@aura-stack/auth 0.4.0-rc.5 → 0.5.0

package/dist/oauth/x.cjs

@@ -23,22 +23,25 @@ __export(x_exports, {
   x: () => x
 });
 module.exports = __toCommonJS(x_exports);
-var x = {
-  id: "x",
-  name: "X",
-  authorizeURL: "https://x.com/i/oauth2/authorize",
-  accessToken: "https://api.x.com/2/oauth2/token",
-  userInfo: "https://api.x.com/2/users/me?user.fields=profile_image_url",
-  scope: "users.read users.email tweet.read offline.access",
-  responseType: "code",
-  profile({ data }) {
-    return {
-      sub: data.id,
-      name: data.name,
-      image: data.profile_image_url,
-      email: ""
-    };
-  }
+var x = (options) => {
+  return {
+    id: "x",
+    name: "X",
+    authorizeURL: "https://twitter.com/i/oauth2/authorize",
+    accessToken: "https://api.twitter.com/2/oauth2/token",
+    userInfo: "https://api.twitter.com/2/users/me?user.fields=profile_image_url",
+    scope: "tweet.read users.read offline.access",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.data.id,
+        name: profile.data.name,
+        image: profile.data.profile_image_url,
+        email: void 0
+      };
+    },
+    ...options
+  };
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/oauth/x.d.ts

@@ -1,7 +1,12 @@
-export { X as XProfile, x } from '../index-B8jeIElf.js';
+export { ah as XProfile, ai as x } from '../index-_aXtxb_s.js';
 import 'zod';
 import '../schemas.js';
-import '@aura-stack/router/cookie';
+import 'zod/v4';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/jose/crypto';
+import '@aura-stack/router/cookie';
 import '../@types/utility.js';
+import 'jose';
+import '@aura-stack/router';
+import 'zod/v4/core';

package/dist/oauth/x.js

@@ -1,6 +1,6 @@
 import {
   x
-} from "../chunk-42XB3YCW.js";
+} from "../chunk-EEE7UM5T.js";
 export {
   x
 };

