@aura-stack/auth 0.4.0 → 0.5.0

package/dist/actions/index.cjs

@@ -1,9 +1,7 @@
 "use strict";
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -17,14 +15,6 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/actions/index.ts
@@ -39,8 +29,7 @@ __export(actions_exports, {
 module.exports = __toCommonJS(actions_exports);
 
 // src/actions/signIn/signIn.ts
-var import_zod2 = require("zod");
-var import_router2 = require("@aura-stack/router");
+var import_v42 = require("zod/v4");
 
 // src/headers.ts
 var cacheControl = {
@@ -70,12 +59,6 @@ var secureApiHeaders = {
   ...secureHeaders
 };
 
-// src/secure.ts
-var import_crypto2 = __toESM(require("crypto"), 1);
-
-// src/utils.ts
-var import_router = require("@aura-stack/router");
-
 // src/errors.ts
 var OAuthProtocolError = class extends Error {
   type = "OAUTH_PROTOCOL_ERROR";
@@ -116,44 +99,160 @@ var isOAuthProtocolError = (error) => {
   return error instanceof OAuthProtocolError;
 };
 
+// src/api/signIn.ts
+var import_router2 = require("@aura-stack/router");
+
+// src/schemas.ts
+var import_v4 = require("zod/v4");
+var AuthorizeConfigSchema = import_v4.z.union([
+  (0, import_v4.string)().url(),
+  (0, import_v4.object)({
+    url: (0, import_v4.string)().url(),
+    params: (0, import_v4.object)({
+      responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
+      scope: (0, import_v4.string)().optional()
+    })
+  })
+]);
+var AccessTokenConfigSchema = import_v4.z.union([
+  (0, import_v4.string)().url(),
+  (0, import_v4.object)({
+    url: (0, import_v4.string)().url(),
+    headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional()
+  })
+]);
+var UserInfoConfigSchema = import_v4.z.union([
+  (0, import_v4.string)().url(),
+  (0, import_v4.object)({
+    url: (0, import_v4.string)().url(),
+    headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional(),
+    method: (0, import_v4.string)().optional()
+  })
+]);
+var OAuthProviderCredentialsSchema = (0, import_v4.object)({
+  id: (0, import_v4.string)(),
+  name: (0, import_v4.string)(),
+  authorize: AuthorizeConfigSchema.optional(),
+  /** @deprecated */
+  authorizeURL: (0, import_v4.string)().url().optional(),
+  accessToken: AccessTokenConfigSchema,
+  /** @deprecated */
+  scope: (0, import_v4.string)().optional(),
+  userInfo: UserInfoConfigSchema,
+  /** @deprecated */
+  responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
+  clientId: (0, import_v4.string)(),
+  clientSecret: (0, import_v4.string)(),
+  profile: import_v4.z.function().optional()
+});
+var OAuthProviderConfigSchema = (0, import_v4.object)({
+  authorize: AuthorizeConfigSchema.optional(),
+  /** @deprecated */
+  authorizeURL: (0, import_v4.string)().url().optional(),
+  accessToken: AccessTokenConfigSchema,
+  /** @deprecated */
+  scope: (0, import_v4.string)().optional(),
+  userInfo: UserInfoConfigSchema,
+  /** @deprecated */
+  responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
+  clientId: (0, import_v4.string)(),
+  clientSecret: (0, import_v4.string)()
+});
+var OAuthAuthorization = OAuthProviderConfigSchema.extend({
+  redirectURI: (0, import_v4.string)(),
+  state: (0, import_v4.string)(),
+  codeChallenge: (0, import_v4.string)(),
+  codeChallengeMethod: (0, import_v4.enum)(["plain", "S256"])
+});
+var OAuthAuthorizationResponse = (0, import_v4.object)({
+  state: (0, import_v4.string)({ message: "Missing state parameter in the OAuth authorization response." }),
+  code: (0, import_v4.string)({ message: "Missing code parameter in the OAuth authorization response." })
+});
+var OAuthAuthorizationErrorResponse = (0, import_v4.object)({
+  error: (0, import_v4.enum)([
+    "invalid_request",
+    "unauthorized_client",
+    "access_denied",
+    "unsupported_response_type",
+    "invalid_scope",
+    "server_error",
+    "temporarily_unavailable"
+  ]),
+  error_description: (0, import_v4.string)().optional(),
+  error_uri: (0, import_v4.string)().optional(),
+  state: (0, import_v4.string)()
+});
+var OAuthAccessToken = OAuthProviderConfigSchema.extend({
+  redirectURI: (0, import_v4.string)(),
+  code: (0, import_v4.string)(),
+  codeVerifier: (0, import_v4.string)().min(43).max(128)
+});
+var OAuthAccessTokenResponse = (0, import_v4.object)({
+  access_token: (0, import_v4.string)(),
+  token_type: (0, import_v4.string)().optional(),
+  expires_in: (0, import_v4.number)().optional(),
+  refresh_token: (0, import_v4.string)().optional(),
+  scope: (0, import_v4.union)([(0, import_v4.string)().optional().or((0, import_v4.null)()), (0, import_v4.array)((0, import_v4.string)()).optional()])
+});
+var OAuthAccessTokenErrorResponse = (0, import_v4.object)({
+  error: (0, import_v4.enum)([
+    "invalid_request",
+    "invalid_client",
+    "invalid_grant",
+    "unauthorized_client",
+    "unsupported_grant_type",
+    "invalid_scope"
+  ]),
+  error_description: (0, import_v4.string)().optional(),
+  error_uri: (0, import_v4.string)().optional()
+});
+var OAuthErrorResponse = (0, import_v4.object)({
+  error: (0, import_v4.string)(),
+  error_description: (0, import_v4.string)().optional()
+});
+var OAuthEnvSchema = (0, import_v4.object)({
+  clientId: import_v4.z.string().min(1, "OAuth Client ID is required in the environment variables."),
+  clientSecret: import_v4.z.string().min(1, "OAuth Client Secret is required in the environment variables.")
+});
+
 // src/utils.ts
-var toSnakeCase = (str) => {
-  return str.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2").toLowerCase().replace(/^_+/, "");
-};
-var toUpperCase = (str) => {
-  return str.toUpperCase();
-};
-var toCastCase = (obj, type = "snake") => {
-  return Object.entries(obj).reduce((previous, [key, value]) => {
-    const newKey = type === "snake" ? toSnakeCase(key) : toUpperCase(key);
-    return { ...previous, [newKey]: value };
-  }, {});
-};
-var equals = (a, b) => {
-  if (a === null || b === null || a === void 0 || b === void 0) return false;
-  return a === b;
-};
-var getBaseURL = (request) => {
-  const url = new URL(request.url);
-  return `${url.origin}${url.pathname}`;
-};
-var toISOString = (date) => {
-  return new Date(date).toISOString();
-};
-var extractPath = (url) => {
-  const pathRegex = /^https?:\/\/[a-zA-Z0-9_\-\.]+(:\d+)?(\/.*)$/;
-  const match = url.match(pathRegex);
-  return match && match[2] ? match[2] : "/";
-};
-var getErrorName = (error) => {
-  if (error instanceof Error) {
-    return error.name;
+var import_router = require("@aura-stack/router");
+
+// src/env.ts
+var import_meta = {};
+var env = new Proxy({}, {
+  get(_, prop) {
+    if (typeof prop !== "string") return void 0;
+    const hasProperty = (process2) => {
+      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
+    };
+    try {
+      if (typeof process !== "undefined" && hasProperty(process.env)) {
+        return process.env[prop];
+      }
+      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
+        return import_meta.env[prop];
+      }
+      if (typeof Deno !== "undefined" && Deno.env?.get) {
+        return Deno.env.get(prop);
+      }
+      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
+        return Bun.env[prop];
+      }
+      const globalValue = globalThis[prop];
+      return typeof globalValue === "string" ? globalValue : void 0;
+    } catch {
+      return void 0;
+    }
   }
-  return typeof error === "string" ? error : "UnknownError";
+});
+var getEnv = (key) => {
+  const keys = [`AURA_AUTH_${key.toUpperCase()}`, `AURA_${key.toUpperCase()}`, `AUTH_${key.toUpperCase()}`, key.toUpperCase()];
+  return env[keys.find((k) => env[k]) ?? ""];
 };
 
