@solgate/server 0.2.0

package/dist/chunk-MSHXG5G3.js

@@ -0,0 +1,1358 @@
+// src/verifiers/types.ts
+var pass = (key, module, evidence) => ({
+  key,
+  module,
+  passed: true,
+  evidence,
+  checkedAt: Date.now()
+});
+var fail = (key, module, reason, evidence) => ({
+  key,
+  module,
+  passed: false,
+  reason,
+  evidence,
+  checkedAt: Date.now()
+});
+var VerificationUnavailable = class extends Error {
+  code = "verification_unavailable";
+};
+
+// src/verifiers/onchain.ts
+import { NftOwnershipModule, TokenBalanceModule, WalletSignatureModule } from "@solgate/core";
+async function rpc(url, method, params) {
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params })
+  });
+  if (!res.ok) throw new Error(`RPC ${method} failed: ${res.status}`);
+  const j = await res.json();
+  if (j.error) throw new Error(`RPC ${method}: ${j.error.message}`);
+  return j.result;
+}
+function toRawAmount(ui, decimals) {
+  const [int, frac = ""] = String(ui).split(".");
+  const fracPadded = (frac + "0".repeat(decimals)).slice(0, decimals);
+  return BigInt(int || "0") * 10n ** BigInt(decimals) + BigInt(fracPadded || "0");
+}
+var walletSignatureVerifier = {
+  moduleId: WalletSignatureModule.id,
+  async verify({ requirement, entry }) {
+    return pass(requirement.key, requirement.module, { wallet: entry.wallet });
+  }
+};
+var tokenBalanceVerifier = {
+  moduleId: TokenBalanceModule.id,
+  async verify({ requirement, config, wallet, cfg }) {
+    let r;
+    try {
+      r = await rpc(cfg.solana.rpcUrl, "getTokenAccountsByOwner", [wallet, { mint: config.mint }, { encoding: "jsonParsed" }]);
+    } catch (e) {
+      throw new VerificationUnavailable(`Could not read token balance: ${e.message}`);
+    }
+    let total = 0n;
+    let decimals = 0;
+    for (const acc of r.value) {
+      const t = acc.account.data.parsed.info.tokenAmount;
+      decimals = t.decimals;
+      total += BigInt(t.amount);
+      if (!config.includeAllAccounts) break;
+    }
+    const required = toRawAmount(config.min, decimals);
+    const evidence = { mint: config.mint, balanceRaw: total.toString(), decimals, required: config.min, accounts: r.value.length };
+    return total >= required ? pass(requirement.key, requirement.module, evidence) : fail(requirement.key, requirement.module, `Need at least ${config.min}, found ${Number(total) / 10 ** decimals}`, evidence);
+  }
+};
+var nftOwnershipVerifier = {
+  moduleId: NftOwnershipModule.id,
+  async verify({ requirement, config, wallet, cfg }) {
+    const matches = [];
+    let page = 1;
+    while (page <= 10) {
+      let r;
+      try {
+        r = await rpc(cfg.solana.dasUrl, "getAssetsByOwner", [{ ownerAddress: wallet, page, limit: 1e3, displayOptions: { showCollectionMetadata: false } }]);
+      } catch (e) {
+        throw new VerificationUnavailable(`Could not read NFT holdings: ${e.message}`);
+      }
+      for (const a of r.items) {
+        if (a.burnt) continue;
+        const inCollection = config.collection && a.grouping?.some((g) => g.group_key === "collection" && g.group_value === config.collection && g.verified !== false);
+        const inMints = config.mints?.includes(a.id);
+        const byCreator = config.creator && a.creators?.some((c) => c.address === config.creator && c.verified);
+        if (inCollection || inMints || byCreator) matches.push(a.id);
+      }
+      if (r.items.length < 1e3) break;
+      page++;
+    }
+    const evidence = { matched: matches.slice(0, 50), count: matches.length, required: config.min };
+    return matches.length >= config.min ? pass(requirement.key, requirement.module, evidence) : fail(requirement.key, requirement.module, `Need ${config.min} qualifying NFT(s), found ${matches.length}`, evidence);
+  }
+};
+
+// src/crypto.ts
+import * as ed from "@noble/ed25519";
+import { sha512 } from "@noble/hashes/sha512";
+import { sha256 } from "@noble/hashes/sha256";
+import { hmac } from "@noble/hashes/hmac";
+import bs58 from "bs58";
+ed.etc.sha512Sync = (...m) => sha512(ed.etc.concatBytes(...m));
+var enc = new TextEncoder();
+var toHex = (u) => Array.from(u, (b) => b.toString(16).padStart(2, "0")).join("");
+var sha256Hex = (s) => toHex(sha256(enc.encode(s)));
+var hmacHex = (secret, data) => toHex(hmac(sha256, enc.encode(secret), enc.encode(data)));
+function randomId(bytes = 16) {
+  const b = new Uint8Array(bytes);
+  crypto.getRandomValues(b);
+  return toHex(b);
+}
+function base64url(u) {
+  const bytes = typeof u === "string" ? enc.encode(u) : u;
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromBase64url(s) {
+  const b = atob(s.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - s.length % 4) % 4));
+  return Uint8Array.from(b, (c) => c.charCodeAt(0));
+}
+function verifyWalletSignature(wallet, message, signature) {
+  try {
+    const pub = bs58.decode(wallet);
+    let sig;
+    try {
+      sig = bs58.decode(signature);
+      if (sig.length !== 64) throw new Error();
+    } catch {
+      sig = fromBase64url(signature);
+    }
+    return ed.verify(sig, enc.encode(message), pub);
+  } catch {
+    return false;
+  }
+}
+function signSession(secret, p) {
+  const body = base64url(JSON.stringify(p));
+  return `${body}.${hmacHex(secret, body)}`;
+}
+function verifySession(secret, token) {
+  const [body, mac] = token.split(".");
+  if (!body || !mac) return null;
+  if (!safeEqual(hmacHex(secret, body), mac)) return null;
+  try {
+    const p = JSON.parse(new TextDecoder().decode(fromBase64url(body)));
+    if (p.exp < Date.now()) return null;
+    return p;
+  } catch {
+    return null;
+  }
+}
+function pkceVerifier() {
+  return base64url(crypto.getRandomValues(new Uint8Array(32)));
+}
+function pkceChallenge(verifier) {
+  return base64url(sha256(enc.encode(verifier)));
+}
+function safeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let r = 0;
+  for (let i = 0; i < a.length; i++) r |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return r === 0;
+}
+
+// src/verifiers/social.ts
+import {
+  DiscordVerificationModule,
+  SocialTaskModule,
+  TelegramVerificationModule,
+  XVerificationModule,
+  YouTubeVerificationModule
+} from "@solgate/core";
+import { hmac as hmac2 } from "@noble/hashes/hmac";
+import { sha256 as sha2562 } from "@noble/hashes/sha256";
+async function claimIdentity(ctx) {
+  const { storage, campaign, wallet, input } = ctx;
+  const res = await storage.claimSocialLink({
+    campaignId: campaign.id,
+    provider: input.provider,
+    providerUserId: input.id,
+    wallet,
+    handle: input.handle,
+    meta: input.meta,
+    createdAt: Date.now()
+  });
+  return res.ok ? null : `This ${input.provider} account is already linked to another wallet.`;
+}
+var xVerifier = {
+  moduleId: XVerificationModule.id,
+  async verify(ctx) {
+    const { requirement, config, input } = ctx;
+    const dup = await claimIdentity(ctx);
+    if (dup) return fail(requirement.key, requirement.module, dup);
+    const meta = input.meta ?? {};
+    if (config.minAccountAgeDays > 0 && meta.created_at) {
+      const ageDays = (Date.now() - Date.parse(meta.created_at)) / 864e5;
+      if (ageDays < config.minAccountAgeDays)
+        return fail(requirement.key, requirement.module, `X account must be at least ${config.minAccountAgeDays} days old`);
+    }
+    if (config.minFollowers > 0 && (meta.followers ?? 0) < config.minFollowers)
+      return fail(requirement.key, requirement.module, `Need at least ${config.minFollowers} followers`);
+    if (config.follow && input.accessToken) {
+      const ok = await checkXFollow(input.accessToken, input.id, config.follow).catch(() => null);
+      if (ok === false) return fail(requirement.key, requirement.module, `Follow @${config.follow} on X, then retry`);
+      if (ok === null) (input.meta ??= {}).followCheck = "unavailable";
+    }
+    return pass(requirement.key, requirement.module, { id: input.id, handle: input.handle, followCheck: input.meta?.followCheck ?? "ok" });
+  }
+};
+async function checkXFollow(token, userId, target) {
+  const t = await fetch(`https://api.x.com/2/users/by/username/${encodeURIComponent(target)}`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!t.ok) return null;
+  const targetId = (await t.json()).data?.id;