package/dist/schemas.cjs

@@ -28,31 +28,77 @@ __export(schemas_exports, {
   OAuthAuthorizationResponse: () => OAuthAuthorizationResponse,
   OAuthEnvSchema: () => OAuthEnvSchema,
   OAuthErrorResponse: () => OAuthErrorResponse,
-  OAuthProviderConfigSchema: () => OAuthProviderConfigSchema
+  OAuthProviderConfigSchema: () => OAuthProviderConfigSchema,
+  OAuthProviderCredentialsSchema: () => OAuthProviderCredentialsSchema
 });
 module.exports = __toCommonJS(schemas_exports);
-var import_zod = require("zod");
-var OAuthProviderConfigSchema = (0, import_zod.object)({
-  authorizeURL: (0, import_zod.string)().url(),
-  accessToken: (0, import_zod.string)().url(),
-  scope: (0, import_zod.string)().optional(),
-  userInfo: (0, import_zod.string)().url(),
-  responseType: (0, import_zod.enum)(["code", "token", "id_token"]),
-  clientId: (0, import_zod.string)(),
-  clientSecret: (0, import_zod.string)()
+var import_v4 = require("zod/v4");
+var AuthorizeConfigSchema = import_v4.z.union([
+  (0, import_v4.string)().url(),
+  (0, import_v4.object)({
+    url: (0, import_v4.string)().url(),
+    params: (0, import_v4.object)({
+      responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
+      scope: (0, import_v4.string)().optional()
+    })
+  })
+]);
+var AccessTokenConfigSchema = import_v4.z.union([
+  (0, import_v4.string)().url(),
+  (0, import_v4.object)({
+    url: (0, import_v4.string)().url(),
+    headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional()
+  })
+]);
+var UserInfoConfigSchema = import_v4.z.union([
+  (0, import_v4.string)().url(),
+  (0, import_v4.object)({
+    url: (0, import_v4.string)().url(),
+    headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional(),
+    method: (0, import_v4.string)().optional()
+  })
+]);
+var OAuthProviderCredentialsSchema = (0, import_v4.object)({
+  id: (0, import_v4.string)(),
+  name: (0, import_v4.string)(),
+  authorize: AuthorizeConfigSchema.optional(),
+  /** @deprecated */
+  authorizeURL: (0, import_v4.string)().url().optional(),
+  accessToken: AccessTokenConfigSchema,
+  /** @deprecated */
+  scope: (0, import_v4.string)().optional(),
+  userInfo: UserInfoConfigSchema,
+  /** @deprecated */
+  responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
+  clientId: (0, import_v4.string)(),
+  clientSecret: (0, import_v4.string)(),
+  profile: import_v4.z.function().optional()
+});
+var OAuthProviderConfigSchema = (0, import_v4.object)({
+  authorize: AuthorizeConfigSchema.optional(),
+  /** @deprecated */
+  authorizeURL: (0, import_v4.string)().url().optional(),
+  accessToken: AccessTokenConfigSchema,
+  /** @deprecated */
+  scope: (0, import_v4.string)().optional(),
+  userInfo: UserInfoConfigSchema,
+  /** @deprecated */
+  responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
+  clientId: (0, import_v4.string)(),
+  clientSecret: (0, import_v4.string)()
 });
 var OAuthAuthorization = OAuthProviderConfigSchema.extend({
-  redirectURI: (0, import_zod.string)(),
-  state: (0, import_zod.string)(),
-  codeChallenge: (0, import_zod.string)(),
-  codeChallengeMethod: (0, import_zod.enum)(["plain", "S256"])
+  redirectURI: (0, import_v4.string)(),
+  state: (0, import_v4.string)(),
+  codeChallenge: (0, import_v4.string)(),
+  codeChallengeMethod: (0, import_v4.enum)(["plain", "S256"])
 });
-var OAuthAuthorizationResponse = (0, import_zod.object)({
-  state: (0, import_zod.string)({ message: "Missing state parameter in the OAuth authorization response." }),
-  code: (0, import_zod.string)({ message: "Missing code parameter in the OAuth authorization response." })
+var OAuthAuthorizationResponse = (0, import_v4.object)({
