faire-auth 1.0.0

package/dist/api-_B7qO28y.mjs

@@ -0,0 +1,1892 @@
+import { t as contextStorage } from "./hono-CoKYWnXA.mjs";
+import { r as runWithTransaction, t as getIp } from "./ip-BjNYspCH.mjs";
+import { n as crypto_exports } from "./crypto-CyQRFtkq.mjs";
+import { t as safeJSONParse } from "./json-B1v2qRTQ.mjs";
+import { n as cookies_exports, o as deleteSessionCookie, y as setSessionCookie } from "./cookies-Ch1JfQIz.mjs";
+import { r as createMiddleware } from "./middleware-CE6OhDkq.mjs";
+import { _ as initContextMiddleware, a as requestOnlySessionMiddleware, c as revokeSessions, d as createAPI, f as createEndpoint, g as initHooksMiddleware, h as initErrorHandler, i as listSessions, l as sensitiveSessionMiddleware, m as setDefaultExecutionCtx, n as getSession, o as revokeOtherSessions, p as setRenderer, s as revokeSession, t as freshSessionMiddleware, u as sessionMiddleware } from "./session-rH8ougDl.mjs";
+import { n as originCheck, r as wildcardMatch, t as initOriginCheckMiddleware } from "./origin-check-8Gajklvh.mjs";
+import { n as sendVerificationEmail, r as verifyEmail, t as createEmailVerificationToken } from "./email-verification-CWhj2qfb.mjs";
+import { n as decryptOAuthToken, r as setTokenUtil, t as handleOAuthUserInfo } from "./oauth2-B8M0lW9l.mjs";
+import { n as parseState, t as generateState } from "./state-CqJfCIl9.mjs";
+import { t as social_providers_exports } from "./social-providers-DoYJhBe3.mjs";
+import { r as generateId } from "./utils-D4vZd1-9.mjs";
+import { c as parseUserInput } from "./schema-DTIwLLmf.mjs";
+import { isDevelopment } from "@faire-auth/core/env";
+import { BASE_ERROR_CODES } from "@faire-auth/core/error";
+import { OpenAPIHono, callbackURLSchema, createRoute, emailSchema, nameSchema, passwordSchema, req, res } from "@faire-auth/core/factory";
+import { Definitions, False, Routes, SCHEMAS, True, isPromise } from "@faire-auth/core/static";
+import { buildSchemas, getDate } from "@faire-auth/core/utils";
+import { Hono } from "hono";
+import { RegExpRouter } from "hono/router/reg-exp-router";
+import * as z$1 from "zod";
+import { looseUserSchema } from "@faire-auth/core/db";
+
+//#region src/api/schema/account.ts
+const socialProviderListEnum = z$1.enum(social_providers_exports.socialProviderList).or(z$1.string());
+const linkAccountSchema = z$1.object({
+	callbackURL: callbackURLSchema(true).openapi({ description: "The URL to redirect to after the user has signed in" }),
+	provider: socialProviderListEnum,
+	idToken: z$1.object({
+		token: z$1.string(),
+		nonce: z$1.string().optional(),
+		accessToken: z$1.string().optional(),
+		refreshToken: z$1.string().optional(),
+		scopes: z$1.array(z$1.string().min(1)).optional()
+	}).optional(),
+	scopes: z$1.array(z$1.string().min(1)).optional().openapi({ description: "Additional scopes to request when linking the account" }),
+	errorCallbackURL: callbackURLSchema(true).openapi({ description: "The URL to redirect to if there is an error during the link process" })
+});
+const unlinkAccountSchema = z$1.object({
+	providerId: z$1.string(),
+	accountId: z$1.string().optional()
+});
+const getAccessTokenSchema = z$1.object({
+	providerId: z$1.string().openapi({ description: "The provider ID for the OAuth provider" }),
+	accountId: z$1.string().optional().openapi({ description: "The account ID associated with the refresh token" }),
+	userId: z$1.string().optional().openapi({ description: "The user ID associated with the account" })
+});
+const refreshAccessTokenSchema = z$1.object({
+	providerId: z$1.string().openapi({ description: "The provider ID for the OAuth provider" }),
+	accountId: z$1.string().optional().openapi({ description: "The account ID associated with the refresh token" }),
+	userId: z$1.string().optional().openapi({ description: "The user ID associated with the account" })
+});
+const getAccountInfoSchema = z$1.object({ accountId: z$1.string().openapi({ description: "The provider given account id for which to get the account info" }) });
+
+//#endregion
+//#region src/api/schema/sign-in.ts
+const signInSocialSchema = z$1.object({
+	callbackURL: callbackURLSchema(true).openapi({ description: "Callback URL to redirect to after the user has signed in" }),
+	newUserCallbackURL: callbackURLSchema(true),
+	errorCallbackURL: callbackURLSchema(true).openapi({ description: "Callback URL to redirect to if an error happens" }),
+	provider: socialProviderListEnum,
+	disableRedirect: z$1.boolean().optional().openapi({ description: "Disable automatic redirection to the provider. Useful for handling the redirection yourself" }),
+	idToken: z$1.optional(z$1.object({
+		token: z$1.string().openapi({ description: "ID token from the provider" }),
+		nonce: z$1.string().optional().openapi({ description: "Nonce used to generate the token" }),
+		accessToken: z$1.string().optional().openapi({ description: "Access token from the provider" }),
+		refreshToken: z$1.string().optional().openapi({ description: "Refresh token from the provider" }),
+		expiresAt: z$1.number().optional().openapi({ description: "Expiry date of the token" })
+	})).openapi({ description: "ID token from the provider to sign in the user with id token" }),
+	scopes: z$1.array(z$1.string().min(1)).optional().openapi({ description: "Array of scopes to request from the provider. This will override the default scopes passed." }),
+	requestSignUp: z$1.boolean().optional().openapi({ description: "Explicitly request sign-up. Useful when disableImplicitSignUp is true for this provider" }),
+	loginHint: z$1.string().optional().openapi({ description: "The login hint to use for the authorization code request" })
+});
+const signInEmailSchema = z$1.object({
+	email: emailSchema.openapi({ description: "Email of the user" }),
+	password: passwordSchema.openapi({ description: "Password of the user" }),
+	callbackURL: callbackURLSchema(true).openapi({ description: "Callback URL to use as a redirect for email verification" }),
+	rememberMe: z$1.boolean().default(true).openapi({ description: "If this is false, the session will not be remembered. Default is `true`." })
+});
+
+//#endregion
+//#region src/api/routes/sign-in.ts
+const signInSocialRoute = createRoute({
+	operationId: Routes.SIGN_IN_SOCIAL,
+	method: "post",
+	path: "/sign-in/social",
+	description: "Sign in with a social provider",
+	request: req().bdy(signInSocialSchema).bld(),
+	responses: res(SCHEMAS[Definitions.SIGN_IN_UP].default, "Returns either session details or redirect URL").rdr().err(401, "Invalid token or user not found").err(404, "Provider or id token not supported").zod().bld()
+});
+const signInSocial = createEndpoint(signInSocialRoute, (options) => async (ctx) => {
+	const { provider: requestedProvider, idToken, requestSignUp, callbackURL, scopes, loginHint, disableRedirect } = ctx.req.valid("json");
+	const context = ctx.get("context");
+	const provider = context.socialProviders.find((p) => p.id === requestedProvider);
+	if (!provider) {
+		context.logger.error("Provider not found. Make sure to add the provider in your auth config", { provider: requestedProvider });
+		return ctx.render({
+			success: False,
+			message: BASE_ERROR_CODES.PROVIDER_NOT_FOUND
+		}, 404);
+	}
+	if (idToken) {
+		if (!provider.verifyIdToken) {
+			context.logger.error("Provider does not support id token verification", { provider: requestedProvider });
+			return ctx.render({
+				success: False,
+				message: BASE_ERROR_CODES.ID_TOKEN_NOT_SUPPORTED
+			}, 404);
+		}
+		const { token, nonce } = idToken;
+		if (!await provider.verifyIdToken(token, nonce)) {
+			context.logger.error("Invalid id token", { provider: requestedProvider });
+			return ctx.render({
+				success: False,
+				message: BASE_ERROR_CODES.INVALID_TOKEN
+			}, 401);
+		}
+		const userInfo = await provider.getUserInfo({
+			idToken: token,
+			...idToken.accessToken != null && { accessToken: idToken.accessToken },
+			...idToken.refreshToken != null && { refreshToken: idToken.refreshToken }
+		});
+		if (!userInfo?.user) {
+			context.logger.error("Failed to get user info", { provider: requestedProvider });
+			return ctx.render({
+				success: False,
+				message: BASE_ERROR_CODES.FAILED_TO_GET_USER_INFO
+			}, 401);
+		}
+		if (userInfo.user.email == null) {
+			context.logger.error("User email not found", { provider: requestedProvider });
+			return ctx.render({
+				success: False,
+				message: BASE_ERROR_CODES.USER_EMAIL_NOT_FOUND
+			}, 401);
+		}
+		const data = await handleOAuthUserInfo(ctx, {
+			userInfo: {
+				...userInfo.user,
+				email: userInfo.user.email,
+				id: userInfo.user.id.toString(),
+				...userInfo.user.name && { name: userInfo.user.name },
+				...userInfo.user.image && { image: userInfo.user.image },
+				emailVerified: userInfo.user.emailVerified
+			},
+			account: {
+				providerId: provider.id,
+				accountId: userInfo.user.id.toString(),
+				...idToken.accessToken && { accessToken: idToken.accessToken }
+			},
+			...callbackURL && { callbackURL },
+			disableSignUp: provider.disableImplicitSignUp === true && requestSignUp !== true || provider.disableSignUp === true
+		}, options);
+		if (data.type === "redirect") return data.response;
+		if (data.type === "error") return ctx.render({
+			success: False,
+			message: data.reason.replaceAll("_", " ")
+		}, 401);
+		await setSessionCookie(ctx, options, data.data);
+		return ctx.render({
+			success: True,
+			redirect: False,
+			token: data.data.session.token,
+			user: data.data.user
+		}, 200);
+	}
+	const { codeVerifier, state } = await generateState(ctx, void 0, options);
+	const url = await provider.createAuthorizationURL({
+		state,
+		codeVerifier,
+		redirectURI: `${context.baseURL}/callback/${provider.id}`,
+		...scopes && scopes.length > 0 && { scopes },
+		...loginHint != null && loginHint !== "" && { loginHint }
+	});
+	if (disableRedirect === true) return ctx.render({
+		success: False,
+		redirect: False
+	}, 200);
+	return ctx.render({
+		success: False,
+		redirect: True,
+		url: url.toString()
+	}, 200);
+});
+const signInEmailRoute = createRoute({
+	operationId: Routes.SIGN_IN_EMAIL,
+	method: "post",
+	path: "/sign-in/email",
+	description: "Sign in with email and password",