+  if (!targetId) return null;
+  let next;
+  for (let i = 0; i < 5; i++) {
+    const u = new URL(`https://api.x.com/2/users/${userId}/following`);
+    u.searchParams.set("max_results", "1000");
+    if (next) u.searchParams.set("pagination_token", next);
+    const r = await fetch(u, { headers: { authorization: `Bearer ${token}` } });
+    if (r.status === 403 || r.status === 402) return null;
+    if (!r.ok) return null;
+    const j = await r.json();
+    if (j.data?.some((x) => x.id === targetId)) return true;
+    next = j.meta?.next_token;
+    if (!next) break;
+  }
+  return false;
+}
+var discordVerifier = {
+  moduleId: DiscordVerificationModule.id,
+  async verify(ctx) {
+    const { requirement, config, input, cfg } = ctx;
+    const dup = await claimIdentity(ctx);
+    if (dup) return fail(requirement.key, requirement.module, dup);
+    if (config.guildId) {
+      const guilds = await fetch("https://discord.com/api/v10/users/@me/guilds", {
+        headers: { authorization: `Bearer ${input.accessToken}` }
+      }).then((r) => r.ok ? r.json() : []);
+      if (!guilds.some((g) => g.id === config.guildId))
+        return fail(requirement.key, requirement.module, "Join the Discord server first, then retry");
+      if (config.roleIds.length > 0) {
+        const bot = cfg.oauth?.discord?.botToken;
+        if (!bot) return fail(requirement.key, requirement.module, "Role check not configured (missing bot token)");
+        const m = await fetch(`https://discord.com/api/v10/guilds/${config.guildId}/members/${input.id}`, {
+          headers: { authorization: `Bot ${bot}` }
+        }).then((r) => r.ok ? r.json() : { roles: [] });
+        if (!m.roles?.some((r) => config.roleIds.includes(r)))
+          return fail(requirement.key, requirement.module, "You don't have the required Discord role");
+      }
+    }
+    return pass(requirement.key, requirement.module, { id: input.id, handle: input.handle });
+  }
+};
+function verifyTelegramLogin(botToken, data, maxAgeSeconds = 600, clockSkewSeconds = 60) {
+  const { hash, ...rest } = data;
+  const dataCheck = Object.keys(rest).sort().map((k) => `${k}=${rest[k]}`).join("\n");
+  const secretHex = sha256Hex(botToken);
+  const secretBytes = Uint8Array.from(secretHex.match(/.{2}/g).map((h) => parseInt(h, 16)));
+  const computed = hmacHexBytes(secretBytes, dataCheck);
+  if (typeof hash !== "string" || !safeEqual(computed, hash)) return false;
+  const now = Date.now() / 1e3;
+  const age = now - Number(data.auth_date);
+  return Number.isFinite(age) && age >= -clockSkewSeconds && age <= maxAgeSeconds;
+}
+function hmacHexBytes(key, data) {
+  return Array.from(hmac2(sha2562, key, new TextEncoder().encode(data)), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+var telegramVerifier = {
+  moduleId: TelegramVerificationModule.id,
+  async verify(ctx) {
+    const { requirement, config, input, cfg } = ctx;
+    if (!cfg.telegram) return fail(requirement.key, requirement.module, "Telegram not configured on server");
+    if (!verifyTelegramLogin(cfg.telegram.botToken, input))
+      return fail(requirement.key, requirement.module, "Invalid or expired Telegram login");
+    const profile = { provider: "telegram", id: String(input.id), handle: input.username };
+    const dup = await claimIdentity({ ...ctx, input: profile });
+    if (dup) return fail(requirement.key, requirement.module, dup);
+    if (config.chatId) {
+      const r = await fetch(
+        `https://api.telegram.org/bot${cfg.telegram.botToken}/getChatMember?chat_id=${encodeURIComponent(config.chatId)}&user_id=${input.id}`
+      ).then((r2) => r2.json());
+      const status = r.result?.status;
+      if (!r.ok || !status || ["left", "kicked"].includes(status))
+        return fail(requirement.key, requirement.module, "Join the Telegram channel/group first, then retry");
+    }
+    return pass(requirement.key, requirement.module, { id: input.id, handle: input.username });
+  }
+};
+var youtubeVerifier = {
+  moduleId: YouTubeVerificationModule.id,
+  async verify(ctx) {
+    const { requirement, config, input } = ctx;
+    const dup = await claimIdentity(ctx);
+    if (dup) return fail(requirement.key, requirement.module, dup);
+    const u = new URL("https://www.googleapis.com/youtube/v3/subscriptions");
+    u.searchParams.set("part", "snippet");
+    u.searchParams.set("mine", "true");
+    u.searchParams.set("forChannelId", config.channelId);
+    const r = await fetch(u, { headers: { authorization: `Bearer ${input.accessToken}` } });
+    if (!r.ok) return fail(requirement.key, requirement.module, "Could not read YouTube subscriptions (grant the youtube.readonly scope)");
+    const j = await r.json();
+    return (j.items?.length ?? 0) > 0 ? pass(requirement.key, requirement.module, { id: input.id, channelId: config.channelId }) : fail(requirement.key, requirement.module, "Subscribe to the channel, then retry");
+  }
+};
+var socialTaskVerifier = {
+  moduleId: SocialTaskModule.id,
+  async verify(ctx) {
+    const { requirement, config, input, storage, campaign, wallet } = ctx;
+    const key = `task:${campaign.id}:${wallet}:${requirement.key}`;
+    if (input.action === "open") {
+      await storage.setTemp(key, String(Date.now()), 3600);
+      return fail(requirement.key, requirement.module, "opened", { openedAt: Date.now() });
+    }
+    const opened = Number(await storage.getTemp(key) ?? 0);
+    if (!opened) return fail(requirement.key, requirement.module, "Open the link first");
+    if ((Date.now() - opened) / 1e3 < config.minDwellSeconds)
+      return fail(requirement.key, requirement.module, "That was quick \u2014 give it a moment and try again");
+    if (config.requireProofUrl && !/^https?:\/\//.test(input.proofUrl ?? ""))
+      return fail(requirement.key, requirement.module, "Paste the link to your post as proof");
+    const evidence = { proofUrl: input.proofUrl, pendingApproval: config.requireApproval };
+    if (config.requireApproval)
+      return { ...fail(requirement.key, requirement.module, "Submitted \u2014 waiting for review", evidence), evidence };
+    return pass(requirement.key, requirement.module, evidence);
+  }
+};
+
+// src/verifiers/input.ts
+import { CaptchaModule, QuizModule, ReferralModule, evaluateEntry } from "@solgate/core";
+var quizVerifier = {
+  moduleId: QuizModule.id,
+  async verify({ requirement, config, input, storage, campaign, wallet }) {
+    const attemptsKey = `quiz:${campaign.id}:${wallet}:${requirement.key}`;
+    const attempts = await storage.incrTemp(attemptsKey, 86400);
+    if (attempts > config.maxAttempts) return fail(requirement.key, requirement.module, "No attempts left today");
+    let scored = 0;
+    let correct = 0;
+    for (const q of config.questions) {
+      const a = input.answers?.[q.id];
+      if (q.required && (a === void 0 || a === "" || Array.isArray(a) && a.length === 0))
+        return fail(requirement.key, requirement.module, `Answer "${q.prompt}"`);
+      if (q.answer === void 0) continue;
+      scored++;
+      if (q.type === "single" && a === q.answer) correct++;
+      else if (q.type === "multi" && Array.isArray(a) && Array.isArray(q.answer)) {
+        const s = new Set(a);
+        if (s.size === q.answer.length && q.answer.every((x) => s.has(x))) correct++;
+      } else if (q.type === "text" && typeof a === "string" && typeof q.answer === "string") {
+        const re = q.answer.startsWith("/") && q.answer.endsWith("/") ? new RegExp(q.answer.slice(1, -1), "i") : null;
+        if (re ? re.test(a.trim()) : a.trim().toLowerCase() === q.answer.trim().toLowerCase()) correct++;
+      }
+    }
+    const score = scored === 0 ? 1 : correct / scored;
+    const evidence = { score, correct, scored, attempt: attempts, answers: input.answers };
+    return score >= config.passScore ? pass(requirement.key, requirement.module, evidence) : fail(requirement.key, requirement.module, `Scored ${correct}/${scored}; need ${Math.ceil(config.passScore * scored)}`, evidence);
+  }
+};
+var referralVerifier = {
+  moduleId: ReferralModule.id,
+  async verify({ requirement, config, input, storage, campaign, entry }) {
+    const code = input.code?.trim().toUpperCase();
