@aura-stack/auth 0.4.0 → 0.6.0

package/dist/index.d.cts

@@ -0,0 +1,2 @@
+import { R as createAuth, _t as User, bt as AuthInstance, pt as Session, yt as AuthConfig } from "./index-BkpwQ0l4.cjs";
+export { type AuthConfig, type AuthInstance, type Session, type User, createAuth };

package/dist/index.d.ts

@@ -1,35 +1,2 @@
-import { d as AuthConfig, e as AuthInstance } from './index-CSyIJmCM.js';
-export { C as CookieConfig, E as ErrorType, f as JoseInstance, i as LogLevel, L as Logger, O as OAuthProvider, g as OAuthProviderConfig, h as OAuthProviderCredentials, S as Session, T as TrustedOrigin, U as User } from './index-CSyIJmCM.js';
-import 'zod';
-import './schemas.js';
-import './jose.js';
-import '@aura-stack/jose';
-import '@aura-stack/jose/jose';
-import '@aura-stack/router/cookie';
-import './@types/utility.js';
-
-/**
- * Creates the authentication instance with the configuration provided for OAuth provider.
- * > NOTE: The handlers returned by this function should be used in the server to handle the authentication routes
- * and within the `/auth` base path
- *
- * @param authConfig - Authentication configuration including OAuth provider
- * @returns Authentication instance with handlers to be used in the server
- * @example
- * const auth = createAuth({
- *   oauth: ["github", {
- *     id: "custom-oauth",
- *     name: "custom-oauth",
- *     authorizationURL: "https://custom-oauth.com/oauth/authorize",
- *     accessToken: "https://custom-oauth.com/oauth/token",
- *     scope: "profile email",
- *     responseType: "code",
- *     userInfo: "https://custom-oauth.com/api/userinfo",
- *     clientId: process.env.AURA_AUTH_CUSTOM_OAUTH_CLIENT_ID!,
- *     clientSecret: process.env.AURA_AUTH_CUSTOM_OAUTH_CLIENT_SECRET!,
- *   }]
- * })
- */
-declare const createAuth: (authConfig: AuthConfig) => AuthInstance;
-
-export { AuthConfig, AuthInstance, createAuth };
+import { R as createAuth, _t as User, bt as AuthInstance, pt as Session, yt as AuthConfig } from "./index-nqLV2t91.js";
+export { type AuthConfig, type AuthInstance, type Session, type User, createAuth };

