@webtwizz/cloud 0.1.0 → 0.3.0

package/dist/server.js

@@ -1,19 +1,1503 @@
+import {
+  NEON_AUTH_SESSION_VERIFIER_PARAM_NAME,
+  normalizeBetterAuthError
+} from "./chunk-7EXXDRMF.js";
 import {
   env
 } from "./chunk-ESAV545E.js";
 
 // src/server.ts
 import "server-only";
-import { createNeonAuth } from "@neondatabase/auth/next/server";
+
+// node_modules/@neondatabase/auth/dist/server-b0OzGjXl.mjs
+import { SignJWT, jwtVerify } from "jose";
+import { parseCookies, parseSetCookieHeader } from "better-auth/cookies";
+var NEON_AUTH_SERVER_PROXY_HEADER = "x-neon-auth-proxy";
+var API_ENDPOINTS = {
+  getSession: {
+    path: "get-session",
+    method: "GET"
+  },
+  getAccessToken: {
+    path: "get-access-token",
+    method: "GET"
+  },
+  listSessions: {
+    path: "list-sessions",
+    method: "GET"
+  },
+  revokeSession: {
+    path: "revoke-session",
+    method: "POST"
+  },
+  revokeSessions: {
+    path: "revoke-sessions",
+    method: "POST"
+  },
+  revokeOtherSessions: {
+    path: "revoke-all-sessions",
+    method: "POST"
+  },
+  refreshToken: {
+    path: "refresh-token",
+    method: "POST"
+  },
+  signIn: {
+    email: {
+      path: "sign-in/email",
+      method: "POST"
+    },
+    social: {
+      path: "sign-in/social",
+      method: "POST"
+    },
+    emailOtp: {
+      path: "sign-in/email-otp",
+      method: "POST"
+    },
+    magicLink: {
+      path: "sign-in/magic-link",
+      method: "POST"
+    }
+  },
+  signUp: { email: {
+    path: "sign-up/email",
+    method: "POST"
+  } },
+  signOut: {
+    path: "sign-out",
+    method: "POST"
+  },
+  listAccounts: {
+    path: "list-accounts",
+    method: "GET"
+  },
+  accountInfo: {
+    path: "account-info",
+    method: "GET"
+  },
+  updateUser: {
+    path: "update-user",
+    method: "POST"
+  },
+  deleteUser: {
+    path: "delete-user",
+    method: "POST"
+  },
+  changePassword: {
+    path: "change-password",
+    method: "POST"
+  },
+  sendVerificationEmail: {
+    path: "send-verification-email",
+    method: "POST"
+  },
+  verifyEmail: {
+    path: "verify-email",
+    method: "POST"
+  },
+  resetPassword: {
+    path: "reset-password",
+    method: "POST"
+  },
+  requestPasswordReset: {
+    path: "request-password-reset",
+    method: "POST"
+  },
+  token: {
+    path: "token",
+    method: "GET"
+  },
+  jwks: {
+    path: "jwt",
+    method: "GET"
+  },
+  getAnonymousToken: {
+    path: "token/anonymous",
+    method: "GET"
+  },
+  admin: {
+    createUser: {
+      path: "admin/create-user",
+      method: "POST"
+    },
+    listUsers: {
+      path: "admin/list-users",
+      method: "GET"
+    },
+    setRole: {
+      path: "admin/set-role",
+      method: "POST"
+    },
+    setUserPassword: {
+      path: "admin/set-user-password",
+      method: "POST"
+    },
+    updateUser: {
+      path: "admin/update-user",
+      method: "POST"
+    },
+    banUser: {
+      path: "admin/ban-user",
+      method: "POST"
+    },
+    unbanUser: {
+      path: "admin/unban-user",
+      method: "POST"
+    },
+    listUserSessions: {
+      path: "admin/list-user-sessions",
+      method: "GET"
+    },
+    revokeUserSession: {
+      path: "admin/revoke-user-session",
+      method: "POST"
+    },
+    revokeUserSessions: {
+      path: "admin/revoke-user-sessions",
+      method: "POST"
+    },
+    impersonateUser: {
+      path: "admin/impersonate-user",
+      method: "POST"
+    },
+    stopImpersonating: {
+      path: "admin/stop-impersonating",
+      method: "POST"
+    },
+    removeUser: {
+      path: "admin/remove-user",
+      method: "POST"
+    },
+    hasPermission: {
+      path: "admin/has-permission",
+      method: "POST"
+    }
+  },
+  organization: {
+    create: {
+      path: "organization/create",
+      method: "POST"
+    },
+    update: {
+      path: "organization/update",
+      method: "POST"
+    },
+    delete: {
+      path: "organization/delete",
+      method: "POST"
+    },
+    list: {
+      path: "organization/list",
+      method: "GET"
+    },
+    getFullOrganization: {
+      path: "organization/get-full-organization",
+      method: "GET"
+    },
+    setActive: {
+      path: "organization/set-active",
+      method: "POST"
+    },
+    checkSlug: {
+      path: "organization/check-slug",
+      method: "GET"
+    },
+    listMembers: {
+      path: "organization/list-members",
+      method: "GET"
+    },
+    removeMember: {
+      path: "organization/remove-member",
+      method: "POST"
+    },
+    updateMemberRole: {
+      path: "organization/update-member-role",
+      method: "POST"
+    },
+    leave: {
+      path: "organization/leave",
+      method: "POST"
+    },
+    getActiveMember: {
+      path: "organization/get-active-member",
+      method: "GET"
+    },
+    getActiveMemberRole: {
+      path: "organization/get-active-member-role",
+      method: "GET"
+    },
+    inviteMember: {
+      path: "organization/invite-member",
+      method: "POST"
+    },
+    acceptInvitation: {
+      path: "organization/accept-invitation",
+      method: "POST"
+    },
+    rejectInvitation: {
+      path: "organization/reject-invitation",
+      method: "POST"
+    },
+    cancelInvitation: {
+      path: "organization/cancel-invitation",
+      method: "POST"
+    },
+    getInvitation: {
+      path: "organization/get-invitation",
+      method: "GET"
+    },
+    listInvitations: {
+      path: "organization/list-invitations",
+      method: "GET"
+    },
+    listUserInvitations: {
+      path: "organization/list-user-invitations",
+      method: "GET"
+    },
+    hasPermission: {
+      path: "organization/has-permission",
+      method: "POST"
+    }
+  },
+  emailOtp: {
+    sendVerificationOtp: {
+      path: "email-otp/send-verification-otp",
+      method: "POST"
+    },
+    verifyEmail: {
+      path: "email-otp/verify-email",
+      method: "POST"
+    },
+    checkVerificationOtp: {
+      path: "email-otp/check-verification-otp",
+      method: "POST"
+    },
+    resetPassword: {
+      path: "email-otp/passcode",
+      method: "POST"
+    }
+  },
+  magicLink: { verify: {
+    path: "magic-link/verify",
+    method: "GET"
+  } }
+};
+var NEON_AUTH_COOKIE_PREFIX = "__Secure-neon-auth";
+var NEON_AUTH_SESSION_DATA_COOKIE_NAME = `${NEON_AUTH_COOKIE_PREFIX}.local.session_data`;
+var NEON_AUTH_LEGACY_SESSION_CHALLENGE_COOKIE_NAME = `${NEON_AUTH_COOKIE_PREFIX}.session_challange`;
+var NEON_AUTH_SESSION_CHALLENGE_COOKIE_NAME = `${NEON_AUTH_COOKIE_PREFIX}.session_challenge`;
