@aura-stack/auth 0.4.0 → 0.5.0

package/dist/index.cjs

@@ -1,9 +1,7 @@
 "use strict";
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -17,23 +15,21 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
-  createAuth: () => createAuth
+  builtInOAuthProviders: () => builtInOAuthProviders,
+  createAuth: () => createAuth,
+  createAuthClient: () => createAuthClient,
+  createClient: () => createClient,
+  createSyslogMessage: () => createSyslogMessage
 });
 module.exports = __toCommonJS(index_exports);
-var import_router7 = require("@aura-stack/router");
+
+// src/createAuth.ts
+var import_router9 = require("@aura-stack/router");
 
 // src/env.ts
 var import_meta = {};
@@ -63,6 +59,22 @@ var env = new Proxy({}, {
     }
   }
 });
+var getEnv = (key) => {
+  const keys = [`AURA_AUTH_${key.toUpperCase()}`, `AURA_${key.toUpperCase()}`, `AUTH_${key.toUpperCase()}`, key.toUpperCase()];
+  return env[keys.find((k) => env[k]) ?? ""];
+};
+var getEnvBoolean = (key) => {
+  const value = getEnv(key);
+  if (value === void 0) return false;
+  const normalized = value.trim().toLowerCase();
+  if (["1", "true", "yes", "on", "debug"].includes(normalized)) return true;
+  return false;
+};
+var getEnvArray = (key, defaultValue = []) => {
+  const value = getEnv(key);
+  if (!value) return defaultValue;
+  return value.split(/[,;\n]+/).map((v) => v.trim()).filter(Boolean);
+};
 
 // src/jose.ts
 var import_jose = require("@aura-stack/jose");
@@ -100,6 +112,16 @@ var AuthSecurityError = class extends Error {
     Error.captureStackTrace(this, new.target);
   }
 };
+var AuthClientError = class extends Error {
+  type = "AUTH_CLIENT_ERROR";
+  code;
+  constructor(code, message, options2) {
+    super(message, options2);
+    this.code = code;
+    this.name = new.target.name;
+    Error.captureStackTrace(this, new.target);
+  }
+};
 var isNativeError = (error) => {
   return error instanceof Error;
 };
@@ -114,15 +136,17 @@ var isAuthSecurityError = (error) => {
 };
 
 // src/jose.ts
+var import_jose2 = require("@aura-stack/jose/jose");
+var import_crypto = require("@aura-stack/jose/crypto");
 var createJoseInstance = (secret) => {
-  secret ??= env.AURA_AUTH_SECRET ?? env.AUTH_SECRET;
+  secret ??= getEnv("SECRET");
   if (!secret) {
     throw new AuthInternalError(
       "JOSE_INITIALIZATION_FAILED",
       "AURA_AUTH_SECRET environment variable is not set and no secret was provided."
     );
   }
-  const salt = env.AURA_AUTH_SALT ?? env.AUTH_SALT;
+  const salt = getEnv("SALT");
   if (!salt) {
     throw new AuthInternalError(
       "JOSE_INITIALIZATION_FAILED",
@@ -138,19 +162,43 @@ var createJoseInstance = (secret) => {
       { cause: error }
     );
   }
-  const { derivedKey: derivedSigningKey } = (0, import_jose.createDeriveKey)(secret, salt, "signing");
-  const { derivedKey: derivedEncryptionKey } = (0, import_jose.createDeriveKey)(secret, salt, "encryption");
-  const { derivedKey: derivedCsrfTokenKey } = (0, import_jose.createDeriveKey)(secret, salt, "csrfToken");
-  const { decodeJWT, encodeJWT } = (0, import_jose.createJWT)({ jws: derivedSigningKey, jwe: derivedEncryptionKey });
-  const { signJWS, verifyJWS } = (0, import_jose.createJWS)(derivedCsrfTokenKey);
-  const { encryptJWE, decryptJWE } = (0, import_jose.createJWE)(derivedEncryptionKey);
+  const jose = (async () => {
+    const derivedSigningKey = await (0, import_jose.createDeriveKey)(secret, salt, "signing");
+    const derivedEncryptionKey = await (0, import_jose.createDeriveKey)(secret, salt, "encryption");
+    const derivedCsrfTokenKey = await (0, import_jose.createDeriveKey)(secret, salt, "csrfToken");
+    return {
+      jwt: (0, import_jose.createJWT)({ jws: derivedSigningKey, jwe: derivedEncryptionKey }),
+      jws: (0, import_jose.createJWS)(derivedCsrfTokenKey),
+      jwe: (0, import_jose.createJWE)(derivedEncryptionKey)
+    };
+  })();
+  jose.catch(() => {
+  });
   return {
-    decodeJWT,
-    encodeJWT,
-    signJWS,
-    verifyJWS,
-    encryptJWE,
-    decryptJWE
+    decodeJWT: async (token, options2) => {
+      const { jwt } = await jose;
+      return jwt.decodeJWT(token, options2);
+    },
+    encodeJWT: async (payload) => {
+      const { jwt } = await jose;
+      return jwt.encodeJWT(payload);
+    },
+    signJWS: async (...args) => {
+      const { jws } = await jose;
+      return jws.signJWS(...args);
+    },
+    verifyJWS: async (...args) => {
+      const { jws } = await jose;
+      return jws.verifyJWS(...args);
+    },
+    encryptJWE: async (...args) => {
+      const { jwe } = await jose;
+      return jwe.encryptJWE(...args);
+    },
+    decryptJWE: async (...args) => {
+      const { jwe } = await jose;
+      return jwe.decryptJWE(...args);
+    }
   };
 };
 var jwtVerificationOptions = {
@@ -158,236 +206,158 @@ var jwtVerificationOptions = {
   typ: "JWT"
 };
 
-// src/cookie.ts
-var import_cookie = require("@aura-stack/router/cookie");
-var COOKIE_NAME = "aura-auth";
-var defaultCookieOptions = {
-  httpOnly: true,
-  sameSite: "lax",
-  path: "/",
-  maxAge: 60 * 60 * 24 * 15
-};
-var defaultStandardCookieConfig = {
-  secure: false,
-  httpOnly: true
-};
-var defaultSecureCookieConfig = {
-  secure: true,
-  httpOnly: true
-};
-var defaultHostCookieConfig = {
-  secure: true,
-  httpOnly: true,
-  path: "/",
-  domain: void 0
+// src/utils.ts
+var import_router = require("@aura-stack/router");
+
+// src/assert.ts
+var import_crypto2 = require("@aura-stack/jose/crypto");
+var unsafeChars = [
+  "<",
+  ">",
+  '"',
+  "`",
+  " ",
+  "\r",
+  "\n",
+  "	",
+  "\\",
+  "%2F",
+  "%5C",
+  "%2f",
+  "%5c",
+  "\r\n",
+  "%0A",
+  "%0D",
+  "%0a",
+  "%0d",
+  "..",
+  "//",
+  "///",
+  "...",
+  "%20",
+  "\0"
+];
+var isValidURL = (value) => {
+  if (!new RegExp(/^https?:\/\/[^/]/).test(value)) {
+    return false;
+  }
+  const match = value.match(/^(https?:\/\/)(.*)$/);
+  if (!match) return false;
+  const rest = match[2];
+  for (const char of unsafeChars) {
+    if (rest.includes(char)) return false;
+  }
+  const regex = /^https?:\/\/(?:[a-zA-Z0-9._-]+|localhost|\[[0-9a-fA-F:]+\])(?::\d{1,5})?(?:\/[a-zA-Z0-9._~!$&'()?#*+,;=:@-]*)*\/?$/;
+  return regex.test(match[0]);
 };
-var oauthCookieOptions = {
-  httpOnly: true,
-  maxAge: 5 * 60,
-  sameSite: "lax",
-  expires: new Date(Date.now() + 5 * 60 * 1e3)
+var isJWTPayloadWithToken = (payload) => {
+  return typeof payload === "object" && payload !== null && "token" in payload && typeof payload?.token === "string";
 };
-var setCookie = (cookieName, value, options2) => {
-  return (0, import_cookie.serialize)(cookieName, value, options2);
+var isRelativeURL = (value) => {
+  if (value.length > 100) return false;
+  for (const char of unsafeChars) {
+    if (value.includes(char)) return false;
+  }
+  const regex = /^\/[a-zA-Z0-9\-_\/.?&=#]*\/?$/;
+  return regex.test(value);
 };
-var expiredCookieAttributes = {
-  ...defaultCookieOptions,
-  expires: /* @__PURE__ */ new Date(0),
-  maxAge: 0,
-  secure: true
+var isSameOrigin = (origin, expected) => {
+  const originURL = new URL(origin);
+  const expectedURL = new URL(expected);
+  return equals(originURL.origin, expectedURL.origin);
 };
-var getCookie = (request, cookieName) => {
-  const cookies = request.headers.get("Cookie");
-  if (!cookies) {
-    throw new AuthInternalError("COOKIE_NOT_FOUND", "No cookies found. There is no active session");
-  }
-  const value = (0, import_cookie.parse)(cookies)[cookieName];
-  if (!value) {
-    throw new AuthInternalError("COOKIE_NOT_FOUND", `Cookie "${cookieName}" not found. There is no active session`);
+var patternToRegex = (pattern) => {
+  try {
+    if (pattern.length > 2048) return null;
+    pattern = pattern.replace(/\\/g, "");
+    const match = pattern.match(/^(https?):\/\/([a-zA-Z0-9.*-]{1,253})(?::(\d{1,5}|\*))?(?:\/.*)?$/);
+    if (!match) return null;
+    const [, protocol, host, port] = match;
+    const hasWildcard = host.includes("*");
+    if (hasWildcard && !host.startsWith("*.")) return null;
+    if (hasWildcard && host.slice(2).includes("*")) return null;
+    const domain = hasWildcard ? host.slice(2) : host;
+    const escapedDomain = domain.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const hostRegex = hasWildcard ? `[^.]+\\.${escapedDomain}` : escapedDomain;
+    const portRegex = port === "*" ? ":\\d{1,5}" : port ? `:${port}` : "";
+    return new RegExp(`^${protocol}:\\/\\/${hostRegex}${portRegex}$`);
+  } catch {
+    return null;
   }
-  return value;
 };
-var createSessionCookie = async (jose, session) => {
+var isTrustedOrigin = (url, trustedOrigins) => {
+  if (!isValidURL(url) || trustedOrigins.length === 0) return false;
   try {
-    const encoded = await jose.encodeJWT(session);
-    return encoded;
-  } catch (error) {
-    throw new AuthInternalError("INVALID_JWT_TOKEN", "Failed to create session cookie", { cause: error });
+    const urlOrigin = new URL(url).origin;
+    for (const pattern of trustedOrigins) {
+      const regex = patternToRegex(pattern);
+      if (regex?.test(urlOrigin)) return true;
+      try {
+        if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return true;
+      } catch {
+      }
+    }
+  } catch {
   }
+  return false;
 };
-var defineSecureCookieOptions = (useSecure, attributes, strategy, logger) => {
-  if (!attributes.httpOnly) {
-    logger?.log("COOKIE_HTTPONLY_DISABLED");
-  }
-  if (attributes.domain === "*") {
-    attributes.domain = void 0;
-    logger?.log("COOKIE_WILDCARD_DOMAIN");
+var timingSafeEqual = (a, b) => {
+  const bufferA = import_crypto2.encoder.encode(a);
+  const bufferB = import_crypto2.encoder.encode(b);
+  const len = Math.max(bufferA.length, bufferB.length);
+  let diff = 0;
+  for (let i = 0; i < len; i++) {
+    diff |= (bufferA[i] ?? 0) ^ (bufferB[i] ?? 0);
   }
-  if (!useSecure) {
-    if (attributes.secure) {
-      logger?.log("COOKIE_SECURE_DISABLED");
-    }
-    if (attributes.sameSite == "none") {
-      attributes.sameSite = "lax";
-      logger?.log("COOKIE_SAMESITE_NONE_WITHOUT_SECURE");
-    }
-    if (process.env.NODE_ENV === "production") {
-      logger?.log("COOKIE_INSECURE_IN_PRODUCTION");
+  return diff === 0 && bufferA.length === bufferB.length;
+};
+
+// src/utils.ts
+var AURA_AUTH_VERSION = "0.4.0";
+var equals = (a, b) => {
+  if (a === null || b === null || a === void 0 || b === void 0) return false;
+  return a === b;
+};
+var createErrorHandler = (logger) => {
+  return (error) => {
+    if ((0, import_router.isRouterError)(error)) {
+      const { message, status, statusText } = error;
+      logger?.log("ROUTER_INTERNAL_ERROR");
+      return Response.json({ type: "ROUTER_ERROR", code: "ROUTER_INTERNAL_ERROR", message }, { status, statusText });
     }
-    if (strategy === "host") {
-      logger?.log("COOKIE_HOST_STRATEGY_INSECURE");
+    if ((0, import_router.isInvalidZodSchemaError)(error)) {
+      logger?.log("INVALID_REQUEST");
+      return Response.json({ type: "ROUTER_ERROR", code: "INVALID_REQUEST", message: error.errors }, { status: 422 });
     }
-    return {
-      ...defaultCookieOptions,
-      ...attributes,
-      ...defaultStandardCookieConfig
-    };
-  }
-  return strategy === "host" ? {
-    ...defaultCookieOptions,
-    ...attributes,
-    ...defaultHostCookieConfig
-  } : { ...defaultCookieOptions, ...attributes, ...defaultSecureCookieConfig };
-};
-var createCookieStore = (useSecure, prefix, overrides, logger) => {
-  prefix ??= COOKIE_NAME;
-  const securePrefix = useSecure ? "__Secure-" : "";
-  const hostPrefix = useSecure ? "__Host-" : "";
-  return {
-    sessionToken: {
-      name: `${securePrefix}${prefix}.${overrides?.sessionToken?.name ?? "session_token"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
+    if (isOAuthProtocolError(error)) {
+      const { error: errorCode, message, type, errorURI } = error;
+      logger?.log("OAUTH_PROTOCOL_ERROR", {
+        structuredData: {
+          error: errorCode,
+          error_description: message,
+          error_uri: errorURI ?? ""
+        }
+      });
+      return Response.json(
         {
-          ...defaultCookieOptions,
-          ...overrides?.sessionToken?.attributes
+          type,
+          message
         },
-        overrides?.sessionToken?.attributes?.strategy ?? "secure",
-        logger
-      )
-    },
-    state: {
-      name: `${securePrefix}${prefix}.${overrides?.state?.name ?? "state"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
+        { status: 400 }
+      );
+    }
+    if (isAuthInternalError(error)) {
+      const { type, code, message } = error;
+      logger?.log("INVALID_OAUTH_CONFIGURATION", {
+        structuredData: {
+          error: code,
+          error_description: message
+        }
+      });
+      return Response.json(
         {
-          ...oauthCookieOptions,
-          ...overrides?.state?.attributes
-        },
-        overrides?.state?.attributes?.strategy ?? "secure",
-        logger
-      )
-    },
-    csrfToken: {
-      name: `${hostPrefix}${prefix}.${overrides?.csrfToken?.name ?? "csrf_token"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...overrides?.csrfToken?.attributes,
-          ...defaultHostCookieConfig,
-          sameSite: "strict"
-        },
-        overrides?.csrfToken?.attributes?.strategy ?? "host",
-        logger
-      )
-    },
-    redirectTo: {
-      name: `${securePrefix}${prefix}.${overrides?.redirectTo?.name ?? "redirect_to"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...oauthCookieOptions,
-          ...overrides?.redirectTo?.attributes
-        },
-        overrides?.redirectTo?.attributes?.strategy ?? "secure",
-        logger
-      )
-    },
-    redirectURI: {
-      name: `${securePrefix}${prefix}.${overrides?.redirectURI?.name ?? "redirect_uri"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...oauthCookieOptions,
-          ...overrides?.redirectURI?.attributes
-        },
-        overrides?.redirectURI?.attributes?.strategy ?? "secure",
-        logger
-      )
-    },
-    codeVerifier: {
-      name: `${securePrefix}${prefix}.${overrides?.codeVerifier?.name ?? "code_verifier"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...oauthCookieOptions,
-          ...overrides?.codeVerifier?.attributes
-        },
-        overrides?.codeVerifier?.attributes?.strategy ?? "secure",
-        logger
-      )
-    }
-  };
-};
-
-// src/utils.ts
-var import_router = require("@aura-stack/router");
-var toSnakeCase = (str) => {
-  return str.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2").toLowerCase().replace(/^_+/, "");
-};
-var toUpperCase = (str) => {
-  return str.toUpperCase();
-};
-var toCastCase = (obj, type = "snake") => {
-  return Object.entries(obj).reduce((previous, [key, value]) => {
-    const newKey = type === "snake" ? toSnakeCase(key) : toUpperCase(key);
-    return { ...previous, [newKey]: value };
-  }, {});
-};
-var equals = (a, b) => {
-  if (a === null || b === null || a === void 0 || b === void 0) return false;
-  return a === b;
-};
-var createErrorHandler = (logger) => {
-  return (error) => {
-    if ((0, import_router.isRouterError)(error)) {
-      const { message, status, statusText } = error;
-      logger?.log("ROUTER_INTERNAL_ERROR");
-      return Response.json({ type: "ROUTER_ERROR", code: "ROUTER_INTERNAL_ERROR", message }, { status, statusText });
-    }
-    if ((0, import_router.isInvalidZodSchemaError)(error)) {
-      logger?.log("INVALID_REQUEST");
-      return Response.json({ type: "ROUTER_ERROR", code: "INVALID_REQUEST", message: error.errors }, { status: 422 });
-    }
-    if (isOAuthProtocolError(error)) {
-      const { error: errorCode, message, type, errorURI } = error;
-      logger?.log("OAUTH_PROTOCOL_ERROR", {
-        structuredData: {
-          error: errorCode,
-          error_description: message,
-          error_uri: errorURI ?? ""
-        }
-      });
-      return Response.json(
-        {
-          type,
-          message
-        },
-        { status: 400 }
-      );
-    }
-    if (isAuthInternalError(error)) {
-      const { type, code, message } = error;
-      logger?.log("INVALID_OAUTH_CONFIGURATION", {
-        structuredData: {
-          error: code,
-          error_description: message
-        }
-      });
-      return Response.json(
-        {
-          type,
-          message
+          type,
+          message
         },
         { status: 400 }
       );
@@ -424,7 +394,9 @@ var toISOString = (date) => {
   return new Date(date).toISOString();
 };
 var useSecureCookies = (request, trustedProxyHeaders) => {
-  return trustedProxyHeaders ? request.url.startsWith("https://") || request.headers.get("X-Forwarded-Proto") === "https" || (request.headers.get("Forwarded")?.includes("proto=https") ?? false) : request.url.startsWith("https://");
+  const headers = request instanceof Headers ? request : request.headers;
+  const url = request instanceof Headers ? null : request.url;
+  return trustedProxyHeaders ? url?.startsWith("https://") || headers.get("X-Forwarded-Proto") === "https" || (headers.get("Forwarded")?.includes("proto=https") ?? false) : url?.startsWith("https://") ?? false;
 };
 var formatZodError = (error) => {
   if (!error.issues || error.issues.length === 0) {
@@ -446,1394 +418,2010 @@ var extractPath = (url) => {
   const match = url.match(pathRegex);
   return match && match[2] ? match[2] : "/";
 };
+var createStructuredData = (data, sdID = "metadata") => {
+  const entries = Object.entries(data);
+  if (entries.length === 0) return `[${sdID}]`;
+  const values = entries.map(([key, value]) => `${key}="${String(value).replace(/(["\\\]])/g, "\\$1")}"`).join(" ");
+  return `[${sdID} ${values}]`;
+};
 var getErrorName = (error) => {
   if (error instanceof Error) {
     return error.name;
   }
   return typeof error === "string" ? error : "UnknownError";
 };
-
-// src/oauth/github.ts
-var github = (options2) => {
-  return {
-    id: "github",
-    name: "GitHub",
-    authorizeURL: "https://github.com/login/oauth/authorize",
-    accessToken: "https://github.com/login/oauth/access_token",
-    userInfo: "https://api.github.com/user",
-    scope: "read:user user:email",
-    responseType: "code",
-    profile: (profile) => {
-      return {
-        sub: profile.id.toString(),
-        name: profile.name ?? profile.login,
-        email: profile.email ?? void 0,
-        image: profile.avatar_url
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/bitbucket.ts
-var bitbucket = (options2) => {
-  return {
-    id: "bitbucket",
-    name: "Bitbucket",
-    authorizeURL: "https://bitbucket.org/site/oauth2/authorize",
-    accessToken: "https://bitbucket.org/site/oauth2/access_token",
-    userInfo: "https://api.bitbucket.org/2.0/user",
-    scope: "account email",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.uuid ?? profile.account_id,
-        name: profile.display_name ?? profile.nickname,
-        image: profile.links.avatar?.href,
-        email: void 0
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/figma.ts
-var figma = (options2) => {
-  return {
-    id: "figma",
-    name: "Figma",
-    authorizeURL: "https://www.figma.com/oauth",
-    accessToken: "https://api.figma.com/v1/oauth/token",
-    userInfo: "https://api.figma.com/v1/me",
-    scope: "current_user:read",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.id,
-        name: profile.handle,
-        email: profile.email,
-        image: profile.img_url
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/discord.ts
-var discord = (options2) => {
-  return {
-    id: "discord",
-    name: "Discord",
-    authorizeURL: "https://discord.com/oauth2/authorize",
-    accessToken: "https://discord.com/api/oauth2/token",
-    userInfo: "https://discord.com/api/users/@me",
-    scope: "identify email",
-    responseType: "code",
-    profile(profile) {
-      let image = "";
-      if (profile.avatar === null) {
-        const index = profile.discriminator === "0" ? (BigInt(profile.id) >> 22n) % 6n : Number(profile.discriminator) % 5;
-        image = `https://cdn.discordapp.com/embed/avatars/${index}.png`;
-      } else {
-        const format = profile.avatar.startsWith("a_") ? "gif" : "png";
-        image = `https://cdn.discordapp.com/avatars/${profile.id}/${profile.avatar}.${format}`;
-      }
-      return {
-        sub: profile.id,
-        name: profile.global_name ?? profile.username,
-        email: profile.email ?? "",
-        image
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/gitlab.ts
-var gitlab = (options2) => {
-  return {
-    id: "gitlab",
-    name: "GitLab",
-    authorizeURL: "https://gitlab.com/oauth/authorize",
-    accessToken: "https://gitlab.com/oauth/token",
-    userInfo: "https://gitlab.com/api/v4/user",
-    scope: "read_user",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.id.toString(),
-        name: profile.name ?? profile.username,
-        email: profile.email,
-        image: profile.avatar_url
-      };
-    },
-    ...options2
-  };
+var createBasicAuthHeader = (username, password) => {
+  const getUsername = getEnv(username.toUpperCase()) ?? username;
+  const getPassword = getEnv(password.toUpperCase()) ?? password;
+  if (!getUsername || !getPassword) {
+    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "Missing client credentials for OAuth provider configuration.");
+  }
+  const credentials = `${getUsername}:${getPassword}`;
+  return `Basic ${btoa(credentials)}`;
 };
-
-// src/oauth/spotify.ts
-var spotify = (options2) => {
-  return {
-    id: "spotify",
-    name: "Spotify",
-    authorizeURL: "https://accounts.spotify.com/authorize",
-    accessToken: "https://accounts.spotify.com/api/token",
-    userInfo: "https://api.spotify.com/v1/me",
-    scope: "user-read-private user-read-email",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.id,
-        name: profile.display_name,
-        email: profile.email,
-        image: profile.images[0]?.url ?? void 0
-      };
-    },
-    ...options2
-  };
+var validateRedirectTo = (url) => {
+  if (!isRelativeURL(url) && !isValidURL(url)) return "/";
+  if (isRelativeURL(url)) return url;
+  return "/";
 };
 
