@aura-stack/auth 0.5.0 → 0.6.0

package/dist/context.cjs

@@ -1,1237 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/context.ts
-var context_exports = {};
-__export(context_exports, {
-  createContext: () => createContext
-});
-module.exports = __toCommonJS(context_exports);
-
-// src/env.ts
-var import_meta = {};
-var env = new Proxy({}, {
-  get(_, prop) {
-    if (typeof prop !== "string") return void 0;
-    const hasProperty = (process2) => {
-      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
-    };
-    try {
-      if (typeof process !== "undefined" && hasProperty(process.env)) {
-        return process.env[prop];
-      }
-      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
-        return import_meta.env[prop];
-      }
-      if (typeof Deno !== "undefined" && Deno.env?.get) {
-        return Deno.env.get(prop);
-      }
-      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
-        return Bun.env[prop];
-      }
-      const globalValue = globalThis[prop];
-      return typeof globalValue === "string" ? globalValue : void 0;
-    } catch {
-      return void 0;
-    }
-  }
-});
-var getEnv = (key) => {
-  const keys = [`AURA_AUTH_${key.toUpperCase()}`, `AURA_${key.toUpperCase()}`, `AUTH_${key.toUpperCase()}`, key.toUpperCase()];
-  return env[keys.find((k) => env[k]) ?? ""];
-};
-var getEnvBoolean = (key) => {
-  const value = getEnv(key);
-  if (value === void 0) return false;
-  const normalized = value.trim().toLowerCase();
-  if (["1", "true", "yes", "on", "debug"].includes(normalized)) return true;
-  return false;
-};
-var getEnvArray = (key, defaultValue = []) => {
-  const value = getEnv(key);
-  if (!value) return defaultValue;
-  return value.split(/[,;\n]+/).map((v) => v.trim()).filter(Boolean);
-};
-
-// src/jose.ts
-var import_jose = require("@aura-stack/jose");
-
-// src/errors.ts
-var AuthInternalError = class extends Error {
-  type = "AUTH_INTERNAL_ERROR";
-  code;
-  constructor(code, message, options2) {
-    super(message, options2);
-    this.code = code;
-    this.name = new.target.name;
-    Error.captureStackTrace(this, new.target);
-  }
-};
-
-// src/jose.ts
-var import_jose2 = require("@aura-stack/jose/jose");
-var import_crypto = require("@aura-stack/jose/crypto");
-var createJoseInstance = (secret) => {
-  secret ??= getEnv("SECRET");
-  if (!secret) {
-    throw new AuthInternalError(
-      "JOSE_INITIALIZATION_FAILED",
-      "AURA_AUTH_SECRET environment variable is not set and no secret was provided."
-    );
-  }
-  const salt = getEnv("SALT");
-  if (!salt) {
-    throw new AuthInternalError(
-      "JOSE_INITIALIZATION_FAILED",
-      "AURA_AUTH_SALT or AUTH_SALT environment variable is not set. A salt value is required for key derivation."
-    );
-  }
-  try {
-    (0, import_jose.createSecret)(salt);
-  } catch (error) {
-    throw new AuthInternalError(
-      "INVALID_SALT_SECRET_VALUE",
-      "AURA_AUTH_SALT/AUTH_SALT is invalid. It must be at least 32 bytes long and meet entropy requirements.",
-      { cause: error }
-    );
-  }
-  const jose = (async () => {
-    const derivedSigningKey = await (0, import_jose.createDeriveKey)(secret, salt, "signing");
-    const derivedEncryptionKey = await (0, import_jose.createDeriveKey)(secret, salt, "encryption");
-    const derivedCsrfTokenKey = await (0, import_jose.createDeriveKey)(secret, salt, "csrfToken");
-    return {
-      jwt: (0, import_jose.createJWT)({ jws: derivedSigningKey, jwe: derivedEncryptionKey }),