 // src/assert.ts
-var import_crypto = require("crypto");
+var import_crypto = require("@aura-stack/jose/crypto");
 var unsafeChars = [
   "<",
   ">",
@@ -244,46 +343,46 @@ var isTrustedOrigin = (url, trustedOrigins) => {
   }
   return false;
 };
-var safeEquals = (a, b) => {
-  const bufferA = Buffer.from(a);
-  const bufferB = Buffer.from(b);
-  if (bufferA.length !== bufferB.length) {
-    return false;
+var timingSafeEqual = (a, b) => {
+  const bufferA = import_crypto.encoder.encode(a);
+  const bufferB = import_crypto.encoder.encode(b);
+  const len = Math.max(bufferA.length, bufferB.length);
+  let diff = 0;
+  for (let i = 0; i < len; i++) {
+    diff |= (bufferA[i] ?? 0) ^ (bufferB[i] ?? 0);
   }
-  return (0, import_crypto.timingSafeEqual)(bufferA, bufferB);
+  return diff === 0 && bufferA.length === bufferB.length;
 };
 
-// src/env.ts
-var import_meta = {};
-var env = new Proxy({}, {
-  get(_, prop) {
-    if (typeof prop !== "string") return void 0;
-    const hasProperty = (process2) => {
-      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
-    };
-    try {
-      if (typeof process !== "undefined" && hasProperty(process.env)) {
-        return process.env[prop];
-      }
-      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
-        return import_meta.env[prop];
-      }
-      if (typeof Deno !== "undefined" && Deno.env?.get) {
-        return Deno.env.get(prop);
-      }
-      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
-        return Bun.env[prop];
-      }
-      const globalValue = globalThis[prop];
-      return typeof globalValue === "string" ? globalValue : void 0;
-    } catch {
-      return void 0;
-    }
+// src/utils.ts
+var AURA_AUTH_VERSION = "0.4.0";
+var equals = (a, b) => {
+  if (a === null || b === null || a === void 0 || b === void 0) return false;
+  return a === b;
+};
+var getBaseURL = (request) => {
+  const url = new URL(request.url);
+  return `${url.origin}${url.pathname}`;
+};
+var toISOString = (date) => {
+  return new Date(date).toISOString();
+};
+var extractPath = (url) => {
+  const pathRegex = /^https?:\/\/[a-zA-Z0-9_\-\.]+(:\d+)?(\/.*)$/;
+  const match = url.match(pathRegex);
+  return match && match[2] ? match[2] : "/";
+};
+var getErrorName = (error) => {
+  if (error instanceof Error) {
+    return error.name;
   }
-});
+  return typeof error === "string" ? error : "UnknownError";
+};
 
 // src/jose.ts
 var import_jose = require("@aura-stack/jose");
+var import_jose2 = require("@aura-stack/jose/jose");
+var import_crypto2 = require("@aura-stack/jose/crypto");
 var jwtVerificationOptions = {
   algorithms: ["HS256"],
   typ: "JWT"
@@ -291,10 +390,15 @@ var jwtVerificationOptions = {
 