-// src/oauth/x.ts
-var x = (options2) => {
-  return {
-    id: "x",
-    name: "X",
-    authorizeURL: "https://twitter.com/i/oauth2/authorize",
-    accessToken: "https://api.twitter.com/2/oauth2/token",
-    userInfo: "https://api.twitter.com/2/users/me?user.fields=profile_image_url",
-    scope: "tweet.read users.read offline.access",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.data.id,
-        name: profile.data.name,
-        image: profile.data.profile_image_url,
-        email: void 0
-      };
-    },
-    ...options2
-  };
+// src/logger.ts
+var logMessages = {
+  ROUTER_INTERNAL_ERROR: {
+    facility: 10,
+    severity: "error",
+    msgId: "ROUTER_INTERNAL_ERROR",
+    message: "Unhandled router error while processing the request"
+  },
+  INVALID_REQUEST: {
+    facility: 10,
+    severity: "warning",
+    msgId: "INVALID_REQUEST",
+    message: "Request validation failed against the expected schema"
+  },
+  SERVER_ERROR: {
+    facility: 10,
+    severity: "error",
+    msgId: "SERVER_ERROR",
+    message: "Unexpected internal server error during authentication"
+  },
+  OAUTH_PROTOCOL_ERROR: {
+    facility: 10,
+    severity: "warning",
+    msgId: "OAUTH_PROTOCOL_ERROR",
+    message: "OAuth provider returned an invalid or unexpected protocol response"
+  },
+  OAUTH_AUTHORIZATION_ERROR: {
+    facility: 10,
+    severity: "error",
+    msgId: "OAUTH_AUTHORIZATION_ERROR",
+    message: "OAuth authorization request was rejected or failed"
+  },
+  INVALID_OAUTH_CONFIGURATION: {
+    facility: 10,
+    severity: "error",
+    msgId: "INVALID_OAUTH_CONFIGURATION",
+    message: "The OAuth provider configuration is invalid or incomplete"
+  },
+  OAUTH_ACCESS_TOKEN_REQUEST_INITIATED: {
+    facility: 10,
+    severity: "debug",
+    msgId: "OAUTH_ACCESS_TOKEN_REQUEST_INITIATED",
+    message: "Starting OAuth access token request to the provider"
+  },
+  INVALID_OAUTH_ACCESS_TOKEN_RESPONSE: {
+    facility: 10,
+    severity: "error",
+    msgId: "INVALID_OAUTH_ACCESS_TOKEN_RESPONSE",
+    message: "OAuth access token endpoint returned an invalid or malformed response"
+  },
+  OAUTH_ACCESS_TOKEN_ERROR: {
+    facility: 10,
+    severity: "error",
+    msgId: "OAUTH_ACCESS_TOKEN_ERROR",
+    message: "OAuth access token endpoint returned an error response"
+  },
+  OAUTH_ACCESS_TOKEN_SUCCESS: {
+    facility: 10,
+    severity: "info",
+    msgId: "OAUTH_ACCESS_TOKEN_SUCCESS",
+    message: "Successfully retrieved OAuth access token from the provider"
+  },
+  OAUTH_ACCESS_TOKEN_REQUEST_FAILED: {
+    facility: 10,
+    severity: "error",
+    msgId: "OAUTH_ACCESS_TOKEN_REQUEST_FAILED",
+    message: "Network or server error while requesting OAuth access token"
+  },
+  OAUTH_USERINFO_REQUEST_INITIATED: {
+    facility: 10,
+    severity: "debug",
+    msgId: "OAUTH_USERINFO_REQUEST_INITIATED",
+    message: "Starting OAuth userinfo request to the provider"
+  },
+  OAUTH_USERINFO_INVALID_RESPONSE: {
+    facility: 10,
+    severity: "error",
+    msgId: "OAUTH_USERINFO_INVALID_RESPONSE",
+    message: "OAuth userinfo endpoint returned an invalid or malformed response"
+  },
+  OAUTH_USERINFO_ERROR: {
+    facility: 10,
+    severity: "error",
+    msgId: "OAUTH_USERINFO_ERROR",
+    message: "OAuth userinfo endpoint returned an error response"
+  },
+  OAUTH_USERINFO_SUCCESS: {
+    facility: 10,
+    severity: "info",
+    msgId: "OAUTH_USERINFO_SUCCESS",
+    message: "Successfully retrieved user information from the OAuth provider"
+  },
+  OAUTH_USERINFO_REQUEST_FAILED: {
+    facility: 10,
+    severity: "error",
+    msgId: "OAUTH_USERINFO_REQUEST_FAILED",
+    message: "Network or server error while requesting user information from the OAuth provider"
+  },
+  OAUTH_CALLBACK_SUCCESS: {
+    facility: 4,
+    severity: "info",
+    msgId: "OAUTH_CALLBACK_SUCCESS",
+    message: "OAuth callback completed successfully and session was created"
+  },
+  MISMATCHING_STATE: {
+    facility: 4,
+    severity: "critical",
+    msgId: "MISMATCHING_STATE",
+    message: "OAuth response state parameter does not match the stored state value"
+  },
+  POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED: {
+    facility: 4,
+    severity: "critical",
+    msgId: "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED",
+    message: "Blocked redirect to untrusted or external URL (potential open redirect attack)"
+  },
+  OPEN_REDIRECT_ATTACK: {
+    facility: 4,
+    severity: "warning",
+    msgId: "OPEN_REDIRECT_ATTACK",
+    message: "Detected redirect target that does not match the trusted origin"
+  },
+  SESSION_TOKEN_MISSING: {
+    facility: 4,
+    severity: "warning",
+    msgId: "SESSION_TOKEN_MISSING",
+    message: "Session cookie is missing from the request"
+  },
+  CSRF_TOKEN_MISSING: {
+    facility: 4,
+    severity: "warning",
+    msgId: "CSRF_TOKEN_MISSING",
+    message: "CSRF token cookie is missing from the request"
+  },
+  CSRF_HEADER_MISSING: {
+    facility: 4,
+    severity: "warning",
+    msgId: "CSRF_HEADER_MISSING",
+    message: "CSRF header is missing from the request"
+  },
+  CSRF_TOKEN_INVALID: {
+    facility: 4,
+    severity: "error",
+    msgId: "CSRF_TOKEN_INVALID",
+    message: "CSRF token verification failed or token is invalid"
+  },
+  SIGN_IN_INITIATED: {
+    facility: 4,
+    severity: "info",
+    msgId: "SIGN_IN_INITIATED",
+    message: "Starting OAuth sign-in flow for the selected provider"
+  },
+  SIGN_OUT_ATTEMPT: {
+    facility: 4,
+    severity: "debug",
+    msgId: "SIGN_OUT_ATTEMPT",
+    message: "Received sign-out request from client"
+  },
+  SIGN_OUT_CSRF_VERIFIED: {
+    facility: 4,
+    severity: "info",
+    msgId: "SIGN_OUT_CSRF_VERIFIED",
+    message: "CSRF token was successfully verified during sign-out"
+  },
+  SIGN_OUT_SUCCESS: {
+    facility: 4,
+    severity: "info",
+    msgId: "SIGN_OUT_SUCCESS",
+    message: "User session was cleared and sign-out completed successfully"
+  },
+  SIGN_OUT_REDIRECT: {
+    facility: 4,
+    severity: "debug",
+    msgId: "SIGN_OUT_REDIRECT",
+    message: "Redirecting client after successful sign-out"
+  },
+  AUTH_SESSION_VALID: {
+    facility: 4,
+    severity: "info",
+    msgId: "AUTH_SESSION_VALID",
+    message: "Session token is valid and user session was returned"
+  },
+  AUTH_SESSION_INVALID: {
+    facility: 4,
+    severity: "notice",
+    msgId: "AUTH_SESSION_INVALID",
+    message: "Session token is missing, expired, or invalid"
+  },
+  INVALID_JWT_TOKEN: {
+    facility: 4,
+    severity: "warning",
+    msgId: "INVALID_JWT_TOKEN",
+    message: "JWT session token failed validation during sign-out"
+  },
+  CSRF_TOKEN_REQUESTED: {
+    facility: 4,
+    severity: "debug",
+    msgId: "CSRF_TOKEN_REQUESTED",
+    message: "Client requested a CSRF token"
+  },
+  CSRF_TOKEN_ISSUED: {
+    facility: 4,
+    severity: "debug",
+    msgId: "CSRF_TOKEN_ISSUED",
+    message: "Issued a new CSRF token to the client"
+  },
+  INVALID_URL: {
+    facility: 10,
+    severity: "error",
+    msgId: "INVALID_URL",
+    message: "Derived origin URL is invalid or malformed"
+  },
+  COOKIE_HTTPONLY_DISABLED: {
+    facility: 10,
+    severity: "critical",
+    msgId: "COOKIE_HTTPONLY_DISABLED",
+    message: "Cookie is configured without HttpOnly. This allows JavaScript access via document.cookie and increases XSS exposure."
+  },
+  COOKIE_WILDCARD_DOMAIN: {
+    facility: 10,
+    severity: "critical",
+    msgId: "COOKIE_WILDCARD_DOMAIN",
+    message: "Cookie 'Domain' is set to a wildcard, which is insecure and should be avoided."
+  },
+  COOKIE_SECURE_DISABLED: {
+    facility: 10,
+    severity: "warning",
+    msgId: "COOKIE_SECURE_DISABLED",
+    message: "Cookie is configured with 'Secure' but the request is not HTTPS. The 'Secure' attribute will be ignored by the browser."
+  },
+  COOKIE_SAMESITE_NONE_WITHOUT_SECURE: {
+    facility: 10,
+    severity: "warning",
+    msgId: "COOKIE_SAMESITE_NONE_WITHOUT_SECURE",
+    message: "Cookie uses SameSite=None without Secure. Falling back to SameSite=Lax for safer defaults."
+  },
+  COOKIE_INSECURE_IN_PRODUCTION: {
+    facility: 10,
+    severity: "critical",
+    msgId: "COOKIE_INSECURE_IN_PRODUCTION",
+    message: "Cookies are being served over an insecure connection in production, which is a serious security risk."
+  },
+  COOKIE_HOST_STRATEGY_INSECURE: {
+    facility: 10,
+    severity: "critical",
+    msgId: "COOKIE_HOST_STRATEGY_INSECURE",
+    message: "__Host- cookies require a secure HTTPS context. Falling back to standard cookie settings."
+  },
+  UNTRUSTED_ORIGIN: {
+    facility: 10,
+    severity: "error",
+    msgId: "UNTRUSTED_ORIGIN",
+    message: "The constructed origin URL is not trusted."
+  }
 };
-
-// src/oauth/strava.ts
-var strava = (options2) => {
+var createLogEntry = (key, overrides) => {
+  const message = logMessages[key];
   return {
-    id: "strava",
-    name: "Strava",
-    authorizeURL: "https://www.strava.com/oauth/authorize",
-    accessToken: "https://www.strava.com/oauth/token",
-    userInfo: "https://www.strava.com/api/v3/athlete",
-    scope: "read",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.id.toString(),
-        name: `${profile.firstname} ${profile.lastname}`,
-        image: profile.profile,
-        email: void 0
-      };
-    },
-    ...options2
+    ...message,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    hostname: "aura-auth",
+    procId: typeof process !== "undefined" && process.pid ? process.pid.toString() : "-",
+    ...overrides
   };
 };
-
-// src/oauth/mailchimp.ts
-var mailchimp = (options2) => {
-  return {
-    id: "mailchimp",
-    name: "Mailchimp",
-    authorizeURL: "https://login.mailchimp.com/oauth2/authorize",
-    accessToken: "https://login.mailchimp.com/oauth2/token",
-    userInfo: "https://login.mailchimp.com/oauth2/metadata",
-    scope: "",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.user_id,
-        name: profile.accountname,
-        email: profile.login.email,
-        image: profile.login.avatar
-      };
-    },
-    ...options2
+var logLevelToSeverity = {
+  debug: ["debug", "info", "notice", "warning", "error", "critical", "alert", "emergency"],
+  info: ["info", "notice", "warning", "error", "critical", "alert", "emergency"],
+  warn: ["warning", "error", "critical", "alert", "emergency"],
+  error: ["error", "critical", "alert", "emergency"]
+};
+var isValidLogLevel = (value) => {
+  return value === "debug" || value === "info" || value === "warn" || value === "error";
+};
+var getSeverityLevel = (severity) => {
+  const severities = {
+    emergency: 0,
+    alert: 1,
+    critical: 2,
+    error: 3,
+    warning: 4,
+    notice: 5,
+    info: 6,
+    debug: 7
   };
+  return severities[severity] ?? 6;
 };
-
-// src/oauth/pinterest.ts
-var pinterest = (options2) => {
+var createSyslogMessage = (options2) => {
+  const { timestamp, hostname, appName = "aura-auth", procId = "-", msgId, structuredData, message } = options2;
+  const pri = (options2.facility ?? 16) * 8 + getSeverityLevel(options2.severity);
+  const structuredDataStr = createStructuredData(structuredData ?? {});
+  return `<${pri}>1 ${timestamp} ${hostname} ${appName} ${procId} ${msgId} ${structuredDataStr} ${message}`;
+};
+var createLogger = (logger) => {
+  if (!logger) return void 0;
+  const level = logger.level;
+  const allowedSeverities = logLevelToSeverity[level] ?? [];
   return {
-    id: "pinterest",
-    name: "Pinterest",
-    authorizeURL: "https://www.pinterest.com/oauth",
-    accessToken: "https://api.pinterest.com/v5/oauth/token",
-    userInfo: "https://api.pinterest.com/v5/user_account",
-    scope: "user_accounts:read",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.id,
-        name: profile.username,
-        image: profile.profile_image,
-        email: void 0
-      };
-    },
-    ...options2
+    level,
+    log(key, overrides) {
+      const entry = createLogEntry(key, overrides);
+      if (!allowedSeverities.includes(entry.severity)) return entry;
+      logger.log({
+        timestamp: entry.timestamp,
+        appName: entry.appName ?? "aura-auth",
+        hostname: entry.hostname ?? "aura-auth",
+        ...entry
+      });
+      return entry;
+    }
   };
 };
+var createProxyLogger = (config2) => {
+  const level = getEnv("LOG_LEVEL");
+  const debug = getEnvBoolean("DEBUG");
+  if (typeof config2?.logger === "object") {
+    return createLogger({
+      log: config2.logger?.log || createSyslogMessage,
+      level: isValidLogLevel(config2.logger?.level) ? config2.logger?.level : isValidLogLevel(level) ? level : "error"
+    });
+  }
+  if (debug || config2?.logger === true || level) {
+    return createLogger({
+      level: isValidLogLevel(level) ? level : "debug",
+      log: (options2) => {
+        const message = createSyslogMessage(options2);
+        console.log(message);
+      }
+    });
+  }
+  return void 0;
+};
 