+	request: req().bdy(signInEmailSchema).bld(),
+	responses: res(SCHEMAS[Definitions.SIGN_IN_UP].default, "Returns either session details or redirect URL").err(400, "Email and password login not enabled in options").err(401, "Invalid email or password").err(403, "Email not verified").zod().err(500, "Failed to create session").bld()
+});
+const signInEmail = createEndpoint(signInEmailRoute, (options) => async (ctx) => {
+	const context = ctx.get("context");
+	if (!(options.emailAndPassword?.enabled ?? false)) {
+		context.logger.error("Email and password is not enabled. Make sure to enable it in the options on you `auth.ts` file. Check `https://faire-auth.com/docs/authentication/email-password` for more!");
+		return ctx.render({
+			success: False,
+			message: "Email and password is not enabled"
+		}, 400);
+	}
+	const { email, password, rememberMe, callbackURL } = ctx.req.valid("json");
+	const user = await context.internalAdapter.findUserByEmail(email, { includeAccounts: true });
+	if (!user) {
+		await context.password.hash(password);
+		context.logger.error("User not found", { email });
+		return ctx.render({
+			success: False,
+			message: BASE_ERROR_CODES.INVALID_EMAIL_OR_PASSWORD
+		}, 401);
+	}
+	const credentialAccount = user.accounts.find((a) => a.providerId === "credential");
+	if (!credentialAccount) {
+		context.logger.error("Credential account not found", { email });
+		return ctx.render({
+			success: False,
+			message: BASE_ERROR_CODES.INVALID_EMAIL_OR_PASSWORD
+		}, 401);
+	}
+	const currentPassword = credentialAccount.password;
+	if (currentPassword == null) {
+		context.logger.error("Password not found", { email });
+		return ctx.render({
+			success: False,
+			message: BASE_ERROR_CODES.INVALID_EMAIL_OR_PASSWORD
+		}, 401);
+	}
+	if (!await context.password.verify({
+		hash: currentPassword,
+		password
+	})) {
+		context.logger.error("Invalid password");
+		return ctx.render({
+			success: False,
+			message: BASE_ERROR_CODES.INVALID_EMAIL_OR_PASSWORD
+		}, 401);
+	}
+	if (options.emailAndPassword?.requireEmailVerification === true && !user.user.emailVerified) {
+		if (!options.emailVerification?.sendVerificationEmail) return ctx.render({
+			success: False,
+			message: BASE_ERROR_CODES.EMAIL_NOT_VERIFIED
+		}, 403);
+		const token = await createEmailVerificationToken(context.secret, user.user.email, void 0, options.emailVerification.expiresIn);
+		const url = `${context.baseURL}/verify-email?token=${token}&callbackURL=${callbackURL ?? "/"}`;
+		await options.emailVerification.sendVerificationEmail({
+			user: user.user,
+			url,
+			token
+		}, ctx);
+		return ctx.render({
+			success: False,
+			message: BASE_ERROR_CODES.EMAIL_NOT_VERIFIED
+		}, 403);
+	}
+	const session = await context.internalAdapter.createSession(user.user.id, !rememberMe);
+	if (session == null) {
+		context.logger.error("Failed to create session");
+		return ctx.render({
+			success: False,
+			message: BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION
+		}, 500);
+	}
+	await setSessionCookie(ctx, options, {
+		session,
+		user: user.user
+	}, !rememberMe);
+	if (callbackURL != null) return ctx.render({
+		success: True,
+		redirect: True,
+		url: callbackURL,
+		token: session.token,
+		user: user.user
+	}, 200);
+	return ctx.render({
+		success: True,
+		redirect: False,
+		token: session.token,
+		user: user.user
+	}, 200);
+});
+
+//#endregion
+//#region src/api/schema/callback.ts
+const callbackSchema = z$1.object({
+	code: z$1.string(),
+	error: z$1.string(),
+	device_id: z$1.string(),
+	error_description: z$1.string(),
+	state: z$1.string(),
+	user: z$1.string()
+}).partial();
+const oauthCallbackParamsSchema = z$1.object({ id: z$1.string().openapi({
+	param: {
+		name: "id",
+		in: "path"
+	},
+	description: "OAuth provider ID"
+}) });
+const oauthCallbackQuerySchema = callbackSchema;
+
+//#endregion
+//#region src/api/routes/callback.ts
+const handleCallbackOAuth = async (ctx, paramsId, { code, error: error$1, device_id, error_description, state, user } = {}, options) => {
+	const context = ctx.get("context");
+	const defaultErrorURL = options.onAPIError?.errorURL ?? `${context.baseURL}/error`;
+	if (error$1 != null) return ctx.redirect(`${defaultErrorURL}?error=${error$1}&error_description=${error_description}`, 302);
+	if (state == null) {
+		context.logger.error("State not found", error$1);
+		return ctx.redirect(`${defaultErrorURL}?error=state_not_found`, 302);
+	}
+	const res$1 = await parseState(ctx, options);
+	if (res$1.type === "redirect") return res$1.response;
+	const { codeVerifier, callbackURL, link, errorURL, newUserURL, requestSignUp } = res$1.data;
+	const redirectOnError = (error$2) => {
+		let url = errorURL ?? defaultErrorURL;
+		if (url.includes("?")) url = `${url}&error=${error$2}`;
+		else url = `${url}?error=${error$2}`;
+		return ctx.redirect(url, 302);
+	};
+	if (code == null) {
+		context.logger.error("Code not found");
+		return redirectOnError("no_code");
+	}
+	const provider = context.socialProviders.find((p) => p.id === paramsId);
+	if (!provider) {
+		context.logger.error("Oauth provider with id", paramsId, "not found");
+		return redirectOnError("oauth_provider_not_found");
+	}
+	let tokens;
+	try {
+		tokens = await provider.validateAuthorizationCode({
+			code,
+			codeVerifier,
+			...device_id != null ? { deviceId: device_id } : {},
+			redirectURI: `${context.baseURL}/callback/${provider.id}`
+		});
+	} catch (e) {
+		context.logger.error("", e);
+		return redirectOnError("invalid_code");
+	}
+	const userInfo = await provider.getUserInfo({
+		...tokens,
+		...user && { user: safeJSONParse(user) }
+	}).then((res$2) => res$2?.user);
+	if (!userInfo) {
+		context.logger.error("Unable to get user info");
+		return redirectOnError("unable_to_get_user_info");
+	}
+	if (!callbackURL) {
+		context.logger.error("No callback URL found");
+		return redirectOnError("no_callback_url");
+	}
+	if (link) {
+		if (!(options.account?.accountLinking?.trustedProviders)?.includes(provider.id) && !userInfo.emailVerified || options.account?.accountLinking?.enabled === false) {
+			context.logger.error("Unable to link account - untrusted provider");
+			return redirectOnError("unable_to_link_account");
+		}
+		const existingAccount = await context.internalAdapter.findAccount(userInfo.id.toString());
+		if (existingAccount) {
+			if (existingAccount.userId.toString() !== link.userId.toString()) return redirectOnError("account_already_linked_to_different_user");
+			const updateData = Object.fromEntries(Object.entries({
+				idToken: tokens.idToken,
+				accessToken: await setTokenUtil(tokens.accessToken, ctx, options),
+				refreshToken: await setTokenUtil(tokens.refreshToken, ctx, options),
+				accessTokenExpiresAt: tokens.accessTokenExpiresAt,
+				refreshTokenExpiresAt: tokens.refreshTokenExpiresAt,
+				...tokens.scopes && tokens.scopes.length > 0 && { scope: tokens.scopes.join(",") }
+			}).filter(([_, value]) => value !== void 0));
+			await context.internalAdapter.updateAccount(existingAccount.id, updateData);
+		} else if (await context.internalAdapter.createAccount({
+			userId: link.userId,
+			providerId: provider.id,
+			accountId: userInfo.id,
+			...tokens,
+			accessToken: await setTokenUtil(tokens.accessToken, ctx, options),
+			refreshToken: await setTokenUtil(tokens.refreshToken, ctx, options),
+			...tokens.scopes && tokens.scopes.length > 0 && { scope: tokens.scopes.join(",") }
+		}) == null) return redirectOnError("unable_to_link_account");
+		let toRedirectTo$1;
+		try {
+			toRedirectTo$1 = callbackURL.toString();
+		} catch {
+			toRedirectTo$1 = callbackURL;
+		}
+		return ctx.redirect(toRedirectTo$1, 302);
+	}
+	if (userInfo.email == null) {
+		context.logger.error("Provider did not return email. This could be due to misconfiguration in the provider settings.");
+		return redirectOnError("email_not_found");
+	}
+	const result = await handleOAuthUserInfo(ctx, {
+		userInfo: {
+			...userInfo,
+			id: userInfo.id.toString(),
+			email: userInfo.email,
+			name: userInfo.name ?? userInfo.email
+		},
+		account: {
+			providerId: provider.id,
+			accountId: userInfo.id.toString(),
+			...tokens,
+			...tokens.scopes && tokens.scopes.length > 0 && { scope: tokens.scopes.join(",") }
+		},
+		callbackURL,
+		disableSignUp: provider.disableImplicitSignUp === true && !(requestSignUp ?? false) || provider.options?.disableSignUp === true,
+		overrideUserInfo: provider.options?.overrideUserInfoOnSignIn ?? false
+	}, options);
+	if (result.type === "redirect") return result.response;
+	if (result.type === "error") {
+		context.logger.error(result.reason);
+		return redirectOnError(result.reason);
+	}
+	const { session, user: resultUser } = result.data;
+	await setSessionCookie(ctx, options, {
+		session,
+		user: resultUser
+	});
+	let toRedirectTo;
+	try {
+		toRedirectTo = (result.isRegister === true ? newUserURL ?? callbackURL : callbackURL).toString();
+	} catch {
+		toRedirectTo = result.isRegister === true ? newUserURL ?? callbackURL : callbackURL;
+	}
+	return ctx.redirect(toRedirectTo, 302);
+};
+const getOAuthCallbackRoute = createRoute({
+	operationId: Routes.OAUTH_CALLBACK_GET,
+	isAction: false,
+	method: "get",
+	path: "/callback/:id",
+	description: "Handle OAuth callback",
+	request: req().qry(oauthCallbackQuerySchema).prm(oauthCallbackParamsSchema).bld(),
+	responses: res().rdr("Redirect to success or error URL").err(400).bld()
+});
+const getOAuthCallback = createEndpoint(getOAuthCallbackRoute, (options) => async (ctx) => {
+	const query = ctx.req.valid("query");
+	const { id: paramsId } = ctx.req.valid("param");
+	return handleCallbackOAuth(ctx, paramsId, query, options);
+});
+const postOAuthCallbackRoute = createRoute({
+	operationId: Routes.OAUTH_CALLBACK_POST,
+	isAction: false,
+	method: "post",
+	path: "/callback/:id",
+	description: "Handle OAuth callback (POST)",
+	request: req().bdy(callbackSchema.optional()).prm(oauthCallbackParamsSchema).bld(),
+	responses: res().rdr("Redirect to success or error URL").err(400).zod().bld()
+});
+const postOAuthCallback = createEndpoint(postOAuthCallbackRoute, (options) => async (ctx) => {
+	const body = ctx.req.valid("json");
+	const { id: paramsId } = ctx.req.valid("param");
