@server/next 0.27.0 → 0.27.3

package/index.js

@@ -1,15 +1,3 @@
-// src/polyfill.ts
-globalThis.env = {};
-if (typeof globalThis.Netlify !== "undefined") {
-  Object.assign(
-    globalThis.env,
-    globalThis.Netlify.env.toObject()
-  );
-}
-if (typeof process !== "undefined") {
-  Object.assign(globalThis.env, process.env);
-}
-
 // src/ServerError.ts
 var ServerError = class _ServerError extends Error {
   code;
@@ -34,7 +22,6 @@ var ServerError = class _ServerError extends Error {
     this.message = messageStr;
     this.status = status2;
   }
-  // Add error codes dynamically to the global object
   static extend(errors) {
     for (const code in errors) {
       const error = errors[code];
@@ -46,31 +33,9 @@ var ServerError = class _ServerError extends Error {
     }
     return errors;
   }
-  // Dynamically added error methods from errors/index.ts
-  static NO_STORE;
-  static NO_STORE_WRITE;
-  static NO_STORE_READ;
-  static AUTH_ARGON_NEEDED;
-  static AUTH_INVALID_TYPE;
-  static AUTH_INVALID_TOKEN;
-  static AUTH_INVALID_COOKIE;
-  static AUTH_NO_PROVIDER;
-  static AUTH_INVALID_PROVIDER;
-  static AUTH_NO_SESSION;
-  static AUTH_NO_USER;
-  static LOGIN_NO_EMAIL;
-  static LOGIN_INVALID_EMAIL;
-  static LOGIN_NO_PASSWORD;
-  static LOGIN_INVALID_PASSWORD;
-  static LOGIN_WRONG_EMAIL;
-  static LOGIN_WRONG_PASSWORD;
-  static REGISTER_NO_EMAIL;
-  static REGISTER_INVALID_EMAIL;
-  static REGISTER_NO_PASSWORD;
-  static REGISTER_INVALID_PASSWORD;
-  static REGISTER_EMAIL_EXISTS;
 };
-var ServerError_default = ServerError;
+var TypedServerError = ServerError;
+var ServerError_default = TypedServerError;
 
 // src/errors/index.ts
 ServerError_default.extend({
@@ -78,9 +43,10 @@ ServerError_default.extend({
   NO_STORE_WRITE: "You need a 'store' to write 'ctx.session.{key}'",
   NO_STORE_READ: "You need a 'store' to read 'ctx.session.{key}'",
   AUTH_ARGON_NEEDED: "Argon2 is needed for the auth module, please install it with 'npm i argon2'",
-  AUTH_INVALID_TYPE: "Invalid Authorization type, '{type}'",
   AUTH_INVALID_TOKEN: "Invalid Authorization token",
   AUTH_INVALID_COOKIE: "Invalid Authorization cookie",
+  AUTH_INVALID_HEADER: "Invalid authorization header {type}, must send 'Bearer {TOKEN}' (with space)",
+  AUTH_INVALID_STRATEGY: "Invalid Authorization type '{strategy}', valid one is '{valid}'",
   AUTH_NO_PROVIDER: "No provider passed to the option 'auth.provider'",
   AUTH_INVALID_PROVIDER: "Invalid provider '{provider}', valid ones are: '{valid}'",
   AUTH_NO_SESSION: { status: 401, message: "Invalid session" },
@@ -101,143 +67,119 @@ ServerError_default.extend({
   REGISTER_EMAIL_EXISTS: "Email is already registered"
 });
 
-// src/helpers/createCookies.ts
-function createCookies(cookies2) {
-  if (!cookies2 || !Object.keys(cookies2).length) return [];
-  return Object.entries(cookies2).map(([key, val]) => {
-    if (!val) {
-      val = { value: "", expires: (/* @__PURE__ */ new Date(0)).toUTCString() };
-    }
-    if (typeof val === "string") {
-      val = { value: val };
-    }
-    const { value, path: path2, expires } = val;
-    const pathPart = `;Path=${path2 || "/"}`;
-    const expiresPart = expires ? `;Expires=${expires}` : "";
-    return `${key}=${value || ""}${pathPart}${expiresPart}`;
-  });
+// src/polyfill.ts
+globalThis.env = {};
+if (typeof globalThis.Netlify !== "undefined") {
+  Object.assign(
+    globalThis.env,
+    globalThis.Netlify.env.toObject()
+  );
+}
+if (typeof process !== "undefined") {
+  Object.assign(globalThis.env, process.env);
 }
 
-// src/helpers/createId.ts
-var alphabet = "useandom26T198340PX75pxJACKVERYMINDBUSHWOLFGQZbfghjklqvwyzrict";
-var random = (bytes) => crypto.getRandomValues(new Uint8Array(bytes));
-var cyrb53 = (str, seed = 0) => {
-  if (typeof str !== "string") str = String(str);
-  let h1 = 3735928559 ^ seed;
-  let h2 = 1103547991 ^ seed;
-  for (let i = 0, ch; i < str.length; i++) {
-    ch = str.charCodeAt(i);
-    h1 = Math.imul(h1 ^ ch, 2654435761);
-    h2 = Math.imul(h2 ^ ch, 1597334677);
-  }
-  h1 = Math.imul(h1 ^ h1 >>> 16, 2246822507);
-  h1 ^= Math.imul(h2 ^ h2 >>> 13, 3266489909);
-  h2 = Math.imul(h2 ^ h2 >>> 16, 2246822507);
-  h2 ^= Math.imul(h1 ^ h1 >>> 13, 3266489909);
-  return 4294967296 * (2097151 & h2) + (h1 >>> 0);
-};
-var hash = (str, size) => {
-  let chars = "";
-  let num = cyrb53(str);
-  for (let i = 0; i < size; i++) {
-    if (num < alphabet.length) num = cyrb53(str, i);
-    chars += alphabet[num % alphabet.length];
-    num = Math.floor(num / alphabet.length);
-  }
-  return chars;
-};
-var randomId = (size = 16) => {
-  let id = "";
-  const bytes = random(size);
-  while (size--) {
-    id += alphabet[bytes[size] & 61];
+// src/auth/updateUser.ts
+async function updateUser(user, auth2, store) {
+  if (auth2.provider === "email") {
+    return await store.set(auth2.email, user);
   }
-  return id;
-};
-function createId(source, size = 16) {
-  if (source) return hash(source, size);
-  return randomId(size);
 }
 
-// src/helpers/createWebsocket.ts
-function createWebsocket(sockets, handlers) {
-  return {
-    message: async (socket, body) => {
-      handlers.socket?.filter((s) => s[1] === "message")?.map((s) => s[2]({ socket, sockets, body }));
-    },
-    open: (socket) => {
-      sockets.push(socket);
-      handlers.socket?.filter((s) => s[1] === "open")?.map((s) => s[2]({ socket, sockets, body: void 0 }));
-    },
-    close: (socket) => {
-      sockets.splice(sockets.indexOf(socket), 1);
-      handlers.socket?.filter((s) => s[1] === "close")?.map((s) => s[2]({ socket, sockets, body: void 0 }));
-    }
+// src/auth/providers/email.ts
+var createSession = async (user, ctx) => {
+  const { strategy, session: session2, cleanUser, redirect: redirect2 = "/user" } = ctx.options.auth;
+  user = await cleanUser(user);
+  const id = createId();
+  const provider = "email";
+  ctx.user = {
+    id,
+    strategy,
+    provider,
+    email: user.email
   };
-}
-
-// src/auth/auth.ts
-var validateToken = (authorization) => {
-  const [type2, id] = authorization.trim().split(" ");
-  if (type2.toLowerCase() !== "bearer") {
-    throw ServerError_default.AUTH_INVALID_TYPE({ type: type2 });
-  }
-  if (id.length !== 16) {
-    throw ServerError_default.AUTH_INVALID_TOKEN();
+  await session2.set(
+    id,
+    { id, strategy, provider, user: user.email },
+    { expires: "1w" }
+  );
+  if (!strategy) throw new Error(`Invalid strategy "${strategy}"`);
+  if (strategy.includes("token")) {
+    return status(201).json({ ...user, token: id });
   }
-  return id;
-};
-var validateCookie = (authorization) => {
-  if (authorization.length !== 16) {
-    throw ServerError_default.AUTH_INVALID_COOKIE();
+  if (strategy.includes("cookie")) {
+    return status(302).cookies({ authentication: id }).redirect(redirect2);
   }
-  return authorization;
-};
-var findSessionId = (ctx) => {
-  const type2 = ctx.options.auth.type;
-  if (type2.includes("token")) {
-    if (!ctx.headers.authorization) return;
-    return validateToken(ctx.headers.authorization);
+  if (strategy.includes("jwt")) {
+    throw new Error("JWT auth not supported yet");
   }
-  if (type2.includes("cookie")) {
-    if (!ctx.cookies.authentication) return;
-    return validateCookie(ctx.cookies.authentication);
+  if (strategy.includes("key")) {
+    throw new Error("Key auth not supported yet");
   }
-  throw new Error(`Invalid auth type "${type2}"`);
+  throw new Error("Unknown auth type");
 };
-async function auth(ctx) {
-  if (!ctx.options.auth) return;
-  const options = ctx.options.auth;
-  const sessionId = findSessionId(ctx);
-  if (!sessionId) return;
-  const auth3 = await options.session.get(sessionId);
-  if (!auth3) return;
-  if (!auth3.provider) throw ServerError_default.AUTH_NO_PROVIDER();
-  if (!options.provider.includes(auth3.provider)) {
-    throw ServerError_default.AUTH_INVALID_PROVIDER({
-      provider: auth3.provider,
-      valid: options.provider
-    });
-  }
-  return auth3;
+async function emailLogin(ctx) {
+  const { email, password } = ctx.body;
+  if (!email) throw ServerError_default.LOGIN_NO_EMAIL();
+  if (!/@/.test(email)) throw ServerError_default.LOGIN_INVALID_EMAIL();
+  if (!password) throw ServerError_default.LOGIN_NO_PASSWORD();
+  if (password.length < 8) throw ServerError_default.LOGIN_INVALID_PASSWORD();
+  const store = ctx.options.auth.store;
+  if (!await store.has(email)) throw ServerError_default.LOGIN_WRONG_EMAIL();
+  const user = await store.get(email);
+  const isValid = await verify(password, user.password);
+  if (!isValid) throw ServerError_default.LOGIN_WRONG_PASSWORD();
+  return createSession(user, ctx);
+}
+async function emailRegister(ctx) {
+  const { email, password, ...data } = ctx.body;
+  if (!email) throw ServerError_default.REGISTER_NO_EMAIL();
+  if (!/@/.test(email)) throw ServerError_default.REGISTER_INVALID_EMAIL();
+  if (!password) throw ServerError_default.REGISTER_NO_PASSWORD();
+  if (password.length < 8) throw ServerError_default.REGISTER_INVALID_PASSWORD();
+  const store = ctx.options.auth.store;
+  if (await store.has(email)) throw ServerError_default.REGISTER_EMAIL_EXISTS();
+  const time = (/* @__PURE__ */ new Date()).toISOString().replace(/\.[0-9]*/, "");
+  const user = {
+    id: createId(email),
+    strategy: ctx.options.auth.strategy,
+    provider: "email",
+    email,
+    password: await hash(password),
+    time,
+    ...data
+  };
+  await store.set(email, user);
+  return createSession(user, ctx);
+}
+async function emailResetPassword() {
+}
+async function emailUpdatePassword(ctx) {
+  const passwords = ctx.body;
+  const fullUser = await ctx.options.auth.store.get(ctx.user.email);
+  if (!fullUser) throw ServerError_default.AUTH_NO_USER();
+  const isValid = await verify(passwords.previous, fullUser.password);
+  if (!isValid) throw ServerError_default.LOGIN_WRONG_PASSWORD();
+  fullUser.password = await hash(passwords.updated);
+  await updateUser(fullUser, ctx.user, ctx.options.auth.store);
+  return 200;
 }
+var email_default = {
+  login: emailLogin,
+  register: emailRegister,
+  reset: emailResetPassword,
+  password: emailUpdatePassword
+};
 
