@aura-stack/auth 0.1.0-rc.8 → 0.1.0

package/dist/actions/callback/callback.cjs

@@ -1,535 +1,517 @@
-"use strict"
-var __create = Object.create
-var __defProp = Object.defineProperty
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor
-var __getOwnPropNames = Object.getOwnPropertyNames
-var __getProtoOf = Object.getPrototypeOf
-var __hasOwnProp = Object.prototype.hasOwnProperty
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
-    for (var name in all) __defProp(target, name, { get: all[name], enumerable: true })
-}
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 var __copyProps = (to, from, except, desc) => {
-    if ((from && typeof from === "object") || typeof from === "function") {
-        for (let key of __getOwnPropNames(from))
-            if (!__hasOwnProp.call(to, key) && key !== except)
-                __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable })
-    }
-    return to
-}
-var __toESM = (mod, isNodeMode, target) => (
-    (target = mod != null ? __create(__getProtoOf(mod)) : {}),
-    __copyProps(
-        // If the importer is in node compatibility mode or this is not an ESM
-        // file that has been converted to a CommonJS file using a Babel-
-        // compatible transform (i.e. "__esModule" has not been set), then set
-        // "default" to the CommonJS "module.exports" for node compatibility.
-        isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-        mod
-    )
-)
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod)
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/actions/callback/callback.ts
-var callback_exports = {}
+var callback_exports = {};
 __export(callback_exports, {
-    callbackAction: () => callbackAction,
-})
-module.exports = __toCommonJS(callback_exports)
-var import_zod = __toESM(require("zod"), 1)
-var import_router2 = require("@aura-stack/router")
+  callbackAction: () => callbackAction
+});
+module.exports = __toCommonJS(callback_exports);
+var import_zod = __toESM(require("zod"), 1);
+var import_router2 = require("@aura-stack/router");
 
 // src/secure.ts
-var import_node_crypto = __toESM(require("crypto"), 1)
+var import_node_crypto = __toESM(require("crypto"), 1);
 
 // src/utils.ts
-var import_router = require("@aura-stack/router")
+var import_router = require("@aura-stack/router");
 
 // src/error.ts
 var AuthError = class extends Error {
-    constructor(type, message) {
-        super(message)
-        this.type = type
-        this.name = "AuthError"
-    }
-}
+  constructor(type, message) {
+    super(message);
+    this.type = type;
+    this.name = "AuthError";
+  }
+};
 var isAuthError = (error) => {
-    return error instanceof AuthError
-}
+  return error instanceof AuthError;
+};
 var throwAuthError = (error, message) => {
-    if (error instanceof Error) {
-        if (isAuthError(error)) {
-            throw error
-        }
-        throw new AuthError("invalid_request", error.message ?? message)
+  if (error instanceof Error) {
+    if (isAuthError(error)) {
+      throw error;
     }
-}
+    throw new AuthError("invalid_request", error.message ?? message);
+  }
+};
 var ERROR_RESPONSE = {
-    AUTHORIZATION: {
-        INVALID_REQUEST: "invalid_request",
-        UNAUTHORIZED_CLIENT: "unauthorized_client",
-        ACCESS_DENIED: "access_denied",
-        UNSUPPORTED_RESPONSE_TYPE: "unsupported_response_type",
-        INVALID_SCOPE: "invalid_scope",
-        SERVER_ERROR: "server_error",
-        TEMPORARILY_UNAVAILABLE: "temporarily_unavailable",
-    },
-    ACCESS_TOKEN: {
-        INVALID_REQUEST: "invalid_request",
-        INVALID_CLIENT: "invalid_client",
-        INVALID_GRANT: "invalid_grant",
-        UNAUTHORIZED_CLIENT: "unauthorized_client",
-        UNSUPPORTED_GRANT_TYPE: "unsupported_grant_type",
-        INVALID_SCOPE: "invalid_scope",
-    },
-}
+  AUTHORIZATION: {
+    INVALID_REQUEST: "invalid_request",
+    UNAUTHORIZED_CLIENT: "unauthorized_client",
+    ACCESS_DENIED: "access_denied",
+    UNSUPPORTED_RESPONSE_TYPE: "unsupported_response_type",
+    INVALID_SCOPE: "invalid_scope",
+    SERVER_ERROR: "server_error",
+    TEMPORARILY_UNAVAILABLE: "temporarily_unavailable"
+  },
+  ACCESS_TOKEN: {
+    INVALID_REQUEST: "invalid_request",
+    INVALID_CLIENT: "invalid_client",
+    INVALID_GRANT: "invalid_grant",
+    UNAUTHORIZED_CLIENT: "unauthorized_client",
+    UNSUPPORTED_GRANT_TYPE: "unsupported_grant_type",
+    INVALID_SCOPE: "invalid_scope"
+  }
+};
 