-      jws: (0, import_jose.createJWS)(derivedCsrfTokenKey),
-      jwe: (0, import_jose.createJWE)(derivedEncryptionKey)
-    };
-  })();
-  jose.catch(() => {
-  });
-  return {
-    decodeJWT: async (token, options2) => {
-      const { jwt } = await jose;
-      return jwt.decodeJWT(token, options2);
-    },
-    encodeJWT: async (payload) => {
-      const { jwt } = await jose;
-      return jwt.encodeJWT(payload);
-    },
-    signJWS: async (...args) => {
-      const { jws } = await jose;
-      return jws.signJWS(...args);
-    },
-    verifyJWS: async (...args) => {
-      const { jws } = await jose;
-      return jws.verifyJWS(...args);
-    },
-    encryptJWE: async (...args) => {
-      const { jwe } = await jose;
-      return jwe.encryptJWE(...args);
-    },
-    decryptJWE: async (...args) => {
-      const { jwe } = await jose;
-      return jwe.decryptJWE(...args);
-    }
-  };
-};
-
-// src/utils.ts
-var import_router = require("@aura-stack/router");
-
-// src/assert.ts
-var import_crypto2 = require("@aura-stack/jose/crypto");
-
-// src/utils.ts
-var formatZodError = (error) => {
-  if (!error.issues || error.issues.length === 0) {
-    return {};
-  }
-  return error.issues.reduce((previous, issue) => {
-    const key = issue.path.join(".");
-    return {
-      ...previous,
-      [key]: {
-        code: issue.code,
-        message: issue.message
-      }
-    };
-  }, {});
-};
-var createStructuredData = (data, sdID = "metadata") => {
-  const entries = Object.entries(data);
-  if (entries.length === 0) return `[${sdID}]`;
-  const values = entries.map(([key, value]) => `${key}="${String(value).replace(/(["\\\]])/g, "\\$1")}"`).join(" ");
-  return `[${sdID} ${values}]`;
-};
-var createBasicAuthHeader = (username, password) => {
-  const getUsername = getEnv(username.toUpperCase()) ?? username;
-  const getPassword = getEnv(password.toUpperCase()) ?? password;
-  if (!getUsername || !getPassword) {
-    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "Missing client credentials for OAuth provider configuration.");
-  }
-  const credentials = `${getUsername}:${getPassword}`;
-  return `Basic ${btoa(credentials)}`;
-};
-
-// src/logger.ts
-var logMessages = {
-  ROUTER_INTERNAL_ERROR: {
-    facility: 10,
-    severity: "error",
-    msgId: "ROUTER_INTERNAL_ERROR",
-    message: "Unhandled router error while processing the request"
-  },
-  INVALID_REQUEST: {
-    facility: 10,
-    severity: "warning",
-    msgId: "INVALID_REQUEST",
-    message: "Request validation failed against the expected schema"
-  },
-  SERVER_ERROR: {
-    facility: 10,
-    severity: "error",
-    msgId: "SERVER_ERROR",
-    message: "Unexpected internal server error during authentication"
-  },
-  OAUTH_PROTOCOL_ERROR: {
-    facility: 10,
-    severity: "warning",
-    msgId: "OAUTH_PROTOCOL_ERROR",
-    message: "OAuth provider returned an invalid or unexpected protocol response"
-  },
-  OAUTH_AUTHORIZATION_ERROR: {
-    facility: 10,
-    severity: "error",
-    msgId: "OAUTH_AUTHORIZATION_ERROR",
-    message: "OAuth authorization request was rejected or failed"
-  },
-  INVALID_OAUTH_CONFIGURATION: {
-    facility: 10,
-    severity: "error",
-    msgId: "INVALID_OAUTH_CONFIGURATION",
-    message: "The OAuth provider configuration is invalid or incomplete"
-  },
-  OAUTH_ACCESS_TOKEN_REQUEST_INITIATED: {
-    facility: 10,
-    severity: "debug",
-    msgId: "OAUTH_ACCESS_TOKEN_REQUEST_INITIATED",