 // src/reply.ts
+var EXPIRED = (/* @__PURE__ */ new Date(0)).toUTCString();
 var Reply = class {
   res;
   constructor() {
     this.res = {
-      headers: {},
-      cookies: {}
+      headers: new Headers()
     };
   }
-  generateHeaders() {
-    const headers2 = new Headers(this.res.headers);
-    for (const cookie of createCookies(this.res.cookies)) {
-      headers2.append("set-cookie", cookie);
-    }
-    return headers2;
-  }
   status(status2) {
     this.res.status = status2;
     return this;
@@ -245,46 +187,55 @@ var Reply = class {
   type(type2) {
     if (!type2) return this;
     type2 = types_default[type2.replace(/^\./, "")] || type2;
-    return this.headers({ "content-type": type2 });
+    this.res.headers.set("content-type", type2);
+    return this;
   }
-  download(name, type2) {
-    if (name && !type2) type2 = name.split(".").pop();
-    if (type2) this.type(type2);
-    const filename = name ? `; filename="${name}"` : "";
-    return this.headers({ "content-disposition": `attachment${filename}` });
+  download(name) {
+    const ext = name?.split(".").pop();
+    if (type && ext && !this.res.headers.get("content-type")) this.type(ext);
+    const filename = name ? `; filename="${encodeURIComponent(name)}"` : "";
+    return this.headers("content-disposition", `attachment${filename}`);
   }
-  headers(headers2) {
-    if (!headers2 || typeof headers2 !== "object") return this;
-    for (const key in headers2) {
-      this.res.headers[key] = headers2[key];
+  headers(key, value) {
+    if (typeof key !== "string") {
+      Object.entries(key).map(([key2, value2]) => this.headers(key2, value2));
+      return this;
     }
+    if (Array.isArray(value)) {
+      Object.values(value).map((val) => this.headers(key, val));
+      return this;
+    }
+    this.res.headers.append(key, value);
     return this;
   }
-  cookies(cookies2) {
-    if (!cookies2 || typeof cookies2 !== "object") return this;
-    for (const key in cookies2) {
-      if (typeof cookies2[key] === "string") {
-        this.res.cookies[key] = { value: cookies2[key] };
-      } else {
-        this.res.cookies[key] = cookies2[key];
-      }
+  cookies(key, value) {
+    if (typeof key === "object") {
+      Object.entries(key).map(([key2, value2]) => this.cookies(key2, value2));
+      return this;
     }
-    return this;
+    if (Array.isArray(value)) {
+      Object.values(value).map((val) => this.cookies(key, val));
+      return this;
+    }
+    console.log(key, value);
+    if (value === null) return this.cookies(key, { expires: EXPIRED });
+    if (typeof value !== "object") return this.cookies(key, { value });
+    return this.headers("set-cookie", createCookies(key, value));
   }
   json(body) {
-    return this.headers({
-      "content-type": "application/json"
-    }).send(JSON.stringify(body));
+    return this.headers("content-type", "application/json").send(
+      JSON.stringify(body)
+    );
   }
-  redirect(Location) {
-    return this.headers({ Location }).status(302).send();
+  redirect(path2) {
+    return this.headers("location", path2).status(302).send();
   }
-  async file(path2, renderer = async (data) => data) {
+  async file(path2) {
     try {
-      const fs2 = await import("fs/promises");
-      const data = await fs2.readFile(path2);
+      const fs2 = await import("fs");
       const ext = path2.split(".").pop();
-      return this.type(ext).send(await renderer(data));
+      const stream = fs2.createReadStream(path2);
+      return this.type(ext).send(stream);
     } catch (error) {
       if (error.code === "ENOENT") {
         return this.status(404).send();
@@ -292,156 +243,39 @@ var Reply = class {
       throw error;
     }
   }
-  async view(path2, renderer = async (data) => data, ctx) {
-    if (!ctx?.options.views) {
-      throw new Error("Views not enabled");
-    }
-    const data = await ctx.options.views.read(path2);
-    if (!data) return this.status(404).send();
-    return this.type(path2.split(".").pop()).send(await renderer(data));
-  }
   send(body = "") {
-    const { status: status2 = 200 } = this.res;
+    const { status: status2 = 200, headers: headers2 } = this.res;
     if (typeof body === "string") {
-      if (!this.res.headers["content-type"]) {
-        const isHtml = body.startsWith("<");
-        this.res.headers["content-type"] = isHtml ? "text/html" : "text/plain";
+      if (!headers2.get("content-type")) {
+        const isHtml = body.trim().startsWith("<");
+        headers2.set("content-type", isHtml ? "text/html" : "text/plain");
       }
-      const headers2 = this.generateHeaders();
       return new Response(body, { status: status2, headers: headers2 });
     }
     const name = body?.constructor?.name;
     if (name === "Buffer") {
-      const headers2 = this.generateHeaders();
       return new Response(body, { status: status2, headers: headers2 });
     }
-    if (name === "ReadableStream") {
-      const headers2 = this.generateHeaders();
+    if (typeof body?.getReader === "function") {
       return new Response(body, { status: status2, headers: headers2 });
     }
     if (name === "PassThrough" || name === "Readable") {
-      const headers2 = this.generateHeaders();
       return new Response(toWeb(body), { status: status2, headers: headers2 });
     }
-    return this.json(body);
-  }
-};
-var status = (...args) => new Reply().status(...args);
-var headers = (...args) => new Reply().headers(...args);
-var type = (...args) => new Reply().type(...args);
-var download = (...args) => new Reply().download(...args);
-var cookies = (...args) => new Reply().cookies(...args);
-var send = (...args) => new Reply().send(...args);
-var json = (...args) => new Reply().json(...args);
-var file = (...args) => new Reply().file(...args);
-var redirect = (...args) => new Reply().redirect(...args);
-var view = (...args) => new Reply().view(...args);
-
-// src/auth/logout.ts
-async function logout(ctx) {
-  const { id, type: type2 } = ctx.auth;
-  await ctx.options.auth.session.del(id);
-  if (type2.includes("token")) {
-    return { token: null };
-  }
-  if (type2.includes("cookie")) {
-    return cookies({ authorization: null }).redirect("/");
-  }
-  if (type2.includes("jwt")) {
-    throw new Error("JWT auth not supported yet");
-  }
-  if (type2.includes("key")) {
-    throw new Error("Key auth not supported yet");
-  }
-  throw new Error("Unknown auth type");
-}
-
-// src/auth/updateUser.ts
-async function updateUser(user2, auth3, store) {
-  if (auth3.provider === "email") {
-    return await store.set(auth3.email, user2);
-  }
-}
-
-// src/auth/providers/email.ts
-var createSession = async (user2, ctx) => {
-  const { type: type2, session: session2, cleanUser, redirect: redirect2 = "/user" } = ctx.options.auth;
-  user2 = cleanUser(user2);
-  const id = createId();
-  const provider = "email";
-  const time = (/* @__PURE__ */ new Date()).toISOString().replace(/\.[0-9]*/, "");
-  ctx.auth = {
-    id,
-    type: type2,
-    provider,
-    user: user2.email,
-    email: user2.email,
-    time
-  };
-  await session2.set(id, ctx.auth, { expires: "1w" });
-  if (type2.includes("token")) {
-    return status(201).json({ ...user2, token: id });
-  }
-  if (type2.includes("cookie")) {
-    return status(302).cookies({ authentication: id }).redirect(redirect2);
-  }
-  if (type2.includes("jwt")) {
-    throw new Error("JWT auth not supported yet");
-  }
-  if (type2.includes("key")) {
-    throw new Error("Key auth not supported yet");
+    headers2.set("content-type", "application/json");
+    return new Response(JSON.stringify(body), { status: status2, headers: headers2 });
   }
-  throw new Error("Unknown auth type");
-};
-async function emailLogin(ctx) {
-  const { email, password } = ctx.body;
-  if (!email) throw ServerError_default.LOGIN_NO_EMAIL();
-  if (!/@/.test(email)) throw ServerError_default.LOGIN_INVALID_EMAIL();
-  if (!password) throw ServerError_default.LOGIN_NO_PASSWORD();
-  if (password.length < 8) throw ServerError_default.LOGIN_INVALID_PASSWORD();
-  const store = ctx.options.auth.store;
-  if (!await store.has(email)) throw ServerError_default.LOGIN_WRONG_EMAIL();
-  const user2 = await store.get(email);
-  const isValid = await verify(password, user2.password);
-  if (!isValid) throw ServerError_default.LOGIN_WRONG_PASSWORD();
-  return createSession(user2, ctx);
-}
-async function emailRegister(ctx) {
-  const { email, password, ...data } = ctx.body;
-  if (!email) throw ServerError_default.REGISTER_NO_EMAIL();
-  if (!/@/.test(email)) throw ServerError_default.REGISTER_INVALID_EMAIL();
-  if (!password) throw ServerError_default.REGISTER_NO_PASSWORD();
-  if (password.length < 8) throw ServerError_default.REGISTER_INVALID_PASSWORD();
-  const store = ctx.options.auth.store;
-  if (await store.has(email)) throw ServerError_default.REGISTER_EMAIL_EXISTS();
-  const time = (/* @__PURE__ */ new Date()).toISOString().replace(/\.[0-9]*/, "");
-  const user2 = {
-    id: createId(email),
-    email,
-    password: await hash2(password),
-    time,
-    ...data
-  };
-  await store.set(email, user2);
-  return createSession(user2, ctx);
-}
-async function emailResetPassword() {
-}
-async function emailUpdatePassword(ctx) {
-  const { previous, updated } = ctx.body;
-  const fullUser = await ctx.options.auth.store.get(ctx.auth.user);
-  const isValid = await verify(previous, fullUser.password);
-  if (!isValid) throw ServerError_default.LOGIN_WRONG_PASSWORD();
-  fullUser.password = await hash2(updated);
-  await updateUser(fullUser, ctx.auth, ctx.options.auth.store);
-  return 200;
-}
-var email_default = {
-  login: emailLogin,
-  register: emailRegister,
-  reset: emailResetPassword,
-  password: emailUpdatePassword
 };
+var r = () => new Reply();
+var status = (...args) => r().status(...args);
+var headers = (...args) => r().headers(...args);
+var type = (...args) => r().type(...args);
+var download = (...args) => r().download(...args);
+var cookies = (...args) => r().cookies(...args);
+var send = (...args) => r().send(...args);
+var json = (...args) => r().json(...args);
+var file = (...args) => r().file(...args);
+var redirect = (...args) => r().redirect(...args);
 
