@server/next 0.27.0 → 0.27.1

package/index.js

@@ -1,15 +1,3 @@
-// src/polyfill.ts
-globalThis.env = {};
-if (typeof globalThis.Netlify !== "undefined") {
-  Object.assign(
-    globalThis.env,
-    globalThis.Netlify.env.toObject()
-  );
-}
-if (typeof process !== "undefined") {
-  Object.assign(globalThis.env, process.env);
-}
-
 // src/ServerError.ts
 var ServerError = class _ServerError extends Error {
   code;
@@ -34,7 +22,6 @@ var ServerError = class _ServerError extends Error {
     this.message = messageStr;
     this.status = status2;
   }
-  // Add error codes dynamically to the global object
   static extend(errors) {
     for (const code in errors) {
       const error = errors[code];
@@ -46,31 +33,9 @@ var ServerError = class _ServerError extends Error {
     }
     return errors;
   }
-  // Dynamically added error methods from errors/index.ts
-  static NO_STORE;
-  static NO_STORE_WRITE;
-  static NO_STORE_READ;
-  static AUTH_ARGON_NEEDED;
-  static AUTH_INVALID_TYPE;
-  static AUTH_INVALID_TOKEN;
-  static AUTH_INVALID_COOKIE;
-  static AUTH_NO_PROVIDER;
-  static AUTH_INVALID_PROVIDER;
-  static AUTH_NO_SESSION;
-  static AUTH_NO_USER;
-  static LOGIN_NO_EMAIL;
-  static LOGIN_INVALID_EMAIL;
-  static LOGIN_NO_PASSWORD;
-  static LOGIN_INVALID_PASSWORD;
-  static LOGIN_WRONG_EMAIL;
-  static LOGIN_WRONG_PASSWORD;
-  static REGISTER_NO_EMAIL;
-  static REGISTER_INVALID_EMAIL;
-  static REGISTER_NO_PASSWORD;
-  static REGISTER_INVALID_PASSWORD;
-  static REGISTER_EMAIL_EXISTS;
 };
-var ServerError_default = ServerError;
+var TypedServerError = ServerError;
+var ServerError_default = TypedServerError;
 
 // src/errors/index.ts
 ServerError_default.extend({
@@ -78,9 +43,10 @@ ServerError_default.extend({
   NO_STORE_WRITE: "You need a 'store' to write 'ctx.session.{key}'",
   NO_STORE_READ: "You need a 'store' to read 'ctx.session.{key}'",
   AUTH_ARGON_NEEDED: "Argon2 is needed for the auth module, please install it with 'npm i argon2'",
-  AUTH_INVALID_TYPE: "Invalid Authorization type, '{type}'",
   AUTH_INVALID_TOKEN: "Invalid Authorization token",
   AUTH_INVALID_COOKIE: "Invalid Authorization cookie",
+  AUTH_INVALID_HEADER: "Invalid authorization header {type}, must send 'Bearer {TOKEN}' (with space)",
+  AUTH_INVALID_STRATEGY: "Invalid Authorization type '{strategy}', valid one is '{valid}'",
   AUTH_NO_PROVIDER: "No provider passed to the option 'auth.provider'",
   AUTH_INVALID_PROVIDER: "Invalid provider '{provider}', valid ones are: '{valid}'",
   AUTH_NO_SESSION: { status: 401, message: "Invalid session" },
@@ -101,126 +67,109 @@ ServerError_default.extend({
   REGISTER_EMAIL_EXISTS: "Email is already registered"
 });
 
-// src/helpers/createCookies.ts
-function createCookies(cookies2) {
-  if (!cookies2 || !Object.keys(cookies2).length) return [];
-  return Object.entries(cookies2).map(([key, val]) => {
-    if (!val) {
-      val = { value: "", expires: (/* @__PURE__ */ new Date(0)).toUTCString() };
-    }
-    if (typeof val === "string") {
-      val = { value: val };
-    }
-    const { value, path: path2, expires } = val;
-    const pathPart = `;Path=${path2 || "/"}`;
-    const expiresPart = expires ? `;Expires=${expires}` : "";
-    return `${key}=${value || ""}${pathPart}${expiresPart}`;
-  });
+// src/polyfill.ts
+globalThis.env = {};
+if (typeof globalThis.Netlify !== "undefined") {
+  Object.assign(
+    globalThis.env,
+    globalThis.Netlify.env.toObject()
+  );
+}
+if (typeof process !== "undefined") {
+  Object.assign(globalThis.env, process.env);
 }
 
-// src/helpers/createId.ts
-var alphabet = "useandom26T198340PX75pxJACKVERYMINDBUSHWOLFGQZbfghjklqvwyzrict";
-var random = (bytes) => crypto.getRandomValues(new Uint8Array(bytes));
-var cyrb53 = (str, seed = 0) => {
-  if (typeof str !== "string") str = String(str);
-  let h1 = 3735928559 ^ seed;
-  let h2 = 1103547991 ^ seed;
-  for (let i = 0, ch; i < str.length; i++) {
-    ch = str.charCodeAt(i);
-    h1 = Math.imul(h1 ^ ch, 2654435761);
-    h2 = Math.imul(h2 ^ ch, 1597334677);
-  }
-  h1 = Math.imul(h1 ^ h1 >>> 16, 2246822507);
-  h1 ^= Math.imul(h2 ^ h2 >>> 13, 3266489909);
-  h2 = Math.imul(h2 ^ h2 >>> 16, 2246822507);
-  h2 ^= Math.imul(h1 ^ h1 >>> 13, 3266489909);
-  return 4294967296 * (2097151 & h2) + (h1 >>> 0);
-};
-var hash = (str, size) => {
-  let chars = "";
-  let num = cyrb53(str);
-  for (let i = 0; i < size; i++) {
-    if (num < alphabet.length) num = cyrb53(str, i);
-    chars += alphabet[num % alphabet.length];
-    num = Math.floor(num / alphabet.length);
-  }
-  return chars;
-};
-var randomId = (size = 16) => {
-  let id = "";
-  const bytes = random(size);
-  while (size--) {
-    id += alphabet[bytes[size] & 61];
+// src/auth/updateUser.ts
+async function updateUser(user, auth2, store) {
+  if (auth2.provider === "email") {
+    return await store.set(auth2.email, user);
   }
-  return id;
-};
-function createId(source, size = 16) {
-  if (source) return hash(source, size);
-  return randomId(size);
 }
 