 // src/utils.ts
 var equals = (a, b) => {
-    if (a === null || b === null || a === void 0 || b === void 0) return false
-    return a === b
-}
+  if (a === null || b === null || a === void 0 || b === void 0) return false;
+  return a === b;
+};
 var sanitizeURL = (url2) => {
-    try {
-        let decodedURL = decodeURIComponent(url2).trim()
-        const protocolMatch = decodedURL.match(/^([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)/)
-        let protocol = ""
-        let rest = decodedURL
-        if (protocolMatch) {
-            protocol = protocolMatch[1]
-            rest = decodedURL.slice(protocol.length)
-            const slashIndex = rest.indexOf("/")
-            if (slashIndex === -1) {
-                return protocol + rest
-            }
-            const domain = rest.slice(0, slashIndex)
-            let path = rest
-                .slice(slashIndex)
-                .replace(/\/\.\.\//g, "/")
-                .replace(/\/\.\.$/, "")
-                .replace(/\.{2,}/g, "")
-                .replace(/\/{2,}/g, "/")
-            if (path !== "/" && path.endsWith("/")) {
-                path = path.replace(/\/+$/, "/")
-            } else if (path !== "/") {
-                path = path.replace(/\/+$/, "")
-            }
-            return protocol + domain + path
-        }
-        let sanitized = decodedURL
-            .replace(/\/\.\.\//g, "/")
-            .replace(/\/\.\.$/, "")
-            .replace(/\.{2,}/g, "")
-            .replace(/\/{2,}/g, "/")
-        if (sanitized !== "/" && sanitized.endsWith("/")) {
-            sanitized = sanitized.replace(/\/+$/, "/")
-        } else if (sanitized !== "/") {
-            sanitized = sanitized.replace(/\/+$/, "")
-        }
-        return sanitized
-    } catch {
-        return url2.trim()
+  try {
+    let decodedURL = decodeURIComponent(url2).trim();
+    const protocolMatch = decodedURL.match(/^([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)/);
+    let protocol = "";
+    let rest = decodedURL;
+    if (protocolMatch) {
+      protocol = protocolMatch[1];
+      rest = decodedURL.slice(protocol.length);
+      const slashIndex = rest.indexOf("/");
+      if (slashIndex === -1) {
+        return protocol + rest;
+      }
+      const domain = rest.slice(0, slashIndex);
+      let path = rest.slice(slashIndex).replace(/\/\.\.\//g, "/").replace(/\/\.\.$/, "").replace(/\.{2,}/g, "").replace(/\/{2,}/g, "/");
+      if (path !== "/" && path.endsWith("/")) {
+        path = path.replace(/\/+$/, "/");
+      } else if (path !== "/") {
+        path = path.replace(/\/+$/, "");
+      }
+      return protocol + domain + path;
+    }
+    let sanitized = decodedURL.replace(/\/\.\.\//g, "/").replace(/\/\.\.$/, "").replace(/\.{2,}/g, "").replace(/\/{2,}/g, "/");
+    if (sanitized !== "/" && sanitized.endsWith("/")) {
+      sanitized = sanitized.replace(/\/+$/, "/");
+    } else if (sanitized !== "/") {
+      sanitized = sanitized.replace(/\/+$/, "");
     }
-}
+    return sanitized;
+  } catch {
+    return url2.trim();
+  }
+};
 var isValidRelativePath = (path) => {
-    if (!path || typeof path !== "string") return false
-    if (!path.startsWith("/") || path.includes("://") || path.includes("\r") || path.includes("\n")) return false
-    if (/[\x00-\x1F\x7F]/.test(path) || path.includes("\0")) return false
-    const sanitized = sanitizeURL(path)
-    if (sanitized.includes("..")) return false
-    return true
-}
+  if (!path || typeof path !== "string") return false;
+  if (!path.startsWith("/") || path.includes("://") || path.includes("\r") || path.includes("\n")) return false;
+  if (/[\x00-\x1F\x7F]/.test(path) || path.includes("\0")) return false;
+  const sanitized = sanitizeURL(path);
+  if (sanitized.includes("..")) return false;
+  return true;
+};
 