 // src/auth/providers/github.ts
 var oauth = async (code) => {
@@ -481,17 +315,17 @@ var getUserProfile = async (code) => {
   return { ...profile, email };
 };
 var callback = async (ctx) => {
-  const { type: type2, cleanUser, store, session: session2, redirect: redirect2 } = ctx.options.auth;
+  const { strategy, cleanUser, store, session: session2, redirect: redirect2 } = ctx.options.auth;
   const profile = await getUserProfile(ctx.url.query.code);
-  const auth3 = {
+  const auth2 = {
     id: createId(),
-    type: type2,
+    strategy,
     provider: "github",
     user: createId(profile.email),
     email: profile.email,
     time: (/* @__PURE__ */ new Date()).toISOString().replace(/\.[0-9]*/, "")
   };
-  const user2 = cleanUser({
+  const user = cleanUser({
     id: profile.id,
     name: profile.name,
     email: profile.email,
@@ -499,18 +333,18 @@ var callback = async (ctx) => {
     location: profile.location,
     created: profile.created_at
   });
-  await store.set(auth3.user, user2);
-  await session2.set(auth3.id, auth3, { expires: "1w" });
-  if (auth3.type.includes("token")) {
-    return status(201).json({ ...user2, token: auth3.id });
+  await store.set(auth2.user, user);
+  await session2.set(auth2.id, auth2, { expires: "1w" });
+  if (auth2.strategy.includes("token")) {
+    return status(201).json({ ...user, token: auth2.id });
   }
-  if (auth3.type.includes("cookie")) {
-    return status(302).cookies({ authentication: auth3.id }).redirect(redirect2);
+  if (auth2.strategy.includes("cookie")) {
+    return status(302).cookies({ authentication: auth2.id }).redirect(redirect2);
   }
-  if (auth3.type.includes("jwt")) {
+  if (auth2.strategy.includes("jwt")) {
     throw new Error("JWT auth not supported yet");
   }
-  if (auth3.type.includes("key")) {
+  if (auth2.strategy.includes("key")) {
     throw new Error("Key auth not supported yet");
   }
   throw new Error("Unknown auth type");
@@ -520,149 +354,70 @@ var github_default = { login, callback };
 // src/auth/providers/index.ts
 var providers_default = { email: email_default, github: github_default };
 