-// src/schemas.ts
-var import_zod = require("zod");
-var OAuthProviderCredentialsSchema = (0, import_zod.object)({
-  id: (0, import_zod.string)(),
-  name: (0, import_zod.string)(),
-  authorizeURL: (0, import_zod.string)().url(),
-  accessToken: (0, import_zod.string)().url(),
-  scope: (0, import_zod.string)(),
-  userInfo: (0, import_zod.string)().url(),
-  responseType: (0, import_zod.enum)(["code", "token", "id_token"]),
-  clientId: (0, import_zod.string)(),
-  clientSecret: (0, import_zod.string)(),
-  profile: import_zod.z.function().optional()
-});
-var OAuthProviderConfigSchema = (0, import_zod.object)({
-  authorizeURL: (0, import_zod.string)().url(),
-  accessToken: (0, import_zod.string)().url(),
-  scope: (0, import_zod.string)().optional(),
-  userInfo: (0, import_zod.string)().url(),
-  responseType: (0, import_zod.enum)(["code", "token", "id_token"]),
-  clientId: (0, import_zod.string)(),
-  clientSecret: (0, import_zod.string)()
-});
-var OAuthAuthorization = OAuthProviderConfigSchema.extend({
-  redirectURI: (0, import_zod.string)(),
-  state: (0, import_zod.string)(),
-  codeChallenge: (0, import_zod.string)(),
-  codeChallengeMethod: (0, import_zod.enum)(["plain", "S256"])
-});
-var OAuthAuthorizationResponse = (0, import_zod.object)({
-  state: (0, import_zod.string)({ message: "Missing state parameter in the OAuth authorization response." }),
-  code: (0, import_zod.string)({ message: "Missing code parameter in the OAuth authorization response." })
-});
-var OAuthAuthorizationErrorResponse = (0, import_zod.object)({
-  error: (0, import_zod.enum)([
-    "invalid_request",
-    "unauthorized_client",
-    "access_denied",
-    "unsupported_response_type",
-    "invalid_scope",
-    "server_error",
-    "temporarily_unavailable"
-  ]),
-  error_description: (0, import_zod.string)().optional(),
-  error_uri: (0, import_zod.string)().optional(),
-  state: (0, import_zod.string)()
-});
-var OAuthAccessToken = OAuthProviderConfigSchema.extend({
-  redirectURI: (0, import_zod.string)(),
-  code: (0, import_zod.string)(),
-  codeVerifier: (0, import_zod.string)().min(43).max(128)
-});
-var OAuthAccessTokenResponse = (0, import_zod.object)({
-  access_token: (0, import_zod.string)(),
-  token_type: (0, import_zod.string)().optional(),
-  expires_in: (0, import_zod.number)().optional(),
-  refresh_token: (0, import_zod.string)().optional(),
-  scope: (0, import_zod.string)().optional().or((0, import_zod.null)())
-});
-var OAuthAccessTokenErrorResponse = (0, import_zod.object)({
-  error: (0, import_zod.enum)([
-    "invalid_request",
-    "invalid_client",
-    "invalid_grant",
-    "unauthorized_client",
-    "unsupported_grant_type",
-    "invalid_scope"
-  ]),
-  error_description: (0, import_zod.string)().optional(),
-  error_uri: (0, import_zod.string)().optional()
-});
-var OAuthErrorResponse = (0, import_zod.object)({
-  error: (0, import_zod.string)(),
-  error_description: (0, import_zod.string)().optional()
-});
-var OAuthEnvSchema = (0, import_zod.object)({
-  clientId: import_zod.z.string().min(1, "OAuth Client ID is required in the environment variables."),
-  clientSecret: import_zod.z.string().min(1, "OAuth Client Secret is required in the environment variables.")
-});
-
-// src/oauth/index.ts
-var builtInOAuthProviders = {
-  github,
-  bitbucket,
-  figma,
-  discord,
-  gitlab,
-  spotify,
-  x,
-  strava,
-  mailchimp,
-  pinterest
+// src/cookie.ts
+var import_cookie = require("@aura-stack/router/cookie");
+var COOKIE_NAME = "aura-auth";
+var defaultCookieOptions = {
+  httpOnly: true,
+  sameSite: "lax",
+  path: "/",
+  maxAge: 60 * 60 * 24 * 15
 };
-var defineOAuthEnvironment = (oauth) => {
-  const clientIdSuffix = `${oauth.toUpperCase()}_CLIENT_ID`;
-  const clientSecretSuffix = `${oauth.toUpperCase()}_CLIENT_SECRET`;
-  const loadEnvs = OAuthEnvSchema.safeParse({
-    clientId: env[`AURA_AUTH_${clientIdSuffix}`] ?? env[`AUTH_${clientIdSuffix}`] ?? env[`${clientIdSuffix}`],
-    clientSecret: env[`AURA_AUTH_${clientSecretSuffix}`] ?? env[`AUTH_${clientSecretSuffix}`] ?? env[`${clientSecretSuffix}`]
-  });
-  if (!loadEnvs.success) {
-    const msg = JSON.stringify(formatZodError(loadEnvs.error), null, 2);
-    throw new AuthInternalError("INVALID_ENVIRONMENT_CONFIGURATION", msg);
-  }
-  return loadEnvs.data;
+var defaultStandardCookieConfig = {
+  secure: false,
+  httpOnly: true
 };
-var defineOAuthProviderConfig = (config2) => {
-  if (typeof config2 === "string") {
-    const definition = defineOAuthEnvironment(config2);
-    const oauthConfig = builtInOAuthProviders[config2]();
-    const parsed2 = OAuthProviderCredentialsSchema.safeParse({ ...oauthConfig, ...definition });
-    if (!parsed2.success) {
-      const details = JSON.stringify(formatZodError(parsed2.error), null, 2);
-      throw new AuthInternalError(
-        "INVALID_OAUTH_PROVIDER_CONFIGURATION",
-        `Invalid configuration for OAuth provider "${config2}": ${details}`
-      );
-    }
-    return parsed2.data;
-  }
-  const hasCredentials = config2.clientId && config2.clientSecret;
-  const envConfig = hasCredentials ? {} : defineOAuthEnvironment(config2.id);
-  const parsed = OAuthProviderCredentialsSchema.safeParse({ ...envConfig, ...config2 });
-  if (!parsed.success) {
-    const details = JSON.stringify(formatZodError(parsed.error), null, 2);
-    throw new AuthInternalError(
-      "INVALID_OAUTH_PROVIDER_CONFIGURATION",
-      `Invalid configuration for OAuth provider "${config2.id}": ${details}`
-    );
-  }
-  return parsed.data;
+var defaultSecureCookieConfig = {
+  secure: true,
+  httpOnly: true
 };
-var createBuiltInOAuthProviders = (oauth = []) => {
-  return oauth.reduce((previous, config2) => {
-    const oauthConfig = defineOAuthProviderConfig(config2);
-    if (oauthConfig.id in previous) {
-      throw new AuthInternalError(
-        "DUPLICATED_OAUTH_PROVIDER_ID",
-        `Duplicate OAuth provider id "${oauthConfig.id}" found. Each provider must have a unique id.`
-      );
-    }
-    return { ...previous, [oauthConfig.id]: oauthConfig };
-  }, {});
+var defaultHostCookieConfig = {
+  secure: true,
+  httpOnly: true,
+  path: "/",
+  domain: void 0
 };
-
-// src/actions/signIn/signIn.ts
-var import_zod2 = require("zod");
-var import_router2 = require("@aura-stack/router");
-
-// src/headers.ts
-var cacheControl = {
-  "Cache-Control": "no-store",
-  Pragma: "no-cache",
-  Expires: "0",
-  Vary: "Cookie"
+var oauthCookieOptions = {
+  httpOnly: true,
+  maxAge: 5 * 60,
+  sameSite: "lax",
+  expires: new Date(Date.now() + 5 * 60 * 1e3)
 };
-var contentSecurityPolicy = {
-  "Content-Security-Policy": [
-    "default-src 'none'",
-    "script-src 'self'",
-    "frame-src 'none'",
-    "object-src 'none'",
-    "frame-ancestors 'none'",
-    "base-uri 'none'"
-  ].join("; ")
+var setCookie = (cookieName, value, options2) => {
+  return (0, import_cookie.serialize)(cookieName, value, options2);
 };
-var secureHeaders = {
-  "X-Content-Type-Options": "nosniff",
-  "X-Frame-Options": "DENY",
-  "Referrer-Policy": "strict-origin-when-cross-origin"
+var expiredCookieAttributes = {
+  ...defaultCookieOptions,
+  expires: /* @__PURE__ */ new Date(0),
+  maxAge: 0,
+  secure: true
 };
-var secureApiHeaders = {
-  ...cacheControl,
-  ...contentSecurityPolicy,
-  ...secureHeaders
+var getCookie = (request, cookieName) => {
+  const cookies = request instanceof Request ? request.headers.get("Cookie") : request.get("Cookie");
+  if (!cookies) {
+    throw new AuthInternalError("COOKIE_NOT_FOUND", "No cookies found. There is no active session");
+  }
+  const value = (0, import_cookie.parse)(cookies)[cookieName];
+  if (!value) {
+    throw new AuthInternalError("COOKIE_NOT_FOUND", `Cookie "${cookieName}" not found. There is no active session`);
+  }
+  return value;
 };
-
-// src/secure.ts
-var import_crypto2 = __toESM(require("crypto"), 1);
-
-// src/assert.ts
-var import_crypto = require("crypto");
-var unsafeChars = [
-  "<",
-  ">",
-  '"',
-  "`",
-  " ",
-  "\r",
-  "\n",
-  "	",
-  "\\",
-  "%2F",
-  "%5C",
-  "%2f",
-  "%5c",
-  "\r\n",
-  "%0A",
-  "%0D",
-  "%0a",
-  "%0d",
-  "..",
-  "//",
-  "///",
-  "...",
-  "%20",
-  "\0"
-];
-var isValidURL = (value) => {
-  if (!new RegExp(/^https?:\/\/[^/]/).test(value)) {
-    return false;
-  }
-  const match = value.match(/^(https?:\/\/)(.*)$/);
-  if (!match) return false;
-  const rest = match[2];
-  for (const char of unsafeChars) {
-    if (rest.includes(char)) return false;
-  }
-  const regex = /^https?:\/\/(?:[a-zA-Z0-9._-]+|localhost|\[[0-9a-fA-F:]+\])(?::\d{1,5})?(?:\/[a-zA-Z0-9._~!$&'()?#*+,;=:@-]*)*\/?$/;
-  return regex.test(match[0]);
-};
-var isJWTPayloadWithToken = (payload) => {
-  return typeof payload === "object" && payload !== null && "token" in payload && typeof payload?.token === "string";
-};
-var isRelativeURL = (value) => {
-  if (value.length > 100) return false;
-  for (const char of unsafeChars) {
-    if (value.includes(char)) return false;
-  }
-  const regex = /^\/[a-zA-Z0-9\-_\/.?&=#]*\/?$/;
-  return regex.test(value);
-};
-var isSameOrigin = (origin, expected) => {
-  const originURL = new URL(origin);
-  const expectedURL = new URL(expected);
-  return equals(originURL.origin, expectedURL.origin);
-};
-var patternToRegex = (pattern) => {
-  try {
-    if (pattern.length > 2048) return null;
-    pattern = pattern.replace(/\\/g, "");
-    const match = pattern.match(/^(https?):\/\/([a-zA-Z0-9.*-]{1,253})(?::(\d{1,5}|\*))?(?:\/.*)?$/);
-    if (!match) return null;
-    const [, protocol, host, port] = match;
-    const hasWildcard = host.includes("*");
-    if (hasWildcard && !host.startsWith("*.")) return null;
-    if (hasWildcard && host.slice(2).includes("*")) return null;
-    const domain = hasWildcard ? host.slice(2) : host;
-    const escapedDomain = domain.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const hostRegex = hasWildcard ? `[^.]+\\.${escapedDomain}` : escapedDomain;
-    const portRegex = port === "*" ? ":\\d{1,5}" : port ? `:${port}` : "";
-    return new RegExp(`^${protocol}:\\/\\/${hostRegex}${portRegex}$`);
-  } catch {
-    return null;
-  }
-};
-var isTrustedOrigin = (url, trustedOrigins) => {
-  if (!isValidURL(url) || trustedOrigins.length === 0) return false;
+var createSessionCookie = async (jose, session) => {
   try {
-    const urlOrigin = new URL(url).origin;
-    for (const pattern of trustedOrigins) {
-      const regex = patternToRegex(pattern);
-      if (regex?.test(urlOrigin)) return true;
-      try {
-        if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return true;
-      } catch {
-      }
-    }
-  } catch {
-  }
-  return false;
-};
-var safeEquals = (a, b) => {
-  const bufferA = Buffer.from(a);
-  const bufferB = Buffer.from(b);
-  if (bufferA.length !== bufferB.length) {
-    return false;
+    const encoded = await jose.encodeJWT(session);
+    return encoded;
+  } catch (error) {
+    throw new AuthInternalError("INVALID_JWT_TOKEN", "Failed to create session cookie", { cause: error });
   }
-  return (0, import_crypto.timingSafeEqual)(bufferA, bufferB);
 };
-
-// src/secure.ts
-var generateSecure = (length = 32) => {
-  return import_crypto2.default.randomBytes(length).toString("base64url");
-};
-var createHash = (data, base = "hex") => {
-  return import_crypto2.default.createHash("sha256").update(data).digest().toString(base);
-};
-var createPKCE = async (verifier) => {
-  const byteLength = verifier ? void 0 : Math.floor(Math.random() * (96 - 32 + 1) + 32);
-  const codeVerifier = verifier ?? generateSecure(byteLength ?? 64);
-  if (codeVerifier.length < 43 || codeVerifier.length > 128) {
-    throw new AuthSecurityError("PKCE_VERIFIER_INVALID", "The code verifier must be between 43 and 128 characters in length.");
+var defineSecureCookieOptions = (useSecure, attributes, strategy, logger) => {
+  if (!attributes.httpOnly) {
+    logger?.log("COOKIE_HTTPONLY_DISABLED");
   }
-  const codeChallenge = createHash(codeVerifier, "base64url");
-  return { codeVerifier, codeChallenge, method: "S256" };
-};
-var createCSRF = async (jose, csrfCookie) => {
-  try {
-    const token = generateSecure(32);
-    if (csrfCookie) {
-      await jose.verifyJWS(csrfCookie, jwtVerificationOptions);
-      return csrfCookie;
-    }
-    return jose.signJWS({ token });
-  } catch {
-    const token = generateSecure(32);
-    return jose.signJWS({ token });
+  if (attributes.domain === "*") {
+    attributes.domain = void 0;
+    logger?.log("COOKIE_WILDCARD_DOMAIN");
   }
-};
-var verifyCSRF = async (jose, cookie, header) => {
-  try {
-    const cookiePayload = await jose.verifyJWS(cookie, jwtVerificationOptions);
-    const headerPayload = await jose.verifyJWS(header, jwtVerificationOptions);
-    if (!isJWTPayloadWithToken(cookiePayload)) {
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "Cookie payload missing token field.");
+  if (!useSecure) {
+    if (attributes.secure) {
+      logger?.log("COOKIE_SECURE_DISABLED");
     }
-    if (!isJWTPayloadWithToken(headerPayload)) {
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "Header payload missing token field.");
+    if (attributes.sameSite == "none") {
+      attributes.sameSite = "lax";
+      logger?.log("COOKIE_SAMESITE_NONE_WITHOUT_SECURE");
     }
-    if (!equals(cookiePayload.token.length, headerPayload.token.length)) {
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
+    if (env.NODE_ENV === "production") {
+      logger?.log("COOKIE_INSECURE_IN_PRODUCTION");
     }
-    if (!safeEquals(cookiePayload.token, headerPayload.token)) {
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
+    if (strategy === "host") {
+      logger?.log("COOKIE_HOST_STRATEGY_INSECURE");
     }
-    return true;
-  } catch {
-    throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
-  }
-};
-
-// src/actions/signIn/authorization.ts
-var createAuthorizationURL = (oauthConfig, redirectURI, state, codeChallenge, codeChallengeMethod, logger) => {
-  const parsed = OAuthAuthorization.safeParse({ ...oauthConfig, redirectURI, state, codeChallenge, codeChallengeMethod });
-  if (!parsed.success) {
-    logger?.log("INVALID_OAUTH_CONFIGURATION", {
-      structuredData: {
-        scope: oauthConfig.scope,
-        redirect_uri: redirectURI,
-        has_state: Boolean(state),
-        has_code_challenge: Boolean(codeChallenge),
-        code_challenge_method: codeChallengeMethod
-      }
-    });
-    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "The OAuth provider configuration is invalid.");
-  }
-  const { authorizeURL, ...options2 } = parsed.data;
-  const { userInfo, accessToken, clientSecret, ...required } = options2;
-  const searchParams = new URLSearchParams(toCastCase(required));
-  return `${authorizeURL}?${searchParams}`;
-};
-var getTrustedOrigins = async (request, trustedOrigins) => {
-  if (!trustedOrigins) return [];
-  const raw = typeof trustedOrigins === "function" ? await trustedOrigins(request) : trustedOrigins;
-  return Array.isArray(raw) ? raw : typeof raw === "string" ? [raw] : [];
-};
-var getOriginURL = async (request, context) => {
-  const headers = request.headers;
-  let origin = new URL(request.url).origin;
-  const trustedOrigins = await getTrustedOrigins(request, context?.trustedOrigins);
-  trustedOrigins.push(origin);
-  if (context?.trustedProxyHeaders) {
-    const protocol = headers.get("Forwarded")?.match(/proto=([^;]+)/i)?.[1] ?? headers.get("X-Forwarded-Proto") ?? "http";
-    const host = headers.get("Host") ?? headers.get("Forwarded")?.match(/host=([^;]+)/i)?.[1] ?? headers.get("X-Forwarded-Host") ?? null;
-    origin = `${protocol}://${host}`;
-  }
-  if (!isTrustedOrigin(origin, trustedOrigins)) {
-    context?.logger?.log("UNTRUSTED_ORIGIN", { structuredData: { origin } });
-    throw new AuthInternalError("UNTRUSTED_ORIGIN", "The constructed origin URL is not trusted.");
-  }
-  return origin;
-};
-var createRedirectURI = async (request, oauth, context) => {
-  const origin = await getOriginURL(request, context);
-  return `${origin}${context.basePath}/callback/${oauth}`;
-};
-var createRedirectTo = async (request, redirectTo, context) => {
-  try {
-    const headers = request.headers;
-    const requestOrigin = await getOriginURL(request, context);
-    const origins = await getTrustedOrigins(request, context?.trustedOrigins);
-    const validateURL = (url) => {
-      if (!isRelativeURL(url) && !isValidURL(url)) return "/";
-      if (isRelativeURL(url)) return url;
-      if (origins.length > 0) {
-        if (isTrustedOrigin(url, origins)) {
-          const urlOrigin = new URL(url).origin;
-          for (const pattern of origins) {
-            const regex = patternToRegex(pattern);
-            if (regex?.test(urlOrigin)) {
-              return isSameOrigin(url, request.url) ? extractPath(url) : url;
-            }
-            if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return url;
-          }
-        }
-        context?.logger?.log("OPEN_REDIRECT_ATTACK");
-        return "/";
-      }
-      if (isSameOrigin(url, requestOrigin)) {
-        return extractPath(url);
-      }
-      context?.logger?.log("OPEN_REDIRECT_ATTACK");
-      return "/";
+    return {
+      ...defaultCookieOptions,
+      ...attributes,
+      ...defaultStandardCookieConfig
     };
-    return validateURL(redirectTo ?? headers.get("Referer") ?? headers.get("Origin") ?? "/");
-  } catch (error) {
-    context?.logger?.log("POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED");
-    return "/";
   }
+  return strategy === "host" ? {
+    ...defaultCookieOptions,
+    ...attributes,
+    ...defaultHostCookieConfig
+  } : { ...defaultCookieOptions, ...attributes, ...defaultSecureCookieConfig };
 };
-
-// src/actions/signIn/signIn.ts
-var signInConfig = (oauth) => {
-  return (0, import_router2.createEndpointConfig)("/signIn/:oauth", {
-    schemas: {
-      params: import_zod2.z.object({
-        oauth: import_zod2.z.enum(
-          Object.keys(oauth),
-          "The OAuth provider is not supported or invalid."
-        )
-      }),
-      searchParams: import_zod2.z.object({
-        redirectTo: import_zod2.z.string().optional()
-      })
-    }
-  });
-};
-var signInAction = (oauth) => {
-  return (0, import_router2.createEndpoint)(
-    "GET",
-    "/signIn/:oauth",
-    async (ctx) => {
-      const {
-        request,
-        params: { oauth: oauth2 },
-        searchParams: { redirectTo },
-        context
-      } = ctx;
-      const { oauth: providers, cookies, logger } = context;
-      const state = generateSecure();
-      const redirectURI = await createRedirectURI(request, oauth2, context);
-      const redirectToValue = await createRedirectTo(request, redirectTo, context);
-      const { codeVerifier, codeChallenge, method } = await createPKCE();
-      const authorization = createAuthorizationURL(providers[oauth2], redirectURI, state, codeChallenge, method, logger);
-      logger?.log("SIGN_IN_INITIATED", {
-        structuredData: { oauth_provider: oauth2, code_challenge_method: method }
-      });
-      const headers = new import_router2.HeadersBuilder(cacheControl).setHeader("Location", authorization).setCookie(cookies.state.name, state, cookies.state.attributes).setCookie(cookies.redirectURI.name, redirectURI, cookies.redirectURI.attributes).setCookie(cookies.redirectTo.name, redirectToValue, cookies.redirectTo.attributes).setCookie(cookies.codeVerifier.name, codeVerifier, cookies.codeVerifier.attributes).toHeaders();
-      return Response.json(
-        { oauth: oauth2 },
+var createCookieStore = (useSecure, prefix, overrides, logger) => {
+  prefix ??= COOKIE_NAME;
+  const securePrefix = useSecure ? "__Secure-" : "";
+  const hostPrefix = useSecure ? "__Host-" : "";
+  return {
+    sessionToken: {
+      name: `${securePrefix}${prefix}.${overrides?.sessionToken?.name ?? "session_token"}`,
+      attributes: defineSecureCookieOptions(
+        useSecure,
         {
-          status: 302,
-          headers
-        }
-      );
+          ...defaultCookieOptions,
+          ...overrides?.sessionToken?.attributes
+        },
+        overrides?.sessionToken?.attributes?.strategy ?? "secure",
+        logger
+      )
     },
-    signInConfig(oauth)
-  );
-};
-
-// src/actions/callback/callback.ts
-var import_zod3 = require("zod");
-var import_router3 = require("@aura-stack/router");
-
-// src/request.ts
-var fetchAsync = async (url, options2 = {}, timeout = 5e3) => {
-  const controller = new AbortController();
-  const timeoutId = setTimeout(() => controller.abort(), timeout);
-  const response = await fetch(url, {
-    ...options2,
-    signal: controller.signal
-  }).finally(() => clearTimeout(timeoutId));
-  return response;
+    state: {
+      name: `${securePrefix}${prefix}.${overrides?.state?.name ?? "state"}`,
+      attributes: defineSecureCookieOptions(
+        useSecure,
+        {
+          ...oauthCookieOptions,
+          ...overrides?.state?.attributes
+        },
+        overrides?.state?.attributes?.strategy ?? "secure",
+        logger
+      )
+    },
+    csrfToken: {
+      name: `${hostPrefix}${prefix}.${overrides?.csrfToken?.name ?? "csrf_token"}`,
+      attributes: defineSecureCookieOptions(
+        useSecure,
+        {
+          ...overrides?.csrfToken?.attributes,
+          ...defaultHostCookieConfig,
+          sameSite: "strict"
+        },
+        overrides?.csrfToken?.attributes?.strategy ?? "host",
+        logger
+      )
+    },
+    redirectTo: {
+      name: `${securePrefix}${prefix}.${overrides?.redirectTo?.name ?? "redirect_to"}`,
+      attributes: defineSecureCookieOptions(
+        useSecure,
+        {
+          ...oauthCookieOptions,
+          ...overrides?.redirectTo?.attributes
+        },
+        overrides?.redirectTo?.attributes?.strategy ?? "secure",
+        logger
+      )
+    },
+    redirectURI: {
+      name: `${securePrefix}${prefix}.${overrides?.redirectURI?.name ?? "redirect_uri"}`,
+      attributes: defineSecureCookieOptions(
+        useSecure,
+        {
+          ...oauthCookieOptions,
+          ...overrides?.redirectURI?.attributes
+        },
+        overrides?.redirectURI?.attributes?.strategy ?? "secure",
+        logger
+      )
+    },
+    codeVerifier: {
+      name: `${securePrefix}${prefix}.${overrides?.codeVerifier?.name ?? "code_verifier"}`,
+      attributes: defineSecureCookieOptions(
+        useSecure,
+        {
+          ...oauthCookieOptions,
+          ...overrides?.codeVerifier?.attributes
+        },
+        overrides?.codeVerifier?.attributes?.strategy ?? "secure",
+        logger
+      )
+    }
+  };
 };
 
