (isValidEmail(data.email) && typeof data.code === "string") {
+        const user = await users.findByEmail(normalizeEmail(data.email));
+        if (!user) return { userId: null, via: "code" };
+        return { ...await users.consumeCode(user, purpose, data.code.replace(/\s/g, "")), via: "code" };
+      }
+      return { userId: null, via: "code" };
+    },
+    invalidVerification(c, { via, locked }) {
+      if (locked) {
+        return error(c, 429, "codes_locked", "Too many wrong codes. Please ask for a new e-mail and use the link in it.");
+      }
+      return via === "link" ? error(c, 400, "link_invalid", "The link is invalid, expired or was already used.") : error(c, 400, "code_invalid", "The code is wrong or expired.");
+    }
+  };
+}
+
+// src/routes/email.ts
+function emailRoutes(app, ctx, users, webhook) {
+  const emails = createEmails(ctx, users, webhook);
+  const signUpMethod = async (userId) => await users.passwordAccount(userId) ? "password" : "totp";
+  app.post("/auth/email/send-verification", async (c) => {
+    const data = await body(c);
+    const target = redirectTarget(ctx, c, data.redirectTo);
+    if (target instanceof Response) return target;
+    if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    if (user && !user.emailVerified && await ctx.enabled(c, await signUpMethod(user.id))) {
+      if (!await emails.sendLinkEmail(user, "verify", target, localeOf(data.locale))) return unavailable(c);
+    }
+    return accepted(c);
+  });
+  const disabled = (c) => error(c, 403, "method_disabled", "This way of signing in is switched off.");
+  app.post("/auth/email/verify", async (c) => {
+    const data = await body(c);
+    const waiting = typeof data.token === "string" && data.token ? await users.peekLinkToken(data.token, "verify") : isValidEmail(data.email) ? (await users.findByEmail(normalizeEmail(data.email)))?.id ?? null : null;
+    if (waiting && !await ctx.enabled(c, await signUpMethod(waiting))) return disabled(c);
+    const consumed = await emails.consume(data, "verify");
+    const { userId, via } = consumed;
+    const user = userId ? await users.findById(userId) : null;
+    if (!user) return emails.invalidVerification(c, consumed);
+    const method = await signUpMethod(user.id);
+    if (!await ctx.enabled(c, method)) return disabled(c);
+    if (!user.emailVerified) await users.dropUnprovenAccounts(user.id, method === "password" ? "password" : void 0);
+    await users.updateUser(user.id, { emailVerified: true, wrongCodes: 0 });
+    const verified = { ...user.emailVerified ? user : await users.reopenSignUp(user), emailVerified: true, wrongCodes: 0 };
+    await ctx.emit("user.email_verified", { user: toMadauthUser(verified), method, via });
+    return signInAnswer(c, await ctx.secondStep(c, verified, method === "password" ? ["pwd"] : [], method));
+  });
+}
+
+// src/routes/email-link.ts
+function emailLinkRoutes(app, ctx, users, webhook) {
+  const emails = createEmails(ctx, users, webhook);
+  app.use("/auth/email-link/*", async (c, next) => {
+    if (!await ctx.enabled(c, "email-link")) {
+      return error(c, 403, "method_disabled", "Signing in with an e-mail link is switched off.");
+    }
+    await next();
+  });
+  app.post("/auth/email-link/send", async (c) => {
+    const data = await body(c);
+    const target = redirectTarget(ctx, c, data.redirectTo);
+    if (target instanceof Response) return target;
+    if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
+    const email = data.email.trim();
+    const locale = localeOf(data.locale);
+    const send = async (user2) => await emails.sendLinkEmail(user2, "signin", target, locale) ? accepted(c) : unavailable(c);
+    const existing = await users.findByEmail(normalizeEmail(email));
+    if (existing && await users.emailLinkAccount(existing.id)) return send(existing);
+    if (existing?.emailVerified && await users.hasSignInMethod(existing.id)) {
+      return await emails.sendAccountEmail(existing, "email.send_already_registered", target, locale) ? accepted(c) : unavailable(c);
+    }
+    const check = await ctx.checkSignup({ email, locale, method: "email-link" });
+    if (!check.ok) return check.reason === "rejected" ? error(c, 403, "signup_rejected", check.message) : unavailable(c);
+    if (existing) {
+      if (Date.now() - existing.lastMailAt < MAIL_INTERVAL_MS) return accepted(c);
+      if (!existing.emailVerified) await users.dropUnprovenAccounts(existing.id, "email-link");
+      if (!await users.linkAccount(existing.id, { key: emailLinkAccountKey(existing.id) })) return accepted(c);
+      return send(await users.reopenSignUp(existing));
+    }
+    const user = await users.createUser({
+      email,
+      emailNormalized: normalizeEmail(email),
+      name: null,
+      emailVerified: false,
+      account: (userId) => ({ key: emailLinkAccountKey(userId) })
+    });
+    if (!user) return accepted(c);
+    return send(user);
+  });
+  app.post("/auth/email-link/verify", async (c) => {
+    const consumed = await emails.consume(await body(c), "signin");
+    const found = consumed.userId ? await users.findById(consumed.userId) : null;
+    if (!found || !await users.emailLinkAccount(found.id)) return emails.invalidVerification(c, consumed);
+    const user = found.emailVerified ? found : await users.reopenSignUp(found);
+    if (!user.emailVerified) {
+      await users.verifyByProvider(user, "email-link");
+      await ctx.emit("user.email_verified", { user: toMadauthUser({ ...user, emailVerified: true }), method: "email-link", via: consumed.via });
+    } else {
+      await users.updateUser(user.id, { wrongCodes: 0 });
+    }
+    const verified = { ...user, emailVerified: true, wrongCodes: 0 };
+    return signInAnswer(c, await ctx.secondStep(c, verified, ["email"], "email-link"));
+  });
+}
+
+// src/crypto.ts
+import { createCipheriv, createDecipheriv, hkdfSync, randomBytes } from "crypto";
+var ENCRYPTION_VERSION = "v1";
+var IV_BYTES = 12;
+var TAG_BYTES = 16;
+function deriveKey(signingKeyD, info) {
+  return Buffer.from(hkdfSync("sha256", Buffer.from(signingKeyD, "base64url"), "", info, 32));
+}
+function encrypt(key, secret) {
+  const iv = randomBytes(IV_BYTES);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(secret), cipher.final()]);
+  const parts = [iv, encrypted, cipher.getAuthTag()].map((part) => part.toString("base64url"));
+  return [ENCRYPTION_VERSION, ...parts].join(".");
+}
+function decrypt(key, stored) {
+  const [version, iv, encrypted, tag, ...rest] = stored.split(".");
+  if (version !== ENCRYPTION_VERSION || !iv || !encrypted || !tag || rest.length) return null;
+  const ivBytes = Buffer.from(iv, "base64url");
+  const tagBytes = Buffer.from(tag, "base64url");
+  if (ivBytes.length !== IV_BYTES || tagBytes.length !== TAG_BYTES) return null;
+  try {
+    const decipher = createDecipheriv("aes-256-gcm", key, ivBytes);
+    decipher.setAuthTag(tagBytes);
+    return Buffer.concat([decipher.update(Buffer.from(encrypted, "base64url")), decipher.final()]);
+  } catch {
+    return null;
+  }
+}
+
+// src/github.ts
+var TOKEN_ENDPOINT = "https://github.com/login/oauth/access_token";
+var API = "https://api.github.com";
+var API_VERSION = "2022-11-28";
+var USER_AGENT = "madauth";
+var NOREPLY_DOMAIN = "@users.noreply.github.com";
+var TIMEOUT_MS = 1e4;
+var REVOKE_TIMEOUT_MS = 5e3;
+function deriveTokenKey(signingKeyD) {
+  return deriveKey(signingKeyD, "madauth provider token");
+}
+var apiHeaders = (token) => ({
+  Authorization: `Bearer ${token}`,
+  Accept: "application/vnd.github+json",
+  "X-GitHub-Api-Version": API_VERSION,
+  "User-Agent": USER_AGENT
+});
+async function exchangeGitHubCode(app, code, redirectUri, verifier) {
+  try {
+    const res = await fetch(TOKEN_ENDPOINT, {
+      method: "POST",
+      headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded", "User-Agent": USER_AGENT },
+      body: new URLSearchParams({
+        client_id: app.clientId,
+        client_secret: app.clientSecret,
+        code,
+        redirect_uri: redirectUri,
+        code_verifier: verifier
+      }),
+      signal: AbortSignal.timeout(TIMEOUT_MS)
+    });
+    if (!res.ok) {
+      await res.body?.cancel();
+      return null;
+    }
+    const body2 = await res.json();
+    return typeof body2.access_token === "string" && body2.access_token ? body2.access_token : null;
+  } catch {
+    return null;
+  }
+}
+async function fetchGitHubAccount(token) {
+  const failed = (reason) => ({ ok: false, error: "verification_failed", reason });
+  let user;
+  let emails;
+  try {
+    const [userRes, emailsRes] = await Promise.all([
+      fetch(`${API}/user`, { headers: apiHeaders(token), signal: AbortSignal.timeout(TIMEOUT_MS) }),
+      fetch(`${API}/user/emails`, { headers: apiHeaders(token), signal: AbortSignal.timeout(TIMEOUT_MS) })
+    ]);
+    if (!userRes.ok || !emailsRes.ok) {
+      await Promise.all([userRes.body?.cancel(), emailsRes.body?.cancel()]);
+      return failed(!userRes.ok ? `GET /user answered ${userRes.status}` : `GET /user/emails answered ${emailsRes.status}`);
