@aura-stack/auth 0.4.0-rc.5 → 0.5.0

package/dist/context.cjs

@@ -0,0 +1,1237 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/context.ts
+var context_exports = {};
+__export(context_exports, {
+  createContext: () => createContext
+});
+module.exports = __toCommonJS(context_exports);
+
+// src/env.ts
+var import_meta = {};
+var env = new Proxy({}, {
+  get(_, prop) {
+    if (typeof prop !== "string") return void 0;
+    const hasProperty = (process2) => {
+      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
+    };
+    try {
+      if (typeof process !== "undefined" && hasProperty(process.env)) {
+        return process.env[prop];
+      }
+      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
+        return import_meta.env[prop];
+      }
+      if (typeof Deno !== "undefined" && Deno.env?.get) {
+        return Deno.env.get(prop);
+      }
+      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
+        return Bun.env[prop];
+      }
+      const globalValue = globalThis[prop];
+      return typeof globalValue === "string" ? globalValue : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+});
+var getEnv = (key) => {
+  const keys = [`AURA_AUTH_${key.toUpperCase()}`, `AURA_${key.toUpperCase()}`, `AUTH_${key.toUpperCase()}`, key.toUpperCase()];
+  return env[keys.find((k) => env[k]) ?? ""];
+};
+var getEnvBoolean = (key) => {
+  const value = getEnv(key);
+  if (value === void 0) return false;
+  const normalized = value.trim().toLowerCase();
+  if (["1", "true", "yes", "on", "debug"].includes(normalized)) return true;
+  return false;
+};
+var getEnvArray = (key, defaultValue = []) => {
+  const value = getEnv(key);
+  if (!value) return defaultValue;
+  return value.split(/[,;\n]+/).map((v) => v.trim()).filter(Boolean);
+};
+
+// src/jose.ts
+var import_jose = require("@aura-stack/jose");
+
+// src/errors.ts
+var AuthInternalError = class extends Error {
+  type = "AUTH_INTERNAL_ERROR";
+  code;
+  constructor(code, message, options2) {
+    super(message, options2);
+    this.code = code;
+    this.name = new.target.name;
+    Error.captureStackTrace(this, new.target);
+  }
+};
+
+// src/jose.ts
+var import_jose2 = require("@aura-stack/jose/jose");
+var import_crypto = require("@aura-stack/jose/crypto");
+var createJoseInstance = (secret) => {
+  secret ??= getEnv("SECRET");
+  if (!secret) {
+    throw new AuthInternalError(
+      "JOSE_INITIALIZATION_FAILED",
+      "AURA_AUTH_SECRET environment variable is not set and no secret was provided."
+    );
+  }
+  const salt = getEnv("SALT");
+  if (!salt) {
+    throw new AuthInternalError(
+      "JOSE_INITIALIZATION_FAILED",
+      "AURA_AUTH_SALT or AUTH_SALT environment variable is not set. A salt value is required for key derivation."
+    );
+  }
+  try {
+    (0, import_jose.createSecret)(salt);
+  } catch (error) {
+    throw new AuthInternalError(
+      "INVALID_SALT_SECRET_VALUE",
+      "AURA_AUTH_SALT/AUTH_SALT is invalid. It must be at least 32 bytes long and meet entropy requirements.",
+      { cause: error }
+    );
+  }
+  const jose = (async () => {
+    const derivedSigningKey = await (0, import_jose.createDeriveKey)(secret, salt, "signing");
+    const derivedEncryptionKey = await (0, import_jose.createDeriveKey)(secret, salt, "encryption");
+    const derivedCsrfTokenKey = await (0, import_jose.createDeriveKey)(secret, salt, "csrfToken");
+    return {
+      jwt: (0, import_jose.createJWT)({ jws: derivedSigningKey, jwe: derivedEncryptionKey }),
+      jws: (0, import_jose.createJWS)(derivedCsrfTokenKey),
+      jwe: (0, import_jose.createJWE)(derivedEncryptionKey)
+    };
+  })();
+  jose.catch(() => {
+  });
+  return {
+    decodeJWT: async (token, options2) => {
+      const { jwt } = await jose;
+      return jwt.decodeJWT(token, options2);
+    },
+    encodeJWT: async (payload) => {
+      const { jwt } = await jose;
+      return jwt.encodeJWT(payload);
+    },
+    signJWS: async (...args) => {
+      const { jws } = await jose;
+      return jws.signJWS(...args);
+    },
+    verifyJWS: async (...args) => {
+      const { jws } = await jose;
+      return jws.verifyJWS(...args);
+    },
+    encryptJWE: async (...args) => {
+      const { jwe } = await jose;
+      return jwe.encryptJWE(...args);
+    },
+    decryptJWE: async (...args) => {
+      const { jwe } = await jose;
+      return jwe.decryptJWE(...args);
+    }
+  };
+};
+
+// src/utils.ts
+var import_router = require("@aura-stack/router");
+
+// src/assert.ts
+var import_crypto2 = require("@aura-stack/jose/crypto");
+
+// src/utils.ts