 // src/secure.ts
 var generateSecure = (length = 32) => {
-  return import_crypto2.default.randomBytes(length).toString("base64url");
+  return import_jose2.base64url.encode((0, import_crypto2.getRandomBytes)(length));
+};
+var createSecretValue = (length = 32) => {
+  return import_jose2.base64url.encode((0, import_crypto2.getRandomBytes)(length));
 };
-var createHash = (data, base = "hex") => {
-  return import_crypto2.default.createHash("sha256").update(data).digest().toString(base);
+var createHash = async (data) => {
+  const subtle = (0, import_crypto2.getSubtleCrypto)();
+  const digest = await subtle.digest("SHA-256", import_crypto2.encoder.encode(data));
+  return import_jose2.base64url.encode(new Uint8Array(digest));
 };
 var createPKCE = async (verifier) => {
   const byteLength = verifier ? void 0 : Math.floor(Math.random() * (96 - 32 + 1) + 32);
@@ -302,7 +406,7 @@ var createPKCE = async (verifier) => {
   if (codeVerifier.length < 43 || codeVerifier.length > 128) {
     throw new AuthSecurityError("PKCE_VERIFIER_INVALID", "The code verifier must be between 43 and 128 characters in length.");
   }
-  const codeChallenge = createHash(codeVerifier, "base64url");
+  const codeChallenge = await createHash(codeVerifier);
   return { codeVerifier, codeChallenge, method: "S256" };
 };
 var createCSRF = async (jose, csrfCookie) => {
@@ -331,7 +435,7 @@ var verifyCSRF = async (jose, cookie, header) => {
     if (!equals(cookiePayload.token.length, headerPayload.token.length)) {
       throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
     }
-    if (!safeEquals(cookiePayload.token, headerPayload.token)) {
+    if (!timingSafeEqual(cookiePayload.token, headerPayload.token)) {
       throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
     }
     return true;
@@ -340,121 +444,101 @@ var verifyCSRF = async (jose, cookie, header) => {
   }
 };
 