package/dist/index.js

@@ -1,132 +1 @@
-import {
-  createBuiltInOAuthProviders
-} from "./chunk-TM5IPSNF.js";
-import "./chunk-IPKO6UQN.js";
-import "./chunk-54CZPKR4.js";
-import "./chunk-EEE7UM5T.js";
-import "./chunk-4YHJ4IEQ.js";
-import "./chunk-OVHNRULD.js";
-import "./chunk-KMMAZFSJ.js";
-import "./chunk-FW4W3REU.js";
-import "./chunk-5LZ7TOM3.js";
-import "./chunk-LDU7A2JE.js";
-import "./chunk-E6G5YCI6.js";
-import "./chunk-ITQ7352M.js";
-import {
-  signInAction
-} from "./chunk-7QF22LHP.js";
-import {
-  csrfTokenAction
-} from "./chunk-ICAZ4OVS.js";
-import {
-  signOutAction
-} from "./chunk-ALG3GIV4.js";
-import {
-  callbackAction
-} from "./chunk-6MXFPFR3.js";
-import "./chunk-TZB6MUXN.js";
-import "./chunk-XGLBNXL4.js";
-import {
-  sessionAction
-} from "./chunk-PHFH2MGS.js";
-import "./chunk-XUP6KKNG.js";
-import "./chunk-ZNCZVF6U.js";
-import "./chunk-KJBAQZX2.js";
-import "./chunk-NUDITUKX.js";
-import "./chunk-4EKY7655.js";
-import {
-  createErrorHandler,
-  useSecureCookies
-} from "./chunk-QQVSRXGX.js";
-import {
-  createCookieStore
-} from "./chunk-5W4BRQYG.js";
-import "./chunk-EBAMFRB7.js";
-import {
-  createJoseInstance
-} from "./chunk-FRJFWTOY.js";
-import "./chunk-4MYWAOLG.js";
-import "./chunk-RRLIF4PQ.js";
-import {
-  createLogEntry
-} from "./chunk-VNCNJKS2.js";
-
-// src/index.ts
-import { createRouter } from "@aura-stack/router";
-var logLevelToSeverity = {
-  debug: ["debug", "info", "notice", "warning", "error", "critical", "alert", "emergency"],
-  info: ["info", "notice", "warning", "error", "critical", "alert", "emergency"],
-  warn: ["warning", "error", "critical", "alert", "emergency"],
-  error: ["error", "critical", "alert", "emergency"]
-};
-var createLoggerProxy = (logger) => {
-  if (!logger) return void 0;
-  const level = logger.level;
-  const allowedSeverities = logLevelToSeverity[level] ?? [];
-  const internalLogger = {
-    level,
-    log(key, overrides) {
-      const entry = createLogEntry(key, overrides);
-      if (!allowedSeverities.includes(entry.severity)) return entry;
-      logger.log({
-        timestamp: entry.timestamp ?? (/* @__PURE__ */ new Date()).toISOString(),
-        appName: entry.appName ?? "aura-auth",
-        hostname: entry.hostname ?? "aura-auth",
-        ...entry
-      });
-      return entry;
-    }
-  };
-  return internalLogger;
-};
-var createInternalConfig = (authConfig) => {
-  const useSecure = authConfig?.trustedProxyHeaders ?? false;
-  const logger = authConfig?.logger;
-  const internalLogger = createLoggerProxy(logger);
-  return {
-    basePath: authConfig?.basePath ?? "/auth",
-    onError: createErrorHandler(internalLogger),
-    context: {
-      oauth: createBuiltInOAuthProviders(authConfig?.oauth),
-      cookies: createCookieStore(
-        useSecure,
-        authConfig?.cookies?.prefix,
-        authConfig?.cookies?.overrides ?? {},
-        internalLogger
-      ),
-      jose: createJoseInstance(authConfig?.secret),
-      secret: authConfig?.secret,
-      basePath: authConfig?.basePath ?? "/auth",
-      trustedProxyHeaders: useSecure,
-      trustedOrigins: authConfig?.trustedOrigins,
-      logger: internalLogger
-    },
-    middlewares: [
-      (ctx) => {
-        const useSecure2 = useSecureCookies(ctx.request, ctx.context.trustedProxyHeaders);
-        const cookies = createCookieStore(
-          useSecure2,
-          authConfig?.cookies?.prefix,
-          authConfig?.cookies?.overrides ?? {},
-          internalLogger
-        );
-        ctx.context.cookies = cookies;
-        return ctx;
-      }
-    ]
-  };
-};
-var createAuth = (authConfig) => {
-  const config = createInternalConfig(authConfig);
-  const router = createRouter(
-    [signInAction(config.context.oauth), callbackAction(config.context.oauth), sessionAction, signOutAction, csrfTokenAction],
-    config
-  );
-  return {
-    handlers: router,
-    jose: config.context.jose
-  };
-};
-export {
-  createAuth
-};
+import{a as e,c as t,d as n,f as r,i,l as a,n as o,o as s,r as c,s as l,u}from"./errors-DFWHOho6.js";import{a as d,i as f,n as p,o as m,r as h,s as g}from"./oauth-DmHy9VrB.js";import{i as _,n as v,r as y,t as b}from"./env-nvh8QBNz.js";import{_ as x,c as S,d as C,f as w,g as ee,h as te,i as T,l as ne,m as E,p as D,r as O,s as k,v as A}from"./assert-B3iQSYlK.js";import{a as re,c as ie,i as j,o as ae,r as oe,s as se,t as M}from"./crypto-Bz8nIciY.js";import{UserIdentity as N}from"./shared/identity.js";import{t as ce}from"./logger-C59_CDMk.js";import{HeadersBuilder as P,createEndpoint as F,createEndpointConfig as I,createRouter as le,isInvalidZodSchemaError as ue,isRouterError as de}from"@aura-stack/router";import{z as L}from"zod/v4";import{parse as fe,serialize as pe}from"@aura-stack/router/cookie";const R={"Cache-Control":`no-store`,Pragma:`no-cache`,Expires:`0`,Vary:`Cookie`},me={"Content-Security-Policy":[`default-src 'none'`,`script-src 'self'`,`frame-src 'none'`,`object-src 'none'`,`frame-ancestors 'none'`,`base-uri 'none'`].join(`; `)},he={"X-Content-Type-Options":`nosniff`,"X-Frame-Options":`DENY`,"Referrer-Policy":`strict-origin-when-cross-origin`},z={...R,...me,...he},ge=(e,t)=>{for(let[n,r]of Object.entries(t))r!==void 0&&r!==``&&e.searchParams.set(n,r)},_e=(e,t,n,r,i)=>{let a=e.authorize,s=typeof a==`string`?a:a?.url??e.authorizeURL;if(!s)throw new o(`INVALID_OAUTH_CONFIGURATION`,`Missing authorization URL in OAuth provider configuration.`);let c=new URL(s),l=typeof a==`string`?void 0:a?.params;return ge(c,{response_type:l?.responseType??e.responseType??`code`,client_id:e.clientId,redirect_uri:t,state:n,code_challenge:r,code_challenge_method:i,scope:l?.scope??e.scope,prompt:l?.prompt,response_mode:l?.responseMode,login_hint:l?.loginHint,nonce:l?.nonce,display:l?.display,audience:l?.audience}),c.toString()},ve=async(e,t,n)=>{let r=j(),{codeVerifier:i,codeChallenge:a,method:s}=await oe(),c=_e(e,t,r,a,s);if(!d.safeParse({...e,redirectURI:t,state:r,codeChallenge:a,codeChallengeMethod:s}).success)throw n?.logger?.log(`INVALID_OAUTH_CONFIGURATION`,{structuredData:{scope:e?.scope??``,redirect_uri:t,has_state:!!r,has_code_challenge:!!a,code_challenge_method:s}}),new o(`INVALID_OAUTH_CONFIGURATION`,`The OAuth provider configuration is invalid.`);return{authorization:c,state:r,codeVerifier:i,method:s}},B=async(e,t)=>{if(!t)return[];let n=typeof t==`function`?await t(e):t;return Array.isArray(n)?n:typeof n==`string`?[n]:[]},V=async({ctx:e,request:t,headers:n})=>{let r=v(`BASE_URL`)||e?.baseURL;if(r&&r!==`/`)return r;if(e?.trustedProxyHeaders){let e=n&&new Headers(n)||t?.headers,r=e?.get(`Forwarded`)?.match(/proto=([^;]+)/i)?.[1]??e?.get(`X-Forwarded-Proto`)??`http`,i=e?.get(`Host`)??e?.get(`Forwarded`)?.match(/host=([^;]+)/i)?.[1]??e?.get(`X-Forwarded-Host`)??null;if(i)return`${r}://${i}`;throw new o(`INVALID_OAUTH_CONFIGURATION`,`The URL cannot be constructed. Please set the BASE_URL environment variable or provide trusted proxy host headers.`)}try{return new URL(t?.url??`not-found`).origin}catch(e){throw new o(`INVALID_OAUTH_CONFIGURATION`,`The URL cannot be constructed. Please set the BASE_URL environment variable or enable trustedProxyHeaders.`,{cause:e})}},H=async(e,t)=>{let n=await B(e,t?.trustedOrigins);n.push(new URL(e.url).origin);let r=await V({request:e,ctx:t});if(!k(r,n))throw t?.logger?.log(`UNTRUSTED_ORIGIN`,{structuredData:{origin:r}}),new o(`UNTRUSTED_ORIGIN`,`The constructed origin URL is not trusted.`);return r},ye=async(e,t,n)=>`${await H(e,n)}${n.basePath}/callback/${t}`,be=async({request:e,oauth:t,ctx:n,redirectTo:r})=>{let i=await H(e,n),a=new URLSearchParams;return r!