-    message: "Starting OAuth access token request to the provider"
-  },
-  INVALID_OAUTH_ACCESS_TOKEN_RESPONSE: {
-    facility: 10,
-    severity: "error",
-    msgId: "INVALID_OAUTH_ACCESS_TOKEN_RESPONSE",
-    message: "OAuth access token endpoint returned an invalid or malformed response"
-  },
-  OAUTH_ACCESS_TOKEN_ERROR: {
-    facility: 10,
-    severity: "error",
-    msgId: "OAUTH_ACCESS_TOKEN_ERROR",
-    message: "OAuth access token endpoint returned an error response"
-  },
-  OAUTH_ACCESS_TOKEN_SUCCESS: {
-    facility: 10,
-    severity: "info",
-    msgId: "OAUTH_ACCESS_TOKEN_SUCCESS",
-    message: "Successfully retrieved OAuth access token from the provider"
-  },
-  OAUTH_ACCESS_TOKEN_REQUEST_FAILED: {
-    facility: 10,
-    severity: "error",
-    msgId: "OAUTH_ACCESS_TOKEN_REQUEST_FAILED",
-    message: "Network or server error while requesting OAuth access token"
-  },
-  OAUTH_USERINFO_REQUEST_INITIATED: {
-    facility: 10,
-    severity: "debug",
-    msgId: "OAUTH_USERINFO_REQUEST_INITIATED",
-    message: "Starting OAuth userinfo request to the provider"
-  },
-  OAUTH_USERINFO_INVALID_RESPONSE: {
-    facility: 10,
-    severity: "error",
-    msgId: "OAUTH_USERINFO_INVALID_RESPONSE",
-    message: "OAuth userinfo endpoint returned an invalid or malformed response"
-  },
-  OAUTH_USERINFO_ERROR: {
-    facility: 10,
-    severity: "error",
-    msgId: "OAUTH_USERINFO_ERROR",
-    message: "OAuth userinfo endpoint returned an error response"
-  },
-  OAUTH_USERINFO_SUCCESS: {
-    facility: 10,
-    severity: "info",
-    msgId: "OAUTH_USERINFO_SUCCESS",
-    message: "Successfully retrieved user information from the OAuth provider"
-  },
-  OAUTH_USERINFO_REQUEST_FAILED: {
-    facility: 10,
-    severity: "error",
-    msgId: "OAUTH_USERINFO_REQUEST_FAILED",
-    message: "Network or server error while requesting user information from the OAuth provider"
-  },
-  OAUTH_CALLBACK_SUCCESS: {
-    facility: 4,
-    severity: "info",
-    msgId: "OAUTH_CALLBACK_SUCCESS",
-    message: "OAuth callback completed successfully and session was created"
-  },
-  MISMATCHING_STATE: {
-    facility: 4,
-    severity: "critical",
-    msgId: "MISMATCHING_STATE",
-    message: "OAuth response state parameter does not match the stored state value"
-  },
-  POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED: {
-    facility: 4,
-    severity: "critical",
-    msgId: "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED",
-    message: "Blocked redirect to untrusted or external URL (potential open redirect attack)"
-  },
-  OPEN_REDIRECT_ATTACK: {
-    facility: 4,
-    severity: "warning",
-    msgId: "OPEN_REDIRECT_ATTACK",
-    message: "Detected redirect target that does not match the trusted origin"
-  },
-  SESSION_TOKEN_MISSING: {
-    facility: 4,
-    severity: "warning",
-    msgId: "SESSION_TOKEN_MISSING",
-    message: "Session cookie is missing from the request"
-  },
-  CSRF_TOKEN_MISSING: {
-    facility: 4,
-    severity: "warning",
-    msgId: "CSRF_TOKEN_MISSING",
-    message: "CSRF token cookie is missing from the request"
-  },
-  CSRF_HEADER_MISSING: {
-    facility: 4,
-    severity: "warning",
-    msgId: "CSRF_HEADER_MISSING",
-    message: "CSRF header is missing from the request"
-  },
-  CSRF_TOKEN_INVALID: {
-    facility: 4,
-    severity: "error",
-    msgId: "CSRF_TOKEN_INVALID",
-    message: "CSRF token verification failed or token is invalid"
