@aura-stack/auth 0.4.0-rc.5 → 0.5.0

package/dist/oauth/index.cjs

@@ -20,233 +20,527 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/oauth/index.ts
 var oauth_exports = {};
 __export(oauth_exports, {
+  atlassian: () => atlassian,
   bitbucket: () => bitbucket,
   builtInOAuthProviders: () => builtInOAuthProviders,
   createBuiltInOAuthProviders: () => createBuiltInOAuthProviders,
   discord: () => discord,
+  dropbox: () => dropbox,
   figma: () => figma,
   github: () => github,
   gitlab: () => gitlab,
   mailchimp: () => mailchimp,
+  notion: () => notion,
   pinterest: () => pinterest,
   spotify: () => spotify,
   strava: () => strava,
+  twitch: () => twitch,
   x: () => x
 });
 module.exports = __toCommonJS(oauth_exports);
 
+// src/env.ts
+var import_meta = {};
+var env = new Proxy({}, {
+  get(_, prop) {
+    if (typeof prop !== "string") return void 0;
+    const hasProperty = (process2) => {
+      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
+    };
+    try {
+      if (typeof process !== "undefined" && hasProperty(process.env)) {
+        return process.env[prop];
+      }
+      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
+        return import_meta.env[prop];
+      }
+      if (typeof Deno !== "undefined" && Deno.env?.get) {
+        return Deno.env.get(prop);
+      }
+      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
+        return Bun.env[prop];
+      }
+      const globalValue = globalThis[prop];
+      return typeof globalValue === "string" ? globalValue : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+});
+var getEnv = (key) => {
+  const keys = [`AURA_AUTH_${key.toUpperCase()}`, `AURA_${key.toUpperCase()}`, `AUTH_${key.toUpperCase()}`, key.toUpperCase()];
+  return env[keys.find((k) => env[k]) ?? ""];
+};
+
 // src/oauth/github.ts
-var github = {
-  id: "github",
-  name: "GitHub",
-  authorizeURL: "https://github.com/login/oauth/authorize",
-  accessToken: "https://github.com/login/oauth/access_token",
-  userInfo: "https://api.github.com/user",
-  scope: "read:user user:email",
-  responseType: "code"
+var github = (options2) => {
+  return {
+    id: "github",
+    name: "GitHub",
+    authorizeURL: "https://github.com/login/oauth/authorize",
+    accessToken: "https://github.com/login/oauth/access_token",
+    userInfo: "https://api.github.com/user",
+    scope: "read:user user:email",
+    responseType: "code",
+    profile: (profile) => {
+      return {
+        sub: profile.id.toString(),
+        name: profile.name ?? profile.login,
+        email: profile.email ?? void 0,
+        image: profile.avatar_url
+      };
+    },
+    ...options2
+  };
 };
 
 // src/oauth/bitbucket.ts
-var bitbucket = {
-  id: "bitbucket",
-  name: "Bitbucket",
-  authorizeURL: "https://bitbucket.org/site/oauth2/authorize",
-  accessToken: "https://bitbucket.org/site/oauth2/access_token",
-  userInfo: "https://api.bitbucket.org/2.0/user",
-  scope: "account email",
-  responseType: "code",
-  profile(profile) {
-    return {
-      sub: profile.uuid ?? profile.account_id,
-      name: profile.display_name ?? profile.nickname,
-      image: profile.links.avatar.href
-    };
-  }
+var bitbucket = (options2) => {
+  return {
+    id: "bitbucket",
+    name: "Bitbucket",
+    authorizeURL: "https://bitbucket.org/site/oauth2/authorize",
+    accessToken: "https://bitbucket.org/site/oauth2/access_token",
+    userInfo: "https://api.bitbucket.org/2.0/user",
+    scope: "account email",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.uuid ?? profile.account_id,
+        name: profile.display_name ?? profile.nickname,
+        image: profile.links.avatar?.href,
+        email: void 0
+      };
+    },
+    ...options2
+  };
 };
 