==void 0&&a.set(`redirectTo`,String(r)),`${i}${n.basePath}/signIn/${t}?${a.toString()}`},U=async(e,t,n)=>{try{let r=e.headers,i=await H(e,n),a=await B(e,n?.trustedOrigins);return(t=>{if(!O(t)&&!S(t))return`/`;if(O(t))return t;if(a.length>0){if(k(t,a)){let n=new URL(t).origin;for(let r of a){if(ee(r)?.test(n))return T(t,e.url)?w(t):t;if(S(r)&&C(new URL(r).origin,n))return t}}return n?.logger?.log(`OPEN_REDIRECT_ATTACK`),`/`}return T(t,i)?w(t):(n?.logger?.log(`OPEN_REDIRECT_ATTACK`),`/`)})(t??r.get(`Referer`)??r.get(`Origin`)??`/`)}catch{return n?.logger?.log(`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`),`/`}},W=async(e,{ctx:t,request:n,headers:r,redirect:i,redirectTo:a})=>{try{let s=new Headers(r),c=t.oauth[e];if(!c)throw new o(`INVALID_OAUTH_CONFIGURATION`,`The OAuth provider "${e}" is not configured.`);let l=n;if(!l){let n=`${await V({ctx:t,headers:s})}${t.basePath}/signIn/${e}`;l=new Request(n,{headers:s})}if(i===!1){t?.logger?.log(`SIGN_IN_INITIATED`,{structuredData:{oauth_provider:e}});let n=await be({request:l,oauth:e,ctx:t,redirectTo:a}),r=new Headers(z);return{success:!0,redirect:!1,signInURL:n,headers:r,toResponse:()=>Response.json({success:!0,redirect:!1,signInURL:n},{status:200,headers:r})}}let u=await ye(l,e,t),d=await U(l,a,t),{authorization:f,state:p,codeVerifier:m}=await ve(c,u,t);t?.logger?.log(`SIGN_IN_INITIATED`,{structuredData:{oauth_provider:e}});let h=new P(R).setHeader(`Location`,f).setCookie(t.cookies.state.name,p,t.cookies.state.attributes).setCookie(t.cookies.redirectURI.name,u,t.cookies.redirectURI.attributes).setCookie(t.cookies.redirectTo.name,d,t.cookies.redirectTo.attributes).setCookie(t.cookies.codeVerifier.name,m,t.cookies.codeVerifier.attributes).toHeaders();return{success:!0,redirect:!0,signInURL:f,headers:h,toResponse:()=>Response.json({success:!0,redirect:!0,signInURL:f},{status:302,headers:h})}}catch(e){let t=`AUTH_SIGN_IN_FAILED`,n=`An error occurred during the sign-in process.`;return l(e)&&(t=e.code,n=e.message),{success:!1,redirect:!1,signInURL:null,error:{code:t,message:n},headers:new Headers(z),toResponse:()=>Response.json({success:!1,redirect:!1,signInURL:null,error:{code:t,message:n}},{status:500,headers:z})}}},G=async({ctx:t,payload:n,request:r,headers:i,redirectTo:a})=>{let{cookies:o,credentials:s,sessionStrategy:c,logger:u}=t;try{let l=r;if(!l){let e=`${await V({ctx:t,headers:i})}${t.basePath}/signIn/credentials`;l=new Request(e,{headers:i})}await H(l,t);let d=await s?.authorize({credentials:n,deriveSecret:s?.hash??re,verifySecret:s?.verify??se});if(!d)throw new e(`INVALID_CREDENTIALS`,`The provided credentials are invalid.`);let f=await c.createSession(d),p=await M(t.jose);u?.log(`CREDENTIALS_SIGN_IN_SUCCESS`);let m=await U(l,a,t),h=new P(z).setHeader(`Location`,m).setCookie(o.csrfToken.name,p,o.csrfToken.attributes).setCookie(o.sessionToken.name,f,o.sessionToken.attributes).toHeaders();return{success:!0,headers:h,redirectURL:m,toResponse:()=>Response.json({success:!0,redirectURL:m},{headers:h})}}catch(t){let n=`CREDENTIALS_SIGN_IN_ERROR`,r=`An error occurred during credentials sign-in.`;l(t)&&(n=t.code,r=t.message);let i=new Headers(z),a={success:!1,headers:i,redirectURL:null,error:{code:n,message:r},toResponse:()=>Response.json({success:!1,redirectURL:null,error:{code:n,message:r}},{headers:i,status:401})};return t instanceof e?(u?.log(`INVALID_CREDENTIALS`,{severity:`warning`,structuredData:{path:`/signIn/credentials`}}),a):(u?.log(`CREDENTIALS_SIGN_IN_FAILED`,{severity:`error`,structuredData:{path:`/signIn/credentials`}}),a)}},K=async({ctx:e,request:t,headers:n,redirect:r,redirectTo:i,skipCSRFCheck:a=!1})=>{let o=await e.sessionStrategy.destroySession(new Headers(n),a),s=t;if(!s){let t=`${await V({ctx:e,headers:o})}${e.basePath}/signOut`;s=new Request(t,{headers:o})}let c=new P(o),l=await U(s,i,e);l&&c.setHeader(`Location`,l);let u=c.toHeaders();return{headers:u,redirect:r??!1,redirectURL:l,success:!0,toResponse:()=>Response.json({success:!0,redirect:r??!1,redirectURL:l},{headers:u,status:i?302:202})}},q={httpOnly:!0,sameSite:`lax`,path:`/`,maxAge:3600*24*15},xe={secure:!1,httpOnly:!0},Se={secure:!0,httpOnly:!0},J={secure:!0,httpOnly:!0,path:`/`,domain:void 0},Y={httpOnly:!0,maxAge:300,sameSite:`lax`,expires:new Date(Date.now()+300*1e3)},Ce=(e,t,n)=>pe(e,t,n),X={...q,expires:new Date(0),maxAge:0,secure:!0},Z=(e,t)=>{let n=e instanceof Request?e.headers.get(`Cookie`):e.get(`Cookie`);if(!n)throw new o(`COOKIE_NOT_FOUND`,`No cookies found. There is no active session`);let r=fe(n)[t];if(!r)throw new o(`COOKIE_NOT_FOUND`,`Cookie "${t}" not found. There is no active session`);return r},Q=(e,t,n,r)=>(t.httpOnly||r?.log(`COOKIE_HTTPONLY_DISABLED`),t.domain===`*`&&(t.domain=void 0,r?.log(`COOKIE_WILDCARD_DOMAIN`)),e?n===`host`?{...q,...t,...J}:{...q,...t,...Se}:(t.secure&&r?.log(`COOKIE_SECURE_DISABLED`),t.sameSite==`none`&&(t.sameSite=`lax`,r?.log(`COOKIE_SAMESITE_NONE_WITHOUT_SECURE`)),b.NODE_ENV===`production`&&r?.log(`COOKIE_INSECURE_IN_PRODUCTION`),n===`host`&&r?.log(`COOKIE_HOST_STRATEGY_INSECURE`),{...q,...t,...xe})),we=(e,t,n,r)=>{t??=`aura-auth`;let i=e?`__Secure-`:``,a=e?`__Host-`:``;return{sessionToken:{name:`${i}${t}.${n?.sessionToken?.name??`session_token`}`,attributes:Q(e,{...q,...n?.sessionToken?.attributes},n?.sessionToken?.attributes?.strategy??`secure`,r)},state:{name:`${i}${t}.${n?.state?.name??`state`}`,attributes:Q(e,{...Y,...n?.state?.attributes},n?.state?.attributes?.strategy??`secure`,r)},csrfToken:{name:`${a}${t}.${n?.csrfToken?.name??`csrf_token`}`,attributes:Q(e,{...n?.csrfToken?.attributes,...J,sameSite:`strict`},n?.csrfToken?.attributes?.strategy??`host`,r)},redirectTo:{name:`${i}${t}.${n?.redirectTo?.name??`redirect_to`}`,attributes:Q(e,{...Y,...n?.redirectTo?.attributes},n?.redirectTo?.attributes?.strategy??`secure`,r)},redirectURI:{name:`${i}${t}.${n?.redirectURI?.name??`redirect_uri`}`,attributes:Q(e,{...Y,...n?.redirectURI?.attributes},n?.redirectURI?.attributes?.strategy??`secure`,r)},codeVerifier:{name:`${i}${t}.${n?.codeVerifier?.name??`code_verifier`}`,attributes:Q(e,{...Y,...n?.codeVerifier?.attributes},n?.codeVerifier?.attributes?.strategy??`secure`,r)}}},Te=async({ctx:e,headers:t})=>{let n=new P(z).setCookie(e.cookies.sessionToken.name,``,{...e.cookies.sessionToken.attributes,...X}).setCookie(e.cookies.csrfToken.name,``,{...e.cookies.csrfToken.attributes,...X}).toHeaders(),r={code:`GET_SESSION_FAILED`,message:`Failed to retrieve session. The session token may be missing, expired, or invalid.`},i={session:null,headers:n,success:!1,error:r,toResponse:()=>Response.json({success:!1,session:null},{status:401,headers:n})};try{let{session:n,headers:a}=await e.sessionStrategy.getSession(new Headers(t));if(!n)return i;let o=A(a,z);return{session:n,headers:o,success:!0,toResponse:()=>Response.json({success:!0,session:n,error:r},{headers:o})}}catch(t){return e?.logger?.log(`AUTH_SESSION_INVALID`,{structuredData:{error_type:E(t)}}),i}},Ee=async({ctx:e,request:t,headers:n,session:r,redirectTo:i,skipCSRFCheck:a=!1})=>{try{let{session:o,headers:s}=await e.sessionStrategy.refreshSession(new Headers(n),r,a),c=A(s,z),l=null;if(i){let n=t;if(!n){let t=`${await V({ctx:e,headers:s})}${e.basePath}/updateSession`;n=new Request(t,{headers:c})}l=await U(n,i,e)}return{headers:c,session:o,success:!!o,redirectURL:l,toResponse:()=>Response.json({success:!!o,session:o,redirectURL:l},{headers:c,status:o?200:401})}}catch(e){let t=`UPDATE_SESSION_INVALID`,n=`Failed to update session.