+    }
+    user = await userRes.json();
+    emails = await emailsRes.json();
+  } catch (e) {
+    return failed(e.message);
+  }
+  const id = typeof user.id === "number" ? String(user.id) : typeof user.id === "string" ? user.id : "";
+  if (!id || typeof user.login !== "string") return failed("GET /user did not return an account");
+  if (!Array.isArray(emails)) return failed("GET /user/emails did not return a list");
+  const verified = emails.filter((e) => typeof e.email === "string" && e.email && e.verified === true && !e.email.endsWith(NOREPLY_DOMAIN));
+  const address = verified.find((e) => e.primary === true) ?? verified[0];
+  if (!address) return { ok: false, error: "email_unverified", reason: "the GitHub account has no verified e-mail address" };
+  const account = {
+    id,
+    email: address.email,
+    name: typeof user.name === "string" && user.name.trim() ? user.name.trim() : user.login
+  };
+  if (typeof user.avatar_url === "string" && user.avatar_url) account.picture = user.avatar_url;
+  return { ok: true, account };
+}
+async function revokeGitHubGrant(app, token) {
+  try {
+    const res = await fetch(`${API}/applications/${encodeURIComponent(app.clientId)}/grant`, {
+      method: "DELETE",
+      headers: {
+        Authorization: `Basic ${Buffer.from(`${app.clientId}:${app.clientSecret}`).toString("base64")}`,
+        Accept: "application/vnd.github+json",
+        "Content-Type": "application/json",
+        "X-GitHub-Api-Version": API_VERSION,
+        "User-Agent": USER_AGENT
+      },
+      body: JSON.stringify({ access_token: token }),
+      signal: AbortSignal.timeout(REVOKE_TIMEOUT_MS)
+    });
+    await res.body?.cancel();
+    return res.status;
+  } catch {
+    return null;
+  }
+}
+
+// src/routes/github.ts
+var GITHUB_AUTH_ENDPOINT = "https://github.com/login/oauth/authorize";
+var COOKIE_PATH = "/auth/github";
+var GITHUB = { method: "github", name: "GitHub" };
+function githubRoutes(app, ctx, github, tokenKey) {
+  const callbackUrl = `${ctx.config.issuer}/auth/github/callback`;
+  app.get("/auth/github/start", async (c) => {
+    const returnUrl = ctx.allowedUrl(c.req.query("return_to"));
+    if (!returnUrl) return c.text("return_to must be an absolute URL whose origin is in ALLOWED_ORIGINS", 400);
+    if (!await ctx.enabled(c, "github")) return redirectBack(c, returnUrl.href, "github")("method_disabled");
+    const oauth = await startOAuth(c, ctx, COOKIE_PATH, returnUrl);
+    const url = new URL(GITHUB_AUTH_ENDPOINT);
+    url.search = new URLSearchParams({
+      client_id: github.clientId,
+      redirect_uri: callbackUrl,
+      // Only the addresses: the profile's id, name and picture come with any token.
+      scope: "user:email",
+      state: oauth.state,
+      code_challenge: await pkceChallenge(oauth.verifier),
+      code_challenge_method: "S256"
+    }).toString();
+    return c.redirect(url.href, 302);
+  });
+  app.get("/auth/github/callback", async (c) => {
+    const oauth = await takeOAuthState(c, ctx, COOKIE_PATH);
+    if (!oauth) return c.text("Sign-in expired or was started in another browser. Please try again.", 400);
+    const back = redirectBack(c, oauth.returnTo, "github");
+    if (!await ctx.enabled(c, "github")) return back("method_disabled");
+    if (c.req.query("error")) return back(c.req.query("error") === "access_denied" ? "cancelled" : "verification_failed");
+    const code = c.req.query("code");
+    if (!code || c.req.query("state") !== oauth.state) return back("verification_failed");
+    const token = await exchangeGitHubCode(github, code, callbackUrl, oauth.verifier);
+    if (!token) return back("verification_failed");
+    const result = await fetchGitHubAccount(token);
+    if (!result.ok) return back(result.error);
+    const { account } = result;
+    const resolved = await resolveProviderUser(
+      ctx,
+      GITHUB,
+      { key: githubAccountKey(account.id), email: account.email, name: account.name, secret: encrypt(tokenKey, Buffer.from(token)) },
+      oauth.locale
+    );
+    if (!resolved.ok) return back(resolved.error);
+    const step = await ctx.secondStep(c, resolved.user, ["github"], "github", { name: account.name, picture: account.picture });
+    if ("disabled" in step) return back("method_disabled");
+    if ("next" in step) return back(void 0, step.next, step.factors);
+    return back();
+  });
+}
+async function revokeGrant(github, tokenKey, account) {
+  if (!account) return;
+  const token = account.secret ? decrypt(tokenKey, account.secret) : null;
+  if (!token) {
+    console.error(`[madauth] The GitHub token of user ${account.userId} can't be read (was MADAUTH_SIGNING_KEY changed?): the authorization stays at GitHub until the user removes it.`);
+    return;
+  }
+  const status = await revokeGitHubGrant(github, token.toString());
+  if (status !== 204 && status !== 404) {
+    console.error(`[madauth] GitHub did not revoke the authorization of user ${account.userId}${status ? ` (HTTP ${status})` : ""}: it stays until the user removes it.`);
+  }
+}
+
+// src/routes/google.ts
+import { deleteCookie as deleteCookie2, getCookie as getCookie2, setCookie as setCookie2 } from "hono/cookie";
+
+// src/google.ts
+import { createRemoteJWKSet, jwtVerify } from "jose";
+var GOOGLE_ISSUERS = ["https://accounts.google.com", "accounts.google.com"];
+var googleJwks;
+function googleKeys() {
+  googleJwks ??= createRemoteJWKSet(new URL("https://www.googleapis.com/oauth2/v3/certs"));
+  return googleJwks;
+}
+async function verifyGoogleIdToken(idToken, opts) {
+  let payload;
+  try {
+    ({ payload } = await jwtVerify(idToken, opts.keys ?? googleKeys(), {
+      issuer: GOOGLE_ISSUERS,
+      audience: opts.clientId,
+      algorithms: ["RS256", "ES256"]
+    }));
+  } catch (e) {
+    return { ok: false, error: "verification_failed", reason: e.message };
+  }
+  if (typeof payload.sub !== "string" || !payload.sub) {
+    return { ok: false, error: "verification_failed", reason: "missing sub" };
+  }
+  if (payload.nonce !== opts.nonce) {
+    return { ok: false, error: "verification_failed", reason: "nonce mismatch" };
+  }
+  if (typeof payload.email !== "string" || !payload.email || payload.email_verified !== true) {
+    return { ok: false, error: "email_unverified", reason: "e-mail address not verified" };
+  }
+  const profile = { sub: payload.sub, email: payload.email };
+  if (typeof payload.name === "string") profile.name = payload.name;
+  if (typeof payload.picture === "string") profile.picture = payload.picture;
+  return { ok: true, profile };
+}
+
+// src/routes/google.ts
+var NONCE_COOKIE = "madauth_nonce";
+var NONCE_TYP = "madauth-nonce+jwt";
+var NONCE_TTL = 5 * 60;
+var COOKIE_PATH2 = "/auth/google";
+var GOOGLE_AUTH_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
+var GOOGLE_TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
+var GOOGLE = { method: "google", name: "Google" };
+var toProfile = (profile) => ({ key: googleAccountKey(profile.sub), email: profile.email, name: profile.name });
+function googleRoutes(app, ctx, google) {
+  const { config, keys, secure } = ctx;
+  const { issuer } = config;
+  const callbackUrl = `${issuer}/auth/google/callback`;
+  const disabled = (c) => c.json({ error: "method_disabled", message: "Google sign-in is switched off." }, 403);
+  app.post("/auth/google/nonce", async (c) => {
+    if (!await ctx.enabled(c, "google")) return disabled(c);
+    const nonce = randomString();
+    const token = await signToken(await keys, issuer, NONCE_TYP, { nonce }, NONCE_TTL);
+    setCookie2(c, NONCE_COOKIE, token, {
+      path: COOKIE_PATH2,
+      httpOnly: true,
+      secure,
+      sameSite: "Strict",
+      maxAge: NONCE_TTL
+    });
+    return c.json({ nonce });
+  });
+  app.post("/auth/google/verify", async (c) => {
+    if (!await ctx.enabled(c, "google")) return disabled(c);
+    const body2 = await c.req.json().catch(() => ({}));
+    if (typeof body2.credential !== "string" || !body2.credential) {
+      return c.json({ error: "verification_failed", message: "credential is missing" }, 400);
+    }
+    const nonceClaims = await readToken(await keys, issuer, NONCE_TYP, getCookie2(c, NONCE_COOKIE));
+    if (!nonceClaims) {
+      return c.json({ error: "verification_failed", message: "nonce cookie missing or expired" }, 401);
+    }
+    const result = await verifyGoogleIdToken(body2.credential, {
+      clientId: google.clientId,
+      nonce: nonceClaims.nonce,
+      keys: config.jwksResolver
+    });
+    if (!result.ok) {
+      return c.json({ error: result.error, message: result.reason }, result.error === "email_unverified" ? 403 : 401);
+    }
+    deleteCookie2(c, NONCE_COOKIE, { path: COOKIE_PATH2, secure });
+    const resolved = await resolveProviderUser(ctx, GOOGLE, toProfile(result.profile), localeOf(body2.locale));
+    if (!resolved.ok) {
+      if (resolved.error === "other_method") return c.json({ error: resolved.error, message: resolved.message, methods: resolved.methods }, 403);
+      return c.json({ error: resolved.error, message: resolved.message }, resolved.error === "signup_rejected" ? 403 : 503);