-// src/auth/NoSession.ts
-var NoSession = class {
-};
-function createNoSession() {
-  return new Proxy(new NoSession(), {
-    get(target, key) {
-      if (target[key]) return target[key];
-      if (key === "then") return target[key];
-      if (typeof key === "symbol") return target[key];
-      throw ServerError_default.NO_STORE_READ({ key: String(key) });
-    },
-    set(target, key, value) {
-      if (target[key] || key === "then" || typeof key === "symbol") {
-        target[key] = value;
-        return true;
-      } else {
-        throw ServerError_default.NO_STORE_WRITE({ key: String(key) });
-      }
-    }
-  });
+// src/auth/parseAuthOptions.ts
+var defaultRedirect = "/user";
+function defaultCleanUser(fullUser) {
+  const { password: _password, ...user } = fullUser;
+  return user;
 }
-
-// src/auth/session.ts
-async function session(ctx) {
-  const store = ctx.options.session?.store;
-  if (!store) return createNoSession();
-  if (ctx.cookies.session) {
-    const session2 = await store.get(ctx.cookies.session);
-    if (session2) return session2;
+var providersKeys = Object.keys(providers_default);
+function getProviders(provider) {
+  if (typeof provider === "string") {
+    provider = provider.split("|");
   }
-  return {};
-}
-
-// src/auth/user.ts
-async function user(ctx) {
-  if (!ctx.auth) return;
-  const user2 = await ctx.options.auth.store.get(ctx.auth.user);
-  if (!user2) throw ServerError_default.AUTH_NO_USER();
-  return ctx.options.auth.cleanUser(user2);
-}
-
-// src/auth/index.ts
-var parseOptions = (auth3, all) => {
-  if (!auth3) return null;
-  if (typeof auth3 === "string") {
-    const [type2, provider] = auth3.split(":");
-    auth3 = { type: type2, provider };
-  }
-  if (typeof auth3.type === "string") {
-    auth3.type = auth3.type.split("|").filter(Boolean);
-  }
-  if (typeof auth3.provider === "string") {
-    auth3.provider = auth3.provider.split("|").filter(Boolean);
-  }
-  if (!auth3.type) {
-    throw new Error("Auth options needs a type");
-  }
-  if (!auth3.type.length) {
-    throw new Error("Auth options needs a type");
-  }
-  if (!auth3.provider || !auth3.provider.length) {
-    throw new Error("Auth options needs a provider");
-  }
-  const providerNotFound = auth3.provider.find((p) => !providers_default[p]);
-  if (providerNotFound) {
+  const invalidProvider = provider.find((p) => !providersKeys.includes(p));
+  if (invalidProvider) {
     throw new Error(
-      `Provider "${providerNotFound}" not found, available ones are "${Object.keys(providers_default).join('", "')}"`
+      `Provider "${invalidProvider}" not found, available ones are "${providersKeys.join('", "')}"`
     );
   }
-  if (!auth3.session && all.store) {
-    auth3.session = all.store.prefix("auth:");
+  return provider;
+}
+function parseAuthOptions(auth2, all) {
+  if (!auth2) return null;
+  if (typeof auth2 === "string") {
+    const [strategy2, providerRaw] = auth2.split(":");
+    const provider2 = providerRaw && providerRaw.split("|");
+    auth2 = { strategy: strategy2, provider: provider2 };
   }
-  if (!auth3.store && all.store) {
-    auth3.store = all.store.prefix("user:");
+  if (!auth2.strategy) {
+    throw new Error("Auth options needs a strategy");
   }
-  if (!auth3.cleanUser) {
-    auth3.cleanUser = (fullUser) => {
-      const { password: _password, ...user2 } = fullUser;
-      return user2;
-    };
+  if (!auth2.strategy.length) {
+    throw new Error("Auth options needs a strategy");
   }
-  if (!auth3.redirect) {
-    auth3.redirect = "/user";
+  const strategy = auth2.strategy;
+  if (!auth2.provider || !auth2.provider.length) {
+    throw new Error("Auth options needs a provider");
   }
-  return auth3;
-};
-var load = async (ctx) => {
-  ctx.session = await session(ctx);
-  ctx.auth = await auth(ctx);
-  ctx.user = await user(ctx);
-};
-var middle = async (ctx) => {
-  if (ctx.options.auth) {
-    if (ctx.options.auth.provider.includes("github")) {
-      if (!env.GITHUB_ID) throw new Error("GITHUB_ID not defined");
-      if (!env.GITHUB_SECRET) throw new Error("GITHUB_SECRET not defined");
-      ctx.app.get(
-        "/auth/logout",
-        { tags: "Auth", title: "Github logout" },
-        logout
-      );
-      ctx.app.get(
-        "/auth/login/github",
-        { tags: "Auth" },
-        providers_default.github.login
-      );
-      ctx.app.get(
-        "/auth/callback/github",
-        { tags: "Auth", title: "Github callback" },
-        providers_default.github.callback
-      );
-    }
-    if (ctx.options.auth.provider.includes("email")) {
-      ctx.app.post("/auth/logout", { tags: "Auth" }, logout);
-      ctx.app.post(
-        "/auth/register/email",
-        { tags: "Auth" },
-        providers_default.email.register
-      );
-      ctx.app.post(
-        "/auth/login/email",
-        { tags: "Auth" },
-        providers_default.email.login
-      );
-      ctx.app.put(
-        "/auth/password/email",
-        { tags: "Auth" },
-        providers_default.email.password
-      );
-      ctx.app.put(
-        "/auth/reset/email",
-        { tags: "Auth" },
-        providers_default.email.reset
-      );
-    }
+  const provider = getProviders(auth2.provider);
+  const redirect2 = auth2.redirect || defaultRedirect;
+  const cleanUser = auth2.cleanUser || defaultCleanUser;
+  if (!auth2.store && !all.store) {
+    throw new Error("Need a userStore store for Auth");
   }
-};
-var auth_default = { load, parseOptions, middle };
+  if (!auth2.session && !all.store) {
+    throw new Error("Need a sessionStore store for Auth");
+  }
+  const store = auth2.store || all.store.prefix("user:");
+  const session2 = auth2.session || all.store.prefix("auth:");
+  return {
+    // Base main configuration
+    strategy,
+    provider,
+    // Extra configuration
+    redirect: redirect2,
+    cleanUser,
+    // Stores for the auth session and users
+    store,
+    session: session2
+  };
+}
 
 // src/helpers/bucket.ts
 import * as fs from "fs";
-import * as path from "path";
 import * as fsp from "fs/promises";
+import * as path from "path";
 function thinLocalBucket(root) {
   const absolute = (name) => {
     if (!name) throw new Error("File name is required");
@@ -737,6 +492,47 @@ function bucket_default(root) {
   return root;
 }
 
+// src/helpers/createId.ts
+var alphabet = "useandom26T198340PX75pxJACKVERYMINDBUSHWOLFGQZbfghjklqvwyzrict";
+var random = (bytes) => crypto.getRandomValues(new Uint8Array(bytes));
+var cyrb53 = (str, seed = 0) => {
+  if (typeof str !== "string") str = String(str);
+  let h1 = 3735928559 ^ seed;
+  let h2 = 1103547991 ^ seed;
+  for (let i = 0, ch; i < str.length; i++) {
+    ch = str.charCodeAt(i);
+    h1 = Math.imul(h1 ^ ch, 2654435761);
+    h2 = Math.imul(h2 ^ ch, 1597334677);
+  }
+  h1 = Math.imul(h1 ^ h1 >>> 16, 2246822507);
+  h1 ^= Math.imul(h2 ^ h2 >>> 13, 3266489909);
+  h2 = Math.imul(h2 ^ h2 >>> 16, 2246822507);
+  h2 ^= Math.imul(h1 ^ h1 >>> 13, 3266489909);
+  return 4294967296 * (2097151 & h2) + (h1 >>> 0);
+};
+var hash2 = (str, size) => {
+  let chars = "";
+  let num = cyrb53(str);
+  for (let i = 0; i < size; i++) {
+    if (num < alphabet.length) num = cyrb53(str, i);
+    chars += alphabet[num % alphabet.length];
+    num = Math.floor(num / alphabet.length);
+  }
+  return chars;
+};
+var randomId = (size = 16) => {
+  let id = "";
+  const bytes = random(size);
+  while (size--) {
+    id += alphabet[bytes[size] & 61];
+  }
+  return id;
+};
+function createId(source, size = 16) {
+  if (source) return hash2(source, size);
+  return randomId(size);
+}
+
 // src/helpers/color.ts
 var map = {
   reset: 0,
@@ -846,7 +642,9 @@ function config(options = {}) {
     (session2) => session2?.store?.name || "working",
     "\u{1F510}"
   );
-  settings.auth = auth_default.parseOptions(options.auth || env2.AUTH || null, options);
+  if (options.auth || env2.AUTH) {
+    settings.auth = parseAuthOptions(options.auth || env2.AUTH || null, options);
+  }
   if (options.openapi) {
     if (options.openapi === true) {
       settings.openapi = {};
@@ -869,6 +667,72 @@ function cors(config2, origin = "") {
   return null;
 }
 
+// src/helpers/createCookies.ts
+var EXPIRED2 = (/* @__PURE__ */ new Date(0)).toUTCString();
+var times = /(-?(?:\d+\.?\d*|\d*\.?\d+)(?:e[-+]?\d+)?)\s*([\p{L}]*)/iu;
+parse.millisecond = parse.ms = 1e-3;
+parse.second = parse.sec = parse.s = parse[""] = 1;
+parse.minute = parse.min = parse.m = parse.s * 60;
+parse.hour = parse.hr = parse.h = parse.m * 60;
+parse.day = parse.d = parse.h * 24;
+parse.week = parse.wk = parse.w = parse.d * 7;
+parse.year = parse.yr = parse.y = parse.d * 365.25;
+parse.month = parse.b = parse.y / 12;
+function parse(str) {
+  if (str === null || str === void 0) return null;
+  if (typeof str === "number") return str;
+  str = str.toLowerCase().replace(/[,_]/g, "");
+  const [_, value, units] = times.exec(str) || [];
+  if (!units) return null;
+  const unitValue = parse[units] || parse[units.replace(/s$/, "")];
+  if (!unitValue) return null;
+  const result = unitValue * parseFloat(value);
+  return Math.abs(Math.round(result * 1e3));
+}
+function normalizeExpires(expires) {
+  if (expires === null || expires === void 0) return void 0;
+  if (expires === 0) return EXPIRED2;
+  if (typeof expires === "string") {
+    if (/^[\d._]+\w+$/.test(expires)) {
+      return new Date(Date.now() + parse(expires)).toUTCString();
+    } else {
+      return expires;
+    }
+  }
+  if (typeof expires === "number") {
+    return new Date(Date.now() + expires).toUTCString();
+  }
+  if (expires instanceof Date) {
+    return expires.toUTCString();
+  }
+  return void 0;
+}
+function createCookies(key, val) {
+  if (val.value === null) val.expires = EXPIRED2;
+  const { value, path: path2, expires } = val;
+  const pathPart = `;Path=${path2 || "/"}`;
+  const expiresStr = normalizeExpires(expires);
+  const expiresPart = typeof expires !== "undefined" ? `;Expires=${expiresStr}` : "";
+  return `${key}=${value || ""}${pathPart}${expiresPart}`;
+}
+
+// src/helpers/createWebsocket.ts
+function createWebsocket(sockets, handlers) {
+  return {
+    message: async (socket, body) => {
+      handlers.socket?.filter((s) => s[1] === "message")?.map((s) => s[2]({ socket, sockets, body }));
+    },
+    open: (socket) => {
+      sockets.push(socket);
+      handlers.socket?.filter((s) => s[1] === "open")?.map((s) => s[2]({ socket, sockets, body: void 0 }));
+    },
+    close: (socket) => {
+      sockets.splice(sockets.indexOf(socket), 1);
+      handlers.socket?.filter((s) => s[1] === "close")?.map((s) => s[2]({ socket, sockets, body: void 0 }));
+    }
+  };
+}
+
 // src/helpers/define.ts
 function define(obj, key, cb) {
   Object.defineProperty(obj, key, {
@@ -965,7 +829,7 @@ async function parseResponse(out, ctx) {
   }
   if (Object.keys(ctx.session || {}).length) {
     if (!ctx.options.session?.store) {
-      throw ServerError_default.NO_STORE({});
+      throw ServerError_default.NO_STORE();
     }
     if (!ctx.cookies.session) {
       ctx.res.cookies.session = createId();
@@ -990,6 +854,7 @@ async function parseResponse(out, ctx) {
 