`;l(e)&&(t=e.code,n=e.message);let r=new Headers(z);return{success:!1,headers:r,session:null,redirectURL:null,error:{code:t,message:n},toResponse:()=>Response.json({success:!1,session:null,redirectURL:null,error:{code:t,message:n}},{status:400,headers:r})}}},De=e=>({getSession:async t=>await Te({ctx:e,headers:t.headers}),signIn:async(t,n)=>W(t,{ctx:e,...n}),signInCredentials:async t=>G({ctx:e,...t}),updateSession:async t=>Ee({ctx:e,...t,skipCSRFCheck:!0}),signOut:async t=>K({ctx:e,...t,skipCSRFCheck:!0})}),Oe=(e,t)=>{let n=e?.mode??`sealed`;if(![`sealed`,`signed`,`encrypted`].includes(n))throw new c(`[auth] invalid JWT mode "${n}". Valid options are: "sealed", "signed", "encrypted".`);return{createToken:n===`sealed`?t.encodeJWT:n===`signed`?t.signJWS:t.encryptJWE,verifyToken:n===`sealed`?t.decodeJWT:n===`signed`?t.verifyJWS:t.decryptJWE}},ke=e=>({getCookie:t=>({sessionToken:Z(t,e().sessionToken.name)}),setCookie:({sessionToken:t})=>new P(z).setCookie(e().sessionToken.name,t,e().sessionToken.attributes).toHeaders(),clear:()=>new P(z).setCookie(e().csrfToken.name,``,{...X,...e().csrfToken.attributes}).setCookie(e().sessionToken.name,``,{...X,...e().sessionToken.attributes}).toHeaders()}),Ae=(e,t)=>{switch(t){case`strip`:return e.strip();case`passthrough`:return e.loose();case`strict`:return e.strict()}},je=t=>{let n=Ae(t.schema??N,t.unknownKeys??`strip`),r=n.partial();return{parse:async(t={})=>{let r=await n.safeParseAsync(t);if(!r.success)throw new e(`INVALID_IDENTITY_VALIDATION_FAILED`,JSON.stringify(D(r.error),null,2),{cause:r.error});return r.data},parseAsPartial:async(t={})=>{let n=await r.safeParseAsync(t);if(!n.success)throw new e(`INVALID_IDENTITY_VALIDATION_FAILED`,JSON.stringify(D(n.error),null,2),{cause:n.error});return n.data}}},Me=({config:e,jose:t,logger:n,cookies:r,identity:a})=>{let o=Oe(e?.jwt,t),s=ke(r),c=e?.jwt?.maxAge??3600*24*15,l=e?.jwt?.expirationStrategy??`absolute`,u=je(a),d=({exp:e})=>{if(!e)return null;let t=Math.floor(Date.now()/1e3);switch(l){case`fixed`:case`absolute`:return null;case`rolling`:return new Date((t+c)*1e3);case`sliding`:{let n=c*.25;return e-t<n?new Date((t+c)*1e3):null}default:return null}},f=async(e,a=!1)=>{let o=null,s=null,c=e.get(`X-CSRF-Token`);try{o=Z(e,r().sessionToken.name)}catch{throw new i(`SESSION_TOKEN_MISSING`,`The sessionToken is missing.`)}try{s=Z(e,r().csrfToken.name)}catch{throw new i(`CSRF_TOKEN_MISSING`,`The CSRF token is missing.`)}if(n?.log(`CSRF_TOKEN_REQUESTED`,{structuredData:{has_session:!!o,has_csrf_token:!!s,has_csrf_header:!!c,skip_csrf_check:a}}),!o)throw n?.log(`SESSION_TOKEN_MISSING`),new i(`SESSION_TOKEN_MISSING`,`The sessionToken is missing.`);if(a)try{await t.verifyJWS(s)}catch(e){throw n?.log(`CSRF_TOKEN_INVALID`,{structuredData:{error_type:E(e)}}),new i(`CSRF_TOKEN_INVALID`,`CSRF token verification failed`)}else{if(!s)throw n?.log(`CSRF_TOKEN_MISSING`),new i(`CSRF_TOKEN_MISSING`,`The CSRF token is missing.`);if(!c)throw n?.log(`CSRF_HEADER_MISSING`),new i(`CSRF_HEADER_MISSING`,`The CSRF header is missing.`);try{await ae(t,s,c)}catch(e){throw n?.log(`CSRF_TOKEN_INVALID`,{structuredData:{error_type:E(e)}}),new i(`CSRF_TOKEN_INVALID`,`CSRF token verification failed`)}n?.log(`CSRF_TOKEN_VERIFIED`)}try{return await t.decodeJWT(o),!0}catch(e){return n?.log(`INVALID_JWT_TOKEN`,{structuredData:{error_type:E(e)}}),!1}};return{getSession:async e=>{let t=new Headers;try{let{sessionToken:r}=s.getCookie(e);if(!r)return{session:null,headers:t};let{exp:i,iat:c,jti:f,nbf:p,aud:m,iss:h,mexp:g,..._}=await o.verifyToken(r);if(!_.sub)return{session:null,headers:t};let v={user:_,expires:i?new Date(i*1e3).toISOString():``},y=d({exp:i});if(!y){let t=a.skipValidation?v.user:await u.parse(v.user);return{session:{expires:v.expires,user:t},headers:e}}let b=a.skipValidation?v.user:await u.parse(v.user),x={user:b,expires:y.toISOString()},S=l===`absolute`?c:Math.floor(Date.now()/1e3),C=await o.createToken({...b,exp:Math.floor(y.getTime()/1e3),iat:S,mexp:g});return n?.log(`SESSION_REFRESHED`,{structuredData:{strategy:`stateless`,expiresAt:y.toISOString()}}),{session:x,headers:s.setCookie({sessionToken:C})}}catch(e){return n?.log(`AUTH_SESSION_INVALID`,{structuredData:{error_type:E(e)}}),{session:null,headers:t}}},createSession:async e=>{a.skipValidation&&n?.log(`IDENTITY_VALIDATION_DISABLED`,{structuredData:{identity_validation_disabled:!0}});let t=a.skipValidation?e:await u.parse(e);return o.createToken(t)},refreshSession:async(e,t,r=!1)=>{try{let{sessionToken:n}=s.getCookie(e);if(!n||!await f(e,r))return{session:null,headers:s.clear()};let i=await o.verifyToken(n),{exp:p,mexp:m,sub:h,iat:g}=i,_=a.skipValidation?i:await u.parse(i),v=a.skipValidation?t.user:await u.parseAsPartial(t.user),y=t.expires?new Date(t.expires):d({exp:p})??new Date(Date.now()+c*1e3),b={user:{..._,...v,sub:h},expires:y.toISOString()},x=l===`absolute`?g:Math.floor(Date.now()/1e3),S=await o.createToken({...b.user,exp:Math.floor(y.getTime()/1e3),iat:x,mexp:m});return b.expires=new Date(b.expires).toISOString(),{session:b,headers:s.setCookie({sessionToken:S})}}catch(e){return n?.log(`AUTH_SESSION_INVALID`,{structuredData:{error_type:E(e)}}),{session:null,headers:s.clear()}}},revokeSession:async e=>{},destroySession:async(e,t=!1)=>(await f(e,t),s.clear())}},Ne=({config:e,jose:t,cookies:n,logger:r,identity:i})=>{let a=e?.strategy??`jwt`;switch(a){case`jwt`:return Me({jose:t,config:e,cookies:n,logger:r,identity:i});default:throw new c(`[auth] unknown session strategy "${a}". Valid options are: "jwt".`)}},Pe=e=>{let t=v(`TRUSTED_PROXY_HEADERS`)===void 0?e?.trustedProxyHeaders??!1:_(`TRUSTED_PROXY_HEADERS`),n=ce(e),r=e?.cookies?.prefix,i=e?.cookies?.overrides??{},a=we(!0,r,i,n),o=we(!1,r,i,n),s=ie(e?.secret,e?.session),c={oauth:p(e?.oauth),credentials:e?.credentials,cookies:o,jose:s,secret:e?.secret,basePath:e?.basePath??`/auth`,trustedProxyHeaders:t,trustedOrigins:y(`TRUSTED_ORIGINS`).length>0?y(`TRUSTED_ORIGINS`):e?.trustedOrigins,logger:n,cookieConfig:{secure:a,standard:o},baseURL:e?.baseURL,identity:{schema:e?.identity?.schema??N,unknownKeys:e?.identity?.unknownKeys??`strip`,skipValidation:e?.identity?.skipValidation??!1}};return c.sessionStrategy=Ne({cookies:()=>c.cookies,jose:c.jose,config:e?.session,logger:c.logger,identity:c.identity}),c},Fe=e=>n=>{if(de(n)){let{message:t,status:r,statusText:i}=n;return e?.log(`ROUTER_INTERNAL_ERROR`),Response.json({type:`ROUTER_ERROR`,code:`ROUTER_INTERNAL_ERROR`,message:t},{status:r,statusText:i})}if(ue(n))return e?.log(`INVALID_REQUEST`),Response.json({type:`ROUTER_ERROR`,code:`INVALID_REQUEST`,message:n.errors},{status:422});if(r(n)){let{error:t,message:r,type:i,errorURI:a}=n;return e?.log(`OAUTH_PROTOCOL_ERROR`,{structuredData:{error:t,error_description:r,error_uri:a??``}}),Response.json({type:i,message:r},{status:400})}if(t(n)){let{type:t,code:r,message:i}=n;return e?.log(`INVALID_OAUTH_CONFIGURATION`,{structuredData:{error:r,error_description:i}}),Response.json({type:t,message:i},{status:400})}if(a(n)){let{type:t,code:r,message:i}=n;return e?.log(`AUTH_SECURITY_ERROR`,{structuredData:{error:r,error_description:i}}),Response.json({type:t,code:r,message:i},{status:400})}if(u(n)){let{type:t,code:r,message:i}=n;return e?.log(`IDENTITY_VALIDATION_FAILED`,{structuredData:{error:r,error_description:i}}),Response.json({type:t,code:r,message:i},{status:422})}return e?.log(`SERVER_ERROR`,{structuredData:{error_type:n.name,error_message:n.message}}),Response.json({type:`SERVER_ERROR`,code:`SERVER_ERROR`,message:`An unexpected error occurred`},{status:500})},Ie=e=>I(`/signIn/:oauth`,{schemas:{params:L.object({oauth:L.enum(Object.keys(e),`The OAuth provider is not supported or invalid.