+	return handleCallbackOAuth(ctx, paramsId, body, options);
+});
+
+//#endregion
+//#region src/api/routes/sign-out.ts
+const signOutRoute = createRoute({
+	operationId: Routes.SIGN_OUT,
+	method: "post",
+	path: "/sign-out",
+	description: "Sign out the current user",
+	responses: res(SCHEMAS[Definitions.SUCCESS].default).err(400).bld()
+});
+const signOut = createEndpoint(signOutRoute, (_options) => async (ctx) => {
+	const context = ctx.get("context");
+	const sessionCookieToken = await (0, cookies_exports.getSignedCookie)(ctx, context.secret, context.authCookies.sessionToken.name);
+	if (sessionCookieToken == null || sessionCookieToken === false) {
+		deleteSessionCookie(ctx);
+		return ctx.render({
+			success: False,
+			message: BASE_ERROR_CODES.FAILED_TO_GET_SESSION
+		}, 400);
+	}
+	await context.internalAdapter.deleteSession(sessionCookieToken);
+	deleteSessionCookie(ctx);
+	return ctx.render({ success: True }, 200);
+});
+
+//#endregion
+//#region src/api/schema/reset-password.ts
+const requestPasswordResetSchema = z$1.object({
+	email: emailSchema.openapi({ description: "The email address of the user to send the password reset email to" }),
+	redirectTo: callbackURLSchema(true).openapi({ description: "The URL to redirect the user to reset their password. If the token isn't valid or expired, it'll be redirected with a query parameter `?error=INVALID_TOKEN`. If the token is valid, it'll be redirected with a query parameter `?token=VALID_TOKEN`" })
+});
+const requestPasswordResetCallbackParamsSchema = z$1.object({ token: z$1.string().openapi({ param: {
+	in: "path",
+	name: "token"
+} }) });
+const requestPasswordResetCallbackQuerySchema = z$1.object({ callbackURL: callbackURLSchema().openapi({
+	param: {
+		in: "query",
+		name: "callbackURL"
+	},
+	description: "The URL to redirect the user to reset their password"
+}) });
+const resetPasswordSchema = z$1.object({
+	newPassword: passwordSchema.openapi({ description: "The new password to set" }),
+	token: z$1.string().optional().openapi({ description: "The token to reset the password" })
+});
+const resetPasswordQuerySchema = z$1.object({ token: z$1.string().optional().openapi({ param: {
+	in: "query",
+	name: "token"
+} }) });
+
+//#endregion
+//#region src/api/routes/reset-password.ts
+const redirectError = (ctx, callbackURL, query) => {
+	const url = callbackURL != null ? new URL(callbackURL, ctx.get("context").baseURL) : new URL(`${ctx.get("context").baseURL}/error`);
+	if (query) Object.entries(query).forEach(([k, v]) => url.searchParams.set(k, v));
+	return url.href;
+};
+const redirectCallback = (ctx, callbackURL, query) => {
+	const url = new URL(callbackURL, ctx.get("context").baseURL);
+	if (query) Object.entries(query).forEach(([k, v]) => url.searchParams.set(k, v));
+	return url.href;
+};
+const requestPasswordResetRoute = createRoute({
+	operationId: Routes.REQUEST_PASSWORD_RESET,
+	method: "post",
+	path: "/request-password-reset",
+	description: "Send a password reset email to the user",
+	request: req().bdy(requestPasswordResetSchema).bld(),
+	responses: res(SCHEMAS[Definitions.SUCCESS].default).err(400, "Reset password not enabled in options").zod().bld()
+});
+const requestPasswordReset = createEndpoint(requestPasswordResetRoute, (options) => async (ctx) => {
+	const context = ctx.get("context");
+	if (!options.emailAndPassword?.sendResetPassword) {
+		context.logger.error("Reset password isn't enabled. Please add an emailAndPassword and sendResetPassword function to your auth config!");
+		return ctx.render({
+			success: False,
+			message: "Reset password isn't enabled"
+		}, 400);
+	}
+	const { email, redirectTo } = ctx.req.valid("json");
+	const user = await context.internalAdapter.findUserByEmail(email, { includeAccounts: true });
+	if (!user) {
+		context.logger.error("Reset Password: User not found", { email });
+		return ctx.render({
+			success: True,
+			message: "If this email exists in our system, check your email for the reset link"
+		}, 200);
+	}
+	const expiresAt = getDate(options.emailAndPassword.resetPasswordTokenExpiresIn ?? 3600 * 1, "sec");
+	const verificationToken = generateId(24);
+	await context.internalAdapter.createVerificationValue({
+		value: user.user.id,
+		identifier: `reset-password:${verificationToken}`,
+		expiresAt
+	});
+	const callbackURL = redirectTo != null ? encodeURIComponent(redirectTo) : void 0;
+	const url = `${context.baseURL}/reset-password/${verificationToken}${callbackURL != null ? `?callbackURL=${callbackURL}` : ""}`;
+	await options.emailAndPassword.sendResetPassword({
+		user: user.user,
+		url,
+		token: verificationToken
+	}, ctx);
+	return ctx.render({ success: True }, 200);
+});
+const requestPasswordResetCallbackRoute = createRoute({
+	operationId: Routes.REQUEST_PASSWORD_RESET_CALLBACK,
+	method: "get",
+	path: "/reset-password/:token",
+	description: "Redirects the user to the callback URL with the token",
+	middleware: [originCheck((ctx) => ctx.req.query("callbackURL"))],
+	request: req().prm(requestPasswordResetCallbackParamsSchema).qry(requestPasswordResetCallbackQuerySchema).bld(),
+	responses: res().rdr().bld()
+});
+const requestPasswordResetCallback = createEndpoint(requestPasswordResetCallbackRoute, (_options) => async (ctx) => {
+	const { token } = ctx.req.valid("param");
+	const { callbackURL } = ctx.req.valid("query");
+	if (!token || !callbackURL) return ctx.redirect(redirectError(ctx, callbackURL, { error: "INVALID_TOKEN" }), 302);
+	const verification = await ctx.get("context").internalAdapter.findVerificationValue(`reset-password:${token}`);
+	if (!verification || verification.expiresAt < /* @__PURE__ */ new Date()) return ctx.redirect(redirectError(ctx, callbackURL, { error: "INVALID_TOKEN" }), 302);
+	return ctx.redirect(redirectCallback(ctx, callbackURL, { token }), 302);
+});
+const resetPasswordRoute = createRoute({
+	operationId: Routes.RESET_PASSWORD,
+	method: "post",
+	path: "/reset-password",
+	description: "Reset the password for a user",
+	request: req().qry(resetPasswordQuerySchema).bdy(resetPasswordSchema).bld(),
+	responses: res(SCHEMAS[Definitions.SUCCESS].default).err(400, "Invalid token or password").zod().bld()
+});
+const resetPassword = createEndpoint(resetPasswordRoute, (options) => async (ctx) => {
+	const token = ctx.req.valid("json").token || ctx.req.valid("query").token;
+	if (token == null || token === "") return ctx.render({
+		success: False,
+		message: BASE_ERROR_CODES.INVALID_TOKEN
+	}, 400);
+	const { newPassword } = ctx.req.valid("json");
+	const context = ctx.get("context");
+	const minLength = context.password.config.minPasswordLength;
+	const maxLength = context.password.config.maxPasswordLength;
+	if (newPassword.length < minLength) return ctx.render({
+		success: False,
+		message: BASE_ERROR_CODES.PASSWORD_TOO_SHORT
+	}, 400);
+	if (newPassword.length > maxLength) return ctx.render({
+		success: False,
+		message: BASE_ERROR_CODES.PASSWORD_TOO_LONG
+	}, 400);
+	const id = `reset-password:${token}`;
+	const verification = await context.internalAdapter.findVerificationValue(id);
+	if (!verification || verification.expiresAt < /* @__PURE__ */ new Date()) return ctx.render({
+		success: False,
+		message: BASE_ERROR_CODES.INVALID_TOKEN
+	}, 400);
+	const userId = verification.value;
+	const hashedPassword = await context.password.hash(newPassword);
+	if (!(await context.internalAdapter.findAccounts(userId)).find((ac) => ac.providerId === "credential")) await context.internalAdapter.createAccount({
+		userId,
+		providerId: "credential",
+		password: hashedPassword,
+		accountId: userId
+	});
+	else await context.internalAdapter.updatePassword(userId, hashedPassword);
+	await context.internalAdapter.deleteVerificationValue(verification.id);
+	if (options.emailAndPassword?.onPasswordReset) {
+		const user = await context.internalAdapter.findUserById(userId);
+		if (user) await options.emailAndPassword.onPasswordReset({ user }, ctx.req);
+	}
+	if (options.emailAndPassword?.revokeSessionsOnPasswordReset) await context.internalAdapter.deleteSessions(userId);
+	return ctx.render({ success: True }, 200);
+});
+
+//#endregion
+//#region src/api/schema/update-user.ts
+const updateUserSchema = looseUserSchema.omit({
+	id: true,
+	createdAt: true,
+	updatedAt: true,
+	emailVerified: true,
+	email: true
+});
+const changePasswordSchema = z$1.object({
+	newPassword: passwordSchema.openapi({ description: "The new password to set" }),
+	currentPassword: passwordSchema.openapi({ description: "The current password" }),
+	revokeOtherSessions: z$1.boolean().optional().openapi({ description: "Revoke all other sessions" })
+});
+const setPasswordSchema = z$1.object({ newPassword: passwordSchema });
+const deleteUserSchema = z$1.object({
+	callbackURL: callbackURLSchema(true).openapi({ description: "The callback URL to redirect to after the user is deleted" }),
+	password: passwordSchema.optional().openapi({ description: "The password of the user. If the password isn't provided, session freshness will be checked." }),
+	token: z$1.string().optional().openapi({ description: "The token to delete the user. If the token is provided, the user will be deleted" })
+});
+const deleteUserCallbackQuerySchema = z$1.object({
+	token: z$1.string().openapi({ param: {
+		in: "query",
+		name: "token"
+	} }),
+	callbackURL: callbackURLSchema(true).openapi({ param: {
+		in: "query",
+		name: "callbackURL"
+	} })
+});
+const changeEmailSchema = z$1.object({
+	newEmail: emailSchema.openapi({ description: "The new email to set" }),
+	callbackURL: callbackURLSchema(true).openapi({ description: "The URL to redirect to after email verification" })
+});
+
+//#endregion
+//#region src/api/routes/update-user.ts
+const updateUserRoute = createRoute({
+	operationId: Routes.UPDATE_USER,
+	method: "post",
+	path: "/update-user",
+	description: "Update the current user",
+	middleware: [sessionMiddleware()],
+	request: req().bdy(updateUserSchema).bld(),
+	responses: res(SCHEMAS[Definitions.SUCCESS].default).zod().err(500, "Failed to update user").bld()
+});
+const updateUser = createEndpoint(updateUserRoute, (options) => async (ctx) => {
+	const { name, image,...rest } = ctx.req.valid("json");