-// src/schemas.ts
-var import_zod = require("zod");
-var OAuthProviderCredentialsSchema = (0, import_zod.object)({
-  id: (0, import_zod.string)(),
-  name: (0, import_zod.string)(),
-  authorizeURL: (0, import_zod.string)().url(),
-  accessToken: (0, import_zod.string)().url(),
-  scope: (0, import_zod.string)(),
-  userInfo: (0, import_zod.string)().url(),
-  responseType: (0, import_zod.enum)(["code", "token", "id_token"]),
-  clientId: (0, import_zod.string)(),
-  clientSecret: (0, import_zod.string)(),
-  profile: import_zod.z.function().optional()
-});
-var OAuthProviderConfigSchema = (0, import_zod.object)({
-  authorizeURL: (0, import_zod.string)().url(),
-  accessToken: (0, import_zod.string)().url(),
-  scope: (0, import_zod.string)().optional(),
-  userInfo: (0, import_zod.string)().url(),
-  responseType: (0, import_zod.enum)(["code", "token", "id_token"]),
-  clientId: (0, import_zod.string)(),
-  clientSecret: (0, import_zod.string)()
-});
-var OAuthAuthorization = OAuthProviderConfigSchema.extend({
-  redirectURI: (0, import_zod.string)(),
-  state: (0, import_zod.string)(),
-  codeChallenge: (0, import_zod.string)(),
-  codeChallengeMethod: (0, import_zod.enum)(["plain", "S256"])
-});
-var OAuthAuthorizationResponse = (0, import_zod.object)({
-  state: (0, import_zod.string)({ message: "Missing state parameter in the OAuth authorization response." }),
-  code: (0, import_zod.string)({ message: "Missing code parameter in the OAuth authorization response." })
-});
-var OAuthAuthorizationErrorResponse = (0, import_zod.object)({
-  error: (0, import_zod.enum)([
-    "invalid_request",
-    "unauthorized_client",
-    "access_denied",
-    "unsupported_response_type",
-    "invalid_scope",
-    "server_error",
-    "temporarily_unavailable"
-  ]),
-  error_description: (0, import_zod.string)().optional(),
-  error_uri: (0, import_zod.string)().optional(),
-  state: (0, import_zod.string)()
-});
-var OAuthAccessToken = OAuthProviderConfigSchema.extend({
-  redirectURI: (0, import_zod.string)(),
-  code: (0, import_zod.string)(),
-  codeVerifier: (0, import_zod.string)().min(43).max(128)
-});
-var OAuthAccessTokenResponse = (0, import_zod.object)({
-  access_token: (0, import_zod.string)(),
-  token_type: (0, import_zod.string)().optional(),
-  expires_in: (0, import_zod.number)().optional(),
-  refresh_token: (0, import_zod.string)().optional(),
-  scope: (0, import_zod.string)().optional().or((0, import_zod.null)())
-});
-var OAuthAccessTokenErrorResponse = (0, import_zod.object)({
-  error: (0, import_zod.enum)([
-    "invalid_request",
-    "invalid_client",
-    "invalid_grant",
-    "unauthorized_client",
-    "unsupported_grant_type",
-    "invalid_scope"
-  ]),
-  error_description: (0, import_zod.string)().optional(),
-  error_uri: (0, import_zod.string)().optional()
-});
-var OAuthErrorResponse = (0, import_zod.object)({
-  error: (0, import_zod.string)(),
-  error_description: (0, import_zod.string)().optional()
-});
-var OAuthEnvSchema = (0, import_zod.object)({
-  clientId: import_zod.z.string().min(1, "OAuth Client ID is required in the environment variables."),
-  clientSecret: import_zod.z.string().min(1, "OAuth Client Secret is required in the environment variables.")
-});
-
-// src/actions/signIn/authorization.ts
-var createAuthorizationURL = (oauthConfig, redirectURI, state, codeChallenge, codeChallengeMethod, logger) => {
-  const parsed = OAuthAuthorization.safeParse({ ...oauthConfig, redirectURI, state, codeChallenge, codeChallengeMethod });
+// src/actions/signIn/authorization-url.ts
+var setSearchParams = (url, params) => {
+  for (const [key, value] of Object.entries(params)) {
+    if (value !== void 0 && value !== "") {
+      url.searchParams.set(key, value);
+    }
+  }
+};
+var buildAuthorizationURL = (oauth, redirect_uri, state, code_challenge, code_challenge_method) => {
+  const authorizeConfig = oauth.authorize;
+  const baseURL = typeof authorizeConfig === "string" ? authorizeConfig : authorizeConfig?.url ?? oauth.authorizeURL;
+  if (!baseURL) {
+    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "Missing authorization URL in OAuth provider configuration.");
+  }
+  const url = new URL(baseURL);
+  const authorizeParams = typeof authorizeConfig === "string" ? void 0 : authorizeConfig?.params;
+  setSearchParams(url, {
+    response_type: authorizeParams?.responseType ?? oauth.responseType ?? "code",
+    client_id: oauth.clientId,
+    redirect_uri,
+    state,
+    code_challenge,
+    code_challenge_method,
+    scope: authorizeParams?.scope ?? oauth.scope,
+    prompt: authorizeParams?.prompt,
+    response_mode: authorizeParams?.responseMode,
+    login_hint: authorizeParams?.loginHint,
+    nonce: authorizeParams?.nonce,
+    display: authorizeParams?.display,
+    audience: authorizeParams?.audience
+  });
+  return url.toString();
+};
+var createAuthorizationURL = async (oauth, redirectURI, ctx) => {
+  const state = createSecretValue();
+  const { codeVerifier, codeChallenge, method } = await createPKCE();
+  const authorization = buildAuthorizationURL(oauth, redirectURI, state, codeChallenge, method);
+  const parsed = OAuthAuthorization.safeParse({ ...oauth, redirectURI, state, codeChallenge, codeChallengeMethod: method });
   if (!parsed.success) {
-    logger?.log("INVALID_OAUTH_CONFIGURATION", {
+    ctx?.logger?.log("INVALID_OAUTH_CONFIGURATION", {
       structuredData: {
-        scope: oauthConfig.scope,
+        scope: oauth?.scope ?? "",
         redirect_uri: redirectURI,
         has_state: Boolean(state),
         has_code_challenge: Boolean(codeChallenge),
-        code_challenge_method: codeChallengeMethod
+        code_challenge_method: method
       }
     });
     throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "The OAuth provider configuration is invalid.");
   }
-  const { authorizeURL, ...options2 } = parsed.data;
-  const { userInfo, accessToken, clientSecret, ...required } = options2;
-  const searchParams = new URLSearchParams(toCastCase(required));
-  return `${authorizeURL}?${searchParams}`;
+  return {
+    authorization,
+    state,
+    codeVerifier,
+    method
+  };
 };
+
+// src/actions/signIn/authorization.ts
 var getTrustedOrigins = async (request, trustedOrigins) => {
   if (!trustedOrigins) return [];
   const raw = typeof trustedOrigins === "function" ? await trustedOrigins(request) : trustedOrigins;
   return Array.isArray(raw) ? raw : typeof raw === "string" ? [raw] : [];
 };
+var getBaseURL2 = async ({
+  ctx,
+  request,
+  headers: headersInit
+}) => {
+  const origin = getEnv("BASE_URL") || ctx?.baseURL;
+  if (origin && origin !== "/") return origin;
+  if (ctx?.trustedProxyHeaders) {
+    const headers = headersInit && new Headers(headersInit) || request?.headers;
+    const protocol = headers?.get("Forwarded")?.match(/proto=([^;]+)/i)?.[1] ?? headers?.get("X-Forwarded-Proto") ?? "http";
+    const host = headers?.get("Host") ?? headers?.get("Forwarded")?.match(/host=([^;]+)/i)?.[1] ?? headers?.get("X-Forwarded-Host") ?? null;
+    if (host) return `${protocol}://${host}`;
+    throw new AuthInternalError(
+      "INVALID_OAUTH_CONFIGURATION",
+      "The URL cannot be constructed. Please set the BASE_URL environment variable or provide trusted proxy host headers."
+    );
+  }
+  try {
+    return new URL(request?.url ?? "not-found").origin;
+  } catch (error) {
+    throw new AuthInternalError(
+      "INVALID_OAUTH_CONFIGURATION",
+      "The URL cannot be constructed. Please set the BASE_URL environment variable or enable trustedProxyHeaders.",
+      { cause: error }
+    );
+  }
+};
 var getOriginURL = async (request, context) => {
-  const headers = request.headers;
-  let origin = new URL(request.url).origin;
   const trustedOrigins = await getTrustedOrigins(request, context?.trustedOrigins);
-  trustedOrigins.push(origin);
-  if (context?.trustedProxyHeaders) {
-    const protocol = headers.get("Forwarded")?.match(/proto=([^;]+)/i)?.[1] ?? headers.get("X-Forwarded-Proto") ?? "http";
-    const host = headers.get("Host") ?? headers.get("Forwarded")?.match(/host=([^;]+)/i)?.[1] ?? headers.get("X-Forwarded-Host") ?? null;
-    origin = `${protocol}://${host}`;
-  }
+  trustedOrigins.push(new URL(request.url).origin);
+  const origin = await getBaseURL2({ request, ctx: context });
   if (!isTrustedOrigin(origin, trustedOrigins)) {
     context?.logger?.log("UNTRUSTED_ORIGIN", { structuredData: { origin } });
     throw new AuthInternalError("UNTRUSTED_ORIGIN", "The constructed origin URL is not trusted.");
@@ -465,6 +549,17 @@ var createRedirectURI = async (request, oauth, context) => {
   const origin = await getOriginURL(request, context);
   return `${origin}${context.basePath}/callback/${oauth}`;
 };
+var createSignInURL = async ({
+  request,
+  oauth,
+  ctx,
+  redirectTo
+}) => {
+  const origin = await getOriginURL(request, ctx);
+  const searchParams = new URLSearchParams();
+  if (redirectTo !== void 0) searchParams.set("redirectTo", String(redirectTo));
+  return `${origin}${ctx.basePath}/signIn/${oauth}?${searchParams.toString()}`;
+};
 var createRedirectTo = async (request, redirectTo, context) => {
   try {
     const headers = request.headers;
@@ -500,58 +595,93 @@ var createRedirectTo = async (request, redirectTo, context) => {
   }
 };
 