+var NEON_AUTH_SESSION_COOKIE_NAME = `${NEON_AUTH_COOKIE_PREFIX}.session_token`;
+var extractNeonAuthCookies = (headers2) => {
+  const cookieHeader = typeof headers2 === "string" ? headers2 : headers2.get("cookie");
+  if (!cookieHeader) return "";
+  const parsedCookies = parseCookies(cookieHeader);
+  const result = [];
+  for (const [name, value] of parsedCookies.entries()) if (name.startsWith(NEON_AUTH_COOKIE_PREFIX)) result.push(`${name}=${value}`);
+  return result.join("; ");
+};
+var parseSetCookies = (setCookieHeader) => {
+  const parsedCookies = parseSetCookieHeader(setCookieHeader);
+  const cookies2 = [];
+  for (const entry of parsedCookies.entries()) {
+    const [name, parsedCookie] = entry;
+    cookies2.push({
+      name,
+      value: decodeURIComponent(parsedCookie.value),
+      path: parsedCookie.path,
+      domain: parsedCookie.domain,
+      maxAge: parsedCookie["max-age"] ?? parsedCookie.maxAge,
+      expires: parsedCookie.expires,
+      httpOnly: parsedCookie.httponly ?? true,
+      secure: parsedCookie.secure ?? true,
+      sameSite: parsedCookie.samesite ?? "lax",
+      partitioned: parsedCookie.partitioned
+    });
+  }
+  return cookies2;
+};
+var serializeSetCookie = (cookie) => {
+  let result = `${cookie.name}=${encodeURIComponent(cookie.value)}`;
+  if (cookie.path) result += `; Path=${cookie.path}`;
+  if (cookie.domain) result += `; Domain=${cookie.domain}`;
+  if (cookie.maxAge !== void 0) result += `; Max-Age=${cookie.maxAge}`;
+  if (cookie.expires) result += `; Expires=${cookie.expires.toUTCString()}`;
+  if (cookie.httpOnly) result += "; HttpOnly";
+  if (cookie.secure) result += "; Secure";
+  if (cookie.sameSite) {
+    const sameSite = cookie.sameSite.charAt(0).toUpperCase() + cookie.sameSite.slice(1);
+    result += `; SameSite=${sameSite}`;
+  }
+  if (cookie.partitioned) result += "; Partitioned";
+  return result;
+};
+var parseCookieValue = (cookieString, name) => {
+  if (!cookieString) return null;
+  return parseCookies(cookieString).get(name) ?? null;
+};
+var DEFAULT_SESSION_CACHE_TTL_SECONDS = 300;
+var JWS_ALGO = "HS256";
+function emit$1(log, level, message, meta) {
+  if (log) {
+    log[level](message, meta);
+    return;
+  }
+  if (meta && Object.keys(meta).length > 0) console[level](message, meta);
+  else console[level](message);
+}
+function parseDate(dateValue, fieldName) {
+  const date = new Date(dateValue);
+  if (Number.isNaN(date.getTime())) throw new TypeError(`Invalid date value for ${fieldName}: ${JSON.stringify(dateValue)}`);
+  return date;
+}
+async function signSessionDataCookie(sessionData, secret, ttlSeconds = DEFAULT_SESSION_CACHE_TTL_SECONDS) {
+  const ttlMs = ttlSeconds * 1e3;
+  const expiresAt = Math.min(sessionData.session.expiresAt.getTime(), Date.now() + ttlMs);
+  return {
+    value: await signPayload(sessionData, expiresAt, secret),
+    expiresAt: new Date(expiresAt)
+  };
+}
+function signPayload(sessionData, expiresAt, secret) {
+  const encodedSecret = new TextEncoder().encode(secret);
+  const expSeconds = Math.floor(expiresAt / 1e3);
+  return new SignJWT(sessionData).setProtectedHeader({
+    alg: JWS_ALGO,
+    typ: "JWT"
+  }).setIssuedAt().setExpirationTime(expSeconds).setSubject(sessionData.user?.id ?? "anonymous").sign(encodedSecret);
+}
+function parseSessionData(json, log) {
+  if (!json || typeof json !== "object") return {
+    session: null,
+    user: null
+  };
+  const data = json;
+  if (!data.session || !data.user) return {
+    session: null,
+    user: null
+  };
+  try {
+    return {
+      session: {
+        ...data.session,
+        expiresAt: parseDate(data.session.expiresAt, "session.expiresAt"),
+        createdAt: parseDate(data.session.createdAt, "session.createdAt"),
+        updatedAt: parseDate(data.session.updatedAt, "session.updatedAt")
+      },
+      user: {
+        ...data.user,
+        createdAt: parseDate(data.user.createdAt, "user.createdAt"),
+        updatedAt: parseDate(data.user.updatedAt, "user.updatedAt")
+      }
+    };
+  } catch (error) {
+    emit$1(log, "error", "[parseSessionData] Failed to parse session dates:", {
+      error: error instanceof Error ? error.message : String(error),
+      hasSession: !!data.session,
+      hasUser: !!data.user
+    });
+    return {
+      session: null,
+      user: null
+    };
+  }
+}
+async function getSessionDataFromCookie(request, cookieName, cookieSecret, log) {
+  try {
+    const cookieHeader = request.headers.get("cookie");
+    if (!cookieHeader) return null;
+    const sessionDataCookie = parseCookies(cookieHeader).get(cookieName);
+    if (!sessionDataCookie) return null;
+    const result = await validateSessionData(sessionDataCookie, cookieSecret);
+    if (result.valid && result.payload) return result.payload;
+    emit$1(log, "warn", "[getSessionDataFromCookie] Invalid session cookie:", {
+      error: result.error,
+      cookieName
+    });
+    return null;
+  } catch (error) {
+    emit$1(log, "error", "[getSessionDataFromCookie] Unexpected validation error:", {
+      error: error instanceof Error ? error.message : String(error),
+      cookieName,
+      ...process.env.NODE_ENV !== "production" && { stack: error instanceof Error ? error.stack : void 0 }
+    });
+    return null;
+  }
+}
+async function fetchSessionWithCookie(sessionTokenCookie, baseUrl, log) {
+  let cookieName;
+  let cookieValue;
+  if (sessionTokenCookie.includes("=")) {
+    const [name, ...valueParts] = sessionTokenCookie.split(";")[0].trim().split("=");
+    cookieName = name.trim();
+    cookieValue = valueParts.join("=").trim();
+  } else throw new Error("Invalid session token cookie format");
+  if (!cookieName.includes("session_token")) throw new Error("session_token not found in cookie");
+  const response = await fetch(`${baseUrl}/get-session`, {
+    headers: { Cookie: `${cookieName}=${cookieValue}` },
+    signal: AbortSignal.timeout(3e3)
+  });
+  if (!response.ok) throw new Error(`Failed to fetch session data: ${response.status} ${response.statusText}`);
+  let body;
+  try {
+    body = await response.json();
+  } catch (error) {
+    throw new Error(`Failed to parse /get-session response as JSON: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  return parseSessionData(body, log);
+}
+var ERRORS = {
+  MISSING_AUTH_BASE_URL: "Missing required config: baseUrl. You must provide the auth URL of your Neon Auth instance in the config object.",