-// src/helpers/createWebsocket.ts
-function createWebsocket(sockets, handlers) {
-  return {
-    message: async (socket, body) => {
-      handlers.socket?.filter((s) => s[1] === "message")?.map((s) => s[2]({ socket, sockets, body }));
-    },
-    open: (socket) => {
-      sockets.push(socket);
-      handlers.socket?.filter((s) => s[1] === "open")?.map((s) => s[2]({ socket, sockets, body: void 0 }));
-    },
-    close: (socket) => {
-      sockets.splice(sockets.indexOf(socket), 1);
-      handlers.socket?.filter((s) => s[1] === "close")?.map((s) => s[2]({ socket, sockets, body: void 0 }));
-    }
+// src/auth/providers/email.ts
+var createSession = async (user, ctx) => {
+  const { strategy, session: session2, cleanUser, redirect: redirect2 = "/user" } = ctx.options.auth;
+  user = await cleanUser(user);
+  const id = createId();
+  const provider = "email";
+  ctx.user = {
+    id,
+    strategy,
+    provider,
+    email: user.email
   };
-}
-
-// src/auth/auth.ts
-var validateToken = (authorization) => {
-  const [type2, id] = authorization.trim().split(" ");
-  if (type2.toLowerCase() !== "bearer") {
-    throw ServerError_default.AUTH_INVALID_TYPE({ type: type2 });
-  }
-  if (id.length !== 16) {
-    throw ServerError_default.AUTH_INVALID_TOKEN();
+  await session2.set(
+    id,
+    { id, strategy, provider, user: user.email },
+    { expires: "1w" }
+  );
+  if (!strategy) throw new Error(`Invalid strategy "${strategy}"`);
+  if (strategy.includes("token")) {
+    return status(201).json({ ...user, token: id });
   }
-  return id;
-};
-var validateCookie = (authorization) => {
-  if (authorization.length !== 16) {
-    throw ServerError_default.AUTH_INVALID_COOKIE();
+  if (strategy.includes("cookie")) {
+    return status(302).cookies({ authentication: id }).redirect(redirect2);
   }
-  return authorization;
-};
-var findSessionId = (ctx) => {
-  const type2 = ctx.options.auth.type;
-  if (type2.includes("token")) {
-    if (!ctx.headers.authorization) return;
-    return validateToken(ctx.headers.authorization);
+  if (strategy.includes("jwt")) {
+    throw new Error("JWT auth not supported yet");
   }
-  if (type2.includes("cookie")) {
-    if (!ctx.cookies.authentication) return;
-    return validateCookie(ctx.cookies.authentication);
+  if (strategy.includes("key")) {
+    throw new Error("Key auth not supported yet");
   }
-  throw new Error(`Invalid auth type "${type2}"`);
+  throw new Error("Unknown auth type");
 };
-async function auth(ctx) {
-  if (!ctx.options.auth) return;
-  const options = ctx.options.auth;
-  const sessionId = findSessionId(ctx);
-  if (!sessionId) return;
-  const auth3 = await options.session.get(sessionId);
-  if (!auth3) return;
-  if (!auth3.provider) throw ServerError_default.AUTH_NO_PROVIDER();
-  if (!options.provider.includes(auth3.provider)) {
-    throw ServerError_default.AUTH_INVALID_PROVIDER({
-      provider: auth3.provider,
-      valid: options.provider
-    });
-  }
-  return auth3;
+async function emailLogin(ctx) {
+  const { email, password } = ctx.body;
+  if (!email) throw ServerError_default.LOGIN_NO_EMAIL();
+  if (!/@/.test(email)) throw ServerError_default.LOGIN_INVALID_EMAIL();
+  if (!password) throw ServerError_default.LOGIN_NO_PASSWORD();
+  if (password.length < 8) throw ServerError_default.LOGIN_INVALID_PASSWORD();
+  const store = ctx.options.auth.store;
+  if (!await store.has(email)) throw ServerError_default.LOGIN_WRONG_EMAIL();
+  const user = await store.get(email);
+  const isValid = await verify(password, user.password);
+  if (!isValid) throw ServerError_default.LOGIN_WRONG_PASSWORD();
+  return createSession(user, ctx);
+}
+async function emailRegister(ctx) {
+  const { email, password, ...data } = ctx.body;
+  if (!email) throw ServerError_default.REGISTER_NO_EMAIL();
+  if (!/@/.test(email)) throw ServerError_default.REGISTER_INVALID_EMAIL();
+  if (!password) throw ServerError_default.REGISTER_NO_PASSWORD();
+  if (password.length < 8) throw ServerError_default.REGISTER_INVALID_PASSWORD();
+  const store = ctx.options.auth.store;
+  if (await store.has(email)) throw ServerError_default.REGISTER_EMAIL_EXISTS();
+  const time = (/* @__PURE__ */ new Date()).toISOString().replace(/\.[0-9]*/, "");
+  const user = {
+    id: createId(email),
+    strategy: ctx.options.auth.strategy,
+    provider: "email",
+    email,
+    password: await hash(password),
+    time,
+    ...data
+  };
+  await store.set(email, user);
+  return createSession(user, ctx);
+}
+async function emailResetPassword() {
 }
+async function emailUpdatePassword(ctx) {
+  const passwords = ctx.body;
+  const fullUser = await ctx.options.auth.store.get(ctx.user.email);
+  if (!fullUser) throw ServerError_default.AUTH_NO_USER();
+  const isValid = await verify(passwords.previous, fullUser.password);
+  if (!isValid) throw ServerError_default.LOGIN_WRONG_PASSWORD();
+  fullUser.password = await hash(passwords.updated);
+  await updateUser(fullUser, ctx.user, ctx.options.auth.store);
+  return 200;
+}
+var email_default = {
+  login: emailLogin,
+  register: emailRegister,
+  reset: emailResetPassword,
+  password: emailUpdatePassword
+};
 
 // src/reply.ts
 var Reply = class {
@@ -337,112 +286,6 @@ var file = (...args) => new Reply().file(...args);
 var redirect = (...args) => new Reply().redirect(...args);
 var view = (...args) => new Reply().view(...args);
 