+var formatZodError = (error) => {
+  if (!error.issues || error.issues.length === 0) {
+    return {};
+  }
+  return error.issues.reduce((previous, issue) => {
+    const key = issue.path.join(".");
+    return {
+      ...previous,
+      [key]: {
+        code: issue.code,
+        message: issue.message
+      }
+    };
+  }, {});
+};
+var createStructuredData = (data, sdID = "metadata") => {
+  const entries = Object.entries(data);
+  if (entries.length === 0) return `[${sdID}]`;
+  const values = entries.map(([key, value]) => `${key}="${String(value).replace(/(["\\\]])/g, "\\$1")}"`).join(" ");
+  return `[${sdID} ${values}]`;
+};
+var createBasicAuthHeader = (username, password) => {
+  const getUsername = getEnv(username.toUpperCase()) ?? username;
+  const getPassword = getEnv(password.toUpperCase()) ?? password;
+  if (!getUsername || !getPassword) {
+    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "Missing client credentials for OAuth provider configuration.");
+  }
+  const credentials = `${getUsername}:${getPassword}`;
+  return `Basic ${btoa(credentials)}`;
+};
+
+// src/logger.ts
+var logMessages = {
+  ROUTER_INTERNAL_ERROR: {
+    facility: 10,
+    severity: "error",
+    msgId: "ROUTER_INTERNAL_ERROR",
+    message: "Unhandled router error while processing the request"
+  },
+  INVALID_REQUEST: {
+    facility: 10,
+    severity: "warning",
+    msgId: "INVALID_REQUEST",
+    message: "Request validation failed against the expected schema"
+  },
+  SERVER_ERROR: {
+    facility: 10,
+    severity: "error",
+    msgId: "SERVER_ERROR",
+    message: "Unexpected internal server error during authentication"
+  },
+  OAUTH_PROTOCOL_ERROR: {
+    facility: 10,
+    severity: "warning",
+    msgId: "OAUTH_PROTOCOL_ERROR",
+    message: "OAuth provider returned an invalid or unexpected protocol response"
+  },
+  OAUTH_AUTHORIZATION_ERROR: {
+    facility: 10,
+    severity: "error",
+    msgId: "OAUTH_AUTHORIZATION_ERROR",
+    message: "OAuth authorization request was rejected or failed"
+  },
+  INVALID_OAUTH_CONFIGURATION: {
+    facility: 10,
+    severity: "error",
+    msgId: "INVALID_OAUTH_CONFIGURATION",
+    message: "The OAuth provider configuration is invalid or incomplete"
+  },
+  OAUTH_ACCESS_TOKEN_REQUEST_INITIATED: {
+    facility: 10,
+    severity: "debug",
+    msgId: "OAUTH_ACCESS_TOKEN_REQUEST_INITIATED",
+    message: "Starting OAuth access token request to the provider"
+  },
+  INVALID_OAUTH_ACCESS_TOKEN_RESPONSE: {
+    facility: 10,
+    severity: "error",
+    msgId: "INVALID_OAUTH_ACCESS_TOKEN_RESPONSE",
+    message: "OAuth access token endpoint returned an invalid or malformed response"
+  },
+  OAUTH_ACCESS_TOKEN_ERROR: {
+    facility: 10,
+    severity: "error",
+    msgId: "OAUTH_ACCESS_TOKEN_ERROR",
+    message: "OAuth access token endpoint returned an error response"
+  },
+  OAUTH_ACCESS_TOKEN_SUCCESS: {
+    facility: 10,
+    severity: "info",
+    msgId: "OAUTH_ACCESS_TOKEN_SUCCESS",
+    message: "Successfully retrieved OAuth access token from the provider"
+  },
+  OAUTH_ACCESS_TOKEN_REQUEST_FAILED: {
+    facility: 10,
+    severity: "error",
+    msgId: "OAUTH_ACCESS_TOKEN_REQUEST_FAILED",
+    message: "Network or server error while requesting OAuth access token"
+  },
+  OAUTH_USERINFO_REQUEST_INITIATED: {
+    facility: 10,
+    severity: "debug",
+    msgId: "OAUTH_USERINFO_REQUEST_INITIATED",
+    message: "Starting OAuth userinfo request to the provider"
+  },
+  OAUTH_USERINFO_INVALID_RESPONSE: {
+    facility: 10,
+    severity: "error",
+    msgId: "OAUTH_USERINFO_INVALID_RESPONSE",
+    message: "OAuth userinfo endpoint returned an invalid or malformed response"
+  },
+  OAUTH_USERINFO_ERROR: {
+    facility: 10,
+    severity: "error",
+    msgId: "OAUTH_USERINFO_ERROR",
+    message: "OAuth userinfo endpoint returned an error response"
+  },
+  OAUTH_USERINFO_SUCCESS: {
+    facility: 10,
+    severity: "info",
+    msgId: "OAUTH_USERINFO_SUCCESS",
+    message: "Successfully retrieved user information from the OAuth provider"
+  },
+  OAUTH_USERINFO_REQUEST_FAILED: {
+    facility: 10,
+    severity: "error",
+    msgId: "OAUTH_USERINFO_REQUEST_FAILED",
+    message: "Network or server error while requesting user information from the OAuth provider"
+  },
+  OAUTH_CALLBACK_SUCCESS: {
+    facility: 4,
+    severity: "info",
+    msgId: "OAUTH_CALLBACK_SUCCESS",
+    message: "OAuth callback completed successfully and session was created"
+  },
+  MISMATCHING_STATE: {
+    facility: 4,
+    severity: "critical",