-  },
-  SIGN_IN_INITIATED: {
-    facility: 4,
-    severity: "info",
-    msgId: "SIGN_IN_INITIATED",
-    message: "Starting OAuth sign-in flow for the selected provider"
-  },
-  SIGN_OUT_ATTEMPT: {
-    facility: 4,
-    severity: "debug",
-    msgId: "SIGN_OUT_ATTEMPT",
-    message: "Received sign-out request from client"
-  },
-  SIGN_OUT_CSRF_VERIFIED: {
-    facility: 4,
-    severity: "info",
-    msgId: "SIGN_OUT_CSRF_VERIFIED",
-    message: "CSRF token was successfully verified during sign-out"
-  },
-  SIGN_OUT_SUCCESS: {
-    facility: 4,
-    severity: "info",
-    msgId: "SIGN_OUT_SUCCESS",
-    message: "User session was cleared and sign-out completed successfully"
-  },
-  SIGN_OUT_REDIRECT: {
-    facility: 4,
-    severity: "debug",
-    msgId: "SIGN_OUT_REDIRECT",
-    message: "Redirecting client after successful sign-out"
-  },
-  AUTH_SESSION_VALID: {
-    facility: 4,
-    severity: "info",
-    msgId: "AUTH_SESSION_VALID",
-    message: "Session token is valid and user session was returned"
-  },
-  AUTH_SESSION_INVALID: {
-    facility: 4,
-    severity: "notice",
-    msgId: "AUTH_SESSION_INVALID",
-    message: "Session token is missing, expired, or invalid"
-  },
-  INVALID_JWT_TOKEN: {
-    facility: 4,
-    severity: "warning",
-    msgId: "INVALID_JWT_TOKEN",
-    message: "JWT session token failed validation during sign-out"
-  },
-  CSRF_TOKEN_REQUESTED: {
-    facility: 4,
-    severity: "debug",
-    msgId: "CSRF_TOKEN_REQUESTED",
-    message: "Client requested a CSRF token"
-  },
-  CSRF_TOKEN_ISSUED: {
-    facility: 4,
-    severity: "debug",
-    msgId: "CSRF_TOKEN_ISSUED",
-    message: "Issued a new CSRF token to the client"
-  },
-  INVALID_URL: {
-    facility: 10,
-    severity: "error",
-    msgId: "INVALID_URL",
-    message: "Derived origin URL is invalid or malformed"
-  },
-  COOKIE_HTTPONLY_DISABLED: {
-    facility: 10,
-    severity: "critical",
-    msgId: "COOKIE_HTTPONLY_DISABLED",
-    message: "Cookie is configured without HttpOnly. This allows JavaScript access via document.cookie and increases XSS exposure."
-  },
-  COOKIE_WILDCARD_DOMAIN: {
-    facility: 10,
-    severity: "critical",
-    msgId: "COOKIE_WILDCARD_DOMAIN",
-    message: "Cookie 'Domain' is set to a wildcard, which is insecure and should be avoided."
-  },
-  COOKIE_SECURE_DISABLED: {
-    facility: 10,
-    severity: "warning",
-    msgId: "COOKIE_SECURE_DISABLED",
-    message: "Cookie is configured with 'Secure' but the request is not HTTPS. The 'Secure' attribute will be ignored by the browser."
-  },
-  COOKIE_SAMESITE_NONE_WITHOUT_SECURE: {
-    facility: 10,
-    severity: "warning",
-    msgId: "COOKIE_SAMESITE_NONE_WITHOUT_SECURE",
-    message: "Cookie uses SameSite=None without Secure. Falling back to SameSite=Lax for safer defaults."
-  },
-  COOKIE_INSECURE_IN_PRODUCTION: {
-    facility: 10,
-    severity: "critical",
-    msgId: "COOKIE_INSECURE_IN_PRODUCTION",
-    message: "Cookies are being served over an insecure connection in production, which is a serious security risk."
-  },
-  COOKIE_HOST_STRATEGY_INSECURE: {
-    facility: 10,
-    severity: "critical",
-    msgId: "COOKIE_HOST_STRATEGY_INSECURE",
-    message: "__Host- cookies require a secure HTTPS context. Falling back to standard cookie settings."
-  },
-  UNTRUSTED_ORIGIN: {
-    facility: 10,
-    severity: "error",
-    msgId: "UNTRUSTED_ORIGIN",
-    message: "The constructed origin URL is not trusted."