+	if (image === void 0 && name === void 0 && Object.keys(rest).length === 0) return ctx.render({ success: True }, 200);
+	const context = ctx.get("context");
+	const session = ctx.get("session");
+	const additionalFields = await parseUserInput(options, rest, "update");
+	if (additionalFields instanceof Response) return additionalFields;
+	const user = await context.internalAdapter.updateUser(session.user.id, {
+		...name != null && { name },
+		...image !== void 0 && { image },
+		...additionalFields
+	});
+	if (user == null) return ctx.render({
+		success: False,
+		message: BASE_ERROR_CODES.FAILED_TO_UPDATE_USER
+	}, 500);
+	/**
+	* Update the session cookie with the new user data
+	*/
+	await setSessionCookie(ctx, options, {
+		session: session.session,
+		user
+	});
+	return ctx.render({ success: True }, 200);
+});
+const changePasswordRoute = createRoute({
+	operationId: Routes.CHANGE_PASSWORD,
+	method: "post",
+	path: "/change-password",
+	description: "Change the password of the user",
+	middleware: [sensitiveSessionMiddleware],
+	request: req().bdy(changePasswordSchema).bld(),
+	responses: res(SCHEMAS[Definitions.SIGN_IN_UP].default).err(400, "Invalid password").err(404, "Account not found").zod().err(500, "Failed to get session").bld()
+});
+const changePassword = createEndpoint(changePasswordRoute, (options) => async (ctx) => {
+	const context = ctx.get("context");
+	const session = ctx.get("session");
+	const { newPassword, currentPassword, revokeOtherSessions: revokeOtherSessions$1 } = ctx.req.valid("json");
+	const { minPasswordLength } = context.password.config;
+	if (newPassword.length < minPasswordLength) {
+		context.logger.error("Password is too short");
+		return ctx.render({
+			success: False,
+			message: BASE_ERROR_CODES.PASSWORD_TOO_SHORT
+		}, 400);
+	}
+	const { maxPasswordLength } = context.password.config;
+	if (newPassword.length > maxPasswordLength) {
+		context.logger.error("Password is too long");
+		return ctx.render({
+			success: False,
+			message: BASE_ERROR_CODES.PASSWORD_TOO_LONG
+		}, 400);
+	}
+	const account = (await context.internalAdapter.findAccounts(session.user.id)).find((account$1) => account$1.providerId === "credential" && account$1.password != null);
+	if (account?.password == null) return ctx.render({
+		success: False,
+		message: BASE_ERROR_CODES.CREDENTIAL_ACCOUNT_NOT_FOUND
+	}, 404);
+	const passwordHash = await context.password.hash(newPassword);
+	if (!await context.password.verify({
+		hash: account.password,
+		password: currentPassword
+	})) return ctx.render({
+		success: False,
+		message: BASE_ERROR_CODES.INVALID_PASSWORD
+	}, 400);
+	await context.internalAdapter.updateAccount(account.id, { password: passwordHash });
+	let token = session.session.token;
+	if (revokeOtherSessions$1 === true) {
+		await context.internalAdapter.deleteSessions(session.user.id);
+		const newSession = await context.internalAdapter.createSession(session.user.id);
+		if (newSession == null) return ctx.render({
+			success: False,
+			message: BASE_ERROR_CODES.FAILED_TO_GET_SESSION
+		}, 500);
+		await setSessionCookie(ctx, options, {
+			session: newSession,
+			user: session.user
+		});
+		token = newSession.token;
+	}
+	return ctx.render({
+		redirect: False,
+		success: True,
+		token,
+		user: session.user
+	}, 200);
+});
+const setPasswordRoute = createRoute({
+	operationId: Routes.SET_PASSWORD,
+	hide: true,
+	SERVER_ONLY: true,
+	method: "post",
+	path: "/set-password",
+	middleware: [sensitiveSessionMiddleware],
+	request: req().bdy(setPasswordSchema).bld(),
+	responses: res(SCHEMAS[Definitions.SUCCESS].default).err(400, "Invalid password or user already has password").zod().bld()
+});
+const setPassword = createEndpoint(setPasswordRoute, (_options) => async (ctx) => {
+	const context = ctx.get("context");
+	const session = ctx.get("session");
+	const { newPassword } = ctx.req.valid("json");
+	const { minPasswordLength } = context.password.config;
+	if (newPassword.length < minPasswordLength) {
+		context.logger.error("Password is too short");
+		return ctx.render({
+			success: False,
+			message: BASE_ERROR_CODES.PASSWORD_TOO_SHORT
+		}, 400);
+	}
+	const { maxPasswordLength } = context.password.config;
+	if (newPassword.length > maxPasswordLength) {
+		context.logger.error("Password is too long");
+		return ctx.render({
+			success: False,
+			message: BASE_ERROR_CODES.PASSWORD_TOO_LONG
+		}, 400);
+	}
+	const account = (await context.internalAdapter.findAccounts(session.user.id)).find((account$1) => account$1.providerId === "credential" && account$1.password != null);
+	const passwordHash = await context.password.hash(newPassword);
+	if (!account) {
+		await context.internalAdapter.linkAccount({
+			userId: session.user.id,
+			providerId: "credential",
+			accountId: session.user.id,
+			password: passwordHash
+		});
+		return ctx.render({ success: True }, 200);
+	}
+	return ctx.render({
+		success: False,
+		message: "User already has a password"
+	}, 400);
+});
+const deleteUserRoute = createRoute({
+	operationId: Routes.DELETE_USER,
+	method: "post",
+	path: "/delete-user",
+	description: "Delete the user",
+	middleware: [sensitiveSessionMiddleware],
+	request: req().bdy(deleteUserSchema).bld(),
+	responses: res(SCHEMAS[Definitions.SUCCESS].default, "User deletion processed successfully").rdr("Redirect to callback URL").err(400, "Account not found or invalid password").err(404, "Delete user is disabled").zod().bld()
+});
+const deleteUser = createEndpoint(deleteUserRoute, (options) => async (ctx) => {
+	const context = ctx.get("context");
+	if (options.user?.deleteUser?.enabled !== true) {
+		context.logger.error("Delete user is disabled. Enable it in the options");
+		return ctx.render({
+			success: False,
+			message: "Delete user is disabled"
+		}, 404);
+	}
+	const session = ctx.get("session");
+	const api = ctx.get("api");
+	const { callbackURL, password, token } = ctx.req.valid("json");
+	let canDelete = false;
+	const account = (await context.internalAdapter.findAccounts(session.user.id)).find((account$1) => account$1.providerId === "credential" && account$1.password != null);
+	if (password != null) {
+		if (account?.password == null) return ctx.render({
+			success: False,
+			message: BASE_ERROR_CODES.CREDENTIAL_ACCOUNT_NOT_FOUND
+		}, 400);
+		if (!await context.password.verify({
+			hash: account.password,
+			password
+		})) return ctx.render({
+			success: False,
+			message: BASE_ERROR_CODES.INVALID_PASSWORD
+		}, 400);
+		canDelete = true;
+	}
+	if (token != null) return await api.deleteUserCallback({ query: { token } }, ctx).then((res$1) => res$1 instanceof Response ? res$1 : ctx.render(res$1, res$1.success === true ? 200 : "errors" in res$1 ? 422 : 404));
+	if (options.user?.deleteUser?.sendDeleteAccountVerification != null) {
+		if (account?.password != null && !canDelete) return ctx.render({
+			success: False,
+			message: BASE_ERROR_CODES.USER_ALREADY_HAS_PASSWORD
+		}, 400);
+		const token$1 = (0, crypto_exports.generateRandomString)(32, "0-9", "a-z");
+		await context.internalAdapter.createVerificationValue({
+			value: session.user.id,
+			identifier: `delete-account-${token$1}`,
+			expiresAt: new Date(Date.now() + (options.user.deleteUser.deleteTokenExpiresIn ?? 3600 * 24) * 1e3)
+		});
+		const url = `${context.baseURL}/delete-user/callback?token=${token$1}${callbackURL ? `&callbackURL=${callbackURL}` : ""}`;
+		await options.user.deleteUser.sendDeleteAccountVerification({
+			user: session.user,
+			url,
+			token: token$1
+		}, ctx);
+		return ctx.render({
+			success: True,
+			message: "Verification email sent"
+		}, 200);
+	}
+	if (!password && context.sessionConfig.freshAge !== 0) {
+		const currentAge = session.session.createdAt.getTime();
+		const freshAge = context.sessionConfig.freshAge * 1e3;
+		if (Date.now() - currentAge > freshAge * 1e3) return ctx.render({
+			success: False,
+			message: BASE_ERROR_CODES.SESSION_EXPIRED
+		}, 400);
+		canDelete = true;
+	}
+	if (!canDelete) return ctx.render({
+		success: False,
+		message: "User cannot be deleted. please provide a password or token"
+	}, 400);
+	if (options.user?.deleteUser?.beforeDelete) await options.user.deleteUser.beforeDelete(session.user, ctx.req);
+	await context.internalAdapter.deleteUser(session.user.id);
+	await context.internalAdapter.deleteSessions(session.user.id);
+	await context.internalAdapter.deleteAccounts(session.user.id);
+	deleteSessionCookie(ctx);
+	if (options.user?.deleteUser?.afterDelete) await options.user.deleteUser.afterDelete(session.user, ctx.req);
+	return ctx.render({
+		success: True,
+		message: "User deleted"
+	}, 200);
+});
+const deleteUserCallbackRoute = createRoute({
+	operationId: Routes.DELETE_USER_CALLBACK,
+	method: "get",
+	path: "/delete-user/callback",
+	description: "Callback to complete user deletion with verification token",
+	middleware: [originCheck((ctx) => ctx.req.query("callbackURL")), sessionMiddleware()],
+	request: req().qry(deleteUserCallbackQuerySchema).bld(),
+	responses: res(SCHEMAS[Definitions.SUCCESS].default, "User successfully deleted").rdr("Redirect to callback URL").err(404, "Invalid token or delete user is disabled").zod().bld()
+});
+const deleteUserCallback = createEndpoint(deleteUserCallbackRoute, (options) => async (ctx) => {
+	const context = ctx.get("context");
+	if (!(options.user?.deleteUser?.enabled ?? false)) {
+		context.logger.error("Delete user is disabled. Enable it in the options");
+		return ctx.render({
+			success: False,
+			message: "Delete user is disabled"
+		}, 404);
+	}
+	const session = ctx.get("session");
+	const { token: requestedToken, callbackURL } = ctx.req.valid("query");
+	const token = await context.internalAdapter.findVerificationValue(`delete-account-${requestedToken}`);
+	if (!token || token.expiresAt < /* @__PURE__ */ new Date()) {
+		context.logger.info(requestedToken);
+		return ctx.render({
+			success: False,
+			message: BASE_ERROR_CODES.INVALID_TOKEN
+		}, 404);
+	}
+	if (token.value !== session.user.id) return ctx.render({
+		success: False,
+		message: BASE_ERROR_CODES.INVALID_TOKEN
+	}, 404);
+	const { beforeDelete } = options.user?.deleteUser ?? {};
+	if (beforeDelete) await beforeDelete(session.user, ctx.req);