+    msgId: "MISMATCHING_STATE",
+    message: "OAuth response state parameter does not match the stored state value"
+  },
+  POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED: {
+    facility: 4,
+    severity: "critical",
+    msgId: "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED",
+    message: "Blocked redirect to untrusted or external URL (potential open redirect attack)"
+  },
+  OPEN_REDIRECT_ATTACK: {
+    facility: 4,
+    severity: "warning",
+    msgId: "OPEN_REDIRECT_ATTACK",
+    message: "Detected redirect target that does not match the trusted origin"
+  },
+  SESSION_TOKEN_MISSING: {
+    facility: 4,
+    severity: "warning",
+    msgId: "SESSION_TOKEN_MISSING",
+    message: "Session cookie is missing from the request"
+  },
+  CSRF_TOKEN_MISSING: {
+    facility: 4,
+    severity: "warning",
+    msgId: "CSRF_TOKEN_MISSING",
+    message: "CSRF token cookie is missing from the request"
+  },
+  CSRF_HEADER_MISSING: {
+    facility: 4,
+    severity: "warning",
+    msgId: "CSRF_HEADER_MISSING",
+    message: "CSRF header is missing from the request"
+  },
+  CSRF_TOKEN_INVALID: {
+    facility: 4,
+    severity: "error",
+    msgId: "CSRF_TOKEN_INVALID",
+    message: "CSRF token verification failed or token is invalid"
+  },
+  SIGN_IN_INITIATED: {
+    facility: 4,
+    severity: "info",
+    msgId: "SIGN_IN_INITIATED",
+    message: "Starting OAuth sign-in flow for the selected provider"
+  },
+  SIGN_OUT_ATTEMPT: {
+    facility: 4,
+    severity: "debug",
+    msgId: "SIGN_OUT_ATTEMPT",
+    message: "Received sign-out request from client"
+  },
+  SIGN_OUT_CSRF_VERIFIED: {
+    facility: 4,
+    severity: "info",
+    msgId: "SIGN_OUT_CSRF_VERIFIED",
+    message: "CSRF token was successfully verified during sign-out"
+  },
+  SIGN_OUT_SUCCESS: {
+    facility: 4,
+    severity: "info",
+    msgId: "SIGN_OUT_SUCCESS",
+    message: "User session was cleared and sign-out completed successfully"
+  },
+  SIGN_OUT_REDIRECT: {
+    facility: 4,
+    severity: "debug",
+    msgId: "SIGN_OUT_REDIRECT",
+    message: "Redirecting client after successful sign-out"
+  },
+  AUTH_SESSION_VALID: {
+    facility: 4,
+    severity: "info",
+    msgId: "AUTH_SESSION_VALID",
+    message: "Session token is valid and user session was returned"
+  },
+  AUTH_SESSION_INVALID: {
+    facility: 4,
+    severity: "notice",
+    msgId: "AUTH_SESSION_INVALID",
+    message: "Session token is missing, expired, or invalid"
+  },
+  INVALID_JWT_TOKEN: {
+    facility: 4,
+    severity: "warning",
+    msgId: "INVALID_JWT_TOKEN",
+    message: "JWT session token failed validation during sign-out"
+  },
+  CSRF_TOKEN_REQUESTED: {
+    facility: 4,
+    severity: "debug",
+    msgId: "CSRF_TOKEN_REQUESTED",
+    message: "Client requested a CSRF token"
+  },
+  CSRF_TOKEN_ISSUED: {
+    facility: 4,
+    severity: "debug",
+    msgId: "CSRF_TOKEN_ISSUED",
+    message: "Issued a new CSRF token to the client"
+  },
+  INVALID_URL: {
+    facility: 10,
+    severity: "error",
+    msgId: "INVALID_URL",
+    message: "Derived origin URL is invalid or malformed"
+  },
+  COOKIE_HTTPONLY_DISABLED: {
+    facility: 10,
+    severity: "critical",
+    msgId: "COOKIE_HTTPONLY_DISABLED",
+    message: "Cookie is configured without HttpOnly. This allows JavaScript access via document.cookie and increases XSS exposure."
+  },
+  COOKIE_WILDCARD_DOMAIN: {
+    facility: 10,
+    severity: "critical",
+    msgId: "COOKIE_WILDCARD_DOMAIN",
+    message: "Cookie 'Domain' is set to a wildcard, which is insecure and should be avoided."
+  },
+  COOKIE_SECURE_DISABLED: {
+    facility: 10,
+    severity: "warning",
+    msgId: "COOKIE_SECURE_DISABLED",
+    message: "Cookie is configured with 'Secure' but the request is not HTTPS. The 'Secure' attribute will be ignored by the browser."
+  },
+  COOKIE_SAMESITE_NONE_WITHOUT_SECURE: {
+    facility: 10,
+    severity: "warning",
+    msgId: "COOKIE_SAMESITE_NONE_WITHOUT_SECURE",
+    message: "Cookie uses SameSite=None without Secure. Falling back to SameSite=Lax for safer defaults."
+  },
+  COOKIE_INSECURE_IN_PRODUCTION: {
+    facility: 10,
+    severity: "critical",
+    msgId: "COOKIE_INSECURE_IN_PRODUCTION",
+    message: "Cookies are being served over an insecure connection in production, which is a serious security risk."
+  },
+  COOKIE_HOST_STRATEGY_INSECURE: {
+    facility: 10,
+    severity: "critical",
+    msgId: "COOKIE_HOST_STRATEGY_INSECURE",
+    message: "__Host- cookies require a secure HTTPS context. Falling back to standard cookie settings."
