@aura-stack/auth 0.4.0-rc.5 → 0.5.0

package/dist/createAuth.d.ts

@@ -0,0 +1,12 @@
+import 'jose';
+export { w as createAuth, ay as createAuthInstance } from './index-_aXtxb_s.js';
+import '@aura-stack/jose';
+import '@aura-stack/router';
+import 'zod/v4/core';
+import 'zod';
+import './@types/utility.js';
+import './schemas.js';
+import 'zod/v4';
+import '@aura-stack/jose/jose';
+import '@aura-stack/jose/crypto';
+import '@aura-stack/router/cookie';

package/dist/createAuth.js

@@ -0,0 +1,48 @@
+import {
+  createAuth,
+  createAuthInstance
+} from "./chunk-CWX724AG.js";
+import "./chunk-ITQ7352M.js";
+import "./chunk-NHZBQNRR.js";
+import "./chunk-GNNBM2WJ.js";
+import "./chunk-FPCVZUVG.js";
+import "./chunk-UN7X6SU5.js";
+import "./chunk-7YYXFKLR.js";
+import "./chunk-3J5TUH2I.js";
+import "./chunk-7BE46WWS.js";
+import "./chunk-LAYPUDQF.js";
+import "./chunk-CITNGXDA.js";
+import "./chunk-JOCGX3RP.js";
+import "./chunk-D2CSIUKP.js";
+import "./chunk-LATR3NIV.js";
+import "./chunk-KBXWTD6E.js";
+import "./chunk-ZNCZVF6U.js";
+import "./chunk-V6LLEAR4.js";
+import "./chunk-2IR674WX.js";
+import "./chunk-PDP3PHB3.js";
+import "./chunk-LDU7A2JE.js";
+import "./chunk-PHYNROD4.js";
+import "./chunk-E6G5YCI6.js";
+import "./chunk-IPKO6UQN.js";
+import "./chunk-54CZPKR4.js";
+import "./chunk-2GQLSIJ2.js";
+import "./chunk-EEE7UM5T.js";
+import "./chunk-C3A37LQC.js";
+import "./chunk-4YHJ4IEQ.js";
+import "./chunk-OVHNRULD.js";
+import "./chunk-QQEKY4XP.js";
+import "./chunk-KMMAZFSJ.js";
+import "./chunk-FW4W3REU.js";
+import "./chunk-5LZ7TOM3.js";
+import "./chunk-U4RK4LKJ.js";
+import "./chunk-2A5B7GWR.js";
+import "./chunk-UZQJJD6A.js";
+import "./chunk-LX3TJ2TJ.js";
+import "./chunk-XY5R3EHH.js";
+import "./chunk-WHNDRO3N.js";
+import "./chunk-U5663F2U.js";
+import "./chunk-EBAMFRB7.js";
+export {
+  createAuth,
+  createAuthInstance
+};

package/dist/env.cjs

@@ -0,0 +1,78 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/env.ts
+var env_exports = {};
+__export(env_exports, {
+  env: () => env,
+  getEnv: () => getEnv,
+  getEnvArray: () => getEnvArray,
+  getEnvBoolean: () => getEnvBoolean
+});
+module.exports = __toCommonJS(env_exports);
+var import_meta = {};
+var env = new Proxy({}, {
+  get(_, prop) {
+    if (typeof prop !== "string") return void 0;
+    const hasProperty = (process2) => {
+      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
+    };
+    try {
+      if (typeof process !== "undefined" && hasProperty(process.env)) {
+        return process.env[prop];
+      }
+      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
+        return import_meta.env[prop];
+      }
+      if (typeof Deno !== "undefined" && Deno.env?.get) {
+        return Deno.env.get(prop);
+      }
+      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
+        return Bun.env[prop];
+      }
+      const globalValue = globalThis[prop];
+      return typeof globalValue === "string" ? globalValue : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+});
+var getEnv = (key) => {
+  const keys = [`AURA_AUTH_${key.toUpperCase()}`, `AURA_${key.toUpperCase()}`, `AUTH_${key.toUpperCase()}`, key.toUpperCase()];
+  return env[keys.find((k) => env[k]) ?? ""];
+};
+var getEnvBoolean = (key) => {
+  const value = getEnv(key);
+  if (value === void 0) return false;
+  const normalized = value.trim().toLowerCase();
+  if (["1", "true", "yes", "on", "debug"].includes(normalized)) return true;
+  return false;
+};
+var getEnvArray = (key, defaultValue = []) => {
+  const value = getEnv(key);
+  if (!value) return defaultValue;
+  return value.split(/[,;\n]+/).map((v) => v.trim()).filter(Boolean);
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  env,
+  getEnv,
+  getEnvArray,
+  getEnvBoolean
+});