+    if (!code) {
+      return config.requireCode ? fail(requirement.key, requirement.module, "Enter a referral code") : pass(requirement.key, requirement.module, { code: null });
+    }
+    if (entry.referredBy) return pass(requirement.key, requirement.module, { code, referredBy: entry.referredBy });
+    if (code === entry.referralCode) return fail(requirement.key, requirement.module, "You can't refer yourself");
+    const referrer = await storage.findEntryByReferralCode(campaign.id, code);
+    if (!referrer) return fail(requirement.key, requirement.module, "Unknown referral code");
+    const n = await storage.incrTemp(`refcount:${campaign.id}:${referrer.wallet}`, 60 * 60 * 24 * 365);
+    if (n <= config.maxReferrals && config.referrerPoints > 0) {
+      referrer.bonusPoints = (referrer.bonusPoints ?? 0) + config.referrerPoints;
+      referrer.results[`${requirement.key}:credits`] = {
+        key: `${requirement.key}:credits`,
+        module: "referral-credit",
+        passed: true,
+        evidence: { referrals: n, bonusPoints: referrer.bonusPoints },
+        checkedAt: Date.now()
+      };
+      await storage.putEntry(evaluateEntry(campaign, referrer));
+    }
+    entry.referredBy = referrer.wallet;
+    return pass(requirement.key, requirement.module, { code, referredBy: referrer.wallet });
+  }
+};
+var endpoints = {
+  turnstile: "https://challenges.cloudflare.com/turnstile/v0/siteverify",
+  hcaptcha: "https://api.hcaptcha.com/siteverify",
+  recaptcha: "https://www.google.com/recaptcha/api/siteverify"
+};
+var captchaVerifier = {
+  moduleId: CaptchaModule.id,
+  async verify({ requirement, config, input, cfg, ip }) {
+    const secret = config.provider === "turnstile" ? cfg.captcha?.turnstileSecret : config.provider === "hcaptcha" ? cfg.captcha?.hcaptchaSecret : cfg.captcha?.recaptchaSecret;
+    if (!secret) return fail(requirement.key, requirement.module, `${config.provider} secret not configured on server`);
+    if (!input?.token) return fail(requirement.key, requirement.module, "Complete the CAPTCHA");
+    const body = new URLSearchParams({ secret, response: input.token });
+    if (ip) body.set("remoteip", ip);
+    const r = await fetch(endpoints[config.provider], { method: "POST", body }).then((r2) => r2.json());
+    if (!r.success) return fail(requirement.key, requirement.module, "CAPTCHA failed", { errors: r["error-codes"] });
+    if (config.provider === "recaptcha" && (r.score ?? 0) < config.minScore)
+      return fail(requirement.key, requirement.module, "CAPTCHA score too low", { score: r.score });
+    return pass(requirement.key, requirement.module, { provider: config.provider, score: r.score });
+  }
+};
+
+// src/verifiers/index.ts
+var builtinVerifiers = [
+  walletSignatureVerifier,
+  tokenBalanceVerifier,
+  nftOwnershipVerifier,
+  xVerifier,
+  discordVerifier,
+  telegramVerifier,
+  youtubeVerifier,
+  socialTaskVerifier,
+  quizVerifier,
+  referralVerifier,
+  captchaVerifier
+];
+
+// src/webhooks.ts
+var EventBus = class {
+  constructor(storage, waitUntil) {
+    this.storage = storage;
+    this.waitUntil = waitUntil;
+  }
+  storage;
+  waitUntil;
+  listeners = [];
+  on(fn) {
+    this.listeners.push(fn);
+    return () => this.listeners = this.listeners.filter((l) => l !== fn);
+  }
+  async emit(type, campaignId, data, wallet) {
+    const event = { id: randomId(12), type, campaignId, wallet, data, createdAt: Date.now() };
+    for (const l of this.listeners) await l(event);
+    const p = this.dispatch(event);
+    this.waitUntil ? this.waitUntil(p) : p.catch(() => {
+    });
+    return event;
+  }
+  async dispatch(event) {
+    const hooks = (await this.storage.listWebhooks()).filter(
+      (h) => h.active && (!h.campaignId || h.campaignId === event.campaignId) && (h.events.includes("*") || h.events.includes(event.type))
+    );
+    await Promise.all(hooks.map((h) => this.deliver(h.id, h.url, h.secret, event)));
+  }
+  async deliver(webhookId, url, secret, event, maxAttempts = 3) {
+    const body = JSON.stringify(event);
+    let status = 0;
+    let lastError;
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+      const ts = Math.floor(Date.now() / 1e3);
+      try {
+        const r = await fetch(url, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            "x-allowlist-event": event.type,
+            "x-allowlist-delivery": event.id,
+            "x-allowlist-signature": `t=${ts},v1=${hmacHex(secret, `${ts}.${body}`)}`
+          },
+          body,
+          signal: AbortSignal.timeout(1e4)
+        });
+        status = r.status;
+        if (r.ok) break;
+        lastError = `HTTP ${r.status}`;
+      } catch (e) {
+        lastError = e.message;
+      }
+      await new Promise((res) => setTimeout(res, 500 * 2 ** attempt));
+      if (attempt === maxAttempts) {
+        await this.storage.putDelivery({ id: randomId(8), webhookId, eventId: event.id, status, attempts: attempt, lastError, createdAt: Date.now() });
+        return;
+      }
+    }
+    await this.storage.putDelivery({ id: randomId(8), webhookId, eventId: event.id, status, attempts: 1, lastError, createdAt: Date.now() });
+  }
+};
+function verifyWebhookSignature(secret, header, body, toleranceSeconds = 300) {
+  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
+  const ts = Number(parts.t);
+  if (!ts || Math.abs(Date.now() / 1e3 - ts) > toleranceSeconds) return false;
+  return safeEqual(hmacHex(secret, `${ts}.${body}`), parts.v1 ?? "");
+}
+function assertSafeWebhookUrl(raw, opts = {}) {
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    throw new Error("Invalid URL");
+  }
+  if (opts.allowInsecure && (u.protocol === "http:" || u.protocol === "https:")) return u;
+  if (u.protocol !== "https:") throw new Error("Webhook URL must use https");
+  const h = u.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (h === "localhost" || h.endsWith(".localhost") || h.endsWith(".internal") || h === "0.0.0.0" || h === "::1" || h === "::") throw new Error("Webhook URL may not target localhost");
+  const m = h.match(/^(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
+  if (m) {
+    const [a, b] = [Number(m[1]), Number(m[2])];
+    if (a === 10 || a === 127 || a === 0 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 100 && b >= 64 && b <= 127)
+      throw new Error("Webhook URL may not target a private network");
+  }
+  if (/^(fc|fd|fe80)/i.test(h)) throw new Error("Webhook URL may not target a private network");
+  return u;
+}
+
+// src/service.ts
+import {
+  ModuleRegistry,
+  applyCaps,
+  evaluateEntry as evaluateEntry2,
+  isCampaignOpen,
+  parseCampaign
+} from "@solgate/core";
+import { buildMerkleTree, getMerkleProof } from "@solgate/core";
+var AllowlistError = class extends Error {
+  constructor(status, message, code = "error") {
+    super(message);
+    this.status = status;
+    this.code = code;
+  }
+  status;
+  code;
+};
+var AllowlistService = class {
+  constructor(cfg, waitUntil) {
+    this.cfg = cfg;
+    this.registry = cfg.registry ?? new ModuleRegistry();
+    for (const v of [...builtinVerifiers, ...cfg.verifiers ?? []]) this.verifiers.set(v.moduleId, v);
+    this.events = new EventBus(cfg.storage, waitUntil);
+  }
+  cfg;
+  registry;
+  verifiers = /* @__PURE__ */ new Map();
+  events;
+  /* ---------- campaigns ---------- */
+  async getCampaign(id) {
+    const c = await this.cfg.storage.getCampaign(id);
+    if (!c) throw new AllowlistError(404, "Campaign not found", "campaign_not_found");
+    return c;
+  }
+  async saveCampaign(input) {
+    const c = parseCampaign(input, this.registry);
+    const prev = await this.cfg.storage.getCampaign(c.id);
+    c.createdAt = prev?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString();
+    c.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+    await this.cfg.storage.putCampaign(c);
+    await this.events.emit("campaign.updated", c.id, { name: c.name });
+    return c;
+  }
+  /**
+   * Campaign as seen by the browser. Requirement config is PRIVATE BY DEFAULT:
+   * a module must opt in via `publicConfig` (on its definition, or on the
+   * verifier) to expose anything. Custom modules that forget get `{}`, not
+   * their secrets.