 // src/pathPattern.ts
 function pathPattern(pattern, path2) {
+  if (pattern === "*" && path2 === "/") return {};
   pattern = `/${pattern.replace(/^\//, "")}`;
   pattern = pattern.replace(/\/$/, "") || "/";
   path2 = path2.replace(/\/$/, "") || "/";
@@ -1062,7 +927,9 @@ function validate(ctx, schema) {
     }
   } catch (error) {
     if (error.name === "ZodError" || error.constructor.name === "ZodError") {
-      const message = error.issues.map(({ path: path2, message: message2 }) => `[${base}.${path2.join(".")}]: ${message2}`).sort().join("\n");
+      const message = error.issues.map(
+        ({ path: path2, message: message2 }) => `[${base}.${path2.join(".")}]: ${message2}`
+      ).sort().join("\n");
       throw new StatusError(message, 422);
     }
     throw error;
@@ -1072,9 +939,6 @@ function validate(ctx, schema) {
 // src/helpers/handleRequest.ts
 async function handleRequest(handlers, ctx) {
   try {
-    if (ctx.error) {
-      throw ctx.error;
-    }
     for (const [method, matcher, ...cbs] of handlers[ctx.method]) {
       const match = pathPattern(matcher, ctx.url.pathname || "/");
       if (!match) continue;
@@ -1090,7 +954,7 @@ async function handleRequest(handlers, ctx) {
       }
       if (method !== "*") break;
     }
-    if (ctx.machine?.provider === "netlify") return;
+    if (ctx.platform.provider === "netlify") return;
     return new Response("Not Found", { status: 404 });
   } catch (error) {
     return new Response(error.message || "", { status: error.status || 500 });
@@ -1101,7 +965,7 @@ async function handleRequest(handlers, ctx) {
 import * as crypto2 from "crypto";
 import { getRandomValues } from "crypto";
 import { promisify } from "util";
-async function hash2(password) {
+async function hash(password) {
   if ("argon2" in crypto2) {
     const argon23 = promisify(crypto2.argon2);
     const buf = await argon23("argon2id", {
@@ -1131,18 +995,6 @@ async function iterate(stream, cb) {
   }
 }
 
-// src/helpers/iteratorToReadable.ts
-function iteratorToReadable(generator) {
-  return new ReadableStream({
-    async start(controller) {
-      for await (const chunk of generator) {
-        controller.enqueue(chunk);
-      }
-      controller.close();
-    }
-  });
-}
-
 // src/helpers/iteratorAsyncToReadable.ts
 function iteratorAsyncToReadable(asyncGenerator) {
   return new ReadableStream({
@@ -1165,6 +1017,116 @@ function iteratorAsyncToReadable(asyncGenerator) {
   });
 }
 
+// src/helpers/iteratorToReadable.ts
+function iteratorToReadable(generator) {
+  return new ReadableStream({
+    async start(controller) {
+      for await (const chunk of generator) {
+        controller.enqueue(chunk);
+      }
+      controller.close();
+    }
+  });
+}
+
+// src/helpers/parseBody.ts
+function getBoundary(header) {
+  if (!header) return null;
+  if (header.includes("multipart/form-data") && !header.includes("boundary=")) {
+    console.error("Do not set the `Content-Type` manually for FormData");
+  }
+  const items = header.split(";");
+  for (const item of items) {
+    const trimmedItem = item.trim();
+    if (trimmedItem.startsWith("boundary=")) {
+      return trimmedItem.split("=")[1].trim();
+    }
+  }
+  return null;
+}
+function getMatching(string, regex) {
+  const matches = string.match(regex);
+  return matches?.[1] ?? "";
+}
+var saveFile = async (name, value, bucket) => {
+  const ext = name.split(".").pop();
+  const id = `${createId()}.${ext}`;
+  await bucket.write(id, value);
+  return id;
+};
+function splitBuffer(buffer, delimiter) {
+  const result = [];
+  let start = 0;
+  let index = buffer.indexOf(delimiter);
+  while (index !== -1) {
+    result.push(buffer.slice(start, index));
+    start = index + delimiter.length;
+    index = buffer.indexOf(delimiter, start);
+  }
+  result.push(buffer.slice(start));
+  return result;
+}
+var BREAK_BUFFER = Buffer.from("\r\n\r\n");
+function isProbablyText(buffer) {
+  for (let i = 0; i < Math.min(buffer.length, 512); i++) {
+    const byte = buffer[i];
+    if (byte === 0) return false;
+    if (byte < 7 || byte > 13 && byte < 32) return false;
+  }
+  return true;
+}
+async function parseBody(raw, contentType, bucket) {
+  const contentTypeStr = Array.isArray(contentType) ? contentType[0] : contentType;
+  if (!raw) return {};
+  if (!contentTypeStr || /^text\//.test(contentTypeStr)) {
+    return raw.toString("utf-8");
+  }
+  if (/application\/json/.test(contentTypeStr)) {
+    return JSON.parse(raw.toString("utf-8"));
+  }
+  const boundary = getBoundary(contentTypeStr);
+  if (!boundary) return null;
+  const body = {};
+  const boundaryBuffer = Buffer.from(`--${boundary}`);
+  const parts = splitBuffer(raw, boundaryBuffer);
+  for (const part of parts) {
+    if (part.length === 0 || part.equals(Buffer.from("--\r\n"))) continue;
+    const idx = part.indexOf(BREAK_BUFFER);
+    if (idx === -1) continue;
+    const headerStr = part.slice(0, idx).toString("utf-8");
+    const contentBuf = part.slice(idx + BREAK_BUFFER.length, part.length - 2);
+    const name = getMatching(headerStr, /name="(.+?)"/).trim().replace(/\[\]$/, "");
+    if (!name) continue;
+    const filename = getMatching(headerStr, /filename="(.+?)"/).trim();
+    if (filename) {
+      if (!bucket) throw new Error("Bucket is required to save files");
+      body[name] = await saveFile(filename, contentBuf, bucket);
+    } else {
+      const value = isProbablyText(contentBuf) ? contentBuf.toString("utf-8").trim() : contentBuf;
+      if (body[name]) {
+        if (!Array.isArray(body[name])) body[name] = [body[name]];
+        body[name].push(value);
+      } else {
+        body[name] = value;
+      }
+    }
+  }
+  return body;
+}
+
+// src/helpers/parseCookies.ts
+function parseCookies(cookies2) {
+  if (!cookies2) return {};
+  const cookieStr = Array.isArray(cookies2) ? cookies2[0] : cookies2;
+  if (!cookieStr) return {};
+  return Object.fromEntries(
+    cookieStr.split(/;\s*/).map((part) => {
+      const [key, ...rest] = part.split("=");
+      return [key, decodeURIComponent(rest.join("="))];
+    })
+  );
+}
+
 // src/helpers/parseHeaders.ts
 var parseHeaders_default = (raw) => {
   const headers2 = {};
@@ -1328,52 +1290,135 @@ async function verify(password, hash3) {
   });
 }
 
-// src/middle/assets.ts
-async function assets(ctx) {
-  if (!ctx.options.public) return;
-  if (ctx.method !== "get") return;
-  if (ctx.url.pathname === "/") return;
-  try {
-    const asset = await ctx.options.public.read(ctx.url.pathname);
-    if (!asset) return;
-    return type(ctx.url.pathname.split(".").pop()).send(asset);
-  } catch {
+// src/auth/findSessionId.ts
+var validateToken = (authorization) => {
+  const [type2, id] = authorization.trim().split(" ");
+  if (type2.toLowerCase() !== "bearer") {
+    throw ServerError_default.AUTH_INVALID_HEADER({ type: type2 });
   }
-}
-
-// src/middle/timer.ts
-var createTime = () => {
-  const times = [["init", performance.now()]];
-  const time = (name) => times.push([name, performance.now()]);
-  time.times = times;
-  time.headers = () => {
-    const r = (t) => Math.round(t);
-    const times2 = time.times;
-    const timing = times2.slice(1).map(([name, time2], i) => `${name};dur=${r(time2 - times2[i][1])}`).join(", ");
-    return timing;
-  };
-  return time;
+  if (id.length !== 16) {
+    throw ServerError_default.AUTH_INVALID_TOKEN();
+  }
+  return id;
 };
-function timer(ctx) {
-  ctx.time = createTime();
+var validateCookie = (authorization) => {
+  if (authorization.length !== 16) {
+    throw ServerError_default.AUTH_INVALID_COOKIE();
+  }
+  return authorization;
+};
+function findSessionId(ctx) {
+  const strategy = ctx.options.auth.strategy;
+  if (!strategy) throw new Error(`Invalid strategy "${strategy}"`);
+  if (strategy.includes("token")) {
+    if (!ctx.headers.authorization) return;
+    return validateToken(ctx.headers.authorization);
+  }
+  if (strategy.includes("cookie")) {
+    if (!ctx.cookies.authentication) return;
+    return validateCookie(ctx.cookies.authentication);
+  }
+  throw new Error(`Invalid auth type "${strategy}"`);
 }
 