+    }
+    return signInAnswer(c, await ctx.secondStep(c, resolved.user, ["google"], "google", result.profile));
+  });
+  const requireCodeFlow = async (c, next) => {
+    if (!google.clientSecret) return c.json({ error: "not_found" }, 404);
+    await next();
+  };
+  app.get("/auth/google/start", requireCodeFlow, async (c) => {
+    const returnUrl = ctx.allowedUrl(c.req.query("return_to"));
+    if (!returnUrl) return c.text("return_to must be an absolute URL whose origin is in ALLOWED_ORIGINS", 400);
+    if (!await ctx.enabled(c, "google")) return redirectBack(c, returnUrl.href, "google")("method_disabled");
+    const oauth = await startOAuth(c, ctx, COOKIE_PATH2, returnUrl);
+    const url = new URL(GOOGLE_AUTH_ENDPOINT);
+    url.search = new URLSearchParams({
+      client_id: google.clientId,
+      redirect_uri: callbackUrl,
+      response_type: "code",
+      scope: "openid email profile",
+      state: oauth.state,
+      nonce: oauth.nonce,
+      code_challenge: await pkceChallenge(oauth.verifier),
+      code_challenge_method: "S256"
+    }).toString();
+    return c.redirect(url.href, 302);
+  });
+  app.get("/auth/google/callback", requireCodeFlow, async (c) => {
+    const oauth = await takeOAuthState(c, ctx, COOKIE_PATH2);
+    if (!oauth) return c.text("Sign-in expired or was started in another browser. Please try again.", 400);
+    const back = redirectBack(c, oauth.returnTo, "google");
+    if (!await ctx.enabled(c, "google")) return back("method_disabled");
+    if (c.req.query("error")) return back(c.req.query("error") === "access_denied" ? "cancelled" : "verification_failed");
+    const code = c.req.query("code");
+    if (!code || c.req.query("state") !== oauth.state) return back("verification_failed");
+    let idToken;
+    try {
+      const res = await fetch(GOOGLE_TOKEN_ENDPOINT, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          code,
+          client_id: google.clientId,
+          client_secret: google.clientSecret,
+          redirect_uri: callbackUrl,
+          grant_type: "authorization_code",
+          code_verifier: oauth.verifier
+        })
+      });
+      if (!res.ok) return back("verification_failed");
+      ({ id_token: idToken } = await res.json());
+    } catch {
+      return back("verification_failed");
+    }
+    if (typeof idToken !== "string") return back("verification_failed");
+    const result = await verifyGoogleIdToken(idToken, {
+      clientId: google.clientId,
+      nonce: oauth.nonce,
+      keys: config.jwksResolver
+    });
+    if (!result.ok) return back(result.error);
+    const resolved = await resolveProviderUser(ctx, GOOGLE, toProfile(result.profile), oauth.locale);
+    if (!resolved.ok) return back(resolved.error);
+    const step = await ctx.secondStep(c, resolved.user, ["google"], "google", result.profile);
+    if ("disabled" in step) return back("method_disabled");
+    if ("next" in step) return back(void 0, step.next, step.factors);
+    return back();
+  });
+}
+
+// src/routes/lockout.ts
+var FREE_ATTEMPTS = 5;
+var MAX_LOCK_MS = 15 * 60 * 1e3;
+async function countSignInAttempt(c, users, account, now = Date.now()) {
+  const tooMany = (message) => c.json({ error: "too_many_attempts", message }, 429);
+  if (account.lockedUntil > now) {
+    const seconds = Math.ceil((account.lockedUntil - now) / 1e3);
+    return tooMany(`Too many failed attempts. Try again in ${seconds} seconds.`);
+  }
+  const failed = account.failedAttempts + 1;
+  const lockedUntil = failed >= FREE_ATTEMPTS ? now + Math.min(2 ** (failed - FREE_ATTEMPTS) * 1e3, MAX_LOCK_MS) : 0;
+  if (!await users.countAttempt(account, { failedAttempts: failed, lockedUntil })) {
+    return tooMany("Too many attempts at once. Please try again.");
+  }
+  return null;
+}
+
+// src/routes/password.ts
+function weakPassword(c, problem) {
+  const { message, ...details } = problem;
+  return c.json({ error: "weak_password", message, ...details }, 400);
+}
+function passwordRoutes(app, ctx, users, webhook) {
+  const refused = async (c, password, userInputs) => {
+    const words = userInputs.filter((word) => !!word);
+    const problem = await checkPasswordPolicy(password, await ctx.settings.passwordRules(), words);
+    return problem ? weakPassword(c, problem) : null;
+  };
+  const emails = createEmails(ctx, users, webhook);
+  app.use("/auth/password/*", async (c, next) => {
+    if (!await ctx.enabled(c, "password")) return error(c, 403, "method_disabled", "E-mail & password sign-in is switched off.");
+    await next();
+  });
+  app.post("/auth/password/signin", async (c) => {
+    const data = await body(c);
+    const wrong = () => error(c, 401, "invalid_credentials", "E-mail or password is wrong.");
+    const pw = typeof data.password === "string" ? data.password : "";
+    if (!isValidEmail(data.email) || !pw || pw.length > MAX_PASSWORD_LENGTH * 4) return wrong();
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    const account = user ? await users.passwordAccount(user.id) : null;
+    if (!user || !account?.secret) {
+      await verifyAgainstDummy(pw);
+      return wrong();
+    }
+    const refused2 = await countSignInAttempt(c, users, account);
+    if (refused2) return refused2;
+    const { ok, needsRehash } = await verifyPassword(pw, account.secret);
+    if (!ok) return wrong();
+    await users.updateAccount(account.id, {
+      failedAttempts: 0,
+      lockedUntil: 0,
+      ...needsRehash ? { secret: await hashPassword(pw) } : {}
+    });
+    if (!user.emailVerified) {
+      return error(c, 403, "email_unverified", "Please confirm your e-mail address first. We can send the e-mail again.");
+    }
+    return signInAnswer(c, await ctx.secondStep(c, user, ["pwd"], "password"));
+  });
+  app.post("/auth/password/signup", async (c) => {
+    const data = await body(c);
+    const target = redirectTarget(ctx, c, data.redirectTo);
+    if (target instanceof Response) return target;
+    if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
+    const name = nameOf(data.name);
+    const email = data.email.trim();
+    const weak = await refused(c, data.password, [email, name]);
+    if (weak) return weak;
+    const locale = localeOf(data.locale);
+    const check = await ctx.checkSignup({ email, name: name ?? void 0, locale, method: "password" });
+    if (!check.ok) return check.reason === "rejected" ? error(c, 403, "signup_rejected", check.message) : unavailable(c);
+    const passwordHash = await hashPassword(data.password);
+    const existing = await users.findByEmail(normalizeEmail(email));
+    if (existing?.emailVerified && await users.hasSignInMethod(existing.id)) {
+      return await emails.sendAccountEmail(existing, "email.send_already_registered", target, locale) ? accepted(c) : unavailable(c);
+    }
+    if (existing) {
+      if (Date.now() - existing.lastMailAt < MAIL_INTERVAL_MS) return accepted(c);
+      if (!existing.emailVerified) await users.dropUnprovenAccounts(existing.id, "password");
+      const account = await users.passwordAccount(existing.id);
+      if (account) await users.updateAccount(account.id, { secret: passwordHash, failedAttempts: 0, lockedUntil: 0 });
+      else if (!await users.linkAccount(existing.id, { key: passwordAccountKey(existing.id), secret: passwordHash })) return accepted(c);
+      await users.reopenSignUp(existing);
+      await users.updateUser(existing.id, { name });
+      return await emails.sendLinkEmail({ ...existing, name }, "verify", target, locale) ? accepted(c) : unavailable(c);
+    }
+    const user = await users.createUser({
+      email,
+      emailNormalized: normalizeEmail(email),
+      name,
+      emailVerified: false,
+      account: (userId) => ({ key: passwordAccountKey(userId), secret: passwordHash })
+    });
+    if (!user) return accepted(c);
+    return await emails.sendLinkEmail(user, "verify", target, locale) ? accepted(c) : unavailable(c);
+  });
+  app.post("/auth/password/send-reset", async (c) => {
+    const data = await body(c);
+    const target = redirectTarget(ctx, c, data.redirectTo);
+    if (target instanceof Response) return target;
+    if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    const locale = localeOf(data.locale);
+    if (user && await users.passwordAccount(user.id)) {
+      if (!await emails.sendLinkEmail(user, "reset", target, locale)) return unavailable(c);
+    } else if (user) {
+      if (!await emails.sendAccountEmail(user, "email.send_password_reset_no_password", target, locale)) return unavailable(c);
+    }
+    return accepted(c);
+  });
+  app.post("/auth/password/reset", async (c) => {
+    const data = await body(c);
+    const weak = await refused(c, data.password, [isValidEmail(data.email) ? data.email.trim() : null]);
+    if (weak) return weak;
+    const consumed = await emails.consume(data, "reset");
+    const user = consumed.userId ? await users.findById(consumed.userId) : null;
+    const account = user ? await users.passwordAccount(user.id) : null;