 // src/secure.ts
 var generateSecure = (length = 32) => {
-    return import_node_crypto.default.randomBytes(length).toString("base64url")
-}
+  return import_node_crypto.default.randomBytes(length).toString("base64url");
+};
 var createCSRF = async (jose, csrfCookie) => {
-    try {
-        const token = generateSecure(32)
-        if (csrfCookie) {
-            await jose.verifyJWS(csrfCookie)
-            return csrfCookie
-        }
-        return jose.signJWS({ token })
-    } catch {
-        const token = generateSecure(32)
-        return jose.signJWS({ token })
+  try {
+    const token = generateSecure(32);
+    if (csrfCookie) {
+      await jose.verifyJWS(csrfCookie);
+      return csrfCookie;
     }
-}
+    return jose.signJWS({ token });
+  } catch {
+    const token = generateSecure(32);
+    return jose.signJWS({ token });
+  }
+};
 
 // src/headers.ts
 var cacheControl = {
-    "Cache-Control": "no-store",
-    Pragma: "no-cache",
-    Expires: "0",
-    Vary: "Cookie",
-}
+  "Cache-Control": "no-store",
+  Pragma: "no-cache",
+  Expires: "0",
+  Vary: "Cookie"
+};
 
 // src/schemas.ts
-var import_v4 = require("zod/v4")
+var import_v4 = require("zod/v4");
 var OAuthProviderConfigSchema = (0, import_v4.object)({
-    authorizeURL: (0, import_v4.url)(),
-    accessToken: (0, import_v4.url)(),
-    scope: (0, import_v4.string)().optional(),
-    userInfo: (0, import_v4.url)(),
-    responseType: (0, import_v4.enum)(["code", "token", "id_token"]),
-    clientId: (0, import_v4.string)(),
-    clientSecret: (0, import_v4.string)(),
-})
+  authorizeURL: (0, import_v4.url)(),
+  accessToken: (0, import_v4.url)(),
+  scope: (0, import_v4.string)().optional(),
+  userInfo: (0, import_v4.url)(),
+  responseType: (0, import_v4.enum)(["code", "token", "id_token"]),
+  clientId: (0, import_v4.string)(),
+  clientSecret: (0, import_v4.string)()
+});
 var OAuthAuthorization = OAuthProviderConfigSchema.extend({
-    redirectURI: (0, import_v4.string)(),
-    state: (0, import_v4.string)(),
-    codeChallenge: (0, import_v4.string)(),
-    codeChallengeMethod: (0, import_v4.enum)(["plain", "S256"]),
-})
+  redirectURI: (0, import_v4.string)(),
+  state: (0, import_v4.string)(),
+  codeChallenge: (0, import_v4.string)(),
+  codeChallengeMethod: (0, import_v4.enum)(["plain", "S256"])
+});
 var OAuthAuthorizationResponse = (0, import_v4.object)({
-    state: (0, import_v4.string)(),
-    code: (0, import_v4.string)(),
-})
+  state: (0, import_v4.string)(),
+  code: (0, import_v4.string)()
+});
 var OAuthAuthorizationErrorResponse = (0, import_v4.object)({
-    error: (0, import_v4.enum)([
-        "invalid_request",
-        "unauthorized_client",
-        "access_denied",
-        "unsupported_response_type",
-        "invalid_scope",
-        "server_error",
-        "temporarily_unavailable",
-    ]),
-    error_description: (0, import_v4.string)().optional(),
-    error_uri: (0, import_v4.string)().optional(),
-    state: (0, import_v4.string)(),
-})
+  error: (0, import_v4.enum)([
+    "invalid_request",
+    "unauthorized_client",
+    "access_denied",
+    "unsupported_response_type",
+    "invalid_scope",
+    "server_error",
+    "temporarily_unavailable"
+  ]),
+  error_description: (0, import_v4.string)().optional(),
+  error_uri: (0, import_v4.string)().optional(),
+  state: (0, import_v4.string)()
+});
 var OAuthAccessToken = OAuthProviderConfigSchema.extend({
-    redirectURI: (0, import_v4.string)(),
-    code: (0, import_v4.string)(),
-    codeVerifier: (0, import_v4.string)().min(43).max(128),
-})
+  redirectURI: (0, import_v4.string)(),
+  code: (0, import_v4.string)(),
+  codeVerifier: (0, import_v4.string)().min(43).max(128)
+});
 var OAuthAccessTokenResponse = (0, import_v4.object)({
-    access_token: (0, import_v4.string)(),
-    token_type: (0, import_v4.string)(),
-    expires_in: (0, import_v4.number)().optional(),
-    refresh_token: (0, import_v4.string)().optional(),
-    scope: (0, import_v4.string)().optional(),
-})
+  access_token: (0, import_v4.string)(),
+  token_type: (0, import_v4.string)(),
+  expires_in: (0, import_v4.number)().optional(),
+  refresh_token: (0, import_v4.string)().optional(),
+  scope: (0, import_v4.string)().optional()
+});
 var OAuthAccessTokenErrorResponse = (0, import_v4.object)({
-    error: (0, import_v4.enum)([
-        "invalid_request",
-        "invalid_client",
-        "invalid_grant",
-        "unauthorized_client",
-        "unsupported_grant_type",
-        "invalid_scope",
-    ]),
-    error_description: (0, import_v4.string)().optional(),
-    error_uri: (0, import_v4.string)().optional(),
-})
+  error: (0, import_v4.enum)([
+    "invalid_request",
+    "invalid_client",
+    "invalid_grant",
+    "unauthorized_client",
+    "unsupported_grant_type",
+    "invalid_scope"
+  ]),
+  error_description: (0, import_v4.string)().optional(),
+  error_uri: (0, import_v4.string)().optional()
+});
 var OAuthErrorResponse = (0, import_v4.object)({
-    error: (0, import_v4.string)(),
-    error_description: (0, import_v4.string)().optional(),
-})
+  error: (0, import_v4.string)(),
+  error_description: (0, import_v4.string)().optional()
+});
 