+// src/api/signIn.ts
+var signIn = async (oauth, {
+  ctx,
+  headers: headersInit,
+  redirectTo = "/",
+  redirect,
+  request: requestInit
+}) => {
+  const headers = new Headers(headersInit);
+  const provider = ctx.oauth[oauth];
+  if (!provider) {
+    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", `The OAuth provider "${oauth}" is not configured.`);
+  }
+  let request = requestInit;
+  if (!request) {
+    const origin = await getBaseURL2({ ctx, headers });
+    const url = `${origin}${ctx.basePath}/signIn/${oauth}`;
+    request = new Request(url, { headers });
+  }
+  if (redirect === false) {
+    const signInURL = await createSignInURL({ request, oauth, ctx, redirectTo });
+    return { redirect: false, signInURL };
+  }
+  const redirectURI = await createRedirectURI(request, oauth, ctx);
+  const redirectToValue = await createRedirectTo(request, redirectTo, ctx);
+  const { authorization, state, codeVerifier } = await createAuthorizationURL(provider, redirectURI, ctx);
+  ctx?.logger?.log("SIGN_IN_INITIATED", {
+    structuredData: { oauth_provider: oauth }
+  });
+  const headersList = new import_router2.HeadersBuilder(cacheControl).setHeader("Location", authorization).setCookie(ctx.cookies.state.name, state, ctx.cookies.state.attributes).setCookie(ctx.cookies.redirectURI.name, redirectURI, ctx.cookies.redirectURI.attributes).setCookie(ctx.cookies.redirectTo.name, redirectToValue, ctx.cookies.redirectTo.attributes).setCookie(ctx.cookies.codeVerifier.name, codeVerifier, ctx.cookies.codeVerifier.attributes).toHeaders();
+  return Response.json(
+    { redirect: redirect ?? true, signInURL: authorization },
+    {
+      status: redirect ?? true ? 302 : 200,
+      headers: headersList
+    }
+  );
+};
+
 // src/actions/signIn/signIn.ts
+var import_router3 = require("@aura-stack/router");
 var signInConfig = (oauth) => {
-  return (0, import_router2.createEndpointConfig)("/signIn/:oauth", {
+  return (0, import_router3.createEndpointConfig)("/signIn/:oauth", {
     schemas: {
-      params: import_zod2.z.object({
-        oauth: import_zod2.z.enum(
+      params: import_v42.z.object({
+        oauth: import_v42.z.enum(
           Object.keys(oauth),
           "The OAuth provider is not supported or invalid."
         )
       }),
-      searchParams: import_zod2.z.object({
-        redirectTo: import_zod2.z.string().optional()
+      searchParams: import_v42.z.object({
+        redirect: import_v42.z.stringbool().optional().default(true),
+        redirectTo: import_v42.z.string().optional()
       })
     }
   });
 };
 var signInAction = (oauth) => {
-  return (0, import_router2.createEndpoint)(
+  return (0, import_router3.createEndpoint)(
     "GET",
     "/signIn/:oauth",
     async (ctx) => {
       const {
         request,
         params: { oauth: oauth2 },
-        searchParams: { redirectTo },
+        searchParams: { redirectTo, redirect },
         context
       } = ctx;
-      const { oauth: providers, cookies, logger } = context;
-      const state = generateSecure();
-      const redirectURI = await createRedirectURI(request, oauth2, context);
-      const redirectToValue = await createRedirectTo(request, redirectTo, context);
-      const { codeVerifier, codeChallenge, method } = await createPKCE();
-      const authorization = createAuthorizationURL(providers[oauth2], redirectURI, state, codeChallenge, method, logger);
-      logger?.log("SIGN_IN_INITIATED", {
-        structuredData: { oauth_provider: oauth2, code_challenge_method: method }
+      const signInResult = await signIn(oauth2, {
+        ctx: context,
+        headers: request.headers,
+        redirect,
+        redirectTo,
+        request
       });
-      const headers = new import_router2.HeadersBuilder(cacheControl).setHeader("Location", authorization).setCookie(cookies.state.name, state, cookies.state.attributes).setCookie(cookies.redirectURI.name, redirectURI, cookies.redirectURI.attributes).setCookie(cookies.redirectTo.name, redirectToValue, cookies.redirectTo.attributes).setCookie(cookies.codeVerifier.name, codeVerifier, cookies.codeVerifier.attributes).toHeaders();
-      return Response.json(
-        { oauth: oauth2 },
-        {
-          status: 302,
-          headers
-        }
-      );
+      if (!redirect) {
+        return Response.json(signInResult, { status: 200 });
+      }
+      return signInResult;
     },
     signInConfig(oauth)
   );
 };
 