+	await context.internalAdapter.deleteUser(session.user.id);
+	await context.internalAdapter.deleteSessions(session.user.id);
+	await context.internalAdapter.deleteAccounts(session.user.id);
+	await context.internalAdapter.deleteVerificationValue(token.id);
+	deleteSessionCookie(ctx);
+	const { afterDelete } = options.user?.deleteUser ?? {};
+	if (afterDelete) await afterDelete(session.user, ctx.req);
+	if (callbackURL != null) return ctx.redirect(callbackURL);
+	return ctx.render({
+		success: True,
+		message: "User deleted"
+	}, 200);
+});
+const changeEmailRoute = createRoute({
+	operationId: Routes.CHANGE_EMAIL,
+	method: "post",
+	path: "/change-email",
+	middleware: [sensitiveSessionMiddleware],
+	request: req().bdy(changeEmailSchema).bld(),
+	responses: res(SCHEMAS[Definitions.SUCCESS].default, "Email change request processed successfully").err(400, "Change email is disabled or user already exists").zod().bld()
+});
+const changeEmail = createEndpoint(changeEmailRoute, (options) => async (ctx) => {
+	const context = ctx.get("context");
+	if (options.user?.changeEmail?.enabled !== true) {
+		context.logger.error("Change email is disabled.");
+		return ctx.render({
+			success: False,
+			message: "Change email is disabled"
+		}, 400);
+	}
+	const session = ctx.get("session");
+	let { callbackURL, newEmail } = ctx.req.valid("json");
+	newEmail = newEmail.toLowerCase();
+	if (newEmail === session.user.email) {
+		context.logger.error("Email is the same");
+		return ctx.render({
+			success: False,
+			message: "Email is the same"
+		}, 400);
+	}
+	if (await context.internalAdapter.findUserByEmail(newEmail)) {
+		context.logger.error("Email already exists");
+		return ctx.render({
+			success: False,
+			message: "Couldn't update your email"
+		}, 400);
+	}
+	/**
+	* If the email is not verified, we can update the email
+	*/
+	if (!session.user.emailVerified) {
+		if (await context.internalAdapter.findUserByEmail(newEmail)) return ctx.render({
+			success: False,
+			message: BASE_ERROR_CODES.USER_ALREADY_EXISTS
+		}, 400);
+		await context.internalAdapter.updateUserByEmail(session.user.email, {
+			email: newEmail,
+			emailVerified: false
+		});
+		await setSessionCookie(ctx, options, {
+			session: session.session,
+			user: {
+				...session.user,
+				email: newEmail
+			}
+		});
+		if (options.emailVerification?.sendVerificationEmail) {
+			const token$1 = await createEmailVerificationToken(context.secret, newEmail, void 0, options.emailVerification.expiresIn);
+			const url$1 = `${context.baseURL}/verify-email?token=${token$1}&callbackURL=${callbackURL ?? "/"}`;
+			await options.emailVerification.sendVerificationEmail({
+				user: session.user,
+				url: url$1,
+				token: token$1
+			}, ctx);
+		}
+		return ctx.render({ success: True }, 200);
+	}
+	/**
+	* If the email is verified, we need to send a verification email
+	*/
+	if (options.user?.changeEmail?.sendChangeEmailVerification == null) {
+		context.logger.error("Verification email isn't enabled.");
+		return ctx.render({
+			success: False,
+			message: "Verification email isn't enabled"
+		}, 400);
+	}
+	const token = await createEmailVerificationToken(context.secret, session.user.email, newEmail, options.emailVerification?.expiresIn);
+	const url = `${context.baseURL}/verify-email?token=${token}&callbackURL=${callbackURL ?? "/"}`;
+	await options.user.changeEmail.sendChangeEmailVerification({
+		user: session.user,
+		newEmail,
+		url,
+		token
+	}, ctx);
+	return ctx.render({ success: True }, 200);
+});
+
+//#endregion
+//#region src/api/routes/error.ts
+const sanitize = (input) => input.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&#39;");
+const html = (errorCode = "Unknown", errorDescription) => `<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Authentication Error</title>
+    <style>
+        :root {
+            --bg-color: #f8f9fa;
+            --text-color: #212529;
+            --accent-color: #000000;
+            --error-color: #dc3545;
+            --border-color: #e9ecef;
+        }
+        body {
+            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
+            background-color: var(--bg-color);
+            color: var(--text-color);
+            display: flex;
+            justify-content: center;
+            align-items: center;
+            height: 100vh;
+            margin: 0;
+            line-height: 1.5;
+        }
+        .error-container {
+            background-color: #ffffff;
+            border-radius: 12px;
+            box-shadow: 0 4px 6px rgba(0, 0, 0, 0.05);
+            padding: 2.5rem;
+            text-align: center;
+            max-width: 90%;
+            width: 400px;
+        }
+        h1 {
+            color: var(--error-color);
+            font-size: 1.75rem;
+            margin-bottom: 1rem;
+            font-weight: 600;
+        }
+        p {
+            margin-bottom: 1.5rem;
+            color: #495057;
+        }
+        .btn {
+            background-color: var(--accent-color);
+            color: #ffffff;
+            text-decoration: none;
+            padding: 0.75rem 1.5rem;
+            border-radius: 6px;
+            transition: all 0.3s ease;
+            display: inline-block;
+            font-weight: 500;
+            border: 2px solid var(--accent-color);
+        }
+        .btn:hover {
+            background-color: #131721;
+        }
+        .error-code {
+            font-size: 0.875rem;
+            color: #6c757d;
+            margin-top: 1.5rem;
+            padding-top: 1.5rem;
+            border-top: 1px solid var(--border-color);
+        }
+        .icon {
+            font-size: 3rem;
+            margin-bottom: 1rem;
+        }
+        .error-description {
+          font-size: 0.95rem;
+          color: #6c757d;
+          margin: -1rem 0 1.5rem;
+        }
+    </style>
+</head>
+<body>
+    <div class="error-container">
+        <div class="icon">!</div>
+        <h1>Faire Auth Error</h1>
+        <p>We encountered an issue while processing your request. Please try again or contact the application owner if the problem persists.</p>
+        ${errorDescription ? `<div class="error-description">${sanitize(errorDescription)}</div>` : ""}
+        <a href="/" id="returnLink" class="btn">Return to Application</a>
+        <div class="error-code">Error Code: <span id="errorCode">${sanitize(errorCode)}</span></div>
+    </div>
+</body>
+</html>`;
+const errorQuerySchema = z$1.object({
+	error: z$1.string().optional(),
+	error_description: z$1.string().optional()
+});
+const errorRoute = createRoute({
+	operationId: Routes.ERROR,
+	hide: true,
+	isAction: false,
+	method: "get",
+	path: "/error",
+	description: "Displays an error page",
+	request: req().qry(errorQuerySchema).bld(),
+	responses: res(z$1.string().openapi({ description: "The HTML content of the error page" }), "A HTML error page", "text/html").zod().bld()
+});
+const error = createEndpoint(errorRoute, (_options) => async (ctx) => {
+	const { error: error$1, error_description: _error_description } = ctx.req.valid("query");
+	return ctx.html(html(error$1), 200);
+});
+
+//#endregion
+//#region src/api/routes/ok.ts
+const okRoute = createRoute({
+	operationId: Routes.OK,
+	hide: true,
+	isAction: false,
+	method: "get",
+	path: "/ok",
+	description: "Check if the API is working",
+	responses: res(SCHEMAS[Definitions.SUCCESS].default, "API is working").bld()
+});
+const ok = createEndpoint(okRoute, (_options) => async (ctx) => ctx.render({ success: True }, 200));
+
+//#endregion
+//#region src/api/schema/sign-up.ts
+const signUpEmailSchema = z$1.looseObject({
+	name: nameSchema,
+	email: emailSchema.openapi({ description: "The email of the user" }),
+	password: passwordSchema.openapi({ description: "The password of the user" }),
+	image: z$1.url().nullish().openapi({ description: "The profile image URL of the user" }),
+	callbackURL: callbackURLSchema(true).openapi({ description: "The URL to use for email verification callback" }),
+	rememberMe: z$1.boolean().default(true).openapi({ description: "If this is false, the session will not be remembered. Default is `true`." })
+});
+
+//#endregion
+//#region src/api/routes/sign-up.ts
+const signUpEmailRoute = createRoute({
+	operationId: Routes.SIGN_UP_EMAIL,
+	method: "post",
+	path: "/sign-up/email",
+	description: "Sign up a user using email and password",
+	request: req().bdy(signUpEmailSchema).bld(),
+	responses: res(SCHEMAS[Definitions.SIGN_IN_UP].default, "Successfully created user").err(400, "Email and password sign up is not enabled, invalid password, or user already exists").zod().bld()
+});
+const signUpEmail = createEndpoint(signUpEmailRoute, (options) => async (ctx) => {
+	if (!(options.emailAndPassword?.enabled ?? false) || options.emailAndPassword?.disableSignUp === true) return ctx.render({
+		success: False,
+		message: "Email and password sign up is not enabled"
+	}, 400);
+	const { name, email, password, image, callbackURL, rememberMe,...additionalFields } = ctx.req.valid("json");
+	const context = ctx.get("context");
+	const { minPasswordLength, maxPasswordLength } = context.password.config;
+	if (password.length < minPasswordLength) {
+		context.logger.error("Password is too short");
+		return ctx.render({
+			success: False,
+			message: BASE_ERROR_CODES.PASSWORD_TOO_SHORT
+		}, 400);
+	}
+	if (password.length > maxPasswordLength) {
+		context.logger.error("Password is too long");
+		return ctx.render({
+			success: False,
+			message: BASE_ERROR_CODES.PASSWORD_TOO_LONG
+		}, 400);
+	}
+	return runWithTransaction(context.adapter, async () => {
+		if ((await context.internalAdapter.findUserByEmail(email))?.user) {
+			context.logger.info(`Sign-up attempt for existing email: ${email}`);
+			return ctx.render({
+				success: False,
+				message: BASE_ERROR_CODES.USER_ALREADY_EXISTS
+			}, 400);
+		}
+		const additionalData = await parseUserInput(options, additionalFields, "create");
+		if (additionalData instanceof Response) return additionalData;
+		/**
+		* Hash the password
+		*
+		* This is done prior to creating the user
+		* to ensure that any plugin that
+		* may break the hashing should break
+		* before the user is created.