-// src/actions/callback/userinfo.ts
-var getDefaultUserInfo = (profile) => {
-  const sub = generateSecure(16);
+// src/oauth/github.ts
+var github = (options2) => {
   return {
-    sub: profile?.id ?? profile?.sub ?? sub,
-    email: profile?.email,
-    name: profile?.name ?? profile?.username ?? profile?.nickname,
-    image: profile?.image ?? profile?.picture
+    id: "github",
+    name: "GitHub",
+    authorizeURL: "https://github.com/login/oauth/authorize",
+    accessToken: "https://github.com/login/oauth/access_token",
+    userInfo: "https://api.github.com/user",
+    scope: "read:user user:email",
+    responseType: "code",
+    profile: (profile) => {
+      return {
+        sub: profile.id.toString(),
+        name: profile.name ?? profile.login,
+        email: profile.email ?? void 0,
+        image: profile.avatar_url
+      };
+    },
+    ...options2
   };
 };
-var getUserInfo = async (oauthConfig, accessToken, logger) => {
-  const userinfoEndpoint = oauthConfig.userInfo;
-  try {
-    logger?.log("OAUTH_USERINFO_REQUEST_INITIATED", {
-      structuredData: {
-        endpoint: userinfoEndpoint
-      }
-    });
-    const response = await fetchAsync(userinfoEndpoint, {
-      method: "GET",
-      headers: {
-        Accept: "application/json",
-        Authorization: `Bearer ${accessToken}`
-      }
-    });
-    if (!response.ok) {
-      logger?.log("OAUTH_USERINFO_INVALID_RESPONSE");
-      throw new OAuthProtocolError("INVALID_REQUEST", "Invalid userinfo response format");
-    }
-    const json = await response.json();
-    const { success, data } = OAuthErrorResponse.safeParse(json);
-    if (success) {
-      logger?.log("OAUTH_USERINFO_ERROR", {
-        message: "Error response received from OAuth userinfo endpoint",
-        structuredData: {
-          error: data.error,
-          error_description: data.error_description ?? ""
-        }
-      });
-      throw new OAuthProtocolError("INVALID_REQUEST", "An error was received from the OAuth userinfo endpoint.");
-    }
-    logger?.log("OAUTH_USERINFO_SUCCESS");
-    return oauthConfig?.profile ? oauthConfig.profile(json) : getDefaultUserInfo(json);
-  } catch (error) {
-    if (isOAuthProtocolError(error)) {
-      throw error;
-    }
-    logger?.log("OAUTH_USERINFO_REQUEST_FAILED");
-    if (isNativeError(error)) {
-      throw new OAuthProtocolError("SERVER_ERROR", "Failed to fetch user information from OAuth provider", "", {
-        cause: error
-      });
-    }
-    throw new OAuthProtocolError("SERVER_ERROR", "Failed to fetch user information", "", { cause: error });
-  }
+
+// src/oauth/bitbucket.ts
+var bitbucket = (options2) => {
+  return {
+    id: "bitbucket",
+    name: "Bitbucket",
+    authorizeURL: "https://bitbucket.org/site/oauth2/authorize",
+    accessToken: "https://bitbucket.org/site/oauth2/access_token",
+    userInfo: "https://api.bitbucket.org/2.0/user",
+    scope: "account email",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.uuid ?? profile.account_id,
+        name: profile.display_name ?? profile.nickname,
+        image: profile.links.avatar?.href,
+        email: void 0
+      };
+    },
+    ...options2
+  };
 };
 
-// src/actions/callback/access-token.ts
-var createAccessToken = async (oauthConfig, redirectURI, code, codeVerifier, logger) => {
-  const parsed = OAuthAccessToken.safeParse({ ...oauthConfig, redirectURI, code, codeVerifier });
-  if (!parsed.success) {
-    logger?.log("INVALID_OAUTH_CONFIGURATION");
-    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "The OAuth provider configuration is invalid.");
-  }
-  const { accessToken, clientId, clientSecret, code: codeParsed, redirectURI: redirectParsed } = parsed.data;
-  try {
-    logger?.log("OAUTH_ACCESS_TOKEN_REQUEST_INITIATED", {
-      structuredData: {
-        has_client_id: Boolean(clientId),
-        redirect_uri: redirectParsed,
-        grant_type: "authorization_code"
-      }
-    });
-    const response = await fetchAsync(accessToken, {
-      method: "POST",
-      headers: {
-        Accept: "application/json",
-        "Content-Type": "application/x-www-form-urlencoded"
-      },
-      body: new URLSearchParams({
-        client_id: clientId,
-        client_secret: clientSecret,
-        code: codeParsed,
-        redirect_uri: redirectParsed,
-        grant_type: "authorization_code",
-        code_verifier: codeVerifier
-      }).toString()
-    });
-    if (!response.ok) {
-      logger?.log("INVALID_OAUTH_ACCESS_TOKEN_RESPONSE");
-      throw new OAuthProtocolError("invalid_request", "Invalid access token response");
-    }
-    const json = await response.json();
-    const token = OAuthAccessTokenResponse.safeParse(json);
-    if (!token.success) {
-      const { success, data } = OAuthAccessTokenErrorResponse.safeParse(json);
-      if (!success) {
-        logger?.log("INVALID_OAUTH_ACCESS_TOKEN_RESPONSE");
-        throw new OAuthProtocolError("invalid_request", "Invalid access token response format");
+// src/oauth/figma.ts
+var figma = (options2) => {
+  return {
+    id: "figma",
+    name: "Figma",
+    authorizeURL: "https://www.figma.com/oauth",
+    accessToken: "https://api.figma.com/v1/oauth/token",
+    userInfo: "https://api.figma.com/v1/me",
+    scope: "current_user:read",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id,
+        name: profile.handle,
+        email: profile.email,
+        image: profile.img_url
+      };
+    },
+    ...options2
+  };
+};
+
+// src/oauth/discord.ts
+var discord = (options2) => {
+  return {
+    id: "discord",
+    name: "Discord",
+    authorizeURL: "https://discord.com/oauth2/authorize",
+    accessToken: "https://discord.com/api/oauth2/token",
+    userInfo: "https://discord.com/api/users/@me",
+    scope: "identify email",
+    responseType: "code",
+    profile(profile) {
+      let image = "";
+      if (profile.avatar === null) {
+        const index = profile.discriminator === "0" ? (BigInt(profile.id) >> 22n) % 6n : Number(profile.discriminator) % 5;
+        image = `https://cdn.discordapp.com/embed/avatars/${index}.png`;
+      } else {
+        const format = profile.avatar.startsWith("a_") ? "gif" : "png";
+        image = `https://cdn.discordapp.com/avatars/${profile.id}/${profile.avatar}.${format}`;
       }
-      logger?.log("OAUTH_ACCESS_TOKEN_ERROR", {
-        structuredData: {
-          error: data.error,
-          error_description: data.error_description ?? ""
-        }
-      });
-      throw new OAuthProtocolError("INVALID_ACCESS_TOKEN", "Failed to retrieve access token");
-    }
-    logger?.log("OAUTH_ACCESS_TOKEN_SUCCESS");
-    return token.data;
-  } catch (error) {
-    logger?.log("OAUTH_ACCESS_TOKEN_REQUEST_FAILED");
-    if (error instanceof Error) {
-      throw new OAuthProtocolError("server_error", "Failed to communicate with OAuth provider", "", { cause: error });
-    }
-    throw error;
-  }
+      return {
+        sub: profile.id,
+        name: profile.global_name ?? profile.username,
+        email: profile.email ?? "",
+        image
+      };
+    },
+    ...options2
+  };
 };
 