 // src/actions/callback/callback.ts
-var import_zod3 = require("zod");
-var import_router3 = require("@aura-stack/router");
+var import_v43 = require("zod/v4");
+var import_router4 = require("@aura-stack/router");
 
 // src/request.ts
 var fetchAsync = async (url, options2 = {}, timeout = 5e3) => {
@@ -575,18 +705,23 @@ var getDefaultUserInfo = (profile) => {
   };
 };
 var getUserInfo = async (oauthConfig, accessToken, logger) => {
-  const userinfoEndpoint = oauthConfig.userInfo;
+  const userInfoConfig = oauthConfig.userInfo;
+  const userinfoURL = typeof userInfoConfig === "string" ? userInfoConfig : userInfoConfig.url;
+  const extraHeaders = typeof userInfoConfig === "string" ? void 0 : userInfoConfig.headers;
+  const method = typeof userInfoConfig === "string" ? "GET" : (userInfoConfig.method ?? "GET").toUpperCase();
   try {
     logger?.log("OAUTH_USERINFO_REQUEST_INITIATED", {
       structuredData: {
-        endpoint: userinfoEndpoint
+        endpoint: userinfoURL
       }
     });
-    const response = await fetchAsync(userinfoEndpoint, {
-      method: "GET",
+    const response = await fetchAsync(userinfoURL, {
+      method,
       headers: {
+        "User-Agent": `Aura Auth/${AURA_AUTH_VERSION}`,
         Accept: "application/json",
-        Authorization: `Bearer ${accessToken}`
+        Authorization: `Bearer ${accessToken}`,
+        ...extraHeaders ?? {}
       }
     });
     if (!response.ok) {
@@ -623,31 +758,42 @@ var getUserInfo = async (oauthConfig, accessToken, logger) => {
 
 // src/actions/callback/access-token.ts
 var createAccessToken = async (oauthConfig, redirectURI, code, codeVerifier, logger) => {
-  const parsed = OAuthAccessToken.safeParse({ ...oauthConfig, redirectURI, code, codeVerifier });
-  if (!parsed.success) {
-    logger?.log("INVALID_OAUTH_CONFIGURATION");
+  const { accessToken, clientId, clientSecret } = oauthConfig;
+  if (!clientId || !clientSecret || !redirectURI || !code || !codeVerifier || !accessToken) {
+    logger?.log("INVALID_OAUTH_CONFIGURATION", {
+      structuredData: {
+        has_client_id: Boolean(clientId),
+        has_client_secret: Boolean(clientSecret),
+        has_access_token: Boolean(accessToken),
+        has_redirect_uri: Boolean(redirectURI),
+        has_code: Boolean(code),
+        has_code_verifier: Boolean(codeVerifier)
+      }
+    });
     throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "The OAuth provider configuration is invalid.");
   }
-  const { accessToken, clientId, clientSecret, code: codeParsed, redirectURI: redirectParsed } = parsed.data;
+  const tokenURL = typeof accessToken === "string" ? accessToken : accessToken.url;
+  const extraHeaders = typeof accessToken === "string" ? void 0 : accessToken.headers;
   try {
     logger?.log("OAUTH_ACCESS_TOKEN_REQUEST_INITIATED", {
       structuredData: {
         has_client_id: Boolean(clientId),
-        redirect_uri: redirectParsed,
+        redirect_uri: redirectURI,
         grant_type: "authorization_code"
       }
     });
-    const response = await fetchAsync(accessToken, {
+    const response = await fetchAsync(tokenURL, {
       method: "POST",
       headers: {
+        ...extraHeaders ?? {},
         Accept: "application/json",
         "Content-Type": "application/x-www-form-urlencoded"
       },
       body: new URLSearchParams({
         client_id: clientId,
         client_secret: clientSecret,
-        code: codeParsed,
-        redirect_uri: redirectParsed,
+        code,
+        redirect_uri: redirectURI,
         grant_type: "authorization_code",
         code_verifier: codeVerifier
       }).toString()
@@ -707,7 +853,7 @@ var expiredCookieAttributes = {
   secure: true
 };
 var getCookie = (request, cookieName) => {
-  const cookies = request.headers.get("Cookie");
+  const cookies = request instanceof Request ? request.headers.get("Cookie") : request.get("Cookie");
   if (!cookies) {
     throw new AuthInternalError("COOKIE_NOT_FOUND", "No cookies found. There is no active session");
   }
@@ -728,20 +874,20 @@ var createSessionCookie = async (jose, session) => {
 