`)}),searchParams:L.object({redirect:L.stringbool().optional().default(!0),redirectTo:L.string().optional()})}}),Le=e=>F(`GET`,`/signIn/:oauth`,async e=>{let{toResponse:t}=await W(e.params.oauth,{ctx:e.context,request:e.request,headers:e.request.headers,redirect:e.searchParams.redirect,redirectTo:e.searchParams.redirectTo});return t()},Ie(e)),Re=F(`POST`,`/signIn/credentials`,async e=>{let t=e.body,{toResponse:n}=await G({ctx:e.context,payload:t,request:e.request,headers:e.request.headers,redirectTo:e.searchParams.redirectTo});return n()},I({schemas:{body:L.object({username:L.string(),password:L.string()}),searchParams:L.object({redirectTo:L.string().optional()})}})),$=async(e,t={},n=5e3)=>{let r=new AbortController,i=setTimeout(()=>r.abort(),n);return await fetch(e,{...t,signal:r.signal}).finally(()=>clearTimeout(i))},ze=e=>{let t=j(16);return{sub:e?.id??e?.sub??t,email:e?.email,name:e?.name??e?.username??e?.nickname,image:e?.image??e?.picture}},Be=async(e,t,i)=>{let a=e.userInfo,o=typeof a==`string`?a:a.url,c=typeof a==`string`?void 0:a.headers,l=typeof a==`string`?`GET`:(a.method??`GET`).toUpperCase();try{i?.log(`OAUTH_USERINFO_REQUEST_INITIATED`,{structuredData:{endpoint:o}});let n=await $(o,{method:l,headers:{"User-Agent":`Aura Auth/${ne}`,Accept:`application/json`,Authorization:`Bearer ${t}`,...c}});if(!n.ok)throw i?.log(`OAUTH_USERINFO_INVALID_RESPONSE`),new s(`INVALID_REQUEST`,`Invalid userinfo response format`);let r=await n.json(),{success:a,data:u}=g.safeParse(r);if(a)throw i?.log(`OAUTH_USERINFO_ERROR`,{message:`Error response received from OAuth userinfo endpoint`,structuredData:{error:u.error,error_description:u.error_description??``}}),new s(`INVALID_REQUEST`,`An error was received from the OAuth userinfo endpoint.`);return i?.log(`OAUTH_USERINFO_SUCCESS`),e?.profile?e.profile(r):ze(r)}catch(e){throw r(e)?e:(i?.log(`OAUTH_USERINFO_REQUEST_FAILED`),n(e)?new s(`SERVER_ERROR`,`Failed to fetch user information from OAuth provider`,``,{cause:e}):new s(`SERVER_ERROR`,`Failed to fetch user information`,``,{cause:e}))}},Ve=async(e,t,n,r,i)=>{let{accessToken:a,clientId:c,clientSecret:l}=e;if(!c||!l||!t||!n||!r||!a)throw i?.log(`INVALID_OAUTH_CONFIGURATION`,{structuredData:{has_client_id:!!c,has_client_secret:!!l,has_access_token:!!a,has_redirect_uri:!!t,has_code:!!n,has_code_verifier:!!r}}),new o(`INVALID_OAUTH_CONFIGURATION`,`The OAuth provider configuration is invalid.`);let u=typeof a==`string`?a:a.url,d=typeof a==`string`?void 0:a.headers;try{i?.log(`OAUTH_ACCESS_TOKEN_REQUEST_INITIATED`,{structuredData:{has_client_id:!!c,redirect_uri:t,grant_type:`authorization_code`}});let e=await $(u,{method:`POST`,headers:{...d,Accept:`application/json`,"Content-Type":`application/x-www-form-urlencoded`},body:new URLSearchParams({client_id:c,client_secret:l,code:n,redirect_uri:t,grant_type:`authorization_code`,code_verifier:r}).toString()});if(!e.ok)throw i?.log(`INVALID_OAUTH_ACCESS_TOKEN_RESPONSE`),new s(`invalid_request`,`Invalid access token response`);let a=await e.json(),o=f.safeParse(a);if(!o.success){let{success:e,data:t}=h.safeParse(a);throw e?(i?.log(`OAUTH_ACCESS_TOKEN_ERROR`,{structuredData:{error:t.error,error_description:t.error_description??``}}),new s(`INVALID_ACCESS_TOKEN`,`Failed to retrieve access token`)):(i?.log(`INVALID_OAUTH_ACCESS_TOKEN_RESPONSE`),new s(`invalid_request`,`Invalid access token response format`))}return i?.log(`OAUTH_ACCESS_TOKEN_SUCCESS`),o.data}catch(e){throw i?.log(`OAUTH_ACCESS_TOKEN_REQUEST_FAILED`),e instanceof Error?new s(`server_error`,`Failed to communicate with OAuth provider`,``,{cause:e}):e}},He=e=>I(`/callback/:oauth`,{schemas:{params:L.object({oauth:L.enum(Object.keys(e),`The OAuth provider is not supported or invalid.`)}),searchParams:L.object({code:L.string(`Missing code parameter in the OAuth authorization response.`),state:L.string(`Missing state parameter in the OAuth authorization response.`)})},use:[e=>{let{searchParams:t,context:{logger:n}}=e,r=m.safeParse(t);if(r.success){let{error:e,error_description:t}=r.data,i=[`access_denied`,`server_error`].includes(e.toLowerCase())?`critical`:`warning`;throw n?.log(`OAUTH_AUTHORIZATION_ERROR`,{severity:i,structuredData:{error:e,error_description:t??``}}),new s(e,t||`OAuth Authorization Error`)}return e}]}),Ue=e=>F(`GET`,`/callback/:oauth`,async e=>{let{request:t,params:{oauth:n},searchParams:{code:r,state:a},context:o}=e,{oauth:s,cookies:c,jose:l,logger:u,trustedOrigins:d}=o,f=s[n],p=Z(t,c.state.name),m=Z(t,c.codeVerifier.name),h=Z(t,c.redirectTo.name),g=Z(t,c.redirectURI.name);if(!x(p,a))throw u?.log(`MISMATCHING_STATE`,{structuredData:{oauth_provider:n}}),new i(`MISMATCHING_STATE`,`The provided state passed in the OAuth response does not match the stored state.`);let _=await Ve(f,g,r,m,u),v=await B(t,d),y=await H(t,o);if(!O(h)&&!(v.length>0?k(h,v):T(h,y)))throw u?.log(`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`,{structuredData:{redirect_path:h,provider:n,has_trusted_origins:v.length>0,request_origin:y}}),new i(`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`,`Invalid redirect path. Potential open redirect attack detected.`);let b=await Be(f,_.access_token,u),S=await o.sessionStrategy.createSession(b),C=await M(l);u?.log(`OAUTH_CALLBACK_SUCCESS`,{structuredData:{provider:n}});let w=new P(R).setHeader(`Location`,h).setCookie(c.sessionToken.name,S,c.sessionToken.attributes).setCookie(c.csrfToken.name,C,c.csrfToken.attributes).setCookie(c.state.name,``,X).setCookie(c.redirectURI.name,``,X).setCookie(c.redirectTo.name,``,X).setCookie(c.codeVerifier.name,``,X).toHeaders();return Response.json({oauth:n},{status:302,headers:w})},He(e)),We=F(`GET`,`/session`,async e=>{let{toResponse:t}=await Te({ctx:e.context,headers:e.request.headers});return t()}),Ge=F(`POST`,`/signOut`,async e=>{let{toResponse:t}=await K({ctx:e.context,request:e.request,headers:e.request.headers,redirectTo:e.searchParams.redirectTo});return t()},I({schemas:{searchParams:L.object({token_type_hint:L.literal(`session_token`),redirectTo:L.string().optional()})}})),Ke=(e,t)=>{try{return Z(e,t)}catch{return}},qe=F(`GET`,`/csrfToken`,async e=>{let{request:t,context:{jose:n,cookies:r,logger:i}}=e,a=Ke(t,r.csrfToken.name);i?.log(`CSRF_TOKEN_REQUESTED`,{structuredData:{has_token:!!a}});let o=await M(n,a);i?.log(`CSRF_TOKEN_ISSUED`,{structuredData:{issued:!!o}});let s=new Headers(z);return s.append(`Set-Cookie`,Ce(r.csrfToken.name,o,r.csrfToken.attributes)),Response.json({csrfToken:o},{headers:s})}),Je=e=>I({schemas:{body:L.object({user:e.schema?.partial().optional(),expires:L.coerce.date().optional()})}}),Ye=e=>F(`PATCH`,`/session`,async e=>{let{toResponse:t}=await Ee({ctx:e.context,headers:e.request.headers,session:{user:e.body.user,expires:e.body.expires?.toISOString()}});return t()},Je(e)),Xe=e=>{let t=Pe(e);return{basePath:e?.basePath??`/auth`,onError:Fe(t.logger),context:t,use:[e=>{let n=te(e.request,e.context.trustedProxyHeaders);return e.context.cookies=n?t.cookieConfig.secure:t.cookieConfig.standard,e}]}},Ze=e=>{let t=Xe(e);return{handlers:le([Le(t.context.oauth),Re,Ue(t.context.oauth),We,Ge,qe,Ye(t.context.identity)],t),jose:t.context.jose,api:De(t.context)}},Qe=e=>{let t=Ze(e);return t.handlers.ALL=async e=>{let n=e.method.toUpperCase(),r={GET:t.handlers.GET,POST:t.handlers.POST,PATCH:t.handlers.PATCH};return n in r?await r[n](e):new Response(`Method Not Allowed`,{status:405,headers:{Allow:Object.keys(r).join(`, `)}})},t};export{Qe as createAuth};