+  },
+  UNTRUSTED_ORIGIN: {
+    facility: 10,
+    severity: "error",
+    msgId: "UNTRUSTED_ORIGIN",
+    message: "The constructed origin URL is not trusted."
+  }
+};
+var createLogEntry = (key, overrides) => {
+  const message = logMessages[key];
+  return {
+    ...message,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    hostname: "aura-auth",
+    procId: typeof process !== "undefined" && process.pid ? process.pid.toString() : "-",
+    ...overrides
+  };
+};
+var logLevelToSeverity = {
+  debug: ["debug", "info", "notice", "warning", "error", "critical", "alert", "emergency"],
+  info: ["info", "notice", "warning", "error", "critical", "alert", "emergency"],
+  warn: ["warning", "error", "critical", "alert", "emergency"],
+  error: ["error", "critical", "alert", "emergency"]
+};
+var isValidLogLevel = (value) => {
+  return value === "debug" || value === "info" || value === "warn" || value === "error";
+};
+var getSeverityLevel = (severity) => {
+  const severities = {
+    emergency: 0,
+    alert: 1,
+    critical: 2,
+    error: 3,
+    warning: 4,
+    notice: 5,
+    info: 6,
+    debug: 7
+  };
+  return severities[severity] ?? 6;
+};
+var createSyslogMessage = (options2) => {
+  const { timestamp, hostname, appName = "aura-auth", procId = "-", msgId, structuredData, message } = options2;
+  const pri = (options2.facility ?? 16) * 8 + getSeverityLevel(options2.severity);
+  const structuredDataStr = createStructuredData(structuredData ?? {});
+  return `<${pri}>1 ${timestamp} ${hostname} ${appName} ${procId} ${msgId} ${structuredDataStr} ${message}`;
+};
+var createLogger = (logger) => {
+  if (!logger) return void 0;
+  const level = logger.level;
+  const allowedSeverities = logLevelToSeverity[level] ?? [];
+  return {
+    level,
+    log(key, overrides) {
+      const entry = createLogEntry(key, overrides);
+      if (!allowedSeverities.includes(entry.severity)) return entry;
+      logger.log({
+        timestamp: entry.timestamp,
+        appName: entry.appName ?? "aura-auth",
+        hostname: entry.hostname ?? "aura-auth",
+        ...entry
+      });
+      return entry;
+    }
+  };
+};
+var createProxyLogger = (config) => {
+  const level = getEnv("LOG_LEVEL");
+  const debug = getEnvBoolean("DEBUG");
+  if (typeof config?.logger === "object") {
+    return createLogger({
+      log: config.logger?.log || createSyslogMessage,
+      level: isValidLogLevel(config.logger?.level) ? config.logger?.level : isValidLogLevel(level) ? level : "error"
+    });
+  }
+  if (debug || config?.logger === true || level) {
+    return createLogger({
+      level: isValidLogLevel(level) ? level : "debug",
+      log: (options2) => {
+        const message = createSyslogMessage(options2);
+        console.log(message);
+      }
+    });
+  }
+  return void 0;
+};
+
+// src/cookie.ts
+var import_cookie = require("@aura-stack/router/cookie");
+var COOKIE_NAME = "aura-auth";
+var defaultCookieOptions = {
+  httpOnly: true,
+  sameSite: "lax",
+  path: "/",
+  maxAge: 60 * 60 * 24 * 15
+};
+var defaultStandardCookieConfig = {
+  secure: false,
+  httpOnly: true
+};
+var defaultSecureCookieConfig = {
+  secure: true,
+  httpOnly: true
+};
+var defaultHostCookieConfig = {
+  secure: true,
+  httpOnly: true,
+  path: "/",
+  domain: void 0
+};
+var oauthCookieOptions = {
+  httpOnly: true,
+  maxAge: 5 * 60,
+  sameSite: "lax",
+  expires: new Date(Date.now() + 5 * 60 * 1e3)
+};
+var expiredCookieAttributes = {
+  ...defaultCookieOptions,
+  expires: /* @__PURE__ */ new Date(0),
+  maxAge: 0,
+  secure: true
+};
+var defineSecureCookieOptions = (useSecure, attributes, strategy, logger) => {
+  if (!attributes.httpOnly) {
+    logger?.log("COOKIE_HTTPONLY_DISABLED");
+  }
+  if (attributes.domain === "*") {
+    attributes.domain = void 0;
+    logger?.log("COOKIE_WILDCARD_DOMAIN");
+  }
+  if (!useSecure) {
+    if (attributes.secure) {
+      logger?.log("COOKIE_SECURE_DISABLED");
+    }
+    if (attributes.sameSite == "none") {
+      attributes.sameSite = "lax";
+      logger?.log("COOKIE_SAMESITE_NONE_WITHOUT_SECURE");
+    }
+    if (env.NODE_ENV === "production") {
+      logger?.log("COOKIE_INSECURE_IN_PRODUCTION");
+    }
+    if (strategy === "host") {
+      logger?.log("COOKIE_HOST_STRATEGY_INSECURE");
+    }
+    return {
+      ...defaultCookieOptions,
+      ...attributes,
+      ...defaultStandardCookieConfig
+    };
+  }
+  return strategy === "host" ? {
+    ...defaultCookieOptions,
+    ...attributes,
+    ...defaultHostCookieConfig
+  } : { ...defaultCookieOptions, ...attributes, ...defaultSecureCookieConfig };
+};
+var createCookieStore = (useSecure, prefix, overrides, logger) => {
+  prefix ??= COOKIE_NAME;
+  const securePrefix = useSecure ? "__Secure-" : "";
+  const hostPrefix = useSecure ? "__Host-" : "";
+  return {
+    sessionToken: {
+      name: `${securePrefix}${prefix}.${overrides?.sessionToken?.name ?? "session_token"}`,
+      attributes: defineSecureCookieOptions(
+        useSecure,
+        {
+          ...defaultCookieOptions,
+          ...overrides?.sessionToken?.attributes
+        },