+		*/
+		const hash = await context.password.hash(password);
+		let createdUser;
+		try {
+			createdUser = await context.internalAdapter.createUser({
+				email: email.toLowerCase(),
+				name,
+				image,
+				...additionalData,
+				emailVerified: false
+			});
+		} catch (e) {
+			if (isDevelopment()) context.logger.error("Failed to create user", e);
+			return ctx.render({
+				success: False,
+				message: BASE_ERROR_CODES.FAILED_TO_CREATE_USER
+			}, 400);
+		}
+		if (createdUser == null) return ctx.render({
+			success: False,
+			message: BASE_ERROR_CODES.FAILED_TO_CREATE_USER
+		}, 400);
+		await context.internalAdapter.linkAccount({
+			userId: createdUser.id,
+			providerId: "credential",
+			accountId: createdUser.id,
+			password: hash
+		});
+		if (options.emailVerification?.sendOnSignUp === true || options.emailAndPassword?.requireEmailVerification === true) {
+			const token = await createEmailVerificationToken(context.secret, createdUser.email, void 0, options.emailVerification?.expiresIn);
+			const url = `${context.baseURL}/verify-email?token=${token}&callbackURL=${callbackURL ?? "/"}`;
+			await options.emailVerification?.sendVerificationEmail?.({
+				user: createdUser,
+				url,
+				token
+			}, ctx);
+		}
+		if (options.emailAndPassword?.autoSignIn === false || options.emailAndPassword?.requireEmailVerification === true) return ctx.render({
+			success: True,
+			redirect: False,
+			user: createdUser
+		}, 200);
+		const session = await context.internalAdapter.createSession(createdUser.id, rememberMe === false);
+		if (session == null) return ctx.render({
+			success: False,
+			message: BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION
+		}, 400);
+		await setSessionCookie(ctx, options, {
+			session,
+			user: createdUser
+		}, rememberMe === false);
+		return ctx.render({
+			success: True,
+			redirect: False,
+			token: session.token,
+			user: createdUser
+		}, 200);
+	});
+});
+
+//#endregion
+//#region src/api/routes/account.ts
+const listAccountsRoute = createRoute({
+	operationId: Routes.LIST_ACCOUNTS,
+	method: "get",
+	path: "/list-accounts",
+	description: "List all accounts linked to the user",
+	middleware: [sessionMiddleware()],
+	responses: res(SCHEMAS[Definitions.ACCOUNTS_LIST].default).bld()
+});
+const listAccounts = createEndpoint(listAccountsRoute, (_options) => async (ctx) => {
+	const context = ctx.get("context");
+	const session = ctx.get("session");
+	const accounts = await context.internalAdapter.findAccounts(session.user.id);
+	return ctx.render(accounts.map((a) => ({
+		id: a.id,
+		providerId: a.providerId,
+		createdAt: a.createdAt,
+		updatedAt: a.updatedAt,
+		accountId: a.accountId,
+		scopes: a.scope ? a.scope.split(",") : []
+	})), 200);
+});
+const linkAccountRoute = createRoute({
+	operationId: Routes.LINK_ACCOUNT,
+	method: "post",
+	path: "/link-social",
+	description: "Link a social account to the user",
+	middleware: [sessionMiddleware()],
+	request: req().bdy(linkAccountSchema).bld(),
+	responses: res(SCHEMAS[Definitions.REDIRECT_URL].default).err(401, "Invalid token, failed to get user info, email not found, linking not allowed, or different emails not allowed").err(404, "Provider not found").err(417, "Unable to create account").zod().bld()
+});
+const linkAccount = createEndpoint(linkAccountRoute, (options) => async (ctx) => {
+	const { scopes, provider: requestedProvider, idToken } = ctx.req.valid("json");
+	const context = ctx.get("context");
+	const session = ctx.get("session");
+	const provider = context.socialProviders.find((p) => p.id === requestedProvider);
+	if (!provider) {
+		context.logger.error("Provider not found. Make sure to add the provider in your auth config", { provider: requestedProvider });
+		return ctx.render({
+			success: False,
+			message: BASE_ERROR_CODES.PROVIDER_NOT_FOUND
+		}, 404);
+	}
+	if (idToken) {
+		if (!provider.verifyIdToken) {
+			context.logger.error("Provider does not support id token verification", { provider: requestedProvider });
+			return ctx.render({
+				success: False,
+				message: BASE_ERROR_CODES.ID_TOKEN_NOT_SUPPORTED
+			}, 404);
+		}
+		const { token, nonce } = idToken;
+		if (!await provider.verifyIdToken(token, nonce)) {
+			context.logger.error("Invalid id token", { provider: requestedProvider });
+			return ctx.render({
+				success: False,
+				message: BASE_ERROR_CODES.INVALID_TOKEN
+			}, 401);
+		}
+		const linkingUserInfo = await provider.getUserInfo({
+			idToken: token,
+			accessToken: idToken.accessToken,
+			refreshToken: idToken.refreshToken
+		});
+		if (!linkingUserInfo || !linkingUserInfo?.user) {
+			context.logger.error("Failed to get user info", { provider: requestedProvider });
+			return ctx.render({
+				success: False,
+				message: BASE_ERROR_CODES.FAILED_TO_GET_USER_INFO
+			}, 401);
+		}
+		const linkingUserId = String(linkingUserInfo.user.id);
+		if (!linkingUserInfo.user.email) {
+			context.logger.error("User email not found", { provider: requestedProvider });
+			return ctx.render({
+				success: False,
+				message: BASE_ERROR_CODES.USER_EMAIL_NOT_FOUND
+			}, 401);
+		}
+		if ((await context.internalAdapter.findAccounts(session.user.id)).find((a) => a.providerId === provider.id && a.accountId === linkingUserId)) return ctx.render({ redirect: False }, 200);
+		if (!(options.account?.accountLinking?.trustedProviders)?.includes(provider.id) && !linkingUserInfo.user.emailVerified || options.account?.accountLinking?.enabled === false) return ctx.render({
+			success: False,
+			message: "Account not linked - linking not allowed"
+		}, 401);
+		if (linkingUserInfo.user.email !== session.user.email && options.account?.accountLinking?.allowDifferentEmails !== true) return ctx.render({
+			success: False,
+			message: "Account not linked - different emails not allowed"
+		}, 401);
+		try {
+			await context.internalAdapter.createAccount({
+				userId: session.user.id,
+				providerId: provider.id,
+				accountId: linkingUserId,
+				accessToken: idToken.accessToken,
+				idToken: token,
+				refreshToken: idToken.refreshToken,
+				...idToken.scopes && idToken.scopes.length > 0 && { scope: idToken.scopes.join(",") }
+			});
+		} catch (e) {
+			return ctx.render({
+				success: False,
+				message: "Account not linked - unable to create account"
+			}, 417);
+		}
+		if (options.account?.accountLinking?.updateUserInfoOnLink === true && (linkingUserInfo.user?.name || linkingUserInfo.user?.image)) try {
+			await context.internalAdapter.updateUser(session.user.id, {
+				...linkingUserInfo.user?.name && { name: linkingUserInfo.user.name },
+				...linkingUserInfo.user?.image && { image: linkingUserInfo.user.image }
+			});
+		} catch (e) {
+			console.warn("Could not update user - " + e.toString());
+		}
+		return ctx.render({ redirect: False }, 200);
+	}
+	const state = await generateState(ctx, {
+		userId: session.user.id,
+		email: session.user.email
+	}, options);
+	const url = await provider.createAuthorizationURL({
+		state: state.state,
+		codeVerifier: state.codeVerifier,
+		redirectURI: `${context.baseURL}/callback/${provider.id}`,
+		...scopes && { scopes }
+	});
+	return ctx.render({
+		redirect: True,
+		url: url.toString()
+	}, 200);
+});
+const unlinkAccountRoute = createRoute({
+	operationId: Routes.UNLINK_ACCOUNT,
+	method: "post",
+	path: "/unlink-account",
+	description: "Unlink an account",
+	middleware: [freshSessionMiddleware],
+	request: req().bdy(unlinkAccountSchema).bld(),
+	responses: res(SCHEMAS[Definitions.SUCCESS].default).err(400, "Account not found or failed to unlink").zod().bld()
+});
+const unlinkAccount = createEndpoint(unlinkAccountRoute, (options) => async (ctx) => {
+	const { providerId, accountId } = ctx.req.valid("json");
+	const context = ctx.get("context");
+	const session = ctx.get("session");
+	const accounts = await context.internalAdapter.findAccounts(session.user.id);
+	if (accounts.length === 1 && options.account?.accountLinking?.allowUnlinkingAll !== true) return ctx.render({
+		success: False,
+		message: BASE_ERROR_CODES.FAILED_TO_UNLINK_LAST_ACCOUNT
+	}, 400);
+	const accountExist = accounts.find((account) => accountId != null ? account.accountId === accountId && account.providerId === providerId : account.providerId === providerId);
+	if (!accountExist) return ctx.render({
+		success: False,
+		message: BASE_ERROR_CODES.ACCOUNT_NOT_FOUND
+	}, 400);
+	await context.internalAdapter.deleteAccount(accountExist.id);
+	return ctx.render({ success: True }, 200);
+});
+const getAccessTokenRoute = createRoute({
+	operationId: Routes.GET_ACCESS_TOKEN,
+	method: "post",
+	path: "/get-access-token",
+	description: "Get a valid access token, doing a refresh if needed",
+	middleware: [requestOnlySessionMiddleware],
+	request: req().bdy(getAccessTokenSchema).bld(),
+	responses: res(SCHEMAS[Definitions.ACCESS_TOKEN].default, "A valid access token").err(400, "Invalid refresh token or provider configuration").zod().bld()
+});
+const getAccessToken = createEndpoint(getAccessTokenRoute, (options) => async (ctx) => {
+	const { providerId, accountId, userId } = ctx.req.valid("json");
+	if (userId && ctx.get("isServer") !== true) return ctx.render({ success: False }, 401);
+	const resolvedUserId = ctx.get("session")?.user.id ?? userId;
+	if (resolvedUserId == null) return ctx.render({
+		success: False,
+		message: `Either userId or session is required`
+	}, 400);