 // src/actions/callback/callback.ts
 var callbackConfig = (oauth) => {
-  return (0, import_router3.createEndpointConfig)("/callback/:oauth", {
+  return (0, import_router4.createEndpointConfig)("/callback/:oauth", {
     schemas: {
-      params: import_zod3.z.object({
-        oauth: import_zod3.z.enum(
+      params: import_v43.z.object({
+        oauth: import_v43.z.enum(
           Object.keys(oauth),
           "The OAuth provider is not supported or invalid."
         )
       }),
-      searchParams: import_zod3.z.object({
-        code: import_zod3.z.string("Missing code parameter in the OAuth authorization response."),
-        state: import_zod3.z.string("Missing state parameter in the OAuth authorization response.")
+      searchParams: import_v43.z.object({
+        code: import_v43.z.string("Missing code parameter in the OAuth authorization response."),
+        state: import_v43.z.string("Missing state parameter in the OAuth authorization response.")
       })
     },
-    middlewares: [
+    use: [
       (ctx) => {
         const {
           searchParams,
@@ -767,7 +913,7 @@ var callbackConfig = (oauth) => {
   });
 };
 var callbackAction = (oauth) => {
-  return (0, import_router3.createEndpoint)(
+  return (0, import_router4.createEndpoint)(
     "GET",
     "/callback/:oauth",
     async (ctx) => {
@@ -783,7 +929,7 @@ var callbackAction = (oauth) => {
       const codeVerifier = getCookie(request, cookies.codeVerifier.name);
       const cookieRedirectTo = getCookie(request, cookies.redirectTo.name);
       const cookieRedirectURI = getCookie(request, cookies.redirectURI.name);
-      if (!safeEquals(cookieState, state)) {
+      if (!timingSafeEqual(cookieState, state)) {
         logger?.log("MISMATCHING_STATE", {
           structuredData: {
             oauth_provider: oauth2
@@ -822,7 +968,7 @@ var callbackAction = (oauth) => {
           provider: oauth2
         }
       });
-      const headers = new import_router3.HeadersBuilder(cacheControl).setHeader("Location", cookieRedirectTo).setCookie(cookies.sessionToken.name, sessionCookie, cookies.sessionToken.attributes).setCookie(cookies.csrfToken.name, csrfToken, cookies.csrfToken.attributes).setCookie(cookies.state.name, "", expiredCookieAttributes).setCookie(cookies.redirectURI.name, "", expiredCookieAttributes).setCookie(cookies.redirectTo.name, "", expiredCookieAttributes).setCookie(cookies.codeVerifier.name, "", expiredCookieAttributes).toHeaders();
+      const headers = new import_router4.HeadersBuilder(cacheControl).setHeader("Location", cookieRedirectTo).setCookie(cookies.sessionToken.name, sessionCookie, cookies.sessionToken.attributes).setCookie(cookies.csrfToken.name, csrfToken, cookies.csrfToken.attributes).setCookie(cookies.state.name, "", expiredCookieAttributes).setCookie(cookies.redirectURI.name, "", expiredCookieAttributes).setCookie(cookies.redirectTo.name, "", expiredCookieAttributes).setCookie(cookies.codeVerifier.name, "", expiredCookieAttributes).toHeaders();
       return Response.json({ oauth: oauth2 }, { status: 302, headers });
     },
     callbackConfig(oauth)
@@ -830,100 +976,161 @@ var callbackAction = (oauth) => {
 };
 
 // src/actions/session/session.ts
-var import_router4 = require("@aura-stack/router");
-var sessionAction = (0, import_router4.createEndpoint)("GET", "/session", async (ctx) => {
+var import_router5 = require("@aura-stack/router");
+
+// src/api/getSession.ts
+var getSession = async ({ ctx, headers }) => {
+  try {
+    const session = getCookie(new Headers(headers), ctx.cookies.sessionToken.name);
+    const decoded = await ctx.jose.decodeJWT(session);
+    ctx?.logger?.log("AUTH_SESSION_VALID");
+    const { exp, iat, jti, nbf, aud, iss, ...user } = decoded;
+    return {
+      session: {
+        user,
+        expires: toISOString(exp * 1e3)
+      },
+      authenticated: true
+    };
+  } catch (error) {
+    ctx?.logger?.log("AUTH_SESSION_INVALID", { structuredData: { error_type: getErrorName(error) } });
+    return { session: null, authenticated: false };
+  }
+};
+
+// src/actions/session/session.ts
+var sessionAction = (0, import_router5.createEndpoint)("GET", "/session", async (ctx) => {
   const {
     request,
-    context: { jose, cookies, logger }
+    context: { cookies }
   } = ctx;
   try {
-    const session = getCookie(request, cookies.sessionToken.name);
-    const decoded = await jose.decodeJWT(session);
-    logger?.log("AUTH_SESSION_VALID");
-    const { exp, iat, jti, nbf, ...user } = decoded;
-    const headers = new Headers(secureApiHeaders);
-    return Response.json({ user, expires: toISOString(exp * 1e3) }, { headers });
+    const session = await getSession({ ctx: ctx.context, headers: request.headers });
+    if (!session.authenticated) {
+      throw new AuthInternalError("INVALID_JWT_TOKEN", "Session not authenticated");
+    }
+    return Response.json(session, { headers: secureApiHeaders });
   } catch (error) {
-    logger?.log("AUTH_SESSION_INVALID", { structuredData: { error_type: getErrorName(error) } });
-    const headers = new import_router4.HeadersBuilder(secureApiHeaders).setCookie(cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
-    return Response.json({ authenticated: false, message: "Unauthorized" }, { status: 401, headers });
+    const headers = new import_router5.HeadersBuilder(secureApiHeaders).setCookie(cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
+    return Response.json({ session: null, authenticated: false }, { status: 401, headers });
   }
 });
 