+  state: (0, import_v4.string)({ message: "Missing state parameter in the OAuth authorization response." }),
+  code: (0, import_v4.string)({ message: "Missing code parameter in the OAuth authorization response." })
 });
-var OAuthAuthorizationErrorResponse = (0, import_zod.object)({
-  error: (0, import_zod.enum)([
+var OAuthAuthorizationErrorResponse = (0, import_v4.object)({
+  error: (0, import_v4.enum)([
     "invalid_request",
     "unauthorized_client",
     "access_denied",
@@ -61,24 +107,24 @@ var OAuthAuthorizationErrorResponse = (0, import_zod.object)({
     "server_error",
     "temporarily_unavailable"
   ]),
-  error_description: (0, import_zod.string)().optional(),
-  error_uri: (0, import_zod.string)().optional(),
-  state: (0, import_zod.string)()
+  error_description: (0, import_v4.string)().optional(),
+  error_uri: (0, import_v4.string)().optional(),
+  state: (0, import_v4.string)()
 });
 var OAuthAccessToken = OAuthProviderConfigSchema.extend({
-  redirectURI: (0, import_zod.string)(),
-  code: (0, import_zod.string)(),
-  codeVerifier: (0, import_zod.string)().min(43).max(128)
+  redirectURI: (0, import_v4.string)(),
+  code: (0, import_v4.string)(),
+  codeVerifier: (0, import_v4.string)().min(43).max(128)
 });
-var OAuthAccessTokenResponse = (0, import_zod.object)({
-  access_token: (0, import_zod.string)(),
-  token_type: (0, import_zod.string)().optional(),
-  expires_in: (0, import_zod.number)().optional(),
-  refresh_token: (0, import_zod.string)().optional(),
-  scope: (0, import_zod.string)().optional().or((0, import_zod.null)())
+var OAuthAccessTokenResponse = (0, import_v4.object)({
+  access_token: (0, import_v4.string)(),
+  token_type: (0, import_v4.string)().optional(),
+  expires_in: (0, import_v4.number)().optional(),
+  refresh_token: (0, import_v4.string)().optional(),
+  scope: (0, import_v4.union)([(0, import_v4.string)().optional().or((0, import_v4.null)()), (0, import_v4.array)((0, import_v4.string)()).optional()])
 });
-var OAuthAccessTokenErrorResponse = (0, import_zod.object)({
-  error: (0, import_zod.enum)([
+var OAuthAccessTokenErrorResponse = (0, import_v4.object)({
+  error: (0, import_v4.enum)([
     "invalid_request",
     "invalid_client",
     "invalid_grant",
@@ -86,16 +132,16 @@ var OAuthAccessTokenErrorResponse = (0, import_zod.object)({
     "unsupported_grant_type",
     "invalid_scope"
   ]),
-  error_description: (0, import_zod.string)().optional(),
-  error_uri: (0, import_zod.string)().optional()
+  error_description: (0, import_v4.string)().optional(),
+  error_uri: (0, import_v4.string)().optional()
 });
-var OAuthErrorResponse = (0, import_zod.object)({
-  error: (0, import_zod.string)(),
-  error_description: (0, import_zod.string)().optional()
+var OAuthErrorResponse = (0, import_v4.object)({
+  error: (0, import_v4.string)(),
+  error_description: (0, import_v4.string)().optional()
 });
-var OAuthEnvSchema = (0, import_zod.object)({
-  clientId: import_zod.z.string().min(1, "OAuth Client ID is required in the environment variables."),
-  clientSecret: import_zod.z.string().min(1, "OAuth Client Secret is required in the environment variables.")
+var OAuthEnvSchema = (0, import_v4.object)({
+  clientId: import_v4.z.string().min(1, "OAuth Client ID is required in the environment variables."),
+  clientSecret: import_v4.z.string().min(1, "OAuth Client Secret is required in the environment variables.")
 });
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
@@ -107,5 +153,6 @@ var OAuthEnvSchema = (0, import_zod.object)({
   OAuthAuthorizationResponse,
   OAuthEnvSchema,
   OAuthErrorResponse,
-  OAuthProviderConfigSchema
+  OAuthProviderConfigSchema,
+  OAuthProviderCredentialsSchema
 });