+        overrides?.sessionToken?.attributes?.strategy ?? "secure",
+        logger
+      )
+    },
+    state: {
+      name: `${securePrefix}${prefix}.${overrides?.state?.name ?? "state"}`,
+      attributes: defineSecureCookieOptions(
+        useSecure,
+        {
+          ...oauthCookieOptions,
+          ...overrides?.state?.attributes
+        },
+        overrides?.state?.attributes?.strategy ?? "secure",
+        logger
+      )
+    },
+    csrfToken: {
+      name: `${hostPrefix}${prefix}.${overrides?.csrfToken?.name ?? "csrf_token"}`,
+      attributes: defineSecureCookieOptions(
+        useSecure,
+        {
+          ...overrides?.csrfToken?.attributes,
+          ...defaultHostCookieConfig,
+          sameSite: "strict"
+        },
+        overrides?.csrfToken?.attributes?.strategy ?? "host",
+        logger
+      )
+    },
+    redirectTo: {
+      name: `${securePrefix}${prefix}.${overrides?.redirectTo?.name ?? "redirect_to"}`,
+      attributes: defineSecureCookieOptions(
+        useSecure,
+        {
+          ...oauthCookieOptions,
+          ...overrides?.redirectTo?.attributes
+        },
+        overrides?.redirectTo?.attributes?.strategy ?? "secure",
+        logger
+      )
+    },
+    redirectURI: {
+      name: `${securePrefix}${prefix}.${overrides?.redirectURI?.name ?? "redirect_uri"}`,
+      attributes: defineSecureCookieOptions(
+        useSecure,
+        {
+          ...oauthCookieOptions,
+          ...overrides?.redirectURI?.attributes
+        },
+        overrides?.redirectURI?.attributes?.strategy ?? "secure",
+        logger
+      )
+    },
+    codeVerifier: {
+      name: `${securePrefix}${prefix}.${overrides?.codeVerifier?.name ?? "code_verifier"}`,
+      attributes: defineSecureCookieOptions(
+        useSecure,
+        {
+          ...oauthCookieOptions,
+          ...overrides?.codeVerifier?.attributes
+        },
+        overrides?.codeVerifier?.attributes?.strategy ?? "secure",
+        logger
+      )
+    }
+  };
+};
+
+// src/oauth/github.ts
+var github = (options2) => {
+  return {
+    id: "github",
+    name: "GitHub",
+    authorizeURL: "https://github.com/login/oauth/authorize",
+    accessToken: "https://github.com/login/oauth/access_token",
+    userInfo: "https://api.github.com/user",
+    scope: "read:user user:email",
+    responseType: "code",
+    profile: (profile) => {
+      return {
+        sub: profile.id.toString(),
+        name: profile.name ?? profile.login,
+        email: profile.email ?? void 0,
+        image: profile.avatar_url
+      };
+    },
+    ...options2
+  };
+};
+
+// src/oauth/bitbucket.ts
+var bitbucket = (options2) => {
+  return {
+    id: "bitbucket",
+    name: "Bitbucket",
+    authorizeURL: "https://bitbucket.org/site/oauth2/authorize",
+    accessToken: "https://bitbucket.org/site/oauth2/access_token",
+    userInfo: "https://api.bitbucket.org/2.0/user",
+    scope: "account email",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.uuid ?? profile.account_id,
+        name: profile.display_name ?? profile.nickname,
+        image: profile.links.avatar?.href,
+        email: void 0
+      };
+    },
+    ...options2
+  };
+};
+
+// src/oauth/figma.ts
+var figma = (options2) => {
+  return {
+    id: "figma",
+    name: "Figma",
+    authorizeURL: "https://www.figma.com/oauth",
+    accessToken: "https://api.figma.com/v1/oauth/token",
+    userInfo: "https://api.figma.com/v1/me",
+    scope: "current_user:read",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id,
+        name: profile.handle,
+        email: profile.email,
+        image: profile.img_url
+      };
+    },
+    ...options2
+  };
+};
+
+// src/oauth/discord.ts
+var discord = (options2) => {
+  return {
+    id: "discord",
+    name: "Discord",
+    authorizeURL: "https://discord.com/oauth2/authorize",
+    accessToken: "https://discord.com/api/oauth2/token",
+    userInfo: "https://discord.com/api/users/@me",
+    scope: "identify email",
+    responseType: "code",
+    profile(profile) {
+      let image = "";
+      if (profile.avatar === null) {
+        const index = profile.discriminator === "0" ? (BigInt(profile.id) >> 22n) % 6n : Number(profile.discriminator) % 5;
+        image = `https://cdn.discordapp.com/embed/avatars/${index}.png`;
+      } else {
+        const format = profile.avatar.startsWith("a_") ? "gif" : "png";
+        image = `https://cdn.discordapp.com/avatars/${profile.id}/${profile.avatar}.${format}`;
+      }
+      return {
+        sub: profile.id,
+        name: profile.global_name ?? profile.username,
+        email: profile.email ?? "",
+        image
+      };
+    },
+    ...options2
+  };
+};
+
+// src/oauth/gitlab.ts
+var gitlab = (options2) => {
+  return {
+    id: "gitlab",
+    name: "GitLab",
+    authorizeURL: "https://gitlab.com/oauth/authorize",
+    accessToken: "https://gitlab.com/oauth/token",
+    userInfo: "https://gitlab.com/api/v4/user",
+    scope: "read_user",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id.toString(),
+        name: profile.name ?? profile.username,
+        email: profile.email,
+        image: profile.avatar_url