 // src/actions/signOut/signOut.ts
-var import_zod4 = require("zod");
-var import_router5 = require("@aura-stack/router");
-var config = (0, import_router5.createEndpointConfig)({
-  schemas: {
-    searchParams: import_zod4.z.object({
-      token_type_hint: import_zod4.z.literal("session_token"),
-      redirectTo: import_zod4.z.string().optional()
-    })
+var import_v44 = require("zod/v4");
+var import_router7 = require("@aura-stack/router");
+
+// src/api/signOut.ts
+var import_router6 = require("@aura-stack/router");
+var signOut = async ({
+  ctx,
+  headers: headersInit,
+  redirectTo = "/",
+  skipCSRFCheck = false
+}) => {
+  const headers = new Headers(headersInit);
+  const header = headers.get("X-CSRF-Token");
+  let session = null;
+  let csrfToken = null;
+  try {
+    session = getCookie(headers, ctx.cookies.sessionToken.name);
+  } catch {
+    throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
   }
-});
-var signOutAction = (0, import_router5.createEndpoint)(
-  "POST",
-  "/signOut",
-  async (ctx) => {
-    const {
-      request,
-      headers,
-      searchParams: { redirectTo },
-      context
-    } = ctx;
-    const { jose, cookies, logger } = context;
-    const session = headers.getCookie(cookies.sessionToken.name);
-    const csrfToken = headers.getCookie(cookies.csrfToken.name);
-    const header = headers.getHeader("X-CSRF-Token");
-    logger?.log("SIGN_OUT_ATTEMPT", {
-      structuredData: {
-        has_session: Boolean(session),
-        has_csrf_token: Boolean(csrfToken),
-        has_csrf_header: Boolean(header)
-      }
-    });
-    if (!session) {
-      logger?.log("SESSION_TOKEN_MISSING");
-      throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
+  try {
+    csrfToken = getCookie(headers, ctx.cookies.csrfToken.name);
+  } catch {
+    throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF token is missing.");
+  }
+  ctx?.logger?.log("SIGN_OUT_ATTEMPT", {
+    structuredData: {
+      has_session: Boolean(session),
+      has_csrf_token: Boolean(csrfToken),
+      has_csrf_header: Boolean(header),
+      skip_csrf_check: skipCSRFCheck
     }
+  });
+  if (!session) {
+    ctx?.logger?.log("SESSION_TOKEN_MISSING");
+    throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
+  }
+  if (!skipCSRFCheck) {
     if (!csrfToken) {
-      logger?.log("CSRF_TOKEN_MISSING");
+      ctx?.logger?.log("CSRF_TOKEN_MISSING");
       throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF token is missing.");
     }
     if (!header) {
-      logger?.log("CSRF_HEADER_MISSING");
+      ctx?.logger?.log("CSRF_HEADER_MISSING");
       throw new AuthSecurityError("CSRF_HEADER_MISSING", "The CSRF header is missing.");
     }
     try {
-      await verifyCSRF(jose, csrfToken, header);
+      await verifyCSRF(ctx.jose, csrfToken, header);
     } catch (error) {
-      logger?.log("CSRF_TOKEN_INVALID", { structuredData: { error_type: getErrorName(error) } });
+      ctx?.logger?.log("CSRF_TOKEN_INVALID", { structuredData: { error_type: getErrorName(error) } });
       throw new AuthSecurityError("CSRF_TOKEN_INVALID", "CSRF token verification failed");
     }
-    logger?.log("SIGN_OUT_CSRF_VERIFIED");
+    ctx?.logger?.log("SIGN_OUT_CSRF_VERIFIED");
+  } else {
     try {
-      await jose.decodeJWT(session);
-      logger?.log("SIGN_OUT_SUCCESS");
+      await ctx.jose.verifyJWS(csrfToken);
     } catch (error) {
-      logger?.log("INVALID_JWT_TOKEN", { structuredData: { error_type: getErrorName(error) } });
+      ctx?.logger?.log("CSRF_TOKEN_INVALID", { structuredData: { error_type: getErrorName(error) } });
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "CSRF token verification failed");
+    }
+  }
+  try {
+    await ctx.jose.decodeJWT(session);
+    ctx?.logger?.log("SIGN_OUT_SUCCESS");
+  } catch (error) {
+    ctx?.logger?.log("INVALID_JWT_TOKEN", { structuredData: { error_type: getErrorName(error) } });
+  }
+  const headersList = new import_router6.HeadersBuilder(secureApiHeaders).setHeader("Location", redirectTo).setCookie(ctx.cookies.csrfToken.name, "", expiredCookieAttributes).setCookie(ctx.cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
+  return Response.json(
+    { redirect: Boolean(redirectTo), url: redirectTo },
+    {
+      status: 202,
+      headers: headersList
     }
+  );
+};
+
+// src/actions/signOut/signOut.ts
+var config = (0, import_router7.createEndpointConfig)({
+  schemas: {
+    searchParams: import_v44.z.object({
+      token_type_hint: import_v44.z.literal("session_token"),
+      redirectTo: import_v44.z.string().optional()
+    })
+  }
+});
+var signOutAction = (0, import_router7.createEndpoint)(
+  "POST",
+  "/signOut",
+  async (ctx) => {
+    const {
+      request,
+      searchParams: { redirectTo },
+      context
+    } = ctx;
     const baseURL = getBaseURL(request);
     const location = await createRedirectTo(
       new Request(baseURL, {
-        headers: headers.toHeaders()
+        headers: request.headers
       }),
       redirectTo,
       context
     );
-    logger?.log("SIGN_OUT_REDIRECT", { structuredData: { location } });
-    const headersList = new import_router5.HeadersBuilder(secureApiHeaders).setHeader("Location", location).setCookie(cookies.csrfToken.name, "", expiredCookieAttributes).setCookie(cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
-    return Response.json({ message: "Signed out successfully" }, { status: import_router5.statusCode.ACCEPTED, headers: headersList });
+    return await signOut({
+      ctx: context,
+      headers: request.headers,
+      redirectTo: location
+    });
   },
   config
 );
 
 // src/actions/csrfToken/csrfToken.ts
-var import_router6 = require("@aura-stack/router");
+var import_router8 = require("@aura-stack/router");
 var getCSRFToken = (request, cookieName) => {
   try {
     return getCookie(request, cookieName);
@@ -931,7 +1138,7 @@ var getCSRFToken = (request, cookieName) => {
     return void 0;
   }
 };
-var csrfTokenAction = (0, import_router6.createEndpoint)("GET", "/csrfToken", async (ctx) => {
+var csrfTokenAction = (0, import_router8.createEndpoint)("GET", "/csrfToken", async (ctx) => {
   const {
     request,
     context: { jose, cookies, logger }