-// src/actions/callback/callback.ts
-var callbackConfig = (oauth) => {
-  return (0, import_router3.createEndpointConfig)("/callback/:oauth", {
-    schemas: {
-      params: import_zod3.z.object({
-        oauth: import_zod3.z.enum(
-          Object.keys(oauth),
-          "The OAuth provider is not supported or invalid."
-        )
-      }),
-      searchParams: import_zod3.z.object({
-        code: import_zod3.z.string("Missing code parameter in the OAuth authorization response."),
-        state: import_zod3.z.string("Missing state parameter in the OAuth authorization response.")
-      })
+// src/oauth/gitlab.ts
+var gitlab = (options2) => {
+  return {
+    id: "gitlab",
+    name: "GitLab",
+    authorizeURL: "https://gitlab.com/oauth/authorize",
+    accessToken: "https://gitlab.com/oauth/token",
+    userInfo: "https://gitlab.com/api/v4/user",
+    scope: "read_user",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id.toString(),
+        name: profile.name ?? profile.username,
+        email: profile.email,
+        image: profile.avatar_url
+      };
     },
-    middlewares: [
-      (ctx) => {
-        const {
-          searchParams,
-          context: { logger }
-        } = ctx;
-        const response = OAuthAuthorizationErrorResponse.safeParse(searchParams);
-        if (response.success) {
-          const { error, error_description } = response.data;
-          const criticalAuthErrors = ["access_denied", "server_error"];
-          const severity = criticalAuthErrors.includes(error.toLowerCase()) ? "critical" : "warning";
-          logger?.log("OAUTH_AUTHORIZATION_ERROR", {
-            severity,
-            structuredData: {
-              error,
-              error_description: error_description ?? ""
-            }
-          });
-          throw new OAuthProtocolError(error, error_description || "OAuth Authorization Error");
-        }
-        return ctx;
-      }
-    ]
-  });
+    ...options2
+  };
 };
-var callbackAction = (oauth) => {
-  return (0, import_router3.createEndpoint)(
-    "GET",
-    "/callback/:oauth",
-    async (ctx) => {
-      const {
-        request,
-        params: { oauth: oauth2 },
-        searchParams: { code, state },
-        context
-      } = ctx;
-      const { oauth: providers, cookies, jose, logger, trustedOrigins } = context;
-      const oauthConfig = providers[oauth2];
-      const cookieState = getCookie(request, cookies.state.name);
-      const codeVerifier = getCookie(request, cookies.codeVerifier.name);
-      const cookieRedirectTo = getCookie(request, cookies.redirectTo.name);
-      const cookieRedirectURI = getCookie(request, cookies.redirectURI.name);
-      if (!safeEquals(cookieState, state)) {
-        logger?.log("MISMATCHING_STATE", {
-          structuredData: {
-            oauth_provider: oauth2
-          }
-        });
-        throw new AuthSecurityError(
-          "MISMATCHING_STATE",
-          "The provided state passed in the OAuth response does not match the stored state."
-        );
-      }
-      const accessToken = await createAccessToken(oauthConfig, cookieRedirectURI, code, codeVerifier, logger);
-      const origins = await getTrustedOrigins(request, trustedOrigins);
-      const requestOrigin = await getOriginURL(request, context);
-      if (!isRelativeURL(cookieRedirectTo)) {
-        const isValid = origins.length > 0 ? isTrustedOrigin(cookieRedirectTo, origins) : isSameOrigin(cookieRedirectTo, requestOrigin);
-        if (!isValid) {
-          logger?.log("POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED", {
-            structuredData: {
-              redirect_path: cookieRedirectTo,
-              provider: oauth2,
-              has_trusted_origins: origins.length > 0,
-              request_origin: requestOrigin
-            }
-          });
-          throw new AuthSecurityError(
-            "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED",
-            "Invalid redirect path. Potential open redirect attack detected."
-          );
-        }
-      }
-      const userInfo = await getUserInfo(oauthConfig, accessToken.access_token, logger);
-      const sessionCookie = await createSessionCookie(jose, userInfo);
-      const csrfToken = await createCSRF(jose);
-      logger?.log("OAUTH_CALLBACK_SUCCESS", {
-        structuredData: {
-          provider: oauth2
-        }
-      });
-      const headers = new import_router3.HeadersBuilder(cacheControl).setHeader("Location", cookieRedirectTo).setCookie(cookies.sessionToken.name, sessionCookie, cookies.sessionToken.attributes).setCookie(cookies.csrfToken.name, csrfToken, cookies.csrfToken.attributes).setCookie(cookies.state.name, "", expiredCookieAttributes).setCookie(cookies.redirectURI.name, "", expiredCookieAttributes).setCookie(cookies.redirectTo.name, "", expiredCookieAttributes).setCookie(cookies.codeVerifier.name, "", expiredCookieAttributes).toHeaders();
-      return Response.json({ oauth: oauth2 }, { status: 302, headers });
+
+// src/oauth/spotify.ts
+var spotify = (options2) => {
+  return {
+    id: "spotify",
+    name: "Spotify",
+    authorizeURL: "https://accounts.spotify.com/authorize",
+    accessToken: "https://accounts.spotify.com/api/token",
+    userInfo: "https://api.spotify.com/v1/me",
+    scope: "user-read-private user-read-email",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id,
+        name: profile.display_name,
+        email: profile.email,
+        image: profile.images[0]?.url ?? void 0
+      };
     },
-    callbackConfig(oauth)
-  );
+    ...options2
+  };
 };
 
-// src/actions/session/session.ts
-var import_router4 = require("@aura-stack/router");
-var sessionAction = (0, import_router4.createEndpoint)("GET", "/session", async (ctx) => {
-  const {
-    request,
-    context: { jose, cookies, logger }
-  } = ctx;
-  try {
-    const session = getCookie(request, cookies.sessionToken.name);
-    const decoded = await jose.decodeJWT(session);
-    logger?.log("AUTH_SESSION_VALID");
-    const { exp, iat, jti, nbf, ...user } = decoded;
-    const headers = new Headers(secureApiHeaders);
-    return Response.json({ user, expires: toISOString(exp * 1e3) }, { headers });
-  } catch (error) {
-    logger?.log("AUTH_SESSION_INVALID", { structuredData: { error_type: getErrorName(error) } });
-    const headers = new import_router4.HeadersBuilder(secureApiHeaders).setCookie(cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
-    return Response.json({ authenticated: false, message: "Unauthorized" }, { status: 401, headers });
-  }
-});
-
-// src/actions/signOut/signOut.ts
-var import_zod4 = require("zod");
-var import_router5 = require("@aura-stack/router");
-var config = (0, import_router5.createEndpointConfig)({
-  schemas: {
-    searchParams: import_zod4.z.object({
-      token_type_hint: import_zod4.z.literal("session_token"),
-      redirectTo: import_zod4.z.string().optional()
-    })
-  }
-});
-var signOutAction = (0, import_router5.createEndpoint)(
-  "POST",
-  "/signOut",
-  async (ctx) => {
-    const {
-      request,
-      headers,
-      searchParams: { redirectTo },
-      context
-    } = ctx;
-    const { jose, cookies, logger } = context;
-    const session = headers.getCookie(cookies.sessionToken.name);
-    const csrfToken = headers.getCookie(cookies.csrfToken.name);
-    const header = headers.getHeader("X-CSRF-Token");
-    logger?.log("SIGN_OUT_ATTEMPT", {
-      structuredData: {
-        has_session: Boolean(session),
-        has_csrf_token: Boolean(csrfToken),
-        has_csrf_header: Boolean(header)
-      }
-    });
-    if (!session) {
-      logger?.log("SESSION_TOKEN_MISSING");
-      throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
-    }
-    if (!csrfToken) {
-      logger?.log("CSRF_TOKEN_MISSING");
-      throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF token is missing.");
-    }
-    if (!header) {
-      logger?.log("CSRF_HEADER_MISSING");
-      throw new AuthSecurityError("CSRF_HEADER_MISSING", "The CSRF header is missing.");
-    }
-    try {
-      await verifyCSRF(jose, csrfToken, header);
-    } catch (error) {
-      logger?.log("CSRF_TOKEN_INVALID", { structuredData: { error_type: getErrorName(error) } });
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "CSRF token verification failed");
-    }
-    logger?.log("SIGN_OUT_CSRF_VERIFIED");
-    try {
-      await jose.decodeJWT(session);
-      logger?.log("SIGN_OUT_SUCCESS");
-    } catch (error) {
-      logger?.log("INVALID_JWT_TOKEN", { structuredData: { error_type: getErrorName(error) } });
-    }
-    const baseURL = getBaseURL(request);
-    const location = await createRedirectTo(
-      new Request(baseURL, {
-        headers: headers.toHeaders()
-      }),
-      redirectTo,
-      context
-    );
-    logger?.log("SIGN_OUT_REDIRECT", { structuredData: { location } });
-    const headersList = new import_router5.HeadersBuilder(secureApiHeaders).setHeader("Location", location).setCookie(cookies.csrfToken.name, "", expiredCookieAttributes).setCookie(cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
-    return Response.json({ message: "Signed out successfully" }, { status: import_router5.statusCode.ACCEPTED, headers: headersList });
-  },
-  config
-);
+// src/oauth/x.ts
+var x = (options2) => {
+  return {
+    id: "x",
+    name: "X",
+    authorizeURL: "https://twitter.com/i/oauth2/authorize",
+    accessToken: "https://api.twitter.com/2/oauth2/token",
+    userInfo: "https://api.twitter.com/2/users/me?user.fields=profile_image_url",
+    scope: "tweet.read users.read offline.access",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.data.id,
+        name: profile.data.name,
+        image: profile.data.profile_image_url,
+        email: void 0
+      };
+    },
+    ...options2
+  };
+};
 
-// src/actions/csrfToken/csrfToken.ts
-var import_router6 = require("@aura-stack/router");
-var getCSRFToken = (request, cookieName) => {
-  try {
-    return getCookie(request, cookieName);
-  } catch {
-    return void 0;
-  }
+// src/oauth/strava.ts
+var strava = (options2) => {
+  return {
+    id: "strava",
+    name: "Strava",
+    authorizeURL: "https://www.strava.com/oauth/authorize",
+    accessToken: "https://www.strava.com/oauth/token",
+    userInfo: "https://www.strava.com/api/v3/athlete",
+    scope: "read",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id.toString(),
+        name: `${profile.firstname} ${profile.lastname}`,
+        image: profile.profile,
+        email: void 0
+      };
+    },
+    ...options2
+  };
 };
-var csrfTokenAction = (0, import_router6.createEndpoint)("GET", "/csrfToken", async (ctx) => {
-  const {
-    request,
-    context: { jose, cookies, logger }
-  } = ctx;
-  const token = getCSRFToken(request, cookies.csrfToken.name);
-  logger?.log("CSRF_TOKEN_REQUESTED", { structuredData: { has_token: Boolean(token) } });
-  const csrfToken = await createCSRF(jose, token);
-  logger?.log("CSRF_TOKEN_ISSUED", { structuredData: { issued: Boolean(csrfToken) } });
-  const headers = new Headers(secureApiHeaders);
-  headers.append("Set-Cookie", setCookie(cookies.csrfToken.name, csrfToken, cookies.csrfToken.attributes));
-  return Response.json({ csrfToken }, { headers });
-});
 