-// src/middle/openapi.ts
-import * as fsp2 from "fs/promises";
-var entities = {
-  "&": "&amp;",
-  "<": "&lt;",
-  ">": "&gt;",
-  '"': "&quot;"
-};
-var encode = (str = "") => {
+// src/auth/getUser.ts
+async function getUser(ctx) {
+  if (!ctx.options.auth) return;
+  const options = ctx.options.auth;
+  const sessionId = findSessionId(ctx);
+  if (!sessionId) return;
+  const auth2 = await options.session.get(sessionId);
+  if (!auth2) return;
+  if (options.strategy !== auth2.strategy) {
+    throw ServerError_default.AUTH_INVALID_STRATEGY({
+      strategy: auth2.strategy || "undefined",
+      valid: options.strategy
+    });
+  }
+  if (!options.provider.includes(auth2.provider)) {
+    throw ServerError_default.AUTH_INVALID_PROVIDER({
+      provider: auth2.provider,
+      valid: options.provider
+    });
+  }
+  const user = await ctx.options.auth.store.get(auth2.user);
+  if (!user) throw ServerError_default.AUTH_NO_USER();
+  user.strategy = auth2.strategy;
+  user.provider = auth2.provider;
+  return ctx.options.auth.cleanUser(user);
+}
+
+// src/auth/logout.ts
+async function logout(ctx) {
+  const session2 = findSessionId(ctx);
+  const { strategy } = ctx.user;
+  await ctx.options.auth.session.del(session2);
+  if (!strategy) throw new Error(`Invalid strategy "${strategy}"`);
+  if (strategy.includes("token")) {
+    return { token: null };
+  }
+  if (strategy.includes("cookie")) {
+    return cookies({ authorization: null }).redirect("/");
+  }
+  if (strategy.includes("jwt")) {
+    throw new Error("JWT auth not supported yet");
+  }
+  if (strategy.includes("key")) {
+    throw new Error("Key auth not supported yet");
+  }
+  throw new Error("Unknown auth type");
+}
+
+// src/auth/index.ts
+function auth(app) {
+  app.use(async function middle(ctx) {
+    ctx.user = await getUser(ctx);
+  });
+  if (app.settings.auth.provider.includes("github")) {
+    if (!env.GITHUB_ID) throw new Error("GITHUB_ID not defined");
+    if (!env.GITHUB_SECRET) throw new Error("GITHUB_SECRET not defined");
+    app.get("/auth/logout", logout);
+    app.get("/auth/login/github", providers_default.github.login);
+    app.get("/auth/callback/github", providers_default.github.callback);
+  }
+  if (app.settings.auth.provider.includes("email")) {
+    app.post("/auth/logout", logout);
+    app.post("/auth/register/email", providers_default.email.register);
+    app.post("/auth/login/email", providers_default.email.login);
+    app.put("/auth/password/email", providers_default.email.password);
+    app.put("/auth/reset/email", providers_default.email.reset);
+  }
+}
+
+// src/middle/assets.ts
+async function assets(ctx) {
+  if (!ctx.options.public) return;
+  if (ctx.method !== "get") return;
+  if (ctx.url.pathname === "/") return;
+  try {
+    const asset = await ctx.options.public.read(ctx.url.pathname);
+    if (!asset) return;
+    return type(ctx.url.pathname.split(".").pop()).send(asset);
+  } catch {
+  }
+}
+
+// src/middle/openapi.ts
+import * as fsp2 from "fs/promises";
+var entities = {
+  "&": "&amp;",
+  "<": "&lt;",
+  ">": "&gt;",
+  '"': "&quot;"
+};
+var encode = (str = "") => {
   if (typeof str === "number") str = String(str);
   if (typeof str !== "string") return "";
   return str.replace(/[&<>"]/g, (tag) => entities[tag]);
 };
 var getConfig = (routes) => {
   const config2 = routes.find(
-    (r) => typeof r !== "string" && typeof r !== "function" && typeof r === "object"
+    (r2) => typeof r2 !== "string" && typeof r2 !== "function" && typeof r2 === "object"
   );
   if (!config2) return {};
   if (config2.tags) {
@@ -1520,10 +1565,205 @@ var openapi_default = async (ctx) => {
 </html> `;
 };
 
-// src/middle/index.ts
-var auth2 = auth_default.middle;
+// src/middle/timer.ts
+var createTime = () => {
+  const times2 = [["init", performance.now()]];
+  const time = (name) => times2.push([name, performance.now()]);
+  time.times = times2;
+  time.headers = () => {
+    const r2 = (t) => Math.round(t);
+    const times3 = time.times;
+    const timing = times3.slice(1).map(([name, time2], i) => `${name};dur=${r2(time2 - times3[i][1])}`).join(", ");
+    return timing;
+  };
+  return time;
+};
+function timer(ctx) {
+  ctx.time = createTime();
+}
+
+// src/auth/NoSession.ts
+var NoSession = class {
+};
+function createNoSession() {
+  return new Proxy(NoSession, {
+    get(target, key) {
+      if (target[key]) return target[key];
+      if (key === "then") return target[key];
+      if (typeof key === "symbol") return target[key];
+      throw ServerError_default.NO_STORE_READ({ key: String(key) });
+    },
+    set(target, key, value) {
+      if (target[key] || key === "then" || typeof key === "symbol") {
+        target[key] = value;
+        return true;
+      }
+      throw ServerError_default.NO_STORE_WRITE({ key: String(key) });
+    }
+  });
+}
+
+// src/auth/session.ts
+async function session(ctx) {
+  const store = ctx.options.session?.store;
+  if (!store) {
+    ctx.session = createNoSession();
+    return;
+  }
+  if (ctx.cookies.session) {
+    const session2 = await store.get(ctx.cookies.session);
+    ctx.session = session2;
+    return;
+  }
+}
+
+// src/context/node.ts
+import { TLSSocket } from "tls";
+
+// src/context/createEvents.ts
+function createEvents() {
+  const events = {};
+  events.on = (name, callback2) => {
+    events[name] = events[name] || [];
+    events[name].push(callback2);
+  };
+  events.trigger = (name, data) => {
+    if (!events[name]) return;
+    for (const cb of events[name]) {
+      cb(data);
+    }
+  };
+  return events;
+}
+
+// src/context/isValidMethod.ts
+var methods = [
+  "get",
+  "post",
+  "put",
+  "patch",
+  "delete",
+  "head",
+  "options",
+  "socket"
+];
+function isValidMethod(method) {
+  return methods.includes(method);
+}
+
+// src/context/node.ts
+var chunkArray = (arr) => arr.length > 2 ? [[arr[0], arr[1]], ...chunkArray(arr.slice(2))] : [arr];
+async function createNode(req, app) {
+  const init = performance.now();
+  const method = req.method?.toLowerCase() || "get";
+  if (!isValidMethod(method)) {
+    throw new Error(`Invalid HTTP method: ${method}`);
+  }
+  const chunks = chunkArray(req.rawHeaders);
+  const headers2 = parseHeaders_default(new Headers(chunks));
+  const cookies2 = parseCookies(headers2.cookie);
+  const scheme = req.socket instanceof TLSSocket ? "https" : "http";
+  const host = headers2.host || `localhost:${app.settings.port}`;
+  const path2 = (req.url || "/").replace(/\/$/, "") || "/";
+  const baseUrl = `${scheme}://${host}`;
+  const url = new URL(path2, baseUrl);
+  define(
+    url,
+    "query",
+    (url2) => Object.fromEntries(url2.searchParams.entries())
+  );
+  const rawBody = await new Promise((resolve2, reject) => {
+    const body2 = [];
+    req.on("data", (chunk) => body2.push(chunk)).on("end", () => resolve2(Buffer.concat(body2))).on("error", reject);
+  });
+  const body = rawBody ? await parseBody(rawBody, headers2["content-type"], app.settings.uploads) : void 0;
+  const events = createEvents();
+  return {
+    options: app.settings,
+    platform: app.platform,
+    url,
+    method,
+    body,
+    headers: headers2,
+    cookies: cookies2,
+    init,
+    events,
+    app
+  };
+}
+
+// src/context/winter.ts
+async function createWinter(req, app) {
+  const init = performance.now();
+  const method = req.method.toLowerCase();
+  if (!isValidMethod(method)) {
+    throw new Error(`Invalid HTTP method: ${method}`);
+  }
+  const headers2 = parseHeaders_default(req.headers);
+  const cookies2 = parseCookies(headers2.cookie);
+  const baseUrl = req.url.replace(/\/$/, "") || "/";
+  const url = new URL(baseUrl);
+  define(
+    url,
+    "query",
+    (url2) => Object.fromEntries(url2.searchParams.entries())
+  );
+  const rawBody = Buffer.from(await req.arrayBuffer());
+  const body = req.body ? await parseBody(rawBody, headers2["content-type"], app.settings.uploads) : void 0;
+  const events = createEvents();
+  return {
+    options: app.settings,
+    platform: app.platform,
+    url,
+    method,
+    body,
+    headers: headers2,
+    cookies: cookies2,
+    init,
+    events,
+    app
+  };
+}
+
+// src/context/handlers.ts
+var Winter = async (app, request, env3) => {
+  if (env3?.upgrade(request)) return;
+  Object.assign(globalThis.env, env3);
+  const ctx = await createWinter(request, app);
+  const res = await handleRequest(app.handlers, ctx);
+  ctx.events.trigger("finish", { ...ctx, res, end: performance.now() });
+  return res;
+};
+var Node = async (app) => {
+  const http = await import("http");
+  http.createServer(async (request, response) => {
+    const ctx = await createNode(request, app);
+    if ("error" in ctx) throw ctx.error;
+    const out = await handleRequest(app.handlers, ctx);
+    response.writeHead(out.status || 200, parseHeaders_default(out.headers));
+    if (out.body instanceof ReadableStream) {
+      await iterate(out.body, (chunk) => response.write(chunk));
+    } else {
+      response.write(out.body || "");
+    }
+    response.end();
+  }).listen(app.settings.port);
+};
+var Netlify = async (app, request, context) => {
+  request.context = context;
+  if (typeof Netlify === "undefined") {
+    throw new Error("Netlify doesn't exist");
+  }
+  const ctx = await createWinter(request, app);
+  const res = await handleRequest(app.handlers, ctx);
+  ctx.events.trigger("finish", { ...ctx, res, end: performance.now() });
+  return res;
+};
 