+    if (!user || !account) return emails.invalidVerification(c, consumed);
+    const secret = await hashPassword(data.password);
+    if (!await users.updateAccount(account.id, { secret, failedAttempts: 0, lockedUntil: 0 })) return emails.invalidVerification(c, consumed);
+    const sessionVersion = user.sessionVersion + 1;
+    await users.updateUser(user.id, { emailVerified: true, sessionVersion, wrongCodes: 0 });
+    await users.clearVerifications(user.id);
+    const reset = { ...user.emailVerified ? user : await users.reopenSignUp(user), emailVerified: true, sessionVersion, wrongCodes: 0 };
+    await ctx.emit("user.password_reset", { user: toMadauthUser(reset) });
+    return signInAnswer(c, await ctx.secondStep(c, reset, ["pwd"], "password"));
+  });
+}
+
+// src/routes/challenge.ts
+import { deleteCookie as deleteCookie3, getCookie as getCookie3, setCookie as setCookie3 } from "hono/cookie";
+var CHALLENGE_COOKIE = "madauth_challenge";
+var CHALLENGE_TYP = "madauth-challenge+jwt";
+var CHALLENGE_TTL = 10 * 60;
+var COOKIE_PATH3 = "/auth";
+var LEGACY_COOKIE_PATH = "/auth/totp";
+var cookieOptions = (secure) => ({ path: COOKIE_PATH3, httpOnly: true, secure, sameSite: "Strict" });
+async function setChallenge(c, ctx, challenge) {
+  const token = await signToken(await ctx.keys, ctx.config.issuer, CHALLENGE_TYP, { ...challenge }, CHALLENGE_TTL);
+  setCookie3(c, CHALLENGE_COOKIE, token, { ...cookieOptions(ctx.secure), maxAge: CHALLENGE_TTL });
+}
+function clearChallenge(c, secure) {
+  deleteCookie3(c, CHALLENGE_COOKIE, cookieOptions(secure));
+  deleteCookie3(c, CHALLENGE_COOKIE, { ...cookieOptions(secure), path: LEGACY_COOKIE_PATH });
+}
+async function readChallenge(c, ctx, step) {
+  const claims = await readToken(await ctx.keys, ctx.config.issuer, CHALLENGE_TYP, getCookie3(c, CHALLENGE_COOKIE));
+  if (!claims || typeof claims.sub !== "string" || !Array.isArray(claims.amr)) return null;
+  const factors = Array.isArray(claims.factors) ? claims.factors : [];
+  const fits = step === "totp-setup" ? claims.next === "totp-setup" : factors.includes(step);
+  return fits ? claims : null;
+}
+var methodStillOn = async (c, ctx, challenge) => isOn(challenge.method, ctx.configured, await ctx.methods(c));
+var methodOff = (c) => error(c, 403, "method_disabled", "This way of signing in is switched off.");
+async function pendingOrSignedIn(c, ctx) {
+  const challenge = await readChallenge(c, ctx, "totp-setup");
+  const waiting = challenge ? await ctx.users.findById(challenge.sub) : null;
+  if (challenge && waiting && waiting.sessionVersion === challenge.sv) return { user: waiting, challenge };
+  const session = await ctx.currentUser(c);
+  const user = session ? await ctx.users.findById(session.id) : null;
+  return user ? { user, challenge: null } : null;
+}
+async function finishSignIn(c, ctx, user, challenge, amr, via) {
+  const result = await ctx.startSession(c, toMadauthUser(user, challenge.profile), [...challenge.amr, amr], { method: challenge.method, signedUpAt: user.signedUpAt }, { sv: user.sessionVersion });
+  await ctx.emit("user.signed_in", { user: result, method: challenge.method, ...challenge.amr.length ? { secondFactor: via } : {} });
+  return result;
+}
+
+// src/routes/sms.ts
+import { deleteCookie as deleteCookie4, getCookie as getCookie4, setCookie as setCookie4 } from "hono/cookie";
+var SMS_TTL_MS = 10 * 60 * 1e3;
+var SETUP_COOKIE = "madauth_sms_setup";
+var SETUP_TYP = "madauth-sms-setup+jwt";
+var SETUP_TTL = 10 * 60;
+var ROUTE_PATH = "/auth/sms";
+function normalizePhone(value) {
+  if (typeof value !== "string") return null;
+  const digits = value.replace(/[\s().-]/g, "");
+  return /^\+[1-9]\d{6,14}$/.test(digits) ? digits : null;
+}
+function maskPhone(phone) {
+  return `${phone.slice(0, 3)} ${"\u2022".repeat(Math.max(0, phone.length - 5))} ${phone.slice(-2)}`;
+}
+function smsRoutes(app, ctx, users, webhook) {
+  const { config, secure } = ctx;
+  const cookie = { path: ROUTE_PATH, httpOnly: true, secure, sameSite: "Strict" };
+  app.use(`${ROUTE_PATH}/*`, async (c, next) => {
+    if (!isOn("sms", ctx.configured, await ctx.methods(c))) return error(c, 403, "method_disabled", "SMS codes are switched off.");
+    await next();
+  });
+  const expired = (c) => error(c, 401, "challenge_expired", "The sign-in has expired. Please sign in again.");
+  const tooSoon = (c) => error(c, 429, "too_soon", "A code was sent to your phone less than a minute ago: enter that one, or wait a minute for a new one.");
+  const sendCode = async (c, user, phone, purpose, locale) => {
+    const { code } = await users.issueVerification(user.id, "sms", SMS_TTL_MS);
+    const data = { to: phone, code, purpose, expiresAt: Date.now() + SMS_TTL_MS, site: originHost(ctx, c), locale, user: { id: user.id, name: user.name ?? void 0 } };
+    const result = await webhook.call("sms.send_code", data, WEBHOOK_TIMEOUT_MS);
+    if (!result.ok) {
+      console.error(`[madauth] Webhook "sms.send_code" for user ${user.id} failed: ${result.reason}`);
+      return false;
+    }
+    await users.updateUser(user.id, { lastSmsAt: Date.now() });
+    return true;
+  };
+  const sentRecently = (user) => Date.now() - (user.lastSmsAt ?? 0) < MAIL_INTERVAL_MS;
+  const checkCode2 = async (c, user, account, data) => {
+    if (account) {
+      const refused = await countSignInAttempt(c, users, account);
+      if (refused) return refused;
+    }
+    const code = typeof data.code === "string" ? data.code.replace(/\s/g, "") : "";
+    const { userId } = code ? await users.consumeCode(user, "sms", code) : { userId: null };
+    if (!userId) return error(c, 401, "code_invalid", "The code is wrong or has expired.");
+    if (account) await users.updateAccount(account.id, { failedAttempts: 0, lockedUntil: 0 });
+    return null;
+  };
+  const whoSetsUp = async (c) => {
+    const who = await pendingOrSignedIn(c, ctx);
+    if (!who || who.challenge && !who.challenge.amr.length) return { answer: noSession(c) };
+    if (who.challenge && !await methodStillOn(c, ctx, who.challenge)) return { answer: methodOff(c) };
+    return who;
+  };
+  app.post(`${ROUTE_PATH}/setup`, async (c) => {
+    const who = await whoSetsUp(c);
+    if ("answer" in who) return who.answer;
+    const { user } = who;
+    const data = await body(c);
+    const phone = normalizePhone(data.phone);
+    if (!phone) return error(c, 400, "invalid_phone", "Enter a mobile number with the country code, e.g. +41 79 123 45 67.");
+    const existing = await users.smsAccount(user.id);
+    let approved;
+    let justApproved = false;
+    if (existing) {
+      const previous = await readToken(await ctx.keys, config.issuer, SETUP_TYP, getCookie4(c, SETUP_COOKIE));
+      const holds = previous?.sub === user.id && typeof previous.approved === "number" && Date.now() - previous.approved < SETUP_TTL * 1e3;
+      if (holds) {
+        approved = previous.approved;
+      } else {
+        if (data.code === void 0) return error(c, 401, "code_required", "Enter the code we sent to your current number to replace it.");
+        const wrong = await checkCode2(c, user, existing, data);
+        if (wrong) return wrong;
+        approved = Date.now();
+        justApproved = true;
+      }
+    }
+    if (!justApproved && sentRecently(user)) return tooSoon(c);
+    if (!await sendCode(c, user, phone, "setup", localeOf(data.locale))) return smsUnavailable(c);
+    const token = await signToken(await ctx.keys, config.issuer, SETUP_TYP, { sub: user.id, phone, ...approved ? { approved } : {} }, SETUP_TTL);
+    setCookie4(c, SETUP_COOKIE, token, { ...cookie, maxAge: SETUP_TTL });
+    return c.json({ phone: maskPhone(phone) }, 202);
+  });
+  app.post(`${ROUTE_PATH}/confirm`, async (c) => {
+    const who = await whoSetsUp(c);
+    if ("answer" in who) return who.answer;
+    const { user, challenge } = who;
+    const setup = await readToken(await ctx.keys, config.issuer, SETUP_TYP, getCookie4(c, SETUP_COOKIE));
+    if (!setup || setup.sub !== user.id || typeof setup.phone !== "string") {
+      return error(c, 400, "setup_expired", "The setup has expired or was started in another browser. Please start again.");
+    }
+    const existing = await users.smsAccount(user.id);
+    if (existing && typeof setup.approved !== "number") {
+      deleteCookie4(c, SETUP_COOKIE, cookie);
+      return error(c, 400, "setup_expired", "Your phone number was changed elsewhere meanwhile. Please start again.");
+    }
+    const wrong = await checkCode2(c, user, existing, await body(c));
+    if (wrong) return wrong;
+    const written = existing ? await users.updateAccount(existing.id, { phone: setup.phone, failedAttempts: 0, lockedUntil: 0 }) : !!await users.linkAccount(user.id, { key: smsAccountKey(user.id), phone: setup.phone });
+    deleteCookie4(c, SETUP_COOKIE, cookie);
+    if (!written) return error(c, 400, "setup_expired", "Your phone number was changed elsewhere meanwhile. Please start again.");
+    await ctx.emit("user.second_factor_enabled", { user: toMadauthUser(user), method: "sms", phone: setup.phone });
+    if (!challenge) return c.json({});