+	const context = ctx.get("context");
+	if (!context.socialProviders.find((p) => p.id === providerId)) return ctx.render({
+		success: False,
+		message: `Provider ${providerId} is not supported.`
+	}, 400);
+	const account = (await context.internalAdapter.findAccounts(resolvedUserId)).find((acc) => accountId != null ? acc.id === accountId && acc.providerId === providerId : acc.providerId === providerId);
+	if (!account) return ctx.render({
+		success: False,
+		message: "Account not found"
+	}, 400);
+	const provider = context.socialProviders.find((p) => p.id === providerId);
+	if (!provider) return ctx.render({
+		success: False,
+		message: `Provider ${providerId} not found.`
+	}, 400);
+	try {
+		let newTokens = null;
+		const accessTokenExpired = account.accessTokenExpiresAt && new Date(account.accessTokenExpiresAt).getTime() - Date.now() < 5e3;
+		if (account.refreshToken && accessTokenExpired && provider.refreshAccessToken) {
+			newTokens = await provider.refreshAccessToken(account.refreshToken);
+			await context.internalAdapter.updateAccount(account.id, {
+				...newTokens.accessToken && {
+					accessToken: await setTokenUtil(newTokens.accessToken, ctx, options),
+					...newTokens.accessTokenExpiresAt && { accessTokenExpiresAt: newTokens.accessTokenExpiresAt }
+				},
+				...newTokens.refreshToken && {
+					refreshToken: await setTokenUtil(newTokens.refreshToken, ctx, options),
+					...newTokens.refreshTokenExpiresAt && { refreshTokenExpiresAt: newTokens.refreshTokenExpiresAt }
+				}
+			});
+		}
+		const tokens = {
+			accessToken: await decryptOAuthToken(newTokens?.accessToken ?? account.accessToken ?? "", ctx, options),
+			...newTokens?.accessTokenExpiresAt != null || account.accessTokenExpiresAt != null ? { accessTokenExpiresAt: newTokens?.accessTokenExpiresAt ?? account.accessTokenExpiresAt } : {},
+			scopes: account.scope ? account.scope.split(",") : [],
+			...(newTokens?.idToken != null && newTokens.idToken !== "" || account.idToken != null && account.idToken !== "") && { idToken: newTokens?.idToken || account.idToken }
+		};
+		return ctx.render(tokens, 200);
+	} catch {
+		return ctx.render({
+			success: False,
+			message: "Failed to get a valid access token"
+		}, 400);
+	}
+});
+const refreshAccessTokenRoute = createRoute({
+	operationId: Routes.REFRESH_ACCESS_TOKEN,
+	method: "post",
+	path: "/refresh-token",
+	description: "Refresh the access token using a refresh token",
+	middleware: [sessionMiddleware()],
+	request: req().bdy(refreshAccessTokenSchema).bld(),
+	responses: res(SCHEMAS[Definitions.ACCESS_TOKEN].default, "Access token refreshed successfully").err(400, "Invalid refresh token or provider configuration").zod().bld()
+});
+const refreshAccessToken = createEndpoint(refreshAccessTokenRoute, (options) => async (ctx) => {
+	const context = ctx.get("context");
+	const session = ctx.get("session");
+	const { providerId, accountId, userId } = ctx.req.valid("json");
+	const resolvedUserId = userId ?? session.user.id;
+	if (!context.socialProviders.find((p) => p.id === providerId)) return ctx.render({
+		success: False,
+		message: `Provider ${providerId} is not supported.`
+	}, 400);
+	const account = (await context.internalAdapter.findAccounts(resolvedUserId)).find((acc) => accountId != null ? acc.id === accountId && acc.providerId === providerId : acc.providerId === providerId);
+	if (account?.refreshToken == null) return ctx.render({
+		success: False,
+		message: "Account not found"
+	}, 400);
+	const provider = context.socialProviders.find((p) => p.id === providerId);
+	if (!provider) return ctx.render({
+		success: False,
+		message: `Provider ${providerId} not found.`
+	}, 400);
+	if (!provider.refreshAccessToken) return ctx.render({
+		success: False,
+		message: `Provider ${providerId} does not support token refreshing.`
+	}, 400);
+	try {
+		const tokens = await provider.refreshAccessToken(account.refreshToken);
+		await context.internalAdapter.updateAccount(account.id, {
+			...tokens.accessToken && {
+				accessToken: await setTokenUtil(tokens.accessToken, ctx, options),
+				...tokens.accessTokenExpiresAt && { accessTokenExpiresAt: tokens.accessTokenExpiresAt }
+			},
+			...tokens.refreshToken && {
+				refreshToken: await setTokenUtil(tokens.refreshToken, ctx, options),
+				...tokens.refreshTokenExpiresAt && { refreshTokenExpiresAt: tokens.refreshTokenExpiresAt }
+			}
+		});
+		return ctx.render(tokens, 200);
+	} catch {
+		return ctx.render({
+			success: False,
+			message: "Failed to refresh access token"
+		}, 400);
+	}
+});
+const getAccountInfoRoute = createRoute({
+	operationId: Routes.GET_ACCOUNT_INFO,
+	method: "post",
+	path: "/account-info",
+	description: "Get the account info provided by the provider",
+	middleware: [sessionMiddleware()],
+	request: req().bdy(getAccountInfoSchema).bld(),
+	responses: res(SCHEMAS[Definitions.ACCOUNT_INFO].default).err(400, "Account not found").zod().err(500, "Provider not configured or failed to get user info").bld()
+});
+const getAccountInfo = createEndpoint(getAccountInfoRoute, (_options) => async (ctx) => {
+	const { accountId } = ctx.req.valid("json");
+	const context = ctx.get("context");
+	const session = ctx.get("session");
+	const api = ctx.get("api");
+	const account = await context.internalAdapter.findAccount(accountId);
+	if (!account || account.userId !== session.user.id) return ctx.render({
+		success: False,
+		message: "Account not found"
+	}, 400);
+	const provider = context.socialProviders.find((p) => p.id === account.providerId);
+	if (!provider) return ctx.render({
+		success: False,
+		message: `Provider account provider is ${account.providerId} but it is not configured`
+	}, 500);
+	const tokensResponse = await api.getAccessToken({ json: {
+		accountId: account.id,
+		providerId: account.providerId,
+		userId: account.userId
+	} }, ctx);
+	if (tokensResponse.success === false) return ctx.render(tokensResponse, 500);
+	const info = await provider.getUserInfo({
+		...tokensResponse.data,
+		...tokensResponse.data.accessTokenExpiresAt != null && { accessTokenExpiresAt: new Date(tokensResponse.data.accessTokenExpiresAt) },
+		...tokensResponse.data.refreshTokenExpiresAt != null && { refreshTokenExpiresAt: new Date(tokensResponse.data.refreshTokenExpiresAt) }
+	});
+	if (info == null) return ctx.render({
+		success: False,
+		message: "Failed to get user info"
+	}, 500);
+	return ctx.render(info, 200);
+});
+
+//#endregion
+//#region src/api/endpoints.ts
+const staticRouteMap = {
+	[Routes.SET_PASSWORD]: setPassword,
+	[Routes.CHANGE_EMAIL]: changeEmail,
+	[Routes.CHANGE_PASSWORD]: changePassword,
+	[Routes.DELETE_USER]: deleteUser,
+	[Routes.DELETE_USER_CALLBACK]: deleteUserCallback,
+	[Routes.ERROR]: error,
+	[Routes.GET_ACCESS_TOKEN]: getAccessToken,
+	[Routes.GET_ACCOUNT_INFO]: getAccountInfo,
+	[Routes.GET_SESSION]: getSession,
+	[Routes.LINK_ACCOUNT]: linkAccount,
+	[Routes.LIST_ACCOUNTS]: listAccounts,
+	[Routes.LIST_SESSIONS]: listSessions,
+	[Routes.OAUTH_CALLBACK_GET]: getOAuthCallback,
+	[Routes.OAUTH_CALLBACK_POST]: postOAuthCallback,
+	[Routes.OK]: ok,
+	[Routes.REFRESH_ACCESS_TOKEN]: refreshAccessToken,
+	[Routes.REQUEST_PASSWORD_RESET]: requestPasswordReset,
+	[Routes.REQUEST_PASSWORD_RESET_CALLBACK]: requestPasswordResetCallback,
+	[Routes.RESET_PASSWORD]: resetPassword,
+	[Routes.REVOKE_OTHER_SESSIONS]: revokeOtherSessions,
+	[Routes.REVOKE_SESSION]: revokeSession,
+	[Routes.REVOKE_SESSIONS]: revokeSessions,
+	[Routes.SEND_VERIFICATION_EMAIL]: sendVerificationEmail,
+	[Routes.SIGN_IN_EMAIL]: signInEmail,
+	[Routes.SIGN_IN_SOCIAL]: signInSocial,
+	[Routes.SIGN_OUT]: signOut,
+	[Routes.SIGN_UP_EMAIL]: signUpEmail,
+	[Routes.UNLINK_ACCOUNT]: unlinkAccount,
+	[Routes.UPDATE_USER]: updateUser,
+	[Routes.VERIFY_EMAIL]: verifyEmail
+};
+const resolveHooks = (options) => {
+	const routeHooks = { ...options.routeHooks };
+	options.plugins?.forEach((p) => {
+		if (p.routeHooks) Object.assign(routeHooks, p.routeHooks);
+	});
+	return routeHooks;
+};
+const resolveRoutes = (options) => {
+	const routeMap = { ...staticRouteMap };
+	options.plugins?.forEach((p) => {
+		if (p.routes) Object.assign(routeMap, p.routes);
+	});
+	return routeMap;
+};
+const createEndpoints = (options) => {
+	const routeMap = resolveRoutes(options);
+	const routeHooks = resolveHooks(options);
+	return {
+		endpoints: Object.fromEntries(Object.entries(routeMap).map(([k, v]) => [k, v(options)])),
+		hooks: routeHooks
+	};
+};
+const createArgs = (endpoints, builtSchemas, context, routeHooks) => {
+	const groups = {
+		priv: [],
+		pub: []
+	};
+	for (const [k, v] of Object.entries(endpoints)) {
+		const args = v.toArgs(builtSchemas, context, endpoints, routeHooks[k]);
+		groups[args[0].SERVER_ONLY === true ? "priv" : "pub"].push(args);
+	}
+	return groups;
+};
+
+//#endregion
+//#region src/api/middleware/intercept.ts
+const runIntercept = (ctx, hooks) => {
+	let response = void 0;
+	for (const hook of hooks) try {
+		const result = hook(ctx);
+		if (result instanceof Response) response = result;
+	} catch (error$1) {
+		ctx.error = error$1;
+	}
+	return response;
+};
+const getHooks = (options) => {
+	const beforeHooks = [];
+	const afterHooks = [];
+	options.plugins?.forEach((p) => {
+		if (p.onRequest) beforeHooks.push(p.onRequest);
+		if (p.onResponse) afterHooks.push(p.onResponse);
+	});
+	return {
+		beforeHooks,
+		afterHooks
+	};
+};
+/**
+* Initializes the intercept middleware.