+      };
+    },
+    ...options2
+  };
+};
+
+// src/oauth/spotify.ts
+var spotify = (options2) => {
+  return {
+    id: "spotify",
+    name: "Spotify",
+    authorizeURL: "https://accounts.spotify.com/authorize",
+    accessToken: "https://accounts.spotify.com/api/token",
+    userInfo: "https://api.spotify.com/v1/me",
+    scope: "user-read-private user-read-email",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id,
+        name: profile.display_name,
+        email: profile.email,
+        image: profile.images[0]?.url ?? void 0
+      };
+    },
+    ...options2
+  };
+};
+
+// src/oauth/x.ts
+var x = (options2) => {
+  return {
+    id: "x",
+    name: "X",
+    authorizeURL: "https://twitter.com/i/oauth2/authorize",
+    accessToken: "https://api.twitter.com/2/oauth2/token",
+    userInfo: "https://api.twitter.com/2/users/me?user.fields=profile_image_url",
+    scope: "tweet.read users.read offline.access",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.data.id,
+        name: profile.data.name,
+        image: profile.data.profile_image_url,
+        email: void 0
+      };
+    },
+    ...options2
+  };
+};
+
+// src/oauth/strava.ts
+var strava = (options2) => {
+  return {
+    id: "strava",
+    name: "Strava",
+    authorizeURL: "https://www.strava.com/oauth/authorize",
+    accessToken: "https://www.strava.com/oauth/token",
+    userInfo: "https://www.strava.com/api/v3/athlete",
+    scope: "read",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id.toString(),
+        name: `${profile.firstname} ${profile.lastname}`,
+        image: profile.profile,
+        email: void 0
+      };
+    },
+    ...options2
+  };
+};
+
+// src/oauth/mailchimp.ts
+var mailchimp = (options2) => {
+  return {
+    id: "mailchimp",
+    name: "Mailchimp",
+    authorizeURL: "https://login.mailchimp.com/oauth2/authorize",
+    accessToken: "https://login.mailchimp.com/oauth2/token",
+    userInfo: "https://login.mailchimp.com/oauth2/metadata",
+    scope: "",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.user_id,
+        name: profile.accountname,
+        email: profile.login.email,
+        image: profile.login.avatar
+      };
+    },
+    ...options2
+  };
+};
+
+// src/oauth/pinterest.ts
+var pinterest = (options2) => {
+  return {
+    id: "pinterest",
+    name: "Pinterest",
+    authorizeURL: "https://www.pinterest.com/oauth",
+    accessToken: "https://api.pinterest.com/v5/oauth/token",
+    userInfo: "https://api.pinterest.com/v5/user_account",
+    scope: "user_accounts:read",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id,
+        name: profile.username,
+        image: profile.profile_image,
+        email: void 0
+      };
+    },
+    ...options2
+  };
+};
+
+// src/oauth/twitch.ts
+var twitch = (options2) => {
+  const clientId = options2?.clientId ?? getEnv("TWITCH_CLIENT_ID");
+  return {
+    id: "twitch",
+    name: "Twitch",
+    authorize: {
+      url: "https://id.twitch.tv/oauth2/authorize",
+      params: { scope: "user:read:email", responseType: "code" }
+    },
+    accessToken: "https://id.twitch.tv/oauth2/token",
+    userInfo: {
+      url: "https://api.twitch.tv/helix/users",
+      headers: {
+        "Client-ID": clientId
+      }
+    },
+    profile(profile) {
+      const user = profile.data[0];
+      if (!user) {
+        throw new Error("No user data found in Twitch profile response");
+      }
+      return {
+        sub: user.id,
+        name: user.display_name,
+        email: user.email,
+        picture: user.profile_image_url
+      };
+    },
+    ...options2
+  };
+};
+
+// src/oauth/notion.ts
+var notion = (options2) => {
+  return {
+    id: "notion",
+    name: "Notion",
+    authorize: {
+      url: "https://api.notion.com/v1/oauth/authorize",
+      params: {
+        owner: "user",
+        scope: "user:read",
+        responseType: "code"
+      }
+    },
+    accessToken: {
+      url: "https://api.notion.com/v1/oauth/token",
+      headers: {
+        Authorization: createBasicAuthHeader(
+          options2?.clientId ?? "NOTION_CLIENT_ID",
+          options2?.clientSecret ?? "NOTION_CLIENT_SECRET"
+        )
+      }
+    },
+    userInfo: {
+      url: "https://api.notion.com/v1/users/me",
+      headers: {
+        "Notion-Version": "2022-06-28"
+      }
+    },
+    profile(profile) {
+      return {
+        sub: profile.id,
+        name: profile.name,
+        image: profile.avatar_url ?? "",
+        email: profile?.bot?.owner?.user?.person?.email
+      };
+    },
+    ...options2
+  };
+};
+
+// src/oauth/dropbox.ts
+var dropbox = (options2) => {
+  return {
+    id: "dropbox",
+    name: "Dropbox",
+    authorize: {
+      url: "https://www.dropbox.com/oauth2/authorize",
+      params: { scope: "account_info.read" }
+    },
+    accessToken: "https://api.dropboxapi.com/oauth2/token",
+    userInfo: {
+      method: "POST",
+      url: "https://api.dropboxapi.com/2/users/get_current_account"
+    },
+    profile(profile) {
+      return {
+        sub: profile.account_id,
+        name: profile.name.display_name,
+        email: profile.email,