+   */
+  publicCampaign(c) {
+    return {
+      ...c,
+      requirements: c.requirements.map((r) => {
+        const v = this.verifiers.get(r.module);
+        const def = this.registry.get(r.module);
+        const project = def?.publicConfig ?? v?.publicConfig;
+        return {
+          ...r,
+          config: project ? project(r.config) ?? {} : {},
+          category: def?.category ?? "custom",
+          label: r.title ?? def?.label ?? r.module
+        };
+      })
+    };
+  }
+  /* ---------- entries ---------- */
+  async getOrCreateEntry(c, wallet) {
+    const s = this.cfg.storage;
+    let e = await s.getEntry(c.id, wallet);
+    if (e) return e;
+    if (!isCampaignOpen(c)) throw new AllowlistError(403, "Registration is closed", "campaign_closed");
+    const now = Date.now();
+    e = {
+      campaignId: c.id,
+      wallet,
+      results: {},
+      eligible: false,
+      points: 0,
+      allocation: 0,
+      referralCode: await this.uniqueReferralCode(c.id),
+      createdAt: now,
+      updatedAt: now
+    };
+    for (const r of c.requirements.filter((r2) => r2.module === "wallet-signature")) {
+      e.results[r.key] = { key: r.key, module: r.module, passed: true, checkedAt: now, evidence: { wallet } };
+    }
+    e = evaluateEntry2(c, e, now);
+    await s.putEntry(e);
+    await this.events.emit("entry.created", c.id, { eligible: e.eligible }, wallet);
+    return e;
+  }
+  async uniqueReferralCode(campaignId) {
+    for (let i = 0; i < 5; i++) {
+      const code = randomId(4).toUpperCase().slice(0, 8);
+      if (!await this.cfg.storage.findEntryByReferralCode(campaignId, code)) return code;
+    }
+    return randomId(6).toUpperCase();
+  }
+  /** Run one requirement's verifier and persist the result. */
+  async verifyRequirement(c, wallet, key, input, ip) {
+    const requirement = c.requirements.find((r) => r.key === key);
+    if (!requirement) throw new AllowlistError(404, "Unknown requirement", "requirement_not_found");
+    const verifier = this.verifiers.get(requirement.module);
+    if (!verifier) throw new AllowlistError(501, `No verifier for module '${requirement.module}'`, "no_verifier");
+    if (!isCampaignOpen(c)) throw new AllowlistError(403, "Registration is closed", "campaign_closed");
+    const entry = await this.getOrCreateEntry(c, wallet);
+    const wasEligible = entry.eligible;
+    let result;
+    try {
+      result = await verifier.verify({ campaign: c, requirement, config: requirement.config, wallet, entry, input, storage: this.cfg.storage, cfg: this.cfg, ip });
+    } catch (e) {
+      if (e instanceof VerificationUnavailable) throw new AllowlistError(503, e.message, e.code);
+      throw e;
+    }
+    entry.results[key] = result;
+    const updated = evaluateEntry2(c, entry);
+    await this.cfg.storage.putEntry(updated);
+    await this.events.emit(result.passed ? "requirement.passed" : "requirement.failed", c.id, { key, result }, wallet);
+    if (updated.eligible !== wasEligible) {
+      await this.events.emit(updated.eligible ? "entry.eligible" : "entry.ineligible", c.id, { points: updated.points, allocation: updated.allocation }, wallet);
+    } else {
+      await this.events.emit("entry.updated", c.id, { key, passed: result.passed }, wallet);
+    }
+    return { entry: updated, result };
+  }
+  /** Re-run all recheckable (on-chain) requirements for every entry — e.g. snapshot before mint. */
+  async recheckCampaign(c, onlyWallets) {
+    const recheckable = c.requirements.filter((r) => this.registry.get(r.module)?.recheckable);
+    const entries = onlyWallets ? (await Promise.all(onlyWallets.map((w) => this.cfg.storage.getEntry(c.id, w)))).filter(Boolean) : await this.cfg.storage.listEntries(c.id);
+    let changed = 0;
+    let unavailable = 0;
+    for (const entry of entries) {
+      const before = entry.eligible;
+      for (const r of recheckable) {
+        const v = this.verifiers.get(r.module);
+        try {
+          entry.results[r.key] = await v.verify({ campaign: c, requirement: r, config: r.config, wallet: entry.wallet, entry, input: {}, storage: this.cfg.storage, cfg: this.cfg });
+        } catch (e) {
+          if (!(e instanceof VerificationUnavailable)) throw e;
+          unavailable++;
+        }
+      }
+      const updated = evaluateEntry2(c, entry);
+      if (updated.eligible !== before) changed++;
+      await this.cfg.storage.putEntry(updated);
+    }
+    return { checked: entries.length, changed, unavailable };
+  }
+  /**
+   * Freeze the current eligible set (with caps applied) into an immutable
+   * snapshot: root, per-wallet allocation/rank/proof. Serve mint-time lookups
+   * from this so the root can't drift while people are minting.
+   */
+  async createSnapshot(c) {
+    const eligible = (await this.finalEntries(c)).filter((e) => e.eligible);
+    const snap = {
+      id: randomId(6),
+      campaignId: c.id,
+      createdAt: Date.now(),
+      count: eligible.length,
+      totalAllocation: eligible.reduce((s, e) => s + e.allocation, 0),
+      entries: Object.fromEntries(eligible.map((e) => [e.wallet, { allocation: e.allocation, rank: e.rank }]))
+    };
+    if (c.merkle.enabled && eligible.length > 0) {
+      const tree = buildMerkleTree(eligible.map((e) => e.wallet), c.merkle.scheme);
+      snap.merkle = { scheme: tree.scheme, root: tree.root };
+      for (const e of eligible) snap.entries[e.wallet].proof = getMerkleProof(tree, e.wallet);
+    }
+    await this.cfg.storage.putSnapshot(snap);
+    await this.events.emit("campaign.snapshot", c.id, { snapshotId: snap.id, count: snap.count, root: snap.merkle?.root });
+    return snap;
+  }
+  /** Entries with campaign-wide caps applied (ranked FCFS). */
+  async finalEntries(c) {
+    const entries = await this.cfg.storage.listEntries(c.id);
+    return applyCaps(c, entries);
+  }
+  /** Admin override for a single requirement (approve social task, manual pass/fail). */
+  async overrideRequirement(c, wallet, key, passed, note) {
+    const entry = await this.cfg.storage.getEntry(c.id, wallet);
+    if (!entry) throw new AllowlistError(404, "Entry not found", "entry_not_found");
+    const r = c.requirements.find((r2) => r2.key === key);
+    if (!r) throw new AllowlistError(404, "Unknown requirement", "requirement_not_found");
+    entry.results[key] = { key, module: r.module, passed, checkedAt: Date.now(), evidence: { ...entry.results[key]?.evidence, override: true, note } };
+    const updated = evaluateEntry2(c, entry);
+    await this.cfg.storage.putEntry(updated);
+    await this.events.emit(updated.eligible ? "entry.eligible" : "entry.updated", c.id, { key, passed, override: true }, wallet);
+    return updated;
+  }
+};
+
+// src/app.ts
+import { Hono } from "hono";
+import { cors } from "hono/cors";
+import { z } from "zod";
+import { buildSignInMessage, buildMerkleTree as buildMerkleTree2, getMerkleProof as getMerkleProof2, toCSV, toJSON, toRows, toWalletList } from "@solgate/core";
+
+// src/config.ts
+function normalizeConfig(cfg) {
+  const url = new URL(cfg.baseUrl);
+  return {
+    ...cfg,
+    domain: cfg.domain ?? url.host,
+    sessionTtlSeconds: cfg.sessionTtlSeconds ?? 60 * 60 * 24,
+    corsOrigins: cfg.corsOrigins ?? "*",
+    eligibilityLookup: cfg.eligibilityLookup ?? "minimal",
+    trustProxy: cfg.trustProxy ?? "none",
+    rateLimit: cfg.rateLimit ?? { windowSeconds: 60, max: 60 },
+    solana: { ...cfg.solana, dasUrl: cfg.solana.dasUrl ?? cfg.solana.rpcUrl }
+  };
+}
+
+// src/routes/oauth.ts
+var providers = {
+  x: {
+    authUrl: "https://x.com/i/oauth2/authorize",
+    tokenUrl: "https://api.x.com/2/oauth2/token",
+    scope: "tweet.read users.read follows.read",
+    pkce: true,
+    basicAuth: true,
+    async profile(token) {
+      const r = await fetch("https://api.x.com/2/users/me?user.fields=created_at,public_metrics", { headers: { authorization: `Bearer ${token}` } });
+      const j = await r.json();
+      return { provider: "x", id: j.data.id, handle: j.data.username, accessToken: token, meta: { created_at: j.data.created_at, followers: j.data.public_metrics?.followers_count } };
