@webtwizz/cloud 0.4.0 → 0.5.0

package/dist/server.js

@@ -1,1503 +1,569 @@
 import {
-  NEON_AUTH_SESSION_VERIFIER_PARAM_NAME,
-  normalizeBetterAuthError
-} from "./chunk-7EXXDRMF.js";
+  FRAME_HEADER
+} from "./chunk-4PKQUQZD.js";
 import {
   env
 } from "./chunk-ESAV545E.js";
 
 // src/server.ts
 import "server-only";
+import { NextResponse } from "next/server";
+import { cache } from "react";
 
-// node_modules/@neondatabase/auth/dist/server-b0OzGjXl.mjs
-import { SignJWT, jwtVerify } from "jose";
-import { parseCookies, parseSetCookieHeader } from "better-auth/cookies";
-var NEON_AUTH_SERVER_PROXY_HEADER = "x-neon-auth-proxy";
-var API_ENDPOINTS = {
-  getSession: {
-    path: "get-session",
-    method: "GET"
-  },
-  getAccessToken: {
-    path: "get-access-token",
-    method: "GET"
-  },
-  listSessions: {
-    path: "list-sessions",
-    method: "GET"
-  },
-  revokeSession: {
-    path: "revoke-session",
-    method: "POST"
-  },
-  revokeSessions: {
-    path: "revoke-sessions",
-    method: "POST"
-  },
-  revokeOtherSessions: {
-    path: "revoke-all-sessions",
-    method: "POST"
-  },
-  refreshToken: {
-    path: "refresh-token",
-    method: "POST"
-  },
-  signIn: {
-    email: {
-      path: "sign-in/email",
-      method: "POST"
-    },
-    social: {
-      path: "sign-in/social",
-      method: "POST"
-    },
-    emailOtp: {
-      path: "sign-in/email-otp",
-      method: "POST"
-    },
-    magicLink: {
-      path: "sign-in/magic-link",
-      method: "POST"
-    }
-  },
-  signUp: { email: {
-    path: "sign-up/email",
-    method: "POST"
-  } },
-  signOut: {
-    path: "sign-out",
-    method: "POST"
-  },
-  listAccounts: {
-    path: "list-accounts",
-    method: "GET"
-  },
-  accountInfo: {
-    path: "account-info",
-    method: "GET"
-  },
-  updateUser: {
-    path: "update-user",
-    method: "POST"
-  },
-  deleteUser: {
-    path: "delete-user",
-    method: "POST"
-  },
-  changePassword: {
-    path: "change-password",
-    method: "POST"
-  },
-  sendVerificationEmail: {
-    path: "send-verification-email",
-    method: "POST"
-  },
-  verifyEmail: {
-    path: "verify-email",
-    method: "POST"
-  },
-  resetPassword: {
-    path: "reset-password",
-    method: "POST"
-  },
-  requestPasswordReset: {
-    path: "request-password-reset",
-    method: "POST"
-  },
-  token: {
-    path: "token",
-    method: "GET"
-  },
-  jwks: {
-    path: "jwt",
-    method: "GET"
-  },
-  getAnonymousToken: {
-    path: "token/anonymous",
-    method: "GET"
-  },
-  admin: {
-    createUser: {
-      path: "admin/create-user",
-      method: "POST"
-    },
-    listUsers: {
-      path: "admin/list-users",
-      method: "GET"
-    },
-    setRole: {
-      path: "admin/set-role",
-      method: "POST"
-    },
-    setUserPassword: {
-      path: "admin/set-user-password",
-      method: "POST"
-    },
-    updateUser: {
-      path: "admin/update-user",
-      method: "POST"
-    },
-    banUser: {
-      path: "admin/ban-user",
-      method: "POST"
-    },
-    unbanUser: {
-      path: "admin/unban-user",
-      method: "POST"
-    },
-    listUserSessions: {
-      path: "admin/list-user-sessions",
-      method: "GET"
-    },
-    revokeUserSession: {
-      path: "admin/revoke-user-session",
-      method: "POST"
-    },
-    revokeUserSessions: {
-      path: "admin/revoke-user-sessions",
-      method: "POST"
-    },
-    impersonateUser: {
-      path: "admin/impersonate-user",
-      method: "POST"
-    },
-    stopImpersonating: {
-      path: "admin/stop-impersonating",
-      method: "POST"
-    },
-    removeUser: {
-      path: "admin/remove-user",
-      method: "POST"
-    },
-    hasPermission: {
-      path: "admin/has-permission",
-      method: "POST"
-    }
-  },
-  organization: {
-    create: {
-      path: "organization/create",
-      method: "POST"
-    },
-    update: {
-      path: "organization/update",
-      method: "POST"
-    },
-    delete: {
-      path: "organization/delete",
-      method: "POST"
-    },
-    list: {
-      path: "organization/list",
-      method: "GET"
-    },
-    getFullOrganization: {
-      path: "organization/get-full-organization",
-      method: "GET"
-    },
-    setActive: {
-      path: "organization/set-active",
-      method: "POST"
-    },
-    checkSlug: {
-      path: "organization/check-slug",
-      method: "GET"
-    },
-    listMembers: {
-      path: "organization/list-members",
-      method: "GET"
-    },
-    removeMember: {
-      path: "organization/remove-member",
-      method: "POST"
-    },
-    updateMemberRole: {
-      path: "organization/update-member-role",
-      method: "POST"
-    },
-    leave: {
-      path: "organization/leave",
-      method: "POST"
-    },
-    getActiveMember: {
-      path: "organization/get-active-member",
-      method: "GET"
-    },
-    getActiveMemberRole: {
-      path: "organization/get-active-member-role",
-      method: "GET"
-    },
-    inviteMember: {
-      path: "organization/invite-member",
-      method: "POST"
-    },
-    acceptInvitation: {
-      path: "organization/accept-invitation",
-      method: "POST"
-    },
-    rejectInvitation: {
-      path: "organization/reject-invitation",
-      method: "POST"
-    },
-    cancelInvitation: {
-      path: "organization/cancel-invitation",
-      method: "POST"
-    },
-    getInvitation: {
-      path: "organization/get-invitation",
-      method: "GET"
-    },
-    listInvitations: {
-      path: "organization/list-invitations",
-      method: "GET"
-    },
-    listUserInvitations: {
-      path: "organization/list-user-invitations",
-      method: "GET"
-    },
-    hasPermission: {
-      path: "organization/has-permission",
-      method: "POST"
-    }
-  },
-  emailOtp: {
-    sendVerificationOtp: {
-      path: "email-otp/send-verification-otp",
-      method: "POST"
-    },
-    verifyEmail: {
-      path: "email-otp/verify-email",
-      method: "POST"
-    },
-    checkVerificationOtp: {
-      path: "email-otp/check-verification-otp",
-      method: "POST"
-    },
-    resetPassword: {
-      path: "email-otp/passcode",
-      method: "POST"
-    }
-  },
-  magicLink: { verify: {
-    path: "magic-link/verify",
-    method: "GET"
-  } }
-};
-var NEON_AUTH_COOKIE_PREFIX = "__Secure-neon-auth";
-var NEON_AUTH_SESSION_DATA_COOKIE_NAME = `${NEON_AUTH_COOKIE_PREFIX}.local.session_data`;
-var NEON_AUTH_LEGACY_SESSION_CHALLENGE_COOKIE_NAME = `${NEON_AUTH_COOKIE_PREFIX}.session_challange`;
-var NEON_AUTH_SESSION_CHALLENGE_COOKIE_NAME = `${NEON_AUTH_COOKIE_PREFIX}.session_challenge`;
-var NEON_AUTH_SESSION_COOKIE_NAME = `${NEON_AUTH_COOKIE_PREFIX}.session_token`;
-var extractNeonAuthCookies = (headers2) => {
-  const cookieHeader = typeof headers2 === "string" ? headers2 : headers2.get("cookie");
-  if (!cookieHeader) return "";
-  const parsedCookies = parseCookies(cookieHeader);
-  const result = [];
-  for (const [name, value] of parsedCookies.entries()) if (name.startsWith(NEON_AUTH_COOKIE_PREFIX)) result.push(`${name}=${value}`);
-  return result.join("; ");
-};
-var parseSetCookies = (setCookieHeader) => {
-  const parsedCookies = parseSetCookieHeader(setCookieHeader);
-  const cookies2 = [];
-  for (const entry of parsedCookies.entries()) {
-    const [name, parsedCookie] = entry;
-    cookies2.push({
-      name,
-      value: decodeURIComponent(parsedCookie.value),
-      path: parsedCookie.path,
-      domain: parsedCookie.domain,
-      maxAge: parsedCookie["max-age"] ?? parsedCookie.maxAge,
-      expires: parsedCookie.expires,
-      httpOnly: parsedCookie.httponly ?? true,
-      secure: parsedCookie.secure ?? true,
-      sameSite: parsedCookie.samesite ?? "lax",
-      partitioned: parsedCookie.partitioned
-    });
-  }
-  return cookies2;
-};
-var serializeSetCookie = (cookie) => {
-  let result = `${cookie.name}=${encodeURIComponent(cookie.value)}`;
-  if (cookie.path) result += `; Path=${cookie.path}`;
-  if (cookie.domain) result += `; Domain=${cookie.domain}`;
-  if (cookie.maxAge !== void 0) result += `; Max-Age=${cookie.maxAge}`;
-  if (cookie.expires) result += `; Expires=${cookie.expires.toUTCString()}`;
-  if (cookie.httpOnly) result += "; HttpOnly";
-  if (cookie.secure) result += "; Secure";
-  if (cookie.sameSite) {
-    const sameSite = cookie.sameSite.charAt(0).toUpperCase() + cookie.sameSite.slice(1);
-    result += `; SameSite=${sameSite}`;
-  }
-  if (cookie.partitioned) result += "; Partitioned";
-  return result;
-};
-var parseCookieValue = (cookieString, name) => {
-  if (!cookieString) return null;
-  return parseCookies(cookieString).get(name) ?? null;
-};
-var DEFAULT_SESSION_CACHE_TTL_SECONDS = 300;
-var JWS_ALGO = "HS256";
-function emit$1(log, level, message, meta) {
-  if (log) {
-    log[level](message, meta);
-    return;
+// src/cookies.ts
+var OURS = "__Host-webtwizz-auth.";
+var LOCAL = "webtwizz-auth.";
+var THEIRS = "__Secure-neon-auth.";
+var SESSION = "session_token";
+var CACHE = "local.session_data";
+var KEEP = 400 * 24 * 60 * 60;
+var LOCALHOST = /^(localhost|.+\.localhost|127\.0\.0\.1|::1)$/;
+function siteOrigin(url, headers) {
+  const origin = headers.get("origin");
+  if (origin && origin !== "null") return origin;
+  const first = (value) => value?.split(",")[0].trim() || null;
+  const fallback = new URL(url);
+  const proto = first(headers.get("x-forwarded-proto")) ?? fallback.protocol.replace(":", "");
+  const host = first(headers.get("x-forwarded-host")) ?? first(headers.get("host")) ?? fallback.host;
+  return `${proto}://${host}`;
+}
+function cookieMode(url, headers) {
+  let local = false;
+  try {
+    const origin = new URL(siteOrigin(url, headers));
