@aura-stack/auth 0.4.0 → 0.5.0

package/dist/schemas.d.ts

@@ -1,17 +1,37 @@
-import { z } from 'zod';
+import { z } from 'zod/v4';
 
 declare const OAuthProviderCredentialsSchema: z.ZodObject<{
     id: z.ZodString;
     name: z.ZodString;
-    authorizeURL: z.ZodString;
-    accessToken: z.ZodString;
-    scope: z.ZodString;
-    userInfo: z.ZodString;
-    responseType: z.ZodEnum<{
+    authorize: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+        params: z.ZodObject<{
+            responseType: z.ZodOptional<z.ZodEnum<{
+                token: "token";
+                code: "code";
+                id_token: "id_token";
+                refresh_token: "refresh_token";
+            }>>;
+            scope: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>]>>;
+    authorizeURL: z.ZodOptional<z.ZodString>;
+    accessToken: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>]>;
+    scope: z.ZodOptional<z.ZodString>;
+    userInfo: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        method: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>;
+    responseType: z.ZodOptional<z.ZodEnum<{
         token: "token";
         code: "code";
         id_token: "id_token";
-    }>;
+        refresh_token: "refresh_token";
+    }>>;
     clientId: z.ZodString;
     clientSecret: z.ZodString;
     profile: z.ZodOptional<z.ZodFunction<z.core.$ZodFunctionArgs, z.core.$ZodFunctionOut>>;
@@ -20,15 +40,35 @@ declare const OAuthProviderCredentialsSchema: z.ZodObject<{
  * Schema for OAuth Provider Configuration
  */
 declare const OAuthProviderConfigSchema: z.ZodObject<{
-    authorizeURL: z.ZodString;
-    accessToken: z.ZodString;
+    authorize: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+        params: z.ZodObject<{
+            responseType: z.ZodOptional<z.ZodEnum<{
+                token: "token";
+                code: "code";
+                id_token: "id_token";
+                refresh_token: "refresh_token";
+            }>>;
+            scope: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>]>>;
+    authorizeURL: z.ZodOptional<z.ZodString>;
+    accessToken: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>]>;
     scope: z.ZodOptional<z.ZodString>;
-    userInfo: z.ZodString;
-    responseType: z.ZodEnum<{
+    userInfo: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        method: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>;
+    responseType: z.ZodOptional<z.ZodEnum<{
         token: "token";
         code: "code";
         id_token: "id_token";
-    }>;
+        refresh_token: "refresh_token";
+    }>>;
     clientId: z.ZodString;
     clientSecret: z.ZodString;
 }, z.core.$strip>;
@@ -38,15 +78,35 @@ declare const OAuthProviderConfigSchema: z.ZodObject<{
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.1
  */
 declare const OAuthAuthorization: z.ZodObject<{
-    authorizeURL: z.ZodString;
-    accessToken: z.ZodString;
+    authorize: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+        params: z.ZodObject<{
+            responseType: z.ZodOptional<z.ZodEnum<{
+                token: "token";
+                code: "code";
+                id_token: "id_token";
+                refresh_token: "refresh_token";
+            }>>;
+            scope: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>]>>;
+    authorizeURL: z.ZodOptional<z.ZodString>;
+    accessToken: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>]>;
     scope: z.ZodOptional<z.ZodString>;
-    userInfo: z.ZodString;
-    responseType: z.ZodEnum<{
+    userInfo: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        method: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>;
+    responseType: z.ZodOptional<z.ZodEnum<{
         token: "token";
         code: "code";
         id_token: "id_token";
-    }>;
+        refresh_token: "refresh_token";
+    }>>;
     clientId: z.ZodString;
     clientSecret: z.ZodString;
     redirectURI: z.ZodString;
@@ -90,15 +150,35 @@ declare const OAuthAuthorizationErrorResponse: z.ZodObject<{
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
  */
 declare const OAuthAccessToken: z.ZodObject<{
-    authorizeURL: z.ZodString;
-    accessToken: z.ZodString;
+    authorize: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+        params: z.ZodObject<{
+            responseType: z.ZodOptional<z.ZodEnum<{
+                token: "token";
+                code: "code";
+                id_token: "id_token";
+                refresh_token: "refresh_token";
+            }>>;
+            scope: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>]>>;
+    authorizeURL: z.ZodOptional<z.ZodString>;
+    accessToken: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>]>;
     scope: z.ZodOptional<z.ZodString>;
-    userInfo: z.ZodString;
-    responseType: z.ZodEnum<{
+    userInfo: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        method: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>;
+    responseType: z.ZodOptional<z.ZodEnum<{
         token: "token";
         code: "code";
         id_token: "id_token";
-    }>;
+        refresh_token: "refresh_token";
+    }>>;
     clientId: z.ZodString;
     clientSecret: z.ZodString;
     redirectURI: z.ZodString;
@@ -115,7 +195,7 @@ declare const OAuthAccessTokenResponse: z.ZodObject<{
     token_type: z.ZodOptional<z.ZodString>;
     expires_in: z.ZodOptional<z.ZodNumber>;
     refresh_token: z.ZodOptional<z.ZodString>;
-    scope: z.ZodUnion<[z.ZodOptional<z.ZodString>, z.ZodNull]>;
+    scope: z.ZodUnion<readonly [z.ZodUnion<[z.ZodOptional<z.ZodString>, z.ZodNull]>, z.ZodOptional<z.ZodArray<z.ZodString>>]>;
 }, z.core.$strip>;
 /**
  * Schema for OAuth Access Token Error Response