+    }
+  },
+  discord: {
+    authUrl: "https://discord.com/oauth2/authorize",
+    tokenUrl: "https://discord.com/api/v10/oauth2/token",
+    scope: "identify guilds",
+    pkce: false,
+    basicAuth: false,
+    async profile(token) {
+      const r = await fetch("https://discord.com/api/v10/users/@me", { headers: { authorization: `Bearer ${token}` } });
+      const j = await r.json();
+      return { provider: "discord", id: j.id, handle: j.username, accessToken: token };
+    }
+  },
+  google: {
+    authUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+    tokenUrl: "https://oauth2.googleapis.com/token",
+    scope: "openid https://www.googleapis.com/auth/youtube.readonly",
+    pkce: true,
+    basicAuth: false,
+    async profile(token) {
+      const r = await fetch("https://www.googleapis.com/oauth2/v3/userinfo", { headers: { authorization: `Bearer ${token}` } });
+      const j = await r.json();
+      return { provider: "google", id: j.sub, handle: j.email, accessToken: token };
+    }
+  }
+};
+var moduleForProvider = { x: "x-verify", discord: "discord-verify", google: "youtube-verify" };
+function resolveReturnUrl(raw, cfg) {
+  const base = new URL(cfg.baseUrl);
+  let u;
+  try {
+    u = new URL(raw ?? "/", base);
+  } catch {
+    return null;
+  }
+  if (u.protocol !== "https:" && u.protocol !== "http:") return null;
+  const corsOrigins = Array.isArray(cfg.corsOrigins) ? cfg.corsOrigins : [];
+  const allowed = /* @__PURE__ */ new Set([base.origin, ...cfg.allowedReturnOrigins ?? [], ...corsOrigins]);
+  return allowed.has(u.origin) ? u : null;
+}
+function registerOAuthRoutes(app, svc, cfg, requireSession) {
+  app.get("/campaigns/:id/oauth/:provider/start", requireSession, async (c) => {
+    const provider = c.req.param("provider");
+    const def = providers[provider];
+    const client = cfg.oauth?.[provider];
+    if (!def || !client) return c.json({ error: "not_configured", message: `${provider} OAuth is not configured` }, 501);
+    const campaign = await svc.getCampaign(c.req.param("id"));
+    const key = c.req.query("key");
+    const req = campaign.requirements.find((r) => r.key === key && r.module === moduleForProvider[provider]);
+    if (!req) return c.json({ error: "bad_request", message: "Requirement key does not match provider" }, 400);
+    const returnUrl = resolveReturnUrl(c.req.query("return"), cfg);
+    if (!returnUrl) return c.json({ error: "bad_request", message: "return URL is not an allowed origin" }, 400);
+    const returnTo = returnUrl.toString();
+    const state = randomId(16);
+    const verifier = def.pkce ? pkceVerifier() : "";
+    await cfg.storage.setTemp(`oauth:${state}`, JSON.stringify({ campaignId: campaign.id, wallet: c.get("session").wallet, key, returnTo, verifier }), 600);
+    const u = new URL(def.authUrl);
+    u.searchParams.set("response_type", "code");
+    u.searchParams.set("client_id", client.clientId);
+    u.searchParams.set("redirect_uri", `${cfg.baseUrl}/oauth/${provider}/callback`);
+    u.searchParams.set("scope", def.scope);
+    u.searchParams.set("state", state);
+    if (def.pkce) {
+      u.searchParams.set("code_challenge", pkceChallenge(verifier));
+      u.searchParams.set("code_challenge_method", "S256");
+    }
+    if (provider === "google") u.searchParams.set("access_type", "online");
+    return c.req.query("redirect") === "1" ? c.redirect(u.toString()) : c.json({ url: u.toString() });
+  });
+  app.get("/oauth/:provider/callback", async (c) => {
+    const provider = c.req.param("provider");
+    const def = providers[provider];
+    const client = cfg.oauth?.[provider];
+    const state = c.req.query("state") ?? "";
+    const raw = await cfg.storage.getTemp(`oauth:${state}`);
+    if (!def || !client || !raw) return c.text("Invalid or expired OAuth state", 400);
+    await cfg.storage.deleteTemp(`oauth:${state}`);
+    const { campaignId, wallet, key, returnTo, verifier } = JSON.parse(raw);
+    const back = (status, msg) => {
+      const u = resolveReturnUrl(returnTo, cfg) ?? new URL("/", cfg.baseUrl);
+      u.searchParams.set("allowlist", `${key}:${status}`);
+      if (msg) u.searchParams.set("allowlist_msg", msg);
+      return c.redirect(u.toString());
+    };
+    if (c.req.query("error")) return back("error", c.req.query("error_description") ?? "Authorization denied");
+    const code = c.req.query("code");
+    if (!code) return back("error", "Missing code");
+    const body = new URLSearchParams({ grant_type: "authorization_code", code, redirect_uri: `${cfg.baseUrl}/oauth/${provider}/callback`, client_id: client.clientId });
+    if (def.pkce) body.set("code_verifier", verifier);
+    const headers = { "content-type": "application/x-www-form-urlencoded" };
+    if (def.basicAuth) headers.authorization = `Basic ${btoa(`${client.clientId}:${client.clientSecret}`)}`;
+    else body.set("client_secret", client.clientSecret);
+    const tokenRes = await fetch(def.tokenUrl, { method: "POST", headers, body });
+    if (!tokenRes.ok) return back("error", `Token exchange failed (${tokenRes.status})`);
+    const { access_token } = await tokenRes.json();
+    try {
+      const profile = await def.profile(access_token);
+      const campaign = await svc.getCampaign(campaignId);
+      const { result } = await svc.verifyRequirement(campaign, wallet, key, profile);
+      return back(result.passed ? "ok" : "error", result.passed ? void 0 : result.reason);
+    } catch (e) {
+      return back("error", e.message);
+    }
+  });
+}
+
+// src/app.ts
+var pubkey = z.string().regex(/^[1-9A-HJ-NP-Za-km-z]{32,44}$/);
+function createAllowlistApp(config, opts = {}) {
+  const cfg = normalizeConfig(config);
+  const svc = new AllowlistService(cfg, opts.waitUntil);
+  const app = new Hono();
+  const socketIp = (c) => {
+    try {
+      return opts.getClientIp?.(c) ?? cfg.getClientIp?.(c.req.raw);
+    } catch {
+      return void 0;
+    }
+  };
+  const ipOf = (c) => {
+    switch (cfg.trustProxy) {
+      case "cloudflare":
+        return c.req.header("cf-connecting-ip") ?? socketIp(c);
+      case "x-forwarded-for":
+        return c.req.header("x-forwarded-for")?.split(",")[0].trim() ?? socketIp(c);
+      default:
+        return socketIp(c);
+    }
+  };
+  app.use("*", cors({ origin: cfg.corsOrigins === "*" ? "*" : cfg.corsOrigins, allowHeaders: ["content-type", "authorization", "x-api-key"] }));
+  app.onError((err, c) => {
+    if (err instanceof AllowlistError) return c.json({ error: err.code, message: err.message }, err.status);
+    if (err instanceof z.ZodError) return c.json({ error: "validation", message: "Invalid input", issues: err.issues }, 400);
+    console.error(err);
+    return c.json({ error: "internal", message: "Something went wrong" }, 500);
+  });
+  app.use("*", async (c, next) => {
+    const ip = ipOf(c);
+    if (ip && cfg.rateLimit.max > 0) {
+      const n = await cfg.storage.incrTemp(`rl:${ip}:${Math.floor(Date.now() / 1e3 / cfg.rateLimit.windowSeconds)}`, cfg.rateLimit.windowSeconds);
+      if (n > cfg.rateLimit.max) return c.json({ error: "rate_limited", message: "Too many requests" }, 429);
+    }
+    await next();
+  });
+  const requireSession = async (c, next) => {
+    const token = c.req.header("authorization")?.replace(/^Bearer\s+/i, "");
+    const s = token && verifySession(cfg.sessionSecret, token);
+    if (!s) return c.json({ error: "unauthorized", message: "Sign in with your wallet first" }, 401);
+    if (s.campaignId !== c.req.param("id")) return c.json({ error: "unauthorized", message: "Session is for a different campaign" }, 401);
+    c.set("session", s);
+    await next();
+  };
+  const requireApiKey = (scope) => async (c, next) => {
+    const key = c.req.header("x-api-key") ?? c.req.header("authorization")?.replace(/^Bearer\s+/i, "");
+    if (!key) return c.json({ error: "unauthorized", message: "API key required" }, 401);
+    if (cfg.adminApiKey && safeEqual(key, cfg.adminApiKey)) {
+      c.set("apiKeyScopes", ["admin", "read"]);
+      return next();
+    }
+    const h = sha256Hex(key);
+    const k = (await cfg.storage.listApiKeys()).find((k2) => k2.hash === h);
