@rebasepro/server 0.14.0 → 0.14.1

package/dist/{auth-CYoPVf-E.js → auth-BobZVd0j.js}

@@ -2,17 +2,16 @@ import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
 import { i as __toESM, n as __exportAll } from "./rolldown-runtime-DSJWtz9O.js";
-import { C as resolveClientListLimit, T as isAnonymousUid, a as deserializeLogicalCondition, i as deserializeFilter, r as UnknownFilterOperatorError, w as ANONYMOUS_USER_ID, x as ListLimitError } from "./src-C7rkDGxA.js";
+import { C as ListLimitError, D as isAnonymousUid, E as ANONYMOUS_USER_ID, T as resolveClientListLimit, a as deserializeLogicalCondition, i as deserializeFilter, r as UnknownFilterOperatorError } from "./src-8XDWyDfR.js";
 import "./src-Cz9nMgUR.js";
-import { i as isSQLAdmin, r as revokeInternalTableSql, t as createDdlBootstrapper } from "./ddl-bootstrap-BhXbTnBl.js";
+import { n as createDdlBootstrapper, o as revokeInternalTableSql, s as isSQLAdmin } from "./ddl-bootstrap-Cywoj8Ta.js";
+import { S as canonicalStorageId, T as require_jsonwebtoken, _ as verifyMfaPendingToken, a as generateMfaPendingToken, c as getJwks, d as hasAsymmetricSigningKey, f as hashRefreshToken, g as verifyDownloadToken, h as verifyAccessToken, i as generateDownloadToken, l as getRefreshTokenExpiry, n as configureJwt, o as generateRefreshToken, p as isJwtConfigured, r as generateAccessToken, s as getAccessTokenExpiry, t as MAX_COOKIE_AGE_MS, u as getRefreshTokenTtlMs, w as tryCanonicalStorageKey } from "./jwt-VJyXTdQQ.js";
 import { t as logger } from "./logger-DfvF_8r-.js";
 import { n as errorHandler, t as ApiError } from "./errors-EBYiaJ2E.js";
-import { a as generateMfaPendingToken, c as getRefreshTokenExpiry, d as isJwtConfigured, g as require_jsonwebtoken, h as verifyMfaPendingToken, i as generateDownloadToken, l as getRefreshTokenTtlMs, m as verifyDownloadToken, n as configureJwt, o as generateRefreshToken, p as verifyAccessToken, r as generateAccessToken, s as getAccessTokenExpiry, t as MAX_COOKIE_AGE_MS, u as hashRefreshToken } from "./jwt-_IFqfTOg.js";
 import { createHash, randomBytes, randomInt } from "node:crypto";
 import { Hono } from "hono";
 import { promisify } from "util";
 import { createCipheriv, createDecipheriv, createHash as createHash$1, createHmac, createPublicKey, randomBytes as randomBytes$1, randomUUID as randomUUID$1, scrypt, timingSafeEqual } from "crypto";
-import path from "node:path";
 import { getConnInfo } from "@hono/node-server/conninfo";
 //#region ../types/src/controllers/storage.ts
 /**
@@ -172,9 +171,68 @@ function parseWhereParam(raw) {
 	const filter = decodeFilter(parsed);
 	return Object.keys(filter).length > 0 ? filter : void 0;
 }
+/**
+* The parsed entries as the driver contract spells them: `[field, direction]`
+* tuples in order of significance.
+*
+* The REST layer used to hand the driver `orderBy[0].field` and drop the rest,
+* so `?orderBy=[{"field":"roles"},{"field":"created_at","direction":"desc"}]`
+* — a shape this parser has always accepted and validated in full — sorted by
+* `roles` alone and returned the ties in whatever order Postgres pleased.
+*/
+function orderByEntriesToTuples(entries) {
+	if (!entries || entries.length === 0) return void 0;
+	return entries.map(({ field, direction }) => [field, direction]);
+}
 function invalidOrderBy(detail) {
 	throw invalidParam(`Invalid \`orderBy\` parameter: ${detail}. Expected \`field\`, \`field:desc\`, or a JSON array like [{"field":"created_at","direction":"desc"}]`, "INVALID_ORDER_BY");
 }
+/** The aggregate functions `?select=` accepts. */
+var AGGREGATE_FUNCTIONS = /* @__PURE__ */ new Set([
+	"count",
+	"sum",
+	"avg",
+	"min",
+	"max"
+]);
+/**
+* Parse `?select=count(),sum(total),avg(total)`.