+    local = origin.protocol === "http:" && LOCALHOST.test(origin.hostname.replace(/^\[|\]$/g, ""));
+  } catch {
   }
-  if (meta && Object.keys(meta).length > 0) console[level](message, meta);
-  else console[level](message);
+  const framed = !local && (headers.get("sec-fetch-dest") === "iframe" || headers.get(FRAME_HEADER) === "1");
+  return { local, framed };
+}
+function pairs(header) {
+  if (!header) return [];
+  return header.split(";").flatMap((part) => {
+    const at = part.indexOf("=");
+    return at < 0 ? [] : [[part.slice(0, at).trim(), part.slice(at + 1).trim()]];
+  });
+}
+function readCookies(header, mode) {
+  const prefix = mode.local ? LOCAL : OURS;
+  const found = /* @__PURE__ */ new Map();
+  for (const [name, value] of pairs(header)) if (name.startsWith(prefix) && name.length > prefix.length) found.set(name.slice(prefix.length), value);
+  return found;
 }
-function parseDate(dateValue, fieldName) {
-  const date = new Date(dateValue);
-  if (Number.isNaN(date.getTime())) throw new TypeError(`Invalid date value for ${fieldName}: ${JSON.stringify(dateValue)}`);
-  return date;
+function upstreamCookies(ours) {
+  return [...ours].filter(([name]) => !name.startsWith("local.")).map(([name, value]) => `${THEIRS}${name}=${value}`).join("; ");
 }
-async function signSessionDataCookie(sessionData, secret, ttlSeconds = DEFAULT_SESSION_CACHE_TTL_SECONDS) {
-  const ttlMs = ttlSeconds * 1e3;
-  const expiresAt = Math.min(sessionData.session.expiresAt.getTime(), Date.now() + ttlMs);
+function browserCookie(name, value, mode, maxAge) {
   return {
-    value: await signPayload(sessionData, expiresAt, secret),
-    expiresAt: new Date(expiresAt)
+    name: (mode.local ? LOCAL : OURS) + name,
+    value,
+    path: "/",
+    maxAge,
+    httpOnly: true,
+    secure: !mode.local,
+    sameSite: mode.framed ? "none" : "lax",
+    partitioned: mode.framed
   };
 }
-function signPayload(sessionData, expiresAt, secret) {
-  const encodedSecret = new TextEncoder().encode(secret);
-  const expSeconds = Math.floor(expiresAt / 1e3);
-  return new SignJWT(sessionData).setProtectedHeader({
-    alg: JWS_ALGO,
-    typ: "JWT"
-  }).setIssuedAt().setExpirationTime(expSeconds).setSubject(sessionData.user?.id ?? "anonymous").sign(encodedSecret);
-}
-function parseSessionData(json, log) {
-  if (!json || typeof json !== "object") return {
-    session: null,
-    user: null
-  };
-  const data = json;
-  if (!data.session || !data.user) return {
-    session: null,
-    user: null
-  };
-  try {
-    return {
-      session: {
-        ...data.session,
-        expiresAt: parseDate(data.session.expiresAt, "session.expiresAt"),
-        createdAt: parseDate(data.session.createdAt, "session.createdAt"),
-        updatedAt: parseDate(data.session.updatedAt, "session.updatedAt")
-      },
-      user: {
-        ...data.user,
-        createdAt: parseDate(data.user.createdAt, "user.createdAt"),
-        updatedAt: parseDate(data.user.updatedAt, "user.updatedAt")
-      }
-    };
-  } catch (error) {
-    emit$1(log, "error", "[parseSessionData] Failed to parse session dates:", {
-      error: error instanceof Error ? error.message : String(error),
-      hasSession: !!data.session,
-      hasUser: !!data.user
-    });
-    return {
-      session: null,
-      user: null
-    };
+var removal = (name, mode) => browserCookie(name, "", mode, 0);
+function fromUpstream(setCookie, mode) {
+  const [pair, ...attributes] = setCookie.split(";");
+  const at = pair.indexOf("=");
+  const name = pair.slice(0, at).trim();
+  if (at < 0 || !name.startsWith(THEIRS)) return null;
+  const short = name.slice(THEIRS.length);
+  const value = pair.slice(at + 1).trim();
+  let maxAge;
+  for (const attribute of attributes) {
+    const [key, ...rest] = attribute.trim().split("=");
+    const lower = key.toLowerCase();
+    if (lower === "max-age") maxAge = Number(rest.join("="));
+    else if (lower === "expires" && maxAge === void 0) {
+      const at2 = Date.parse(rest.join("="));
+      if (!Number.isNaN(at2)) maxAge = Math.max(0, Math.floor((at2 - Date.now()) / 1e3));
+    }
   }
-}
-async function getSessionDataFromCookie(request, cookieName, cookieSecret, log) {
-  try {
-    const cookieHeader = request.headers.get("cookie");
-    if (!cookieHeader) return null;
-    const sessionDataCookie = parseCookies(cookieHeader).get(cookieName);
-    if (!sessionDataCookie) return null;
-    const result = await validateSessionData(sessionDataCookie, cookieSecret);
-    if (result.valid && result.payload) return result.payload;
-    emit$1(log, "warn", "[getSessionDataFromCookie] Invalid session cookie:", {
-      error: result.error,
-      cookieName
-    });
-    return null;
-  } catch (error) {
-    emit$1(log, "error", "[getSessionDataFromCookie] Unexpected validation error:", {
-      error: error instanceof Error ? error.message : String(error),
-      cookieName,
-      ...process.env.NODE_ENV !== "production" && { stack: error instanceof Error ? error.stack : void 0 }
-    });
-    return null;
+  if (Number.isNaN(maxAge)) maxAge = void 0;
+  if (short === SESSION && maxAge && maxAge > 0) maxAge = KEEP;
+  return browserCookie(short, maxAge === 0 ? "" : value, mode, maxAge);
+}
+function serialize(cookie) {
+  const parts = [`${cookie.name}=${cookie.value}`, `Path=${cookie.path}`];
+  if (cookie.maxAge !== void 0) parts.push(`Max-Age=${cookie.maxAge}`);
+  if (cookie.httpOnly) parts.push("HttpOnly");
+  if (cookie.secure) parts.push("Secure");
+  parts.push(cookie.sameSite === "none" ? "SameSite=None" : "SameSite=Lax");
+  if (cookie.partitioned) parts.push("Partitioned");
+  return parts.join("; ");
+}
+function applyToHeader(header, cookies) {
+  const jar = new Map(pairs(header));
+  for (const cookie of cookies) {
+    if (cookie.maxAge === 0) jar.delete(cookie.name);
+    else jar.set(cookie.name, cookie.value);
   }
+  return [...jar].map(([name, value]) => `${name}=${value}`).join("; ");
 }
-async function fetchSessionWithCookie(sessionTokenCookie, baseUrl, log) {
-  let cookieName;
-  let cookieValue;
-  if (sessionTokenCookie.includes("=")) {
-    const [name, ...valueParts] = sessionTokenCookie.split(";")[0].trim().split("=");
-    cookieName = name.trim();
-    cookieValue = valueParts.join("=").trim();
-  } else throw new Error("Invalid session token cookie format");
-  if (!cookieName.includes("session_token")) throw new Error("session_token not found in cookie");
-  const response = await fetch(`${baseUrl}/get-session`, {
-    headers: { Cookie: `${cookieName}=${cookieValue}` },
-    signal: AbortSignal.timeout(3e3)
-  });
-  if (!response.ok) throw new Error(`Failed to fetch session data: ${response.status} ${response.statusText}`);
-  let body;
+
+// src/next-headers.ts
+import { cookies as nextCookies, headers as nextHeaders } from "next/headers";
+var decode = (value) => {
   try {
-    body = await response.json();
-  } catch (error) {
-    throw new Error(`Failed to parse /get-session response as JSON: ${error instanceof Error ? error.message : String(error)}`);
+    return decodeURIComponent(value);
+  } catch {
+    return value;
   }
-  return parseSessionData(body, log);
-}
-var ERRORS = {
-  MISSING_AUTH_BASE_URL: "Missing required config: baseUrl. You must provide the auth URL of your Neon Auth instance in the config object.",
-  MISSING_COOKIE_SECRET: "Missing required config: cookies.secret. You must provide the cookie secret in the config object.",
-  COOKIE_SECRET_TOO_SHORT: "cookies.secret must be at least 32 characters long for security. Generate a secure secret with: openssl rand -base64 32",
-  INVALID_SESSION_DATA_TTL: "cookies.sessionDataTtl must be a positive number (in seconds)"
 };
-async function validateSessionData(sessionDataString, cookieSecret) {
-  try {
-    const { payload } = await jwtVerify(sessionDataString, new TextEncoder().encode(cookieSecret), { algorithms: ["HS256"] });
-    return {
-      valid: true,
-      payload: parseSessionData(payload)
-    };
-  } catch (error) {
-    return {
-      valid: false,
-      error: error instanceof Error ? error.message : "Invalid session data"
-    };
+async function requestScope() {
+  const [headers, jar] = await Promise.all([nextHeaders(), nextCookies()]);
+  return {
+    headers: new Headers(headers),
+    cookieHeader: jar.getAll().map(({ name, value }) => `${name}=${encodeURIComponent(value)}`).join("; "),
+    setCookie(cookie) {
+      try {
+        jar.set({ ...cookie, value: decode(cookie.value) });
+      } catch {
+      }
+    }
+  };
+}
+
+// src/session.ts
+var VERIFIER = "neon_auth_session_verifier";
+var PRIVATE = ["token", "ipAddress", "userAgent"];
+var MAX_CACHE = 3800;
+var STALE = 60 * 60;
+var TIMEOUT = 1e4;
+var unreachable = { message: "Sign-in isn't working right now.", status: 502, statusText: "Bad Gateway", code: "NETWORK_ERROR" };
+function visitorHeaders(incoming) {
+  const out = {};
+  for (const name of ["x-forwarded-for", "x-real-ip", "user-agent"]) {
+    const value = incoming.get(name);
+    if (value) out[name] = value;
   }
+  return out;
 }
-async function mintSessionDataCookie(sessionTokenCookie, baseUrl, cookieConfig, log) {
+async function upstream(config, path, call) {
+  const headers = { ...call.visitor, origin: call.origin, accept: "application/json" };
+  if (call.cookie) headers.cookie = call.cookie;
+  if (call.contentType) headers["content-type"] = call.contentType;
   try {
-    const sessionData = await fetchSessionWithCookie(sessionTokenCookie, baseUrl, log);
-    if (!sessionData.session) return null;
-    const { value: signedData, expiresAt } = await signSessionDataCookie(sessionData, cookieConfig.secret, cookieConfig.sessionDataTtl);
-    const maxAge = Math.floor((expiresAt.getTime() - Date.now()) / 1e3);