package/dist/logger-C59_CDMk.js

@@ -0,0 +1 @@
+import{i as e,n as t}from"./env-nvh8QBNz.js";const n={ROUTER_INTERNAL_ERROR:{facility:10,severity:`error`,msgId:`ROUTER_INTERNAL_ERROR`,message:`Unhandled router error while processing the request`},INVALID_REQUEST:{facility:10,severity:`warning`,msgId:`INVALID_REQUEST`,message:`Request validation failed against the expected schema`},SERVER_ERROR:{facility:10,severity:`error`,msgId:`SERVER_ERROR`,message:`Unexpected internal server error during authentication`},OAUTH_PROTOCOL_ERROR:{facility:10,severity:`warning`,msgId:`OAUTH_PROTOCOL_ERROR`,message:`OAuth provider returned an invalid or unexpected protocol response`},OAUTH_AUTHORIZATION_ERROR:{facility:10,severity:`error`,msgId:`OAUTH_AUTHORIZATION_ERROR`,message:`OAuth authorization request was rejected or failed`},INVALID_OAUTH_CONFIGURATION:{facility:10,severity:`error`,msgId:`INVALID_OAUTH_CONFIGURATION`,message:`The OAuth provider configuration is invalid or incomplete`},OAUTH_ACCESS_TOKEN_REQUEST_INITIATED:{facility:10,severity:`debug`,msgId:`OAUTH_ACCESS_TOKEN_REQUEST_INITIATED`,message:`Starting OAuth access token request to the provider`},INVALID_OAUTH_ACCESS_TOKEN_RESPONSE:{facility:10,severity:`error`,msgId:`INVALID_OAUTH_ACCESS_TOKEN_RESPONSE`,message:`OAuth access token endpoint returned an invalid or malformed response`},OAUTH_ACCESS_TOKEN_ERROR:{facility:10,severity:`error`,msgId:`OAUTH_ACCESS_TOKEN_ERROR`,message:`OAuth access token endpoint returned an error response`},OAUTH_ACCESS_TOKEN_SUCCESS:{facility:10,severity:`info`,msgId:`OAUTH_ACCESS_TOKEN_SUCCESS`,message:`Successfully retrieved OAuth access token from the provider`},OAUTH_ACCESS_TOKEN_REQUEST_FAILED:{facility:10,severity:`error`,msgId:`OAUTH_ACCESS_TOKEN_REQUEST_FAILED`,message:`Network or server error while requesting OAuth access token`},OAUTH_USERINFO_REQUEST_INITIATED:{facility:10,severity:`debug`,msgId:`OAUTH_USERINFO_REQUEST_INITIATED`,message:`Starting OAuth userinfo request to the provider`},OAUTH_USERINFO_INVALID_RESPONSE:{facility:10,severity:`error`,msgId:`OAUTH_USERINFO_INVALID_RESPONSE`,message:`OAuth userinfo endpoint returned an invalid or malformed response`},OAUTH_USERINFO_ERROR:{facility:10,severity:`error`,msgId:`OAUTH_USERINFO_ERROR`,message:`OAuth userinfo endpoint returned an error response`},OAUTH_USERINFO_SUCCESS:{facility:10,severity:`info`,msgId:`OAUTH_USERINFO_SUCCESS`,message:`Successfully retrieved user information from the OAuth provider`},OAUTH_USERINFO_REQUEST_FAILED:{facility:10,severity:`error`,msgId:`OAUTH_USERINFO_REQUEST_FAILED`,message:`Network or server error while requesting user information from the OAuth provider`},OAUTH_CALLBACK_SUCCESS:{facility:4,severity:`info`,msgId:`OAUTH_CALLBACK_SUCCESS`,message:`OAuth callback completed successfully and session was created`},MISMATCHING_STATE:{facility:4,severity:`critical`,msgId:`MISMATCHING_STATE`,message:`OAuth response state parameter does not match the stored state value`},POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED:{facility:4,severity:`critical`,msgId:`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`,message:`Blocked redirect to untrusted or external URL (potential open redirect attack)`},OPEN_REDIRECT_ATTACK:{facility:4,severity:`warning`,msgId:`OPEN_REDIRECT_ATTACK`,message:`Detected redirect target that does not match the trusted origin`},SESSION_TOKEN_MISSING:{facility:4,severity:`warning`,msgId:`SESSION_TOKEN_MISSING`,message:`Session cookie is missing from the request`},CSRF_TOKEN_MISSING:{facility:4,severity:`warning`,msgId:`CSRF_TOKEN_MISSING`,message:`CSRF token cookie is missing from the request`},CSRF_HEADER_MISSING:{facility:4,severity:`warning`,msgId:`CSRF_HEADER_MISSING`,message:`CSRF header is missing from the request`},CSRF_TOKEN_INVALID:{facility:4,severity:`error`,msgId:`CSRF_TOKEN_INVALID`,message:`CSRF token verification failed or token is invalid`},SIGN_IN_INITIATED:{facility:4,severity:`info`,msgId:`SIGN_IN_INITIATED`,message:`Starting OAuth sign-in flow for the selected provider`},SIGN_OUT_ATTEMPT:{facility:4,severity:`debug`,msgId:`SIGN_OUT_ATTEMPT`,message:`Received sign-out request from client`},SIGN_OUT_CSRF_VERIFIED:{facility:4,severity:`info`,msgId:`SIGN_OUT_CSRF_VERIFIED`,message:`CSRF token was successfully verified during sign-out`},SIGN_OUT_SUCCESS:{facility:4,severity:`info`,msgId:`SIGN_OUT_SUCCESS`,message:`User session was cleared and sign-out completed successfully`},SIGN_OUT_REDIRECT:{facility:4,severity:`debug`,msgId:`SIGN_OUT_REDIRECT`,message:`Redirecting client after successful sign-out`},AUTH_SESSION_VALID:{facility:4,severity:`info`,msgId:`AUTH_SESSION_VALID`,message:`Session token is valid and user session was returned`},AUTH_SESSION_INVALID:{facility:4,severity:`notice`,msgId:`AUTH_SESSION_INVALID`,message:`Session token is missing, expired, or invalid`},INVALID_JWT_TOKEN:{facility:4,severity:`warning`,msgId:`INVALID_JWT_TOKEN`,message:`JWT session token failed validation during sign-out`},CSRF_TOKEN_REQUESTED:{facility:4,severity:`debug`,msgId:`CSRF_TOKEN_REQUESTED`,message:`Client requested a CSRF token`},CSRF_TOKEN_ISSUED:{facility:4,severity:`debug`,msgId:`CSRF_TOKEN_ISSUED`,message:`Issued a new CSRF token to the client`},INVALID_URL:{facility:10,severity:`error`,msgId:`INVALID_URL`,message:`Derived origin URL is invalid or malformed`},COOKIE_HTTPONLY_DISABLED:{facility:10,severity:`critical`,msgId:`COOKIE_HTTPONLY_DISABLED`,message:`Cookie is configured without HttpOnly. This allows JavaScript access via document.cookie and increases XSS exposure.`},COOKIE_WILDCARD_DOMAIN:{facility:10,severity:`critical`,msgId:`COOKIE_WILDCARD_DOMAIN`,message:`Cookie 'Domain' is set to a wildcard, which is insecure and should be avoided.`},COOKIE_SECURE_DISABLED:{facility:10,severity:`warning`,msgId:`COOKIE_SECURE_DISABLED`,message:`Cookie is configured with 'Secure' but the request is not HTTPS. The 'Secure' attribute will be ignored by the browser.`},COOKIE_SAMESITE_NONE_WITHOUT_SECURE:{facility:10,severity:`warning`,msgId:`COOKIE_SAMESITE_NONE_WITHOUT_SECURE`,message:`Cookie uses SameSite=None without Secure. Falling back to SameSite=Lax for safer defaults.`},COOKIE_INSECURE_IN_PRODUCTION:{facility:10,severity:`critical`,msgId:`COOKIE_INSECURE_IN_PRODUCTION`,message:`Cookies are being served over an insecure connection in production, which is a serious security risk.`},COOKIE_HOST_STRATEGY_INSECURE:{facility:10,severity:`critical`,msgId:`COOKIE_HOST_STRATEGY_INSECURE`,message:`__Host- cookies require a secure HTTPS context. Falling back to standard cookie settings.`},UNTRUSTED_ORIGIN:{facility:10,severity:`error`,msgId:`UNTRUSTED_ORIGIN`,message:`The constructed origin URL is not trusted.`},SESSION_REFRESHED:{facility:4,severity:`info`,msgId:`SESSION_REFRESHED`,message:`User session was refreshed with a new expiration time`},AUTH_SECURITY_ERROR:{facility:10,severity:`error`,msgId:`AUTH_SECURITY_ERROR`,message:`An authentication security error occurred`},CSRF_TOKEN_VERIFIED:{facility:4,severity:`info`,msgId:`CSRF_TOKEN_VERIFIED`,message:`CSRF token verification succeeded`},IDENTITY_VALIDATION_DISABLED:{facility:4,severity:`warning`,msgId:`IDENTITY_VALIDATION_DISABLED`,message:`Identity validation is disabled. User data will not be validated against a schema.`},IDENTITY_VALIDATION_FAILED:{facility:4,severity:`error`,msgId:`IDENTITY_VALIDATION_FAILED`,message:`User identity validation against the schema failed`},CREDENTIALS_SIGN_IN_SUCCESS:{facility:4,severity:`info`,msgId:`CREDENTIALS_SIGN_IN_SUCCESS`,message:`User successfully authenticated with credentials`},INVALID_CREDENTIALS:{facility:4,severity:`warning`,msgId:`INVALID_CREDENTIALS`,message:`Authentication failed due to invalid credentials`},CREDENTIALS_SIGN_IN_FAILED:{facility:4,severity:`error`,msgId:`CREDENTIALS_SIGN_IN_FAILED`,message:`An error occurred during credentials sign-in`}},r=(e,t)=>({...n[e],timestamp:new Date().toISOString(),hostname:`aura-auth`,...t}),i={debug:[`debug`,`info`,`notice`,`warning`,`error`,`critical`,`alert`,`emergency`],info:[`info`,`notice`,`warning`,`error`,`critical`,`alert`,`emergency`],warn:[`warning`,`error`,`critical`,`alert`,`emergency`],error:[`error`,`critical`,`alert`,`emergency`]},a=e=>e===`debug`||e===`info`||e===`warn`||e===`error`,o=e=>({emergency:0,alert:1,critical:2,error:3,warning:4,notice:5,info:6,debug:7})[e]??6,s=(e,t=`metadata`)=>{let n=Object.entries(e);return n.length===0?`[${t}]`:`[${t} ${n.map(([e,t])=>`${e}="${String(t).replace(/(["\\\]])/g,`\\$1`)}"`).join(` `)}]`},c=e=>{let{timestamp:t,hostname:n,appName:r=`aura-auth`,procId:i=`-`,msgId:a,structuredData:c,message:l}=e;return`<${(e.facility??16)*8+o(e.severity)}>1 ${t} ${n} ${r} ${i} ${a} ${s(c??{})} ${l}`},l=e=>{if(!e)return;let t=e.level,n=i[t]??[];return{level:t,log(t,i){let a=r(t,i);return n.includes(a.severity)&&e.log({timestamp:a.timestamp,appName:a.appName??`aura-auth`,hostname:a.hostname??`aura-auth`,...a}),a}}},u=n=>{let r=t(`LOG_LEVEL`),i=e(`DEBUG`);if(typeof n?.logger==`object`)return l({log:n.logger?.log||c,level:a(n.logger?.level)?n.logger?.level:a(r)?r:`error`});if(i||n?.logger===!0||r)return l({level:a(r)?r:`debug`,log:e=>{let t=c(e);console.log(t)}})};export{c as n,u as t};