-// src/logger.ts
-var logMessages = {
-  ROUTER_INTERNAL_ERROR: {
-    facility: 10,
-    severity: "error",
-    msgId: "ROUTER_INTERNAL_ERROR",
-    message: "Unhandled router error while processing the request"
-  },
-  INVALID_REQUEST: {
-    facility: 10,
-    severity: "warning",
-    msgId: "INVALID_REQUEST",
-    message: "Request validation failed against the expected schema"
-  },
-  SERVER_ERROR: {
-    facility: 10,
-    severity: "error",
-    msgId: "SERVER_ERROR",
-    message: "Unexpected internal server error during authentication"
-  },
-  OAUTH_PROTOCOL_ERROR: {
-    facility: 10,
-    severity: "warning",
-    msgId: "OAUTH_PROTOCOL_ERROR",
-    message: "OAuth provider returned an invalid or unexpected protocol response"
-  },
-  OAUTH_AUTHORIZATION_ERROR: {
-    facility: 10,
-    severity: "error",
-    msgId: "OAUTH_AUTHORIZATION_ERROR",
-    message: "OAuth authorization request was rejected or failed"
-  },
-  INVALID_OAUTH_CONFIGURATION: {
-    facility: 10,
-    severity: "error",
-    msgId: "INVALID_OAUTH_CONFIGURATION",
-    message: "The OAuth provider configuration is invalid or incomplete"
-  },
-  OAUTH_ACCESS_TOKEN_REQUEST_INITIATED: {
-    facility: 10,
-    severity: "debug",
-    msgId: "OAUTH_ACCESS_TOKEN_REQUEST_INITIATED",
-    message: "Starting OAuth access token request to the provider"
-  },
-  INVALID_OAUTH_ACCESS_TOKEN_RESPONSE: {
-    facility: 10,
-    severity: "error",
-    msgId: "INVALID_OAUTH_ACCESS_TOKEN_RESPONSE",
-    message: "OAuth access token endpoint returned an invalid or malformed response"
-  },
-  OAUTH_ACCESS_TOKEN_ERROR: {
-    facility: 10,
-    severity: "error",
-    msgId: "OAUTH_ACCESS_TOKEN_ERROR",
-    message: "OAuth access token endpoint returned an error response"
-  },
-  OAUTH_ACCESS_TOKEN_SUCCESS: {
-    facility: 10,
-    severity: "info",
-    msgId: "OAUTH_ACCESS_TOKEN_SUCCESS",
-    message: "Successfully retrieved OAuth access token from the provider"
-  },
-  OAUTH_ACCESS_TOKEN_REQUEST_FAILED: {
-    facility: 10,
-    severity: "error",
-    msgId: "OAUTH_ACCESS_TOKEN_REQUEST_FAILED",
-    message: "Network or server error while requesting OAuth access token"
-  },
-  OAUTH_USERINFO_REQUEST_INITIATED: {
-    facility: 10,
-    severity: "debug",
-    msgId: "OAUTH_USERINFO_REQUEST_INITIATED",
-    message: "Starting OAuth userinfo request to the provider"
-  },
-  OAUTH_USERINFO_INVALID_RESPONSE: {
-    facility: 10,
-    severity: "error",
-    msgId: "OAUTH_USERINFO_INVALID_RESPONSE",
-    message: "OAuth userinfo endpoint returned an invalid or malformed response"
-  },
-  OAUTH_USERINFO_ERROR: {
-    facility: 10,
-    severity: "error",
-    msgId: "OAUTH_USERINFO_ERROR",
-    message: "OAuth userinfo endpoint returned an error response"
-  },
-  OAUTH_USERINFO_SUCCESS: {
-    facility: 10,
-    severity: "info",
-    msgId: "OAUTH_USERINFO_SUCCESS",
-    message: "Successfully retrieved user information from the OAuth provider"
-  },
-  OAUTH_USERINFO_REQUEST_FAILED: {
-    facility: 10,
-    severity: "error",
-    msgId: "OAUTH_USERINFO_REQUEST_FAILED",
-    message: "Network or server error while requesting user information from the OAuth provider"
-  },
-  OAUTH_CALLBACK_SUCCESS: {
-    facility: 4,
-    severity: "info",
-    msgId: "OAUTH_CALLBACK_SUCCESS",
-    message: "OAuth callback completed successfully and session was created"
-  },
-  MISMATCHING_STATE: {
-    facility: 4,
-    severity: "critical",
-    msgId: "MISMATCHING_STATE",
-    message: "OAuth response state parameter does not match the stored state value"
-  },
-  POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED: {
-    facility: 4,
-    severity: "critical",
-    msgId: "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED",
-    message: "Blocked redirect to untrusted or external URL (potential open redirect attack)"
-  },
-  OPEN_REDIRECT_ATTACK: {
-    facility: 4,
-    severity: "warning",
-    msgId: "OPEN_REDIRECT_ATTACK",
-    message: "Detected redirect target that does not match the trusted origin"
-  },
-  SESSION_TOKEN_MISSING: {
-    facility: 4,
-    severity: "warning",
-    msgId: "SESSION_TOKEN_MISSING",
-    message: "Session cookie is missing from the request"
-  },
-  CSRF_TOKEN_MISSING: {
-    facility: 4,
-    severity: "warning",
-    msgId: "CSRF_TOKEN_MISSING",
-    message: "CSRF token cookie is missing from the request"
-  },
-  CSRF_HEADER_MISSING: {
-    facility: 4,
-    severity: "warning",
-    msgId: "CSRF_HEADER_MISSING",
-    message: "CSRF header is missing from the request"
-  },
-  CSRF_TOKEN_INVALID: {
-    facility: 4,
-    severity: "error",
-    msgId: "CSRF_TOKEN_INVALID",
-    message: "CSRF token verification failed or token is invalid"
-  },
-  SIGN_IN_INITIATED: {
-    facility: 4,
-    severity: "info",
-    msgId: "SIGN_IN_INITIATED",
-    message: "Starting OAuth sign-in flow for the selected provider"
-  },
-  SIGN_OUT_ATTEMPT: {
-    facility: 4,
-    severity: "debug",
-    msgId: "SIGN_OUT_ATTEMPT",
-    message: "Received sign-out request from client"
-  },
-  SIGN_OUT_CSRF_VERIFIED: {
-    facility: 4,
-    severity: "info",
-    msgId: "SIGN_OUT_CSRF_VERIFIED",
-    message: "CSRF token was successfully verified during sign-out"
-  },
-  SIGN_OUT_SUCCESS: {
-    facility: 4,
-    severity: "info",
-    msgId: "SIGN_OUT_SUCCESS",
-    message: "User session was cleared and sign-out completed successfully"
-  },
-  SIGN_OUT_REDIRECT: {
-    facility: 4,
-    severity: "debug",
-    msgId: "SIGN_OUT_REDIRECT",
-    message: "Redirecting client after successful sign-out"
-  },
-  AUTH_SESSION_VALID: {
-    facility: 4,
-    severity: "info",
-    msgId: "AUTH_SESSION_VALID",
-    message: "Session token is valid and user session was returned"
-  },
-  AUTH_SESSION_INVALID: {
-    facility: 4,
-    severity: "notice",
-    msgId: "AUTH_SESSION_INVALID",
-    message: "Session token is missing, expired, or invalid"
-  },
-  INVALID_JWT_TOKEN: {
-    facility: 4,
-    severity: "warning",
-    msgId: "INVALID_JWT_TOKEN",
-    message: "JWT session token failed validation during sign-out"
-  },
-  CSRF_TOKEN_REQUESTED: {
-    facility: 4,
-    severity: "debug",
-    msgId: "CSRF_TOKEN_REQUESTED",
-    message: "Client requested a CSRF token"
-  },
-  CSRF_TOKEN_ISSUED: {
-    facility: 4,
-    severity: "debug",
-    msgId: "CSRF_TOKEN_ISSUED",
-    message: "Issued a new CSRF token to the client"
-  },
-  INVALID_URL: {
-    facility: 10,
-    severity: "error",
-    msgId: "INVALID_URL",
-    message: "Derived origin URL is invalid or malformed"
-  },
-  COOKIE_HTTPONLY_DISABLED: {
-    facility: 10,
-    severity: "critical",
-    msgId: "COOKIE_HTTPONLY_DISABLED",
-    message: "Cookie is configured without HttpOnly. This allows JavaScript access via document.cookie and increases XSS exposure."
-  },
-  COOKIE_WILDCARD_DOMAIN: {
-    facility: 10,
-    severity: "critical",
-    msgId: "COOKIE_WILDCARD_DOMAIN",
-    message: "Cookie 'Domain' is set to a wildcard, which is insecure and should be avoided."
-  },
-  COOKIE_SECURE_DISABLED: {
-    facility: 10,
-    severity: "warning",
-    msgId: "COOKIE_SECURE_DISABLED",
-    message: "Cookie is configured with 'Secure' but the request is not HTTPS. The 'Secure' attribute will be ignored by the browser."
-  },
-  COOKIE_SAMESITE_NONE_WITHOUT_SECURE: {
-    facility: 10,
-    severity: "warning",
-    msgId: "COOKIE_SAMESITE_NONE_WITHOUT_SECURE",
-    message: "Cookie uses SameSite=None without Secure. Falling back to SameSite=Lax for safer defaults."
-  },
-  COOKIE_INSECURE_IN_PRODUCTION: {
-    facility: 10,
-    severity: "critical",
-    msgId: "COOKIE_INSECURE_IN_PRODUCTION",
-    message: "Cookies are being served over an insecure connection in production, which is a serious security risk."
-  },
-  COOKIE_HOST_STRATEGY_INSECURE: {
-    facility: 10,
-    severity: "critical",
-    msgId: "COOKIE_HOST_STRATEGY_INSECURE",
-    message: "__Host- cookies require a secure HTTPS context. Falling back to standard cookie settings."
-  },
-  UNTRUSTED_ORIGIN: {
-    facility: 10,
-    severity: "error",
-    msgId: "UNTRUSTED_ORIGIN",
-    message: "The constructed origin URL is not trusted."
+// src/oauth/mailchimp.ts
+var mailchimp = (options2) => {
+  return {
+    id: "mailchimp",
+    name: "Mailchimp",
+    authorizeURL: "https://login.mailchimp.com/oauth2/authorize",
+    accessToken: "https://login.mailchimp.com/oauth2/token",
+    userInfo: "https://login.mailchimp.com/oauth2/metadata",
+    scope: "",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.user_id,
+        name: profile.accountname,
+        email: profile.login.email,
+        image: profile.login.avatar
+      };
+    },
+    ...options2
+  };
+};
+
+// src/oauth/pinterest.ts
+var pinterest = (options2) => {
+  return {
+    id: "pinterest",
+    name: "Pinterest",
+    authorizeURL: "https://www.pinterest.com/oauth",
+    accessToken: "https://api.pinterest.com/v5/oauth/token",
+    userInfo: "https://api.pinterest.com/v5/user_account",
+    scope: "user_accounts:read",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.id,
+        name: profile.username,
+        image: profile.profile_image,
+        email: void 0
+      };
+    },
+    ...options2
+  };
+};
+
+// src/oauth/twitch.ts
+var twitch = (options2) => {
+  const clientId = options2?.clientId ?? getEnv("TWITCH_CLIENT_ID");
+  return {
+    id: "twitch",
+    name: "Twitch",
+    authorize: {
+      url: "https://id.twitch.tv/oauth2/authorize",
+      params: { scope: "user:read:email", responseType: "code" }
+    },
+    accessToken: "https://id.twitch.tv/oauth2/token",
+    userInfo: {
+      url: "https://api.twitch.tv/helix/users",
+      headers: {
+        "Client-ID": clientId
+      }
+    },
+    profile(profile) {
+      const user = profile.data[0];
+      if (!user) {
+        throw new Error("No user data found in Twitch profile response");
+      }
+      return {
+        sub: user.id,
+        name: user.display_name,
+        email: user.email,
+        picture: user.profile_image_url
+      };
+    },
+    ...options2
+  };
+};
+
+// src/oauth/notion.ts
+var notion = (options2) => {
+  return {
+    id: "notion",
+    name: "Notion",
+    authorize: {
+      url: "https://api.notion.com/v1/oauth/authorize",
+      params: {
+        owner: "user",
+        scope: "user:read",
+        responseType: "code"
+      }
+    },
+    accessToken: {
+      url: "https://api.notion.com/v1/oauth/token",
+      headers: {
+        Authorization: createBasicAuthHeader(
+          options2?.clientId ?? "NOTION_CLIENT_ID",
+          options2?.clientSecret ?? "NOTION_CLIENT_SECRET"
+        )
+      }
+    },
+    userInfo: {
+      url: "https://api.notion.com/v1/users/me",
+      headers: {
+        "Notion-Version": "2022-06-28"
+      }
+    },
+    profile(profile) {
+      return {
+        sub: profile.id,
+        name: profile.name,
+        image: profile.avatar_url ?? "",
+        email: profile?.bot?.owner?.user?.person?.email
+      };
+    },
+    ...options2
+  };
+};
+
+// src/oauth/dropbox.ts
+var dropbox = (options2) => {
+  return {
+    id: "dropbox",
+    name: "Dropbox",
+    authorize: {
+      url: "https://www.dropbox.com/oauth2/authorize",
+      params: { scope: "account_info.read" }
+    },
+    accessToken: "https://api.dropboxapi.com/oauth2/token",
+    userInfo: {
+      method: "POST",
+      url: "https://api.dropboxapi.com/2/users/get_current_account"
+    },
+    profile(profile) {
+      return {
+        sub: profile.account_id,
+        name: profile.name.display_name,
+        email: profile.email,
+        image: profile.profile_photo_url
+      };
+    },
+    ...options2
+  };
+};
+
+// src/oauth/atlassian.ts
+var atlassian = (options2) => {
+  return {
+    id: "atlassian",
+    name: "Atlassian",
+    authorize: {
+      url: "https://auth.atlassian.com/authorize",
+      params: {
+        audience: "api.atlassian.com",
+        scope: "read:me read:account",
+        prompt: "consent"
+      }
+    },
+    authorizeURL: "https://auth.atlassian.com/authorize",
+    accessToken: "https://auth.atlassian.com/oauth/token",
+    userInfo: "https://api.atlassian.com/me",
+    scope: "read:me read:account",
+    responseType: "code",
+    profile(profile) {
+      return {
+        sub: profile.account_id,
+        name: profile.name,
+        email: profile.email,
+        image: profile.picture
+      };
+    },
+    ...options2
+  };
+};
+
+// src/schemas.ts
+var import_v4 = require("zod/v4");
+var AuthorizeConfigSchema = import_v4.z.union([
+  (0, import_v4.string)().url(),
+  (0, import_v4.object)({
+    url: (0, import_v4.string)().url(),
+    params: (0, import_v4.object)({
+      responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
+      scope: (0, import_v4.string)().optional()
+    })
+  })
+]);
+var AccessTokenConfigSchema = import_v4.z.union([
+  (0, import_v4.string)().url(),
+  (0, import_v4.object)({
+    url: (0, import_v4.string)().url(),
+    headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional()
+  })
+]);
+var UserInfoConfigSchema = import_v4.z.union([
+  (0, import_v4.string)().url(),
+  (0, import_v4.object)({
+    url: (0, import_v4.string)().url(),
+    headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional(),
+    method: (0, import_v4.string)().optional()
+  })
+]);
+var OAuthProviderCredentialsSchema = (0, import_v4.object)({
+  id: (0, import_v4.string)(),
+  name: (0, import_v4.string)(),
+  authorize: AuthorizeConfigSchema.optional(),
+  /** @deprecated */
+  authorizeURL: (0, import_v4.string)().url().optional(),
+  accessToken: AccessTokenConfigSchema,
+  /** @deprecated */
+  scope: (0, import_v4.string)().optional(),
+  userInfo: UserInfoConfigSchema,
+  /** @deprecated */
+  responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
+  clientId: (0, import_v4.string)(),
+  clientSecret: (0, import_v4.string)(),
+  profile: import_v4.z.function().optional()
+});
+var OAuthProviderConfigSchema = (0, import_v4.object)({
+  authorize: AuthorizeConfigSchema.optional(),
+  /** @deprecated */
+  authorizeURL: (0, import_v4.string)().url().optional(),
+  accessToken: AccessTokenConfigSchema,
+  /** @deprecated */
+  scope: (0, import_v4.string)().optional(),
+  userInfo: UserInfoConfigSchema,
+  /** @deprecated */
+  responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
+  clientId: (0, import_v4.string)(),
+  clientSecret: (0, import_v4.string)()
+});
+var OAuthAuthorization = OAuthProviderConfigSchema.extend({
+  redirectURI: (0, import_v4.string)(),
+  state: (0, import_v4.string)(),
+  codeChallenge: (0, import_v4.string)(),
+  codeChallengeMethod: (0, import_v4.enum)(["plain", "S256"])
+});
+var OAuthAuthorizationResponse = (0, import_v4.object)({
+  state: (0, import_v4.string)({ message: "Missing state parameter in the OAuth authorization response." }),
+  code: (0, import_v4.string)({ message: "Missing code parameter in the OAuth authorization response." })
+});
+var OAuthAuthorizationErrorResponse = (0, import_v4.object)({
+  error: (0, import_v4.enum)([
+    "invalid_request",
+    "unauthorized_client",
+    "access_denied",
+    "unsupported_response_type",
+    "invalid_scope",
+    "server_error",
+    "temporarily_unavailable"
+  ]),
+  error_description: (0, import_v4.string)().optional(),
+  error_uri: (0, import_v4.string)().optional(),
+  state: (0, import_v4.string)()
+});
+var OAuthAccessToken = OAuthProviderConfigSchema.extend({
+  redirectURI: (0, import_v4.string)(),
+  code: (0, import_v4.string)(),
+  codeVerifier: (0, import_v4.string)().min(43).max(128)
+});
+var OAuthAccessTokenResponse = (0, import_v4.object)({
+  access_token: (0, import_v4.string)(),
+  token_type: (0, import_v4.string)().optional(),
+  expires_in: (0, import_v4.number)().optional(),
+  refresh_token: (0, import_v4.string)().optional(),
+  scope: (0, import_v4.union)([(0, import_v4.string)().optional().or((0, import_v4.null)()), (0, import_v4.array)((0, import_v4.string)()).optional()])
+});
+var OAuthAccessTokenErrorResponse = (0, import_v4.object)({
+  error: (0, import_v4.enum)([
+    "invalid_request",
+    "invalid_client",
+    "invalid_grant",
+    "unauthorized_client",
+    "unsupported_grant_type",
+    "invalid_scope"
+  ]),
+  error_description: (0, import_v4.string)().optional(),
+  error_uri: (0, import_v4.string)().optional()
+});
+var OAuthErrorResponse = (0, import_v4.object)({
+  error: (0, import_v4.string)(),
+  error_description: (0, import_v4.string)().optional()
+});
+var OAuthEnvSchema = (0, import_v4.object)({
+  clientId: import_v4.z.string().min(1, "OAuth Client ID is required in the environment variables."),
+  clientSecret: import_v4.z.string().min(1, "OAuth Client Secret is required in the environment variables.")
+});
+
+// src/oauth/index.ts
+var builtInOAuthProviders = {
+  github,
+  bitbucket,
+  figma,
+  discord,
+  gitlab,
+  spotify,
+  x,
+  strava,
+  mailchimp,
+  pinterest,
+  twitch,
+  notion,
+  dropbox,
+  atlassian
+};
+var defineOAuthEnvironment = (oauth) => {
+  const loadEnvs = OAuthEnvSchema.safeParse({
+    clientId: getEnv(`${oauth.toUpperCase()}_CLIENT_ID`),
+    clientSecret: getEnv(`${oauth.toUpperCase()}_CLIENT_SECRET`)
+  });
+  if (!loadEnvs.success) {
+    const msg = JSON.stringify({ [oauth]: formatZodError(loadEnvs.error) }, null, 2);
+    throw new AuthInternalError("INVALID_ENVIRONMENT_CONFIGURATION", msg);
+  }
+  return loadEnvs.data;
+};
+var defineOAuthProviderConfig = (config2) => {
+  if (typeof config2 === "string") {
+    const definition = defineOAuthEnvironment(config2);
+    const oauthConfig = builtInOAuthProviders[config2]();
+    const parsed2 = OAuthProviderCredentialsSchema.safeParse({ ...oauthConfig, ...definition });
+    if (!parsed2.success) {
+      const details = JSON.stringify({ [config2]: formatZodError(parsed2.error) }, null, 2);
+      throw new AuthInternalError(
+        "INVALID_OAUTH_PROVIDER_CONFIGURATION",
+        `Invalid configuration for OAuth provider "${config2}": ${details}`
+      );
+    }
+    return parsed2.data;
+  }
+  const hasCredentials = config2.clientId && config2.clientSecret;
+  const envConfig = hasCredentials ? {} : defineOAuthEnvironment(config2.id);
+  const parsed = OAuthProviderCredentialsSchema.safeParse({ ...envConfig, ...config2 });
+  if (!parsed.success) {
+    const details = JSON.stringify({ [config2.id]: formatZodError(parsed.error) }, null, 2);
+    throw new AuthInternalError(
+      "INVALID_OAUTH_PROVIDER_CONFIGURATION",
+      `Invalid configuration for OAuth provider "${config2.id}": ${details}`
+    );
+  }
+  return parsed.data;
+};
+var createBuiltInOAuthProviders = (oauth = []) => {
+  return oauth.reduce((previous, config2) => {
+    const oauthConfig = defineOAuthProviderConfig(config2);
+    if (oauthConfig.id in previous) {
+      throw new AuthInternalError(
+        "DUPLICATED_OAUTH_PROVIDER_ID",
+        `Duplicate OAuth provider id "${oauthConfig.id}" found. Each provider must have a unique id.`
+      );
+    }
+    return { ...previous, [oauthConfig.id]: oauthConfig };
+  }, {});
+};
+
+// src/context.ts
+var createContext = (config2) => {
+  const trustedProxyHeadersEnv = getEnv("TRUSTED_PROXY_HEADERS");
+  const useProxyHeaders = trustedProxyHeadersEnv === void 0 ? config2?.trustedProxyHeaders ?? false : getEnvBoolean("TRUSTED_PROXY_HEADERS");
+  const logger = createProxyLogger(config2);
+  const cookiePrefix = config2?.cookies?.prefix;
+  const cookieOverrides = config2?.cookies?.overrides ?? {};
+  const secureCookieStore = createCookieStore(true, cookiePrefix, cookieOverrides, logger);
+  const standardCookieStore = createCookieStore(false, cookiePrefix, cookieOverrides, logger);
+  return {
+    oauth: createBuiltInOAuthProviders(config2?.oauth),
+    cookies: standardCookieStore,
+    jose: createJoseInstance(config2?.secret),
+    secret: config2?.secret,
+    basePath: config2?.basePath ?? "/auth",
+    trustedProxyHeaders: useProxyHeaders,
+    trustedOrigins: getEnvArray("TRUSTED_ORIGINS").length > 0 ? getEnvArray("TRUSTED_ORIGINS") : config2?.trustedOrigins,
+    logger,
+    cookieConfig: { secure: secureCookieStore, standard: standardCookieStore },
+    baseURL: config2?.baseURL
+  };
+};
+
+// src/headers.ts
+var cacheControl = {
+  "Cache-Control": "no-store",
+  Pragma: "no-cache",
+  Expires: "0",
+  Vary: "Cookie"
+};
+var contentSecurityPolicy = {
+  "Content-Security-Policy": [
+    "default-src 'none'",
+    "script-src 'self'",
+    "frame-src 'none'",
+    "object-src 'none'",
+    "frame-ancestors 'none'",
+    "base-uri 'none'"
+  ].join("; ")
+};
+var secureHeaders = {
+  "X-Content-Type-Options": "nosniff",
+  "X-Frame-Options": "DENY",
+  "Referrer-Policy": "strict-origin-when-cross-origin"
+};
+var secureApiHeaders = {
+  ...cacheControl,
+  ...contentSecurityPolicy,
+  ...secureHeaders
+};
+
+// src/api/signIn.ts
+var import_router2 = require("@aura-stack/router");
+
+// src/secure.ts
+var generateSecure = (length = 32) => {
+  return import_jose2.base64url.encode((0, import_crypto.getRandomBytes)(length));