+*
+* The spelling is SQL's, because whoever writes it is thinking in SQL and
+* because any other spelling has to be learned first. `count()` with no field
+* counts rows; every other function names a column.
+*
+* Aliases are derived rather than accepted: `sum(total)` returns as
+* `sum_total`, `count()` as `count`. Letting a caller choose would mean
+* checking their alias is not also a `groupBy` field — a rule nobody would
+* guess, and a silently overwritten value if it went unchecked.
+*/
+function parseAggregateSelect(raw) {
+	const value = getLastValue(raw);
+	if (!value) return void 0;
+	const entries = String(value).split(",").map((s) => s.trim()).filter(Boolean);
+	if (entries.length === 0) return void 0;
+	return entries.map((entry) => {
+		const match = /^([a-z]+)\(\s*([A-Za-z0-9_]*)\s*\)$/i.exec(entry);
+		if (!match) throw invalidParam(`Invalid \`select\` entry "${entry}". Expected \`fn(field)\`, e.g. \`sum(total)\` or \`count()\`.`, "INVALID_AGGREGATE_SELECT");
+		const fn = match[1].toLowerCase();
+		const field = match[2] || void 0;
+		if (!AGGREGATE_FUNCTIONS.has(fn)) throw invalidParam(`Unknown aggregate function "${fn}". Expected: ${[...AGGREGATE_FUNCTIONS].join(", ")}.`, "INVALID_AGGREGATE_FUNCTION");
+		if (fn !== "count" && !field) throw invalidParam(`\`${fn}()\` needs a field, e.g. \`${fn}(total)\`. Only \`count()\` may be empty.`, "INVALID_AGGREGATE_SELECT");
+		return {
+			fn,
+			field,
+			alias: field ? `${fn}_${field}` : fn
+		};
+	});
+}
+/** Parse `?groupBy=status,country`. */
+function parseGroupBy(raw) {
+	const value = getLastValue(raw);
+	if (!value) return void 0;
+	const fields = String(value).split(",").map((s) => s.trim()).filter(Boolean);
+	return fields.length > 0 ? fields : void 0;
+}
 /** `asc`/`desc`, in any case. Anything else is a request to sort in a way that does not exist. */
 function toDirection(raw, context) {
 	if (raw === void 0 || raw === null) return "asc";
@@ -299,7 +357,9 @@ function parseQueryOptions(query, limits = {}) {
 		"vector_threshold",
 		"or",
 		"and",
-		"where"
+		"where",
+		"select",
+		"groupBy"
 	];
 	const filterDict = {};
 	for (const [key, rawValue] of Object.entries(query)) {
@@ -832,137 +892,6 @@ function createApiKeyPreAuth(options) {
 	};
 }
 //#endregion
-//#region src/storage/keys.ts
-/**
-* Canonical storage keys and bucket names.
-*
-* Storage is not under RLS, so a `storageAuthorize` hook is the whole access
-* control model — and a hook can only be correct if the key it is shown is the
-* key that is written. That is the invariant this module exists to hold: one
-* canonical string, computed once per request, handed to the hook, to the
-* controller, and to the download token alike.
-*
-* ## Why rejecting beats stripping
-*
-* The previous `sanitizeStorageKey` *stripped* `../` in a single pass. Two
-* things were wrong with that, and only one of them was the obvious one.
-*
-* The obvious one: a single pass is not a fixed point. `....//` contains `../`
-* at offset 2, so removing it leaves `../` behind — the sanitizer manufactured
-* the traversal it was there to remove. `users/alice/....//bob/x` came out as
-* `users/alice/../bob/x`, which a prefix hook reads as alice's (it starts with
-* `users/alice/`) and the filesystem reads as bob's. The hook approved one
-* object and the controller wrote another.
-*
-* The subtler one, and the reason this is a rewrite rather than a loop: even a
-* correct strip is a silent rewrite. A caller who asks to store at `a/../b` and
-* gets an object at `a/b` was not protected, they were misled — and every later
-* read, ownership row and audit line now refers to a path nobody chose. So a key
-* that means something other than what it says is refused (400), not repaired.