-    return serializeSetCookie({
-      name: NEON_AUTH_SESSION_DATA_COOKIE_NAME,
-      value: signedData,
-      path: "/",
-      domain: cookieConfig.domain,
-      httpOnly: true,
-      secure: true,
-      sameSite: cookieConfig.sameSite ?? "lax",
-      maxAge
+    return await fetch(`${config.baseUrl.replace(/\/+$/, "")}/${path}${call.search ?? ""}`, {
+      method: call.method ?? "GET",
+      headers,
+      body: call.body,
+      redirect: "manual",
+      signal: AbortSignal.timeout(TIMEOUT)
     });
   } catch (error) {
-    const meta = {
-      error: error instanceof Error ? error.message : String(error),
-      ...process.env.NODE_ENV !== "production" && { stack: error instanceof Error ? error.stack : void 0 }
-    };
-    if (log) log.error("[mintSessionDataCookie] Failed to mint session_data cookie:", meta);
-    else console.error("[mintSessionDataCookie] Failed to mint session_data cookie:", meta);
+    const reason = error;
+    console.error(`[webtwizz-auth] The sign-in service could not be reached (${reason?.cause?.code ?? reason?.name ?? "unknown"})`);
     return null;
   }
 }
-async function mintSessionDataFromResponse(responseHeaders, baseUrl, cookieConfig, log) {
-  const setCookieHeaders = responseHeaders.getSetCookie();
-  let sessionTokenCookie;
-  let sessionTokenIsDeletion = false;
-  for (const cookieHeader of setCookieHeaders) {
-    const parsed = parseSetCookies(cookieHeader).find((cookie) => cookie.name === NEON_AUTH_SESSION_COOKIE_NAME);
-    if (parsed) {
-      sessionTokenCookie = cookieHeader;
-      sessionTokenIsDeletion = parsed.maxAge === 0 || parsed.expires !== void 0 && parsed.expires.getTime() <= Date.now();
-      break;
-    }
-  }
-  if (!sessionTokenCookie) return null;
-  if (sessionTokenIsDeletion) return serializeSetCookie({
-    name: NEON_AUTH_SESSION_DATA_COOKIE_NAME,
-    value: "",
-    path: "/",
-    domain: cookieConfig.domain,
-    httpOnly: true,
-    secure: true,
-    sameSite: cookieConfig.sameSite ?? "lax",
-    maxAge: 0
-  });
-  return await mintSessionDataCookie(sessionTokenCookie, baseUrl, cookieConfig, log);
+var encoder = new TextEncoder();
+function base64url(bytes) {
+  let text = "";
+  for (const byte of new Uint8Array(bytes)) text += String.fromCharCode(byte);
+  return btoa(text).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
-async function mintSessionDataFromToken(sessionTokenCookie, baseUrl, cookieConfig, log) {
-  return await mintSessionDataCookie(sessionTokenCookie, baseUrl, cookieConfig, log);
+function fromBase64url(value) {
+  const text = atob(value.replace(/-/g, "+").replace(/_/g, "/"));
+  return new TextDecoder().decode(Uint8Array.from(text, (char) => char.charCodeAt(0)));
 }
-var LEVEL_RANK = {
-  error: 0,
-  warn: 1,
-  info: 2,
-  debug: 3
-};
-var consoleSink = {
-  error: (message, meta) => {
-    if (meta && Object.keys(meta).length > 0) console.error(message, meta);
-    else console.error(message);
-  },
-  warn: (message, meta) => {
-    if (meta && Object.keys(meta).length > 0) console.warn(message, meta);
-    else console.warn(message);
-  },
-  info: (message, meta) => {
-    if (meta && Object.keys(meta).length > 0) console.info(message, meta);
-    else console.info(message);
-  },
-  debug: (message, meta) => {
-    if (meta && Object.keys(meta).length > 0) console.debug(message, meta);
-    else console.debug(message);
-  }
-};
-function wrapWithLevel(level, logger) {
-  const minRank = LEVEL_RANK[level];
-  const gate = (messageLevel, fn) => {
-    return (message, meta) => {
-      if (LEVEL_RANK[messageLevel] <= minRank) fn(message, meta);
-    };
-  };
-  return {
-    error: gate("error", logger.error),
-    warn: gate("warn", logger.warn),
-    info: gate("info", logger.info),
-    debug: gate("debug", logger.debug)
-  };
+var hmacKey = (secret) => crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign", "verify"]);
+async function hmac(secret, data) {
+  return base64url(await crypto.subtle.sign("HMAC", await hmacKey(secret), encoder.encode(data)));
 }
-var noopResolved = {
-  error: () => {
-  },
-  warn: () => {
-  },
-  info: () => {
-  },
-  debug: () => {
+async function signedBy(secret, data, signature) {
+  try {
+    const bytes = Uint8Array.from(atob(signature.replace(/-/g, "+").replace(/_/g, "/")), (char) => char.charCodeAt(0));
+    return await crypto.subtle.verify("HMAC", await hmacKey(secret), bytes, encoder.encode(data));
+  } catch {
+    return false;
   }
-};
-function resolveNeonAuthLogging(input) {
-  if (input?.logLevel === "silent") return noopResolved;
-  const level = input?.logLevel ?? "warn";
-  const raw = input?.logger ?? {};
-  return wrapWithLevel(level, {
-    error: raw.error ?? consoleSink.error,
-    warn: raw.warn ?? consoleSink.warn,
-    info: raw.info ?? consoleSink.info,
-    debug: raw.debug ?? consoleSink.debug
-  });
-}
-function resolveLog(log) {
-  if (!log) return void 0;
-  if (log.error && log.warn && log.info && log.debug) return log;
-  return resolveNeonAuthLogging({ logger: log });
-}
-function readErrnoCode(node) {
-  if (!node || typeof node !== "object") return void 0;
-  const code = node.code;
-  return typeof code === "string" ? code : void 0;
-}
-function isAbortError(node) {
-  if (node instanceof Error && node.name === "AbortError") return true;
-  if (typeof node === "object" && node !== null && "name" in node && node.name === "AbortError") return true;
-  return false;
-}
-function isTlsRelated(code, message) {
-  if (!code && !message) return false;
-  const c = code ?? "";
-  if (c.startsWith("ERR_TLS") || c.startsWith("CERT_") || c === "UNABLE_TO_VERIFY_LEAF_SIGNATURE") return true;
-  const m = message.toLowerCase();
-  return m.includes("certificate") || m.includes("ssl") || m.includes("tls") || m.includes("wrong version number");
 }
-function isLegacyFetchTypeError(node) {
-  return node instanceof TypeError && typeof node.message === "string" && node.message.includes("fetch");
+var tokenId = async (token) => base64url((await crypto.subtle.digest("SHA-256", encoder.encode(token))).slice(0, 16));
+function trim(data) {
+  const session = { ...data.session };
+  for (const key of PRIVATE) delete session[key];
+  return { session, user: data.user };
 }
-function collectRelatedErrors(error) {
-  const seen = /* @__PURE__ */ new Set();
-  const list = [];
-  function add(e) {
-    if (e === void 0 || e === null) return;
-    if (typeof e === "object") {
-      if (seen.has(e)) return;
-      seen.add(e);
-    }
-    list.push(e);
-    if (e instanceof Error && e.cause !== void 0) add(e.cause);
-    if (e instanceof AggregateError && Array.isArray(e.errors)) for (const sub of e.errors) add(sub);
+async function readCache(value, token, secret) {
+  if (!value) return null;
+  const [body, signature] = value.split(".");
+  if (!body || !signature || !await signedBy(secret, body, signature)) return null;
+  try {
+    const { d, s, f } = JSON.parse(fromBase64url(body));
+    if (s !== await tokenId(token) || !d?.session || !d?.user) return null;
+    return { data: d, fresh: Date.now() / 1e3 < f };
+  } catch {
+    return null;
   }
-  add(error);
-  return list;
 }
-function clientMessageFor(code) {
-  switch (code) {
-    case "NETWORK_DNS":
-      return "Could not resolve authentication server hostname";
-    case "NETWORK_REFUSED":
-      return "Connection refused by authentication server";
-    case "NETWORK_TIMEOUT":
-      return "Authentication server connection timed out";
-    case "NETWORK_TLS":
-      return "TLS error connecting to authentication server";
-    case "NETWORK_RESET":
-      return "Connection to authentication server was reset";
-    case "NETWORK_ABORT":
-      return "Authentication request was aborted";
-    default:
-      return "Unable to connect to authentication server";
+async function cacheCookie(data, token, config, mode) {
+  const now = Math.floor(Date.now() / 1e3);
+  const ends = Math.floor(Date.parse(String(data.session.expiresAt)) / 1e3) || now + STALE;
+  const body = base64url(encoder.encode(JSON.stringify({ d: data, s: await tokenId(token), f: Math.min(now + config.ttl, ends) })));
+  const cookie = browserCookie(CACHE, `${body}.${await hmac(config.secret, body)}`, mode, Math.max(0, Math.min(STALE, ends - now)));
+  return cookie.name.length + cookie.value.length > MAX_CACHE ? removal(CACHE, mode) : cookie;
+}
+async function resolveSession(config, lookup) {
+  const ours = readCookies(lookup.cookieHeader, lookup.mode);
+  const token = ours.get(SESSION);
+  const exchanging = lookup.search?.has(VERIFIER) ?? false;
+  if (!token && !exchanging) return { data: null, cookies: ours.has(CACHE) ? [removal(CACHE, lookup.mode)] : [], error: null };
+  const cached = token ? await readCache(ours.get(CACHE), token, config.secret) : null;
+  if (cached?.fresh && !lookup.fresh) return { data: cached.data, cookies: [], error: null };
+  const search = lookup.search?.size ? `?${lookup.search}` : "";
+  const response = await upstream(config, "get-session", { search, cookie: upstreamCookies(ours), visitor: visitorHeaders(lookup.headers), origin: lookup.origin });
+  if (!response || response.status >= 500 || response.status === 429) {
+    if (cached) return { data: cached.data, cookies: [], error: null };
+    return { data: null, cookies: [], error: response ? { ...unreachable, status: response.status, statusText: response.statusText } : unreachable };
   }
-}
-var INTERNAL_PUBLIC_MESSAGE = "Internal Server Error";
-function classifyFetchFailure(error) {
-  const nodes = collectRelatedErrors(error);
-  for (const node of nodes) if (isAbortError(node)) return {
-    kind: "transport",
-    code: "NETWORK_ABORT",
-    detail: "AbortError",