package/dist/schemas.js

@@ -9,7 +9,7 @@ import {
   OAuthErrorResponse,
   OAuthProviderConfigSchema,
   OAuthProviderCredentialsSchema
-} from "./chunk-KJBAQZX2.js";
+} from "./chunk-2A5B7GWR.js";
 export {
   OAuthAccessToken,
   OAuthAccessTokenErrorResponse,

package/dist/secure.cjs

@@ -1,9 +1,7 @@
 "use strict";
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -17,14 +15,6 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/secure.ts
@@ -33,11 +23,11 @@ __export(secure_exports, {
   createCSRF: () => createCSRF,
   createHash: () => createHash,
   createPKCE: () => createPKCE,
+  createSecretValue: () => createSecretValue,
   generateSecure: () => generateSecure,
   verifyCSRF: () => verifyCSRF
 });
 module.exports = __toCommonJS(secure_exports);
-var import_crypto2 = __toESM(require("crypto"), 1);
 
 // src/utils.ts
 var import_router = require("@aura-stack/router");
@@ -54,26 +44,6 @@ var AuthSecurityError = class extends Error {
   }
 };
 
-// src/utils.ts
-var equals = (a, b) => {
-  if (a === null || b === null || a === void 0 || b === void 0) return false;
-  return a === b;
-};
-
-// src/assert.ts
-var import_crypto = require("crypto");
-var isJWTPayloadWithToken = (payload) => {
-  return typeof payload === "object" && payload !== null && "token" in payload && typeof payload?.token === "string";
-};
-var safeEquals = (a, b) => {
-  const bufferA = Buffer.from(a);
-  const bufferB = Buffer.from(b);
-  if (bufferA.length !== bufferB.length) {
-    return false;
-  }
-  return (0, import_crypto.timingSafeEqual)(bufferA, bufferB);
-};
-
 // src/env.ts
 var import_meta = {};
 var env = new Proxy({}, {
@@ -103,8 +73,32 @@ var env = new Proxy({}, {
   }
 });
 