-*
-* Note what is NOT traversal under this rule: `....` is an ordinary directory
-* name, and `users/alice/....//bob/x` canonicalizes to
-* `users/alice/..../bob/x` — still comfortably inside alice's prefix, which is
-* exactly right. Only a real `..` segment is refused.
-*/
-/** Longest key accepted, in UTF-16 code units. Matches the previous cap. */
-var MAX_STORAGE_KEY_LENGTH = 1024;
-/**
-* A key that cannot be canonicalized. Carries no path back to the caller
-* beyond what they sent, so it is safe to surface as a 400 message.
-*/
-var InvalidStorageKeyError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "InvalidStorageKeyError";
-	}
-};
-/**
-* Canonicalize a caller-supplied storage key, or throw
-* {@link InvalidStorageKeyError}.
-*
-* Normalizations applied (safe, idempotent, and meaning-preserving):
-* - leading slashes removed — `/a/b` and `a/b` name the same object
-* - `.` segments and repeated slashes collapsed
-*
-* Refusals (the key means something other than what it says):
-* - any `..` segment, on either separator, at any depth
-* - null bytes
-* - keys longer than {@link MAX_STORAGE_KEY_LENGTH}
-*
-* A trailing slash is preserved: it is how the folder route marks a prefix.
-*/
-function canonicalStorageKey(rawKey) {
-	if (rawKey.includes("\0")) throw new InvalidStorageKeyError("Storage key contains a null byte.");
-	if (rawKey.length > 1024) throw new InvalidStorageKeyError(`Storage key exceeds the maximum length of ${MAX_STORAGE_KEY_LENGTH} characters.`);
-	if (rawKey.split(/[\\/]/).some((segment) => segment === "..")) throw new InvalidStorageKeyError("Storage key contains a '..' path segment. Keys must name an object directly.");
-	const withoutLeadingSlashes = rawKey.replace(/^\/+/, "");
-	if (withoutLeadingSlashes === "") return "";
-	const denotesDirectory = /(?:^|\/)\.?$/.test(withoutLeadingSlashes);
-	const normalized = path.posix.normalize(withoutLeadingSlashes);
-	if (normalized === "." || normalized === "./") return "";
-	const key = normalized.replace(/^\.\//, "").replace(/^\/+/, "");
-	if (key === "") return "";
-	return denotesDirectory && !key.endsWith("/") ? `${key}/` : key;
-}
-/**
-* Canonicalize, or return `null` when the key is not canonicalizable.
-*
-* For callers that must fail closed without an exception — the download-token
-* middleware compares a request path against a granted path, and a key it
-* cannot canonicalize simply matches nothing.
-*/
-function tryCanonicalStorageKey(rawKey) {
-	try {
-		return canonicalStorageKey(rawKey);
-	} catch {
-		return null;
-	}
-}
-/** A bucket name that does not name a bucket. See {@link canonicalStorageBucket}. */
-var InvalidStorageBucketError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "InvalidStorageBucketError";
-	}
-};
-/**
-* One path segment: letters, digits, `.`, `_`, `-`, first character
-* alphanumeric. Deliberately narrow — it is the intersection of what S3, GCS
-* and a filesystem directory all accept, and it makes `..`, `.tus-uploads`,
-* absolute paths and anything containing a separator unrepresentable.
-*/
-var STORAGE_BUCKET_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
-/**
-* Canonicalize a caller-supplied bucket name, or throw
-* {@link InvalidStorageBucketError}.
-*
-* The bucket is the *other* caller-controlled routing value in an upload
-* request, and it was the one nobody validated. `LocalStorageController`
-* builds `join(basePath, bucket)` and then checks containment against that
-* result, so a bucket of `../../etc` moved the boundary rather than crossing
-* it — the guard passed because the guard's reference point was the attacker's.
-* The containment check now resolves against the storage root, and this is the
-* check at the route boundary that stops the value before it gets there.
-*
-* A bucket is configuration, not user data: there is no legitimate caller that
-* needs a separator, a leading dot, or a `..` in one. So this refuses rather
-* than repairs, exactly as {@link canonicalStorageKey} does — a rewritten
-* bucket would silently store the object somewhere the caller did not ask for.