 // src/actions/callback/userinfo.ts
 var getDefaultUserInfo = (profile) => {
-    const sub = generateSecure(16)
-    return {
-        sub: profile?.id ?? profile?.sub ?? sub,
-        email: profile?.email,
-        name: profile?.name ?? profile?.username ?? profile?.nickname,
-        image: profile?.image ?? profile?.picture,
-    }
-}
+  const sub = generateSecure(16);
+  return {
+    sub: profile?.id ?? profile?.sub ?? sub,
+    email: profile?.email,
+    name: profile?.name ?? profile?.username ?? profile?.nickname,
+    image: profile?.image ?? profile?.picture
+  };
+};
 var getUserInfo = async (oauthConfig, accessToken) => {
-    const userinfoEndpoint = oauthConfig.userInfo
-    try {
-        const response = await fetch(userinfoEndpoint, {
-            method: "GET",
-            headers: {
-                Accept: "application/json",
-                Authorization: `Bearer ${accessToken}`,
-            },
-        })
-        const json = await response.json()
-        const { success, data } = OAuthErrorResponse.safeParse(json)
-        if (success) {
-            throw new AuthError(data.error, data?.error_description ?? "An error occurred while fetching user information.")
-        }
-        return oauthConfig?.profile ? oauthConfig.profile(json) : getDefaultUserInfo(json)
-    } catch (error) {
-        throw throwAuthError(error, "Failed to retrieve userinfo")
+  const userinfoEndpoint = oauthConfig.userInfo;
+  try {
+    const response = await fetch(userinfoEndpoint, {
+      method: "GET",
+      headers: {
+        Accept: "application/json",
+        Authorization: `Bearer ${accessToken}`
+      }
+    });
+    const json = await response.json();
+    const { success, data } = OAuthErrorResponse.safeParse(json);
+    if (success) {
+      throw new AuthError(data.error, data?.error_description ?? "An error occurred while fetching user information.");
     }
-}
+    return oauthConfig?.profile ? oauthConfig.profile(json) : getDefaultUserInfo(json);
+  } catch (error) {
+    throw throwAuthError(error, "Failed to retrieve userinfo");
+  }
+};
 
 // src/response.ts
 var AuraResponse = class extends Response {
-    static json(body, init) {
-        return Response.json(body, init)
-    }
-}
+  static json(body, init) {
+    return Response.json(body, init);
+  }
+};
 