+// src/assert.ts
+var import_crypto = require("@aura-stack/jose/crypto");
+var isJWTPayloadWithToken = (payload) => {
+  return typeof payload === "object" && payload !== null && "token" in payload && typeof payload?.token === "string";
+};
+var timingSafeEqual = (a, b) => {
+  const bufferA = import_crypto.encoder.encode(a);
+  const bufferB = import_crypto.encoder.encode(b);
+  const len = Math.max(bufferA.length, bufferB.length);
+  let diff = 0;
+  for (let i = 0; i < len; i++) {
+    diff |= (bufferA[i] ?? 0) ^ (bufferB[i] ?? 0);
+  }
+  return diff === 0 && bufferA.length === bufferB.length;
+};
+
+// src/utils.ts
+var equals = (a, b) => {
+  if (a === null || b === null || a === void 0 || b === void 0) return false;
+  return a === b;
+};
+
 // src/jose.ts
 var import_jose = require("@aura-stack/jose");
+var import_jose2 = require("@aura-stack/jose/jose");
+var import_crypto2 = require("@aura-stack/jose/crypto");
 var jwtVerificationOptions = {
   algorithms: ["HS256"],
   typ: "JWT"
@@ -112,10 +106,15 @@ var jwtVerificationOptions = {
 
 // src/secure.ts
 var generateSecure = (length = 32) => {
-  return import_crypto2.default.randomBytes(length).toString("base64url");
+  return import_jose2.base64url.encode((0, import_crypto2.getRandomBytes)(length));
+};
+var createSecretValue = (length = 32) => {
+  return import_jose2.base64url.encode((0, import_crypto2.getRandomBytes)(length));
 };
-var createHash = (data, base = "hex") => {
-  return import_crypto2.default.createHash("sha256").update(data).digest().toString(base);
+var createHash = async (data) => {
+  const subtle = (0, import_crypto2.getSubtleCrypto)();
+  const digest = await subtle.digest("SHA-256", import_crypto2.encoder.encode(data));
+  return import_jose2.base64url.encode(new Uint8Array(digest));
 };
 var createPKCE = async (verifier) => {
   const byteLength = verifier ? void 0 : Math.floor(Math.random() * (96 - 32 + 1) + 32);
@@ -123,7 +122,7 @@ var createPKCE = async (verifier) => {
   if (codeVerifier.length < 43 || codeVerifier.length > 128) {
     throw new AuthSecurityError("PKCE_VERIFIER_INVALID", "The code verifier must be between 43 and 128 characters in length.");
   }
-  const codeChallenge = createHash(codeVerifier, "base64url");
+  const codeChallenge = await createHash(codeVerifier);
   return { codeVerifier, codeChallenge, method: "S256" };
 };
 var createCSRF = async (jose, csrfCookie) => {
@@ -152,7 +151,7 @@ var verifyCSRF = async (jose, cookie, header) => {
     if (!equals(cookiePayload.token.length, headerPayload.token.length)) {
       throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
     }
-    if (!safeEquals(cookiePayload.token, headerPayload.token)) {
+    if (!timingSafeEqual(cookiePayload.token, headerPayload.token)) {
       throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
     }
     return true;
@@ -165,6 +164,7 @@ var verifyCSRF = async (jose, cookie, header) => {
   createCSRF,
   createHash,
   createPKCE,
+  createSecretValue,
   generateSecure,
   verifyCSRF
 });

package/dist/secure.d.ts

@@ -1,14 +1,20 @@
-import { A as AuthRuntimeConfig } from './index-CSyIJmCM.js';
+import { c as AuthRuntimeConfig } from './index-_aXtxb_s.js';
 import 'zod';
 import './schemas.js';
-import './jose.js';
+import 'zod/v4';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/jose/crypto';
 import '@aura-stack/router/cookie';
 import './@types/utility.js';
+import 'jose';
+import '@aura-stack/router';
+import 'zod/v4/core';
 
+/** @deprecated use `createSecretValue` instead */
 declare const generateSecure: (length?: number) => string;
-declare const createHash: (data: string, base?: "hex" | "base64" | "base64url") => string;
+declare const createSecretValue: (length?: number) => string;
+declare const createHash: (data: string) => Promise<string>;
 /**
  * Creates the code challenge flow for PKCE OAuth flow. It generates a code verifier and its corresponding
  * code challenge using SHA-256 hashing.
@@ -32,4 +38,4 @@ declare const createPKCE: (verifier?: string) => Promise<{
 declare const createCSRF: (jose: AuthRuntimeConfig["jose"], csrfCookie?: string) => Promise<string>;
 declare const verifyCSRF: (jose: AuthRuntimeConfig["jose"], cookie: string, header: string) => Promise<boolean>;
 