-// src/auth/logout.ts
-async function logout(ctx) {
-  const { id, type: type2 } = ctx.auth;
-  await ctx.options.auth.session.del(id);
-  if (type2.includes("token")) {
-    return { token: null };
-  }
-  if (type2.includes("cookie")) {
-    return cookies({ authorization: null }).redirect("/");
-  }
-  if (type2.includes("jwt")) {
-    throw new Error("JWT auth not supported yet");
-  }
-  if (type2.includes("key")) {
-    throw new Error("Key auth not supported yet");
-  }
-  throw new Error("Unknown auth type");
-}
-
-// src/auth/updateUser.ts
-async function updateUser(user2, auth3, store) {
-  if (auth3.provider === "email") {
-    return await store.set(auth3.email, user2);
-  }
-}
-
-// src/auth/providers/email.ts
-var createSession = async (user2, ctx) => {
-  const { type: type2, session: session2, cleanUser, redirect: redirect2 = "/user" } = ctx.options.auth;
-  user2 = cleanUser(user2);
-  const id = createId();
-  const provider = "email";
-  const time = (/* @__PURE__ */ new Date()).toISOString().replace(/\.[0-9]*/, "");
-  ctx.auth = {
-    id,
-    type: type2,
-    provider,
-    user: user2.email,
-    email: user2.email,
-    time
-  };
-  await session2.set(id, ctx.auth, { expires: "1w" });
-  if (type2.includes("token")) {
-    return status(201).json({ ...user2, token: id });
-  }
-  if (type2.includes("cookie")) {
-    return status(302).cookies({ authentication: id }).redirect(redirect2);
-  }
-  if (type2.includes("jwt")) {
-    throw new Error("JWT auth not supported yet");
-  }
-  if (type2.includes("key")) {
-    throw new Error("Key auth not supported yet");
-  }
-  throw new Error("Unknown auth type");
-};
-async function emailLogin(ctx) {
-  const { email, password } = ctx.body;
-  if (!email) throw ServerError_default.LOGIN_NO_EMAIL();
-  if (!/@/.test(email)) throw ServerError_default.LOGIN_INVALID_EMAIL();
-  if (!password) throw ServerError_default.LOGIN_NO_PASSWORD();
-  if (password.length < 8) throw ServerError_default.LOGIN_INVALID_PASSWORD();
-  const store = ctx.options.auth.store;
-  if (!await store.has(email)) throw ServerError_default.LOGIN_WRONG_EMAIL();
-  const user2 = await store.get(email);
-  const isValid = await verify(password, user2.password);
-  if (!isValid) throw ServerError_default.LOGIN_WRONG_PASSWORD();
-  return createSession(user2, ctx);
-}
-async function emailRegister(ctx) {
-  const { email, password, ...data } = ctx.body;
-  if (!email) throw ServerError_default.REGISTER_NO_EMAIL();
-  if (!/@/.test(email)) throw ServerError_default.REGISTER_INVALID_EMAIL();
-  if (!password) throw ServerError_default.REGISTER_NO_PASSWORD();
-  if (password.length < 8) throw ServerError_default.REGISTER_INVALID_PASSWORD();
-  const store = ctx.options.auth.store;
-  if (await store.has(email)) throw ServerError_default.REGISTER_EMAIL_EXISTS();
-  const time = (/* @__PURE__ */ new Date()).toISOString().replace(/\.[0-9]*/, "");
-  const user2 = {
-    id: createId(email),
-    email,
-    password: await hash2(password),
-    time,
-    ...data
-  };
-  await store.set(email, user2);
-  return createSession(user2, ctx);
-}
-async function emailResetPassword() {
-}
-async function emailUpdatePassword(ctx) {
-  const { previous, updated } = ctx.body;
-  const fullUser = await ctx.options.auth.store.get(ctx.auth.user);
-  const isValid = await verify(previous, fullUser.password);
-  if (!isValid) throw ServerError_default.LOGIN_WRONG_PASSWORD();
-  fullUser.password = await hash2(updated);
-  await updateUser(fullUser, ctx.auth, ctx.options.auth.store);
-  return 200;
-}
-var email_default = {
-  login: emailLogin,
-  register: emailRegister,
-  reset: emailResetPassword,
-  password: emailUpdatePassword
-};
-
 // src/auth/providers/github.ts
 var oauth = async (code) => {
   const fch = async (url, { body, headers: headers2 = {}, ...rest } = {}) => {
@@ -481,17 +324,17 @@ var getUserProfile = async (code) => {
   return { ...profile, email };
 };
 var callback = async (ctx) => {
-  const { type: type2, cleanUser, store, session: session2, redirect: redirect2 } = ctx.options.auth;
+  const { strategy, cleanUser, store, session: session2, redirect: redirect2 } = ctx.options.auth;
   const profile = await getUserProfile(ctx.url.query.code);
-  const auth3 = {
+  const auth2 = {
     id: createId(),
-    type: type2,
+    strategy,
     provider: "github",
     user: createId(profile.email),
     email: profile.email,
     time: (/* @__PURE__ */ new Date()).toISOString().replace(/\.[0-9]*/, "")
   };
-  const user2 = cleanUser({
+  const user = cleanUser({
     id: profile.id,
     name: profile.name,
     email: profile.email,
@@ -499,18 +342,18 @@ var callback = async (ctx) => {
     location: profile.location,
     created: profile.created_at
   });
-  await store.set(auth3.user, user2);
-  await session2.set(auth3.id, auth3, { expires: "1w" });
-  if (auth3.type.includes("token")) {
-    return status(201).json({ ...user2, token: auth3.id });
+  await store.set(auth2.user, user);
+  await session2.set(auth2.id, auth2, { expires: "1w" });
+  if (auth2.strategy.includes("token")) {
+    return status(201).json({ ...user, token: auth2.id });
   }
-  if (auth3.type.includes("cookie")) {
-    return status(302).cookies({ authentication: auth3.id }).redirect(redirect2);
+  if (auth2.strategy.includes("cookie")) {
+    return status(302).cookies({ authentication: auth2.id }).redirect(redirect2);
   }
-  if (auth3.type.includes("jwt")) {
+  if (auth2.strategy.includes("jwt")) {
     throw new Error("JWT auth not supported yet");
   }
-  if (auth3.type.includes("key")) {
+  if (auth2.strategy.includes("key")) {
     throw new Error("Key auth not supported yet");
   }
   throw new Error("Unknown auth type");
@@ -520,149 +363,53 @@ var github_default = { login, callback };
 // src/auth/providers/index.ts
 var providers_default = { email: email_default, github: github_default };
 
-// src/auth/NoSession.ts
-var NoSession = class {
-};
-function createNoSession() {
-  return new Proxy(new NoSession(), {
-    get(target, key) {
-      if (target[key]) return target[key];
-      if (key === "then") return target[key];
-      if (typeof key === "symbol") return target[key];
-      throw ServerError_default.NO_STORE_READ({ key: String(key) });
-    },
-    set(target, key, value) {
-      if (target[key] || key === "then" || typeof key === "symbol") {
-        target[key] = value;
-        return true;
-      } else {
-        throw ServerError_default.NO_STORE_WRITE({ key: String(key) });
-      }
-    }
-  });
-}
-
-// src/auth/session.ts
-async function session(ctx) {
-  const store = ctx.options.session?.store;
-  if (!store) return createNoSession();
-  if (ctx.cookies.session) {
-    const session2 = await store.get(ctx.cookies.session);
-    if (session2) return session2;
-  }
-  return {};
-}
-
-// src/auth/user.ts
-async function user(ctx) {
-  if (!ctx.auth) return;
-  const user2 = await ctx.options.auth.store.get(ctx.auth.user);
-  if (!user2) throw ServerError_default.AUTH_NO_USER();
-  return ctx.options.auth.cleanUser(user2);
-}
-
-// src/auth/index.ts
-var parseOptions = (auth3, all) => {
-  if (!auth3) return null;
-  if (typeof auth3 === "string") {
-    const [type2, provider] = auth3.split(":");
-    auth3 = { type: type2, provider };
+// src/auth/parseAuthOptions.ts
+function parseAuthOptions(auth2, all) {
+  if (!auth2) return null;
+  if (typeof auth2 === "string") {
+    const [strategy, provider] = auth2.split(":");
+    auth2 = { strategy, provider };
   }
-  if (typeof auth3.type === "string") {
-    auth3.type = auth3.type.split("|").filter(Boolean);
+  if (typeof auth2.provider === "string") {
+    auth2.provider = auth2.provider.split("|").filter(Boolean);
   }
-  if (typeof auth3.provider === "string") {
-    auth3.provider = auth3.provider.split("|").filter(Boolean);
+  if (!auth2.strategy) {
+    throw new Error("Auth options needs a strategy");
   }
-  if (!auth3.type) {
-    throw new Error("Auth options needs a type");
+  if (!auth2.strategy.length) {
+    throw new Error("Auth options needs a strategy");
   }
-  if (!auth3.type.length) {
-    throw new Error("Auth options needs a type");
-  }
-  if (!auth3.provider || !auth3.provider.length) {
+  if (!auth2.provider || !auth2.provider.length) {
     throw new Error("Auth options needs a provider");
   }
-  const providerNotFound = auth3.provider.find((p) => !providers_default[p]);
+  const providerNotFound = auth2.provider.find((p) => !providers_default[p]);
   if (providerNotFound) {
     throw new Error(
       `Provider "${providerNotFound}" not found, available ones are "${Object.keys(providers_default).join('", "')}"`
     );
   }
-  if (!auth3.session && all.store) {
-    auth3.session = all.store.prefix("auth:");
+  if (!auth2.session && all.store) {
+    auth2.session = all.store.prefix("auth:");
   }
-  if (!auth3.store && all.store) {
-    auth3.store = all.store.prefix("user:");
+  if (!auth2.store && all.store) {
+    auth2.store = all.store.prefix("user:");
   }
-  if (!auth3.cleanUser) {
-    auth3.cleanUser = (fullUser) => {
-      const { password: _password, ...user2 } = fullUser;
-      return user2;
+  if (!auth2.cleanUser) {
+    auth2.cleanUser = (fullUser) => {
+      const { password: _password, ...user } = fullUser;
+      return user;
     };
   }
-  if (!auth3.redirect) {
-    auth3.redirect = "/user";
-  }
-  return auth3;
-};
-var load = async (ctx) => {
-  ctx.session = await session(ctx);
-  ctx.auth = await auth(ctx);
-  ctx.user = await user(ctx);
-};
-var middle = async (ctx) => {
-  if (ctx.options.auth) {
-    if (ctx.options.auth.provider.includes("github")) {
-      if (!env.GITHUB_ID) throw new Error("GITHUB_ID not defined");
-      if (!env.GITHUB_SECRET) throw new Error("GITHUB_SECRET not defined");
-      ctx.app.get(
-        "/auth/logout",
-        { tags: "Auth", title: "Github logout" },
-        logout
-      );
-      ctx.app.get(
-        "/auth/login/github",
-        { tags: "Auth" },
-        providers_default.github.login
-      );
-      ctx.app.get(
-        "/auth/callback/github",
-        { tags: "Auth", title: "Github callback" },
-        providers_default.github.callback
-      );
-    }
-    if (ctx.options.auth.provider.includes("email")) {
-      ctx.app.post("/auth/logout", { tags: "Auth" }, logout);
-      ctx.app.post(
-        "/auth/register/email",
-        { tags: "Auth" },
-        providers_default.email.register
-      );
-      ctx.app.post(
-        "/auth/login/email",
-        { tags: "Auth" },
-        providers_default.email.login
-      );
-      ctx.app.put(
-        "/auth/password/email",
-        { tags: "Auth" },
-        providers_default.email.password
-      );
-      ctx.app.put(
-        "/auth/reset/email",
-        { tags: "Auth" },
-        providers_default.email.reset
-      );
-    }
+  if (!auth2.redirect) {
+    auth2.redirect = "/user";
   }
-};
-var auth_default = { load, parseOptions, middle };
+  return auth2;
+}
 