+    if (!k || scope === "admin" && !k.scopes.includes("admin")) return c.json({ error: "forbidden", message: "Invalid API key" }, 403);
+    c.set("apiKeyScopes", k.scopes);
+    await next();
+  };
+  app.get("/health", (c) => c.json({ ok: true, modules: svc.registry.list().map((m) => m.id) }));
+  app.get("/modules", (c) => c.json(svc.registry.list().map(({ configSchema: _s, ...m }) => m)));
+  app.get("/campaigns/:id", async (c) => {
+    const campaign = await svc.getCampaign(c.req.param("id"));
+    const [total, eligible] = await Promise.all([cfg.storage.countEntries(campaign.id), cfg.storage.countEntries(campaign.id, { eligibleOnly: true })]);
+    return c.json({ campaign: svc.publicCampaign(campaign), stats: { total, eligible } });
+  });
+  app.post("/campaigns/:id/auth/nonce", async (c) => {
+    const campaign = await svc.getCampaign(c.req.param("id"));
+    const { wallet } = z.object({ wallet: pubkey }).parse(await c.req.json());
+    const nonce = randomId(16);
+    const issuedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const statement = campaign.requirements.find((r) => r.module === "wallet-signature")?.config?.statement;
+    const message = buildSignInMessage({ domain: cfg.domain, wallet, campaignId: campaign.id, nonce, issuedAt, statement });
+    await cfg.storage.setTemp(`nonce:${campaign.id}:${wallet}:${nonce}`, message, 300);
+    return c.json({ nonce, message });
+  });
+  app.post("/campaigns/:id/auth/verify", async (c) => {
+    const campaign = await svc.getCampaign(c.req.param("id"));
+    const { wallet, nonce, signature } = z.object({ wallet: pubkey, nonce: z.string().min(8), signature: z.string().min(40) }).parse(await c.req.json());
+    const key = `nonce:${campaign.id}:${wallet}:${nonce}`;
+    const message = await cfg.storage.getTemp(key);
+    if (!message) throw new AllowlistError(400, "Nonce expired \u2014 request a new one", "nonce_expired");
+    if (!verifyWalletSignature(wallet, message, signature)) throw new AllowlistError(401, "Signature does not match wallet", "bad_signature");
+    await cfg.storage.deleteTemp(key);
+    const entry = await svc.getOrCreateEntry(campaign, wallet);
+    const token = signSession(cfg.sessionSecret, { wallet, campaignId: campaign.id, exp: Date.now() + cfg.sessionTtlSeconds * 1e3 });
+    return c.json({ token, entry });
+  });
+  app.get("/campaigns/:id/me", requireSession, async (c) => {
+    const campaign = await svc.getCampaign(c.req.param("id"));
+    const entry = await svc.getOrCreateEntry(campaign, c.get("session").wallet);
+    const links = await cfg.storage.listSocialLinksForWallet(campaign.id, entry.wallet);
+    return c.json({ entry, social: links.map(({ provider, handle }) => ({ provider, handle })) });
+  });
+  app.post("/campaigns/:id/requirements/:key/verify", requireSession, async (c) => {
+    const campaign = await svc.getCampaign(c.req.param("id"));
+    const input = await c.req.json().catch(() => ({}));
+    const { entry, result } = await svc.verifyRequirement(campaign, c.get("session").wallet, c.req.param("key"), input, ipOf(c));
+    return c.json({ entry, result });
+  });
+  registerOAuthRoutes(app, svc, cfg, requireSession);
+  const passthrough = async (_c, n) => n();
+  const lookupGuard = cfg.eligibilityLookup === "protected" ? requireApiKey("read") : passthrough;
+  app.get("/campaigns/:id/eligibility/:wallet", lookupGuard, async (c) => {
+    const campaign = await svc.getCampaign(c.req.param("id"));
+    const wallet = pubkey.parse(c.req.param("wallet"));
+    const hasKey = !!c.req.header("x-api-key") || !!c.req.header("authorization");
+    const detailed = cfg.eligibilityLookup === "full" || cfg.eligibilityLookup === "protected" || hasKey;
+    const snap = await cfg.storage.getSnapshot(campaign.id, c.req.query("snapshot") || void 0);
+    if (snap) {
+      const e = snap.entries[wallet];
+      const out2 = { wallet, eligible: !!e, allocation: e?.allocation ?? 0, snapshot: snap.id };
+      if (detailed) out2.rank = e?.rank;
+      if (e?.proof && snap.merkle) out2.merkle = { root: snap.merkle.root, proof: e.proof };
+      return c.json(out2);
+    }
+    const entries = await svc.finalEntries(campaign);
+    const entry = entries.find((e) => e.wallet === wallet);
+    const out = { wallet, eligible: entry?.eligible ?? false, allocation: entry?.allocation ?? 0, snapshot: null };
+    if (detailed) Object.assign(out, { points: entry?.points ?? 0, rank: entry?.rank });
+    if (campaign.merkle.enabled && entry?.eligible) {
+      const tree = buildMerkleTree2(entries.filter((e) => e.eligible).map((e) => e.wallet), campaign.merkle.scheme);
+      out.merkle = { root: tree.root, proof: getMerkleProof2(tree, wallet) };
+    }
+    return c.json(out);
+  });
+  const admin = new Hono();
+  admin.use("*", requireApiKey("admin"));
+  admin.get("/campaigns", async (c) => c.json(await cfg.storage.listCampaigns()));
+  admin.post("/campaigns", async (c) => c.json(await svc.saveCampaign(await c.req.json()), 201));
+  admin.put("/campaigns/:id", async (c) => c.json(await svc.saveCampaign({ ...await c.req.json(), id: c.req.param("id") })));
+  admin.get("/campaigns/:id", async (c) => c.json(await svc.getCampaign(c.req.param("id"))));
+  admin.delete("/campaigns/:id", async (c) => {
+    await cfg.storage.deleteCampaign(c.req.param("id"));
+    return c.body(null, 204);
+  });
+  admin.get("/campaigns/:id/stats", async (c) => {
+    const campaign = await svc.getCampaign(c.req.param("id"));
+    const entries = await svc.finalEntries(campaign);
+    const byRequirement = Object.fromEntries(campaign.requirements.map((r) => [r.key, entries.filter((e) => e.results[r.key]?.passed).length]));
+    const pendingReview = entries.filter((e) => Object.values(e.results).some((r) => !r.passed && r.evidence?.pendingApproval)).length;
+    return c.json({
+      total: entries.length,
+      eligible: entries.filter((e) => e.eligible).length,
+      totalAllocation: entries.reduce((s, e) => s + e.allocation, 0),
+      byRequirement,
+      pendingReview,
+      last24h: entries.filter((e) => Date.now() - e.createdAt < 864e5).length
+    });
+  });
+  admin.get("/campaigns/:id/entries", async (c) => {
+    const campaign = await svc.getCampaign(c.req.param("id"));
+    const q = z.object({ page: z.coerce.number().int().positive().default(1), limit: z.coerce.number().int().positive().max(500).default(50), eligible: z.enum(["true", "false"]).optional(), search: z.string().optional() }).parse(c.req.query());
+    let entries = await svc.finalEntries(campaign);
+    if (q.eligible) entries = entries.filter((e) => e.eligible === (q.eligible === "true"));
+    if (q.search) entries = entries.filter((e) => e.wallet.includes(q.search) || e.referralCode === q.search.toUpperCase());
+    const total = entries.length;
+    return c.json({ total, page: q.page, limit: q.limit, entries: entries.slice((q.page - 1) * q.limit, q.page * q.limit) });
+  });
+  admin.patch("/campaigns/:id/entries/:wallet/requirements/:key", async (c) => {
+    const campaign = await svc.getCampaign(c.req.param("id"));
+    const { passed, note } = z.object({ passed: z.boolean(), note: z.string().optional() }).parse(await c.req.json());
+    return c.json(await svc.overrideRequirement(campaign, c.req.param("wallet"), c.req.param("key"), passed, note));
+  });
+  admin.post("/campaigns/:id/snapshot", async (c) => {
+    const campaign = await svc.getCampaign(c.req.param("id"));
+    const { entries: _e, ...summary } = await svc.createSnapshot(campaign);
+    return c.json(summary, 201);
+  });
+  admin.get("/campaigns/:id/snapshots", async (c) => c.json(await cfg.storage.listSnapshots(c.req.param("id"))));
+  admin.get("/campaigns/:id/snapshots/:sid", async (c) => {
+    const snap = await cfg.storage.getSnapshot(c.req.param("id"), c.req.param("sid"));
+    if (!snap) throw new AllowlistError(404, "Snapshot not found");
+    return c.json(snap);
+  });
+  admin.post("/campaigns/:id/recheck", async (c) => {
+    const campaign = await svc.getCampaign(c.req.param("id"));