-*
-* Returns `undefined` when the caller named no bucket (absent, or an empty
-* form field), which is how every controller spells "use my default". An empty
-* string used to reach `getFullPath` and resolve to the storage *root* rather
-* than the `default` bucket, which is a third place a bare key did not
-* round-trip.
-*/
-function canonicalStorageBucket(rawBucket) {
-	if (rawBucket === void 0 || rawBucket === null || rawBucket === "") return void 0;
-	if (rawBucket.length > 63) throw new InvalidStorageBucketError(`Storage bucket exceeds the maximum length of 63 characters.`);
-	if (!STORAGE_BUCKET_PATTERN.test(rawBucket)) throw new InvalidStorageBucketError("Storage bucket must be a single name of letters, digits, '.', '_' or '-', starting with a letter or digit.");
-	return rawBucket;
-}
-//#endregion
 //#region src/auth/middleware.ts
 /**
 * Hono middleware that requires a valid JWT token via Authorization header.
@@ -1326,25 +1255,49 @@ var fileTokenAuth = async (c, next) => {
 			resolvedPath: tryCanonicalStorageKey(filePath)
 		};
 	};
+	/**
+	* Decide what a valid download token entitles this request to.
+	*
+	* One function rather than a copy per token location: a Bearer token and a
+	* `?token=` are the same grant presented two ways, and the whole failure
+	* this guards against is two places disagreeing about what was granted.
+	*
+	* `"no-path"` is distinct from the two denials because the caller treats it
+	* differently — a request with no object path at all is not a denied read,
+	* it is a request this middleware has nothing to say about, and on
+	* `/metadata/*` it must still reach the downstream auth gate.
+	*/
+	const evaluateGrant = (payload) => {
+		if (canonicalStorageId(c.req.query("storageId")) !== payload.storageId) return "deny-storage";
+		const rawPath = extractWildcard(c);
+		if (!rawPath) return "no-path";
+		const { bucket, resolvedPath } = parseBucketPath(decodeURIComponent(rawPath));
+		if (resolvedPath === null) return "deny-path";
+		return isPathMatch(`${bucket}/${resolvedPath}`, payload.path) ? "grant" : "deny-path";
+	};
+	/**
+	* Which half of the scope failed is named in the message. The holder of the
+	* token already knows both values, so this reveals nothing to an attacker —
+	* and without it, a client that forgets to forward `?storageId=` on the file
+	* URL reports a "path mismatch" for a path that matches perfectly.
+	*/
+	const denyMismatch = (outcome) => c.json({ error: {
+		message: outcome === "deny-storage" ? "Forbidden: Scoped token storage mismatch" : "Forbidden: Scoped token path mismatch",
+		code: "FORBIDDEN"
+	} }, 403);
 	const bearerToken = extractBearerToken(authHeader);
 	if (bearerToken !== void 0) {
 		const payload = verifyDownloadToken(bearerToken);
 		if (payload) {
-			const rawPath = extractWildcard(c);
-			if (rawPath) {
-				const { bucket, resolvedPath } = parseBucketPath(decodeURIComponent(rawPath));
-				const requestedFullPath = resolvedPath === null ? null : `${bucket}/${resolvedPath}`;
-				if (requestedFullPath !== null && isPathMatch(requestedFullPath, payload.path)) {
-					c.set("user", {
-						uid: "download-token",
-						roles: ["reader"]
-					});
-					return next();
-				} else return c.json({ error: {
-					message: "Forbidden: Scoped token path mismatch",
-					code: "FORBIDDEN"
-				} }, 403);
+			const outcome = evaluateGrant(payload);
+			if (outcome === "grant") {
+				c.set("user", {
+					uid: "download-token",
+					roles: ["reader"]
+				});
+				return next();
 			}
+			if (outcome !== "no-path") return denyMismatch(outcome);
 		}
 		if (isFileRoute) return c.json({ error: {
 			message: "Unauthorized: Access JWT not allowed on file routes",
@@ -1355,21 +1308,15 @@ var fileTokenAuth = async (c, next) => {
 	if (queryToken) {
 		const payload = verifyDownloadToken(queryToken);
 		if (payload) {