-    clientMessage: clientMessageFor("NETWORK_ABORT")
-  };
-  for (const node of nodes) {
-    const code = readErrnoCode(node);
-    const message = node instanceof Error ? node.message : "";
-    if (code === "ENOTFOUND" || code === "EAI_AGAIN") return {
-      kind: "transport",
-      code: "NETWORK_DNS",
-      detail: code,
-      clientMessage: clientMessageFor("NETWORK_DNS")
-    };
-    if (code === "ECONNREFUSED") return {
-      kind: "transport",
-      code: "NETWORK_REFUSED",
-      detail: code,
-      clientMessage: clientMessageFor("NETWORK_REFUSED")
-    };
-    if (code === "ETIMEDOUT" || code === "UND_ERR_CONNECT_TIMEOUT" || code === "UND_ERR_HEADERS_TIMEOUT" || code === "UND_ERR_BODY_TIMEOUT") return {
-      kind: "transport",
-      code: "NETWORK_TIMEOUT",
-      detail: code ?? "timeout",
-      clientMessage: clientMessageFor("NETWORK_TIMEOUT")
-    };
-    if (code === "ECONNRESET" || code === "EPIPE" || code === "ECONNABORTED") return {
-      kind: "transport",
-      code: "NETWORK_RESET",
-      detail: code,
-      clientMessage: clientMessageFor("NETWORK_RESET")
-    };
-    if (isTlsRelated(code, message)) return {
-      kind: "transport",
-      code: "NETWORK_TLS",
-      detail: code ?? "tls",
-      clientMessage: clientMessageFor("NETWORK_TLS")
-    };
+  const cookies = response.headers.getSetCookie().map((cookie) => fromUpstream(cookie, lookup.mode)).filter((cookie) => cookie !== null);
+  const body = await response.json().catch(() => null);
+  if (!response.ok) {
+    return { data: null, cookies, error: { message: body?.message ?? body?.error ?? response.statusText, status: response.status, statusText: response.statusText, code: body?.code ?? "UNKNOWN" } };
   }
-  for (const node of nodes) if (isLegacyFetchTypeError(node)) return {
-    kind: "transport",
-    code: "NETWORK_ERROR",
-    detail: "fetch TypeError",
-    clientMessage: clientMessageFor("NETWORK_ERROR")
-  };
-  const head = nodes[0];
-  return {
-    kind: "internal",
-    detail: (head instanceof Error ? head.message : INTERNAL_PUBLIC_MESSAGE).slice(0, 200),
-    clientMessage: INTERNAL_PUBLIC_MESSAGE
-  };
-}
-function validateCookieConfig(cookies2) {
-  if (!cookies2.secret) throw new Error(ERRORS.MISSING_COOKIE_SECRET);
-  if (cookies2.secret.length < 32) throw new Error(ERRORS.COOKIE_SECRET_TOO_SHORT);
-  if (cookies2.sessionDataTtl !== void 0 && cookies2.sessionDataTtl <= 0) throw new Error(ERRORS.INVALID_SESSION_DATA_TTL);
-}
-function createAuthServer(config) {
-  const { baseUrl, context: getContext, cookieSecret, sessionDataTtl, domain, sameSite } = config;
-  const log = resolveLog(config.log);
-  validateCookieConfig({
-    secret: cookieSecret,
-    sessionDataTtl
-  });
-  const effectiveSameSite = sameSite ?? "lax";
-  const fetchWithAuth = async (path, method, args) => {
-    const ctx = await getContext();
-    const cookies2 = await ctx.getCookies();
-    const origin = await ctx.getOrigin();
-    const framework = ctx.getFramework();
-    const url = new URL(path, baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`);
-    const { query, fetchOptions: _fetchOptions, ...body } = args || {};
-    if (query && typeof query === "object") {
-      const queryParams = query;
-      for (const [key, value] of Object.entries(queryParams)) if (value !== void 0 && value !== null) url.searchParams.set(key, String(value));
-    }
-    const headers2 = {
-      Cookie: cookies2,
-      Origin: origin,
-      [NEON_AUTH_SERVER_PROXY_HEADER]: framework
-    };
-    let requestBody;
-    if (method === "POST") {
-      headers2["Content-Type"] = "application/json";
-      requestBody = JSON.stringify(Object.keys(body).length > 0 ? body : {});
-    }
-    let response;
-    try {
-      response = await fetch(url.toString(), {
-        method,
-        headers: headers2,
-        body: requestBody
-      });
-    } catch (error) {
-      const classified = classifyFetchFailure(error);
-      if (classified.kind === "transport") {
-        log?.warn("[webtwizz-auth] Server API upstream fetch failed", {
-          component: "server-api",
-          path: url.pathname,
-          code: classified.code,
-          detail: classified.detail,
-          host: url.host
-        });
-        return {
-          data: null,
-          error: {
-            message: classified.clientMessage,
-            status: 502,
-            statusText: "Bad Gateway",
-            code: classified.code
-          }
-        };
-      }
-      log?.error("[webtwizz-auth] Server API unexpected fetch error", {
-        component: "server-api",
-        path: url.pathname,
-        detail: classified.detail,
-        host: url.host,
-        err: error
-      });
-      throw error instanceof Error ? error : new Error(String(error));
-    }
-    if (response.ok) log?.debug("[webtwizz-auth] Server API upstream fetch completed", {
-      component: "server-api",
-      path: url.pathname,
-      status: response.status,
-      host: url.host
-    });
-    else if (response.status >= 500) log?.warn("[webtwizz-auth] Server API upstream HTTP error", {
-      component: "server-api",
-      path: url.pathname,
-      status: response.status,
-      statusText: response.statusText,
-      host: url.host
-    });
-    else log?.info("[webtwizz-auth] Server API upstream HTTP non-2xx", {
-      component: "server-api",
-      path: url.pathname,
-      status: response.status,
-      statusText: response.statusText,
-      host: url.host
-    });
-    const setCookieHeaders = response.headers.getSetCookie();
-    if (setCookieHeaders.length > 0) {
-      for (const setCookieHeader of setCookieHeaders) {
-        const parsedCookies = parseSetCookies(setCookieHeader);
-        for (const cookie of parsedCookies) {
-          const cookieOptions = {
-            ...cookie,
-            domain,
-            partitioned: void 0,
-            sameSite: effectiveSameSite,
-            secure: true
-          };
-          await ctx.setCookie(cookie.name, cookie.value, cookieOptions);
-        }
-      }
-      try {
-        const sessionDataCookie = await mintSessionDataFromResponse(response.headers, baseUrl, {
-          secret: cookieSecret,
-          sessionDataTtl,
-          domain,
-          sameSite
-        }, log);
-        if (sessionDataCookie) {
-          const [parsedSessionData] = parseSetCookies(sessionDataCookie);
-          if (parsedSessionData) await ctx.setCookie(parsedSessionData.name, parsedSessionData.value, parsedSessionData);
-        }
-      } catch (error) {
-        log?.warn("[webtwizz-auth] Failed to mint session data cookie", {
-          component: "server-api",
-          detail: error instanceof Error ? error.message : String(error),
-          err: error
-        });
-      }
-    }
-    const responseData = await response.json().catch(() => null);
-    if (!response.ok) {
-      const normalized = normalizeBetterAuthError({
-        status: response.status,
-        statusText: response.statusText,
-        message: responseData?.message || response.statusText,
-        code: responseData?.code,
-        body: responseData
-      });
-      return {
-        data: null,
-        error: {
-          message: normalized.message,
-          status: normalized.status ?? response.status,
-          statusText: response.statusText,
-          code: normalized.code
-        }
-      };
-    }
-    return {
-      data: responseData,
-      error: null
-    };
-  };
-  const baseServer = createApiProxy(API_ENDPOINTS, fetchWithAuth);
-  const originalGetSession = baseServer.getSession;
-  baseServer.getSession = async (...args) => {
-    const [data] = args;
-    if (!(data?.query?.disableCookieCache === "true")) try {
-      const cookiesString = await (await getContext()).getCookies();
-      const hasSessionToken = cookiesString.includes(NEON_AUTH_SESSION_COOKIE_NAME);
-      const sessionDataCookie = parseCookieValue(cookiesString, NEON_AUTH_SESSION_DATA_COOKIE_NAME);
-      if (sessionDataCookie && hasSessionToken) {
-        const result = await validateSessionData(sessionDataCookie, cookieSecret);
-        if (result.valid && result.payload) return {
-          data: result.payload,
-          error: null
-        };
-      }
-    } catch (error) {
-      log?.warn("[webtwizz-auth] Cookie validation error before getSession upstream call", {
-        component: "server-api",
-        detail: error instanceof Error ? error.message : String(error),
-        err: error
-      });
-    }
-    return originalGetSession(...args);
-  };
-  return baseServer;
-}
-function isEndpointConfig(value) {
-  return typeof value === "object" && value !== null && "path" in value && "method" in value;
-}
-function createApiProxy(endpoints, fetchFn) {
-  return new Proxy({}, {
-    get(target, prop) {
-      if (prop in target) return target[prop];
-      const endpoint = endpoints[prop];
-      if (!endpoint) return;
-      if (isEndpointConfig(endpoint)) return (args) => fetchFn(endpoint.path, endpoint.method, args);
-      return createApiProxy(endpoint, fetchFn);
-    },
-    set(target, prop, value) {
-      target[prop] = value;
-      return true;
-    }
-  });
+  if (!body?.session || !body?.user) {
+    if (token && !cookies.some((cookie) => cookie.name.endsWith(SESSION))) cookies.push(removal(SESSION, lookup.mode));
+    cookies.push(removal(CACHE, lookup.mode));
+    return { data: null, cookies, error: null };
+  }
+  const renewed = cookies.find((cookie) => cookie.name.endsWith(SESSION) && cookie.value)?.value;
+  const data = trim(body);
+  cookies.push(await cacheCookie(data, renewed ?? token ?? "", config, lookup.mode));
+  return { data, cookies, error: null };
 }
-var PROXY_HEADERS = [