+    const { wallets } = z.object({ wallets: z.array(pubkey).optional() }).parse(await c.req.json().catch(() => ({})));
+    return c.json(await svc.recheckCampaign(campaign, wallets));
+  });
+  admin.get("/campaigns/:id/export", async (c) => {
+    const campaign = await svc.getCampaign(c.req.param("id"));
+    const q = z.object({ format: z.enum(["csv", "json", "txt", "merkle"]).default("json"), all: z.enum(["true", "false"]).default("false"), evidence: z.enum(["true", "false"]).default("false") }).parse(c.req.query());
+    const entries = await svc.finalEntries(campaign);
+    const opts2 = { eligibleOnly: q.all !== "true", includeEvidence: q.evidence === "true" };
+    await svc.events.emit("campaign.exported", campaign.id, { format: q.format, count: entries.filter((e) => e.eligible).length });
+    const fname = `${campaign.id}-allowlist`;
+    if (q.format === "csv") return c.body(toCSV(toRows(campaign, entries, opts2)), 200, { "content-type": "text/csv", "content-disposition": `attachment; filename="${fname}.csv"` });
+    if (q.format === "txt") return c.body(toWalletList(entries), 200, { "content-type": "text/plain", "content-disposition": `attachment; filename="${fname}.txt"` });
+    if (q.format === "merkle") {
+      const eligible = entries.filter((e) => e.eligible).map((e) => e.wallet);
+      if (eligible.length === 0) throw new AllowlistError(400, "No eligible wallets yet", "empty");
+      const tree = buildMerkleTree2(eligible, campaign.merkle.scheme);
+      return c.json({ scheme: tree.scheme, root: tree.root, count: eligible.length, proofs: Object.fromEntries(eligible.map((w) => [w, getMerkleProof2(tree, w)])) });
+    }
+    return c.json(toJSON(campaign, entries, { ...opts2, includeMerkle: campaign.merkle.enabled }));
+  });
+  admin.get("/webhooks", async (c) => c.json((await cfg.storage.listWebhooks()).map(({ secret: _s, ...w }) => w)));
+  admin.post("/webhooks", async (c) => {
+    const body = z.object({ url: z.string().url(), events: z.array(z.string()).default(["*"]), campaignId: z.string().optional() }).parse(await c.req.json());
+    try {
+      assertSafeWebhookUrl(body.url, { allowInsecure: cfg.allowInsecureWebhooks });
+    } catch (e) {
+      throw new AllowlistError(400, e.message, "unsafe_webhook_url");
+    }
+    const w = { id: randomId(8), secret: randomId(24), active: true, createdAt: Date.now(), ...body };
+    await cfg.storage.putWebhook(w);
+    return c.json(w, 201);
+  });
+  admin.delete("/webhooks/:id", async (c) => {
+    await cfg.storage.deleteWebhook(c.req.param("id"));
+    return c.body(null, 204);
+  });
+  admin.post("/webhooks/:id/test", async (c) => {
+    const w = (await cfg.storage.listWebhooks()).find((w2) => w2.id === c.req.param("id"));
+    if (!w) throw new AllowlistError(404, "Webhook not found");
+    await svc.events.deliver(w.id, w.url, w.secret, { id: randomId(8), type: "entry.updated", campaignId: w.campaignId ?? "test", data: { test: true }, createdAt: Date.now() }, 1);
+    return c.json({ ok: true });
+  });
+  admin.get("/api-keys", async (c) => c.json((await cfg.storage.listApiKeys()).map(({ hash: _h, ...k }) => k)));
+  admin.post("/api-keys", async (c) => {
+    const { label, scopes } = z.object({ label: z.string().min(1), scopes: z.array(z.enum(["admin", "read"])).default(["read"]) }).parse(await c.req.json());
+    const key = `al_${randomId(24)}`;
+    const k = { id: randomId(6), hash: sha256Hex(key), label, scopes, createdAt: Date.now() };
+    await cfg.storage.putApiKey(k);
+    return c.json({ id: k.id, label, scopes, key }, 201);
+  });
+  admin.delete("/api-keys/:id", async (c) => {
+    await cfg.storage.deleteApiKey(c.req.param("id"));
+    return c.body(null, 204);
+  });
+  app.route("/admin", admin);
+  return { app, service: svc, config: cfg };
+}
+
+// src/storage/sqlite.ts
+async function createSqliteStorage(file = "allowlist.db") {
+  const mod = await import("./lib-HMVXUU3V.js");
+  const Database = mod.default ?? mod;
+  const db = new Database(file);
+  db.pragma("journal_mode = WAL");
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS campaigns (id TEXT PRIMARY KEY, json TEXT NOT NULL, updated_at INTEGER NOT NULL);
+    CREATE TABLE IF NOT EXISTS entries (
+      campaign_id TEXT NOT NULL, wallet TEXT NOT NULL, json TEXT NOT NULL,
+      eligible INTEGER NOT NULL, referral_code TEXT, created_at INTEGER NOT NULL,
+      PRIMARY KEY (campaign_id, wallet)
+    );
+    CREATE INDEX IF NOT EXISTS entries_ref ON entries(campaign_id, referral_code);
+    CREATE INDEX IF NOT EXISTS entries_created ON entries(campaign_id, created_at);
+    CREATE TABLE IF NOT EXISTS temp (k TEXT PRIMARY KEY, v TEXT NOT NULL, exp INTEGER NOT NULL);
+    CREATE TABLE IF NOT EXISTS social_links (
+      campaign_id TEXT NOT NULL, provider TEXT NOT NULL, provider_user_id TEXT NOT NULL,
+      wallet TEXT NOT NULL, json TEXT NOT NULL,
+      PRIMARY KEY (campaign_id, provider, provider_user_id)
+    );
+    CREATE INDEX IF NOT EXISTS social_wallet ON social_links(campaign_id, wallet);
+    CREATE TABLE IF NOT EXISTS webhooks (id TEXT PRIMARY KEY, json TEXT NOT NULL);
+    CREATE TABLE IF NOT EXISTS deliveries (id TEXT PRIMARY KEY, webhook_id TEXT, json TEXT NOT NULL);
+    CREATE TABLE IF NOT EXISTS api_keys (id TEXT PRIMARY KEY, json TEXT NOT NULL);
+    CREATE TABLE IF NOT EXISTS snapshots (id TEXT PRIMARY KEY, campaign_id TEXT NOT NULL, created_at INTEGER NOT NULL, json TEXT NOT NULL);
+    CREATE INDEX IF NOT EXISTS snapshots_campaign ON snapshots(campaign_id, created_at);
+  `);
+  const j = (row) => row ? JSON.parse(row.json) : null;
+  const s = {
+    async getCampaign(id) {
+      return j(db.prepare("SELECT json FROM campaigns WHERE id=?").get(id));
+    },
+    async listCampaigns() {
+      return db.prepare("SELECT json FROM campaigns ORDER BY updated_at DESC").all().map((r) => JSON.parse(r.json));
+    },
+    async putCampaign(c) {
+      db.prepare("INSERT OR REPLACE INTO campaigns (id,json,updated_at) VALUES (?,?,?)").run(c.id, JSON.stringify(c), Date.now());
+    },
+    async deleteCampaign(id) {
+      db.prepare("DELETE FROM campaigns WHERE id=?").run(id);
+      db.prepare("DELETE FROM entries WHERE campaign_id=?").run(id);
+      db.prepare("DELETE FROM social_links WHERE campaign_id=?").run(id);
+    },
+    async getEntry(campaignId, wallet) {
+      return j(db.prepare("SELECT json FROM entries WHERE campaign_id=? AND wallet=?").get(campaignId, wallet));
+    },
+    async putEntry(e) {
+      db.prepare(
+        "INSERT OR REPLACE INTO entries (campaign_id,wallet,json,eligible,referral_code,created_at) VALUES (?,?,?,?,?,?)"
+      ).run(e.campaignId, e.wallet, JSON.stringify(e), e.eligible ? 1 : 0, e.referralCode ?? null, e.createdAt);
+    },
+    async listEntries(campaignId, opts = {}) {
+      const rows = db.prepare(
+        `SELECT json FROM entries WHERE campaign_id=? ${opts.eligibleOnly ? "AND eligible=1" : ""} ORDER BY created_at ASC LIMIT ? OFFSET ?`
+      ).all(campaignId, opts.limit ?? 1e6, opts.offset ?? 0);
+      return rows.map((r) => JSON.parse(r.json));
+    },
+    async countEntries(campaignId, opts = {}) {
+      const r = db.prepare(`SELECT COUNT(*) as n FROM entries WHERE campaign_id=? ${opts.eligibleOnly ? "AND eligible=1" : ""}`).get(campaignId);
+      return r.n;
+    },
+    async findEntryByReferralCode(campaignId, code) {
+      return j(db.prepare("SELECT json FROM entries WHERE campaign_id=? AND referral_code=?").get(campaignId, code));
+    },
+    async setTemp(k, v, ttl) {
+      db.prepare("INSERT OR REPLACE INTO temp (k,v,exp) VALUES (?,?,?)").run(k, v, Date.now() + ttl * 1e3);
+    },
+    async getTemp(k) {
+      const r = db.prepare("SELECT v,exp FROM temp WHERE k=?").get(k);
+      if (!r) return null;
+      if (r.exp < Date.now()) {
+        db.prepare("DELETE FROM temp WHERE k=?").run(k);
+        return null;
+      }
+      return r.v;
+    },
+    async deleteTemp(k) {
+      db.prepare("DELETE FROM temp WHERE k=?").run(k);
+    },
+    async incrTemp(k, ttl) {
+      const now = Date.now();
+      const r = db.prepare(
+        `INSERT INTO temp (k,v,exp) VALUES (?, '1', ?)