+  MISSING_COOKIE_SECRET: "Missing required config: cookies.secret. You must provide the cookie secret in the config object.",
+  COOKIE_SECRET_TOO_SHORT: "cookies.secret must be at least 32 characters long for security. Generate a secure secret with: openssl rand -base64 32",
+  INVALID_SESSION_DATA_TTL: "cookies.sessionDataTtl must be a positive number (in seconds)"
+};
+async function validateSessionData(sessionDataString, cookieSecret) {
+  try {
+    const { payload } = await jwtVerify(sessionDataString, new TextEncoder().encode(cookieSecret), { algorithms: ["HS256"] });
+    return {
+      valid: true,
+      payload: parseSessionData(payload)
+    };
+  } catch (error) {
+    return {
+      valid: false,
+      error: error instanceof Error ? error.message : "Invalid session data"
+    };
+  }
+}
+async function mintSessionDataCookie(sessionTokenCookie, baseUrl, cookieConfig, log) {
+  try {
+    const sessionData = await fetchSessionWithCookie(sessionTokenCookie, baseUrl, log);
+    if (!sessionData.session) return null;
+    const { value: signedData, expiresAt } = await signSessionDataCookie(sessionData, cookieConfig.secret, cookieConfig.sessionDataTtl);
+    const maxAge = Math.floor((expiresAt.getTime() - Date.now()) / 1e3);
+    return serializeSetCookie({
+      name: NEON_AUTH_SESSION_DATA_COOKIE_NAME,
+      value: signedData,
+      path: "/",
+      domain: cookieConfig.domain,
+      httpOnly: true,
+      secure: true,
+      sameSite: cookieConfig.sameSite ?? "lax",
+      maxAge
+    });
+  } catch (error) {
+    const meta = {
+      error: error instanceof Error ? error.message : String(error),
+      ...process.env.NODE_ENV !== "production" && { stack: error instanceof Error ? error.stack : void 0 }
+    };
+    if (log) log.error("[mintSessionDataCookie] Failed to mint session_data cookie:", meta);
+    else console.error("[mintSessionDataCookie] Failed to mint session_data cookie:", meta);
+    return null;
+  }
+}
+async function mintSessionDataFromResponse(responseHeaders, baseUrl, cookieConfig, log) {
+  const setCookieHeaders = responseHeaders.getSetCookie();
+  let sessionTokenCookie;
+  let sessionTokenIsDeletion = false;
+  for (const cookieHeader of setCookieHeaders) {
+    const parsed = parseSetCookies(cookieHeader).find((cookie) => cookie.name === NEON_AUTH_SESSION_COOKIE_NAME);
+    if (parsed) {
+      sessionTokenCookie = cookieHeader;
+      sessionTokenIsDeletion = parsed.maxAge === 0 || parsed.expires !== void 0 && parsed.expires.getTime() <= Date.now();
+      break;
+    }
+  }
+  if (!sessionTokenCookie) return null;
+  if (sessionTokenIsDeletion) return serializeSetCookie({
+    name: NEON_AUTH_SESSION_DATA_COOKIE_NAME,
+    value: "",
+    path: "/",
+    domain: cookieConfig.domain,
+    httpOnly: true,
+    secure: true,
+    sameSite: cookieConfig.sameSite ?? "lax",
+    maxAge: 0
+  });
+  return await mintSessionDataCookie(sessionTokenCookie, baseUrl, cookieConfig, log);
+}
+async function mintSessionDataFromToken(sessionTokenCookie, baseUrl, cookieConfig, log) {
+  return await mintSessionDataCookie(sessionTokenCookie, baseUrl, cookieConfig, log);
+}
+var LEVEL_RANK = {
+  error: 0,
+  warn: 1,
+  info: 2,
+  debug: 3
+};
+var consoleSink = {
+  error: (message, meta) => {
+    if (meta && Object.keys(meta).length > 0) console.error(message, meta);
+    else console.error(message);
+  },
+  warn: (message, meta) => {
+    if (meta && Object.keys(meta).length > 0) console.warn(message, meta);
+    else console.warn(message);
+  },
+  info: (message, meta) => {
+    if (meta && Object.keys(meta).length > 0) console.info(message, meta);
+    else console.info(message);
+  },
+  debug: (message, meta) => {
+    if (meta && Object.keys(meta).length > 0) console.debug(message, meta);
+    else console.debug(message);
+  }
+};
+function wrapWithLevel(level, logger) {
+  const minRank = LEVEL_RANK[level];
+  const gate = (messageLevel, fn) => {
+    return (message, meta) => {
+      if (LEVEL_RANK[messageLevel] <= minRank) fn(message, meta);
+    };
+  };
+  return {
+    error: gate("error", logger.error),
+    warn: gate("warn", logger.warn),
+    info: gate("info", logger.info),
+    debug: gate("debug", logger.debug)
+  };
+}
+var noopResolved = {
+  error: () => {
+  },
+  warn: () => {
+  },
+  info: () => {
+  },
+  debug: () => {
+  }
+};
+function resolveNeonAuthLogging(input) {
+  if (input?.logLevel === "silent") return noopResolved;
+  const level = input?.logLevel ?? "warn";
+  const raw = input?.logger ?? {};
+  return wrapWithLevel(level, {
+    error: raw.error ?? consoleSink.error,
+    warn: raw.warn ?? consoleSink.warn,
+    info: raw.info ?? consoleSink.info,
+    debug: raw.debug ?? consoleSink.debug
+  });
+}
+function resolveLog(log) {
+  if (!log) return void 0;
+  if (log.error && log.warn && log.info && log.debug) return log;
+  return resolveNeonAuthLogging({ logger: log });
+}
+function readErrnoCode(node) {
+  if (!node || typeof node !== "object") return void 0;
+  const code = node.code;
+  return typeof code === "string" ? code : void 0;
+}
+function isAbortError(node) {
+  if (node instanceof Error && node.name === "AbortError") return true;
+  if (typeof node === "object" && node !== null && "name" in node && node.name === "AbortError") return true;
+  return false;
+}
+function isTlsRelated(code, message) {
+  if (!code && !message) return false;
+  const c = code ?? "";
+  if (c.startsWith("ERR_TLS") || c.startsWith("CERT_") || c === "UNABLE_TO_VERIFY_LEAF_SIGNATURE") return true;
+  const m = message.toLowerCase();
+  return m.includes("certificate") || m.includes("ssl") || m.includes("tls") || m.includes("wrong version number");
+}
+function isLegacyFetchTypeError(node) {
+  return node instanceof TypeError && typeof node.message === "string" && node.message.includes("fetch");
+}
+function collectRelatedErrors(error) {
+  const seen = /* @__PURE__ */ new Set();
+  const list = [];
+  function add(e) {
+    if (e === void 0 || e === null) return;
+    if (typeof e === "object") {
+      if (seen.has(e)) return;
+      seen.add(e);
+    }
+    list.push(e);
+    if (e instanceof Error && e.cause !== void 0) add(e.cause);
+    if (e instanceof AggregateError && Array.isArray(e.errors)) for (const sub of e.errors) add(sub);
+  }
+  add(error);
+  return list;
+}
+function clientMessageFor(code) {
+  switch (code) {
+    case "NETWORK_DNS":
+      return "Could not resolve authentication server hostname";
+    case "NETWORK_REFUSED":