 // src/actions/callback/access-token.ts
 var createAccessToken = async (oauthConfig, redirectURI, code, codeVerifier) => {
-    const parsed = OAuthAccessToken.safeParse({ ...oauthConfig, redirectURI, code, codeVerifier })
-    if (!parsed.success) {
-        throw new AuthError(ERROR_RESPONSE.ACCESS_TOKEN.INVALID_REQUEST, "Invalid OAuth configuration")
-    }
-    const { accessToken, clientId, clientSecret, code: codeParsed, redirectURI: redirectParsed } = parsed.data
-    try {
-        const response = await fetch(accessToken, {
-            method: "POST",
-            headers: {
-                Accept: "application/json",
-                "Content-Type": "application/x-www-form-urlencoded",
-            },
-            body: new URLSearchParams({
-                client_id: clientId,
-                client_secret: clientSecret,
-                code: codeParsed,
-                redirect_uri: redirectParsed,
-                grant_type: "authorization_code",
-                code_verifier: codeVerifier,
-            }).toString(),
-        })
-        const json = await response.json()
-        const token = OAuthAccessTokenResponse.safeParse(json)
-        if (!token.success) {
-            const { success, data } = OAuthAccessTokenErrorResponse.safeParse(json)
-            if (!success) {
-                throw new AuthError(ERROR_RESPONSE.ACCESS_TOKEN.INVALID_GRANT, "Invalid access token response format")
-            }
-            throw new AuthError(data.error, data?.error_description ?? "Failed to retrieve access token")
-        }
-        return token.data
-    } catch (error) {
-        throw throwAuthError(error, "Failed to create access token")
+  const parsed = OAuthAccessToken.safeParse({ ...oauthConfig, redirectURI, code, codeVerifier });
+  if (!parsed.success) {
+    throw new AuthError(ERROR_RESPONSE.ACCESS_TOKEN.INVALID_REQUEST, "Invalid OAuth configuration");
+  }
+  const { accessToken, clientId, clientSecret, code: codeParsed, redirectURI: redirectParsed } = parsed.data;
+  try {
+    const response = await fetch(accessToken, {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/x-www-form-urlencoded"
+      },
+      body: new URLSearchParams({
+        client_id: clientId,
+        client_secret: clientSecret,
+        code: codeParsed,
+        redirect_uri: redirectParsed,
+        grant_type: "authorization_code",
+        code_verifier: codeVerifier
+      }).toString()
+    });
+    const json = await response.json();
+    const token = OAuthAccessTokenResponse.safeParse(json);
+    if (!token.success) {
+      const { success, data } = OAuthAccessTokenErrorResponse.safeParse(json);
+      if (!success) {
+        throw new AuthError(ERROR_RESPONSE.ACCESS_TOKEN.INVALID_GRANT, "Invalid access token response format");
+      }
+      throw new AuthError(data.error, data?.error_description ?? "Failed to retrieve access token");
     }
-}
+    return token.data;
+  } catch (error) {
+    throw throwAuthError(error, "Failed to create access token");
+  }
+};
 
 // src/cookie.ts
-var import_cookie = require("cookie")
+var import_cookie = require("cookie");
 
 // src/assert.ts
 var isRequest = (value) => {
-    return typeof Request !== "undefined" && value instanceof Request
-}
+  return typeof Request !== "undefined" && value instanceof Request;
+};
 