+           ON CONFLICT(k) DO UPDATE SET
+             v   = CASE WHEN temp.exp < ? THEN '1' ELSE CAST(CAST(temp.v AS INTEGER) + 1 AS TEXT) END,
+             exp = CASE WHEN temp.exp < ? THEN excluded.exp ELSE temp.exp END
+           RETURNING v`
+      ).get(k, now + ttl * 1e3, now, now);
+      return Number(r.v);
+    },
+    async getSocialLink(campaignId, provider, providerUserId) {
+      return j(
+        db.prepare("SELECT json FROM social_links WHERE campaign_id=? AND provider=? AND provider_user_id=?").get(campaignId, provider, providerUserId)
+      );
+    },
+    async claimSocialLink(l) {
+      db.prepare(
+        "INSERT INTO social_links (campaign_id,provider,provider_user_id,wallet,json) VALUES (?,?,?,?,?) ON CONFLICT(campaign_id,provider,provider_user_id) DO NOTHING"
+      ).run(l.campaignId, l.provider, l.providerUserId, l.wallet, JSON.stringify(l));
+      const owner = db.prepare("SELECT wallet FROM social_links WHERE campaign_id=? AND provider=? AND provider_user_id=?").get(l.campaignId, l.provider, l.providerUserId).wallet;
+      return owner === l.wallet ? { ok: true } : { ok: false, owner };
+    },
+    async putSnapshot(snap) {
+      db.prepare("INSERT OR REPLACE INTO snapshots (id,campaign_id,created_at,json) VALUES (?,?,?,?)").run(snap.id, snap.campaignId, snap.createdAt, JSON.stringify(snap));
+    },
+    async getSnapshot(campaignId, id) {
+      const row = id ? db.prepare("SELECT json FROM snapshots WHERE campaign_id=? AND id=?").get(campaignId, id) : db.prepare("SELECT json FROM snapshots WHERE campaign_id=? ORDER BY created_at DESC LIMIT 1").get(campaignId);
+      return j(row);
+    },
+    async listSnapshots(campaignId) {
+      return db.prepare("SELECT json FROM snapshots WHERE campaign_id=? ORDER BY created_at DESC").all(campaignId).map((r) => {
+        const { entries: _e, ...rest } = JSON.parse(r.json);
+        return rest;
+      });
+    },
+    async listSocialLinksForWallet(campaignId, wallet) {
+      return db.prepare("SELECT json FROM social_links WHERE campaign_id=? AND wallet=?").all(campaignId, wallet).map((r) => JSON.parse(r.json));
+    },
+    async listWebhooks() {
+      return db.prepare("SELECT json FROM webhooks").all().map((r) => JSON.parse(r.json));
+    },
+    async putWebhook(w) {
+      db.prepare("INSERT OR REPLACE INTO webhooks (id,json) VALUES (?,?)").run(w.id, JSON.stringify(w));
+    },
+    async deleteWebhook(id) {
+      db.prepare("DELETE FROM webhooks WHERE id=?").run(id);
+    },
+    async putDelivery(d) {
+      db.prepare("INSERT OR REPLACE INTO deliveries (id,webhook_id,json) VALUES (?,?,?)").run(d.id, d.webhookId, JSON.stringify(d));
+    },
+    async listApiKeys() {
+      return db.prepare("SELECT json FROM api_keys").all().map((r) => JSON.parse(r.json));
+    },
+    async putApiKey(k) {
+      db.prepare("INSERT OR REPLACE INTO api_keys (id,json) VALUES (?,?)").run(k.id, JSON.stringify(k));
+    },
+    async deleteApiKey(id) {
+      db.prepare("DELETE FROM api_keys WHERE id=?").run(id);
+    }
+  };
+  return s;
+}
+
+// src/storage/memory.ts
+var MemoryStorage = class {
+  campaigns = /* @__PURE__ */ new Map();
+  entries = /* @__PURE__ */ new Map();
+  // `${campaignId}:${wallet}`
+  temp = /* @__PURE__ */ new Map();
+  social = /* @__PURE__ */ new Map();
+  webhooks = /* @__PURE__ */ new Map();
+  deliveries = [];
+  apiKeys = /* @__PURE__ */ new Map();
+  snapshots = /* @__PURE__ */ new Map();
+  async getCampaign(id) {
+    return this.campaigns.get(id) ?? null;
+  }
+  async listCampaigns() {
+    return [...this.campaigns.values()];
+  }
+  async putCampaign(c) {
+    this.campaigns.set(c.id, c);
+  }
+  async deleteCampaign(id) {
+    this.campaigns.delete(id);
+    for (const k of [...this.entries.keys()]) if (k.startsWith(id + ":")) this.entries.delete(k);
+  }
+  async getEntry(campaignId, wallet) {
+    return this.entries.get(`${campaignId}:${wallet}`) ?? null;
+  }
+  async putEntry(e) {
+    this.entries.set(`${e.campaignId}:${e.wallet}`, e);
+  }
+  async listEntries(campaignId, opts = {}) {
+    let list = [...this.entries.values()].filter((e) => e.campaignId === campaignId);
+    if (opts.eligibleOnly) list = list.filter((e) => e.eligible);
+    list.sort((a, b) => a.createdAt - b.createdAt);
+    const off = opts.offset ?? 0;
+    return list.slice(off, opts.limit ? off + opts.limit : void 0);
+  }
+  async countEntries(campaignId, opts = {}) {
+    return (await this.listEntries(campaignId, opts)).length;
+  }
+  async findEntryByReferralCode(campaignId, code) {
+    return [...this.entries.values()].find((e) => e.campaignId === campaignId && e.referralCode === code) ?? null;
+  }
+  sweep() {
+    const now = Date.now();
+    for (const [k, v] of this.temp) if (v.exp < now) this.temp.delete(k);
+  }
+  async setTemp(key, value, ttlSeconds) {
+    this.sweep();
+    this.temp.set(key, { v: value, exp: Date.now() + ttlSeconds * 1e3 });
+  }
+  async getTemp(key) {
+    const v = this.temp.get(key);
+    if (!v || v.exp < Date.now()) return null;
+    return v.v;
+  }
+  async deleteTemp(key) {
+    this.temp.delete(key);
+  }
+  async incrTemp(key, ttlSeconds) {
+    const cur = Number(await this.getTemp(key) ?? 0) + 1;
+    const existing = this.temp.get(key);
+    this.temp.set(key, { v: String(cur), exp: existing?.exp ?? Date.now() + ttlSeconds * 1e3 });
+    return cur;
+  }
+  async getSocialLink(campaignId, provider, providerUserId) {
+    return this.social.get(`${campaignId}:${provider}:${providerUserId}`) ?? null;
+  }
+  // JS is single-threaded, so check-then-set within one synchronous block is atomic here.
+  async claimSocialLink(link) {
+    const k = `${link.campaignId}:${link.provider}:${link.providerUserId}`;
+    const existing = this.social.get(k);
+    if (existing && existing.wallet !== link.wallet) return { ok: false, owner: existing.wallet };
+    if (!existing) this.social.set(k, link);
+    return { ok: true };
+  }
+  async putSnapshot(s) {
+    this.snapshots.set(s.id, s);
+  }
+  async getSnapshot(campaignId, id) {
+    const all = [...this.snapshots.values()].filter((s) => s.campaignId === campaignId).sort((a, b) => b.createdAt - a.createdAt);
+    return (id ? all.find((s) => s.id === id) : all[0]) ?? null;
+  }
+  async listSnapshots(campaignId) {
+    return [...this.snapshots.values()].filter((s) => s.campaignId === campaignId).sort((a, b) => b.createdAt - a.createdAt).map(({ entries: _e, ...s }) => s);
+  }
+  async listSocialLinksForWallet(campaignId, wallet) {
+    return [...this.social.values()].filter((l) => l.campaignId === campaignId && l.wallet === wallet);
+  }
+  async listWebhooks() {
+    return [...this.webhooks.values()];
+  }
+  async putWebhook(w) {
+    this.webhooks.set(w.id, w);
+  }
+  async deleteWebhook(id) {
+    this.webhooks.delete(id);
+  }
+  async putDelivery(d) {
+    this.deliveries.push(d);
+  }
+  async listApiKeys() {
+    return [...this.apiKeys.values()];
+  }
+  async putApiKey(k) {
+    this.apiKeys.set(k.id, k);
+  }
+  async deleteApiKey(id) {
+    this.apiKeys.delete(id);
+  }
+};
+
+export {
+  pass,
+  fail,
+  VerificationUnavailable,
+  toRawAmount,
+  walletSignatureVerifier,
+  tokenBalanceVerifier,
+  nftOwnershipVerifier,
+  verifyWalletSignature,
+  xVerifier,
+  discordVerifier,
+  verifyTelegramLogin,
+  telegramVerifier,
+  youtubeVerifier,
+  socialTaskVerifier,
+  quizVerifier,
+  referralVerifier,
+  captchaVerifier,
+  builtinVerifiers,
+  EventBus,
+  verifyWebhookSignature,
+  AllowlistError,
+  AllowlistService,
+  createAllowlistApp,
+  createSqliteStorage,
+  MemoryStorage
+};