+      return "Connection refused by authentication server";
+    case "NETWORK_TIMEOUT":
+      return "Authentication server connection timed out";
+    case "NETWORK_TLS":
+      return "TLS error connecting to authentication server";
+    case "NETWORK_RESET":
+      return "Connection to authentication server was reset";
+    case "NETWORK_ABORT":
+      return "Authentication request was aborted";
+    default:
+      return "Unable to connect to authentication server";
+  }
+}
+var INTERNAL_PUBLIC_MESSAGE = "Internal Server Error";
+function classifyFetchFailure(error) {
+  const nodes = collectRelatedErrors(error);
+  for (const node of nodes) if (isAbortError(node)) return {
+    kind: "transport",
+    code: "NETWORK_ABORT",
+    detail: "AbortError",
+    clientMessage: clientMessageFor("NETWORK_ABORT")
+  };
+  for (const node of nodes) {
+    const code = readErrnoCode(node);
+    const message = node instanceof Error ? node.message : "";
+    if (code === "ENOTFOUND" || code === "EAI_AGAIN") return {
+      kind: "transport",
+      code: "NETWORK_DNS",
+      detail: code,
+      clientMessage: clientMessageFor("NETWORK_DNS")
+    };
+    if (code === "ECONNREFUSED") return {
+      kind: "transport",
+      code: "NETWORK_REFUSED",
+      detail: code,
+      clientMessage: clientMessageFor("NETWORK_REFUSED")
+    };
+    if (code === "ETIMEDOUT" || code === "UND_ERR_CONNECT_TIMEOUT" || code === "UND_ERR_HEADERS_TIMEOUT" || code === "UND_ERR_BODY_TIMEOUT") return {
+      kind: "transport",
+      code: "NETWORK_TIMEOUT",
+      detail: code ?? "timeout",
+      clientMessage: clientMessageFor("NETWORK_TIMEOUT")
+    };
+    if (code === "ECONNRESET" || code === "EPIPE" || code === "ECONNABORTED") return {
+      kind: "transport",
+      code: "NETWORK_RESET",
+      detail: code,
+      clientMessage: clientMessageFor("NETWORK_RESET")
+    };
+    if (isTlsRelated(code, message)) return {
+      kind: "transport",
+      code: "NETWORK_TLS",
+      detail: code ?? "tls",
+      clientMessage: clientMessageFor("NETWORK_TLS")
+    };
+  }
+  for (const node of nodes) if (isLegacyFetchTypeError(node)) return {
+    kind: "transport",
+    code: "NETWORK_ERROR",
+    detail: "fetch TypeError",
+    clientMessage: clientMessageFor("NETWORK_ERROR")
+  };
+  const head = nodes[0];
+  return {
+    kind: "internal",
+    detail: (head instanceof Error ? head.message : INTERNAL_PUBLIC_MESSAGE).slice(0, 200),
+    clientMessage: INTERNAL_PUBLIC_MESSAGE
+  };
+}
+function validateCookieConfig(cookies2) {
+  if (!cookies2.secret) throw new Error(ERRORS.MISSING_COOKIE_SECRET);
+  if (cookies2.secret.length < 32) throw new Error(ERRORS.COOKIE_SECRET_TOO_SHORT);
+  if (cookies2.sessionDataTtl !== void 0 && cookies2.sessionDataTtl <= 0) throw new Error(ERRORS.INVALID_SESSION_DATA_TTL);
+}
+function createAuthServer(config) {
+  const { baseUrl, context: getContext, cookieSecret, sessionDataTtl, domain, sameSite } = config;
+  const log = resolveLog(config.log);
+  validateCookieConfig({
+    secret: cookieSecret,
+    sessionDataTtl
+  });
+  const effectiveSameSite = sameSite ?? "lax";
+  const fetchWithAuth = async (path, method, args) => {
+    const ctx = await getContext();
+    const cookies2 = await ctx.getCookies();
+    const origin = await ctx.getOrigin();
+    const framework = ctx.getFramework();
+    const url = new URL(path, baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`);
+    const { query, fetchOptions: _fetchOptions, ...body } = args || {};
+    if (query && typeof query === "object") {
+      const queryParams = query;
+      for (const [key, value] of Object.entries(queryParams)) if (value !== void 0 && value !== null) url.searchParams.set(key, String(value));
+    }
+    const headers2 = {
+      Cookie: cookies2,
+      Origin: origin,
+      [NEON_AUTH_SERVER_PROXY_HEADER]: framework
+    };
+    let requestBody;
+    if (method === "POST") {
+      headers2["Content-Type"] = "application/json";
+      requestBody = JSON.stringify(Object.keys(body).length > 0 ? body : {});
+    }
+    let response;
+    try {
+      response = await fetch(url.toString(), {
+        method,
+        headers: headers2,
+        body: requestBody
+      });
+    } catch (error) {
+      const classified = classifyFetchFailure(error);
+      if (classified.kind === "transport") {
+        log?.warn("[webtwizz-auth] Server API upstream fetch failed", {
+          component: "server-api",
+          path: url.pathname,
+          code: classified.code,
+          detail: classified.detail,
+          host: url.host
+        });
+        return {
+          data: null,
+          error: {
+            message: classified.clientMessage,
+            status: 502,
+            statusText: "Bad Gateway",
+            code: classified.code
+          }
+        };
+      }
+      log?.error("[webtwizz-auth] Server API unexpected fetch error", {
+        component: "server-api",
+        path: url.pathname,
+        detail: classified.detail,
+        host: url.host,
+        err: error
+      });
+      throw error instanceof Error ? error : new Error(String(error));
+    }
+    if (response.ok) log?.debug("[webtwizz-auth] Server API upstream fetch completed", {
+      component: "server-api",
+      path: url.pathname,
+      status: response.status,
+      host: url.host
+    });
+    else if (response.status >= 500) log?.warn("[webtwizz-auth] Server API upstream HTTP error", {
+      component: "server-api",
+      path: url.pathname,
+      status: response.status,
+      statusText: response.statusText,
+      host: url.host
+    });
+    else log?.info("[webtwizz-auth] Server API upstream HTTP non-2xx", {
+      component: "server-api",
+      path: url.pathname,
+      status: response.status,
+      statusText: response.statusText,
+      host: url.host
+    });
+    const setCookieHeaders = response.headers.getSetCookie();
+    if (setCookieHeaders.length > 0) {
+      for (const setCookieHeader of setCookieHeaders) {
+        const parsedCookies = parseSetCookies(setCookieHeader);
+        for (const cookie of parsedCookies) {
+          const cookieOptions = {
+            ...cookie,
+            domain,
+            partitioned: void 0,
+            sameSite: effectiveSameSite,
+            secure: true
+          };
+          await ctx.setCookie(cookie.name, cookie.value, cookieOptions);
+        }
+      }
+      try {
+        const sessionDataCookie = await mintSessionDataFromResponse(response.headers, baseUrl, {