+* @template O - The options type.
+* @param options - The FaireAuth options.
+* @returns The middleware function.
+*/
+const initInterceptMiddleware = (options) => {
+	const { beforeHooks, afterHooks } = getHooks(options);
+	return createMiddleware()(async (ctx, next) => {
+		const before = runIntercept(ctx, beforeHooks);
+		if (before instanceof Response) return before;
+		await next();
+		const after = runIntercept(ctx, afterHooks);
+		if (after instanceof Response) ctx.res = after;
+	});
+};
+
+//#endregion
+//#region src/api/middleware/on-disabled.ts
+/**
+* Initializes the middleware to handle disabled paths.
+* @param options - The FaireAuth options.
+* @returns The middleware function.
+*/
+const initHandleDisabledMiddleware = (options) => {
+	let disabledPaths = null;
+	return createMiddleware()(async (ctx, next) => {
+		disabledPaths ??= options.disabledPaths ?? [];
+		if (disabledPaths.includes(ctx.get("path"))) return ctx.notFound();
+		return await next();
+	});
+};
+
+//#endregion
+//#region src/api/middleware/rate-limit.ts
+const shouldRateLimit = (max, window, rateLimitData) => {
+	const now = Date.now();
+	const windowInMs = window * 1e3;
+	return now - rateLimitData.lastRequest < windowInMs && rateLimitData.count >= max;
+};
+const rateLimitResponse = (ctx, retryAfter) => {
+	ctx.header("X-Retry-After", retryAfter.toString());
+	return ctx.json({
+		status: False,
+		message: "Too many requests. Please try again later."
+	}, 429);
+};
+const getRetryAfter = (lastRequest, window) => {
+	const now = Date.now();
+	const windowInMs = window * 1e3;
+	return Math.ceil((lastRequest + windowInMs - now) / 1e3);
+};
+const createDBStorage = (ctx) => {
+	const model = "rateLimit";
+	const db = ctx.adapter;
+	return {
+		get: async (key) => {
+			const res$1 = db.findMany({
+				model,
+				where: [{
+					field: "key",
+					value: key
+				}]
+			});
+			const data = isPromise(res$1) ? (await res$1)[0] : res$1[0];
+			if (typeof data?.lastRequest === "bigint") data.lastRequest = Number(data.lastRequest);
+			return data;
+		},
+		set: async (key, value, _update) => {
+			try {
+				if (_update === true) {
+					const res$1 = db.updateMany({
+						model: "rateLimit",
+						where: [{
+							field: "key",
+							value: key
+						}],
+						update: {
+							count: value.count,
+							lastRequest: value.lastRequest
+						}
+					});
+					if (isPromise(res$1)) await res$1;
+				} else {
+					const res$1 = await db.create({
+						model: "rateLimit",
+						data: {
+							key,
+							count: value.count,
+							lastRequest: value.lastRequest
+						}
+					});
+					if (isPromise(res$1)) await res$1;
+				}
+			} catch (e) {
+				ctx.logger.error("Error setting rate limit", e);
+			}
+		}
+	};
+};
+const memory = /* @__PURE__ */ new Map();
+/**
+* Gets the rate limit storage based on the configuration.
+* @param context - The auth context with rateLimit, adapter, and logger.
+* @param options - The FaireAuth options with rateLimit and secondaryStorage.
+* @returns The storage object with get and set methods.
+*/
+const getRateLimitStorage = (config, context, options) => {
+	if (options.rateLimit?.customStorage) return options.rateLimit.customStorage;
+	if (config.storage === "secondary-storage") return {
+		get: (key) => {
+			const res$1 = options.secondaryStorage?.get(key);
+			return isPromise(res$1) ? res$1.then((r) => r ? safeJSONParse(r) : void 0) : res$1 ? safeJSONParse(res$1) : void 0;
+		},
+		set: (key, value) => options.secondaryStorage?.set(key, JSON.stringify(value))
+	};
+	if (config.storage === "memory") return {
+		get: (key) => memory.get(key),
+		set: (key, value, _update) => memory.set(key, value)
+	};
+	return createDBStorage(context);
+};
+const getDefaultSpecialRules = () => [{
+	pathMatcher: (path) => path.startsWith("/sign-in") || path.startsWith("/sign-up") || path.startsWith("/change-password") || path.startsWith("/change-email"),
+	window: 10,
+	max: 3
+}];
+/**
+* Initializes the rate limit middleware.
+* @param options - The FaireAuth options.
+* @returns The middleware function.
+*/
+const initRateLimitMiddleware = (options, rateLimit) => {
+	const specialRules = getDefaultSpecialRules();
+	return createMiddleware()(async (ctx, next) => {
+		if (!rateLimit.enabled) return await next();
+		const ip = getIp(ctx.req, options);
+		if (!ip) return await next();
+		const context = ctx.get("context");
+		const path = ctx.get("path");
+		const key = ip + path;
+		let window = rateLimit.window;
+		let max = rateLimit.max;
+		const specialRule = specialRules.find((rule) => rule.pathMatcher(path));
+		if (specialRule) {
+			window = specialRule.window;
+			max = specialRule.max;
+		}
+		for (const plugin of options.plugins ?? []) if (plugin.rateLimit) {
+			const matchedRule = plugin.rateLimit.find((rule) => rule.pathMatcher(path));
+			if (matchedRule) {
+				window = matchedRule.window;
+				max = matchedRule.max;
+				break;
+			}
+		}
+		if (rateLimit.customRules) {
+			const _path = Object.keys(rateLimit.customRules).find((p) => p.includes("*") ? wildcardMatch(p)(path) : p === path);
+			if (_path) {
+				const customRule = rateLimit.customRules[_path];
+				const res$2 = typeof customRule === "function" ? customRule(ctx.req) : customRule;
+				const resolved = isPromise(res$2) ? await res$2 : res$2;
+				if (resolved) {
+					window = resolved.window;
+					max = resolved.max;
+				}
+				if (resolved === false) return await next();
+			}
+		}
+		const storage = getRateLimitStorage(rateLimit, context, options);
+		const res$1 = storage.get(key);
+		const now = Date.now();
+		const data = isPromise(res$1) ? await res$1 : res$1;
+		if (!data) {
+			const res2 = storage.set(key, {
+				key,
+				count: 1,
+				lastRequest: now
+			});
+			if (isPromise(res2)) await res2;
+		} else {
+			const timeSinceLastRequest = now - data.lastRequest;
+			if (shouldRateLimit(max, window, data)) return rateLimitResponse(ctx, getRetryAfter(data.lastRequest, window));
+			if (timeSinceLastRequest > window * 1e3) {
+				const res3 = storage.set(key, {
+					...data,
+					count: 1,
+					lastRequest: now
+				}, true);
+				if (isPromise(res3)) await res3;
+			} else {
+				const res3 = storage.set(key, {
+					...data,
+					count: data.count + 1,
+					lastRequest: now
+				}, true);
+				if (isPromise(res3)) await res3;
+			}
+		}
+		return await next();
+	});
+};
+
+//#endregion
+//#region src/api/index.ts
+const router = (context, options) => {
+	const schemas = buildSchemas(SCHEMAS, options);
+	const { endpoints, hooks } = createEndpoints(options);
+	const { pub } = createArgs(endpoints, schemas, context, hooks);
+	const api = createAPI(endpoints);
+	let app = new OpenAPIHono(options).openapi(...pub[0]).openapi(...pub[1]).openapi(...pub[2]).openapi(...pub[3]).openapi(...pub[4]).openapi(...pub[5]).openapi(...pub[6]).openapi(...pub[7]).openapi(...pub[8]).openapi(...pub[9]).openapi(...pub[10]).openapi(...pub[11]).openapi(...pub[12]).openapi(...pub[13]).openapi(...pub[14]).openapi(...pub[15]).openapi(...pub[16]).openapi(...pub[17]).openapi(...pub[18]).openapi(...pub[19]).openapi(...pub[20]).openapi(...pub[21]).openapi(...pub[22]).openapi(...pub[23]).openapi(...pub[24]).openapi(...pub[25]).openapi(...pub[26]).openapi(...pub[27]).openapi(...pub[28]);
+	pub.slice(29).forEach((route) => app = app.openapi(...route));
+	return {
+		api,
+		app: new Hono({
+			router: new RegExpRouter(),
+			...options.hono?.init
+		}).basePath(options.basePath).use(setDefaultExecutionCtx, setRenderer, initContextMiddleware(options, context, endpoints), contextStorage(), initHandleDisabledMiddleware(options), initInterceptMiddleware(options), initRateLimitMiddleware(options, context.rateLimit), initOriginCheckMiddleware(options, context), initHooksMiddleware(options)).onError(initErrorHandler(options)).route("/", app)
+	};
+};
+
+//#endregion
+export { router as t };