 // src/helpers/bucket.ts
 import * as fs from "fs";
-import * as path from "path";
 import * as fsp from "fs/promises";
+import * as path from "path";
 function thinLocalBucket(root) {
   const absolute = (name) => {
     if (!name) throw new Error("File name is required");
@@ -737,6 +484,47 @@ function bucket_default(root) {
   return root;
 }
 
+// src/helpers/createId.ts
+var alphabet = "useandom26T198340PX75pxJACKVERYMINDBUSHWOLFGQZbfghjklqvwyzrict";
+var random = (bytes) => crypto.getRandomValues(new Uint8Array(bytes));
+var cyrb53 = (str, seed = 0) => {
+  if (typeof str !== "string") str = String(str);
+  let h1 = 3735928559 ^ seed;
+  let h2 = 1103547991 ^ seed;
+  for (let i = 0, ch; i < str.length; i++) {
+    ch = str.charCodeAt(i);
+    h1 = Math.imul(h1 ^ ch, 2654435761);
+    h2 = Math.imul(h2 ^ ch, 1597334677);
+  }
+  h1 = Math.imul(h1 ^ h1 >>> 16, 2246822507);
+  h1 ^= Math.imul(h2 ^ h2 >>> 13, 3266489909);
+  h2 = Math.imul(h2 ^ h2 >>> 16, 2246822507);
+  h2 ^= Math.imul(h1 ^ h1 >>> 13, 3266489909);
+  return 4294967296 * (2097151 & h2) + (h1 >>> 0);
+};
+var hash2 = (str, size) => {
+  let chars = "";
+  let num = cyrb53(str);
+  for (let i = 0; i < size; i++) {
+    if (num < alphabet.length) num = cyrb53(str, i);
+    chars += alphabet[num % alphabet.length];
+    num = Math.floor(num / alphabet.length);
+  }
+  return chars;
+};
+var randomId = (size = 16) => {
+  let id = "";
+  const bytes = random(size);
+  while (size--) {
+    id += alphabet[bytes[size] & 61];
+  }
+  return id;
+};
+function createId(source, size = 16) {
+  if (source) return hash2(source, size);
+  return randomId(size);
+}
+
 // src/helpers/color.ts
 var map = {
   reset: 0,
@@ -846,7 +634,9 @@ function config(options = {}) {
     (session2) => session2?.store?.name || "working",
     "\u{1F510}"
   );
-  settings.auth = auth_default.parseOptions(options.auth || env2.AUTH || null, options);
+  if (options.auth || env2.AUTH) {
+    settings.auth = parseAuthOptions(options.auth || env2.AUTH || null, options);
+  }
   if (options.openapi) {
     if (options.openapi === true) {
       settings.openapi = {};
@@ -869,6 +659,40 @@ function cors(config2, origin = "") {
   return null;
 }
 
+// src/helpers/createCookies.ts
+function createCookies(cookies2) {
+  if (!cookies2 || !Object.keys(cookies2).length) return [];
+  return Object.entries(cookies2).map(([key, val]) => {
+    if (!val) {
+      val = { value: "", expires: (/* @__PURE__ */ new Date(0)).toUTCString() };
+    }
+    if (typeof val === "string") {
+      val = { value: val };
+    }
+    const { value, path: path2, expires } = val;
+    const pathPart = `;Path=${path2 || "/"}`;
+    const expiresPart = expires ? `;Expires=${expires}` : "";
+    return `${key}=${value || ""}${pathPart}${expiresPart}`;
+  });
+}
+
+// src/helpers/createWebsocket.ts
+function createWebsocket(sockets, handlers) {
+  return {
+    message: async (socket, body) => {
+      handlers.socket?.filter((s) => s[1] === "message")?.map((s) => s[2]({ socket, sockets, body }));
+    },
+    open: (socket) => {
+      sockets.push(socket);
+      handlers.socket?.filter((s) => s[1] === "open")?.map((s) => s[2]({ socket, sockets, body: void 0 }));
+    },
+    close: (socket) => {
+      sockets.splice(sockets.indexOf(socket), 1);
+      handlers.socket?.filter((s) => s[1] === "close")?.map((s) => s[2]({ socket, sockets, body: void 0 }));
+    }
+  };
+}
+
 // src/helpers/define.ts
 function define(obj, key, cb) {
   Object.defineProperty(obj, key, {
@@ -990,6 +814,7 @@ async function parseResponse(out, ctx) {
 
 // src/pathPattern.ts
 function pathPattern(pattern, path2) {
+  if (pattern === "*" && path2 === "/") return {};
   pattern = `/${pattern.replace(/^\//, "")}`;
   pattern = pattern.replace(/\/$/, "") || "/";
   path2 = path2.replace(/\/$/, "") || "/";
@@ -1062,7 +887,9 @@ function validate(ctx, schema) {
     }
   } catch (error) {
     if (error.name === "ZodError" || error.constructor.name === "ZodError") {
-      const message = error.issues.map(({ path: path2, message: message2 }) => `[${base}.${path2.join(".")}]: ${message2}`).sort().join("\n");
+      const message = error.issues.map(
+        ({ path: path2, message: message2 }) => `[${base}.${path2.join(".")}]: ${message2}`
+      ).sort().join("\n");
       throw new StatusError(message, 422);
     }
     throw error;
@@ -1072,9 +899,6 @@ function validate(ctx, schema) {
 // src/helpers/handleRequest.ts
 async function handleRequest(handlers, ctx) {
   try {
-    if (ctx.error) {
-      throw ctx.error;
-    }
     for (const [method, matcher, ...cbs] of handlers[ctx.method]) {
       const match = pathPattern(matcher, ctx.url.pathname || "/");
       if (!match) continue;
@@ -1090,7 +914,7 @@ async function handleRequest(handlers, ctx) {
       }
       if (method !== "*") break;
     }
-    if (ctx.machine?.provider === "netlify") return;
+    if (ctx.platform.provider === "netlify") return;
     return new Response("Not Found", { status: 404 });
   } catch (error) {
     return new Response(error.message || "", { status: error.status || 500 });
@@ -1101,7 +925,7 @@ async function handleRequest(handlers, ctx) {
 import * as crypto2 from "crypto";
 import { getRandomValues } from "crypto";
 import { promisify } from "util";
-async function hash2(password) {
+async function hash(password) {
   if ("argon2" in crypto2) {
     const argon23 = promisify(crypto2.argon2);
     const buf = await argon23("argon2id", {
@@ -1131,18 +955,6 @@ async function iterate(stream, cb) {
   }
 }
 