+          secret: cookieSecret,
+          sessionDataTtl,
+          domain,
+          sameSite
+        }, log);
+        if (sessionDataCookie) {
+          const [parsedSessionData] = parseSetCookies(sessionDataCookie);
+          if (parsedSessionData) await ctx.setCookie(parsedSessionData.name, parsedSessionData.value, parsedSessionData);
+        }
+      } catch (error) {
+        log?.warn("[webtwizz-auth] Failed to mint session data cookie", {
+          component: "server-api",
+          detail: error instanceof Error ? error.message : String(error),
+          err: error
+        });
+      }
+    }
+    const responseData = await response.json().catch(() => null);
+    if (!response.ok) {
+      const normalized = normalizeBetterAuthError({
+        status: response.status,
+        statusText: response.statusText,
+        message: responseData?.message || response.statusText,
+        code: responseData?.code,
+        body: responseData
+      });
+      return {
+        data: null,
+        error: {
+          message: normalized.message,
+          status: normalized.status ?? response.status,
+          statusText: response.statusText,
+          code: normalized.code
+        }
+      };
+    }
+    return {
+      data: responseData,
+      error: null
+    };
+  };
+  const baseServer = createApiProxy(API_ENDPOINTS, fetchWithAuth);
+  const originalGetSession = baseServer.getSession;
+  baseServer.getSession = async (...args) => {
+    const [data] = args;
+    if (!(data?.query?.disableCookieCache === "true")) try {
+      const cookiesString = await (await getContext()).getCookies();
+      const hasSessionToken = cookiesString.includes(NEON_AUTH_SESSION_COOKIE_NAME);
+      const sessionDataCookie = parseCookieValue(cookiesString, NEON_AUTH_SESSION_DATA_COOKIE_NAME);
+      if (sessionDataCookie && hasSessionToken) {
+        const result = await validateSessionData(sessionDataCookie, cookieSecret);
+        if (result.valid && result.payload) return {
+          data: result.payload,
+          error: null
+        };
+      }
+    } catch (error) {
+      log?.warn("[webtwizz-auth] Cookie validation error before getSession upstream call", {
+        component: "server-api",
+        detail: error instanceof Error ? error.message : String(error),
+        err: error
+      });
+    }
+    return originalGetSession(...args);
+  };
+  return baseServer;
+}
+function isEndpointConfig(value) {
+  return typeof value === "object" && value !== null && "path" in value && "method" in value;
+}
+function createApiProxy(endpoints, fetchFn) {
+  return new Proxy({}, {
+    get(target, prop) {
+      if (prop in target) return target[prop];
+      const endpoint = endpoints[prop];
+      if (!endpoint) return;
+      if (isEndpointConfig(endpoint)) return (args) => fetchFn(endpoint.path, endpoint.method, args);
+      return createApiProxy(endpoint, fetchFn);
+    },
+    set(target, prop, value) {
+      target[prop] = value;
+      return true;
+    }
+  });
+}
+var PROXY_HEADERS = [
+  "user-agent",
+  "authorization",
+  "referer",
+  "content-type"
+];
+var NEON_AUTH_HEADER_MIDDLEWARE_NAME = "x-neon-auth-middleware";
+function safeAuthHost(baseUrl) {
+  try {
+    return new URL(baseUrl).host;
+  } catch {
+    return;
+  }
+}
+var handleAuthRequest = async (baseUrl, request, path, log) => {
+  const headers2 = prepareRequestHeaders(request);
+  const body = await parseRequestBody(request);
+  try {
+    const upstreamURL = getUpstreamURL(baseUrl, path, { originalUrl: new URL(request.url) });
+    const response = await fetch(upstreamURL.toString(), {
+      method: request.method,
+      headers: headers2,
+      body
+    });
+    const host = safeAuthHost(baseUrl);
+    if (response.ok) log?.debug("[webtwizz-auth] Upstream fetch completed", {
+      component: "proxy",
+      proxyPath: path,
+      status: response.status,
+      host
+    });
+    else if (response.status >= 500) log?.warn("[webtwizz-auth] Upstream HTTP error", {
+      component: "proxy",
+      proxyPath: path,
+      status: response.status,
+      statusText: response.statusText,
+      host
+    });
+    else log?.info("[webtwizz-auth] Upstream HTTP non-2xx", {
+      component: "proxy",
+      proxyPath: path,
+      status: response.status,
+      statusText: response.statusText,
+      host
+    });
+    return response;
+  } catch (error) {
+    const classified = classifyFetchFailure(error);
+    if (classified.kind === "transport") {
+      log?.warn("[webtwizz-auth] Upstream fetch failed", {
+        component: "proxy",
+        proxyPath: path,
+        code: classified.code,
+        detail: classified.detail,
+        host: safeAuthHost(baseUrl)
+      });
+      return Response.json({
+        error: classified.clientMessage,
+        code: classified.code
+      }, {
+        status: 502,
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+    log?.error("[webtwizz-auth] Unexpected proxy error", {
+      component: "proxy",
+      proxyPath: path,
+      detail: classified.detail,
+      host: safeAuthHost(baseUrl)
+    });
+    return Response.json({
+      error: classified.clientMessage,
+      code: "INTERNAL_ERROR"
+    }, {
+      status: 500,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+};
+var getUpstreamURL = (baseUrl, path, { originalUrl }) => {
+  const url = new URL(`${baseUrl}/${path}`);
+  if (originalUrl) {
+    url.search = originalUrl.search;
+    return url;
+  }
+  return url;
+};
+var prepareRequestHeaders = (request) => {
+  const headers2 = new Headers();
+  for (const header of PROXY_HEADERS) if (request.headers.get(header)) headers2.set(header, request.headers.get(header));
+  headers2.set("Origin", getOrigin(request));
+  headers2.set("Cookie", extractNeonAuthCookies(request.headers));
+  headers2.set(NEON_AUTH_HEADER_MIDDLEWARE_NAME, "true");
+  return headers2;
+};
+var getOrigin = (request) => {
+  return request.headers.get("origin") || request.headers.get("referer")?.split("/").slice(0, 3).join("/") || new URL(request.url).origin;
+};
+var parseRequestBody = async (request) => {
+  if (request.body) return request.text();
+};
+var RESPONSE_HEADERS_ALLOWLIST = [
+  "content-type",
+  "content-encoding",
+  "date",
+  "set-cookie",
+  "set-auth-jwt",
+  "set-auth-token",
+  "x-neon-ret-request-id"
+];
+var handleAuthResponse = async (response, baseUrl, cookieConfig, log) => {
+  const responseHeaders = prepareResponseHeaders(response, cookieConfig);