 // src/router.ts
+function isMiddleware(x) {
+  return typeof x === "function";
+}
 var Router = class _Router {
   handlers = {
     socket: [],
@@ -1545,35 +1785,59 @@ var Router = class _Router {
       middleware.unshift(path2);
       path2 = "*";
     }
-    const methods = method === "*" ? Object.keys(this.handlers) : [method];
-    for (const m of methods) {
+    const methods2 = method === "*" ? Object.keys(this.handlers) : [method];
+    for (const m of methods2) {
       this.handlers[m].push([method, path2, ...middleware]);
     }
     return this.self();
   }
-  socket(path2, ...middleware) {
-    return this.handle("socket", path2, ...middleware);
+  socket(pathOrMid, optionsOrMid, ...middleware) {
+    if (typeof pathOrMid === "string" && isMiddleware(optionsOrMid)) {
+      return this.handle("socket", pathOrMid, optionsOrMid, ...middleware);
+    }
+    return this.handle("socket", pathOrMid, ...middleware);
   }
-  get(path2, ...middleware) {
-    return this.handle("get", path2, ...middleware);
+  get(pathOrMid, optionsOrMid, ...middleware) {
+    if (typeof pathOrMid === "string" && isMiddleware(optionsOrMid)) {
+      return this.handle("get", pathOrMid, optionsOrMid, ...middleware);
+    }
+    return this.handle("get", pathOrMid, ...middleware);
   }
-  head(path2, ...middleware) {
-    return this.handle("head", path2, ...middleware);
+  head(pathOrMid, optionsOrMid, ...middleware) {
+    if (typeof pathOrMid === "string" && isMiddleware(optionsOrMid)) {
+      return this.handle("head", pathOrMid, optionsOrMid, ...middleware);
+    }
+    return this.handle("head", pathOrMid, ...middleware);
   }
-  post(path2, ...middleware) {
-    return this.handle("post", path2, ...middleware);
+  post(pathOrMid, optionsOrMid, ...middleware) {
+    if (typeof pathOrMid === "string" && isMiddleware(optionsOrMid)) {
+      return this.handle("post", pathOrMid, optionsOrMid, ...middleware);
+    }
+    return this.handle("post", pathOrMid, ...middleware);
   }
-  put(path2, ...middleware) {
-    return this.handle("put", path2, ...middleware);
+  put(pathOrMid, optionsOrMid, ...middleware) {
+    if (typeof pathOrMid === "string" && isMiddleware(optionsOrMid)) {
+      return this.handle("put", pathOrMid, optionsOrMid, ...middleware);
+    }
+    return this.handle("put", pathOrMid, ...middleware);
   }
-  patch(path2, ...middleware) {
-    return this.handle("patch", path2, ...middleware);
+  patch(pathOrMid, optionsOrMid, ...middleware) {
+    if (typeof pathOrMid === "string" && isMiddleware(optionsOrMid)) {
+      return this.handle("patch", pathOrMid, optionsOrMid, ...middleware);
+    }
+    return this.handle("patch", pathOrMid, ...middleware);
   }
-  del(path2, ...middleware) {
-    return this.handle("delete", path2, ...middleware);
+  del(pathOrMid, optionsOrMid, ...middleware) {
+    if (typeof pathOrMid === "string" && isMiddleware(optionsOrMid)) {
+      return this.handle("delete", pathOrMid, optionsOrMid, ...middleware);
+    }
+    return this.handle("delete", pathOrMid, ...middleware);
   }
-  options(path2, ...middleware) {
-    return this.handle("options", path2, ...middleware);
+  options(pathOrMid, optionsOrMid, ...middleware) {
+    if (typeof pathOrMid === "string" && isMiddleware(optionsOrMid)) {
+      return this.handle("options", pathOrMid, optionsOrMid, ...middleware);
+    }
+    return this.handle("options", pathOrMid, ...middleware);
   }
   use(...args) {
     const path2 = typeof args[0] === "string" ? args.shift() : "*";
@@ -1601,337 +1865,46 @@ function isSerializable(body) {
   if (typeof body === "string") return false;
   if (body instanceof ReadableStream) return false;
   if (body instanceof FormData) return false;
+  if (body instanceof Blob) return false;
+  if (body instanceof ArrayBuffer) return false;
+  if (ArrayBuffer.isView(body)) return false;
+  if (body instanceof URLSearchParams) return false;
   return true;
 }
 function ServerTest(app) {
   const port = app.settings.port;
-  const fetch2 = async (path2, method, options = {}) => {
-    try {
-      if (!options.headers) options.headers = {};
-      if (isSerializable(options.body)) {
-        options.headers["content-type"] = "application/json";
-        options.body = JSON.stringify(options.body);
-      }
-      const res = await app.fetch(
-        new Request(`http://localhost:${port}${path2}`, {
-          method,
-          ...options
-        })
-      );
-      const headers2 = parseHeaders_default(res.headers);
-      let body;
-      if (headers2["content-type"]?.includes("application/json")) {
-        body = await res.json();
-      } else {
-        body = await res.text();
-      }
-      return { status: res.status, headers: headers2, body };
-    } catch (error) {
-      return { status: 500, headers: {}, body: error.message };
+  const fetch2 = async (method, path2, options = {}) => {
+    if (!options.headers) options.headers = {};
+    if (isSerializable(options.body)) {
+      options.headers["content-type"] = "application/json";
+      options.body = JSON.stringify(options.body);
     }
+    return await app.fetch(
+      new Request(`http://localhost:${port}${path2}`, {
+        method,
+        ...options
+      })
+    );
   };
   return {
-    get: (path2, options) => fetch2(path2, "get", options),
-    head: (path2, options) => fetch2(path2, "head", options),
-    post: (path2, body, options) => fetch2(path2, "post", { body, ...options }),
-    put: (path2, body, options) => fetch2(path2, "put", { body, ...options }),
-    patch: (path2, body, options) => fetch2(path2, "patch", { body, ...options }),
-    delete: (path2, options) => fetch2(path2, "delete", options),
-    options: (path2, options) => fetch2(path2, "options", options)
+    get: (path2, options) => fetch2("get", path2, options),
+    head: (path2, options) => fetch2("head", path2, options),
+    post: (path2, body, options) => fetch2("post", path2, { body, ...options }),
+    put: (path2, body, options) => fetch2("put", path2, { body, ...options }),
+    patch: (path2, body, options) => fetch2("patch", path2, { body, ...options }),
+    delete: (path2, options) => fetch2("delete", path2, options),
+    options: (path2, options) => fetch2("options", path2, options)
   };
 }
 