-// src/helpers/iteratorToReadable.ts
-function iteratorToReadable(generator) {
-  return new ReadableStream({
-    async start(controller) {
-      for await (const chunk of generator) {
-        controller.enqueue(chunk);
-      }
-      controller.close();
-    }
-  });
-}
-
 // src/helpers/iteratorAsyncToReadable.ts
 function iteratorAsyncToReadable(asyncGenerator) {
   return new ReadableStream({
@@ -1165,6 +977,116 @@ function iteratorAsyncToReadable(asyncGenerator) {
   });
 }
 
+// src/helpers/iteratorToReadable.ts
+function iteratorToReadable(generator) {
+  return new ReadableStream({
+    async start(controller) {
+      for await (const chunk of generator) {
+        controller.enqueue(chunk);
+      }
+      controller.close();
+    }
+  });
+}
+
+// src/helpers/parseBody.ts
+function getBoundary(header) {
+  if (!header) return null;
+  if (header.includes("multipart/form-data") && !header.includes("boundary=")) {
+    console.error("Do not set the `Content-Type` manually for FormData");
+  }
+  const items = header.split(";");
+  for (const item of items) {
+    const trimmedItem = item.trim();
+    if (trimmedItem.startsWith("boundary=")) {
+      return trimmedItem.split("=")[1].trim();
+    }
+  }
+  return null;
+}
+function getMatching(string, regex) {
+  const matches = string.match(regex);
+  return matches?.[1] ?? "";
+}
+var saveFile = async (name, value, bucket) => {
+  const ext = name.split(".").pop();
+  const id = `${createId()}.${ext}`;
+  await bucket.write(id, value);
+  return id;
+};
+function splitBuffer(buffer, delimiter) {
+  const result = [];
+  let start = 0;
+  let index = buffer.indexOf(delimiter);
+  while (index !== -1) {
+    result.push(buffer.slice(start, index));
+    start = index + delimiter.length;
+    index = buffer.indexOf(delimiter, start);
+  }
+  result.push(buffer.slice(start));
+  return result;
+}
+var BREAK_BUFFER = Buffer.from("\r\n\r\n");
+function isProbablyText(buffer) {
+  for (let i = 0; i < Math.min(buffer.length, 512); i++) {
+    const byte = buffer[i];
+    if (byte === 0) return false;
+    if (byte < 7 || byte > 13 && byte < 32) return false;
+  }
+  return true;
+}
+async function parseBody(raw, contentType, bucket) {
+  const contentTypeStr = Array.isArray(contentType) ? contentType[0] : contentType;
+  if (!raw) return {};
+  if (!contentTypeStr || /^text\//.test(contentTypeStr)) {
+    return raw.toString("utf-8");
+  }
+  if (/application\/json/.test(contentTypeStr)) {
+    return JSON.parse(raw.toString("utf-8"));
+  }
+  const boundary = getBoundary(contentTypeStr);
+  if (!boundary) return null;
+  const body = {};
+  const boundaryBuffer = Buffer.from(`--${boundary}`);
+  const parts = splitBuffer(raw, boundaryBuffer);
+  for (const part of parts) {
+    if (part.length === 0 || part.equals(Buffer.from("--\r\n"))) continue;
+    const idx = part.indexOf(BREAK_BUFFER);
+    if (idx === -1) continue;
+    const headerStr = part.slice(0, idx).toString("utf-8");
+    const contentBuf = part.slice(idx + BREAK_BUFFER.length, part.length - 2);
+    const name = getMatching(headerStr, /name="(.+?)"/).trim().replace(/\[\]$/, "");
+    if (!name) continue;
+    const filename = getMatching(headerStr, /filename="(.+?)"/).trim();
+    if (filename) {
+      if (!bucket) throw new Error("Bucket is required to save files");
+      body[name] = await saveFile(filename, contentBuf, bucket);
+    } else {
+      const value = isProbablyText(contentBuf) ? contentBuf.toString("utf-8").trim() : contentBuf;
+      if (body[name]) {
+        if (!Array.isArray(body[name])) body[name] = [body[name]];
+        body[name].push(value);
+      } else {
+        body[name] = value;
+      }
+    }
+  }
+  return body;
+}
+
+// src/helpers/parseCookies.ts
+function parseCookies(cookies2) {
+  if (!cookies2) return {};
+  const cookieStr = Array.isArray(cookies2) ? cookies2[0] : cookies2;
+  if (!cookieStr) return {};
+  return Object.fromEntries(
+    cookieStr.split(/;\s*/).map((part) => {
+      const [key, ...rest] = part.split("=");
+      return [key, decodeURIComponent(rest.join("="))];
+    })
+  );
+}
+
 // src/helpers/parseHeaders.ts
 var parseHeaders_default = (raw) => {
   const headers2 = {};
@@ -1328,34 +1250,117 @@ async function verify(password, hash3) {
   });
 }
 
-// src/middle/assets.ts
-async function assets(ctx) {
-  if (!ctx.options.public) return;
-  if (ctx.method !== "get") return;
-  if (ctx.url.pathname === "/") return;
-  try {
-    const asset = await ctx.options.public.read(ctx.url.pathname);
-    if (!asset) return;
-    return type(ctx.url.pathname.split(".").pop()).send(asset);
-  } catch {
+// src/auth/findSessionId.ts
+var validateToken = (authorization) => {
+  const [type2, id] = authorization.trim().split(" ");
+  if (type2.toLowerCase() !== "bearer") {
+    throw ServerError_default.AUTH_INVALID_HEADER({ type: type2 });
+  }
+  if (id.length !== 16) {
+    throw ServerError_default.AUTH_INVALID_TOKEN();
+  }
+  return id;
+};
+var validateCookie = (authorization) => {
+  if (authorization.length !== 16) {
+    throw ServerError_default.AUTH_INVALID_COOKIE();
+  }
+  return authorization;
+};
+function findSessionId(ctx) {
+  const strategy = ctx.options.auth.strategy;
+  if (!strategy) throw new Error(`Invalid strategy "${strategy}"`);
+  if (strategy.includes("token")) {
+    if (!ctx.headers.authorization) return;
+    return validateToken(ctx.headers.authorization);
+  }
+  if (strategy.includes("cookie")) {
+    if (!ctx.cookies.authentication) return;
+    return validateCookie(ctx.cookies.authentication);
   }
+  throw new Error(`Invalid auth type "${strategy}"`);
 }
 