+  const sessionDataCookie = await mintSessionDataFromResponse(response.headers, baseUrl, cookieConfig, log);
+  if (sessionDataCookie) responseHeaders.append("Set-Cookie", sessionDataCookie);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: responseHeaders
+  });
+};
+var prepareResponseHeaders = (response, cookieConfig) => {
+  const headers2 = new Headers();
+  const effectiveSameSite = cookieConfig.sameSite ?? "lax";
+  const { domain } = cookieConfig;
+  for (const header of RESPONSE_HEADERS_ALLOWLIST) if (header === "set-cookie") {
+    const cookies2 = response.headers.getSetCookie();
+    for (const cookieHeader of cookies2) {
+      const parsedCookies = parseSetCookies(cookieHeader);
+      for (const parsedCookie of parsedCookies) {
+        parsedCookie.partitioned = void 0;
+        parsedCookie.sameSite = effectiveSameSite;
+        parsedCookie.secure = true;
+        if (domain) parsedCookie.domain = domain;
+        headers2.append("Set-Cookie", serializeSetCookie(parsedCookie));
+      }
+    }
+  } else {
+    const value = response.headers.get(header);
+    if (value) headers2.set(header, value);
+  }
+  return headers2;
+};
+function emit(log, level, message, meta) {
+  if (log) {
+    log[level](message, meta);
+    return;
+  }
+  if (meta && Object.keys(meta).length > 0) console[level](message, meta);
+  else console[level](message);
+}
+async function trySessionCache(request, baseUrl, cookieConfig, log) {
+  if (new URL(request.url).searchParams.get("disableCookieCache") === "true") return null;
+  const cookieHeader = request.headers.get("cookie") || "";
+  if (!cookieHeader.includes(NEON_AUTH_SESSION_COOKIE_NAME)) return null;
+  const hasSessionData = parseCookies(cookieHeader).has(NEON_AUTH_SESSION_DATA_COOKIE_NAME);
+  const mintAndReturn = async () => {
+    const sessionTokenCookie = extractSessionTokenCookie(cookieHeader);
+    if (!sessionTokenCookie) return null;
+    const sessionDataCookieString = await mintSessionDataFromToken(sessionTokenCookie, baseUrl, cookieConfig, log);
+    if (!sessionDataCookieString) return null;
+    try {
+      const sessionData = await fetchSessionWithCookie(sessionTokenCookie, baseUrl, log);
+      if (!sessionData.session) return null;
+      const response = Response.json(sessionData);
+      response.headers.set("Set-Cookie", sessionDataCookieString);
+      return response;
+    } catch (error) {
+      emit(log, "error", "[trySessionCache] Failed to fetch session after minting cookie:", { error: error instanceof Error ? error.message : String(error) });
+      return null;
+    }
+  };
+  if (!hasSessionData) return await mintAndReturn();
+  try {
+    const sessionData = await getSessionDataFromCookie(request, NEON_AUTH_SESSION_DATA_COOKIE_NAME, cookieConfig.secret, log);
+    if (sessionData && sessionData.session) return Response.json(sessionData);
+    return await mintAndReturn();
+  } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : String(error);
+    const errorName = error instanceof Error ? error.name : "Unknown";
+    if (errorName === "JWTExpired") emit(log, "debug", "[trySessionCache] Session cookie expired, minting new one:", {
+      error: errorMessage,
+      url: request.url
+    });
+    else if (errorName === "JWTInvalid" || errorName === "JWTClaimValidationFailed") emit(log, "warn", "[trySessionCache] Invalid session cookie, minting new one:", {
+      error: errorMessage,
+      url: request.url
+    });
+    else emit(log, "error", "[trySessionCache] Unexpected validation error:", {
+      error: errorMessage,
+      url: request.url
+    });
+    return await mintAndReturn();
+  }
+}
+function extractSessionTokenCookie(cookieHeader) {
+  const sessionToken = parseCookies(cookieHeader).get(NEON_AUTH_SESSION_COOKIE_NAME);
+  if (!sessionToken) return null;
+  return `${NEON_AUTH_SESSION_COOKIE_NAME}=${sessionToken}`;
+}
+async function handleAuthProxyRequest(config) {
+  const { request, path, baseUrl, cookieSecret, sessionDataTtl, domain, sameSite } = config;
+  const log = resolveLog(config.log);
+  if (path === API_ENDPOINTS.getSession.path && request.method === API_ENDPOINTS.getSession.method) {
+    const cachedResponse = await trySessionCache(request, baseUrl, {
+      secret: cookieSecret,
+      sessionDataTtl,
+      domain,
+      sameSite
+    }, log);
+    if (cachedResponse) return cachedResponse;
+  }
+  return await handleAuthResponse(await handleAuthRequest(baseUrl, request, path, log), baseUrl, {
+    secret: cookieSecret,
+    sessionDataTtl,
+    domain,
+    sameSite
+  }, log);
+}
+function hasSessionChallengeCookie(cookies2) {
+  return cookies2.has(NEON_AUTH_SESSION_CHALLENGE_COOKIE_NAME) || cookies2.has(NEON_AUTH_LEGACY_SESSION_CHALLENGE_COOKIE_NAME);
+}
+function needsSessionVerification(request) {
+  const hasVerifier = new URL(request.url).searchParams.has(NEON_AUTH_SESSION_VERIFIER_PARAM_NAME);
+  const cookieHeader = request.headers.get("cookie");
+  if (!cookieHeader) return false;
+  const cookies2 = parseCookies(cookieHeader);
+  return hasVerifier && hasSessionChallengeCookie(cookies2);
+}
+async function exchangeOAuthToken(request, baseUrl, cookieSecret, sessionDataTtl, domain, sameSite, log) {
+  const url = new URL(request.url);
+  const verifier = url.searchParams.get(NEON_AUTH_SESSION_VERIFIER_PARAM_NAME);
+  const cookieHeader = request.headers.get("cookie");
+  if (!cookieHeader) return null;
+  const cookies2 = parseCookies(cookieHeader);
+  if (!verifier || !hasSessionChallengeCookie(cookies2)) return null;
+  const response = await handleAuthResponse(await handleAuthRequest(baseUrl, new Request(request.url, {
+    method: "GET",
+    headers: request.headers
+  }), "get-session", log), baseUrl, {
+    secret: cookieSecret,
+    sessionDataTtl,
+    domain,
+    sameSite
+  });
+  if (response.ok) {
+    const setCookieHeaders = response.headers.getSetCookie();
+    url.searchParams.delete(NEON_AUTH_SESSION_VERIFIER_PARAM_NAME);
+    return {
+      redirectUrl: url,
+      cookies: setCookieHeaders,
+      success: true
+    };
+  }
+  return null;
+}
+var DEFAULT_AUTH_SKIP_ROUTES = [
+  "/api/auth",
+  "/auth/callback",
+  "/auth/sign-in",
+  "/auth/sign-up",
+  "/auth/magic-link",
+  "/auth/email-otp",
+  "/auth/forgot-password"
+];
+function shouldProtectRoute(pathname, skipRoutes) {
+  return !skipRoutes.some((route) => isSamePathOrSubpath(pathname, route));
+}
+function isSamePathOrSubpath(pathname, routePathname) {