-			const rawPath = extractWildcard(c);
-			if (rawPath) {
-				const { bucket, resolvedPath } = parseBucketPath(decodeURIComponent(rawPath));
-				const requestedFullPath = resolvedPath === null ? null : `${bucket}/${resolvedPath}`;
-				if (requestedFullPath !== null && isPathMatch(requestedFullPath, payload.path)) {
-					c.set("user", {
-						uid: "download-token",
-						roles: ["reader"]
-					});
-					return next();
-				} else return c.json({ error: {
-					message: "Forbidden: Scoped token path mismatch",
-					code: "FORBIDDEN"
-				} }, 403);
+			const outcome = evaluateGrant(payload);
+			if (outcome === "grant") {
+				c.set("user", {
+					uid: "download-token",
+					roles: ["reader"]
+				});
+				return next();
 			}
+			if (outcome !== "no-path") return denyMismatch(outcome);
 		}
 		return c.json({ error: {
 			message: "Unauthorized: Invalid or unauthorized token",
@@ -7419,7 +7366,7 @@ function mountSessionRoutes(opts) {
 		clearRefreshCookie(c, config.cookieAuth);
 		const accessToken = extractBearerToken(c.req.header("authorization"));
 		if (ops.afterLogout && accessToken !== void 0) {
-			const { verifyAccessToken } = await import("./jwt-_IFqfTOg.js").then((n) => n.f);
+			const { verifyAccessToken } = await import("./jwt-VJyXTdQQ.js").then((n) => n.m);
 			const payload = verifyAccessToken(accessToken);
 			if (payload) ops.afterLogout(payload.uid).catch((err) => {
 				logger.error("[AuthHooks] afterLogout error", { error: err instanceof Error ? err.message : err });
@@ -9049,6 +8996,31 @@ function toAuthUserData(user) {
 	};
 }
 //#endregion
+//#region src/auth/jwks-routes.ts
+/**
+* `GET /.well-known/jwks.json` — the public keys that verify this issuer's
+* access tokens.
+*
+* Deliberately unauthenticated and world-readable: the whole point is that a
+* gateway, an edge function or a neighbouring service can check a Rebase token
+* without being trusted with anything. Public keys are not a secret, and
+* `jwt-keys.ts` derives what is served here from the public half of each pair.
+*
+* Mounted at the root rather than under `basePath`, because `/.well-known/` is
+* where every verifier looks — an issuer of `https://api.example.com` implies
+* `https://api.example.com/.well-known/jwks.json`, whatever the API happens to
+* be prefixed with.
+*/
+function createJwksRoutes() {
+	const router = new Hono();
+	router.get("/jwks.json", (c) => {
+		const jwks = getJwks();
+		c.header("Cache-Control", "public, max-age=300");
+		return c.json(jwks);
+	});
+	return router;
+}
+//#endregion
 //#region src/auth/oauth-code-flow.ts
 /**
 * Build the request schema for an authorization-code provider.
@@ -10478,6 +10450,7 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	createGitHubProvider: () => createGitHubProvider,
 	createGitLabProvider: () => createGitLabProvider,
 	createGoogleProvider: () => createGoogleProvider,
+	createJwksRoutes: () => createJwksRoutes,
 	createLinkedinProvider: () => createLinkedinProvider,
 	createMicrosoftProvider: () => createMicrosoftProvider,
 	createRateLimiter: () => createRateLimiter,
@@ -10496,7 +10469,9 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	generateSecurePassword: () => generateSecurePassword,
 	generateSecureToken: () => generateSecureToken,
 	getAccessTokenExpiry: () => getAccessTokenExpiry,
+	getJwks: () => getJwks,
 	getRefreshTokenExpiry: () => getRefreshTokenExpiry,
+	hasAsymmetricSigningKey: () => hasAsymmetricSigningKey,
 	hashPassword: () => hashPassword,
 	hashRefreshToken: () => hashRefreshToken,
 	hashToken: () => hashToken,
@@ -10526,6 +10501,6 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	verifyPassword: () => verifyPassword
 });
 //#endregion