package/dist/schemas.d.ts

@@ -1,18 +1,74 @@
-import { z } from 'zod';
+import { z } from 'zod/v4';
 
+declare const OAuthProviderCredentialsSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    authorize: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+        params: z.ZodObject<{
+            responseType: z.ZodOptional<z.ZodEnum<{
+                token: "token";
+                code: "code";
+                id_token: "id_token";
+                refresh_token: "refresh_token";
+            }>>;
+            scope: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>]>>;
+    authorizeURL: z.ZodOptional<z.ZodString>;
+    accessToken: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>]>;
+    scope: z.ZodOptional<z.ZodString>;
+    userInfo: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        method: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>;
+    responseType: z.ZodOptional<z.ZodEnum<{
+        token: "token";
+        code: "code";
+        id_token: "id_token";
+        refresh_token: "refresh_token";
+    }>>;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    profile: z.ZodOptional<z.ZodFunction<z.core.$ZodFunctionArgs, z.core.$ZodFunctionOut>>;
+}, z.core.$strip>;
 /**
  * Schema for OAuth Provider Configuration
  */
 declare const OAuthProviderConfigSchema: z.ZodObject<{
-    authorizeURL: z.ZodString;
-    accessToken: z.ZodString;
+    authorize: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+        params: z.ZodObject<{
+            responseType: z.ZodOptional<z.ZodEnum<{
+                token: "token";
+                code: "code";
+                id_token: "id_token";
+                refresh_token: "refresh_token";
+            }>>;
+            scope: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>]>>;
+    authorizeURL: z.ZodOptional<z.ZodString>;
+    accessToken: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>]>;
     scope: z.ZodOptional<z.ZodString>;
-    userInfo: z.ZodString;
-    responseType: z.ZodEnum<{
+    userInfo: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        method: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>;
+    responseType: z.ZodOptional<z.ZodEnum<{
         token: "token";
         code: "code";
         id_token: "id_token";
-    }>;
+        refresh_token: "refresh_token";
+    }>>;
     clientId: z.ZodString;
     clientSecret: z.ZodString;
 }, z.core.$strip>;
@@ -22,15 +78,35 @@ declare const OAuthProviderConfigSchema: z.ZodObject<{
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.1
  */
 declare const OAuthAuthorization: z.ZodObject<{
-    authorizeURL: z.ZodString;
-    accessToken: z.ZodString;
+    authorize: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+        params: z.ZodObject<{
+            responseType: z.ZodOptional<z.ZodEnum<{
+                token: "token";
+                code: "code";
+                id_token: "id_token";
+                refresh_token: "refresh_token";
+            }>>;
+            scope: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>]>>;
+    authorizeURL: z.ZodOptional<z.ZodString>;
+    accessToken: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>]>;
     scope: z.ZodOptional<z.ZodString>;
-    userInfo: z.ZodString;
-    responseType: z.ZodEnum<{
+    userInfo: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        method: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>;
+    responseType: z.ZodOptional<z.ZodEnum<{
         token: "token";
         code: "code";
         id_token: "id_token";
-    }>;
+        refresh_token: "refresh_token";
+    }>>;
     clientId: z.ZodString;
     clientSecret: z.ZodString;
     redirectURI: z.ZodString;
@@ -74,15 +150,35 @@ declare const OAuthAuthorizationErrorResponse: z.ZodObject<{
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
  */
 declare const OAuthAccessToken: z.ZodObject<{
-    authorizeURL: z.ZodString;
-    accessToken: z.ZodString;
+    authorize: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+        params: z.ZodObject<{
+            responseType: z.ZodOptional<z.ZodEnum<{
+                token: "token";
+                code: "code";
+                id_token: "id_token";
+                refresh_token: "refresh_token";
+            }>>;
+            scope: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>]>>;
+    authorizeURL: z.ZodOptional<z.ZodString>;
+    accessToken: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>]>;
     scope: z.ZodOptional<z.ZodString>;
-    userInfo: z.ZodString;
-    responseType: z.ZodEnum<{
+    userInfo: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        method: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>;
+    responseType: z.ZodOptional<z.ZodEnum<{
         token: "token";
         code: "code";
         id_token: "id_token";
-    }>;
+        refresh_token: "refresh_token";
+    }>>;
     clientId: z.ZodString;
     clientSecret: z.ZodString;
     redirectURI: z.ZodString;
@@ -99,7 +195,7 @@ declare const OAuthAccessTokenResponse: z.ZodObject<{
     token_type: z.ZodOptional<z.ZodString>;
     expires_in: z.ZodOptional<z.ZodNumber>;
     refresh_token: z.ZodOptional<z.ZodString>;
-    scope: z.ZodUnion<[z.ZodOptional<z.ZodString>, z.ZodNull]>;
+    scope: z.ZodUnion<readonly [z.ZodUnion<[z.ZodOptional<z.ZodString>, z.ZodNull]>, z.ZodOptional<z.ZodArray<z.ZodString>>]>;
 }, z.core.$strip>;
 /**
  * Schema for OAuth Access Token Error Response
@@ -130,4 +226,4 @@ declare const OAuthEnvSchema: z.ZodObject<{
     clientSecret: z.ZodString;
 }, z.core.$strip>;
 
-export { OAuthAccessToken, OAuthAccessTokenErrorResponse, OAuthAccessTokenResponse, OAuthAuthorization, OAuthAuthorizationErrorResponse, OAuthAuthorizationResponse, OAuthEnvSchema, OAuthErrorResponse, OAuthProviderConfigSchema };
+export { OAuthAccessToken, OAuthAccessTokenErrorResponse, OAuthAccessTokenResponse, OAuthAuthorization, OAuthAuthorizationErrorResponse, OAuthAuthorizationResponse, OAuthEnvSchema, OAuthErrorResponse, OAuthProviderConfigSchema, OAuthProviderCredentialsSchema };

package/dist/schemas.js

@@ -7,8 +7,9 @@ import {
   OAuthAuthorizationResponse,
   OAuthEnvSchema,
   OAuthErrorResponse,
-  OAuthProviderConfigSchema
-} from "./chunk-YRCB5FLE.js";
+  OAuthProviderConfigSchema,
+  OAuthProviderCredentialsSchema
+} from "./chunk-2A5B7GWR.js";
 export {
   OAuthAccessToken,
   OAuthAccessTokenErrorResponse,
@@ -18,5 +19,6 @@ export {
   OAuthAuthorizationResponse,
   OAuthEnvSchema,
   OAuthErrorResponse,
-  OAuthProviderConfigSchema
+  OAuthProviderConfigSchema,
+  OAuthProviderCredentialsSchema
 };