package/dist/logger-UnUhYL2V.cjs

@@ -0,0 +1 @@
+const e=require(`./env-bq387KyP.cjs`),t={ROUTER_INTERNAL_ERROR:{facility:10,severity:`error`,msgId:`ROUTER_INTERNAL_ERROR`,message:`Unhandled router error while processing the request`},INVALID_REQUEST:{facility:10,severity:`warning`,msgId:`INVALID_REQUEST`,message:`Request validation failed against the expected schema`},SERVER_ERROR:{facility:10,severity:`error`,msgId:`SERVER_ERROR`,message:`Unexpected internal server error during authentication`},OAUTH_PROTOCOL_ERROR:{facility:10,severity:`warning`,msgId:`OAUTH_PROTOCOL_ERROR`,message:`OAuth provider returned an invalid or unexpected protocol response`},OAUTH_AUTHORIZATION_ERROR:{facility:10,severity:`error`,msgId:`OAUTH_AUTHORIZATION_ERROR`,message:`OAuth authorization request was rejected or failed`},INVALID_OAUTH_CONFIGURATION:{facility:10,severity:`error`,msgId:`INVALID_OAUTH_CONFIGURATION`,message:`The OAuth provider configuration is invalid or incomplete`},OAUTH_ACCESS_TOKEN_REQUEST_INITIATED:{facility:10,severity:`debug`,msgId:`OAUTH_ACCESS_TOKEN_REQUEST_INITIATED`,message:`Starting OAuth access token request to the provider`},INVALID_OAUTH_ACCESS_TOKEN_RESPONSE:{facility:10,severity:`error`,msgId:`INVALID_OAUTH_ACCESS_TOKEN_RESPONSE`,message:`OAuth access token endpoint returned an invalid or malformed response`},OAUTH_ACCESS_TOKEN_ERROR:{facility:10,severity:`error`,msgId:`OAUTH_ACCESS_TOKEN_ERROR`,message:`OAuth access token endpoint returned an error response`},OAUTH_ACCESS_TOKEN_SUCCESS:{facility:10,severity:`info`,msgId:`OAUTH_ACCESS_TOKEN_SUCCESS`,message:`Successfully retrieved OAuth access token from the provider`},OAUTH_ACCESS_TOKEN_REQUEST_FAILED:{facility:10,severity:`error`,msgId:`OAUTH_ACCESS_TOKEN_REQUEST_FAILED`,message:`Network or server error while requesting OAuth access token`},OAUTH_USERINFO_REQUEST_INITIATED:{facility:10,severity:`debug`,msgId:`OAUTH_USERINFO_REQUEST_INITIATED`,message:`Starting OAuth userinfo request to the provider`},OAUTH_USERINFO_INVALID_RESPONSE:{facility:10,severity:`error`,msgId:`OAUTH_USERINFO_INVALID_RESPONSE`,message:`OAuth userinfo endpoint returned an invalid or malformed response`},OAUTH_USERINFO_ERROR:{facility:10,severity:`error`,msgId:`OAUTH_USERINFO_ERROR`,message:`OAuth userinfo endpoint returned an error response`},OAUTH_USERINFO_SUCCESS:{facility:10,severity:`info`,msgId:`OAUTH_USERINFO_SUCCESS`,message:`Successfully retrieved user information from the OAuth provider`},OAUTH_USERINFO_REQUEST_FAILED:{facility:10,severity:`error`,msgId:`OAUTH_USERINFO_REQUEST_FAILED`,message:`Network or server error while requesting user information from the OAuth provider`},OAUTH_CALLBACK_SUCCESS:{facility:4,severity:`info`,msgId:`OAUTH_CALLBACK_SUCCESS`,message:`OAuth callback completed successfully and session was created`},MISMATCHING_STATE:{facility:4,severity:`critical`,msgId:`MISMATCHING_STATE`,message:`OAuth response state parameter does not match the stored state value`},POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED:{facility:4,severity:`critical`,msgId:`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`,message:`Blocked redirect to untrusted or external URL (potential open redirect attack)`},OPEN_REDIRECT_ATTACK:{facility:4,severity:`warning`,msgId:`OPEN_REDIRECT_ATTACK`,message:`Detected redirect target that does not match the trusted origin`},SESSION_TOKEN_MISSING:{facility:4,severity:`warning`,msgId:`SESSION_TOKEN_MISSING`,message:`Session cookie is missing from the request`},CSRF_TOKEN_MISSING:{facility:4,severity:`warning`,msgId:`CSRF_TOKEN_MISSING`,message:`CSRF token cookie is missing from the request`},CSRF_HEADER_MISSING:{facility:4,severity:`warning`,msgId:`CSRF_HEADER_MISSING`,message:`CSRF header is missing from the request`},CSRF_TOKEN_INVALID:{facility:4,severity:`error`,msgId:`CSRF_TOKEN_INVALID`,message:`CSRF token verification failed or token is invalid`},SIGN_IN_INITIATED:{facility:4,severity:`info`,msgId:`SIGN_IN_INITIATED`,message:`Starting OAuth sign-in flow for the selected provider`},SIGN_OUT_ATTEMPT:{facility:4,severity:`debug`,msgId:`SIGN_OUT_ATTEMPT`,message:`Received sign-out request from client`},SIGN_OUT_CSRF_VERIFIED:{facility:4,severity:`info`,msgId:`SIGN_OUT_CSRF_VERIFIED`,message:`CSRF token was successfully verified during sign-out`},SIGN_OUT_SUCCESS:{facility:4,severity:`info`,msgId:`SIGN_OUT_SUCCESS`,message:`User session was cleared and sign-out completed successfully`},SIGN_OUT_REDIRECT:{facility:4,severity:`debug`,msgId:`SIGN_OUT_REDIRECT`,message:`Redirecting client after successful sign-out`},AUTH_SESSION_VALID:{facility:4,severity:`info`,msgId:`AUTH_SESSION_VALID`,message:`Session token is valid and user session was returned`},AUTH_SESSION_INVALID:{facility:4,severity:`notice`,msgId:`AUTH_SESSION_INVALID`,message:`Session token is missing, expired, or invalid`},INVALID_JWT_TOKEN:{facility:4,severity:`warning`,msgId:`INVALID_JWT_TOKEN`,message:`JWT session token failed validation during sign-out`},CSRF_TOKEN_REQUESTED:{facility:4,severity:`debug`,msgId:`CSRF_TOKEN_REQUESTED`,message:`Client requested a CSRF token`},CSRF_TOKEN_ISSUED:{facility:4,severity:`debug`,msgId:`CSRF_TOKEN_ISSUED`,message:`Issued a new CSRF token to the client`},INVALID_URL:{facility:10,severity:`error`,msgId:`INVALID_URL`,message:`Derived origin URL is invalid or malformed`},COOKIE_HTTPONLY_DISABLED:{facility:10,severity:`critical`,msgId:`COOKIE_HTTPONLY_DISABLED`,message:`Cookie is configured without HttpOnly. This allows JavaScript access via document.cookie and increases XSS exposure.`},COOKIE_WILDCARD_DOMAIN:{facility:10,severity:`critical`,msgId:`COOKIE_WILDCARD_DOMAIN`,message:`Cookie 'Domain' is set to a wildcard, which is insecure and should be avoided.`},COOKIE_SECURE_DISABLED:{facility:10,severity:`warning`,msgId:`COOKIE_SECURE_DISABLED`,message:`Cookie is configured with 'Secure' but the request is not HTTPS. The 'Secure' attribute will be ignored by the browser.`},COOKIE_SAMESITE_NONE_WITHOUT_SECURE:{facility:10,severity:`warning`,msgId:`COOKIE_SAMESITE_NONE_WITHOUT_SECURE`,message:`Cookie uses SameSite=None without Secure. Falling back to SameSite=Lax for safer defaults.`},COOKIE_INSECURE_IN_PRODUCTION:{facility:10,severity:`critical`,msgId:`COOKIE_INSECURE_IN_PRODUCTION`,message:`Cookies are being served over an insecure connection in production, which is a serious security risk.`},COOKIE_HOST_STRATEGY_INSECURE:{facility:10,severity:`critical`,msgId:`COOKIE_HOST_STRATEGY_INSECURE`,message:`__Host- cookies require a secure HTTPS context. Falling back to standard cookie settings.`},UNTRUSTED_ORIGIN:{facility:10,severity:`error`,msgId:`UNTRUSTED_ORIGIN`,message:`The constructed origin URL is not trusted.`},SESSION_REFRESHED:{facility:4,severity:`info`,msgId:`SESSION_REFRESHED`,message:`User session was refreshed with a new expiration time`},AUTH_SECURITY_ERROR:{facility:10,severity:`error`,msgId:`AUTH_SECURITY_ERROR`,message:`An authentication security error occurred`},CSRF_TOKEN_VERIFIED:{facility:4,severity:`info`,msgId:`CSRF_TOKEN_VERIFIED`,message:`CSRF token verification succeeded`},IDENTITY_VALIDATION_DISABLED:{facility:4,severity:`warning`,msgId:`IDENTITY_VALIDATION_DISABLED`,message:`Identity validation is disabled. User data will not be validated against a schema.`},IDENTITY_VALIDATION_FAILED:{facility:4,severity:`error`,msgId:`IDENTITY_VALIDATION_FAILED`,message:`User identity validation against the schema failed`},CREDENTIALS_SIGN_IN_SUCCESS:{facility:4,severity:`info`,msgId:`CREDENTIALS_SIGN_IN_SUCCESS`,message:`User successfully authenticated with credentials`},INVALID_CREDENTIALS:{facility:4,severity:`warning`,msgId:`INVALID_CREDENTIALS`,message:`Authentication failed due to invalid credentials`},CREDENTIALS_SIGN_IN_FAILED:{facility:4,severity:`error`,msgId:`CREDENTIALS_SIGN_IN_FAILED`,message:`An error occurred during credentials sign-in`}},n=(e,n)=>({...t[e],timestamp:new Date().toISOString(),hostname:`aura-auth`,...n}),r={debug:[`debug`,`info`,`notice`,`warning`,`error`,`critical`,`alert`,`emergency`],info:[`info`,`notice`,`warning`,`error`,`critical`,`alert`,`emergency`],warn:[`warning`,`error`,`critical`,`alert`,`emergency`],error:[`error`,`critical`,`alert`,`emergency`]},i=e=>e===`debug`||e===`info`||e===`warn`||e===`error`,a=e=>({emergency:0,alert:1,critical:2,error:3,warning:4,notice:5,info:6,debug:7})[e]??6,o=(e,t=`metadata`)=>{let n=Object.entries(e);return n.length===0?`[${t}]`:`[${t} ${n.map(([e,t])=>`${e}="${String(t).replace(/(["\\\]])/g,`\\$1`)}"`).join(` `)}]`},s=e=>{let{timestamp:t,hostname:n,appName:r=`aura-auth`,procId:i=`-`,msgId:s,structuredData:c,message:l}=e;return`<${(e.facility??16)*8+a(e.severity)}>1 ${t} ${n} ${r} ${i} ${s} ${o(c??{})} ${l}`},c=e=>{if(!e)return;let t=e.level,i=r[t]??[];return{level:t,log(t,r){let a=n(t,r);return i.includes(a.severity)&&e.log({timestamp:a.timestamp,appName:a.appName??`aura-auth`,hostname:a.hostname??`aura-auth`,...a}),a}}},l=t=>{let n=e.n(`LOG_LEVEL`),r=e.i(`DEBUG`);if(typeof t?.logger==`object`)return c({log:t.logger?.log||s,level:i(t.logger?.level)?t.logger?.level:i(n)?n:`error`});if(r||t?.logger===!0||n)return c({level:i(n)?n:`debug`,log:e=>{let t=s(e);console.log(t)}})};Object.defineProperty(exports,`n`,{enumerable:!0,get:function(){return s}}),Object.defineProperty(exports,`t`,{enumerable:!0,get:function(){return l}});

package/dist/oauth/atlassian.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=e=>({id:`atlassian`,name:`Atlassian`,authorize:{url:`https://auth.atlassian.com/authorize`,params:{audience:`api.atlassian.com`,scope:`read:me read:account`,prompt:`consent`}},authorizeURL:`https://auth.atlassian.com/authorize`,accessToken:`https://auth.atlassian.com/oauth/token`,userInfo:`https://api.atlassian.com/me`,profile:e=>({sub:e.account_id,name:e.name,email:e.email,image:e.picture}),...e});exports.atlassian=e;

package/dist/oauth/atlassian.d.ts

@@ -0,0 +1,2 @@
+import { $t as atlassian, Qt as ExtendedProfile, Zt as AtlassianProfile } from "../index-nqLV2t91.js";
+export { AtlassianProfile, ExtendedProfile, atlassian };

package/dist/oauth/atlassian.js

@@ -0,0 +1 @@
+const e=e=>({id:`atlassian`,name:`Atlassian`,authorize:{url:`https://auth.atlassian.com/authorize`,params:{audience:`api.atlassian.com`,scope:`read:me read:account`,prompt:`consent`}},authorizeURL:`https://auth.atlassian.com/authorize`,accessToken:`https://auth.atlassian.com/oauth/token`,userInfo:`https://api.atlassian.com/me`,profile:e=>({sub:e.account_id,name:e.name,email:e.email,image:e.picture}),...e});export{e as atlassian};

package/dist/oauth/bitbucket.cjs

@@ -1,49 +1 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/oauth/bitbucket.ts
-var bitbucket_exports = {};
-__export(bitbucket_exports, {
-  bitbucket: () => bitbucket
-});
-module.exports = __toCommonJS(bitbucket_exports);
-var bitbucket = (options) => {
-  return {
-    id: "bitbucket",
-    name: "Bitbucket",
-    authorizeURL: "https://bitbucket.org/site/oauth2/authorize",
-    accessToken: "https://bitbucket.org/site/oauth2/access_token",
-    userInfo: "https://api.bitbucket.org/2.0/user",
-    scope: "account email",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.uuid ?? profile.account_id,
-        name: profile.display_name ?? profile.nickname,
-        image: profile.links.avatar?.href,
-        email: void 0
-      };
-    },
-    ...options
-  };
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  bitbucket
-});
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=e=>({id:`bitbucket`,name:`Bitbucket`,authorize:{url:`https://bitbucket.org/site/oauth2/authorize`,params:{scope:`account email`,responseType:`code`}},authorizeURL:`https://bitbucket.org/site/oauth2/authorize`,accessToken:`https://bitbucket.org/site/oauth2/access_token`,userInfo:`https://api.bitbucket.org/2.0/user`,profile:e=>({sub:e.uuid??e.account_id,name:e.display_name??e.nickname,image:e.links.avatar?.href,email:void 0}),...e});exports.bitbucket=e;

package/dist/oauth/bitbucket.d.ts

@@ -1,8 +1,2 @@
-export { H as BitbucketProfile, K as bitbucket } from '../index-CSyIJmCM.js';
-import '../@types/utility.js';
-import 'zod';
-import '../schemas.js';
-import '../jose.js';
-import '@aura-stack/jose';
-import '@aura-stack/jose/jose';
-import '@aura-stack/router/cookie';
+import { Fn as BitbucketProfile, In as bitbucket } from "../index-nqLV2t91.js";
+export { BitbucketProfile, bitbucket };

package/dist/oauth/bitbucket.js

@@ -1,6 +1 @@
-import {
-  bitbucket
-} from "../chunk-4YHJ4IEQ.js";
-export {
-  bitbucket
-};
+const e=e=>({id:`bitbucket`,name:`Bitbucket`,authorize:{url:`https://bitbucket.org/site/oauth2/authorize`,params:{scope:`account email`,responseType:`code`}},authorizeURL:`https://bitbucket.org/site/oauth2/authorize`,accessToken:`https://bitbucket.org/site/oauth2/access_token`,userInfo:`https://api.bitbucket.org/2.0/user`,profile:e=>({sub:e.uuid??e.account_id,name:e.display_name??e.nickname,image:e.links.avatar?.href,email:void 0}),...e});export{e as bitbucket};