-export { createCSRF, createHash, createPKCE, generateSecure, verifyCSRF };
+export { createCSRF, createHash, createPKCE, createSecretValue, generateSecure, verifyCSRF };

package/dist/secure.js

@@ -2,18 +2,19 @@ import {
   createCSRF,
   createHash,
   createPKCE,
+  createSecretValue,
   generateSecure,
   verifyCSRF
-} from "./chunk-NUDITUKX.js";
-import "./chunk-4EKY7655.js";
-import "./chunk-QQVSRXGX.js";
-import "./chunk-FRJFWTOY.js";
-import "./chunk-4MYWAOLG.js";
-import "./chunk-RRLIF4PQ.js";
+} from "./chunk-V6LLEAR4.js";
+import "./chunk-UZQJJD6A.js";
+import "./chunk-LX3TJ2TJ.js";
+import "./chunk-WHNDRO3N.js";
+import "./chunk-U5663F2U.js";
 export {
   createCSRF,
   createHash,
   createPKCE,
+  createSecretValue,
   generateSecure,
   verifyCSRF
 };

package/dist/utils.cjs

@@ -20,6 +20,8 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/utils.ts
 var utils_exports = {};
 __export(utils_exports, {
+  AURA_AUTH_VERSION: () => AURA_AUTH_VERSION,
+  createBasicAuthHeader: () => createBasicAuthHeader,
   createErrorHandler: () => createErrorHandler,
   createStructuredData: () => createStructuredData,
   equals: () => equals,
@@ -31,7 +33,8 @@ __export(utils_exports, {
   toISOString: () => toISOString,
   toSnakeCase: () => toSnakeCase,
   toUpperCase: () => toUpperCase,
-  useSecureCookies: () => useSecureCookies
+  useSecureCookies: () => useSecureCookies,
+  validateRedirectTo: () => validateRedirectTo
 });
 module.exports = __toCommonJS(utils_exports);
 var import_router = require("@aura-stack/router");
@@ -79,7 +82,91 @@ var isAuthSecurityError = (error) => {
   return error instanceof AuthSecurityError;
 };
 