+        image: profile.profile_photo_url
+      };
+    },
+    ...options2
+  };
+};
+
+// src/oauth/atlassian.ts
+var atlassian = (options2) => {
+  return {
+    id: "atlassian",
+    name: "Atlassian",
+    authorize: {
+      url: "https://auth.atlassian.com/authorize",
+      params: {
+        audience: "api.atlassian.com",
+        scope: "read:me read:account",
+        prompt: "consent"
+      }
+    },
+    authorizeURL: "https://auth.atlassian.com/authorize",
+    accessToken: "https://auth.atlassian.com/oauth/token",
+    userInfo: "https://api.atlassian.com/me",
+    scope: "read:me read:account",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.account_id,
+        name: profile.name,
+        email: profile.email,
+        image: profile.picture
+      };
+    },
+    ...options2
+  };
+};
+
+// src/schemas.ts
+var import_v4 = require("zod/v4");
+var AuthorizeConfigSchema = import_v4.z.union([
+  (0, import_v4.string)().url(),
+  (0, import_v4.object)({
+    url: (0, import_v4.string)().url(),
+    params: (0, import_v4.object)({
+      responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
+      scope: (0, import_v4.string)().optional()
+    })
+  })
+]);
+var AccessTokenConfigSchema = import_v4.z.union([
+  (0, import_v4.string)().url(),
+  (0, import_v4.object)({
+    url: (0, import_v4.string)().url(),
+    headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional()
+  })
+]);
+var UserInfoConfigSchema = import_v4.z.union([
+  (0, import_v4.string)().url(),
+  (0, import_v4.object)({
+    url: (0, import_v4.string)().url(),
+    headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional(),
+    method: (0, import_v4.string)().optional()
+  })
+]);
+var OAuthProviderCredentialsSchema = (0, import_v4.object)({
+  id: (0, import_v4.string)(),
+  name: (0, import_v4.string)(),
+  authorize: AuthorizeConfigSchema.optional(),
+  /** @deprecated */
+  authorizeURL: (0, import_v4.string)().url().optional(),
+  accessToken: AccessTokenConfigSchema,
+  /** @deprecated */
+  scope: (0, import_v4.string)().optional(),
+  userInfo: UserInfoConfigSchema,
+  /** @deprecated */
+  responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
+  clientId: (0, import_v4.string)(),
+  clientSecret: (0, import_v4.string)(),
+  profile: import_v4.z.function().optional()
+});
+var OAuthProviderConfigSchema = (0, import_v4.object)({
+  authorize: AuthorizeConfigSchema.optional(),
+  /** @deprecated */
+  authorizeURL: (0, import_v4.string)().url().optional(),
+  accessToken: AccessTokenConfigSchema,
+  /** @deprecated */
+  scope: (0, import_v4.string)().optional(),
+  userInfo: UserInfoConfigSchema,
+  /** @deprecated */
+  responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
+  clientId: (0, import_v4.string)(),
+  clientSecret: (0, import_v4.string)()
+});
+var OAuthAuthorization = OAuthProviderConfigSchema.extend({
+  redirectURI: (0, import_v4.string)(),
+  state: (0, import_v4.string)(),
+  codeChallenge: (0, import_v4.string)(),
+  codeChallengeMethod: (0, import_v4.enum)(["plain", "S256"])
+});
+var OAuthAuthorizationResponse = (0, import_v4.object)({
+  state: (0, import_v4.string)({ message: "Missing state parameter in the OAuth authorization response." }),
+  code: (0, import_v4.string)({ message: "Missing code parameter in the OAuth authorization response." })
+});
+var OAuthAuthorizationErrorResponse = (0, import_v4.object)({
+  error: (0, import_v4.enum)([
+    "invalid_request",
+    "unauthorized_client",
+    "access_denied",
+    "unsupported_response_type",
+    "invalid_scope",
+    "server_error",
+    "temporarily_unavailable"
+  ]),
+  error_description: (0, import_v4.string)().optional(),
+  error_uri: (0, import_v4.string)().optional(),
+  state: (0, import_v4.string)()
+});
+var OAuthAccessToken = OAuthProviderConfigSchema.extend({
+  redirectURI: (0, import_v4.string)(),
+  code: (0, import_v4.string)(),
+  codeVerifier: (0, import_v4.string)().min(43).max(128)
+});
+var OAuthAccessTokenResponse = (0, import_v4.object)({
+  access_token: (0, import_v4.string)(),
+  token_type: (0, import_v4.string)().optional(),
+  expires_in: (0, import_v4.number)().optional(),
+  refresh_token: (0, import_v4.string)().optional(),
+  scope: (0, import_v4.union)([(0, import_v4.string)().optional().or((0, import_v4.null)()), (0, import_v4.array)((0, import_v4.string)()).optional()])
+});
+var OAuthAccessTokenErrorResponse = (0, import_v4.object)({
+  error: (0, import_v4.enum)([
+    "invalid_request",
+    "invalid_client",
+    "invalid_grant",
+    "unauthorized_client",
+    "unsupported_grant_type",
+    "invalid_scope"
+  ]),
+  error_description: (0, import_v4.string)().optional(),
+  error_uri: (0, import_v4.string)().optional()
+});
+var OAuthErrorResponse = (0, import_v4.object)({
+  error: (0, import_v4.string)(),
+  error_description: (0, import_v4.string)().optional()
+});
+var OAuthEnvSchema = (0, import_v4.object)({
+  clientId: import_v4.z.string().min(1, "OAuth Client ID is required in the environment variables."),
+  clientSecret: import_v4.z.string().min(1, "OAuth Client Secret is required in the environment variables.")