+    return c.json({ user: await finishSignIn(c, ctx, user, challenge, "sms", "sms") });
+  });
+  app.post(`${ROUTE_PATH}/send`, async (c) => {
+    const data = await body(c);
+    const challenge = await readChallenge(c, ctx, "sms");
+    let user;
+    if (challenge) {
+      if (!await methodStillOn(c, ctx, challenge)) return methodOff(c);
+      const waiting = await users.findById(challenge.sub);
+      user = waiting && waiting.sessionVersion === challenge.sv ? waiting : null;
+      if (!user) return expired(c);
+    } else {
+      const session = await ctx.currentUser(c);
+      user = session ? await users.findById(session.id) : null;
+      if (!user) return noSession(c);
+    }
+    const account = await users.smsAccount(user.id);
+    if (!account?.phone) return challenge ? expired(c) : error(c, 400, "no_phone", "No phone number is set up.");
+    if (sentRecently(user)) return tooSoon(c);
+    if (!await sendCode(c, user, account.phone, challenge ? "signin" : "approve", localeOf(data.locale))) return smsUnavailable(c);
+    return c.json({ phone: maskPhone(account.phone) }, 202);
+  });
+  app.post(`${ROUTE_PATH}/verify`, async (c) => {
+    const challenge = await readChallenge(c, ctx, "sms");
+    if (!challenge) return expired(c);
+    if (!await methodStillOn(c, ctx, challenge)) return methodOff(c);
+    const user = await users.findById(challenge.sub);
+    const account = user && user.sessionVersion === challenge.sv ? await users.smsAccount(user.id) : null;
+    if (!user || !account) return expired(c);
+    const wrong = await checkCode2(c, user, account, await body(c));
+    if (wrong) return wrong;
+    return c.json({ user: await finishSignIn(c, ctx, user, challenge, "sms", "sms") });
+  });
+  app.post(`${ROUTE_PATH}/remove`, async (c) => {
+    const session = await ctx.currentUser(c);
+    const user = session ? await users.findById(session.id) : null;
+    if (!user) return noSession(c);
+    const account = await users.smsAccount(user.id);
+    if (!account) return error(c, 400, "no_phone", "No phone number is set up.");
+    const methods = await ctx.methods(c);
+    const required = METHODS_WITH_SECOND_FACTOR.some((method) => isOn(method, ctx.configured, methods) && policyOf(method, methods) === "required");
+    if (required && !await users.totpAccount(user.id)) {
+      return error(c, 403, "required_by_policy", "Signing in requires a second factor, so the phone number can't be removed without an authenticator app.");
+    }
+    const wrong = await checkCode2(c, user, account, await body(c));
+    if (wrong) return wrong;
+    await users.removeSms(user.id);
+    await ctx.emit("user.second_factor_disabled", { user: toMadauthUser(user), method: "sms" });
+    return c.json({});
+  });
+  app.get(`${ROUTE_PATH}/status`, async (c) => {
+    const session = await ctx.currentUser(c);
+    if (!session) return noSession(c);
+    const account = await users.smsAccount(session.id);
+    return c.json({ enabled: !!account?.phone, phone: account?.phone ? maskPhone(account.phone) : null });
+  });
+}
+
+// src/routes/totp.ts
+import { deleteCookie as deleteCookie5, getCookie as getCookie5, setCookie as setCookie5 } from "hono/cookie";
+
+// src/totp.ts
+import { createHmac, randomBytes as randomBytes2, randomInt } from "crypto";
+var TOTP_STEP_SECONDS = 30;
+var TOTP_DIGITS = 6;
+var TOTP_WINDOW = 1;
+var RECOVERY_CODES = 10;
+var SECRET_BYTES = 20;
+var BASE32 = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+var RECOVERY_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
+var RECOVERY_CODE_LENGTH = 10;
+function base32Encode(bytes) {
+  let bits = 0;
+  let value = 0;
+  let out = "";
+  for (const byte of bytes) {
+    value = (value << 8 | byte) & 65535;
+    bits += 8;
+    while (bits >= 5) {
+      out += BASE32[value >>> bits - 5 & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) out += BASE32[value << 5 - bits & 31];
+  return out;
+}
+function hotp(secret, counter, digits = TOTP_DIGITS) {
+  const message = Buffer.alloc(8);
+  message.writeBigUInt64BE(BigInt(counter));
+  const digest = createHmac("sha1", secret).update(message).digest();
+  const offset = digest[digest.length - 1] & 15;
+  const binary = (digest[offset] & 127) << 24 | digest[offset + 1] << 16 | digest[offset + 2] << 8 | digest[offset + 3];
+  return (binary % 10 ** digits).toString().padStart(digits, "0");
+}
+function stepOf(nowMs) {
+  return Math.floor(nowMs / 1e3 / TOTP_STEP_SECONDS);
+}
+function totp(secret, step, digits = TOTP_DIGITS) {
+  return hotp(secret, step, digits);
+}
+function verifyTotp(secret, code, nowMs, window = TOTP_WINDOW) {
+  const given = code.replace(/\s/g, "");
+  if (!new RegExp(`^\\d{${TOTP_DIGITS}}$`).test(given)) return null;
+  const now = stepOf(nowMs);
+  let found = null;
+  for (let step = now - window; step <= now + window; step++) {
+    if (safeEqual(totp(secret, step), given) && found === null) found = step;
+  }
+  return found;
+}
+function generateTotpSecret() {
+  return randomBytes2(SECRET_BYTES);
+}
+function otpauthUri(options) {
+  const issuer = encodeURIComponent(options.issuer);
+  const account = encodeURIComponent(options.account);
+  const secret = base32Encode(options.secret);
+  return `otpauth://totp/${issuer}:${account}?secret=${secret}&issuer=${issuer}&algorithm=SHA1&digits=${TOTP_DIGITS}&period=${TOTP_STEP_SECONDS}`;
+}
+function deriveTotpKey(signingKeyD) {
+  return deriveKey(signingKeyD, "madauth totp secret");
+}
+function generateRecoveryCodes() {
+  const codes = /* @__PURE__ */ new Set();
+  while (codes.size < RECOVERY_CODES) {
+    let code = "";
+    for (let i = 0; i < RECOVERY_CODE_LENGTH; i++) code += RECOVERY_ALPHABET[randomInt(RECOVERY_ALPHABET.length)];
+    codes.add(`${code.slice(0, 5)}-${code.slice(5)}`);
+  }
+  return [...codes];
+}
+function normalizeRecoveryCode(text) {
+  if (typeof text !== "string") return null;
+  const code = text.toLowerCase().replace(/[\s-]/g, "");
+  return code.length === RECOVERY_CODE_LENGTH && [...code].every((char) => RECOVERY_ALPHABET.includes(char)) ? code : null;
+}
+function hashRecoveryCode(codeKey, code) {
+  return hashCode(codeKey, `recovery:${code}`);
+}
+
+// src/routes/totp.ts
+var SETUP_COOKIE2 = "madauth_totp_setup";
+var SETUP_TYP2 = "madauth-totp-setup+jwt";
+var SETUP_TTL2 = 10 * 60;
+var COOKIE_PATH4 = "/auth/totp";
+var cookieOptions2 = (secure) => ({ path: COOKIE_PATH4, httpOnly: true, secure, sameSite: "Strict" });
+async function checkCode(c, ctx, keys, user, account, data, wrong = () => error(c, 401, "code_invalid", "The code is wrong or was already used.")) {
+  const { users } = ctx;
+  const refused = await countSignInAttempt(c, users, account);
+  if (refused) return refused;
+  if (typeof data.recoveryCode === "string") {
+    const code = normalizeRecoveryCode(data.recoveryCode);
+    if (!code || !await users.consumeRecoveryCode(account, hashRecoveryCode(keys.codeKey, code))) return wrong();
+    await users.updateAccount(account.id, { failedAttempts: 0, lockedUntil: 0 });
+    const remaining = await users.countRecoveryCodes(account);
+    await ctx.emit("user.recovery_code_used", { user: toMadauthUser(user), remaining });
+    return "recovery_code";
+  }
+  if (typeof data.code !== "string" || !account.secret) return wrong();
+  const secret = decrypt(keys.totpKey, account.secret);
+  if (!secret) {
+    console.error(`[madauth] The authenticator secret of user ${user.id} can't be read: was MADAUTH_SIGNING_KEY changed?`);
+    return wrong();
+  }
+  const step = verifyTotp(secret, data.code, Date.now(), TOTP_WINDOW);
+  if (step === null || step <= (account.lastUsedStep ?? 0) || !await users.useTotpStep(account, step)) return wrong();
+  return "totp";
+}
+function totpRoutes(app, ctx, keys) {
+  const { config, secure, users } = ctx;
+  const { issuer } = config;
+  const cookie = cookieOptions2(secure);
+  const methodsNow = (c) => ctx.methods(c);
+  app.use(`${COOKIE_PATH4}/*`, async (c, next) => {
+    if (!authenticatorOn(ctx.configured, await methodsNow(c))) {
+      return error(c, 403, "method_disabled", "The authenticator app is switched off.");
+    }
+    await next();
+  });
+  const standalone = async (c) => isOn("totp", ctx.configured, await methodsNow(c));
+  const notStandalone = (c) => error(c, 403, "method_disabled", "Signing in with the authenticator app alone is switched off.");
+  const signedIn = async (c) => {
+    const user = await ctx.currentUser(c);
+    return user ? users.findById(user.id) : null;
+  };
+  const whoSetsUp = (c) => pendingOrSignedIn(c, ctx);
+  const newRecoveryCodes = () => {
+    const recoveryCodes = generateRecoveryCodes();
+    return { recoveryCodes, hashes: recoveryCodes.map((code) => hashRecoveryCode(keys.codeKey, normalizeRecoveryCode(code))) };
+  };
+  const issuerLabel = (c) => config.totpIssuer || originHost(ctx, c);
+  app.post(`${COOKIE_PATH4}/setup`, async (c) => {
+    const who = await whoSetsUp(c);
+    if (!who) return noSession(c);
+    if (who.challenge && !await methodStillOn(c, ctx, who.challenge)) return methodOff(c);