 // src/oauth/figma.ts
-var figma = {
-  id: "figma",
-  name: "Figma",
-  authorizeURL: "https://www.figma.com/oauth",
-  accessToken: "https://api.figma.com/v1/oauth/token",
-  userInfo: "https://api.figma.com/v1/me",
-  scope: "current_user:read",
-  responseType: "code",
-  profile(profile) {
-    return {
-      sub: profile.id,
-      name: profile.handle,
-      email: profile.email,
-      image: profile.img_url
-    };
-  }
+var figma = (options2) => {
+  return {
+    id: "figma",
+    name: "Figma",
+    authorizeURL: "https://www.figma.com/oauth",
+    accessToken: "https://api.figma.com/v1/oauth/token",
+    userInfo: "https://api.figma.com/v1/me",
+    scope: "current_user:read",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id,
+        name: profile.handle,
+        email: profile.email,
+        image: profile.img_url
+      };
+    },
+    ...options2
+  };
 };
 
 // src/oauth/discord.ts
-var discord = {
-  id: "discord",
-  name: "Discord",
-  authorizeURL: "https://discord.com/oauth2/authorize",
-  accessToken: "https://discord.com/api/oauth2/token",
-  userInfo: "https://discord.com/api/users/@me",
-  scope: "identify email",
-  responseType: "code",
-  profile(profile) {
-    let image = "";
-    if (profile.avatar === null) {
-      const index = profile.discriminator === "0" ? (BigInt(profile.id) >> 22n) % 6n : Number(profile.discriminator) % 5;
-      image = `https://cdn.discordapp.com/embed/avatars/${index}.png`;
-    } else {
-      const format = profile.avatar.startsWith("a_") ? "gif" : "png";
-      image = `https://cdn.discordapp.com/avatars/${profile.id}/${profile.avatar}.${format}`;
-    }
-    return {
-      sub: profile.id,
-      name: profile.global_name ?? profile.username,
-      email: profile.email ?? "",
-      image
-    };
-  }
+var discord = (options2) => {
+  return {
+    id: "discord",
+    name: "Discord",
+    authorizeURL: "https://discord.com/oauth2/authorize",
+    accessToken: "https://discord.com/api/oauth2/token",
+    userInfo: "https://discord.com/api/users/@me",
+    scope: "identify email",
+    responseType: "code",
+    profile(profile) {
+      let image = "";
+      if (profile.avatar === null) {
+        const index = profile.discriminator === "0" ? (BigInt(profile.id) >> 22n) % 6n : Number(profile.discriminator) % 5;
+        image = `https://cdn.discordapp.com/embed/avatars/${index}.png`;
+      } else {
+        const format = profile.avatar.startsWith("a_") ? "gif" : "png";
+        image = `https://cdn.discordapp.com/avatars/${profile.id}/${profile.avatar}.${format}`;
+      }
+      return {
+        sub: profile.id,
+        name: profile.global_name ?? profile.username,
+        email: profile.email ?? "",
+        image
+      };
+    },
+    ...options2
+  };
 };
 
 // src/oauth/gitlab.ts
-var gitlab = {
-  id: "gitlab",
-  name: "GitLab",
-  authorizeURL: "https://gitlab.com/oauth/authorize",
-  accessToken: "https://gitlab.com/oauth/token",
-  userInfo: "https://gitlab.com/api/v4/user",
-  scope: "read_user",
-  responseType: "code",
-  profile(profile) {
-    return {
-      sub: profile.id.toString(),
-      name: profile.name ?? profile.username,
-      email: profile.email,
-      avatar: profile.avatar_url
-    };
-  }
+var gitlab = (options2) => {
+  return {
+    id: "gitlab",
+    name: "GitLab",
+    authorizeURL: "https://gitlab.com/oauth/authorize",
+    accessToken: "https://gitlab.com/oauth/token",
+    userInfo: "https://gitlab.com/api/v4/user",
+    scope: "read_user",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id.toString(),
+        name: profile.name ?? profile.username,
+        email: profile.email,
+        image: profile.avatar_url
+      };
+    },
+    ...options2
+  };
 };
 
 // src/oauth/spotify.ts
-var spotify = {
-  id: "spotify",
-  name: "Spotify",
-  authorizeURL: "https://accounts.spotify.com/authorize",
-  accessToken: "https://accounts.spotify.com/api/token",
-  userInfo: "https://api.spotify.com/v1/me",
-  scope: "user-read-email user-read-private",
-  responseType: "token",
-  profile(profile) {
-    return {
-      sub: profile.id,
-      name: profile.display_name,
-      email: profile.email,
-      image: profile.images?.[0]?.url
-    };
-  }
+var spotify = (options2) => {
+  return {
+    id: "spotify",
+    name: "Spotify",
+    authorizeURL: "https://accounts.spotify.com/authorize",
+    accessToken: "https://accounts.spotify.com/api/token",
+    userInfo: "https://api.spotify.com/v1/me",
+    scope: "user-read-private user-read-email",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id,
+        name: profile.display_name,
+        email: profile.email,
+        image: profile.images[0]?.url ?? void 0
+      };
+    },
+    ...options2
+  };
 };
 