-  "user-agent",
-  "authorization",
-  "referer",
-  "content-type"
+
+// src/server.ts
+var RETURN = "return";
+var NOT_FOUND = { code: "NOT_FOUND", message: "Not found" };
+var NO_PROVIDER = { code: "PROVIDER_NOT_FOUND", message: "Provider not found" };
+var HIDDEN = [/^reference$/, /^open-api(\/|$)/, /^error$/, /^token(\/|$)/, /^jwks$/, /^\.well-known\//, /^oauth2\//, /^callback\//];
+var SERVER_ONLY = [
+  /^admin\//,
+  /^organization\//,
+  /^magic-link\//,
+  /^sign-in\/(email-otp|magic-link|anonymous|phone-number)$/,
+  /^request-password-reset$/,
+  /^forget-password$/,
+  /^reset-password\/./,
+  /^send-verification-email$/
 ];
-var NEON_AUTH_HEADER_MIDDLEWARE_NAME = "x-neon-auth-middleware";
-function safeAuthHost(baseUrl) {
+var CODE_TYPES = /* @__PURE__ */ new Set(["email-verification", "forget-password"]);
+var SOCIAL = /* @__PURE__ */ new Set(["sign-in/social", "link-social"]);
+var GETS = /* @__PURE__ */ new Set([
+  "get-session",
+  "list-sessions",
+  "list-accounts",
+  "account-info",
+  "verify-email",
+  "admin/get-user",
+  "admin/list-users",
+  "organization/get-organization",
+  "organization/get-full-organization",
+  "organization/list",
+  "organization/get-invitation",
+  "organization/list-invitations",
+  "organization/get-active-member",
+  "organization/list-user-invitations",
+  "organization/list-members",
+  "organization/get-active-member-role"
+]);
+var PASSED = ["content-type", "cache-control", "location", "retry-after", "x-retry-after"];
+var EMPTY = /* @__PURE__ */ new Set([101, 204, 205, 304]);
+var parse = (text) => {
   try {
-    return new URL(baseUrl).host;
+    const value = text ? JSON.parse(text) : null;
+    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
   } catch {
-    return;
-  }
-}
-var handleAuthRequest = async (baseUrl, request, path, log) => {
-  const headers2 = prepareRequestHeaders(request);
-  const body = await parseRequestBody(request);
-  try {
-    const upstreamURL = getUpstreamURL(baseUrl, path, { originalUrl: new URL(request.url) });
-    const response = await fetch(upstreamURL.toString(), {
-      method: request.method,
-      headers: headers2,
-      body
-    });
-    const host = safeAuthHost(baseUrl);
-    if (response.ok) log?.debug("[webtwizz-auth] Upstream fetch completed", {
-      component: "proxy",
-      proxyPath: path,
-      status: response.status,
-      host
-    });
-    else if (response.status >= 500) log?.warn("[webtwizz-auth] Upstream HTTP error", {
-      component: "proxy",
-      proxyPath: path,
-      status: response.status,
-      statusText: response.statusText,
-      host
-    });
-    else log?.info("[webtwizz-auth] Upstream HTTP non-2xx", {
-      component: "proxy",
-      proxyPath: path,
-      status: response.status,
-      statusText: response.statusText,
-      host
-    });
-    return response;
-  } catch (error) {
-    const classified = classifyFetchFailure(error);
-    if (classified.kind === "transport") {
-      log?.warn("[webtwizz-auth] Upstream fetch failed", {
-        component: "proxy",
-        proxyPath: path,
-        code: classified.code,
-        detail: classified.detail,
-        host: safeAuthHost(baseUrl)
-      });
-      return Response.json({
-        error: classified.clientMessage,
-        code: classified.code
-      }, {
-        status: 502,
-        headers: { "Content-Type": "application/json" }
-      });
-    }
-    log?.error("[webtwizz-auth] Unexpected proxy error", {
-      component: "proxy",
-      proxyPath: path,
-      detail: classified.detail,
-      host: safeAuthHost(baseUrl)
-    });
-    return Response.json({
-      error: classified.clientMessage,
-      code: "INTERNAL_ERROR"
-    }, {
-      status: 500,
-      headers: { "Content-Type": "application/json" }
-    });
-  }
-};
-var getUpstreamURL = (baseUrl, path, { originalUrl }) => {
-  const url = new URL(`${baseUrl}/${path}`);
-  if (originalUrl) {
-    url.search = originalUrl.search;
-    return url;
-  }
-  return url;
-};
-var prepareRequestHeaders = (request) => {
-  const headers2 = new Headers();
-  for (const header of PROXY_HEADERS) if (request.headers.get(header)) headers2.set(header, request.headers.get(header));
-  headers2.set("Origin", getOrigin(request));
-  headers2.set("Cookie", extractNeonAuthCookies(request.headers));
-  headers2.set(NEON_AUTH_HEADER_MIDDLEWARE_NAME, "true");
-  return headers2;
-};
-var getOrigin = (request) => {
-  return request.headers.get("origin") || request.headers.get("referer")?.split("/").slice(0, 3).join("/") || new URL(request.url).origin;
-};
-var parseRequestBody = async (request) => {
-  if (request.body) return request.text();
-};
-var RESPONSE_HEADERS_ALLOWLIST = [
-  "content-type",
-  "content-encoding",
-  "date",
-  "set-cookie",
-  "set-auth-jwt",
-  "set-auth-token",
-  "x-neon-ret-request-id"
-];
-var handleAuthResponse = async (response, baseUrl, cookieConfig, log) => {
-  const responseHeaders = prepareResponseHeaders(response, cookieConfig);
-  const sessionDataCookie = await mintSessionDataFromResponse(response.headers, baseUrl, cookieConfig, log);
-  if (sessionDataCookie) responseHeaders.append("Set-Cookie", sessionDataCookie);
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers: responseHeaders
-  });
-};
-var prepareResponseHeaders = (response, cookieConfig) => {
-  const headers2 = new Headers();
-  const effectiveSameSite = cookieConfig.sameSite ?? "lax";
-  const { domain } = cookieConfig;
-  for (const header of RESPONSE_HEADERS_ALLOWLIST) if (header === "set-cookie") {
-    const cookies2 = response.headers.getSetCookie();
-    for (const cookieHeader of cookies2) {
-      const parsedCookies = parseSetCookies(cookieHeader);
-      for (const parsedCookie of parsedCookies) {
-        parsedCookie.partitioned = void 0;
-        parsedCookie.sameSite = effectiveSameSite;
-        parsedCookie.secure = true;
-        if (domain) parsedCookie.domain = domain;
-        headers2.append("Set-Cookie", serializeSetCookie(parsedCookie));
-      }
-    }
-  } else {
-    const value = response.headers.get(header);
-    if (value) headers2.set(header, value);
+    return null;
   }
-  return headers2;
 };
-function emit(log, level, message, meta) {
-  if (log) {
-    log[level](message, meta);
-    return;
+var kebab = (key) => key.replace(/[A-Z]/g, (letter) => `-${letter.toLowerCase()}`);
+function onSite(target, origin, fallback = `${origin}/`) {
+  if (!target) return fallback;
+  try {
+    const url = new URL(target, origin);
+    return url.origin === origin ? url.toString() : fallback;
+  } catch {
+    return fallback;
   }
-  if (meta && Object.keys(meta).length > 0) console[level](message, meta);
-  else console[level](message);
 }
-async function trySessionCache(request, baseUrl, cookieConfig, log) {
-  if (new URL(request.url).searchParams.get("disableCookieCache") === "true") return null;
-  const cookieHeader = request.headers.get("cookie") || "";
-  if (!cookieHeader.includes(NEON_AUTH_SESSION_COOKIE_NAME)) return null;
-  const hasSessionData = parseCookies(cookieHeader).has(NEON_AUTH_SESSION_DATA_COOKIE_NAME);
-  const mintAndReturn = async () => {
-    const sessionTokenCookie = extractSessionTokenCookie(cookieHeader);
-    if (!sessionTokenCookie) return null;
-    const sessionDataCookieString = await mintSessionDataFromToken(sessionTokenCookie, baseUrl, cookieConfig, log);
-    if (!sessionDataCookieString) return null;
-    try {
-      const sessionData = await fetchSessionWithCookie(sessionTokenCookie, baseUrl, log);
-      if (!sessionData.session) return null;
-      const response = Response.json(sessionData);
-      response.headers.set("Set-Cookie", sessionDataCookieString);
-      return response;
-    } catch (error) {
-      emit(log, "error", "[trySessionCache] Failed to fetch session after minting cookie:", { error: error instanceof Error ? error.message : String(error) });
-      return null;
-    }
+var within = (pathname, route) => pathname === route || pathname.startsWith(`${route.replace(/\/+$/, "")}/`);
+function withError(target, code) {
+  const url = new URL(target);
+  url.searchParams.set("error", code.toUpperCase());
+  return url.toString();
+}
+function redirect(location, cookies = []) {
+  const headers = new Headers({ location, "cache-control": "no-store" });
+  for (const cookie of cookies) headers.append("set-cookie", serialize(cookie));
+  return new Response(null, { status: 302, headers });
+}
+function relay(url) {
+  const back = new URL(url);
+  back.searchParams.delete("popup");
+  const target = JSON.stringify(back.pathname + back.search).replace(/</g, "\\u003c");
+  const html = `<!doctype html><meta charset="utf-8"><title>Signing in</title><p>You can close this window.</p><script>try{window.opener&&window.opener.postMessage({type:"webtwizz-auth:return",url:${target}},location.origin)}finally{window.close()}</script>`;
+  return new Response(html, { headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", "referrer-policy": "no-referrer" } });
+}
+var dated = (value) => typeof value === "string" ? new Date(value) : value;
+function withDates(data) {
+  return {
+    session: { ...data.session, expiresAt: dated(data.session.expiresAt), createdAt: dated(data.session.createdAt), updatedAt: dated(data.session.updatedAt) },
+    user: { ...data.user, createdAt: dated(data.user.createdAt), updatedAt: dated(data.user.updatedAt) }
   };
-  if (!hasSessionData) return await mintAndReturn();
+}
+var google = null;
+var warned = false;
+function googleOn() {
+  if (!google || Date.now() - google.at > 6e4) google = { at: Date.now(), on: readGoogle() };
+  return google.on;
+}
+async function readGoogle() {
+  const allow = (reason) => {