package/dist/secure.cjs

@@ -1,9 +1,7 @@
 "use strict";
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -17,28 +15,19 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/secure.ts
 var secure_exports = {};
 __export(secure_exports, {
   createCSRF: () => createCSRF,
-  createDerivedSalt: () => createDerivedSalt,
   createHash: () => createHash,
   createPKCE: () => createPKCE,
+  createSecretValue: () => createSecretValue,
   generateSecure: () => generateSecure,
   verifyCSRF: () => verifyCSRF
 });
 module.exports = __toCommonJS(secure_exports);
-var import_crypto = __toESM(require("crypto"), 1);
 
 // src/utils.ts
 var import_router = require("@aura-stack/router");
@@ -55,34 +44,92 @@ var AuthSecurityError = class extends Error {
   }
 };
 
+// src/env.ts
+var import_meta = {};
+var env = new Proxy({}, {
+  get(_, prop) {
+    if (typeof prop !== "string") return void 0;
+    const hasProperty = (process2) => {
+      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
+    };
+    try {
+      if (typeof process !== "undefined" && hasProperty(process.env)) {
+        return process.env[prop];
+      }
+      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
+        return import_meta.env[prop];
+      }
+      if (typeof Deno !== "undefined" && Deno.env?.get) {
+        return Deno.env.get(prop);
+      }
+      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
+        return Bun.env[prop];
+      }
+      const globalValue = globalThis[prop];
+      return typeof globalValue === "string" ? globalValue : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+});
+
+// src/assert.ts
+var import_crypto = require("@aura-stack/jose/crypto");
+var isJWTPayloadWithToken = (payload) => {
+  return typeof payload === "object" && payload !== null && "token" in payload && typeof payload?.token === "string";
+};
+var timingSafeEqual = (a, b) => {
+  const bufferA = import_crypto.encoder.encode(a);
+  const bufferB = import_crypto.encoder.encode(b);
+  const len = Math.max(bufferA.length, bufferB.length);
+  let diff = 0;
+  for (let i = 0; i < len; i++) {
+    diff |= (bufferA[i] ?? 0) ^ (bufferB[i] ?? 0);
+  }
+  return diff === 0 && bufferA.length === bufferB.length;
+};
+
 // src/utils.ts
 var equals = (a, b) => {
   if (a === null || b === null || a === void 0 || b === void 0) return false;
   return a === b;
 };
 
-// src/assert.ts
-var isJWTPayloadWithToken = (payload) => {
-  return typeof payload === "object" && payload !== null && "token" in payload && typeof payload?.token === "string";
+// src/jose.ts
+var import_jose = require("@aura-stack/jose");
+var import_jose2 = require("@aura-stack/jose/jose");
+var import_crypto2 = require("@aura-stack/jose/crypto");
+var jwtVerificationOptions = {
+  algorithms: ["HS256"],
+  typ: "JWT"
 };
 