 // src/oauth/x.ts
-var x = {
-  id: "x",
-  name: "X",
-  authorizeURL: "https://x.com/i/oauth2/authorize",
-  accessToken: "https://api.x.com/2/oauth2/token",
-  userInfo: "https://api.x.com/2/users/me?user.fields=profile_image_url",
-  scope: "users.read users.email tweet.read offline.access",
-  responseType: "code",
-  profile({ data }) {
-    return {
-      sub: data.id,
-      name: data.name,
-      image: data.profile_image_url,
-      email: ""
-    };
-  }
+var x = (options2) => {
+  return {
+    id: "x",
+    name: "X",
+    authorizeURL: "https://twitter.com/i/oauth2/authorize",
+    accessToken: "https://api.twitter.com/2/oauth2/token",
+    userInfo: "https://api.twitter.com/2/users/me?user.fields=profile_image_url",
+    scope: "tweet.read users.read offline.access",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.data.id,
+        name: profile.data.name,
+        image: profile.data.profile_image_url,
+        email: void 0
+      };
+    },
+    ...options2
+  };
 };
 
 // src/oauth/strava.ts
-var strava = {
-  id: "strava",
-  name: "Strava",
-  authorizeURL: "https://www.strava.com/oauth/authorize",
-  accessToken: "https://www.strava.com/oauth/token",
-  userInfo: "https://www.strava.com/api/v3/athlete",
-  scope: "read",
-  responseType: "code",
-  profile(profile) {
-    return {
-      sub: profile.id.toString(),
-      name: `${profile.firstname} ${profile.lastname}`,
-      image: profile.profile,
-      email: ""
-    };
-  }
+var strava = (options2) => {
+  return {
+    id: "strava",
+    name: "Strava",
+    authorizeURL: "https://www.strava.com/oauth/authorize",
+    accessToken: "https://www.strava.com/oauth/token",
+    userInfo: "https://www.strava.com/api/v3/athlete",
+    scope: "read",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id.toString(),
+        name: `${profile.firstname} ${profile.lastname}`,
+        image: profile.profile,
+        email: void 0
+      };
+    },
+    ...options2
+  };
 };
 
 // src/oauth/mailchimp.ts
-var mailchimp = {
-  id: "mailchimp",
-  name: "Mailchimp",
-  authorizeURL: "https://login.mailchimp.com/oauth2/authorize",
-  accessToken: "https://login.mailchimp.com/oauth2/token",
-  userInfo: "https://login.mailchimp.com/oauth2/metadata",
-  scope: "",
-  responseType: "code",
-  profile(profile) {
-    return {
-      sub: profile.user_id,
-      name: profile.accountname,
-      email: profile.login.login_email,
-      image: null
-    };
-  }
+var mailchimp = (options2) => {
+  return {
+    id: "mailchimp",
+    name: "Mailchimp",
+    authorizeURL: "https://login.mailchimp.com/oauth2/authorize",
+    accessToken: "https://login.mailchimp.com/oauth2/token",
+    userInfo: "https://login.mailchimp.com/oauth2/metadata",
+    scope: "",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.user_id,
+        name: profile.accountname,
+        email: profile.login.email,
+        image: profile.login.avatar
+      };
+    },
+    ...options2
+  };
 };
 