+// src/env.ts
+var import_meta = {};
+var env = new Proxy({}, {
+  get(_, prop) {
+    if (typeof prop !== "string") return void 0;
+    const hasProperty = (process2) => {
+      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
+    };
+    try {
+      if (typeof process !== "undefined" && hasProperty(process.env)) {
+        return process.env[prop];
+      }
+      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
+        return import_meta.env[prop];
+      }
+      if (typeof Deno !== "undefined" && Deno.env?.get) {
+        return Deno.env.get(prop);
+      }
+      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
+        return Bun.env[prop];
+      }
+      const globalValue = globalThis[prop];
+      return typeof globalValue === "string" ? globalValue : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+});
+var getEnv = (key) => {
+  const keys = [`AURA_AUTH_${key.toUpperCase()}`, `AURA_${key.toUpperCase()}`, `AUTH_${key.toUpperCase()}`, key.toUpperCase()];
+  return env[keys.find((k) => env[k]) ?? ""];
+};
+
+// src/assert.ts
+var import_crypto = require("@aura-stack/jose/crypto");
+var unsafeChars = [
+  "<",
+  ">",
+  '"',
+  "`",
+  " ",
+  "\r",
+  "\n",
+  "	",
+  "\\",
+  "%2F",
+  "%5C",
+  "%2f",
+  "%5c",
+  "\r\n",
+  "%0A",
+  "%0D",
+  "%0a",
+  "%0d",
+  "..",
+  "//",
+  "///",
+  "...",
+  "%20",
+  "\0"
+];
+var isValidURL = (value) => {
+  if (!new RegExp(/^https?:\/\/[^/]/).test(value)) {
+    return false;
+  }
+  const match = value.match(/^(https?:\/\/)(.*)$/);
+  if (!match) return false;
+  const rest = match[2];
+  for (const char of unsafeChars) {
+    if (rest.includes(char)) return false;
+  }
+  const regex = /^https?:\/\/(?:[a-zA-Z0-9._-]+|localhost|\[[0-9a-fA-F:]+\])(?::\d{1,5})?(?:\/[a-zA-Z0-9._~!$&'()?#*+,;=:@-]*)*\/?$/;
+  return regex.test(match[0]);
+};
+var isRelativeURL = (value) => {
+  if (value.length > 100) return false;
+  for (const char of unsafeChars) {
+    if (value.includes(char)) return false;
+  }
+  const regex = /^\/[a-zA-Z0-9\-_\/.?&=#]*\/?$/;
+  return regex.test(value);
+};
+
 // src/utils.ts
+var AURA_AUTH_VERSION = "0.4.0";
 var toSnakeCase = (str) => {
   return str.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2").toLowerCase().replace(/^_+/, "");
 };
@@ -172,7 +259,9 @@ var toISOString = (date) => {
   return new Date(date).toISOString();
 };
 var useSecureCookies = (request, trustedProxyHeaders) => {
-  return trustedProxyHeaders ? request.url.startsWith("https://") || request.headers.get("X-Forwarded-Proto") === "https" || (request.headers.get("Forwarded")?.includes("proto=https") ?? false) : request.url.startsWith("https://");
+  const headers = request instanceof Headers ? request : request.headers;
+  const url = request instanceof Headers ? null : request.url;
+  return trustedProxyHeaders ? url?.startsWith("https://") || headers.get("X-Forwarded-Proto") === "https" || (headers.get("Forwarded")?.includes("proto=https") ?? false) : url?.startsWith("https://") ?? false;
 };
 var formatZodError = (error) => {
   if (!error.issues || error.issues.length === 0) {
@@ -206,8 +295,24 @@ var getErrorName = (error) => {
   }
   return typeof error === "string" ? error : "UnknownError";
 };
+var createBasicAuthHeader = (username, password) => {
+  const getUsername = getEnv(username.toUpperCase()) ?? username;
+  const getPassword = getEnv(password.toUpperCase()) ?? password;
+  if (!getUsername || !getPassword) {
+    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "Missing client credentials for OAuth provider configuration.");
+  }
+  const credentials = `${getUsername}:${getPassword}`;
+  return `Basic ${btoa(credentials)}`;
+};
+var validateRedirectTo = (url) => {
+  if (!isRelativeURL(url) && !isValidURL(url)) return "/";
+  if (isRelativeURL(url)) return url;
+  return "/";
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AURA_AUTH_VERSION,
+  createBasicAuthHeader,
   createErrorHandler,
   createStructuredData,
   equals,
@@ -219,5 +324,6 @@ var getErrorName = (error) => {
   toISOString,
   toSnakeCase,
   toUpperCase,
-  useSecureCookies
+  useSecureCookies,
+  validateRedirectTo
 });

package/dist/utils.d.ts

@@ -1,13 +1,17 @@
 import { RouterConfig } from '@aura-stack/router';
 import { ZodError } from 'zod';
-import { I as InternalLogger, j as APIErrorMap } from './index-CSyIJmCM.js';
+import { a as InternalLogger, f as APIErrorMap } from './index-_aXtxb_s.js';
 import './schemas.js';
-import './jose.js';
+import 'zod/v4';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/jose/crypto';
 import '@aura-stack/router/cookie';
 import './@types/utility.js';
+import 'jose';
+import 'zod/v4/core';
 