+    if (!warned) console.error(`[webtwizz-auth] Could not read whether Google sign-in is on (${reason}), so it is allowed`);
+    warned = true;
+    return true;
+  };
+  const url = process.env.DATABASE_URL;
+  if (!url) return allow("DATABASE_URL is not set");
+  let sql;
   try {
-    const sessionData = await getSessionDataFromCookie(request, NEON_AUTH_SESSION_DATA_COOKIE_NAME, cookieConfig.secret, log);
-    if (sessionData && sessionData.session) return Response.json(sessionData);
-    return await mintAndReturn();
+    const { default: postgres } = await import("postgres");
+    sql = postgres(url, { max: 1, prepare: false, connect_timeout: 5, idle_timeout: 1, onnotice: () => {
+    } });
+    const [row] = await sql`select social_providers from neon_auth.project_config limit 1`;
+    const providers = row?.social_providers;
+    if (!Array.isArray(providers)) return allow("unexpected setting");
+    const entry = providers.find((provider) => provider?.id === "google");
+    if (!entry) return false;
+    if (typeof entry.isShared !== "boolean") return allow("unexpected setting");
+    return !entry.isShared;
   } catch (error) {
-    const errorMessage = error instanceof Error ? error.message : String(error);
-    const errorName = error instanceof Error ? error.name : "Unknown";
-    if (errorName === "JWTExpired") emit(log, "debug", "[trySessionCache] Session cookie expired, minting new one:", {
-      error: errorMessage,
-      url: request.url
-    });
-    else if (errorName === "JWTInvalid" || errorName === "JWTClaimValidationFailed") emit(log, "warn", "[trySessionCache] Invalid session cookie, minting new one:", {
-      error: errorMessage,
-      url: request.url
-    });
-    else emit(log, "error", "[trySessionCache] Unexpected validation error:", {
-      error: errorMessage,
-      url: request.url
+    return allow(error?.code ?? "query failed");
+  } finally {
+    sql?.end({ timeout: 1 }).catch(() => {
     });
-    return await mintAndReturn();
   }
 }
-function extractSessionTokenCookie(cookieHeader) {
-  const sessionToken = parseCookies(cookieHeader).get(NEON_AUTH_SESSION_COOKIE_NAME);
-  if (!sessionToken) return null;
-  return `${NEON_AUTH_SESSION_COOKIE_NAME}=${sessionToken}`;
-}
-async function handleAuthProxyRequest(config) {
-  const { request, path, baseUrl, cookieSecret, sessionDataTtl, domain, sameSite } = config;
-  const log = resolveLog(config.log);
-  if (path === API_ENDPOINTS.getSession.path && request.method === API_ENDPOINTS.getSession.method) {
-    const cachedResponse = await trySessionCache(request, baseUrl, {
-      secret: cookieSecret,
-      sessionDataTtl,
-      domain,
-      sameSite
-    }, log);
-    if (cachedResponse) return cachedResponse;
-  }
-  return await handleAuthResponse(await handleAuthRequest(baseUrl, request, path, log), baseUrl, {
-    secret: cookieSecret,
-    sessionDataTtl,
-    domain,
-    sameSite
-  }, log);
-}
-function hasSessionChallengeCookie(cookies2) {
-  return cookies2.has(NEON_AUTH_SESSION_CHALLENGE_COOKIE_NAME) || cookies2.has(NEON_AUTH_LEGACY_SESSION_CHALLENGE_COOKIE_NAME);
-}
-function needsSessionVerification(request) {
-  const hasVerifier = new URL(request.url).searchParams.has(NEON_AUTH_SESSION_VERIFIER_PARAM_NAME);
-  const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) return false;
-  const cookies2 = parseCookies(cookieHeader);
-  return hasVerifier && hasSessionChallengeCookie(cookies2);
-}
-async function exchangeOAuthToken(request, baseUrl, cookieSecret, sessionDataTtl, domain, sameSite, log) {
-  const url = new URL(request.url);
-  const verifier = url.searchParams.get(NEON_AUTH_SESSION_VERIFIER_PARAM_NAME);
-  const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) return null;
-  const cookies2 = parseCookies(cookieHeader);
-  if (!verifier || !hasSessionChallengeCookie(cookies2)) return null;
-  const response = await handleAuthResponse(await handleAuthRequest(baseUrl, new Request(request.url, {
-    method: "GET",
-    headers: request.headers
-  }), "get-session", log), baseUrl, {
-    secret: cookieSecret,
-    sessionDataTtl,
-    domain,
-    sameSite
-  });
-  if (response.ok) {
-    const setCookieHeaders = response.headers.getSetCookie();
-    url.searchParams.delete(NEON_AUTH_SESSION_VERIFIER_PARAM_NAME);
-    return {
-      redirectUrl: url,
-      cookies: setCookieHeaders,
-      success: true
-    };
-  }
+async function refuse(path, body, from) {
+  if (HIDDEN.some((pattern) => pattern.test(path))) return NOT_FOUND;
+  if (from === "browser" && SERVER_ONLY.some((pattern) => pattern.test(path))) return NOT_FOUND;
+  if (from === "browser" && path === "email-otp/send-verification-otp" && body && !CODE_TYPES.has(String(body.type))) return NOT_FOUND;
+  if (SOCIAL.has(path) && (body?.provider !== "google" || !await googleOn())) return NO_PROVIDER;
   return null;
 }
-var DEFAULT_AUTH_SKIP_ROUTES = [
-  "/api/auth",
-  "/auth/callback",
-  "/auth/sign-in",
-  "/auth/sign-up",
-  "/auth/magic-link",
-  "/auth/email-otp",
-  "/auth/forgot-password"
-];
-function shouldProtectRoute(pathname, skipRoutes) {
-  return !skipRoutes.some((route) => isSamePathOrSubpath(pathname, route));
-}
-function isSamePathOrSubpath(pathname, routePathname) {
-  const normalizedRoutePathname = routePathname === "/" ? routePathname : routePathname.replace(/\/+$/, "");
-  if (pathname === normalizedRoutePathname) return true;
-  return normalizedRoutePathname !== "/" && pathname.startsWith(`${normalizedRoutePathname}/`);
-}
-function checkSessionRequired(pathname, skipRoutes, loginPathname, session) {
-  if (loginPathname !== null && isSamePathOrSubpath(pathname, loginPathname)) return {
-    allowed: true,
-    requiresRedirect: false
-  };
-  if (!shouldProtectRoute(pathname, skipRoutes)) return {
-    allowed: true,
-    requiresRedirect: false
-  };
-  if (!session || session.session === null) return {
-    allowed: false,
-    requiresRedirect: true
+function socialReturn(body, origin, mount, popup, referer) {
+  const start = onSite(referer, origin);
+  const back = (target, fallback) => {
+    const url = new URL(`${origin}${mount}/${RETURN}`);
+    url.searchParams.set("to", onSite(typeof target === "string" ? target : null, origin, fallback));
+    if (popup) url.searchParams.set("popup", "1");
+    return url.toString();
   };
   return {
-    allowed: true,
-    session,
-    requiresRedirect: false
+    ...body,
+    callbackURL: back(body.callbackURL, `${origin}/`),
+    errorCallbackURL: back(body.errorCallbackURL, start),
+    ...body.newUserCallbackURL ? { newUserCallbackURL: back(body.newUserCallbackURL, `${origin}/`) } : {}
   };
 }
-function stripBodyHeaders(headers2) {
-  const next = new Headers(headers2);
-  next.delete("content-type");
-  next.delete("content-length");
-  next.delete("transfer-encoding");
-  return next;
-}
-async function processAuthMiddleware(config) {
-  const log = config.log ?? resolveNeonAuthLogging({
-    logger: config.logger,
-    logLevel: config.logLevel
-  });
-  const { request, pathname, skipRoutes, loginUrl, baseUrl, cookieSecret, sessionDataTtl, domain, sameSite } = config;
-  const effectiveSameSite = sameSite ?? "lax";
-  const requestUrl = new URL(request.url);
-  const resolvedLoginUrl = new URL(loginUrl, requestUrl);
-  const sameOriginLoginPathname = resolvedLoginUrl.origin === requestUrl.origin ? resolvedLoginUrl.pathname : null;
-  if (sameOriginLoginPathname !== null && isSamePathOrSubpath(pathname, sameOriginLoginPathname)) return { action: "allow" };
-  if (needsSessionVerification(request)) {
-    const exchangeResult = await exchangeOAuthToken(request, baseUrl, cookieSecret, sessionDataTtl, domain, sameSite, log);
-    if (exchangeResult !== null) return {
-      action: "redirect_oauth",
-      redirectUrl: exchangeResult.redirectUrl,
-      cookies: exchangeResult.cookies
-    };
+async function forBrowser(response, mode) {
+  const headers = new Headers();
+  for (const name of PASSED) {
+    const value = response.headers.get(name);
+    if (value) headers.set(name, value);
   }
-  const cookieHeader = request.headers.get("cookie") || "";
-  const hasSessionToken = cookieHeader.includes(NEON_AUTH_SESSION_COOKIE_NAME);
-  const hasStaleSessionData = parseCookies(cookieHeader).has(NEON_AUTH_SESSION_DATA_COOKIE_NAME) && !hasSessionToken;
-  let sessionData = {
-    session: null,
-    user: null
+  const cookies = response.headers.getSetCookie().map((cookie) => fromUpstream(cookie, mode)).filter((cookie) => cookie !== null);
+  if (cookies.some((cookie) => cookie.name.endsWith(SESSION))) cookies.push(removal(CACHE, mode));
+  for (const cookie of cookies) headers.append("set-cookie", serialize(cookie));
+  if (EMPTY.has(response.status)) return new Response(null, { status: response.status, headers });
+  let body = await response.text();
+  if (!response.ok && /neon/i.test(body)) body = JSON.stringify({ code: parse(body)?.code ?? "UNKNOWN", message: "Something went wrong" });
+  return new Response(body, { status: response.status, statusText: response.statusText, headers });
+}
+function sessionResponse({ data, cookies, error }) {
+  const headers = new Headers({ "cache-control": "no-store" });
+  for (const cookie of cookies) headers.append("set-cookie", serialize(cookie));
+  if (error && error.status >= 500) return Response.json({ code: error.code, message: error.message }, { status: error.status, headers });
+  return Response.json(data, { headers });
+}
+function withCookies(response, cookies) {
+  for (const cookie of cookies) response.headers.append("set-cookie", serialize(cookie));
+  return response;
+}
+async function sendSignUpCode(config, request, origin, response) {
+  const data = parse(await response.clone().text());