 // src/cookie.ts
-var import_cookie2 = require("cookie")
-var COOKIE_NAME = "aura-auth"
+var import_cookie2 = require("cookie");
+var COOKIE_NAME = "aura-auth";
 var defaultCookieOptions = {
-    httpOnly: true,
-    sameSite: "lax",
-    path: "/",
-    maxAge: 60 * 60 * 24 * 15,
-}
+  httpOnly: true,
+  sameSite: "lax",
+  path: "/",
+  maxAge: 60 * 60 * 24 * 15
+};
 var defaultStandardCookieConfig = {
-    secure: false,
-    httpOnly: true,
-    prefix: "",
-}
+  secure: false,
+  httpOnly: true,
+  prefix: ""
+};
 var defaultSecureCookieConfig = {
-    secure: true,
-    prefix: "__Secure-",
-}
+  secure: true,
+  prefix: "__Secure-"
+};
 var defaultHostCookieConfig = {
-    secure: true,
-    prefix: "__Host-",
-    path: "/",
-    domain: void 0,
-}
+  secure: true,
+  prefix: "__Host-",
+  path: "/",
+  domain: void 0
+};
 var expiredCookieOptions = {
-    ...defaultCookieOptions,
-    expires: /* @__PURE__ */ new Date(0),
-    maxAge: 0,
-}
+  ...defaultCookieOptions,
+  expires: /* @__PURE__ */ new Date(0),
+  maxAge: 0
+};
 var defineDefaultCookieOptions = (options2) => {
-    return {
-        name: options2?.name ?? COOKIE_NAME,
-        prefix: options2?.prefix ?? (options2?.secure ? "__Secure-" : ""),
-        ...defaultCookieOptions,
-        ...options2,
-    }
-}
+  return {
+    name: options2?.name ?? COOKIE_NAME,
+    prefix: options2?.prefix ?? (options2?.secure ? "__Secure-" : ""),
+    ...defaultCookieOptions,
+    ...options2
+  };
+};
 var setCookie = (cookieName, value, options2) => {
-    const { prefix, name } = defineDefaultCookieOptions(options2)
-    const cookieNameWithPrefix = `${prefix}${name}.${cookieName}`
-    return (0, import_cookie.serialize)(cookieNameWithPrefix, value, {
-        ...defaultCookieOptions,
-        ...options2,
-    })
-}
+  const { prefix, name } = defineDefaultCookieOptions(options2);
+  const cookieNameWithPrefix = `${prefix}${name}.${cookieName}`;
+  return (0, import_cookie.serialize)(cookieNameWithPrefix, value, {
+    ...defaultCookieOptions,
+    ...options2
+  });
+};
 var getCookie = (petition, cookie, options2, optional = false) => {
-    const cookies = isRequest(petition) ? petition.headers.get("Cookie") : petition.headers.getSetCookie().join("; ")
-    if (!cookies) {
-        if (optional) {
-            return ""
-        }
-        throw new AuthError("invalid_request", "No cookies found. There is no active session")
+  const cookies = isRequest(petition) ? petition.headers.get("Cookie") : petition.headers.getSetCookie().join("; ");
+  if (!cookies) {
+    if (optional) {
+      return "";
     }
-    const { name, prefix } = defineDefaultCookieOptions(options2)
-    const parsedCookies = (0, import_cookie.parse)(cookies)
-    const value = parsedCookies[`${prefix}${name}.${cookie}`]
-    if (value === void 0) {
-        if (optional) {
-            return ""
-        }
-        throw new AuthError("invalid_request", `Cookie "${cookie}" not found. There is no active session`)
+    throw new AuthError("invalid_request", "No cookies found. There is no active session");
+  }
+  const { name, prefix } = defineDefaultCookieOptions(options2);
+  const parsedCookies = (0, import_cookie.parse)(cookies);
+  const value = parsedCookies[`${prefix}${name}.${cookie}`];
+  if (value === void 0) {
+    if (optional) {
+      return "";
     }
-    return value
-}
+    throw new AuthError("invalid_request", `Cookie "${cookie}" not found. There is no active session`);
+  }
+  return value;
+};
 var createSessionCookie = async (session, cookieOptions, jose) => {
-    try {
-        const encoded = await jose.encodeJWT(session)
-        return setCookie("sessionToken", encoded, cookieOptions)
-    } catch (error) {
-        throw new AuthError("server_error", "Failed to create session cookie", { cause: error })
-    }
-}
+  try {
+    const encoded = await jose.encodeJWT(session);
+    return setCookie("sessionToken", encoded, cookieOptions);
+  } catch (error) {