-// src/context/parseBody.ts
-function getBoundary(header) {
-  if (!header) return null;
-  if (header.includes("multipart/form-data") && !header.includes("boundary=")) {
-    console.error("Do not set the `Content-Type` manually for FormData");
-  }
-  const items = header.split(";");
-  for (const item of items) {
-    const trimmedItem = item.trim();
-    if (trimmedItem.startsWith("boundary=")) {
-      return trimmedItem.split("=")[1].trim();
-    }
-  }
-  return null;
-}
-function getMatching(string, regex) {
-  const matches = string.match(regex);
-  return matches?.[1] ?? "";
-}
-var saveFile = async (name, value, bucket) => {
-  const ext = name.split(".").pop();
-  const id = `${createId()}.${ext}`;
-  await bucket.write(id, value);
-  return id;
-};
-function splitBuffer(buffer, delimiter) {
-  const result = [];
-  let start = 0;
-  let index = buffer.indexOf(delimiter);
-  while (index !== -1) {
-    result.push(buffer.slice(start, index));
-    start = index + delimiter.length;
-    index = buffer.indexOf(delimiter, start);
-  }
-  result.push(buffer.slice(start));
-  return result;
-}
-var BREAK_BUFFER = Buffer.from("\r\n\r\n");
-function isProbablyText(buffer) {
-  for (let i = 0; i < Math.min(buffer.length, 512); i++) {
-    const byte = buffer[i];
-    if (byte === 0) return false;
-    if (byte < 7 || byte > 13 && byte < 32) return false;
-  }
-  return true;
-}
-async function parseBody(raw, contentType, bucket) {
-  const contentTypeStr = Array.isArray(contentType) ? contentType[0] : contentType;
-  let rawBuffer;
-  if (raw instanceof Buffer) {
-    rawBuffer = raw;
-  } else if ("arrayBuffer" in raw && typeof raw.arrayBuffer === "function") {
-    const arrayBuf = await raw.arrayBuffer();
-    rawBuffer = Buffer.from(arrayBuf);
-  } else {
-    throw new Error("Unsupported raw type");
-  }
-  if (!rawBuffer) return {};
-  if (!contentTypeStr || /text\/plain/.test(contentTypeStr)) {
-    return rawBuffer.toString("utf-8");
-  }
-  if (/application\/json/.test(contentTypeStr)) {
-    return JSON.parse(rawBuffer.toString("utf-8"));
-  }
-  const boundary = getBoundary(contentTypeStr);
-  if (!boundary) return null;
-  const body = {};
-  const boundaryBuffer = Buffer.from(`--${boundary}`);
-  const parts = splitBuffer(rawBuffer, boundaryBuffer);
-  for (const part of parts) {
-    if (part.length === 0 || part.equals(Buffer.from("--\r\n"))) continue;
-    const idx = part.indexOf(BREAK_BUFFER);
-    if (idx === -1) continue;
-    const headerStr = part.slice(0, idx).toString("utf-8");
-    const contentBuf = part.slice(idx + BREAK_BUFFER.length, part.length - 2);
-    const name = getMatching(headerStr, /name="(.+?)"/).trim().replace(/\[\]$/, "");
-    if (!name) continue;
-    const filename = getMatching(headerStr, /filename="(.+?)"/).trim();
-    if (filename) {
-      if (!bucket) throw new Error("Bucket is required to save files");
-      body[name] = await saveFile(filename, contentBuf, bucket);
-    } else {
-      const value = isProbablyText(contentBuf) ? contentBuf.toString("utf-8").trim() : contentBuf;
-      if (body[name]) {
-        if (!Array.isArray(body[name])) body[name] = [body[name]];
-        body[name].push(value);
-      } else {
-        body[name] = value;
-      }
-    }
-  }
-  return body;
-}
-
-// src/context/parseCookies.ts
-function parseCookies(cookies2) {
-  if (!cookies2) return {};
-  const cookieStr = Array.isArray(cookies2) ? cookies2[0] : cookies2;
-  if (!cookieStr) return {};
-  return Object.fromEntries(
-    cookieStr.split(/;\s*/).map((part) => {
-      const [key, ...rest] = part.split("=");
-      return [key, decodeURIComponent(rest.join("="))];
-    })
-  );
-}
-
-// src/context/winter.ts
-function isValidMethod(method) {
-  return [
-    "get",
-    "post",
-    "put",
-    "patch",
-    "delete",
-    "head",
-    "options",
-    "socket"
-  ].includes(method);
-}
-var winter_default = async (request, app) => {
-  try {
-    const ctx = {
-      headers: {},
-      cookies: {},
-      url: void 0,
-      options: app.settings || {},
-      method: "get",
-      init: performance.now(),
-      req: request
-    };
-    const method = request.method.toLowerCase();
-    if (!isValidMethod(method)) {
-      throw new Error(`Invalid HTTP method: ${method}`);
-    }
-    ctx.method = method;
-    const events = {};
-    ctx.on = (name, callback2) => {
-      events[name] = events[name] || [];
-      events[name].push(callback2);
-    };
-    ctx.trigger = (name, data) => {
-      if (!events[name]) return;
-      for (const cb of events[name]) {
-        cb(data);
-      }
-    };
-    ctx.headers = parseHeaders_default(request.headers);
-    ctx.cookies = parseCookies(ctx.headers.cookie);
-    await auth_default.load(ctx);
-    ctx.url = new URL(request.url.replace(/\/$/, ""));
-    define(
-      ctx.url,
-      "query",
-      (url) => Object.fromEntries(url.searchParams.entries())
-    );
-    if (request.body) {
-      const type2 = ctx.headers["content-type"];
-      ctx.body = await parseBody(request, type2, ctx.options.uploads);
-    }
-    ctx.app = app;
-    ctx.platform = app.platform;
-    ctx.machine = app.platform;
-    return ctx;
-  } catch (error) {
-    return { error };
-  }
-};
-
-// src/context/node.ts
-function isValidMethod2(method) {
-  return [
-    "get",
-    "post",
-    "put",
-    "patch",
-    "delete",
-    "head",
-    "options",
-    "socket"
-  ].includes(method);
-}
-var chunkArray = (arr, size) => arr.length > size ? [arr.slice(0, size), ...chunkArray(arr.slice(size), size)] : [arr];
-var node_default = async (request, app) => {
-  try {
-    const ctx = {
-      headers: {},
-      cookies: {},
-      url: void 0,
-      options: app.settings || {},
-      method: "get",
-      req: request
-    };
-    const method = request.method?.toLowerCase() || "get";
-    if (!isValidMethod2(method)) {
-      throw new Error(`Invalid HTTP method: ${method}`);
-    }
-    ctx.method = method;
-    const events = {};
-    ctx.on = (name, callback2) => {
-      events[name] = events[name] || [];
-      events[name].push(callback2);
-    };
-    ctx.trigger = (name, data) => {
-      if (!events[name]) return;
-      for (const cb of events[name]) {
-        cb(data);
-      }
-    };
-    ctx.headers = parseHeaders_default(
-      new Headers(chunkArray(request.rawHeaders, 2))
-    );
-    ctx.cookies = parseCookies(ctx.headers.cookie);
-    await auth_default.load(ctx);
-    const https = request.connection?.encrypted ? "https" : "http";
-    const host = ctx.headers.host || `localhost:${ctx.options.port}`;
-    const path2 = (request.url || "/").replace(/\/$/, "") || "/";
-    ctx.url = new URL(path2, `${https}://${host}`);
-    define(
-      ctx.url,
-      "query",
-      (url) => Object.fromEntries(url.searchParams.entries())
-    );
-    await new Promise((resolve2, reject) => {
-      const body = [];
-      request.on("data", (chunk) => {
-        body.push(chunk);
-      }).on("end", async () => {
-        const type2 = ctx.headers["content-type"];
-        const concatenated = Buffer.concat(body);
-        ctx.body = await parseBody(concatenated, type2, ctx.options.uploads);
-        resolve2();
-      }).on("error", reject);
-    });
-    ctx.app = app;
-    ctx.platform = app.platform;
-    ctx.machine = app.platform;
-    return ctx;
-  } catch (error) {
-    return { error };
-  }
-};
-
-// src/context/handlers.ts
-var Winter = async (app, request, env3) => {
-  if (env3?.upgrade(request)) return;
-  Object.assign(globalThis.env, env3);
-  const ctx = await winter_default(request, app);
-  if ("error" in ctx) {
-    throw ctx.error;
-  }
-  const res = await handleRequest(app.handlers, ctx);
-  ctx.trigger("finish", { ...ctx, res, end: performance.now() });
-  return res;
-};
-var Node = async (app) => {
-  const http = await import("http");
-  http.createServer(async (request, response) => {
-    const ctx = await node_default(request, app);
-    if ("error" in ctx) {
-      throw ctx.error;
-    }
-    const out = await handleRequest(app.handlers, ctx);
-    response.writeHead(out.status || 200, parseHeaders_default(out.headers));
-    if (out.body instanceof ReadableStream) {
-      await iterate(out.body, (chunk) => response.write(chunk));
-    } else {
-      response.write(out.body || "");
-    }
-    response.end();
-  }).listen(app.settings.port);
-};
-var Netlify = async (app, request, context) => {
-  request.context = context;
-  if (typeof Netlify === "undefined") {
-    throw new Error("Netlify doesn't exist");
-  }
-  const ctx = await winter_default(request, app);
-  if ("error" in ctx) {
-    throw ctx.error;
-  }
-  return await handleRequest(app.handlers, ctx);
-};
-
 // src/index.ts
 var Server = class extends Router {
   settings;
   platform;
-  port;
   sockets;
   websocket;
+  // Needed to be explicit for Bun/WinterCG
+  port;
   constructor(options = {}) {
     super();
     this.settings = config(options);
@@ -1946,12 +1919,13 @@ var Server = class extends Router {
     }
     this.use(timer);
     this.use(assets);
+    this.use(session);
+    if (this.settings.auth) {
+      auth(this);
+    }
     if (this.settings.openapi) {
       this.get(this.settings.openapi.path || "/docs", openapi_default);
     }
-    if (this.settings.auth) {
-      this.use(auth2);
-    }
   }
   // We need to return a function; some environment expect the default export
   // to be a function that is called with the request, but we also want to
@@ -1988,7 +1962,7 @@ function server(options = {}) {
   return new Server(options).self();
 }
 export {
-  Reply,
+  Server,
   ServerError_default as ServerError,
   cookies,
   server as default,
@@ -2000,6 +1974,5 @@ export {
   router,
   send,
   status,
-  type,
-  view
+  type
 };