 // src/oauth/pinterest.ts
-var pinterest = {
-  id: "pinterest",
-  name: "Pinterest",
-  authorizeURL: "https://api.pinterest.com/oauth/",
-  accessToken: "https://api.pinterest.com/v5/oauth/token",
-  userInfo: "https://api.pinterest.com/v5/user_account",
-  scope: "user_accounts:read",
-  responseType: "code",
-  profile(profile) {
+var pinterest = (options2) => {
+  return {
+    id: "pinterest",
+    name: "Pinterest",
+    authorizeURL: "https://www.pinterest.com/oauth",
+    accessToken: "https://api.pinterest.com/v5/oauth/token",
+    userInfo: "https://api.pinterest.com/v5/user_account",
+    scope: "user_accounts:read",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id,
+        name: profile.username,
+        image: profile.profile_image,
+        email: void 0
+      };
+    },
+    ...options2
+  };
+};
+
+// src/oauth/twitch.ts
+var twitch = (options2) => {
+  const clientId = options2?.clientId ?? getEnv("TWITCH_CLIENT_ID");
+  return {
+    id: "twitch",
+    name: "Twitch",
+    authorize: {
+      url: "https://id.twitch.tv/oauth2/authorize",
+      params: { scope: "user:read:email", responseType: "code" }
+    },
+    accessToken: "https://id.twitch.tv/oauth2/token",
+    userInfo: {
+      url: "https://api.twitch.tv/helix/users",
+      headers: {
+        "Client-ID": clientId
+      }
+    },
+    profile(profile) {
+      const user = profile.data[0];
+      if (!user) {
+        throw new Error("No user data found in Twitch profile response");
+      }
+      return {
+        sub: user.id,
+        name: user.display_name,
+        email: user.email,
+        picture: user.profile_image_url
+      };
+    },
+    ...options2
+  };
+};
+
+// src/utils.ts
+var import_router = require("@aura-stack/router");
+
+// src/errors.ts
+var AuthInternalError = class extends Error {
+  type = "AUTH_INTERNAL_ERROR";
+  code;
+  constructor(code, message, options2) {
+    super(message, options2);
+    this.code = code;
+    this.name = new.target.name;
+    Error.captureStackTrace(this, new.target);
+  }
+};
+
+// src/assert.ts
+var import_crypto = require("@aura-stack/jose/crypto");
+
+// src/utils.ts
+var formatZodError = (error) => {
+  if (!error.issues || error.issues.length === 0) {
+    return {};
+  }
+  return error.issues.reduce((previous, issue) => {
+    const key = issue.path.join(".");
     return {
-      sub: profile.id,
-      name: profile.username,
-      email: null,
-      image: profile.profile_image
+      ...previous,
+      [key]: {
+        code: issue.code,
+        message: issue.message
+      }
     };
+  }, {});
+};
+var createBasicAuthHeader = (username, password) => {
+  const getUsername = getEnv(username.toUpperCase()) ?? username;
+  const getPassword = getEnv(password.toUpperCase()) ?? password;
+  if (!getUsername || !getPassword) {
+    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "Missing client credentials for OAuth provider configuration.");
   }
+  const credentials = `${getUsername}:${getPassword}`;
+  return `Basic ${btoa(credentials)}`;
+};
+
+// src/oauth/notion.ts
+var notion = (options2) => {
+  return {
+    id: "notion",
+    name: "Notion",
+    authorize: {
+      url: "https://api.notion.com/v1/oauth/authorize",
+      params: {
+        owner: "user",
+        scope: "user:read",
+        responseType: "code"
+      }
+    },
+    accessToken: {
+      url: "https://api.notion.com/v1/oauth/token",
+      headers: {
+        Authorization: createBasicAuthHeader(
+          options2?.clientId ?? "NOTION_CLIENT_ID",
+          options2?.clientSecret ?? "NOTION_CLIENT_SECRET"
+        )
+      }
+    },
+    userInfo: {
+      url: "https://api.notion.com/v1/users/me",
+      headers: {
+        "Notion-Version": "2022-06-28"
+      }
+    },
+    profile(profile) {
+      return {
+        sub: profile.id,
+        name: profile.name,
+        image: profile.avatar_url ?? "",
+        email: profile?.bot?.owner?.user?.person?.email
+      };
+    },
+    ...options2
+  };
+};
+
+// src/oauth/dropbox.ts
+var dropbox = (options2) => {
+  return {
+    id: "dropbox",
+    name: "Dropbox",
+    authorize: {
+      url: "https://www.dropbox.com/oauth2/authorize",
+      params: { scope: "account_info.read" }
+    },
+    accessToken: "https://api.dropboxapi.com/oauth2/token",
+    userInfo: {
+      method: "POST",
+      url: "https://api.dropboxapi.com/2/users/get_current_account"
+    },
+    profile(profile) {
+      return {
+        sub: profile.account_id,
+        name: profile.name.display_name,
+        email: profile.email,
+        image: profile.profile_photo_url
+      };
+    },
+    ...options2
+  };
+};
+
+// src/oauth/atlassian.ts
+var atlassian = (options2) => {
+  return {
+    id: "atlassian",
+    name: "Atlassian",
+    authorize: {
+      url: "https://auth.atlassian.com/authorize",
+      params: {
+        audience: "api.atlassian.com",
+        scope: "read:me read:account",
+        prompt: "consent"
+      }
+    },
+    authorizeURL: "https://auth.atlassian.com/authorize",
+    accessToken: "https://auth.atlassian.com/oauth/token",
+    userInfo: "https://api.atlassian.com/me",
+    scope: "read:me read:account",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.account_id,
+        name: profile.name,
+        email: profile.email,
+        image: profile.picture
+      };
+    },
+    ...options2
+  };
 };
 