+};
+var createSecretValue = (length = 32) => {
+  return import_jose2.base64url.encode((0, import_crypto.getRandomBytes)(length));
+};
+var createHash = async (data) => {
+  const subtle = (0, import_crypto.getSubtleCrypto)();
+  const digest = await subtle.digest("SHA-256", import_crypto.encoder.encode(data));
+  return import_jose2.base64url.encode(new Uint8Array(digest));
+};
+var createPKCE = async (verifier) => {
+  const byteLength = verifier ? void 0 : Math.floor(Math.random() * (96 - 32 + 1) + 32);
+  const codeVerifier = verifier ?? generateSecure(byteLength ?? 64);
+  if (codeVerifier.length < 43 || codeVerifier.length > 128) {
+    throw new AuthSecurityError("PKCE_VERIFIER_INVALID", "The code verifier must be between 43 and 128 characters in length.");
+  }
+  const codeChallenge = await createHash(codeVerifier);
+  return { codeVerifier, codeChallenge, method: "S256" };
+};
+var createCSRF = async (jose, csrfCookie) => {
+  try {
+    const token = generateSecure(32);
+    if (csrfCookie) {
+      await jose.verifyJWS(csrfCookie, jwtVerificationOptions);
+      return csrfCookie;
+    }
+    return jose.signJWS({ token });
+  } catch {
+    const token = generateSecure(32);
+    return jose.signJWS({ token });
+  }
+};
+var verifyCSRF = async (jose, cookie, header) => {
+  try {
+    const cookiePayload = await jose.verifyJWS(cookie, jwtVerificationOptions);
+    const headerPayload = await jose.verifyJWS(header, jwtVerificationOptions);
+    if (!isJWTPayloadWithToken(cookiePayload)) {
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "Cookie payload missing token field.");
+    }
+    if (!isJWTPayloadWithToken(headerPayload)) {
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "Header payload missing token field.");
+    }
+    if (!equals(cookiePayload.token.length, headerPayload.token.length)) {
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
+    }
+    if (!timingSafeEqual(cookiePayload.token, headerPayload.token)) {
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
+    }
+    return true;
+  } catch {
+    throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
+  }
+};
+
+// src/actions/signIn/authorization-url.ts
+var setSearchParams = (url, params) => {
+  for (const [key, value] of Object.entries(params)) {
+    if (value !== void 0 && value !== "") {
+      url.searchParams.set(key, value);
+    }
+  }
+};
+var buildAuthorizationURL = (oauth, redirect_uri, state, code_challenge, code_challenge_method) => {
+  const authorizeConfig = oauth.authorize;
+  const baseURL = typeof authorizeConfig === "string" ? authorizeConfig : authorizeConfig?.url ?? oauth.authorizeURL;
+  if (!baseURL) {
+    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "Missing authorization URL in OAuth provider configuration.");
+  }
+  const url = new URL(baseURL);
+  const authorizeParams = typeof authorizeConfig === "string" ? void 0 : authorizeConfig?.params;
+  setSearchParams(url, {
+    response_type: authorizeParams?.responseType ?? oauth.responseType ?? "code",
+    client_id: oauth.clientId,
+    redirect_uri,
+    state,
+    code_challenge,
+    code_challenge_method,
+    scope: authorizeParams?.scope ?? oauth.scope,
+    prompt: authorizeParams?.prompt,
+    response_mode: authorizeParams?.responseMode,
+    login_hint: authorizeParams?.loginHint,
+    nonce: authorizeParams?.nonce,
+    display: authorizeParams?.display,
+    audience: authorizeParams?.audience
+  });
+  return url.toString();
+};
+var createAuthorizationURL = async (oauth, redirectURI, ctx) => {
+  const state = createSecretValue();
+  const { codeVerifier, codeChallenge, method } = await createPKCE();
+  const authorization = buildAuthorizationURL(oauth, redirectURI, state, codeChallenge, method);
+  const parsed = OAuthAuthorization.safeParse({ ...oauth, redirectURI, state, codeChallenge, codeChallengeMethod: method });
+  if (!parsed.success) {
+    ctx?.logger?.log("INVALID_OAUTH_CONFIGURATION", {
+      structuredData: {
+        scope: oauth?.scope ?? "",
+        redirect_uri: redirectURI,
+        has_state: Boolean(state),
+        has_code_challenge: Boolean(codeChallenge),
+        code_challenge_method: method
+      }
+    });
+    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "The OAuth provider configuration is invalid.");
+  }
+  return {
+    authorization,
+    state,
+    codeVerifier,
+    method
+  };
+};
+
+// src/actions/signIn/authorization.ts
+var getTrustedOrigins = async (request, trustedOrigins) => {
+  if (!trustedOrigins) return [];
+  const raw = typeof trustedOrigins === "function" ? await trustedOrigins(request) : trustedOrigins;
+  return Array.isArray(raw) ? raw : typeof raw === "string" ? [raw] : [];
+};
+var getBaseURL2 = async ({
+  ctx,
+  request,
+  headers: headersInit
+}) => {
+  const origin = getEnv("BASE_URL") || ctx?.baseURL;
+  if (origin && origin !== "/") return origin;
+  if (ctx?.trustedProxyHeaders) {
+    const headers = headersInit && new Headers(headersInit) || request?.headers;
+    const protocol = headers?.get("Forwarded")?.match(/proto=([^;]+)/i)?.[1] ?? headers?.get("X-Forwarded-Proto") ?? "http";
+    const host = headers?.get("Host") ?? headers?.get("Forwarded")?.match(/host=([^;]+)/i)?.[1] ?? headers?.get("X-Forwarded-Host") ?? null;
+    if (host) return `${protocol}://${host}`;
+    throw new AuthInternalError(
+      "INVALID_OAUTH_CONFIGURATION",
+      "The URL cannot be constructed. Please set the BASE_URL environment variable or provide trusted proxy host headers."
+    );
+  }
+  try {
+    return new URL(request?.url ?? "not-found").origin;
+  } catch (error) {
+    throw new AuthInternalError(
+      "INVALID_OAUTH_CONFIGURATION",
+      "The URL cannot be constructed. Please set the BASE_URL environment variable or enable trustedProxyHeaders.",
+      { cause: error }
+    );
+  }
+};
+var getOriginURL = async (request, context) => {
+  const trustedOrigins = await getTrustedOrigins(request, context?.trustedOrigins);
+  trustedOrigins.push(new URL(request.url).origin);
+  const origin = await getBaseURL2({ request, ctx: context });
+  if (!isTrustedOrigin(origin, trustedOrigins)) {
+    context?.logger?.log("UNTRUSTED_ORIGIN", { structuredData: { origin } });
+    throw new AuthInternalError("UNTRUSTED_ORIGIN", "The constructed origin URL is not trusted.");
+  }
+  return origin;
+};
+var createRedirectURI = async (request, oauth, context) => {
+  const origin = await getOriginURL(request, context);
+  return `${origin}${context.basePath}/callback/${oauth}`;
+};
+var createSignInURL = async ({
+  request,
+  oauth,
+  ctx,
+  redirectTo
+}) => {
+  const origin = await getOriginURL(request, ctx);
+  const searchParams = new URLSearchParams();
+  if (redirectTo !== void 0) searchParams.set("redirectTo", String(redirectTo));
+  return `${origin}${ctx.basePath}/signIn/${oauth}?${searchParams.toString()}`;
+};
+var createRedirectTo = async (request, redirectTo, context) => {
+  try {
+    const headers = request.headers;
+    const requestOrigin = await getOriginURL(request, context);
+    const origins = await getTrustedOrigins(request, context?.trustedOrigins);
+    const validateURL = (url) => {
+      if (!isRelativeURL(url) && !isValidURL(url)) return "/";
+      if (isRelativeURL(url)) return url;
+      if (origins.length > 0) {
+        if (isTrustedOrigin(url, origins)) {
+          const urlOrigin = new URL(url).origin;
+          for (const pattern of origins) {
+            const regex = patternToRegex(pattern);
+            if (regex?.test(urlOrigin)) {
+              return isSameOrigin(url, request.url) ? extractPath(url) : url;
+            }
+            if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return url;
+          }
+        }
+        context?.logger?.log("OPEN_REDIRECT_ATTACK");
+        return "/";
+      }
+      if (isSameOrigin(url, requestOrigin)) {
+        return extractPath(url);
+      }
+      context?.logger?.log("OPEN_REDIRECT_ATTACK");
+      return "/";
+    };
+    return validateURL(redirectTo ?? headers.get("Referer") ?? headers.get("Origin") ?? "/");
+  } catch (error) {
+    context?.logger?.log("POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED");
+    return "/";
+  }
+};
+
+// src/api/signIn.ts
+var signIn = async (oauth, {
+  ctx,
+  headers: headersInit,
+  redirectTo = "/",
+  redirect,
+  request: requestInit
+}) => {
+  const headers = new Headers(headersInit);
+  const provider = ctx.oauth[oauth];
+  if (!provider) {
+    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", `The OAuth provider "${oauth}" is not configured.`);
+  }
+  let request = requestInit;
+  if (!request) {
+    const origin = await getBaseURL2({ ctx, headers });
+    const url = `${origin}${ctx.basePath}/signIn/${oauth}`;
+    request = new Request(url, { headers });
+  }
+  if (redirect === false) {
+    const signInURL = await createSignInURL({ request, oauth, ctx, redirectTo });
+    return { redirect: false, signInURL };
+  }
+  const redirectURI = await createRedirectURI(request, oauth, ctx);
+  const redirectToValue = await createRedirectTo(request, redirectTo, ctx);
+  const { authorization, state, codeVerifier } = await createAuthorizationURL(provider, redirectURI, ctx);
+  ctx?.logger?.log("SIGN_IN_INITIATED", {
+    structuredData: { oauth_provider: oauth }
+  });
+  const headersList = new import_router2.HeadersBuilder(cacheControl).setHeader("Location", authorization).setCookie(ctx.cookies.state.name, state, ctx.cookies.state.attributes).setCookie(ctx.cookies.redirectURI.name, redirectURI, ctx.cookies.redirectURI.attributes).setCookie(ctx.cookies.redirectTo.name, redirectToValue, ctx.cookies.redirectTo.attributes).setCookie(ctx.cookies.codeVerifier.name, codeVerifier, ctx.cookies.codeVerifier.attributes).toHeaders();
+  return Response.json(
+    { redirect: redirect ?? true, signInURL: authorization },
+    {
+      status: redirect ?? true ? 302 : 200,
+      headers: headersList
+    }
+  );
+};
+
+// src/api/signOut.ts
+var import_router3 = require("@aura-stack/router");
+var signOut = async ({
+  ctx,
+  headers: headersInit,
+  redirectTo = "/",
+  skipCSRFCheck = false
+}) => {
+  const headers = new Headers(headersInit);
+  const header = headers.get("X-CSRF-Token");
+  let session = null;
+  let csrfToken = null;
+  try {
+    session = getCookie(headers, ctx.cookies.sessionToken.name);
+  } catch {
+    throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
+  }
+  try {
+    csrfToken = getCookie(headers, ctx.cookies.csrfToken.name);
+  } catch {
+    throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF token is missing.");
+  }
+  ctx?.logger?.log("SIGN_OUT_ATTEMPT", {
+    structuredData: {
+      has_session: Boolean(session),
+      has_csrf_token: Boolean(csrfToken),
+      has_csrf_header: Boolean(header),
+      skip_csrf_check: skipCSRFCheck
+    }
+  });
+  if (!session) {
+    ctx?.logger?.log("SESSION_TOKEN_MISSING");
+    throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
+  }
+  if (!skipCSRFCheck) {
+    if (!csrfToken) {
+      ctx?.logger?.log("CSRF_TOKEN_MISSING");
+      throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF token is missing.");
+    }
+    if (!header) {
+      ctx?.logger?.log("CSRF_HEADER_MISSING");
+      throw new AuthSecurityError("CSRF_HEADER_MISSING", "The CSRF header is missing.");
+    }
+    try {
+      await verifyCSRF(ctx.jose, csrfToken, header);
+    } catch (error) {
+      ctx?.logger?.log("CSRF_TOKEN_INVALID", { structuredData: { error_type: getErrorName(error) } });
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "CSRF token verification failed");
+    }
+    ctx?.logger?.log("SIGN_OUT_CSRF_VERIFIED");
+  } else {
+    try {
+      await ctx.jose.verifyJWS(csrfToken);
+    } catch (error) {
+      ctx?.logger?.log("CSRF_TOKEN_INVALID", { structuredData: { error_type: getErrorName(error) } });
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "CSRF token verification failed");
+    }
+  }
+  try {
+    await ctx.jose.decodeJWT(session);
+    ctx?.logger?.log("SIGN_OUT_SUCCESS");
+  } catch (error) {
+    ctx?.logger?.log("INVALID_JWT_TOKEN", { structuredData: { error_type: getErrorName(error) } });
+  }
+  const headersList = new import_router3.HeadersBuilder(secureApiHeaders).setHeader("Location", redirectTo).setCookie(ctx.cookies.csrfToken.name, "", expiredCookieAttributes).setCookie(ctx.cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
+  return Response.json(
+    { redirect: Boolean(redirectTo), url: redirectTo },
+    {
+      status: 202,
+      headers: headersList
+    }
+  );
+};
+
+// src/api/getSession.ts
+var getSession = async ({ ctx, headers }) => {
+  try {
+    const session = getCookie(new Headers(headers), ctx.cookies.sessionToken.name);
+    const decoded = await ctx.jose.decodeJWT(session);
+    ctx?.logger?.log("AUTH_SESSION_VALID");
+    const { exp, iat, jti, nbf, aud, iss, ...user } = decoded;
+    return {
+      session: {
+        user,
+        expires: toISOString(exp * 1e3)
+      },
+      authenticated: true
+    };
+  } catch (error) {
+    ctx?.logger?.log("AUTH_SESSION_INVALID", { structuredData: { error_type: getErrorName(error) } });
+    return { session: null, authenticated: false };
+  }
+};
+
+// src/api/createApi.ts
+var createAuthAPI = (ctx) => {
+  return {
+    getSession: async (options2) => {
+      const session = await getSession({ ctx, headers: options2.headers });
+      return session;
+    },
+    signIn: async (oauth, options2) => {
+      return signIn(oauth, {
+        ctx,
+        headers: options2?.headers,
+        request: options2?.request,
+        redirect: options2?.redirect,
+        redirectTo: options2?.redirectTo
+      });
+    },
+    signOut: async (options2) => {
+      const redirectTo = validateRedirectTo(options2?.redirectTo ?? "/");
+      return signOut({ ctx, headers: options2.headers, redirectTo, skipCSRFCheck: true });
+    }
+  };
+};
+
+// src/actions/signIn/signIn.ts
+var import_v42 = require("zod/v4");
+var import_router4 = require("@aura-stack/router");
+var signInConfig = (oauth) => {
+  return (0, import_router4.createEndpointConfig)("/signIn/:oauth", {
+    schemas: {
+      params: import_v42.z.object({
+        oauth: import_v42.z.enum(
+          Object.keys(oauth),
+          "The OAuth provider is not supported or invalid."
+        )
+      }),
+      searchParams: import_v42.z.object({
+        redirect: import_v42.z.stringbool().optional().default(true),
+        redirectTo: import_v42.z.string().optional()
+      })
+    }
+  });
+};
+var signInAction = (oauth) => {
+  return (0, import_router4.createEndpoint)(
+    "GET",
+    "/signIn/:oauth",
+    async (ctx) => {
+      const {
+        request,
+        params: { oauth: oauth2 },
+        searchParams: { redirectTo, redirect },
+        context
+      } = ctx;
+      const signInResult = await signIn(oauth2, {
+        ctx: context,
+        headers: request.headers,
+        redirect,
+        redirectTo,
+        request
+      });
+      if (!redirect) {
+        return Response.json(signInResult, { status: 200 });
+      }
+      return signInResult;
+    },
+    signInConfig(oauth)
+  );
+};
+
+// src/actions/callback/callback.ts
+var import_v43 = require("zod/v4");
+var import_router5 = require("@aura-stack/router");
+
+// src/request.ts
+var fetchAsync = async (url, options2 = {}, timeout = 5e3) => {
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), timeout);
+  const response = await fetch(url, {
+    ...options2,
+    signal: controller.signal
+  }).finally(() => clearTimeout(timeoutId));
+  return response;
+};
+
+// src/actions/callback/userinfo.ts
+var getDefaultUserInfo = (profile) => {
+  const sub = generateSecure(16);
+  return {
+    sub: profile?.id ?? profile?.sub ?? sub,
+    email: profile?.email,
+    name: profile?.name ?? profile?.username ?? profile?.nickname,
+    image: profile?.image ?? profile?.picture
+  };
+};
+var getUserInfo = async (oauthConfig, accessToken, logger) => {
+  const userInfoConfig = oauthConfig.userInfo;
+  const userinfoURL = typeof userInfoConfig === "string" ? userInfoConfig : userInfoConfig.url;
+  const extraHeaders = typeof userInfoConfig === "string" ? void 0 : userInfoConfig.headers;
+  const method = typeof userInfoConfig === "string" ? "GET" : (userInfoConfig.method ?? "GET").toUpperCase();
+  try {
+    logger?.log("OAUTH_USERINFO_REQUEST_INITIATED", {
+      structuredData: {
+        endpoint: userinfoURL
+      }
+    });
+    const response = await fetchAsync(userinfoURL, {
+      method,
+      headers: {
+        "User-Agent": `Aura Auth/${AURA_AUTH_VERSION}`,
+        Accept: "application/json",
+        Authorization: `Bearer ${accessToken}`,
+        ...extraHeaders ?? {}
+      }
+    });
+    if (!response.ok) {
+      logger?.log("OAUTH_USERINFO_INVALID_RESPONSE");
+      throw new OAuthProtocolError("INVALID_REQUEST", "Invalid userinfo response format");
+    }
+    const json = await response.json();
+    const { success, data } = OAuthErrorResponse.safeParse(json);
+    if (success) {
+      logger?.log("OAUTH_USERINFO_ERROR", {
+        message: "Error response received from OAuth userinfo endpoint",
+        structuredData: {
+          error: data.error,
+          error_description: data.error_description ?? ""
+        }
+      });
+      throw new OAuthProtocolError("INVALID_REQUEST", "An error was received from the OAuth userinfo endpoint.");
+    }
+    logger?.log("OAUTH_USERINFO_SUCCESS");
+    return oauthConfig?.profile ? oauthConfig.profile(json) : getDefaultUserInfo(json);
+  } catch (error) {
+    if (isOAuthProtocolError(error)) {
+      throw error;
+    }
+    logger?.log("OAUTH_USERINFO_REQUEST_FAILED");
+    if (isNativeError(error)) {
+      throw new OAuthProtocolError("SERVER_ERROR", "Failed to fetch user information from OAuth provider", "", {
+        cause: error
+      });
+    }
+    throw new OAuthProtocolError("SERVER_ERROR", "Failed to fetch user information", "", { cause: error });
+  }
+};
+
+// src/actions/callback/access-token.ts
+var createAccessToken = async (oauthConfig, redirectURI, code, codeVerifier, logger) => {
+  const { accessToken, clientId, clientSecret } = oauthConfig;
+  if (!clientId || !clientSecret || !redirectURI || !code || !codeVerifier || !accessToken) {
+    logger?.log("INVALID_OAUTH_CONFIGURATION", {
+      structuredData: {
+        has_client_id: Boolean(clientId),
+        has_client_secret: Boolean(clientSecret),
+        has_access_token: Boolean(accessToken),
+        has_redirect_uri: Boolean(redirectURI),
+        has_code: Boolean(code),
+        has_code_verifier: Boolean(codeVerifier)
+      }
+    });
+    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "The OAuth provider configuration is invalid.");
+  }
+  const tokenURL = typeof accessToken === "string" ? accessToken : accessToken.url;
+  const extraHeaders = typeof accessToken === "string" ? void 0 : accessToken.headers;
+  try {
+    logger?.log("OAUTH_ACCESS_TOKEN_REQUEST_INITIATED", {
+      structuredData: {
+        has_client_id: Boolean(clientId),
+        redirect_uri: redirectURI,
+        grant_type: "authorization_code"
+      }
+    });
+    const response = await fetchAsync(tokenURL, {
+      method: "POST",
+      headers: {
+        ...extraHeaders ?? {},
+        Accept: "application/json",
+        "Content-Type": "application/x-www-form-urlencoded"
+      },
+      body: new URLSearchParams({
+        client_id: clientId,
+        client_secret: clientSecret,
+        code,
+        redirect_uri: redirectURI,
+        grant_type: "authorization_code",
+        code_verifier: codeVerifier
+      }).toString()
+    });
+    if (!response.ok) {
+      logger?.log("INVALID_OAUTH_ACCESS_TOKEN_RESPONSE");
+      throw new OAuthProtocolError("invalid_request", "Invalid access token response");
+    }
+    const json = await response.json();
+    const token = OAuthAccessTokenResponse.safeParse(json);
+    if (!token.success) {
+      const { success, data } = OAuthAccessTokenErrorResponse.safeParse(json);
+      if (!success) {
+        logger?.log("INVALID_OAUTH_ACCESS_TOKEN_RESPONSE");
+        throw new OAuthProtocolError("invalid_request", "Invalid access token response format");
+      }
+      logger?.log("OAUTH_ACCESS_TOKEN_ERROR", {
+        structuredData: {
+          error: data.error,
+          error_description: data.error_description ?? ""
+        }
+      });
+      throw new OAuthProtocolError("INVALID_ACCESS_TOKEN", "Failed to retrieve access token");
+    }
+    logger?.log("OAUTH_ACCESS_TOKEN_SUCCESS");
+    return token.data;
+  } catch (error) {
+    logger?.log("OAUTH_ACCESS_TOKEN_REQUEST_FAILED");
+    if (error instanceof Error) {
+      throw new OAuthProtocolError("server_error", "Failed to communicate with OAuth provider", "", { cause: error });
+    }
+    throw error;
   }
 };
-var createLogEntry = (key, overrides) => {
-  const message = logMessages[key];
-  return {
-    ...message,
-    ...overrides
-  };
-};
 