+  const email = data?.user?.email;
+  if (!email || data.user?.emailVerified !== false || data.token) return;
+  const sent = await upstream(config, "email-otp/send-verification-otp", {
+    method: "POST",
+    origin,
+    visitor: visitorHeaders(request.headers),
+    contentType: "application/json",
+    body: JSON.stringify({ email, type: "email-verification" })
+  });
+  if (!sent?.ok) console.error("[webtwizz-auth] Could not send the sign-up code", sent?.status);
+}
+function createAuth(options = {}) {
+  const config = {
+    baseUrl: options.url ?? env("WEBTWIZZ_AUTH_URL"),
+    secret: options.secret ?? env("WEBTWIZZ_AUTH_SECRET"),
+    ttl: options.sessionDataTtl ?? 10
   };
-  let sessionCookies = [];
-  if (hasSessionToken) {
-    const sessionResponse = await handleAuthProxyRequest({
-      request: new Request(request.url, {
-        method: "GET",
-        headers: stripBodyHeaders(request.headers)
-      }),
-      path: "get-session",
-      baseUrl,
-      cookieSecret,
-      sessionDataTtl,
-      domain,
-      sameSite,
-      log
+  if (config.secret.length < 32) throw new Error("WEBTWIZZ_AUTH_SECRET must be at least 32 characters.");
+  if (!(config.ttl > 0)) throw new Error("sessionDataTtl must be a positive number of seconds.");
+  async function finishSocial(request, url, mode, origin) {
+    const to = onSite(url.searchParams.get("to"), origin);
+    const failed = url.searchParams.get("error");
+    const verifier = url.searchParams.get(VERIFIER);
+    if (failed || !verifier) return redirect(withError(to, failed ?? "sign_in_failed"));
+    if (url.searchParams.get("popup") === "1") return relay(url);
+    const { data, cookies } = await resolveSession(config, {
+      cookieHeader: request.headers.get("cookie"),
+      headers: request.headers,
+      origin,
+      mode,
+      fresh: true,
+      search: new URLSearchParams({ [VERIFIER]: verifier })
     });
-    if (sessionResponse.ok) {
-      const data = await sessionResponse.json().catch((error) => {
-        log.debug("[webtwizz-auth] Failed to parse session response JSON", {
-          component: "middleware",
-          detail: error instanceof Error ? error.message : String(error)
-        });
-        return null;
-      });
-      if (data) sessionData = data;
-    }
-    sessionCookies = sessionResponse.headers.getSetCookie();
+    return redirect(data ? to : withError(to, "sign_in_failed"), cookies);
   }
-  if (checkSessionRequired(pathname, skipRoutes, sameOriginLoginPathname, sessionData).allowed) return {
-    action: "allow",
-    headers: { [NEON_AUTH_HEADER_MIDDLEWARE_NAME]: "true" },
-    cookies: sessionCookies
-  };
-  const cookies2 = [];
-  if (hasStaleSessionData) cookies2.push(serializeSetCookie({
-    name: NEON_AUTH_SESSION_DATA_COOKIE_NAME,
-    value: "",
-    path: "/",
-    domain,
-    httpOnly: true,
-    secure: true,
-    sameSite: effectiveSameSite,
-    maxAge: 0
-  }));
-  if (resolvedLoginUrl.origin === requestUrl.origin) {
-    const configuredLoginParamNames = new Set(resolvedLoginUrl.searchParams.keys());
-    for (const [name, value] of requestUrl.searchParams) if (!configuredLoginParamNames.has(name)) resolvedLoginUrl.searchParams.append(name, value);
-  }
-  return {
-    action: "redirect_login",
-    redirectUrl: resolvedLoginUrl,
-    cookies: cookies2.length > 0 ? cookies2 : void 0
-  };
-}
-
-// src/next-headers.ts
-import { cookies as nextCookies, headers as nextHeaders } from "next/headers";
-
-// src/cookies.ts
-var OURS = "__Secure-webtwizz-auth.";
-var THEIRS = "__Secure-neon-auth.";
-var toTheirs = (name) => name.startsWith(OURS) ? THEIRS + name.slice(OURS.length) : name;
-var toOurs = (name) => name.startsWith(THEIRS) ? OURS + name.slice(THEIRS.length) : name;
-function cookieHeaderToTheirs(header) {
-  if (!header || !header.includes(OURS)) return header;
-  return header.split(/;\s*/).map((pair) => {
-    const at = pair.indexOf("=");
-    return at < 0 ? pair : toTheirs(pair.slice(0, at)) + pair.slice(at);
-  }).join("; ");
-}
-function setCookieToOurs(value) {
-  const at = value.indexOf("=");
-  return at < 0 ? value : toOurs(value.slice(0, at)) + value.slice(at);
-}
-
-// src/next-headers.ts
-function delegate(target, overrides) {
-  return new Proxy(target, {
-    get(store, key) {
-      if (typeof key === "string" && key in overrides) return overrides[key];
-      const value = Reflect.get(store, key, store);
-      return typeof value === "function" ? value.bind(store) : value;
+  const route = async (request, context) => {
+    const segments = (await context.params).path ?? [];
+    if (!segments.length || segments.some((segment) => !segment || segment === "." || segment === ".." || /[\\/]/.test(segment))) {
+      return Response.json(NOT_FOUND, { status: 404 });
     }
-  });
-}
-async function headers() {
-  const store = await nextHeaders();
-  return delegate(store, {
-    get: (name) => name.toLowerCase() === "cookie" ? cookieHeaderToTheirs(store.get(name)) : store.get(name)
-  });
-}
-async function cookies() {
-  const store = await nextCookies();
-  const rename = (args) => {
-    const [first, ...rest] = args;
-    if (typeof first === "string") return [toOurs(first), ...rest];
-    if (first && typeof first === "object" && "name" in first) return [{ ...first, name: toOurs(String(first.name)) }, ...rest];
-    return args;
-  };
-  return delegate(store, {
-    set: (...args) => store.set(...rename(args)),
-    delete: (...args) => store.delete(...rename(args))
-  });
-}
-
-// node_modules/@neondatabase/auth/dist/next/server/index.mjs
-import { NextRequest, NextResponse } from "next/server";
-async function createNextRequestContext() {
-  const cookieStore = await cookies();
-  const headerStore = await headers();
-  return {
-    getCookies() {
-      return extractNeonAuthCookies(headerStore);
-    },
-    setCookie(name, value, options) {
-      cookieStore.set(name, value, options);
-    },
-    getHeader(name) {
-      return headerStore.get(name) ?? null;
-    },
-    getOrigin() {
-      return headerStore.get("origin") || headerStore.get("referer")?.split("/").slice(0, 3).join("/") || "";
-    },
-    getFramework() {
-      return "nextjs";
+    const path = segments.join("/").toLowerCase();
+    const url = new URL(request.url);
+    const mode = cookieMode(request.url, request.headers);
+    const origin = siteOrigin(request.url, request.headers);
+    if (path === RETURN && request.method === "GET") return finishSocial(request, url, mode, origin);
+    const text = request.method === "GET" || request.method === "HEAD" ? void 0 : await request.text();
+    const body = parse(text);
+    const refusal = await refuse(path, body, "browser");
+    if (refusal) return Response.json(refusal, { status: 404 });
+    if (path === "get-session" && request.method === "GET") {
+      return sessionResponse(await resolveSession(config, {
+        cookieHeader: request.headers.get("cookie"),
+        headers: request.headers,
+        origin,
+        mode,
+        fresh: url.searchParams.get("disableCookieCache") === "true",
+        search: url.searchParams
+      }));
     }
-  };
-}
-function authApiHandler(config) {
-  const { baseUrl, cookies: cookies$1 } = config;
-  validateCookieConfig(cookies$1);
-  const log = resolveNeonAuthLogging(config);
-  const handler = async (request, { params }) => {
-    return handleAuthProxyRequest({
-      request,
-      path: (await params).path.join("/"),
-      baseUrl,
-      cookieSecret: cookies$1.secret,
-      sessionDataTtl: cookies$1.sessionDataTtl,
-      domain: cookies$1.domain,
-      sameSite: cookies$1.sameSite,
-      log
+    let sent = text;
+    if (SOCIAL.has(path) && body) {
+      const mount = url.pathname.split("/").slice(0, -segments.length).join("/");
+      sent = JSON.stringify(socialReturn(body, origin, mount, mode.framed, request.headers.get("referer")));
+    }
+    const response = await upstream(config, segments.map(encodeURIComponent).join("/"), {
+      method: request.method,
+      search: url.search,
+      cookie: upstreamCookies(readCookies(request.headers.get("cookie"), mode)),
+      visitor: visitorHeaders(request.headers),
+      origin,
+      body: sent,
+      contentType: request.headers.get("content-type")
     });
+    if (!response) return Response.json({ code: unreachable.code, message: unreachable.message }, { status: 502 });
+    if (path === "sign-up/email" && response.ok) await sendSignUpCode(config, request, origin, response);
+    return forBrowser(response, mode);
   };
-  return {
-    GET: handler,
-    POST: handler,
-    PUT: handler,
-    DELETE: handler,
-    PATCH: handler
-  };
-}
-var SKIP_ROUTES = DEFAULT_AUTH_SKIP_ROUTES;
-function neonAuthMiddleware(config) {
-  const { baseUrl, cookies: cookies$1, loginUrl = "/auth/sign-in", log, logger, logLevel } = config;
-  validateCookieConfig(cookies$1);
-  return async (request) => {
-    const pathname = request.nextUrl.pathname;
-    const result = await processAuthMiddleware({
-      request,
-      pathname,
-      skipRoutes: SKIP_ROUTES,
-      loginUrl,
-      baseUrl,
-      cookieSecret: cookies$1.secret,
-      sessionDataTtl: cookies$1.sessionDataTtl,
-      domain: cookies$1.domain,
-      sameSite: cookies$1.sameSite,
-      log,
-      logger,
-      logLevel
+  const lookups = cache(() => /* @__PURE__ */ new Map());
+  async function getSession(input = {}) {
+    const scope = await requestScope();
+    const site = `http://${scope.headers.get("host") ?? "localhost"}/`;
+    const mode = cookieMode(site, scope.headers);
+    const query = input?.query ?? {};
+    const fresh = query.disableCookieCache === true || query.disableCookieCache === "true";