package/dist/env.d.ts

@@ -0,0 +1,10 @@
+/**
+ * A runtime-agnostic environment variable proxy.
+ * Checks multiple sources to ensure compatibility with Node, Bun, Deno, Vite, and Edge platforms.
+ */
+declare const env: Record<string, string | undefined>;
+declare const getEnv: (key: string) => string | undefined;
+declare const getEnvBoolean: (key: string) => boolean;
+declare const getEnvArray: (key: string, defaultValue?: string[]) => string[];
+
+export { env, getEnv, getEnvArray, getEnvBoolean };

package/dist/env.js

@@ -0,0 +1,12 @@
+import {
+  env,
+  getEnv,
+  getEnvArray,
+  getEnvBoolean
+} from "./chunk-WHNDRO3N.js";
+export {
+  env,
+  getEnv,
+  getEnvArray,
+  getEnvBoolean
+};

package/dist/errors.cjs

@@ -20,9 +20,11 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/errors.ts
 var errors_exports = {};
 __export(errors_exports, {
+  AuthClientError: () => AuthClientError,
   AuthInternalError: () => AuthInternalError,
   AuthSecurityError: () => AuthSecurityError,
   OAuthProtocolError: () => OAuthProtocolError,
+  isAuthClientError: () => isAuthClientError,
   isAuthInternalError: () => isAuthInternalError,
   isAuthSecurityError: () => isAuthSecurityError,
   isNativeError: () => isNativeError,
@@ -61,6 +63,16 @@ var AuthSecurityError = class extends Error {
     Error.captureStackTrace(this, new.target);
   }
 };
+var AuthClientError = class extends Error {
+  type = "AUTH_CLIENT_ERROR";
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+    this.name = new.target.name;
+    Error.captureStackTrace(this, new.target);
+  }
+};
 var isNativeError = (error) => {
   return error instanceof Error;
 };
@@ -73,11 +85,16 @@ var isAuthInternalError = (error) => {
 var isAuthSecurityError = (error) => {
   return error instanceof AuthSecurityError;
 };
+var isAuthClientError = (error) => {
+  return error instanceof AuthClientError;
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AuthClientError,
   AuthInternalError,
   AuthSecurityError,
   OAuthProtocolError,
+  isAuthClientError,
   isAuthInternalError,
   isAuthSecurityError,
   isNativeError,

package/dist/errors.d.ts

@@ -1,10 +1,15 @@
-import { E as ErrorType, b as AuthInternalErrorCode, c as AuthSecurityErrorCode } from './index-B8jeIElf.js';
+import { d as AuthInternalErrorCode, e as AuthSecurityErrorCode, E as ErrorType } from './index-_aXtxb_s.js';
 import { LiteralUnion } from './@types/utility.js';
 import 'zod';
 import './schemas.js';
-import '@aura-stack/router/cookie';
+import 'zod/v4';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/jose/crypto';
+import '@aura-stack/router/cookie';
+import 'jose';
+import '@aura-stack/router';
+import 'zod/v4/core';
 
 /**
  * The object returned by the class to users its:
@@ -39,11 +44,17 @@ declare class AuthInternalError extends Error {
 declare class AuthSecurityError extends Error {
     readonly type = "AUTH_SECURITY_ERROR";
     readonly code: string;
-    constructor(code: AuthSecurityErrorCode, message?: string, options?: ErrorOptions);
+    constructor(code: LiteralUnion<AuthSecurityErrorCode>, message?: string, options?: ErrorOptions);
+}
+declare class AuthClientError extends Error {
+    readonly type = "AUTH_CLIENT_ERROR";
+    readonly code: string;
+    constructor(code: string, message?: string, options?: ErrorOptions);
 }
 declare const isNativeError: (error: unknown) => error is Error;
 declare const isOAuthProtocolError: (error: unknown) => error is OAuthProtocolError;
 declare const isAuthInternalError: (error: unknown) => error is AuthInternalError;
 declare const isAuthSecurityError: (error: unknown) => error is AuthSecurityError;
+declare const isAuthClientError: (error: unknown) => error is AuthClientError;
 