-// src/middle/timer.ts
-var createTime = () => {
-  const times = [["init", performance.now()]];
-  const time = (name) => times.push([name, performance.now()]);
-  time.times = times;
-  time.headers = () => {
-    const r = (t) => Math.round(t);
-    const times2 = time.times;
-    const timing = times2.slice(1).map(([name, time2], i) => `${name};dur=${r(time2 - times2[i][1])}`).join(", ");
-    return timing;
-  };
-  return time;
-};
-function timer(ctx) {
-  ctx.time = createTime();
+// src/auth/getUser.ts
+async function getUser(ctx) {
+  if (!ctx.options.auth) return;
+  const options = ctx.options.auth;
+  const sessionId = findSessionId(ctx);
+  if (!sessionId) return;
+  const auth2 = await options.session.get(sessionId);
+  if (!auth2) return;
+  if (options.strategy !== auth2.strategy) {
+    throw ServerError_default.AUTH_INVALID_STRATEGY({
+      strategy: auth2.strategy || "undefined",
+      valid: options.strategy
+    });
+  }
+  if (!options.provider.includes(auth2.provider)) {
+    throw ServerError_default.AUTH_INVALID_PROVIDER({
+      provider: auth2.provider,
+      valid: options.provider
+    });
+  }
+  const user = await ctx.options.auth.store.get(auth2.user);
+  if (!user) throw ServerError_default.AUTH_NO_USER();
+  user.strategy = auth2.strategy;
+  user.provider = auth2.provider;
+  return ctx.options.auth.cleanUser(user);
+}
+
+// src/auth/logout.ts
+async function logout(ctx) {
+  const session2 = findSessionId(ctx);
+  const { strategy } = ctx.user;
+  await ctx.options.auth.session.del(session2);
+  if (!strategy) throw new Error(`Invalid strategy "${strategy}"`);
+  if (strategy.includes("token")) {
+    return { token: null };
+  }
+  if (strategy.includes("cookie")) {
+    return cookies({ authorization: null }).redirect("/");
+  }
+  if (strategy.includes("jwt")) {
+    throw new Error("JWT auth not supported yet");
+  }
+  if (strategy.includes("key")) {
+    throw new Error("Key auth not supported yet");
+  }
+  throw new Error("Unknown auth type");
+}
+
+// src/auth/index.ts
+function auth(app) {
+  app.use(async function middle(ctx) {
+    ctx.user = await getUser(ctx);
+  });
+  if (app.settings.auth.provider.includes("github")) {
+    if (!env.GITHUB_ID) throw new Error("GITHUB_ID not defined");
+    if (!env.GITHUB_SECRET) throw new Error("GITHUB_SECRET not defined");
+    app.get("/auth/logout", logout);
+    app.get("/auth/login/github", providers_default.github.login);
+    app.get("/auth/callback/github", providers_default.github.callback);
+  }
+  if (app.settings.auth.provider.includes("email")) {
+    app.post("/auth/logout", logout);
+    app.post("/auth/register/email", providers_default.email.register);
+    app.post("/auth/login/email", providers_default.email.login);
+    app.put("/auth/password/email", providers_default.email.password);
+    app.put("/auth/reset/email", providers_default.email.reset);
+  }
+}
+
+// src/middle/assets.ts
+async function assets(ctx) {
+  if (!ctx.options.public) return;
+  if (ctx.method !== "get") return;
+  if (ctx.url.pathname === "/") return;
+  try {
+    const asset = await ctx.options.public.read(ctx.url.pathname);
+    if (!asset) return;
+    return type(ctx.url.pathname.split(".").pop()).send(asset);
+  } catch {
+  }
 }
 
 // src/middle/openapi.ts
@@ -1520,10 +1525,205 @@ var openapi_default = async (ctx) => {
 </html> `;
 };
 
-// src/middle/index.ts
-var auth2 = auth_default.middle;
+// src/middle/timer.ts
+var createTime = () => {
+  const times = [["init", performance.now()]];
+  const time = (name) => times.push([name, performance.now()]);
+  time.times = times;
+  time.headers = () => {
+    const r = (t) => Math.round(t);
+    const times2 = time.times;
+    const timing = times2.slice(1).map(([name, time2], i) => `${name};dur=${r(time2 - times2[i][1])}`).join(", ");
+    return timing;
+  };
+  return time;
+};
+function timer(ctx) {
+  ctx.time = createTime();
+}
+
+// src/auth/NoSession.ts
+var NoSession = class {
+};
+function createNoSession() {
+  return new Proxy(NoSession, {
+    get(target, key) {
+      if (target[key]) return target[key];
+      if (key === "then") return target[key];
+      if (typeof key === "symbol") return target[key];
+      throw ServerError_default.NO_STORE_READ({ key: String(key) });
+    },
+    set(target, key, value) {
+      if (target[key] || key === "then" || typeof key === "symbol") {
+        target[key] = value;
+        return true;
+      }
+      throw ServerError_default.NO_STORE_WRITE({ key: String(key) });
+    }
+  });
+}
+
+// src/auth/session.ts
+async function session(ctx) {
+  const store = ctx.options.session?.store;
+  if (!store) {
+    ctx.session = createNoSession();
+    return;
+  }
+  if (ctx.cookies.session) {
+    const session2 = await store.get(ctx.cookies.session);
+    ctx.session = session2;
+    return;
+  }
+}
+
+// src/context/node.ts
+import { TLSSocket } from "tls";
+
+// src/context/createEvents.ts
+function createEvents() {
+  const events = {};
+  events.on = (name, callback2) => {
+    events[name] = events[name] || [];
+    events[name].push(callback2);
+  };
+  events.trigger = (name, data) => {
+    if (!events[name]) return;
+    for (const cb of events[name]) {
+      cb(data);
+    }
+  };
+  return events;
+}
+
+// src/context/isValidMethod.ts
+var methods = [
+  "get",
+  "post",
+  "put",
+  "patch",
+  "delete",
+  "head",
+  "options",
+  "socket"
+];
+function isValidMethod(method) {
+  return methods.includes(method);
+}
+
+// src/context/node.ts
+var chunkArray = (arr) => arr.length > 2 ? [[arr[0], arr[1]], ...chunkArray(arr.slice(2))] : [arr];
+async function createNode(req, app) {
+  const init = performance.now();
+  const method = req.method?.toLowerCase() || "get";
+  if (!isValidMethod(method)) {
+    throw new Error(`Invalid HTTP method: ${method}`);
+  }
+  const chunks = chunkArray(req.rawHeaders);
+  const headers2 = parseHeaders_default(new Headers(chunks));
+  const cookies2 = parseCookies(headers2.cookie);
+  const scheme = req.socket instanceof TLSSocket ? "https" : "http";
+  const host = headers2.host || `localhost:${app.settings.port}`;
+  const path2 = (req.url || "/").replace(/\/$/, "") || "/";
+  const baseUrl = `${scheme}://${host}`;
+  const url = new URL(path2, baseUrl);
+  define(
+    url,
+    "query",
+    (url2) => Object.fromEntries(url2.searchParams.entries())
+  );
+  const rawBody = await new Promise((resolve2, reject) => {
+    const body2 = [];
+    req.on("data", (chunk) => body2.push(chunk)).on("end", () => resolve2(Buffer.concat(body2))).on("error", reject);
+  });
+  const body = rawBody ? await parseBody(rawBody, headers2["content-type"], app.settings.uploads) : void 0;
+  const events = createEvents();
+  return {
+    options: app.settings,
+    platform: app.platform,
+    url,
+    method,
+    body,
+    headers: headers2,
+    cookies: cookies2,
+    init,
+    events,
+    app
+  };
+}
+
+// src/context/winter.ts
+async function createWinter(req, app) {
+  const init = performance.now();
+  const method = req.method.toLowerCase();
+  if (!isValidMethod(method)) {
+    throw new Error(`Invalid HTTP method: ${method}`);
+  }
+  const headers2 = parseHeaders_default(req.headers);
+  const cookies2 = parseCookies(headers2.cookie);
+  const baseUrl = req.url.replace(/\/$/, "") || "/";
+  const url = new URL(baseUrl);
+  define(
+    url,
+    "query",
+    (url2) => Object.fromEntries(url2.searchParams.entries())
+  );
+  const rawBody = Buffer.from(await req.arrayBuffer());
+  const body = req.body ? await parseBody(rawBody, headers2["content-type"], app.settings.uploads) : void 0;
+  const events = createEvents();
+  return {
+    options: app.settings,
+    platform: app.platform,
+    url,
+    method,
+    body,
+    headers: headers2,
+    cookies: cookies2,
+    init,
+    events,
+    app
+  };
+}
+
+// src/context/handlers.ts
+var Winter = async (app, request, env3) => {
+  if (env3?.upgrade(request)) return;
+  Object.assign(globalThis.env, env3);
+  const ctx = await createWinter(request, app);
+  const res = await handleRequest(app.handlers, ctx);
+  ctx.events.trigger("finish", { ...ctx, res, end: performance.now() });
+  return res;
+};
+var Node = async (app) => {
+  const http = await import("http");
+  http.createServer(async (request, response) => {
+    const ctx = await createNode(request, app);
+    if ("error" in ctx) throw ctx.error;
+    const out = await handleRequest(app.handlers, ctx);
+    response.writeHead(out.status || 200, parseHeaders_default(out.headers));
+    if (out.body instanceof ReadableStream) {
+      await iterate(out.body, (chunk) => response.write(chunk));
+    } else {
+      response.write(out.body || "");
+    }
+    response.end();
+  }).listen(app.settings.port);
+};
+var Netlify = async (app, request, context) => {
+  request.context = context;
+  if (typeof Netlify === "undefined") {
+    throw new Error("Netlify doesn't exist");
+  }
+  const ctx = await createWinter(request, app);
+  const res = await handleRequest(app.handlers, ctx);
+  ctx.events.trigger("finish", { ...ctx, res, end: performance.now() });
+  return res;
+};
 