 // src/schemas.ts
-var import_zod = require("zod");
-var OAuthProviderConfigSchema = (0, import_zod.object)({
-  authorizeURL: (0, import_zod.string)().url(),
-  accessToken: (0, import_zod.string)().url(),
-  scope: (0, import_zod.string)().optional(),
-  userInfo: (0, import_zod.string)().url(),
-  responseType: (0, import_zod.enum)(["code", "token", "id_token"]),
-  clientId: (0, import_zod.string)(),
-  clientSecret: (0, import_zod.string)()
+var import_v4 = require("zod/v4");
+var AuthorizeConfigSchema = import_v4.z.union([
+  (0, import_v4.string)().url(),
+  (0, import_v4.object)({
+    url: (0, import_v4.string)().url(),
+    params: (0, import_v4.object)({
+      responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
+      scope: (0, import_v4.string)().optional()
+    })
+  })
+]);
+var AccessTokenConfigSchema = import_v4.z.union([
+  (0, import_v4.string)().url(),
+  (0, import_v4.object)({
+    url: (0, import_v4.string)().url(),
+    headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional()
+  })
+]);
+var UserInfoConfigSchema = import_v4.z.union([
+  (0, import_v4.string)().url(),
+  (0, import_v4.object)({
+    url: (0, import_v4.string)().url(),
+    headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional(),
+    method: (0, import_v4.string)().optional()
+  })
+]);
+var OAuthProviderCredentialsSchema = (0, import_v4.object)({
+  id: (0, import_v4.string)(),
+  name: (0, import_v4.string)(),
+  authorize: AuthorizeConfigSchema.optional(),
+  /** @deprecated */
+  authorizeURL: (0, import_v4.string)().url().optional(),
+  accessToken: AccessTokenConfigSchema,
+  /** @deprecated */
+  scope: (0, import_v4.string)().optional(),
+  userInfo: UserInfoConfigSchema,
+  /** @deprecated */
+  responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
+  clientId: (0, import_v4.string)(),
+  clientSecret: (0, import_v4.string)(),
+  profile: import_v4.z.function().optional()
+});
+var OAuthProviderConfigSchema = (0, import_v4.object)({
+  authorize: AuthorizeConfigSchema.optional(),
+  /** @deprecated */
+  authorizeURL: (0, import_v4.string)().url().optional(),
+  accessToken: AccessTokenConfigSchema,
+  /** @deprecated */
+  scope: (0, import_v4.string)().optional(),
+  userInfo: UserInfoConfigSchema,
+  /** @deprecated */
+  responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
+  clientId: (0, import_v4.string)(),
+  clientSecret: (0, import_v4.string)()
 });
 var OAuthAuthorization = OAuthProviderConfigSchema.extend({
-  redirectURI: (0, import_zod.string)(),
-  state: (0, import_zod.string)(),
-  codeChallenge: (0, import_zod.string)(),
-  codeChallengeMethod: (0, import_zod.enum)(["plain", "S256"])
+  redirectURI: (0, import_v4.string)(),
+  state: (0, import_v4.string)(),
+  codeChallenge: (0, import_v4.string)(),
+  codeChallengeMethod: (0, import_v4.enum)(["plain", "S256"])
 });
-var OAuthAuthorizationResponse = (0, import_zod.object)({
-  state: (0, import_zod.string)({ message: "Missing state parameter in the OAuth authorization response." }),
-  code: (0, import_zod.string)({ message: "Missing code parameter in the OAuth authorization response." })
+var OAuthAuthorizationResponse = (0, import_v4.object)({
+  state: (0, import_v4.string)({ message: "Missing state parameter in the OAuth authorization response." }),