+    const existing = await users.totpAccount(who.user.id);
+    let approved;
+    if (existing) {
+      const previous = await readToken(await ctx.keys, issuer, SETUP_TYP2, getCookie5(c, SETUP_COOKIE2));
+      const holds = previous?.sub === who.user.id && typeof previous.approved === "number" && Date.now() - previous.approved < SETUP_TTL2 * 1e3;
+      if (holds) {
+        approved = previous.approved;
+      } else {
+        const data = await body(c);
+        if (data.code === void 0 && data.recoveryCode === void 0) {
+          return error(c, 401, "code_required", "Enter a code from your current authenticator app (or a recovery code) to replace it.");
+        }
+        const via = await checkCode(c, ctx, keys, who.user, existing, data);
+        if (via instanceof Response) return via;
+        approved = Date.now();
+      }
+    }
+    const secret = generateTotpSecret();
+    const claims = {
+      sub: who.user.id,
+      setup: newId("tsu"),
+      secret: encrypt(keys.totpKey, secret),
+      ...existing ? { replaces: existing.setupId } : {},
+      ...approved ? { approved } : {}
+    };
+    const token = await signToken(await ctx.keys, issuer, SETUP_TYP2, claims, SETUP_TTL2);
+    setCookie5(c, SETUP_COOKIE2, token, { ...cookie, maxAge: SETUP_TTL2 });
+    return c.json({ secret: base32Encode(secret), uri: otpauthUri({ issuer: issuerLabel(c), account: who.user.email, secret }) });
+  });
+  app.post(`${COOKIE_PATH4}/confirm`, async (c) => {
+    const who = await whoSetsUp(c);
+    if (!who) return noSession(c);
+    const { user, challenge } = who;
+    if (challenge && !await methodStillOn(c, ctx, challenge)) return methodOff(c);
+    const data = await body(c);
+    const setup = await readToken(await ctx.keys, issuer, SETUP_TYP2, getCookie5(c, SETUP_COOKIE2));
+    const secret = setup && setup.sub === user.id && typeof setup.secret === "string" && typeof setup.setup === "string" ? decrypt(keys.totpKey, setup.secret) : null;
+    if (!setup || !secret) return error(c, 400, "setup_expired", "The setup has expired or was started in another browser. Please start again.");
+    const step = typeof data.code === "string" ? verifyTotp(secret, data.code, Date.now(), TOTP_WINDOW) : null;
+    if (step === null) return error(c, 400, "code_invalid", "The code is wrong. Enter the current code from the app.");
+    const signUp = challenge?.method === "totp";
+    const { recoveryCodes, hashes } = newRecoveryCodes();
+    await users.addRecoveryCodes(user.id, setup.setup, hashes);
+    const patch = { secret: setup.secret, setupId: setup.setup, failedAttempts: 0, lockedUntil: 0, lastUsedStep: step };
+    const replaced = setup.replaces === void 0 ? null : await users.totpApp(user.id);
+    const current = replaced?.account ?? null;
+    const written = setup.replaces === void 0 ? !!await users.linkAccount(user.id, { key: totpAccountKey(user.id), primary: signUp, ...patch }) : !!current && await users.confirmTotpSetup(current.id, setup.replaces, patch);
+    if (!written) {
+      await users.clearRecoveryCodes(user.id, { only: setup.setup });
+      deleteCookie5(c, SETUP_COOKIE2, cookie);
+      return error(c, 400, "setup_expired", "Your authenticator app was set up or removed elsewhere meanwhile. Please start again.");
+    }
+    await users.clearRecoveryCodes(user.id, { except: setup.setup });
+    deleteCookie5(c, SETUP_COOKIE2, cookie);
+    const secondFactor = replaced ? !replaced.signsIn : !signUp;
+    if (secondFactor) await ctx.emit("user.second_factor_enabled", { user: toMadauthUser(user), method: "totp" });
+    if (!challenge) return c.json({ recoveryCodes });
+    const result = await finishSignIn(c, ctx, user, challenge, "otp", "totp");
+    return c.json({ user: result, recoveryCodes });
+  });
+  app.post(`${COOKIE_PATH4}/verify`, async (c) => {
+    const expired = () => error(c, 401, "challenge_expired", "The sign-in has expired. Please sign in again.");
+    const challenge = await readChallenge(c, ctx, "totp");
+    if (!challenge) return expired();
+    if (!await methodStillOn(c, ctx, challenge)) return methodOff(c);
+    const user = await users.findById(challenge.sub);
+    const account = user && user.sessionVersion === challenge.sv ? await users.totpAccount(user.id) : null;
+    if (!user || !account) return expired();
+    const via = await checkCode(c, ctx, keys, user, account, await body(c));
+    if (via instanceof Response) return via;
+    return c.json({ user: await finishSignIn(c, ctx, user, challenge, "otp", via) });
+  });
+  app.post(`${COOKIE_PATH4}/signin`, async (c) => {
+    if (!await standalone(c)) return notStandalone(c);
+    const data = await body(c);
+    const wrong = () => error(c, 401, "invalid_credentials", "E-mail or code is wrong.");
+    if (!isValidEmail(data.email)) return wrong();
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    const app2 = user ? await users.totpApp(user.id) : null;
+    const account = app2?.account;
+    if (!user || !user.emailVerified || !app2?.signsIn || !account?.secret) return wrong();
+    const via = await checkCode(c, ctx, keys, user, account, data, wrong);
+    if (via instanceof Response) return via;
+    const result = await ctx.startSession(c, toMadauthUser(user), ["otp"], { method: "totp", signedUpAt: user.signedUpAt }, { sv: user.sessionVersion });
+    await ctx.emit("user.signed_in", { user: result, method: "totp" });
+    return c.json({ user: result });
+  });
+  app.post(`${COOKIE_PATH4}/remove`, async (c) => {
+    const user = await signedIn(c);
+    if (!user) return noSession(c);
+    const methods = await methodsNow(c);
+    const required = METHODS_WITH_SECOND_FACTOR.filter((method) => isOn(method, ctx.configured, methods) && policyOf(method, methods) === "required");
+    const smsOn = isOn("sms", ctx.configured, methods);
+    if (required.length && !(smsOn && await users.smsAccount(user.id))) {
+      const names = required.map((method) => ({ google: "Google", github: "GitHub", password: "e-mail & password", "email-link": "the e-mail link" })[method]);
+      const alternative = smsOn ? " Add a phone number for SMS codes first, or" : " To stop using it,";
+      return error(c, 403, "required_by_policy", `Signing in with ${names.join(" and ")} requires a second factor, so the authenticator app can't be removed.${alternative} delete your account.`);
+    }
+    const app2 = await users.totpApp(user.id);
+    if (!app2) return c.json({});
+    const { account } = app2;
+    if (app2.signsIn) {
+      return error(c, 403, "only_method", "The authenticator app is the only way you sign in, so it can't be removed. Delete your account instead.");
+    }
+    const via = await checkCode(c, ctx, keys, user, account, await body(c));
+    if (via instanceof Response) return via;
+    await users.removeTotp(user.id);
+    await ctx.emit("user.second_factor_disabled", { user: toMadauthUser(user), method: "totp" });
+    return c.json({});
+  });
+  app.post(`${COOKIE_PATH4}/recovery-codes`, async (c) => {
+    const user = await signedIn(c);
+    if (!user) return noSession(c);
+    const account = await users.totpAccount(user.id);
+    if (!account) return error(c, 400, "no_authenticator", "No authenticator app is set up.");
+    const via = await checkCode(c, ctx, keys, user, account, await body(c));
+    if (via instanceof Response) return via;
+    const { recoveryCodes, hashes } = newRecoveryCodes();
+    await users.replaceRecoveryCodes(account, hashes);
+    return c.json({ recoveryCodes });
+  });
+  app.get(`${COOKIE_PATH4}/status`, async (c) => {
+    const user = await signedIn(c);
+    if (!user) return noSession(c);
+    const account = await users.totpAccount(user.id);
+    return c.json({ enabled: !!account, recoveryCodesLeft: account ? await users.countRecoveryCodes(account) : 0 });
+  });
+  if (ctx.webhook && ctx.emailVerification) {
+    const emails = createEmails(ctx, users, ctx.webhook);
+    app.post(`${COOKIE_PATH4}/signup`, async (c) => {
+      if (!await standalone(c)) return notStandalone(c);
+      const data = await body(c);
+      const target = redirectTarget(ctx, c, data.redirectTo);
+      if (target instanceof Response) return target;
+      if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
+      const name = nameOf(data.name);
+      const email = data.email.trim();
+      const locale = localeOf(data.locale);
+      const check = await ctx.checkSignup({ email, name: name ?? void 0, locale, method: "totp" });
+      if (!check.ok) return check.reason === "rejected" ? error(c, 403, "signup_rejected", check.message) : unavailable(c);
+      const existing = await users.findByEmail(normalizeEmail(email));
+      if (existing?.emailVerified && await users.hasSignInMethod(existing.id)) {
+        return await emails.sendAccountEmail(existing, "email.send_already_registered", target, locale) ? accepted(c) : unavailable(c);
+      }
+      if (existing) {
+        if (Date.now() - existing.lastMailAt < MAIL_INTERVAL_MS) return accepted(c);
+        if (!existing.emailVerified) await users.dropUnprovenAccounts(existing.id);