+  const normalizedRoutePathname = routePathname === "/" ? routePathname : routePathname.replace(/\/+$/, "");
+  if (pathname === normalizedRoutePathname) return true;
+  return normalizedRoutePathname !== "/" && pathname.startsWith(`${normalizedRoutePathname}/`);
+}
+function checkSessionRequired(pathname, skipRoutes, loginPathname, session) {
+  if (loginPathname !== null && isSamePathOrSubpath(pathname, loginPathname)) return {
+    allowed: true,
+    requiresRedirect: false
+  };
+  if (!shouldProtectRoute(pathname, skipRoutes)) return {
+    allowed: true,
+    requiresRedirect: false
+  };
+  if (!session || session.session === null) return {
+    allowed: false,
+    requiresRedirect: true
+  };
+  return {
+    allowed: true,
+    session,
+    requiresRedirect: false
+  };
+}
+function stripBodyHeaders(headers2) {
+  const next = new Headers(headers2);
+  next.delete("content-type");
+  next.delete("content-length");
+  next.delete("transfer-encoding");
+  return next;
+}
+async function processAuthMiddleware(config) {
+  const log = config.log ?? resolveNeonAuthLogging({
+    logger: config.logger,
+    logLevel: config.logLevel
+  });
+  const { request, pathname, skipRoutes, loginUrl, baseUrl, cookieSecret, sessionDataTtl, domain, sameSite } = config;
+  const effectiveSameSite = sameSite ?? "lax";
+  const requestUrl = new URL(request.url);
+  const resolvedLoginUrl = new URL(loginUrl, requestUrl);
+  const sameOriginLoginPathname = resolvedLoginUrl.origin === requestUrl.origin ? resolvedLoginUrl.pathname : null;
+  if (sameOriginLoginPathname !== null && isSamePathOrSubpath(pathname, sameOriginLoginPathname)) return { action: "allow" };
+  if (needsSessionVerification(request)) {
+    const exchangeResult = await exchangeOAuthToken(request, baseUrl, cookieSecret, sessionDataTtl, domain, sameSite, log);
+    if (exchangeResult !== null) return {
+      action: "redirect_oauth",
+      redirectUrl: exchangeResult.redirectUrl,
+      cookies: exchangeResult.cookies
+    };
+  }
+  const cookieHeader = request.headers.get("cookie") || "";
+  const hasSessionToken = cookieHeader.includes(NEON_AUTH_SESSION_COOKIE_NAME);
+  const hasStaleSessionData = parseCookies(cookieHeader).has(NEON_AUTH_SESSION_DATA_COOKIE_NAME) && !hasSessionToken;
+  let sessionData = {
+    session: null,
+    user: null
+  };
+  let sessionCookies = [];
+  if (hasSessionToken) {
+    const sessionResponse = await handleAuthProxyRequest({
+      request: new Request(request.url, {
+        method: "GET",
+        headers: stripBodyHeaders(request.headers)
+      }),
+      path: "get-session",
+      baseUrl,
+      cookieSecret,
+      sessionDataTtl,
+      domain,
+      sameSite,
+      log
+    });
+    if (sessionResponse.ok) {
+      const data = await sessionResponse.json().catch((error) => {
+        log.debug("[webtwizz-auth] Failed to parse session response JSON", {
+          component: "middleware",
+          detail: error instanceof Error ? error.message : String(error)
+        });
+        return null;
+      });
+      if (data) sessionData = data;
+    }
+    sessionCookies = sessionResponse.headers.getSetCookie();
+  }
+  if (checkSessionRequired(pathname, skipRoutes, sameOriginLoginPathname, sessionData).allowed) return {
+    action: "allow",
+    headers: { [NEON_AUTH_HEADER_MIDDLEWARE_NAME]: "true" },
+    cookies: sessionCookies
+  };
+  const cookies2 = [];
+  if (hasStaleSessionData) cookies2.push(serializeSetCookie({
+    name: NEON_AUTH_SESSION_DATA_COOKIE_NAME,
+    value: "",
+    path: "/",
+    domain,
+    httpOnly: true,
+    secure: true,
+    sameSite: effectiveSameSite,
+    maxAge: 0
+  }));
+  if (resolvedLoginUrl.origin === requestUrl.origin) {
+    const configuredLoginParamNames = new Set(resolvedLoginUrl.searchParams.keys());
+    for (const [name, value] of requestUrl.searchParams) if (!configuredLoginParamNames.has(name)) resolvedLoginUrl.searchParams.append(name, value);
+  }
+  return {
+    action: "redirect_login",
+    redirectUrl: resolvedLoginUrl,
+    cookies: cookies2.length > 0 ? cookies2 : void 0
+  };
+}
+
+// src/next-headers.ts
+import { cookies as nextCookies, headers as nextHeaders } from "next/headers";
+
+// src/cookies.ts
+var OURS = "__Secure-webtwizz-auth.";
+var THEIRS = "__Secure-neon-auth.";
+var toTheirs = (name) => name.startsWith(OURS) ? THEIRS + name.slice(OURS.length) : name;
+var toOurs = (name) => name.startsWith(THEIRS) ? OURS + name.slice(THEIRS.length) : name;
+function cookieHeaderToTheirs(header) {
+  if (!header || !header.includes(OURS)) return header;
+  return header.split(/;\s*/).map((pair) => {
+    const at = pair.indexOf("=");
+    return at < 0 ? pair : toTheirs(pair.slice(0, at)) + pair.slice(at);
+  }).join("; ");
+}
+function setCookieToOurs(value) {
+  const at = value.indexOf("=");
+  return at < 0 ? value : toOurs(value.slice(0, at)) + value.slice(at);
+}
+
+// src/next-headers.ts
+function delegate(target, overrides) {
+  return new Proxy(target, {
+    get(store, key) {
+      if (typeof key === "string" && key in overrides) return overrides[key];
+      const value = Reflect.get(store, key, store);
+      return typeof value === "function" ? value.bind(store) : value;
+    }
+  });
+}
+async function headers() {
+  const store = await nextHeaders();
+  return delegate(store, {
+    get: (name) => name.toLowerCase() === "cookie" ? cookieHeaderToTheirs(store.get(name)) : store.get(name)
+  });
+}
+async function cookies() {
+  const store = await nextCookies();
+  const rename = (args) => {
+    const [first, ...rest] = args;
+    if (typeof first === "string") return [toOurs(first), ...rest];
+    if (first && typeof first === "object" && "name" in first) return [{ ...first, name: toOurs(String(first.name)) }, ...rest];
+    return args;
+  };
+  return delegate(store, {
+    set: (...args) => store.set(...rename(args)),
+    delete: (...args) => store.delete(...rename(args))
+  });
+}
+
+// node_modules/@neondatabase/auth/dist/next/server/index.mjs
+import { NextRequest, NextResponse } from "next/server";
+async function createNextRequestContext() {
+  const cookieStore = await cookies();
+  const headerStore = await headers();
+  return {
+    getCookies() {
+      return extractNeonAuthCookies(headerStore);
+    },
+    setCookie(name, value, options) {
+      cookieStore.set(name, value, options);
+    },
+    getHeader(name) {
+      return headerStore.get(name) ?? null;
+    },
+    getOrigin() {
+      return headerStore.get("origin") || headerStore.get("referer")?.split("/").slice(0, 3).join("/") || "";