+    throw new AuthError("server_error", "Failed to create session cookie", { cause: error });
+  }
+};
 var secureCookieOptions = (request, cookieOptions, trustedProxyHeaders) => {
-    const name = cookieOptions.name ?? COOKIE_NAME
-    const isSecure = trustedProxyHeaders
-        ? request.url.startsWith("https://") ||
-          request.headers.get("X-Forwarded-Proto") === "https" ||
-          request.headers.get("Forwarded")?.includes("proto=https")
-        : request.url.startsWith("https://")
-    if (!cookieOptions.options?.httpOnly) {
-        console.warn(
-            "[WARNING]: Cookie is configured without HttpOnly. This allows JavaScript access via document.cookie and increases XSS risk."
-        )
+  const name = cookieOptions.name ?? COOKIE_NAME;
+  const isSecure = trustedProxyHeaders ? request.url.startsWith("https://") || request.headers.get("X-Forwarded-Proto") === "https" || request.headers.get("Forwarded")?.includes("proto=https") : request.url.startsWith("https://");
+  if (!cookieOptions.options?.httpOnly) {
+    console.warn(
+      "[WARNING]: Cookie is configured without HttpOnly. This allows JavaScript access via document.cookie and increases XSS risk."
+    );
+  }
+  if (cookieOptions.options?.domain === "*") {
+    console.warn("[WARNING]: Cookie 'Domain' is set to '*', which is insecure. Avoid wildcard domains.");
+  }
+  if (!isSecure) {
+    const options2 = cookieOptions.options;
+    if (options2?.secure) {
+      console.warn(
+        "[WARNING]: The 'Secure' attribute will be disabled for this cookie. Serve over HTTPS to enforce Secure cookies."
+      );
     }
-    if (cookieOptions.options?.domain === "*") {
-        console.warn("[WARNING]: Cookie 'Domain' is set to '*', which is insecure. Avoid wildcard domains.")
+    if (options2?.sameSite == "none") {
+      console.warn("[WARNING]: SameSite=None without a secure connection can be blocked by browsers.");
     }
-    if (!isSecure) {
-        const options2 = cookieOptions.options
-        if (options2?.secure) {
-            console.warn(
-                "[WARNING]: The 'Secure' attribute will be disabled for this cookie. Serve over HTTPS to enforce Secure cookies."
-            )
-        }
-        if (options2?.sameSite == "none") {
-            console.warn("[WARNING]: SameSite=None without a secure connection can be blocked by browsers.")
-        }
-        if (process.env.NODE_ENV === "production") {
-            console.warn("[WARNING]: In production, ensure cookies are served over HTTPS to maintain security.")
-        }
-        return {
-            ...defaultCookieOptions,
-            ...cookieOptions.options,
-            sameSite: options2?.sameSite === "none" ? "lax" : (options2?.sameSite ?? "lax"),
-            ...defaultStandardCookieConfig,
-            name,
-        }
+    if (process.env.NODE_ENV === "production") {
+      console.warn("[WARNING]: In production, ensure cookies are served over HTTPS to maintain security.");
     }
-    return cookieOptions.strategy === "host"
-        ? {
-              ...defaultCookieOptions,
-              ...cookieOptions.options,
-              ...defaultHostCookieConfig,
-              name,
-          }
-        : { ...defaultCookieOptions, ...cookieOptions.options, ...defaultSecureCookieConfig, name }
-}
+    return {
+      ...defaultCookieOptions,
+      ...cookieOptions.options,
+      sameSite: options2?.sameSite === "none" ? "lax" : options2?.sameSite ?? "lax",
+      ...defaultStandardCookieConfig,
+      name
+    };
+  }
+  return cookieOptions.strategy === "host" ? {
+    ...defaultCookieOptions,
+    ...cookieOptions.options,
+    ...defaultHostCookieConfig,
+    name
+  } : { ...defaultCookieOptions, ...cookieOptions.options, ...defaultSecureCookieConfig, name };
+};
 var expireCookie = (name, options2) => {
-    return setCookie(name, "", { ...options2, ...expiredCookieOptions })
-}
+  return setCookie(name, "", { ...options2, ...expiredCookieOptions });
+};
 