+        await users.reopenSignUp(existing);
+        await users.updateUser(existing.id, { name });
+        return await emails.sendLinkEmail({ ...existing, name }, "verify", target, locale) ? accepted(c) : unavailable(c);
+      }
+      const user = await users.createUser({ email, emailNormalized: normalizeEmail(email), name, emailVerified: false });
+      if (!user) return accepted(c);
+      return await emails.sendLinkEmail(user, "verify", target, locale) ? accepted(c) : unavailable(c);
+    });
+  }
+}
+
+// src/app.ts
+var EVENT_TIMEOUT_MS = 5e3;
+function createApp(config) {
+  const { issuer, allowedOrigins, sessionTtlSeconds, renewalTtlSeconds, cookieDomain } = config;
+  const keys = importSigningKeys(config.signingKey);
+  const secure = issuer.startsWith("https:");
+  const isAllowedOrigin = (origin) => !!origin && allowedOrigins.includes(origin);
+  const codeKey = deriveCodeKey(config.signingKey.d);
+  const users = new Users(config.store, codeKey);
+  const methods = methodConfig(config);
+  const settings = new Settings(config.store, initialMethods(methods));
+  const configured = (method) => isConfigured(methods, method);
+  const signsUp = (method) => canSignUp(methods, method);
+  const emailVerification = sendsVerificationEmails(config);
+  const totpKeys = { totpKey: deriveTotpKey(config.signingKey.d), codeKey };
+  const tokenKey = deriveTokenKey(config.signingKey.d);
+  const issueSession = async (c, user, amr, extra) => {
+    const signingKeys = await keys;
+    const [sessionToken, renewalToken] = await Promise.all([
+      signSession(signingKeys, issuer, sessionTtlSeconds, user, amr, extra),
+      signRenewal(signingKeys, issuer, renewalTtlSeconds, user, amr, extra)
+    ]);
+    setCookie6(c, SESSION_COOKIE, sessionToken, {
+      path: "/",
+      domain: cookieDomain,
+      httpOnly: true,
+      secure,
+      sameSite: "Lax",
+      maxAge: sessionTtlSeconds
+    });
+    setCookie6(c, RENEWAL_COOKIE, renewalToken, {
+      path: "/auth",
+      httpOnly: true,
+      secure,
+      sameSite: "Lax",
+      maxAge: renewalTtlSeconds
+    });
+    setCookie6(c, EXPIRY_COOKIE, String(Math.floor(Date.now() / 1e3) + sessionTtlSeconds), {
+      path: "/",
+      domain: cookieDomain,
+      secure,
+      sameSite: "Lax",
+      maxAge: renewalTtlSeconds
+    });
+  };
+  const clearSession = (c) => {
+    deleteCookie6(c, SESSION_COOKIE, { path: "/", domain: cookieDomain, secure });
+    deleteCookie6(c, RENEWAL_COOKIE, { path: "/auth", secure });
+    deleteCookie6(c, EXPIRY_COOKIE, { path: "/", domain: cookieDomain, secure });
+  };
+  const tokenClaims = async (c, cookie, typ) => readToken(await keys, issuer, typ, getCookie6(c, cookie));
+  const checked = async (claims) => {
+    const stored = await users.findById(claims.sub);
+    if (!stored || stored.sessionVersion !== claims.sv) return null;
+    const { claims: _, ...user } = userFromClaims(claims);
+    const current = claimsFromJson(stored.claims);
+    return Object.keys(current).length ? { ...user, claims: current } : user;
+  };
+  const currentSession = async (c) => {
+    const session = await tokenClaims(c, SESSION_COOKIE, SESSION_TYP);
+    const user = session ? await checked(session) : null;
+    const upToDate = session && user && sameClaims(user.claims, session.claims) && Date.now() / 1e3 - session.iat <= sessionTtlSeconds / 2;
+    if (upToDate) return user;
+    const renewal = await tokenClaims(c, RENEWAL_COOKIE, RENEWAL_TYP);
+    const sameSignIn = session && user && renewal && renewal.sub === session.sub && renewal.sv === session.sv && renewal.email === session.email;
+    const renewed = sameSignIn ? user : renewal ? await checked(renewal) : null;
+    if (renewal && renewed) {
+      await issueSession(c, renewed, renewal.amr, { sv: renewal.sv });
+      return renewed;
+    }
+    return user;
+  };
+  const methodsOf = /* @__PURE__ */ new WeakMap();
+  const ctx = {
+    config,
+    keys,
+    secure,
+    isAllowedOrigin,
+    allowedUrl(value) {
+      let url;
+      try {
+        url = new URL(typeof value === "string" ? value : "");
+      } catch {
+        return null;
+      }
+      if (!isAllowedOrigin(url.origin)) return null;
+      url.hash = "";
+      return url;
+    },
+    async startSession(c, user, amr, { method, signedUpAt }, extra) {
+      const firstSession = signedUpAt === 0 && await users.markSignedUp(user.id);
+      clearChallenge(c, secure);
+      await issueSession(c, user, amr, extra);
+      const result = { ...user, amr };
+      if (firstSession) await this.emit("user.signed_up", { user: result, method });
+      return result;
+    },
+    async secondStep(c, user, amr, method, profile) {
+      const methods2 = await this.methods(c);
+      if (!isOn(method, configured, methods2)) return { disabled: true };
+      const policy = method === "totp" ? "required" : policyOf(method, methods2);
+      let next = null;
+      let factors = [];
+      if (policy !== "none") {
+        const [app2, phone] = await Promise.all([
+          users.totpAccount(user.id),
+          method !== "totp" && isOn("sms", configured, methods2) ? users.smsAccount(user.id) : null
+        ]);
+        factors = [...app2 ? ["totp"] : [], ...phone ? ["sms"] : []];
+        next = app2 ? "totp" : phone ? "sms" : policy === "required" ? "totp-setup" : null;
+      }
+      if (next) {
+        clearSession(c);
+        const known = { ...profile?.name ? { name: profile.name } : {}, ...profile?.picture ? { picture: profile.picture } : {} };
+        await setChallenge(c, this, { sub: user.id, sv: user.sessionVersion, amr, method, next, factors, ...Object.keys(known).length ? { profile: known } : {} });
+        return { next, method, factors };
+      }
+      const result = await this.startSession(c, toMadauthUser(user, profile), amr, { method, signedUpAt: user.signedUpAt }, { sv: user.sessionVersion });
+      await this.emit("user.signed_in", { user: result, method });
+      return { user: result };
+    },
+    currentUser: currentSession,
+    users,
+    settings,
+    webhook: config.webhook ? createWebhookClient(config.webhook, config.webhookFetch) : void 0,
+    configured,
+    emailVerification,
+    methods(c) {
+      let reading = methodsOf.get(c.req.raw);
+      if (!reading) {
+        reading = settings.methods();
+        methodsOf.set(c.req.raw, reading);
+      }
+      return reading;
+    },
+    async enabled(c, method) {
+      return isOn(method, configured, await this.methods(c));
+    },
+    async checkSignup(data) {
+      if (!this.webhook?.wants("user.signing_up")) return { ok: true };
+      const check = await this.webhook.call("user.signing_up", data, WEBHOOK_TIMEOUT_MS);
+      if (!check.ok) {
+        console.error(`[madauth] Webhook "user.signing_up" failed: ${check.reason}`);
+        return { ok: false, reason: "unavailable" };
+      }
+      const answer = check.body;
+      if (answer?.allow === false) {
+        const message = typeof answer.message === "string" && answer.message ? answer.message : "Sign-up is not possible with this e-mail address.";
+        return { ok: false, reason: "rejected", message };
+      }
+      return { ok: true };
+    },
+    async emit(type, data) {
+      if (!this.webhook?.wants(type)) return;
+      const user = data.user;
+      const payload = user && typeof user === "object" && "amr" in user ? { ...data, user: { ...user, amr: void 0 } } : data;
+      const result = await this.webhook.call(type, payload, EVENT_TIMEOUT_MS);
+      if (!result.ok) console.error(`[madauth] Webhook "${type}" failed: ${result.reason}`);
+    }
+  };
+  const app = new Hono();
+  app.use(
+    "/auth/*",
+    cors({
+      origin: (origin) => isAllowedOrigin(origin) ? origin : null,
+      credentials: true,
+      allowMethods: ["GET", "POST"],
+      allowHeaders: ["Content-Type"],
+      maxAge: 600
+    })
+  );
+  app.use("/auth/*", async (c, next) => {
+    if (c.req.method === "POST" && !isAllowedOrigin(c.req.header("origin"))) {
+      return c.json({ error: "forbidden_origin" }, 403);
+    }
+    await next();
+  });
+  app.get("/health", (c) => c.text("ok"));
+  app.get("/.well-known/jwks.json", async (c) => {
+    const { publicJwk } = await keys;
+    c.header("Cache-Control", "public, max-age=3600");
+    return c.json({ keys: [publicJwk] });
+  });
+  app.get("/auth/config", async (c) => {
+    const current = await ctx.methods(c);
+    const on = (method) => isOn(method, configured, current);
+    const rules = on("password") ? await settings.passwordRules() : null;
+    return c.json({
+      google: on("google") ? { clientId: config.google.clientId, codeFlow: !!config.google.clientSecret, secondFactor: policyOf("google", current) } : null,
+      github: on("github") ? { secondFactor: policyOf("github", current) } : null,
+      password: rules ? { ...rules, secondFactor: policyOf("password", current) } : null,
+      // The app can be set up when it is in use at all; `signIn` says whether it signs in on its own.