+});
+
+// src/oauth/index.ts
+var builtInOAuthProviders = {
+  github,
+  bitbucket,
+  figma,
+  discord,
+  gitlab,
+  spotify,
+  x,
+  strava,
+  mailchimp,
+  pinterest,
+  twitch,
+  notion,
+  dropbox,
+  atlassian
+};
+var defineOAuthEnvironment = (oauth) => {
+  const loadEnvs = OAuthEnvSchema.safeParse({
+    clientId: getEnv(`${oauth.toUpperCase()}_CLIENT_ID`),
+    clientSecret: getEnv(`${oauth.toUpperCase()}_CLIENT_SECRET`)
+  });
+  if (!loadEnvs.success) {
+    const msg = JSON.stringify({ [oauth]: formatZodError(loadEnvs.error) }, null, 2);
+    throw new AuthInternalError("INVALID_ENVIRONMENT_CONFIGURATION", msg);
+  }
+  return loadEnvs.data;
+};
+var defineOAuthProviderConfig = (config) => {
+  if (typeof config === "string") {
+    const definition = defineOAuthEnvironment(config);
+    const oauthConfig = builtInOAuthProviders[config]();
+    const parsed2 = OAuthProviderCredentialsSchema.safeParse({ ...oauthConfig, ...definition });
+    if (!parsed2.success) {
+      const details = JSON.stringify({ [config]: formatZodError(parsed2.error) }, null, 2);
+      throw new AuthInternalError(
+        "INVALID_OAUTH_PROVIDER_CONFIGURATION",
+        `Invalid configuration for OAuth provider "${config}": ${details}`
+      );
+    }
+    return parsed2.data;
+  }
+  const hasCredentials = config.clientId && config.clientSecret;
+  const envConfig = hasCredentials ? {} : defineOAuthEnvironment(config.id);
+  const parsed = OAuthProviderCredentialsSchema.safeParse({ ...envConfig, ...config });
+  if (!parsed.success) {
+    const details = JSON.stringify({ [config.id]: formatZodError(parsed.error) }, null, 2);
+    throw new AuthInternalError(
+      "INVALID_OAUTH_PROVIDER_CONFIGURATION",
+      `Invalid configuration for OAuth provider "${config.id}": ${details}`
+    );
+  }
+  return parsed.data;
+};
+var createBuiltInOAuthProviders = (oauth = []) => {
+  return oauth.reduce((previous, config) => {
+    const oauthConfig = defineOAuthProviderConfig(config);
+    if (oauthConfig.id in previous) {
+      throw new AuthInternalError(
+        "DUPLICATED_OAUTH_PROVIDER_ID",
+        `Duplicate OAuth provider id "${oauthConfig.id}" found. Each provider must have a unique id.`
+      );
+    }
+    return { ...previous, [oauthConfig.id]: oauthConfig };
+  }, {});
+};
+
+// src/context.ts
+var createContext = (config) => {
+  const trustedProxyHeadersEnv = getEnv("TRUSTED_PROXY_HEADERS");
+  const useProxyHeaders = trustedProxyHeadersEnv === void 0 ? config?.trustedProxyHeaders ?? false : getEnvBoolean("TRUSTED_PROXY_HEADERS");
+  const logger = createProxyLogger(config);
+  const cookiePrefix = config?.cookies?.prefix;
+  const cookieOverrides = config?.cookies?.overrides ?? {};
+  const secureCookieStore = createCookieStore(true, cookiePrefix, cookieOverrides, logger);
+  const standardCookieStore = createCookieStore(false, cookiePrefix, cookieOverrides, logger);
+  return {
+    oauth: createBuiltInOAuthProviders(config?.oauth),
+    cookies: standardCookieStore,
+    jose: createJoseInstance(config?.secret),
+    secret: config?.secret,
+    basePath: config?.basePath ?? "/auth",
+    trustedProxyHeaders: useProxyHeaders,
+    trustedOrigins: getEnvArray("TRUSTED_ORIGINS").length > 0 ? getEnvArray("TRUSTED_ORIGINS") : config?.trustedOrigins,
+    logger,
+    cookieConfig: { secure: secureCookieStore, standard: standardCookieStore },
+    baseURL: config?.baseURL
+  };
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createContext
+});