 // src/actions/callback/callback.ts
 var callbackConfig = (oauth) => {
-    return (0, import_router2.createEndpointConfig)("/callback/:oauth", {
-        schemas: {
-            searchParams: OAuthAuthorizationResponse,
-            params: import_zod.default.object({
-                oauth: import_zod.default.enum(Object.keys(oauth)),
-            }),
-        },
-        middlewares: [
-            (ctx) => {
-                const response = OAuthAuthorizationErrorResponse.safeParse(ctx.searchParams)
-                if (response.success) {
-                    const { error, error_description } = response.data
-                    throw new AuthError(error, error_description ?? "OAuth Authorization Error")
-                }
-                return ctx
-            },
-        ],
-    })
-}
+  return (0, import_router2.createEndpointConfig)("/callback/:oauth", {
+    schemas: {
+      searchParams: OAuthAuthorizationResponse,
+      params: import_zod.default.object({
+        oauth: import_zod.default.enum(Object.keys(oauth))
+      })
+    },
+    middlewares: [
+      (ctx) => {
+        const response = OAuthAuthorizationErrorResponse.safeParse(ctx.searchParams);
+        if (response.success) {
+          const { error, error_description } = response.data;
+          throw new AuthError(error, error_description ?? "OAuth Authorization Error");
+        }
+        return ctx;
+      }
+    ]
+  });
+};
 var callbackAction = (oauth) => {
-    return (0, import_router2.createEndpoint)(
-        "GET",
-        "/callback/:oauth",
-        async (ctx) => {
-            const {
-                request,
-                params: { oauth: oauth2 },
-                searchParams: { code, state },
-                context: { oauth: providers, cookies, jose, trustedProxyHeaders },
-            } = ctx
-            try {
-                const oauthConfig = providers[oauth2]
-                const cookieOptions = secureCookieOptions(request, cookies, trustedProxyHeaders)
-                const cookieState = getCookie(request, "state", cookieOptions)
-                const cookieRedirectTo = getCookie(request, "redirect_to", cookieOptions)
-                const cookieRedirectURI = getCookie(request, "redirect_uri", cookieOptions)
-                const codeVerifier = getCookie(request, "code_verifier", cookieOptions)
-                if (!equals(cookieState, state)) {
-                    throw new AuthError(ERROR_RESPONSE.ACCESS_TOKEN.INVALID_REQUEST, "Mismatching state")
-                }
-                const accessToken = await createAccessToken(oauthConfig, cookieRedirectURI, code, codeVerifier)
-                const sanitized = sanitizeURL(cookieRedirectTo)
-                if (!isValidRelativePath(sanitized)) {
-                    throw new AuthError(
-                        ERROR_RESPONSE.ACCESS_TOKEN.INVALID_REQUEST,
-                        "Invalid redirect path. Potential open redirect attack detected."
-                    )
-                }
-                const headers = new Headers(cacheControl)
-                headers.set("Location", sanitized)
-                const userInfo = await getUserInfo(oauthConfig, accessToken.access_token)
-                const sessionCookie = await createSessionCookie(userInfo, cookieOptions, jose)
-                const csrfToken = await createCSRF(jose)
-                const csrfCookie = setCookie(
-                    "csrfToken",
-                    csrfToken,
-                    secureCookieOptions(
-                        request,
-                        {
-                            ...cookies,
-                            strategy: "host",
-                        },
-                        trustedProxyHeaders
-                    )
-                )
-                headers.set("Set-Cookie", sessionCookie)
-                headers.append("Set-Cookie", expireCookie("state", cookieOptions))
-                headers.append("Set-Cookie", expireCookie("redirect_uri", cookieOptions))
-                headers.append("Set-Cookie", expireCookie("redirect_to", cookieOptions))
-                headers.append("Set-Cookie", expireCookie("code_verifier", cookieOptions))
-                headers.append("Set-Cookie", csrfCookie)
-                return Response.json({ oauth: oauth2 }, { status: 302, headers })
-            } catch (error) {
-                if (isAuthError(error)) {
-                    const { type, message } = error
-                    return AuraResponse.json(
-                        { error: type, error_description: message },
-                        { status: import_router2.statusCode.BAD_REQUEST }
-                    )
-                }
-                return AuraResponse.json(
-                    {
-                        error: ERROR_RESPONSE.ACCESS_TOKEN.INVALID_CLIENT,
-                        error_description: "An unexpected error occurred",
-                    },
-                    { status: import_router2.statusCode.INTERNAL_SERVER_ERROR }
-                )
-            }
-        },
-        callbackConfig(oauth)
-    )
-}
+  return (0, import_router2.createEndpoint)(
+    "GET",
+    "/callback/:oauth",
+    async (ctx) => {
+      const {
+        request,
+        params: { oauth: oauth2 },
+        searchParams: { code, state },
+        context: { oauth: providers, cookies, jose, trustedProxyHeaders }
+      } = ctx;
+      try {
+        const oauthConfig = providers[oauth2];
+        const cookieOptions = secureCookieOptions(request, cookies, trustedProxyHeaders);
+        const cookieState = getCookie(request, "state", cookieOptions);
+        const cookieRedirectTo = getCookie(request, "redirect_to", cookieOptions);
+        const cookieRedirectURI = getCookie(request, "redirect_uri", cookieOptions);
+        const codeVerifier = getCookie(request, "code_verifier", cookieOptions);
+        if (!equals(cookieState, state)) {
+          throw new AuthError(ERROR_RESPONSE.ACCESS_TOKEN.INVALID_REQUEST, "Mismatching state");
+        }
+        const accessToken = await createAccessToken(oauthConfig, cookieRedirectURI, code, codeVerifier);
+        const sanitized = sanitizeURL(cookieRedirectTo);
+        if (!isValidRelativePath(sanitized)) {
+          throw new AuthError(
+            ERROR_RESPONSE.ACCESS_TOKEN.INVALID_REQUEST,
+            "Invalid redirect path. Potential open redirect attack detected."
+          );
+        }
+        const headers = new Headers(cacheControl);
+        headers.set("Location", sanitized);
+        const userInfo = await getUserInfo(oauthConfig, accessToken.access_token);
+        const sessionCookie = await createSessionCookie(userInfo, cookieOptions, jose);
+        const csrfToken = await createCSRF(jose);
+        const csrfCookie = setCookie(
+          "csrfToken",
+          csrfToken,
+          secureCookieOptions(
+            request,
+            {
+              ...cookies,
+              strategy: "host"
+            },
+            trustedProxyHeaders
+          )
+        );
+        headers.set("Set-Cookie", sessionCookie);
+        headers.append("Set-Cookie", expireCookie("state", cookieOptions));
+        headers.append("Set-Cookie", expireCookie("redirect_uri", cookieOptions));
+        headers.append("Set-Cookie", expireCookie("redirect_to", cookieOptions));
+        headers.append("Set-Cookie", expireCookie("code_verifier", cookieOptions));
+        headers.append("Set-Cookie", csrfCookie);
+        return Response.json({ oauth: oauth2 }, { status: 302, headers });
+      } catch (error) {
+        if (isAuthError(error)) {
+          const { type, message } = error;
+          return AuraResponse.json(
+            { error: type, error_description: message },
+            { status: import_router2.statusCode.BAD_REQUEST }
+          );
+        }
+        return AuraResponse.json(
+          {
+            error: ERROR_RESPONSE.ACCESS_TOKEN.INVALID_CLIENT,
+            error_description: "An unexpected error occurred"
+          },
+          { status: import_router2.statusCode.INTERNAL_SERVER_ERROR }
+        );
+      }
+    },
+    callbackConfig(oauth)
+  );
+};
 // Annotate the CommonJS export names for ESM import in node:
-0 &&
-    (module.exports = {
-        callbackAction,
-    })
+0 && (module.exports = {
+  callbackAction
+});