+      totp: authenticatorOn(configured, current) ? { signIn: on("totp"), signUp: on("totp") && emailVerification } : null,
+      email: { verification: emailVerification },
+      emailLink: on("email-link") ? { secondFactor: policyOf("email-link", current) } : null,
+      // SMS codes as a second factor: a signed-in user can add a phone, and the dialog offers it in the second step.
+      sms: on("sms")
+    });
+  });
+  if (emailVerification && ctx.webhook) emailRoutes(app, ctx, users, ctx.webhook);
+  if (configured("email-link") && ctx.webhook) emailLinkRoutes(app, ctx, users, ctx.webhook);
+  if (configured("sms") && ctx.webhook) smsRoutes(app, ctx, users, ctx.webhook);
+  if (config.google) googleRoutes(app, ctx, config.google);
+  if (config.github) githubRoutes(app, ctx, config.github, tokenKey);
+  if (config.password && ctx.webhook) passwordRoutes(app, ctx, users, ctx.webhook);
+  totpRoutes(app, ctx, totpKeys);
+  app.get("/auth/session", async (c) => {
+    const user = await currentSession(c);
+    if (!user) {
+      clearSession(c);
+      return c.json({ error: "no_session" }, 401);
+    }
+    return c.json({ user });
+  });
+  app.post("/auth/logout", (c) => {
+    clearSession(c);
+    clearChallenge(c, secure);
+    return c.body(null, 204);
+  });
+  app.post("/auth/account/delete", async (c) => {
+    const user = await currentSession(c);
+    if (!user) return c.json({ error: "no_session" }, 401);
+    const stored = await users.findById(user.id);
+    const protects = stored && authenticatorOn(configured, await ctx.methods(c));
+    const authenticator = protects ? await users.totpAccount(user.id) : null;
+    if (stored && authenticator) {
+      const data = await body(c);
+      if (data.code === void 0 && data.recoveryCode === void 0) {
+        return error(c, 401, "code_required", "Enter a code from your authenticator app (or a recovery code) to delete your account.");
+      }
+      const via = await checkCode(c, ctx, totpKeys, stored, authenticator, data);
+      if (via instanceof Response) return via;
+    }
+    const googleSub = await users.googleSub(user.id);
+    const githubAccount = config.github ? await users.githubAccount(user.id) : null;
+    const deleted = await users.deleteById(user.id);
+    if (deleted && config.github) await revokeGrant(config.github, tokenKey, githubAccount);
+    clearSession(c);
+    await ctx.emit("user.deleted", { user });
+    return googleSub ? c.json({ googleSub }) : c.body(null, 204);
+  });
+  const admin = async (c) => {
+    const user = await currentSession(c);
+    if (!user) return { answer: c.json({ error: "no_session" }, 401) };
+    const email = user.email ? normalizeEmail(user.email) : void 0;
+    if (!email || !isAdmin(user)) {
+      const message = `Only users with the role "${ADMIN_ROLE}" can manage claims and settings.`;
+      return { answer: c.json({ error: "forbidden", message }, 403) };
+    }
+    return { email };
+  };
+  const invalidEmail = (c) => c.json({ error: "invalid_email", message: "This is not a valid e-mail address." }, 400);
+  const noUser = (c) => c.json({ error: "user_not_found", message: "No user has this e-mail address." }, 404);
+  app.post("/auth/admin/claims/get", async (c) => {
+    const caller = await admin(c);
+    if ("answer" in caller) return caller.answer;
+    const data = await body(c);
+    if (!isValidEmail(data.email)) return invalidEmail(c);
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    if (!user) return noUser(c);
+    return c.json({ email: user.emailNormalized, userId: user.id, claims: claimsFromJson(user.claims) });
+  });
+  app.post("/auth/admin/claims/set", async (c) => {
+    const caller = await admin(c);
+    if ("answer" in caller) return caller.answer;
+    const data = await body(c);
+    if (!isValidEmail(data.email)) return invalidEmail(c);
+    const claims = parseClaims(data.claims);
+    if (!claims) {
+      return c.json(
+        {
+          error: "invalid_claims",
+          message: 'claims must be a JSON object of at most 2048 characters whose keys are names (letters, digits and "_", starting with a letter). "roles" must be a list of names of lower-case letters, digits, "-" and "_".'
+        },
+        400
+      );
+    }
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    if (!user) return noUser(c);
+    const stored = Object.keys(claims).length ? JSON.stringify(claims) : null;
+    await users.updateUser(user.id, { claims: stored });
+    const email = user.emailNormalized;
+    await ctx.emit("user.claims_changed", { user: toMadauthUser({ ...user, claims: stored }), claims, by: caller.email });
+    return c.json({ email, userId: user.id, claims });
+  });
+  const settingsAnswer = (methods2, password) => ({
+    password,
+    methods: Object.fromEntries(
+      METHODS.map((method) => [
+        method,
+        {
+          configured: configured(method),
+          enabled: isOn(method, configured, methods2),
+          ...hasSecondFactor(method) ? { secondFactor: policyOf(method, methods2) } : {}
+        }
+      ])
+    )
+  });
+  app.post("/auth/admin/settings/get", async (c) => {
+    const caller = await admin(c);
+    if ("answer" in caller) return caller.answer;
+    const [methods2, password] = await Promise.all([settings.methods(), settings.passwordRules()]);
+    return c.json(settingsAnswer(methods2, password));
+  });
+  app.post("/auth/admin/settings/set", async (c) => {
+    const caller = await admin(c);
+    if ("answer" in caller) return caller.answer;
+    const data = await body(c);
+    const invalid = (message) => c.json({ error: "invalid_settings", message }, 400);
+    if (data.methods === void 0 && data.password === void 0) return invalid("Pass methods, password or both.");
+    const next = data.methods === void 0 ? void 0 : parseMethodSettings(data.methods, { booleans: true });
+    if (next === null) {
+      return invalid(
+        `methods must list the sign-in methods that are on (${SIGN_IN_METHODS.join(", ")}; sms for SMS codes as a second factor), each as true, {} or { "secondFactor": "none" | "optional" | "required" } (google, github, password and email-link), e.g. { "google": {}, "password": { "secondFactor": "optional" }, "sms": {} }. A method that is not listed is off.`
+      );
+    }
+    const rules = data.password === void 0 ? void 0 : parsePasswordRules(data.password);
+    if (rules === null) {
+      return invalid(
+        `password must be { "minLength": 1 to ${MAX_MIN_LENGTH}, "minScore": 0 to 4 }, both optional, e.g. { "minLength": 10, "minScore": 3 }. What is left out takes its default (${DEFAULT_PASSWORD_RULES.minLength}, ${DEFAULT_PASSWORD_RULES.minScore}).`
+      );
+    }
+    if (next && !anyOn(signsUp, next)) {
+      return invalid("At least one sign-in method that creates users must stay on: Google, GitHub, e-mail & password, the e-mail link, or the authenticator app with sign-up by e-mail.");
+    }
+    const previousRules = rules && next ? await settings.passwordRules() : void 0;
+    const password = rules ? await settings.setPasswordRules(rules, caller.email) : await settings.passwordRules();
+    if (next) {
+      try {
+        await settings.changeMethods(() => next, caller.email);
+      } catch (e) {
+        if (previousRules) await settings.setPasswordRules(previousRules, caller.email).catch(() => {
+        });
+        throw e;
+      }
+    }
+    const methods2 = next ?? await settings.methods();
+    return c.json(settingsAnswer(methods2, password));
+  });
+  app.post("/auth/admin/totp/remove", async (c) => {
+    const caller = await admin(c);
+    if ("answer" in caller) return caller.answer;
+    const data = await body(c);
+    if (!isValidEmail(data.email)) return invalidEmail(c);
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    if (!user) return noUser(c);
+    const app2 = await users.totpApp(user.id);
+    const secondFactor = !!app2 && !app2.signsIn;
+    const removed = await users.removeTotp(user.id);
+    if (removed && secondFactor) await ctx.emit("user.second_factor_disabled", { user: toMadauthUser(user), method: "totp", by: caller.email });
+    return c.json({ email: user.emailNormalized, userId: user.id, enabled: false });
+  });
+  app.post("/auth/admin/sms/remove", async (c) => {
+    const caller = await admin(c);
+    if ("answer" in caller) return caller.answer;
+    const data = await body(c);
+    if (!isValidEmail(data.email)) return invalidEmail(c);
+    const user = await users.findByEmail(normalizeEmail(data.email));
+    if (!user) return noUser(c);
+    const removed = await users.removeSms(user.id);
+    if (removed) await ctx.emit("user.second_factor_disabled", { user: toMadauthUser(user), method: "sms", by: caller.email });
+    return c.json({ email: user.emailNormalized, userId: user.id, enabled: false });
+  });
+  return app;
+}
+
+export {
+  REDIRECT_ERROR_PARAM,
+  createApp
+};