+  code: (0, import_v4.string)({ message: "Missing code parameter in the OAuth authorization response." })
 });
-var OAuthAuthorizationErrorResponse = (0, import_zod.object)({
-  error: (0, import_zod.enum)([
+var OAuthAuthorizationErrorResponse = (0, import_v4.object)({
+  error: (0, import_v4.enum)([
     "invalid_request",
     "unauthorized_client",
     "access_denied",
@@ -255,24 +549,24 @@ var OAuthAuthorizationErrorResponse = (0, import_zod.object)({
     "server_error",
     "temporarily_unavailable"
   ]),
-  error_description: (0, import_zod.string)().optional(),
-  error_uri: (0, import_zod.string)().optional(),
-  state: (0, import_zod.string)()
+  error_description: (0, import_v4.string)().optional(),
+  error_uri: (0, import_v4.string)().optional(),
+  state: (0, import_v4.string)()
 });
 var OAuthAccessToken = OAuthProviderConfigSchema.extend({
-  redirectURI: (0, import_zod.string)(),
-  code: (0, import_zod.string)(),
-  codeVerifier: (0, import_zod.string)().min(43).max(128)
+  redirectURI: (0, import_v4.string)(),
+  code: (0, import_v4.string)(),
+  codeVerifier: (0, import_v4.string)().min(43).max(128)
 });
-var OAuthAccessTokenResponse = (0, import_zod.object)({
-  access_token: (0, import_zod.string)(),
-  token_type: (0, import_zod.string)().optional(),
-  expires_in: (0, import_zod.number)().optional(),
-  refresh_token: (0, import_zod.string)().optional(),
-  scope: (0, import_zod.string)().optional().or((0, import_zod.null)())
+var OAuthAccessTokenResponse = (0, import_v4.object)({
+  access_token: (0, import_v4.string)(),
+  token_type: (0, import_v4.string)().optional(),
+  expires_in: (0, import_v4.number)().optional(),
+  refresh_token: (0, import_v4.string)().optional(),
+  scope: (0, import_v4.union)([(0, import_v4.string)().optional().or((0, import_v4.null)()), (0, import_v4.array)((0, import_v4.string)()).optional()])
 });
-var OAuthAccessTokenErrorResponse = (0, import_zod.object)({
-  error: (0, import_zod.enum)([
+var OAuthAccessTokenErrorResponse = (0, import_v4.object)({
+  error: (0, import_v4.enum)([
     "invalid_request",
     "invalid_client",
     "invalid_grant",
@@ -280,48 +574,18 @@ var OAuthAccessTokenErrorResponse = (0, import_zod.object)({
     "unsupported_grant_type",
     "invalid_scope"
   ]),
-  error_description: (0, import_zod.string)().optional(),
-  error_uri: (0, import_zod.string)().optional()
+  error_description: (0, import_v4.string)().optional(),
+  error_uri: (0, import_v4.string)().optional()
 });
-var OAuthErrorResponse = (0, import_zod.object)({
-  error: (0, import_zod.string)(),
-  error_description: (0, import_zod.string)().optional()
+var OAuthErrorResponse = (0, import_v4.object)({
+  error: (0, import_v4.string)(),
+  error_description: (0, import_v4.string)().optional()
 });
-var OAuthEnvSchema = (0, import_zod.object)({
-  clientId: import_zod.z.string().min(1, "OAuth Client ID is required in the environment variables."),
-  clientSecret: import_zod.z.string().min(1, "OAuth Client Secret is required in the environment variables.")
+var OAuthEnvSchema = (0, import_v4.object)({
+  clientId: import_v4.z.string().min(1, "OAuth Client ID is required in the environment variables."),
+  clientSecret: import_v4.z.string().min(1, "OAuth Client Secret is required in the environment variables.")
 });
 