+    },
+    getFramework() {
+      return "nextjs";
+    }
+  };
+}
+function authApiHandler(config) {
+  const { baseUrl, cookies: cookies$1 } = config;
+  validateCookieConfig(cookies$1);
+  const log = resolveNeonAuthLogging(config);
+  const handler = async (request, { params }) => {
+    return handleAuthProxyRequest({
+      request,
+      path: (await params).path.join("/"),
+      baseUrl,
+      cookieSecret: cookies$1.secret,
+      sessionDataTtl: cookies$1.sessionDataTtl,
+      domain: cookies$1.domain,
+      sameSite: cookies$1.sameSite,
+      log
+    });
+  };
+  return {
+    GET: handler,
+    POST: handler,
+    PUT: handler,
+    DELETE: handler,
+    PATCH: handler
+  };
+}
+var SKIP_ROUTES = DEFAULT_AUTH_SKIP_ROUTES;
+function neonAuthMiddleware(config) {
+  const { baseUrl, cookies: cookies$1, loginUrl = "/auth/sign-in", log, logger, logLevel } = config;
+  validateCookieConfig(cookies$1);
+  return async (request) => {
+    const pathname = request.nextUrl.pathname;
+    const result = await processAuthMiddleware({
+      request,
+      pathname,
+      skipRoutes: SKIP_ROUTES,
+      loginUrl,
+      baseUrl,
+      cookieSecret: cookies$1.secret,
+      sessionDataTtl: cookies$1.sessionDataTtl,
+      domain: cookies$1.domain,
+      sameSite: cookies$1.sameSite,
+      log,
+      logger,
+      logLevel
+    });
+    switch (result.action) {
+      case "allow": {
+        const headers$1 = new Headers(request.headers);
+        if (result.headers) for (const [key, value] of Object.entries(result.headers)) headers$1.set(key, value);
+        const response = NextResponse.next({ request: { headers: headers$1 } });
+        if (result.cookies) for (const cookie of result.cookies) response.headers.append("Set-Cookie", cookie);
+        return response;
+      }
+      case "redirect_oauth": {
+        const oauthHeaders = new Headers();
+        for (const cookie of result.cookies) oauthHeaders.append("Set-Cookie", cookie);
+        return NextResponse.redirect(result.redirectUrl, { headers: oauthHeaders });
+      }
+      case "redirect_login":
+        if (result.cookies && result.cookies.length > 0) {
+          const loginHeaders = new Headers();
+          for (const cookie of result.cookies) loginHeaders.append("Set-Cookie", cookie);
+          return NextResponse.redirect(result.redirectUrl, { headers: loginHeaders });
+        }
+        return NextResponse.redirect(result.redirectUrl);
+    }
+  };
+}
+function createNeonAuth(config) {
+  const { baseUrl, cookies: cookies$1 } = config;
+  validateCookieConfig(cookies$1);
+  const log = resolveNeonAuthLogging(config);
+  const server = createAuthServer({
+    baseUrl,
+    context: createNextRequestContext,
+    cookieSecret: cookies$1.secret,
+    sessionDataTtl: cookies$1.sessionDataTtl,
+    domain: cookies$1.domain,
+    sameSite: cookies$1.sameSite,
+    log
+  });
+  server.handler = () => authApiHandler(config);
+  server.middleware = (middlewareConfig) => neonAuthMiddleware({
+    ...config,
+    ...middlewareConfig,
+    log
+  });
+  return server;
+}
+
+// src/server.ts
+import { NextRequest as NextRequest2 } from "next/server";
+var PROVIDER_HEADER = /^x-neon-/i;
+function forLibrary(request, make) {
+  const cookie = request.headers.get("cookie");
+  const translated = cookieHeaderToTheirs(cookie);
+  if (translated === cookie) return request;
+  const headers2 = new Headers(request.headers);
+  headers2.set("cookie", translated);
+  return make(request, headers2);
+}
+function forBrowser(response) {
+  const provider = [...response.headers.keys()].filter((name) => PROVIDER_HEADER.test(name));
+  const cookies2 = response.headers.getSetCookie();
+  const rename = cookies2.some((cookie) => cookie.startsWith(THEIRS));
+  if (!provider.length && !rename) return response;
+  const apply = (headers2) => {
+    for (const name of provider) headers2.delete(name);
+    if (rename) {
+      headers2.delete("set-cookie");
+      for (const cookie of cookies2) headers2.append("set-cookie", setCookieToOurs(cookie));
+    }
+  };
+  try {
+    apply(response.headers);
+    return response;
+  } catch {
+    const headers2 = new Headers(response.headers);
+    apply(headers2);
+    return new Response(response.body, { status: response.status, statusText: response.statusText, headers: headers2 });
+  }
+}
+async function sendSignUpCode(baseUrl, request, response) {
+  const data = await response.clone().json().catch(() => null);
+  const email = data?.user?.email;
+  if (!email || data.user.emailVerified !== false || data.token) return;
+  await fetch(`${baseUrl.replace(/\/+$/, "")}/email-otp/send-verification-otp`, {
+    method: "POST",
+    headers: { "content-type": "application/json", origin: request.headers.get("origin") || new URL(request.url).origin },
+    body: JSON.stringify({ email, type: "email-verification" })
+  }).catch((error) => console.error("[webtwizz-auth] Could not send the sign-up code", error));
+}
 function createAuth(options = {}) {
-  return createNeonAuth({
-    baseUrl: options.url ?? env("WEBTWIZZ_AUTH_URL"),
+  const baseUrl = options.url ?? env("WEBTWIZZ_AUTH_URL");
+  const auth = createNeonAuth({
+    baseUrl,
     cookies: {
       secret: options.secret ?? env("WEBTWIZZ_AUTH_SECRET"),
       sessionDataTtl: options.sessionDataTtl
     }
   });
+  const handler = auth.handler.bind(auth);
+  const middleware = auth.middleware.bind(auth);
+  auth.handler = () => {
+    const methods = handler();
+    const wrap = (method) => async (request, context) => forBrowser(await method(forLibrary(request, (original, headers2) => new Request(original, { headers: headers2 })), context));
+    const post = wrap(methods.POST);
+    const signUp = async (request, context) => {
+      const response = await post(request, context);
+      const { path } = await context.params;
+      if (response.ok && path?.join("/") === "sign-up/email") await sendSignUpCode(baseUrl, request, response);
+      return response;
+    };
+    return { GET: wrap(methods.GET), POST: signUp, PUT: wrap(methods.PUT), DELETE: wrap(methods.DELETE), PATCH: wrap(methods.PATCH) };
+  };
+  auth.middleware = (config) => {
+    const run = middleware(config);
+    return async (request) => forBrowser(await run(forLibrary(request, (original, headers2) => new NextRequest2(original, { headers: headers2 }))));
+  };
+  return auth;
 }
 export {
-  createAuth
+  createAuth,
+  forBrowser
 };