+    const search = new URLSearchParams(Object.entries(query).filter(([key2, value]) => key2 !== "disableCookieCache" && value !== void 0).map(([key2, value]) => [key2, String(value)]));
+    const key = `${fresh}|${search}|${scope.cookieHeader}`;
+    const memo = lookups();
+    let pending = memo.get(key);
+    if (!pending) {
+      pending = resolveSession(config, { cookieHeader: scope.cookieHeader, headers: scope.headers, origin: siteOrigin(site, scope.headers), mode, fresh, search });
+      memo.set(key, pending);
+      for (const cookie of (await pending).cookies) scope.setCookie(cookie);
+    }
+    const { data, error } = await pending;
+    return { data: data ? withDates(data) : null, error: data ? null : error };
+  }
+  async function call(path, input = {}) {
+    const { query, fetchOptions: _fetchOptions, ...rest } = input ?? {};
+    const refusal = await refuse(path, rest, "server");
+    if (refusal) return { data: null, error: { ...refusal, status: 404, statusText: "Not Found" } };
+    const scope = await requestScope();
+    const site = `http://${scope.headers.get("host") ?? "localhost"}/`;
+    const mode = cookieMode(site, scope.headers);
+    const method = GETS.has(path) ? "GET" : "POST";
+    const origin = siteOrigin(site, scope.headers);
+    const search = query && typeof query === "object" ? `?${new URLSearchParams(Object.entries(query).map(([key, value]) => [key, String(value)]))}` : "";
+    const body = SOCIAL.has(path) ? socialReturn(rest, origin, "/api/auth", false, scope.headers.get("referer")) : rest;
+    const response = await upstream(config, path, {
+      method,
+      search,
+      cookie: upstreamCookies(readCookies(scope.cookieHeader, mode)),
+      visitor: visitorHeaders(scope.headers),
+      origin,
+      body: method === "POST" ? JSON.stringify(body) : void 0,
+      contentType: method === "POST" ? "application/json" : null
     });
-    switch (result.action) {
-      case "allow": {
-        const headers$1 = new Headers(request.headers);
-        if (result.headers) for (const [key, value] of Object.entries(result.headers)) headers$1.set(key, value);
-        const response = NextResponse.next({ request: { headers: headers$1 } });
-        if (result.cookies) for (const cookie of result.cookies) response.headers.append("Set-Cookie", cookie);
-        return response;
-      }
-      case "redirect_oauth": {
-        const oauthHeaders = new Headers();
-        for (const cookie of result.cookies) oauthHeaders.append("Set-Cookie", cookie);
-        return NextResponse.redirect(result.redirectUrl, { headers: oauthHeaders });
-      }
-      case "redirect_login":
-        if (result.cookies && result.cookies.length > 0) {
-          const loginHeaders = new Headers();
-          for (const cookie of result.cookies) loginHeaders.append("Set-Cookie", cookie);
-          return NextResponse.redirect(result.redirectUrl, { headers: loginHeaders });
-        }
-        return NextResponse.redirect(result.redirectUrl);
+    if (!response) return { data: null, error: unreachable };
+    const cookies = response.headers.getSetCookie().map((cookie) => fromUpstream(cookie, mode)).filter((cookie) => cookie !== null);
+    if (cookies.some((cookie) => cookie.name.endsWith(SESSION))) cookies.push(removal(CACHE, mode));
+    for (const cookie of cookies) scope.setCookie(cookie);
+    const json = parse(await response.text());
+    if (!response.ok) {
+      const message = String(json?.message ?? json?.error ?? response.statusText);
+      return { data: null, error: { message: /neon/i.test(message) ? "Something went wrong" : message, status: response.status, statusText: response.statusText, code: String(json?.code ?? "UNKNOWN") } };
     }
-  };
-}
-function createNeonAuth(config) {
-  const { baseUrl, cookies: cookies$1 } = config;
-  validateCookieConfig(cookies$1);
-  const log = resolveNeonAuthLogging(config);
-  const server = createAuthServer({
-    baseUrl,
-    context: createNextRequestContext,
-    cookieSecret: cookies$1.secret,
-    sessionDataTtl: cookies$1.sessionDataTtl,
-    domain: cookies$1.domain,
-    sameSite: cookies$1.sameSite,
-    log
-  });
-  server.handler = () => authApiHandler(config);
-  server.middleware = (middlewareConfig) => neonAuthMiddleware({
-    ...config,
-    ...middlewareConfig,
-    log
+    return { data: json, error: null };
+  }
+  const api = (path) => new Proxy(() => {
+  }, {
+    get: (_, key) => typeof key === "string" && key !== "then" ? api([...path, kebab(key)]) : void 0,
+    apply: (_, __, [input]) => call(path.join("/"), input)
   });
-  return server;
-}
-
-// src/server.ts
-import { NextRequest as NextRequest2 } from "next/server";
-var PROVIDER_HEADER = /^x-neon-/i;
-function forLibrary(request, make) {
-  const cookie = request.headers.get("cookie");
-  const translated = cookieHeaderToTheirs(cookie);
-  if (translated === cookie) return request;
-  const headers2 = new Headers(request.headers);
-  headers2.set("cookie", translated);
-  return make(request, headers2);
-}
-function forBrowser(response) {
-  const provider = [...response.headers.keys()].filter((name) => PROVIDER_HEADER.test(name));
-  const cookies2 = response.headers.getSetCookie();
-  const rename = cookies2.some((cookie) => cookie.startsWith(THEIRS));
-  if (!provider.length && !rename) return response;
-  const apply = (headers2) => {
-    for (const name of provider) headers2.delete(name);
-    if (rename) {
-      headers2.delete("set-cookie");
-      for (const cookie of cookies2) headers2.append("set-cookie", setCookieToOurs(cookie));
+  const auth = {
+    getSession,
+    handler: () => ({ GET: route, POST: route, PUT: route, DELETE: route, PATCH: route }),
+    middleware: ({ loginUrl = "/auth/sign-in" } = {}) => async (request) => {
+      const url = new URL(request.url);
+      const mode = cookieMode(request.url, request.headers);
+      const origin = siteOrigin(request.url, request.headers);
+      const login = new URL(loginUrl, request.url);
+      const local = login.origin === url.origin;
+      if (local && within(url.pathname, login.pathname) || within(url.pathname, "/api/auth")) return NextResponse.next();
+      const lookup = { cookieHeader: request.headers.get("cookie"), headers: request.headers, origin, mode };
+      const verifier = url.searchParams.get(VERIFIER);
+      if (verifier) {
+        const { cookies: cookies2 } = await resolveSession(config, { ...lookup, fresh: true, search: new URLSearchParams({ [VERIFIER]: verifier }) });
+        url.searchParams.delete(VERIFIER);
+        return withCookies(NextResponse.redirect(url), cookies2);
+      }
+      const { data, cookies } = await resolveSession(config, lookup);
+      if (data) {
+        if (!cookies.length) return NextResponse.next();
+        const headers = new Headers(request.headers);
+        headers.set("cookie", applyToHeader(request.headers.get("cookie"), cookies));
+        return withCookies(NextResponse.next({ request: { headers } }), cookies);
+      }
+      if (local) {
+        for (const [name, value] of url.searchParams) if (!login.searchParams.has(name)) login.searchParams.append(name, value);
+      }
+      return withCookies(NextResponse.redirect(login), cookies);
     }
   };
-  try {
-    apply(response.headers);
-    return response;
-  } catch {
-    const headers2 = new Headers(response.headers);
-    apply(headers2);
-    return new Response(response.body, { status: response.status, statusText: response.statusText, headers: headers2 });
-  }
-}
-async function sendSignUpCode(baseUrl, request, response) {
-  const data = await response.clone().json().catch(() => null);
-  const email = data?.user?.email;
-  if (!email || data.user.emailVerified !== false || data.token) return;
-  await fetch(`${baseUrl.replace(/\/+$/, "")}/email-otp/send-verification-otp`, {
-    method: "POST",
-    headers: { "content-type": "application/json", origin: request.headers.get("origin") || new URL(request.url).origin },
-    body: JSON.stringify({ email, type: "email-verification" })
-  }).catch((error) => console.error("[webtwizz-auth] Could not send the sign-up code", error));
-}
-function createAuth(options = {}) {
-  const baseUrl = options.url ?? env("WEBTWIZZ_AUTH_URL");
-  const auth = createNeonAuth({
-    baseUrl,
-    cookies: {
-      secret: options.secret ?? env("WEBTWIZZ_AUTH_SECRET"),
-      sessionDataTtl: options.sessionDataTtl
-    }
+  return new Proxy(auth, {
+    get: (target, key) => key in target ? target[key] : typeof key === "string" && key !== "then" ? api([kebab(key)]) : void 0
   });
-  const handler = auth.handler.bind(auth);
-  const middleware = auth.middleware.bind(auth);
-  auth.handler = () => {
-    const methods = handler();
-    const wrap = (method) => async (request, context) => forBrowser(await method(forLibrary(request, (original, headers2) => new Request(original, { headers: headers2 })), context));
-    const post = wrap(methods.POST);
-    const signUp = async (request, context) => {
-      const response = await post(request, context);
-      const { path } = await context.params;
-      if (response.ok && path?.join("/") === "sign-up/email") await sendSignUpCode(baseUrl, request, response);
-      return response;
-    };
-    return { GET: wrap(methods.GET), POST: signUp, PUT: wrap(methods.PUT), DELETE: wrap(methods.DELETE), PATCH: wrap(methods.PATCH) };
-  };
-  auth.middleware = (config) => {
-    const run = middleware(config);
-    return async (request) => forBrowser(await run(forLibrary(request, (original, headers2) => new NextRequest2(original, { headers: headers2 }))));
-  };
-  return auth;
 }
 export {
-  createAuth,
-  forBrowser
+  createAuth
 };