+declare const AURA_AUTH_VERSION = "0.4.0";
 declare const toSnakeCase: (str: string) => string;
 declare const toUpperCase: (str: string) => string;
 declare const toCastCase: <Obj extends Record<string, string>, Type extends "snake" | "upper">(obj: Obj, type?: Type) => Type extends "snake" ? { [K in keyof Obj as `${string & K}`]: Obj[K]; } : { [K in keyof Obj as Uppercase<string & K>]: Obj[K]; };
@@ -15,10 +19,17 @@ declare const equals: (a: string | number | undefined | null, b: string | number
 declare const createErrorHandler: (logger?: InternalLogger) => RouterConfig["onError"];
 declare const getBaseURL: (request: Request) => string;
 declare const toISOString: (date: Date | string | number) => string;
-declare const useSecureCookies: (request: Request, trustedProxyHeaders: boolean) => boolean;
+declare const useSecureCookies: (request: Request | Headers, trustedProxyHeaders: boolean) => boolean;
 declare const formatZodError: <T extends Record<string, unknown> = Record<string, unknown>>(error: ZodError<T>) => APIErrorMap;
 declare const extractPath: (url: string) => string;
 declare const createStructuredData: (data: Record<string, string | number | boolean>, sdID?: string) => string;
 declare const getErrorName: (error: unknown) => string;
+declare const createBasicAuthHeader: (username: string, password: string) => string;
+/**
+ * Validates and sanitizes redirect URLs to prevent open redirect attacks.
+ * Only relative URLs (starting with /) are allowed; absolute URLs are
+ * rejected and replaced with "/" to enforce same-origin redirects.
+ */
+declare const validateRedirectTo: (url: string) => string;
 
-export { createErrorHandler, createStructuredData, equals, extractPath, formatZodError, getBaseURL, getErrorName, toCastCase, toISOString, toSnakeCase, toUpperCase, useSecureCookies };
+export { AURA_AUTH_VERSION, createBasicAuthHeader, createErrorHandler, createStructuredData, equals, extractPath, formatZodError, getBaseURL, getErrorName, toCastCase, toISOString, toSnakeCase, toUpperCase, useSecureCookies, validateRedirectTo };

package/dist/utils.js

@@ -1,4 +1,6 @@
 import {
+  AURA_AUTH_VERSION,
+  createBasicAuthHeader,
   createErrorHandler,
   createStructuredData,
   equals,
@@ -10,10 +12,14 @@ import {
   toISOString,
   toSnakeCase,
   toUpperCase,
-  useSecureCookies
-} from "./chunk-QQVSRXGX.js";
-import "./chunk-RRLIF4PQ.js";
+  useSecureCookies,
+  validateRedirectTo
+} from "./chunk-LX3TJ2TJ.js";
+import "./chunk-WHNDRO3N.js";
+import "./chunk-U5663F2U.js";
 export {
+  AURA_AUTH_VERSION,
+  createBasicAuthHeader,
   createErrorHandler,
   createStructuredData,
   equals,
@@ -25,5 +31,6 @@ export {
   toISOString,
   toSnakeCase,
   toUpperCase,
-  useSecureCookies
+  useSecureCookies,
+  validateRedirectTo
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aura-stack/auth",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "private": false,
   "type": "module",
   "description": "Core auth for @aura-stack/auth",
@@ -30,6 +30,11 @@
       "types": "./dist/@types/index.d.ts",
       "import": "./dist/@types/index.js",
       "require": "./dist/@types/index.cjs"
+    },
+    "./client": {
+      "types": "./dist/client/index.d.ts",
+      "import": "./dist/client/index.js",
+      "require": "./dist/client/index.cjs"
     }
   },
   "keywords": [
@@ -44,12 +49,11 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@aura-stack/router": "^0.5.0",
-    "zod": "^4.3.5",
-    "@aura-stack/jose": "0.3.0"
+    "@aura-stack/router": "^0.6.0",
+    "zod": "4.3.5",
+    "@aura-stack/jose": "0.4.0"
   },
   "devDependencies": {
-    "@types/node": "^24.9.2",
     "typescript": "^5.9.2",
     "@aura-stack/tsconfig": "0.0.0",
     "@aura-stack/tsup-config": "0.0.0"