 // src/secure.ts
 var generateSecure = (length = 32) => {
-  return import_crypto.default.randomBytes(length).toString("base64url");
+  return import_jose2.base64url.encode((0, import_crypto2.getRandomBytes)(length));
+};
+var createSecretValue = (length = 32) => {
+  return import_jose2.base64url.encode((0, import_crypto2.getRandomBytes)(length));
 };
-var createHash = (data, base = "hex") => {
-  return import_crypto.default.createHash("sha256").update(data).digest().toString(base);
+var createHash = async (data) => {
+  const subtle = (0, import_crypto2.getSubtleCrypto)();
+  const digest = await subtle.digest("SHA-256", import_crypto2.encoder.encode(data));
+  return import_jose2.base64url.encode(new Uint8Array(digest));
 };
 var createPKCE = async (verifier) => {
-  const codeVerifier = verifier ?? generateSecure(86);
-  const codeChallenge = createHash(codeVerifier, "base64url");
+  const byteLength = verifier ? void 0 : Math.floor(Math.random() * (96 - 32 + 1) + 32);
+  const codeVerifier = verifier ?? generateSecure(byteLength ?? 64);
+  if (codeVerifier.length < 43 || codeVerifier.length > 128) {
+    throw new AuthSecurityError("PKCE_VERIFIER_INVALID", "The code verifier must be between 43 and 128 characters in length.");
+  }
+  const codeChallenge = await createHash(codeVerifier);
   return { codeVerifier, codeChallenge, method: "S256" };
 };
 var createCSRF = async (jose, csrfCookie) => {
   try {
     const token = generateSecure(32);
     if (csrfCookie) {
-      await jose.verifyJWS(csrfCookie);
+      await jose.verifyJWS(csrfCookie, jwtVerificationOptions);
       return csrfCookie;
     }
     return jose.signJWS({ token });
@@ -93,20 +140,18 @@ var createCSRF = async (jose, csrfCookie) => {
 };
 var verifyCSRF = async (jose, cookie, header) => {
   try {
-    const cookiePayload = await jose.verifyJWS(cookie);
-    const headerPayload = await jose.verifyJWS(header);
+    const cookiePayload = await jose.verifyJWS(cookie, jwtVerificationOptions);
+    const headerPayload = await jose.verifyJWS(header, jwtVerificationOptions);
     if (!isJWTPayloadWithToken(cookiePayload)) {
       throw new AuthSecurityError("CSRF_TOKEN_INVALID", "Cookie payload missing token field.");
     }
     if (!isJWTPayloadWithToken(headerPayload)) {
       throw new AuthSecurityError("CSRF_TOKEN_INVALID", "Header payload missing token field.");
     }
-    const cookieBuffer = Buffer.from(cookiePayload.token);
-    const headerBuffer = Buffer.from(headerPayload.token);
-    if (!equals(headerBuffer.length, cookieBuffer.length)) {
+    if (!equals(cookiePayload.token.length, headerPayload.token.length)) {
       throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
     }
-    if (!import_crypto.default.timingSafeEqual(cookieBuffer, headerBuffer)) {
+    if (!timingSafeEqual(cookiePayload.token, headerPayload.token)) {
       throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
     }
     return true;
@@ -114,15 +159,12 @@ var verifyCSRF = async (jose, cookie, header) => {
     throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
   }
 };
-var createDerivedSalt = (secret) => {
-  return import_crypto.default.createHash("sha256").update(secret).update("aura-auth-salt").digest("hex");
-};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   createCSRF,
-  createDerivedSalt,
   createHash,
   createPKCE,
+  createSecretValue,
   generateSecure,
   verifyCSRF
 });

package/dist/secure.d.ts

@@ -1,13 +1,20 @@
-import { A as AuthRuntimeConfig } from './index-B8jeIElf.js';
+import { c as AuthRuntimeConfig } from './index-_aXtxb_s.js';
 import 'zod';
 import './schemas.js';
-import '@aura-stack/router/cookie';
+import 'zod/v4';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/jose/crypto';
+import '@aura-stack/router/cookie';
 import './@types/utility.js';
+import 'jose';
+import '@aura-stack/router';
+import 'zod/v4/core';
 
+/** @deprecated use `createSecretValue` instead */
 declare const generateSecure: (length?: number) => string;
-declare const createHash: (data: string, base?: "hex" | "base64" | "base64url") => string;
+declare const createSecretValue: (length?: number) => string;
+declare const createHash: (data: string) => Promise<string>;
 /**
  * Creates the code challenge flow for PKCE OAuth flow. It generates a code verifier and its corresponding
  * code challenge using SHA-256 hashing.
@@ -30,12 +37,5 @@ declare const createPKCE: (verifier?: string) => Promise<{
  */
 declare const createCSRF: (jose: AuthRuntimeConfig["jose"], csrfCookie?: string) => Promise<string>;
 declare const verifyCSRF: (jose: AuthRuntimeConfig["jose"], cookie: string, header: string) => Promise<boolean>;
-/**
- * Creates a deterministic derived salt from the provided secret.
- *
- * @param secret the base secret to derive the salt from
- * @returns the derived salt as a hexadecimal string
- */
-declare const createDerivedSalt: (secret: string) => string;
 
-export { createCSRF, createDerivedSalt, createHash, createPKCE, generateSecure, verifyCSRF };
+export { createCSRF, createHash, createPKCE, createSecretValue, generateSecure, verifyCSRF };