package/dist/oauth/discord.cjs

@@ -1,57 +1 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/oauth/discord.ts
-var discord_exports = {};
-__export(discord_exports, {
-  discord: () => discord
-});
-module.exports = __toCommonJS(discord_exports);
-var discord = (options) => {
-  return {
-    id: "discord",
-    name: "Discord",
-    authorizeURL: "https://discord.com/oauth2/authorize",
-    accessToken: "https://discord.com/api/oauth2/token",
-    userInfo: "https://discord.com/api/users/@me",
-    scope: "identify email",
-    responseType: "code",
-    profile(profile) {
-      let image = "";
-      if (profile.avatar === null) {
-        const index = profile.discriminator === "0" ? (BigInt(profile.id) >> 22n) % 6n : Number(profile.discriminator) % 5;
-        image = `https://cdn.discordapp.com/embed/avatars/${index}.png`;
-      } else {
-        const format = profile.avatar.startsWith("a_") ? "gif" : "png";
-        image = `https://cdn.discordapp.com/avatars/${profile.id}/${profile.avatar}.${format}`;
-      }
-      return {
-        sub: profile.id,
-        name: profile.global_name ?? profile.username,
-        email: profile.email ?? "",
-        image
-      };
-    },
-    ...options
-  };
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  discord
-});
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=e=>({id:`discord`,name:`Discord`,authorize:{url:`https://discord.com/oauth2/authorize`,params:{scope:`identify email`,responseType:`code`}},authorizeURL:`https://discord.com/oauth2/authorize`,accessToken:`https://discord.com/api/oauth2/token`,userInfo:`https://discord.com/api/users/@me`,profile(e){let t=``;if(e.avatar===null)t=`https://cdn.discordapp.com/embed/avatars/${e.discriminator===`0`?(BigInt(e.id)>>22n)%6n:Number(e.discriminator)%5}.png`;else{let n=e.avatar.startsWith(`a_`)?`gif`:`png`;t=`https://cdn.discordapp.com/avatars/${e.id}/${e.avatar}.${n}`}return{sub:e.id,name:e.global_name??e.username,email:e.email??``,image:t}},...e});exports.discord=e;

package/dist/oauth/discord.d.ts

@@ -1,8 +1,2 @@
-export { D as DiscordProfile, N as Nameplate, z as discord } from '../index-CSyIJmCM.js';
-import 'zod';
-import '../schemas.js';
-import '../jose.js';
-import '@aura-stack/jose';
-import '@aura-stack/jose/jose';
-import '@aura-stack/router/cookie';
-import '../@types/utility.js';
+import { An as DiscordProfile, Mn as discord, jn as Nameplate } from "../index-nqLV2t91.js";
+export { DiscordProfile, Nameplate, discord };

package/dist/oauth/discord.js

@@ -1,6 +1 @@
-import {
-  discord
-} from "../chunk-OVHNRULD.js";
-export {
-  discord
-};
+const e=e=>({id:`discord`,name:`Discord`,authorize:{url:`https://discord.com/oauth2/authorize`,params:{scope:`identify email`,responseType:`code`}},authorizeURL:`https://discord.com/oauth2/authorize`,accessToken:`https://discord.com/api/oauth2/token`,userInfo:`https://discord.com/api/users/@me`,profile(e){let t=``;if(e.avatar===null)t=`https://cdn.discordapp.com/embed/avatars/${e.discriminator===`0`?(BigInt(e.id)>>22n)%6n:Number(e.discriminator)%5}.png`;else{let n=e.avatar.startsWith(`a_`)?`gif`:`png`;t=`https://cdn.discordapp.com/avatars/${e.id}/${e.avatar}.${n}`}return{sub:e.id,name:e.global_name??e.username,email:e.email??``,image:t}},...e});export{e as discord};

package/dist/oauth/dropbox.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=e=>({id:`dropbox`,name:`Dropbox`,authorize:{url:`https://www.dropbox.com/oauth2/authorize`,params:{scope:`account_info.read`}},accessToken:`https://api.dropboxapi.com/oauth2/token`,userInfo:{method:`POST`,url:`https://api.dropboxapi.com/2/users/get_current_account`},profile:e=>({sub:e.account_id,name:e.name.display_name,email:e.email,image:e.profile_photo_url}),...e});exports.dropbox=e;

package/dist/oauth/dropbox.d.ts

@@ -0,0 +1,2 @@
+import { an as dropbox, en as AccountType, in as RootInfo, nn as FullTeam, rn as Name, tn as DropboxProfile } from "../index-nqLV2t91.js";
+export { AccountType, DropboxProfile, FullTeam, Name, RootInfo, dropbox };

package/dist/oauth/dropbox.js

@@ -0,0 +1 @@
+const e=e=>({id:`dropbox`,name:`Dropbox`,authorize:{url:`https://www.dropbox.com/oauth2/authorize`,params:{scope:`account_info.read`}},accessToken:`https://api.dropboxapi.com/oauth2/token`,userInfo:{method:`POST`,url:`https://api.dropboxapi.com/2/users/get_current_account`},profile:e=>({sub:e.account_id,name:e.name.display_name,email:e.email,image:e.profile_photo_url}),...e});export{e as dropbox};

package/dist/oauth/figma.cjs

@@ -1,49 +1 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/oauth/figma.ts
-var figma_exports = {};
-__export(figma_exports, {
-  figma: () => figma
-});
-module.exports = __toCommonJS(figma_exports);
-var figma = (options) => {
-  return {
-    id: "figma",
-    name: "Figma",
-    authorizeURL: "https://www.figma.com/oauth",
-    accessToken: "https://api.figma.com/v1/oauth/token",
-    userInfo: "https://api.figma.com/v1/me",
-    scope: "current_user:read",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.id,
-        name: profile.handle,
-        email: profile.email,
-        image: profile.img_url
-      };
-    },
-    ...options
-  };
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  figma
-});
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=e=>({id:`figma`,name:`Figma`,authorize:{url:`https://www.figma.com/oauth`,params:{scope:`current_user:read`,responseType:`code`}},accessToken:`https://api.figma.com/v1/oauth/token`,userInfo:`https://api.figma.com/v1/me`,profile:e=>({sub:e.id,name:e.handle,email:e.email,image:e.img_url}),...e});exports.figma=e;

package/dist/oauth/figma.d.ts

@@ -1,8 +1,2 @@
-export { F as FigmaProfile, B as figma } from '../index-CSyIJmCM.js';
-import 'zod';
-import '../schemas.js';
-import '../jose.js';
-import '@aura-stack/jose';
-import '@aura-stack/jose/jose';
-import '@aura-stack/router/cookie';
-import '../@types/utility.js';
+import { Nn as FigmaProfile, Pn as figma } from "../index-nqLV2t91.js";
+export { FigmaProfile, figma };

package/dist/oauth/figma.js

@@ -1,6 +1 @@
-import {
-  figma
-} from "../chunk-KMMAZFSJ.js";
-export {
-  figma
-};
+const e=e=>({id:`figma`,name:`Figma`,authorize:{url:`https://www.figma.com/oauth`,params:{scope:`current_user:read`,responseType:`code`}},accessToken:`https://api.figma.com/v1/oauth/token`,userInfo:`https://api.figma.com/v1/me`,profile:e=>({sub:e.id,name:e.handle,email:e.email,image:e.img_url}),...e});export{e as figma};

package/dist/oauth/github.cjs

@@ -1,49 +1 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/oauth/github.ts
-var github_exports = {};
-__export(github_exports, {
-  github: () => github
-});
-module.exports = __toCommonJS(github_exports);
-var github = (options) => {
-  return {
-    id: "github",
-    name: "GitHub",
-    authorizeURL: "https://github.com/login/oauth/authorize",
-    accessToken: "https://github.com/login/oauth/access_token",
-    userInfo: "https://api.github.com/user",
-    scope: "read:user user:email",
-    responseType: "code",
-    profile: (profile) => {
-      return {
-        sub: profile.id.toString(),
-        name: profile.name ?? profile.login,
-        email: profile.email ?? void 0,
-        image: profile.avatar_url
-      };
-    },
-    ...options
-  };
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  github
-});
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=e=>({id:`github`,name:`GitHub`,authorize:{url:`https://github.com/login/oauth/authorize`,params:{scope:`read:user user:email`,responseType:`code`}},accessToken:`https://github.com/login/oauth/access_token`,userInfo:`https://api.github.com/user`,profile:e=>({sub:e.id.toString(),name:e.name??e.login,email:e.email??void 0,image:e.avatar_url}),...e});exports.github=e;

package/dist/oauth/github.d.ts

@@ -1,8 +1,2 @@
-export { Q as GitHubProfile, V as github } from '../index-CSyIJmCM.js';
-import 'zod';
-import '../schemas.js';
-import '../jose.js';
-import '@aura-stack/jose';
-import '@aura-stack/jose/jose';
-import '@aura-stack/router/cookie';
-import '../@types/utility.js';
+import { Ln as GitHubProfile, Rn as github } from "../index-nqLV2t91.js";
+export { GitHubProfile, github };

package/dist/oauth/github.js

@@ -1,6 +1 @@
-import {
-  github
-} from "../chunk-FW4W3REU.js";
-export {
-  github
-};
+const e=e=>({id:`github`,name:`GitHub`,authorize:{url:`https://github.com/login/oauth/authorize`,params:{scope:`read:user user:email`,responseType:`code`}},accessToken:`https://github.com/login/oauth/access_token`,userInfo:`https://api.github.com/user`,profile:e=>({sub:e.id.toString(),name:e.name??e.login,email:e.email??void 0,image:e.avatar_url}),...e});export{e as github};