 // src/router.ts
+function isMiddleware(x) {
+  return typeof x === "function";
+}
 var Router = class _Router {
   handlers = {
     socket: [],
@@ -1545,35 +1745,59 @@ var Router = class _Router {
       middleware.unshift(path2);
       path2 = "*";
     }
-    const methods = method === "*" ? Object.keys(this.handlers) : [method];
-    for (const m of methods) {
+    const methods2 = method === "*" ? Object.keys(this.handlers) : [method];
+    for (const m of methods2) {
       this.handlers[m].push([method, path2, ...middleware]);
     }
     return this.self();
   }
-  socket(path2, ...middleware) {
-    return this.handle("socket", path2, ...middleware);
+  socket(pathOrMid, optionsOrMid, ...middleware) {
+    if (typeof pathOrMid === "string" && isMiddleware(optionsOrMid)) {
+      return this.handle("socket", pathOrMid, optionsOrMid, ...middleware);
+    }
+    return this.handle("socket", pathOrMid, ...middleware);
   }
-  get(path2, ...middleware) {
-    return this.handle("get", path2, ...middleware);
+  get(pathOrMid, optionsOrMid, ...middleware) {
+    if (typeof pathOrMid === "string" && isMiddleware(optionsOrMid)) {
+      return this.handle("get", pathOrMid, optionsOrMid, ...middleware);
+    }
+    return this.handle("get", pathOrMid, ...middleware);
   }
-  head(path2, ...middleware) {
-    return this.handle("head", path2, ...middleware);
+  head(pathOrMid, optionsOrMid, ...middleware) {
+    if (typeof pathOrMid === "string" && isMiddleware(optionsOrMid)) {
+      return this.handle("head", pathOrMid, optionsOrMid, ...middleware);
+    }
+    return this.handle("head", pathOrMid, ...middleware);
   }
-  post(path2, ...middleware) {
-    return this.handle("post", path2, ...middleware);
+  post(pathOrMid, optionsOrMid, ...middleware) {
+    if (typeof pathOrMid === "string" && isMiddleware(optionsOrMid)) {
+      return this.handle("post", pathOrMid, optionsOrMid, ...middleware);
+    }
+    return this.handle("post", pathOrMid, ...middleware);
   }
-  put(path2, ...middleware) {
-    return this.handle("put", path2, ...middleware);
+  put(pathOrMid, optionsOrMid, ...middleware) {
+    if (typeof pathOrMid === "string" && isMiddleware(optionsOrMid)) {
+      return this.handle("put", pathOrMid, optionsOrMid, ...middleware);
+    }
+    return this.handle("put", pathOrMid, ...middleware);
   }
-  patch(path2, ...middleware) {
-    return this.handle("patch", path2, ...middleware);
+  patch(pathOrMid, optionsOrMid, ...middleware) {
+    if (typeof pathOrMid === "string" && isMiddleware(optionsOrMid)) {
+      return this.handle("patch", pathOrMid, optionsOrMid, ...middleware);
+    }
+    return this.handle("patch", pathOrMid, ...middleware);
   }
-  del(path2, ...middleware) {
-    return this.handle("delete", path2, ...middleware);
+  del(pathOrMid, optionsOrMid, ...middleware) {
+    if (typeof pathOrMid === "string" && isMiddleware(optionsOrMid)) {
+      return this.handle("delete", pathOrMid, optionsOrMid, ...middleware);
+    }
+    return this.handle("delete", pathOrMid, ...middleware);
   }
-  options(path2, ...middleware) {
-    return this.handle("options", path2, ...middleware);
+  options(pathOrMid, optionsOrMid, ...middleware) {
+    if (typeof pathOrMid === "string" && isMiddleware(optionsOrMid)) {
+      return this.handle("options", pathOrMid, optionsOrMid, ...middleware);
+    }
+    return this.handle("options", pathOrMid, ...middleware);
   }
   use(...args) {
     const path2 = typeof args[0] === "string" ? args.shift() : "*";
@@ -1601,6 +1825,10 @@ function isSerializable(body) {
   if (typeof body === "string") return false;
   if (body instanceof ReadableStream) return false;
   if (body instanceof FormData) return false;
+  if (body instanceof Blob) return false;
+  if (body instanceof ArrayBuffer) return false;
+  if (ArrayBuffer.isView(body)) return false;
+  if (body instanceof URLSearchParams) return false;
   return true;
 }
 function ServerTest(app) {
@@ -1641,297 +1869,14 @@ function ServerTest(app) {
   };
 }
 