-// src/errors.ts
-var AuthInternalError = class extends Error {
-  type = "AUTH_INTERNAL_ERROR";
-  code;
-  constructor(code, message, options2) {
-    super(message, options2);
-    this.code = code;
-    this.name = new.target.name;
-    Error.captureStackTrace(this, new.target);
-  }
-};
-
-// src/utils.ts
-var import_router = require("@aura-stack/router");
-var formatZodError = (error) => {
-  if (!error.issues || error.issues.length === 0) {
-    return {};
-  }
-  return error.issues.reduce((previous, issue) => {
-    const key = issue.path.join(".");
-    return {
-      ...previous,
-      [key]: {
-        code: issue.code,
-        message: issue.message
-      }
-    };
-  }, {});
-};
-
 // src/oauth/index.ts
 var builtInOAuthProviders = {
   github,
@@ -333,18 +597,19 @@ var builtInOAuthProviders = {
   x,
   strava,
   mailchimp,
-  pinterest
+  pinterest,
+  twitch,
+  notion,
+  dropbox,
+  atlassian
 };
 var defineOAuthEnvironment = (oauth) => {
-  const env = process.env;
-  const clientIdSuffix = `${oauth.toUpperCase()}_CLIENT_ID`;
-  const clientSecretSuffix = `${oauth.toUpperCase()}_CLIENT_SECRET`;
   const loadEnvs = OAuthEnvSchema.safeParse({
-    clientId: env[`AURA_AUTH_${clientIdSuffix}`] ?? env[`AUTH_${clientIdSuffix}`] ?? env[`${clientIdSuffix}`],
-    clientSecret: env[`AURA_AUTH_${clientSecretSuffix}`] ?? env[`AUTH_${clientSecretSuffix}`] ?? env[`${clientSecretSuffix}`]
+    clientId: getEnv(`${oauth.toUpperCase()}_CLIENT_ID`),
+    clientSecret: getEnv(`${oauth.toUpperCase()}_CLIENT_SECRET`)
   });
   if (!loadEnvs.success) {
-    const msg = JSON.stringify(formatZodError(loadEnvs.error), null, 2);
+    const msg = JSON.stringify({ [oauth]: formatZodError(loadEnvs.error) }, null, 2);
     throw new AuthInternalError("INVALID_ENVIRONMENT_CONFIGURATION", msg);
   }
   return loadEnvs.data;
@@ -352,32 +617,57 @@ var defineOAuthEnvironment = (oauth) => {
 var defineOAuthProviderConfig = (config) => {
   if (typeof config === "string") {
     const definition = defineOAuthEnvironment(config);
-    const oauthConfig = builtInOAuthProviders[config];
-    return {
-      ...oauthConfig,
-      ...definition
-    };
+    const oauthConfig = builtInOAuthProviders[config]();
+    const parsed2 = OAuthProviderCredentialsSchema.safeParse({ ...oauthConfig, ...definition });
+    if (!parsed2.success) {
+      const details = JSON.stringify({ [config]: formatZodError(parsed2.error) }, null, 2);
+      throw new AuthInternalError(
+        "INVALID_OAUTH_PROVIDER_CONFIGURATION",
+        `Invalid configuration for OAuth provider "${config}": ${details}`
+      );
+    }
+    return parsed2.data;
+  }
+  const hasCredentials = config.clientId && config.clientSecret;
+  const envConfig = hasCredentials ? {} : defineOAuthEnvironment(config.id);
+  const parsed = OAuthProviderCredentialsSchema.safeParse({ ...envConfig, ...config });
+  if (!parsed.success) {
+    const details = JSON.stringify({ [config.id]: formatZodError(parsed.error) }, null, 2);
+    throw new AuthInternalError(
+      "INVALID_OAUTH_PROVIDER_CONFIGURATION",
+      `Invalid configuration for OAuth provider "${config.id}": ${details}`
+    );
   }
-  return config;
+  return parsed.data;
 };
 var createBuiltInOAuthProviders = (oauth = []) => {
   return oauth.reduce((previous, config) => {
     const oauthConfig = defineOAuthProviderConfig(config);
+    if (oauthConfig.id in previous) {
+      throw new AuthInternalError(
+        "DUPLICATED_OAUTH_PROVIDER_ID",
+        `Duplicate OAuth provider id "${oauthConfig.id}" found. Each provider must have a unique id.`
+      );
+    }
     return { ...previous, [oauthConfig.id]: oauthConfig };
   }, {});
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  atlassian,
   bitbucket,
   builtInOAuthProviders,
   createBuiltInOAuthProviders,
   discord,
+  dropbox,
   figma,
   github,
   gitlab,
   mailchimp,
+  notion,
   pinterest,
   spotify,
   strava,
+  twitch,
   x
 });