-export { fileTokenAuth as $, MemoryRateLimitStore as A, getEmailVerificationTemplate as B, ZodNumber as C, isPublicStoragePath as Ct, _coercedNumber as D, string as E, resolveAuthHooks as F, RawHtml as G, getPasswordResetTemplate as H, hashPassword as I, raw as J, escapeHtml as K, validatePasswordStrength as L, createEmailService as M, assertEmailLinkBases as N, DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT as O, resolveEmailLinkBase as P, extractUserFromToken as Q, verifyPassword as R, createBuiltinAuthAdapter as S, PUBLIC_STORAGE_PREFIX as St, object as T, getUserInvitationTemplate as U, getMagicLinkTemplate as V, getWelcomeEmailTemplate as W, createAuthMiddleware as X, createAdapterAuthMiddleware as Y, createRequireAuth as Z, createLinkedinProvider as _, scopeDataDriver as _t, createSpotifyProvider as a, InvalidStorageBucketError as at, pkceTokenParams as b, parseQueryOptions as bt, createGitLabProvider as c, canonicalStorageKey as ct, createFacebookProvider as d, createStorageApiKeyGuard as dt, optionalAuth as et, createAppleProvider as f, isApiKeyToken as ft, createGitHubProvider as g, SERVICE_IDENTITY as gt, verifyOidcIdToken as h, safeCompare as ht, createApiKeyStore as i, requireAuth as it, SMTPEmailService as j, createDataRateLimiter as k, createDiscordProvider as l, createApiKeyPreAuth as lt, tryVerifyOidcIdToken as m, extractBearerToken as mt, createCustomAuthAdapter as n, queryTokenAuth as nt, createSlackProvider as o, InvalidStorageKeyError as ot, createMicrosoftProvider as p, validateApiKey as pt, html as q, createApiKeyRoutes as r, requireAdmin as rt, createBitbucketProvider as s, canonicalStorageBucket as st, auth_exports as t, publicObjectAuth as tt, createTwitterProvider as u, createFunctionApiKeyGuard as ut, createGoogleProvider as v, httpMethodToOperation as vt, _enum as w, providerVerifiedEmail as x, resolveListLimitParam as xt, oauthCodeFlowSchema as y, isOperationAllowed as yt, generateSecurePassword as z };
+export { extractUserFromToken as $, createDataRateLimiter as A, generateSecurePassword as B, createBuiltinAuthAdapter as C, isPublicStoragePath as Ct, string as D, object as E, resolveEmailLinkBase as F, getWelcomeEmailTemplate as G, getMagicLinkTemplate as H, resolveAuthHooks as I, html as J, RawHtml as K, hashPassword as L, SMTPEmailService as M, createEmailService as N, _coercedNumber as O, assertEmailLinkBases as P, createRequireAuth as Q, validatePasswordStrength as R, createJwksRoutes as S, PUBLIC_STORAGE_PREFIX as St, _enum as T, getPasswordResetTemplate as U, getEmailVerificationTemplate as V, getUserInvitationTemplate as W, createAdapterAuthMiddleware as X, raw as Y, createAuthMiddleware as Z, createLinkedinProvider as _, orderByEntriesToTuples as _t, createSpotifyProvider as a, requireAuth as at, pkceTokenParams as b, parseQueryOptions as bt, createGitLabProvider as c, createStorageApiKeyGuard as ct, createFacebookProvider as d, extractBearerToken as dt, fileTokenAuth as et, createAppleProvider as f, safeCompare as ft, createGitHubProvider as g, isOperationAllowed as gt, verifyOidcIdToken as h, httpMethodToOperation as ht, createApiKeyStore as i, requireAdmin as it, MemoryRateLimitStore as j, DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT as k, createDiscordProvider as l, isApiKeyToken as lt, tryVerifyOidcIdToken as m, scopeDataDriver as mt, createCustomAuthAdapter as n, publicObjectAuth as nt, createSlackProvider as o, createApiKeyPreAuth as ot, createMicrosoftProvider as p, SERVICE_IDENTITY as pt, escapeHtml as q, createApiKeyRoutes as r, queryTokenAuth as rt, createBitbucketProvider as s, createFunctionApiKeyGuard as st, auth_exports as t, optionalAuth as tt, createTwitterProvider as u, validateApiKey as ut, createGoogleProvider as v, parseAggregateSelect as vt, ZodNumber as w, providerVerifiedEmail as x, resolveListLimitParam as xt, oauthCodeFlowSchema as y, parseGroupBy as yt, verifyPassword as z };
 
-//# sourceMappingURL=auth-CYoPVf-E.js.map
+//# sourceMappingURL=auth-BobZVd0j.js.map