-export { AuthInternalError, AuthSecurityError, OAuthProtocolError, isAuthInternalError, isAuthSecurityError, isNativeError, isOAuthProtocolError };
+export { AuthClientError, AuthInternalError, AuthSecurityError, OAuthProtocolError, isAuthClientError, isAuthInternalError, isAuthSecurityError, isNativeError, isOAuthProtocolError };

package/dist/errors.js

@@ -1,16 +1,20 @@
 import {
+  AuthClientError,
   AuthInternalError,
   AuthSecurityError,
   OAuthProtocolError,
+  isAuthClientError,
   isAuthInternalError,
   isAuthSecurityError,
   isNativeError,
   isOAuthProtocolError
-} from "./chunk-RRLIF4PQ.js";
+} from "./chunk-U5663F2U.js";
 export {
+  AuthClientError,
   AuthInternalError,
   AuthSecurityError,
   OAuthProtocolError,
+  isAuthClientError,
   isAuthInternalError,
   isAuthSecurityError,
   isNativeError,

package/dist/headers.cjs

@@ -20,7 +20,10 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/headers.ts
 var headers_exports = {};
 __export(headers_exports, {
-  cacheControl: () => cacheControl
+  cacheControl: () => cacheControl,
+  contentSecurityPolicy: () => contentSecurityPolicy,
+  secureApiHeaders: () => secureApiHeaders,
+  secureHeaders: () => secureHeaders
 });
 module.exports = __toCommonJS(headers_exports);
 var cacheControl = {
@@ -29,7 +32,30 @@ var cacheControl = {
   Expires: "0",
   Vary: "Cookie"
 };
+var contentSecurityPolicy = {
+  "Content-Security-Policy": [
+    "default-src 'none'",
+    "script-src 'self'",
+    "frame-src 'none'",
+    "object-src 'none'",
+    "frame-ancestors 'none'",
+    "base-uri 'none'"
+  ].join("; ")
+};
+var secureHeaders = {
+  "X-Content-Type-Options": "nosniff",
+  "X-Frame-Options": "DENY",
+  "Referrer-Policy": "strict-origin-when-cross-origin"
+};
+var secureApiHeaders = {
+  ...cacheControl,
+  ...contentSecurityPolicy,
+  ...secureHeaders
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  cacheControl
+  cacheControl,
+  contentSecurityPolicy,
+  secureApiHeaders,
+  secureHeaders
 });

package/dist/headers.d.ts

@@ -5,5 +5,29 @@
  * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Vary
  */
 declare const cacheControl: HeadersInit;
+/**
+ * Content Security Policy headers optimized for JSON API endpoints.
+ * Provides protection against XSS, clickjacking, and code injection attacks.
+ * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
+ * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy
+ */
+declare const contentSecurityPolicy: HeadersInit;
+/**
+ * X-Frame-Options is overridden by the frame-ancestors directive in CSP.
+ * However, it's included here for compatibility with older browsers that do not support CSP.
+ * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Content-Type-Options
+ * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options
+ * @see https://developer.mozilla.org/es/docs/Web/HTTP/Reference/Headers/Referrer-Policy
+ */
+declare const secureHeaders: {
+    "X-Content-Type-Options": string;
+    "X-Frame-Options": string;
+    "Referrer-Policy": string;
+};
+/**
+ * Combined security headers for JSON API responses.
+ * Includes cache control, CSP, and other security headers.
+ */
+declare const secureApiHeaders: HeadersInit;
 
-export { cacheControl };
+export { cacheControl, contentSecurityPolicy, secureApiHeaders, secureHeaders };

package/dist/headers.js

@@ -1,6 +1,12 @@
 import {
-  cacheControl
-} from "./chunk-STHEPPUZ.js";
+  cacheControl,
+  contentSecurityPolicy,
+  secureApiHeaders,
+  secureHeaders
+} from "./chunk-EBAMFRB7.js";
 export {
-  cacheControl
+  cacheControl,
+  contentSecurityPolicy,
+  secureApiHeaders,
+  secureHeaders
 };