-// src/index.ts
-var logLevelToSeverity = {
-  debug: ["debug", "info", "notice", "warning", "error", "critical", "alert", "emergency"],
-  info: ["info", "notice", "warning", "error", "critical", "alert", "emergency"],
-  warn: ["warning", "error", "critical", "alert", "emergency"],
-  error: ["error", "critical", "alert", "emergency"]
+// src/actions/callback/callback.ts
+var callbackConfig = (oauth) => {
+  return (0, import_router5.createEndpointConfig)("/callback/:oauth", {
+    schemas: {
+      params: import_v43.z.object({
+        oauth: import_v43.z.enum(
+          Object.keys(oauth),
+          "The OAuth provider is not supported or invalid."
+        )
+      }),
+      searchParams: import_v43.z.object({
+        code: import_v43.z.string("Missing code parameter in the OAuth authorization response."),
+        state: import_v43.z.string("Missing state parameter in the OAuth authorization response.")
+      })
+    },
+    use: [
+      (ctx) => {
+        const {
+          searchParams,
+          context: { logger }
+        } = ctx;
+        const response = OAuthAuthorizationErrorResponse.safeParse(searchParams);
+        if (response.success) {
+          const { error, error_description } = response.data;
+          const criticalAuthErrors = ["access_denied", "server_error"];
+          const severity = criticalAuthErrors.includes(error.toLowerCase()) ? "critical" : "warning";
+          logger?.log("OAUTH_AUTHORIZATION_ERROR", {
+            severity,
+            structuredData: {
+              error,
+              error_description: error_description ?? ""
+            }
+          });
+          throw new OAuthProtocolError(error, error_description || "OAuth Authorization Error");
+        }
+        return ctx;
+      }
+    ]
+  });
 };
-var createLoggerProxy = (logger) => {
-  if (!logger) return void 0;
-  const level = logger.level;
-  const allowedSeverities = logLevelToSeverity[level] ?? [];
-  const internalLogger = {
-    level,
-    log(key, overrides) {
-      const entry = createLogEntry(key, overrides);
-      if (!allowedSeverities.includes(entry.severity)) return entry;
-      logger.log({
-        timestamp: entry.timestamp ?? (/* @__PURE__ */ new Date()).toISOString(),
-        appName: entry.appName ?? "aura-auth",
-        hostname: entry.hostname ?? "aura-auth",
-        ...entry
+var callbackAction = (oauth) => {
+  return (0, import_router5.createEndpoint)(
+    "GET",
+    "/callback/:oauth",
+    async (ctx) => {
+      const {
+        request,
+        params: { oauth: oauth2 },
+        searchParams: { code, state },
+        context
+      } = ctx;
+      const { oauth: providers, cookies, jose, logger, trustedOrigins } = context;
+      const oauthConfig = providers[oauth2];
+      const cookieState = getCookie(request, cookies.state.name);
+      const codeVerifier = getCookie(request, cookies.codeVerifier.name);
+      const cookieRedirectTo = getCookie(request, cookies.redirectTo.name);
+      const cookieRedirectURI = getCookie(request, cookies.redirectURI.name);
+      if (!timingSafeEqual(cookieState, state)) {
+        logger?.log("MISMATCHING_STATE", {
+          structuredData: {
+            oauth_provider: oauth2
+          }
+        });
+        throw new AuthSecurityError(
+          "MISMATCHING_STATE",
+          "The provided state passed in the OAuth response does not match the stored state."
+        );
+      }
+      const accessToken = await createAccessToken(oauthConfig, cookieRedirectURI, code, codeVerifier, logger);
+      const origins = await getTrustedOrigins(request, trustedOrigins);
+      const requestOrigin = await getOriginURL(request, context);
+      if (!isRelativeURL(cookieRedirectTo)) {
+        const isValid = origins.length > 0 ? isTrustedOrigin(cookieRedirectTo, origins) : isSameOrigin(cookieRedirectTo, requestOrigin);
+        if (!isValid) {
+          logger?.log("POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED", {
+            structuredData: {
+              redirect_path: cookieRedirectTo,
+              provider: oauth2,
+              has_trusted_origins: origins.length > 0,
+              request_origin: requestOrigin
+            }
+          });
+          throw new AuthSecurityError(
+            "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED",
+            "Invalid redirect path. Potential open redirect attack detected."
+          );
+        }
+      }
+      const userInfo = await getUserInfo(oauthConfig, accessToken.access_token, logger);
+      const sessionCookie = await createSessionCookie(jose, userInfo);
+      const csrfToken = await createCSRF(jose);
+      logger?.log("OAUTH_CALLBACK_SUCCESS", {
+        structuredData: {
+          provider: oauth2
+        }
       });
-      return entry;
+      const headers = new import_router5.HeadersBuilder(cacheControl).setHeader("Location", cookieRedirectTo).setCookie(cookies.sessionToken.name, sessionCookie, cookies.sessionToken.attributes).setCookie(cookies.csrfToken.name, csrfToken, cookies.csrfToken.attributes).setCookie(cookies.state.name, "", expiredCookieAttributes).setCookie(cookies.redirectURI.name, "", expiredCookieAttributes).setCookie(cookies.redirectTo.name, "", expiredCookieAttributes).setCookie(cookies.codeVerifier.name, "", expiredCookieAttributes).toHeaders();
+      return Response.json({ oauth: oauth2 }, { status: 302, headers });
+    },
+    callbackConfig(oauth)
+  );
+};
+
+// src/actions/session/session.ts
+var import_router6 = require("@aura-stack/router");
+var sessionAction = (0, import_router6.createEndpoint)("GET", "/session", async (ctx) => {
+  const {
+    request,
+    context: { cookies }
+  } = ctx;
+  try {
+    const session = await getSession({ ctx: ctx.context, headers: request.headers });
+    if (!session.authenticated) {
+      throw new AuthInternalError("INVALID_JWT_TOKEN", "Session not authenticated");
     }
-  };
-  return internalLogger;
+    return Response.json(session, { headers: secureApiHeaders });
+  } catch (error) {
+    const headers = new import_router6.HeadersBuilder(secureApiHeaders).setCookie(cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
+    return Response.json({ session: null, authenticated: false }, { status: 401, headers });
+  }
+});
+
+// src/actions/signOut/signOut.ts
+var import_v44 = require("zod/v4");
+var import_router7 = require("@aura-stack/router");
+var config = (0, import_router7.createEndpointConfig)({
+  schemas: {
+    searchParams: import_v44.z.object({
+      token_type_hint: import_v44.z.literal("session_token"),
+      redirectTo: import_v44.z.string().optional()
+    })
+  }
+});
+var signOutAction = (0, import_router7.createEndpoint)(
+  "POST",
+  "/signOut",
+  async (ctx) => {
+    const {
+      request,
+      searchParams: { redirectTo },
+      context
+    } = ctx;
+    const baseURL = getBaseURL(request);
+    const location = await createRedirectTo(
+      new Request(baseURL, {
+        headers: request.headers
+      }),
+      redirectTo,
+      context
+    );
+    return await signOut({
+      ctx: context,
+      headers: request.headers,
+      redirectTo: location
+    });
+  },
+  config
+);
+
+// src/actions/csrfToken/csrfToken.ts
+var import_router8 = require("@aura-stack/router");
+var getCSRFToken = (request, cookieName) => {
+  try {
+    return getCookie(request, cookieName);
+  } catch {
+    return void 0;
+  }
 };
+var csrfTokenAction = (0, import_router8.createEndpoint)("GET", "/csrfToken", async (ctx) => {
+  const {
+    request,
+    context: { jose, cookies, logger }
+  } = ctx;
+  const token = getCSRFToken(request, cookies.csrfToken.name);
+  logger?.log("CSRF_TOKEN_REQUESTED", { structuredData: { has_token: Boolean(token) } });
+  const csrfToken = await createCSRF(jose, token);
+  logger?.log("CSRF_TOKEN_ISSUED", { structuredData: { issued: Boolean(csrfToken) } });
+  const headers = new Headers(secureApiHeaders);
+  headers.append("Set-Cookie", setCookie(cookies.csrfToken.name, csrfToken, cookies.csrfToken.attributes));
+  return Response.json({ csrfToken }, { headers });
+});
+
+// src/createAuth.ts
 var createInternalConfig = (authConfig) => {
-  const useSecure = authConfig?.trustedProxyHeaders ?? false;
-  const logger = authConfig?.logger;
-  const internalLogger = createLoggerProxy(logger);
+  const context = createContext(authConfig);
   return {
     basePath: authConfig?.basePath ?? "/auth",
-    onError: createErrorHandler(internalLogger),
-    context: {
-      oauth: createBuiltInOAuthProviders(authConfig?.oauth),
-      cookies: createCookieStore(
-        useSecure,
-        authConfig?.cookies?.prefix,
-        authConfig?.cookies?.overrides ?? {},
-        internalLogger
-      ),
-      jose: createJoseInstance(authConfig?.secret),
-      secret: authConfig?.secret,
-      basePath: authConfig?.basePath ?? "/auth",
-      trustedProxyHeaders: useSecure,
-      trustedOrigins: authConfig?.trustedOrigins,
-      logger: internalLogger
-    },
-    middlewares: [
+    onError: createErrorHandler(context.logger),
+    context,
+    use: [
       (ctx) => {
-        const useSecure2 = useSecureCookies(ctx.request, ctx.context.trustedProxyHeaders);
-        const cookies = createCookieStore(
-          useSecure2,
-          authConfig?.cookies?.prefix,
-          authConfig?.cookies?.overrides ?? {},
-          internalLogger
-        );
-        ctx.context.cookies = cookies;
+        const useSecure = useSecureCookies(ctx.request, ctx.context.trustedProxyHeaders);
+        ctx.context.cookies = useSecure ? context.cookieConfig.secure : context.cookieConfig.standard;
         return ctx;
       }
     ]
   };
 };
-var createAuth = (authConfig) => {
+var createAuthInstance = (authConfig) => {
   const config2 = createInternalConfig(authConfig);
-  const router = (0, import_router7.createRouter)(
+  const router = (0, import_router9.createRouter)(
     [signInAction(config2.context.oauth), callbackAction(config2.context.oauth), sessionAction, signOutAction, csrfTokenAction],
     config2
   );
   return {
     handlers: router,
-    jose: config2.context.jose
+    jose: config2.context.jose,
+    api: createAuthAPI(config2.context)
+  };
+};
+var createAuth = (config2) => {
+  const authInstance = createAuthInstance(config2);
+  authInstance.handlers.ALL = async (request) => {
+    const method = request.method.toUpperCase();
+    const methodHandlers = {
+      GET: authInstance.handlers.GET,
+      POST: authInstance.handlers.POST
+    };
+    if (method in methodHandlers) {
+      return await methodHandlers[method](request);
+    }
+    return new Response("Method Not Allowed", {
+      status: 405,
+      headers: { Allow: Object.keys(methodHandlers).join(", ") }
+    });
+  };
+  return authInstance;
+};
+
+// src/client/client.ts
+var import_router10 = require("@aura-stack/router");
+var createClient = import_router10.createClient;
+var createAuthClient = (options2) => {
+  if (typeof window === "undefined" && !options2.baseURL) {
+    throw new AuthClientError("`baseURL` is required when createAuthClient is used outside the browser.");
+  }
+  const client = createClient({
+    cache: "no-store",
+    credentials: "include",
+    baseURL: options2.baseURL ?? window.location.origin,
+    ...options2
+  });
+  const getCSRFToken2 = async () => {
+    try {
+      const response = await client.get("/csrfToken");
+      if (!response.ok) return null;
+      const data = await response.json();
+      return data.csrfToken;
+    } catch (error) {
+      console.error("Error fetching CSRF token:", error);
+      return null;
+    }
+  };
+  const getSession2 = async () => {
+    try {
+      const response = await client.get("/session");
+      if (!response.ok) return null;
+      const session = await response.json();
+      if (!session?.authenticated) return null;
+      return session.session;
+    } catch (error) {
+      console.error("Error fetching session:", error);
+      return null;
+    }
+  };
+  const signIn2 = async (oauth, options3) => {
+    try {
+      const response = await client.get("/signIn/:oauth", {
+        params: {
+          oauth
+        },
+        searchParams: {
+          ...options3,
+          redirect: false
+        }
+      });
+      const json = await response.json();
+      if ((options3?.redirect ?? true) && typeof window !== "undefined" && json?.signInURL) {
+        window.location.assign(json.signInURL);
+      }
+      return json;
+    } catch (error) {
+      console.error("Error during sign-in:", error);
+      return { redirect: false, signInURL: "/" };
+    }
+  };
+  const signOut2 = async (options3) => {
+    try {
+      const csrfToken = await getCSRFToken2();
+      if (!csrfToken) {
+        throw new AuthClientError("Failed to fetch CSRF token for sign-out.");
+      }
+      const response = await client.post("/signOut", {
+        searchParams: {
+          redirectTo: options3?.redirectTo ?? "/",
+          token_type_hint: "session_token"
+        },
+        headers: {
+          "X-CSRF-Token": csrfToken
+        }
+      });
+      const json = await response.json();
+      if ((options3?.redirect ?? true) && typeof window !== "undefined" && json?.url) {
+        window.location.assign(json.url);
+      }
+      return json;
+    } catch (error) {
+      console.error("Error during sign-out:", error);
+      throw isNativeError(error) ? error : new AuthClientError("Sign-out failed.", "The sign-out request failed.", { cause: error });
+    }
+  };
+  return {
+    getSession: getSession2,
+    signIn: signIn2,
+    signOut: signOut2
   };
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  createAuth
+  builtInOAuthProviders,
+  createAuth,
+  createAuthClient,
+  createClient,
+  createSyslogMessage
 });