-// src/context/parseBody.ts
-function getBoundary(header) {
-  if (!header) return null;
-  if (header.includes("multipart/form-data") && !header.includes("boundary=")) {
-    console.error("Do not set the `Content-Type` manually for FormData");
-  }
-  const items = header.split(";");
-  for (const item of items) {
-    const trimmedItem = item.trim();
-    if (trimmedItem.startsWith("boundary=")) {
-      return trimmedItem.split("=")[1].trim();
-    }
-  }
-  return null;
-}
-function getMatching(string, regex) {
-  const matches = string.match(regex);
-  return matches?.[1] ?? "";
-}
-var saveFile = async (name, value, bucket) => {
-  const ext = name.split(".").pop();
-  const id = `${createId()}.${ext}`;
-  await bucket.write(id, value);
-  return id;
-};
-function splitBuffer(buffer, delimiter) {
-  const result = [];
-  let start = 0;
-  let index = buffer.indexOf(delimiter);
-  while (index !== -1) {
-    result.push(buffer.slice(start, index));
-    start = index + delimiter.length;
-    index = buffer.indexOf(delimiter, start);
-  }
-  result.push(buffer.slice(start));
-  return result;
-}
-var BREAK_BUFFER = Buffer.from("\r\n\r\n");
-function isProbablyText(buffer) {
-  for (let i = 0; i < Math.min(buffer.length, 512); i++) {
-    const byte = buffer[i];
-    if (byte === 0) return false;
-    if (byte < 7 || byte > 13 && byte < 32) return false;
-  }
-  return true;
-}
-async function parseBody(raw, contentType, bucket) {
-  const contentTypeStr = Array.isArray(contentType) ? contentType[0] : contentType;
-  let rawBuffer;
-  if (raw instanceof Buffer) {
-    rawBuffer = raw;
-  } else if ("arrayBuffer" in raw && typeof raw.arrayBuffer === "function") {
-    const arrayBuf = await raw.arrayBuffer();
-    rawBuffer = Buffer.from(arrayBuf);
-  } else {
-    throw new Error("Unsupported raw type");
-  }
-  if (!rawBuffer) return {};
-  if (!contentTypeStr || /text\/plain/.test(contentTypeStr)) {
-    return rawBuffer.toString("utf-8");
-  }
-  if (/application\/json/.test(contentTypeStr)) {
-    return JSON.parse(rawBuffer.toString("utf-8"));
-  }
-  const boundary = getBoundary(contentTypeStr);
-  if (!boundary) return null;
-  const body = {};
-  const boundaryBuffer = Buffer.from(`--${boundary}`);
-  const parts = splitBuffer(rawBuffer, boundaryBuffer);
-  for (const part of parts) {
-    if (part.length === 0 || part.equals(Buffer.from("--\r\n"))) continue;
-    const idx = part.indexOf(BREAK_BUFFER);
-    if (idx === -1) continue;
-    const headerStr = part.slice(0, idx).toString("utf-8");
-    const contentBuf = part.slice(idx + BREAK_BUFFER.length, part.length - 2);
-    const name = getMatching(headerStr, /name="(.+?)"/).trim().replace(/\[\]$/, "");
-    if (!name) continue;
-    const filename = getMatching(headerStr, /filename="(.+?)"/).trim();
-    if (filename) {
-      if (!bucket) throw new Error("Bucket is required to save files");
-      body[name] = await saveFile(filename, contentBuf, bucket);
-    } else {
-      const value = isProbablyText(contentBuf) ? contentBuf.toString("utf-8").trim() : contentBuf;
-      if (body[name]) {
-        if (!Array.isArray(body[name])) body[name] = [body[name]];
-        body[name].push(value);
-      } else {
-        body[name] = value;
-      }
-    }
-  }
-  return body;
-}
-
-// src/context/parseCookies.ts
-function parseCookies(cookies2) {
-  if (!cookies2) return {};
-  const cookieStr = Array.isArray(cookies2) ? cookies2[0] : cookies2;
-  if (!cookieStr) return {};
-  return Object.fromEntries(
-    cookieStr.split(/;\s*/).map((part) => {
-      const [key, ...rest] = part.split("=");
-      return [key, decodeURIComponent(rest.join("="))];
-    })
-  );
-}
-
-// src/context/winter.ts
-function isValidMethod(method) {
-  return [
-    "get",
-    "post",
-    "put",
-    "patch",
-    "delete",
-    "head",
-    "options",
-    "socket"
-  ].includes(method);
-}
-var winter_default = async (request, app) => {
-  try {
-    const ctx = {
-      headers: {},
-      cookies: {},
-      url: void 0,
-      options: app.settings || {},
-      method: "get",
-      init: performance.now(),
-      req: request
-    };
-    const method = request.method.toLowerCase();
-    if (!isValidMethod(method)) {
-      throw new Error(`Invalid HTTP method: ${method}`);
-    }
-    ctx.method = method;
-    const events = {};
-    ctx.on = (name, callback2) => {
-      events[name] = events[name] || [];
-      events[name].push(callback2);
-    };
-    ctx.trigger = (name, data) => {
-      if (!events[name]) return;
-      for (const cb of events[name]) {
-        cb(data);
-      }
-    };
-    ctx.headers = parseHeaders_default(request.headers);
-    ctx.cookies = parseCookies(ctx.headers.cookie);
-    await auth_default.load(ctx);
-    ctx.url = new URL(request.url.replace(/\/$/, ""));
-    define(
-      ctx.url,
-      "query",
-      (url) => Object.fromEntries(url.searchParams.entries())
-    );
-    if (request.body) {
-      const type2 = ctx.headers["content-type"];
-      ctx.body = await parseBody(request, type2, ctx.options.uploads);
-    }
-    ctx.app = app;
-    ctx.platform = app.platform;
-    ctx.machine = app.platform;
-    return ctx;
-  } catch (error) {
-    return { error };
-  }
-};
-
-// src/context/node.ts
-function isValidMethod2(method) {
-  return [
-    "get",
-    "post",
-    "put",
-    "patch",
-    "delete",
-    "head",
-    "options",
-    "socket"
-  ].includes(method);
-}
-var chunkArray = (arr, size) => arr.length > size ? [arr.slice(0, size), ...chunkArray(arr.slice(size), size)] : [arr];
-var node_default = async (request, app) => {
-  try {
-    const ctx = {
-      headers: {},
-      cookies: {},
-      url: void 0,
-      options: app.settings || {},
-      method: "get",
-      req: request
-    };
-    const method = request.method?.toLowerCase() || "get";
-    if (!isValidMethod2(method)) {
-      throw new Error(`Invalid HTTP method: ${method}`);
-    }
-    ctx.method = method;
-    const events = {};
-    ctx.on = (name, callback2) => {
-      events[name] = events[name] || [];
-      events[name].push(callback2);
-    };
-    ctx.trigger = (name, data) => {
-      if (!events[name]) return;
-      for (const cb of events[name]) {
-        cb(data);
-      }
-    };
-    ctx.headers = parseHeaders_default(
-      new Headers(chunkArray(request.rawHeaders, 2))
-    );
-    ctx.cookies = parseCookies(ctx.headers.cookie);
-    await auth_default.load(ctx);
-    const https = request.connection?.encrypted ? "https" : "http";
-    const host = ctx.headers.host || `localhost:${ctx.options.port}`;
-    const path2 = (request.url || "/").replace(/\/$/, "") || "/";
-    ctx.url = new URL(path2, `${https}://${host}`);
-    define(
-      ctx.url,
-      "query",
-      (url) => Object.fromEntries(url.searchParams.entries())
-    );
-    await new Promise((resolve2, reject) => {
-      const body = [];
-      request.on("data", (chunk) => {
-        body.push(chunk);
-      }).on("end", async () => {
-        const type2 = ctx.headers["content-type"];
-        const concatenated = Buffer.concat(body);
-        ctx.body = await parseBody(concatenated, type2, ctx.options.uploads);
-        resolve2();
-      }).on("error", reject);
-    });
-    ctx.app = app;
-    ctx.platform = app.platform;
-    ctx.machine = app.platform;
-    return ctx;
-  } catch (error) {
-    return { error };
-  }
-};
-
-// src/context/handlers.ts
-var Winter = async (app, request, env3) => {
-  if (env3?.upgrade(request)) return;
-  Object.assign(globalThis.env, env3);
-  const ctx = await winter_default(request, app);
-  if ("error" in ctx) {
-    throw ctx.error;
-  }
-  const res = await handleRequest(app.handlers, ctx);
-  ctx.trigger("finish", { ...ctx, res, end: performance.now() });
-  return res;
-};
-var Node = async (app) => {
-  const http = await import("http");
-  http.createServer(async (request, response) => {
-    const ctx = await node_default(request, app);
-    if ("error" in ctx) {
-      throw ctx.error;
-    }
-    const out = await handleRequest(app.handlers, ctx);
-    response.writeHead(out.status || 200, parseHeaders_default(out.headers));
-    if (out.body instanceof ReadableStream) {
-      await iterate(out.body, (chunk) => response.write(chunk));
-    } else {
-      response.write(out.body || "");
-    }
-    response.end();
-  }).listen(app.settings.port);
-};
-var Netlify = async (app, request, context) => {
-  request.context = context;
-  if (typeof Netlify === "undefined") {
-    throw new Error("Netlify doesn't exist");
-  }
-  const ctx = await winter_default(request, app);
-  if ("error" in ctx) {
-    throw ctx.error;
-  }
-  return await handleRequest(app.handlers, ctx);
-};
-
 // src/index.ts
 var Server = class extends Router {
   settings;
   platform;
-  port;
   sockets;
   websocket;
+  // Needed to be explicit for Bun/WinterCG
+  port;
   constructor(options = {}) {
     super();
     this.settings = config(options);
@@ -1946,12 +1891,13 @@ var Server = class extends Router {
     }
     this.use(timer);
     this.use(assets);
+    this.use(session);
+    if (this.settings.auth) {
+      auth(this);
+    }
     if (this.settings.openapi) {
       this.get(this.settings.openapi.path || "/docs", openapi_default);
     }
-    if (this.settings.auth) {
-      this.use(auth2);
-    }
   }
   // We need to return a function; some environment expect the default export
   // to be a function that is called with the request, but we also want to
@@ -1989,6 +1935,7 @@ function server(options = {}) {
 }
 export {
   Reply,
+  Server,
   ServerError_default as ServerError,
   cookies,
   server as default,