-  }
-};
-var createLogEntry = (key, overrides) => {
-  const message = logMessages[key];
-  return {
-    ...message,
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    hostname: "aura-auth",
-    procId: typeof process !== "undefined" && process.pid ? process.pid.toString() : "-",
-    ...overrides
-  };
-};
-var logLevelToSeverity = {
-  debug: ["debug", "info", "notice", "warning", "error", "critical", "alert", "emergency"],
-  info: ["info", "notice", "warning", "error", "critical", "alert", "emergency"],
-  warn: ["warning", "error", "critical", "alert", "emergency"],
-  error: ["error", "critical", "alert", "emergency"]
-};
-var isValidLogLevel = (value) => {
-  return value === "debug" || value === "info" || value === "warn" || value === "error";
-};
-var getSeverityLevel = (severity) => {
-  const severities = {
-    emergency: 0,
-    alert: 1,
-    critical: 2,
-    error: 3,
-    warning: 4,
-    notice: 5,
-    info: 6,
-    debug: 7
-  };
-  return severities[severity] ?? 6;
-};
-var createSyslogMessage = (options2) => {
-  const { timestamp, hostname, appName = "aura-auth", procId = "-", msgId, structuredData, message } = options2;
-  const pri = (options2.facility ?? 16) * 8 + getSeverityLevel(options2.severity);
-  const structuredDataStr = createStructuredData(structuredData ?? {});
-  return `<${pri}>1 ${timestamp} ${hostname} ${appName} ${procId} ${msgId} ${structuredDataStr} ${message}`;
-};
-var createLogger = (logger) => {
-  if (!logger) return void 0;
-  const level = logger.level;
-  const allowedSeverities = logLevelToSeverity[level] ?? [];
-  return {
-    level,
-    log(key, overrides) {
-      const entry = createLogEntry(key, overrides);
-      if (!allowedSeverities.includes(entry.severity)) return entry;
-      logger.log({
-        timestamp: entry.timestamp,
-        appName: entry.appName ?? "aura-auth",
-        hostname: entry.hostname ?? "aura-auth",
-        ...entry
-      });
-      return entry;
-    }
-  };
-};
-var createProxyLogger = (config) => {
-  const level = getEnv("LOG_LEVEL");
-  const debug = getEnvBoolean("DEBUG");
-  if (typeof config?.logger === "object") {
-    return createLogger({
-      log: config.logger?.log || createSyslogMessage,
-      level: isValidLogLevel(config.logger?.level) ? config.logger?.level : isValidLogLevel(level) ? level : "error"
-    });
-  }
-  if (debug || config?.logger === true || level) {
-    return createLogger({
-      level: isValidLogLevel(level) ? level : "debug",
-      log: (options2) => {
-        const message = createSyslogMessage(options2);
-        console.log(message);
-      }
-    });
-  }
-  return void 0;
-};
-
-// src/cookie.ts
-var import_cookie = require("@aura-stack/router/cookie");
-var COOKIE_NAME = "aura-auth";
-var defaultCookieOptions = {
-  httpOnly: true,
-  sameSite: "lax",
-  path: "/",
-  maxAge: 60 * 60 * 24 * 15
-};
-var defaultStandardCookieConfig = {
-  secure: false,
-  httpOnly: true
-};
-var defaultSecureCookieConfig = {
-  secure: true,
-  httpOnly: true
-};
-var defaultHostCookieConfig = {
-  secure: true,
-  httpOnly: true,
-  path: "/",
-  domain: void 0
-};
-var oauthCookieOptions = {
-  httpOnly: true,
-  maxAge: 5 * 60,
-  sameSite: "lax",
-  expires: new Date(Date.now() + 5 * 60 * 1e3)
-};
-var expiredCookieAttributes = {
-  ...defaultCookieOptions,
-  expires: /* @__PURE__ */ new Date(0),
-  maxAge: 0,
-  secure: true
-};
-var defineSecureCookieOptions = (useSecure, attributes, strategy, logger) => {
-  if (!attributes.httpOnly) {
-    logger?.log("COOKIE_HTTPONLY_DISABLED");
-  }
-  if (attributes.domain === "*") {
-    attributes.domain = void 0;
-    logger?.log("COOKIE_WILDCARD_DOMAIN");
-  }
-  if (!useSecure) {
-    if (attributes.secure) {
-      logger?.log("COOKIE_SECURE_DISABLED");
-    }
-    if (attributes.sameSite == "none") {
-      attributes.sameSite = "lax";
-      logger?.log("COOKIE_SAMESITE_NONE_WITHOUT_SECURE");
-    }
-    if (env.NODE_ENV === "production") {
-      logger?.log("COOKIE_INSECURE_IN_PRODUCTION");
-    }
-    if (strategy === "host") {
-      logger?.log("COOKIE_HOST_STRATEGY_INSECURE");
-    }
-    return {
-      ...defaultCookieOptions,
-      ...attributes,
-      ...defaultStandardCookieConfig
-    };
-  }
-  return strategy === "host" ? {
-    ...defaultCookieOptions,
-    ...attributes,
-    ...defaultHostCookieConfig
-  } : { ...defaultCookieOptions, ...attributes, ...defaultSecureCookieConfig };
-};
-var createCookieStore = (useSecure, prefix, overrides, logger) => {
-  prefix ??= COOKIE_NAME;
-  const securePrefix = useSecure ? "__Secure-" : "";
-  const hostPrefix = useSecure ? "__Host-" : "";
-  return {
-    sessionToken: {
-      name: `${securePrefix}${prefix}.${overrides?.sessionToken?.name ?? "session_token"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...defaultCookieOptions,
-          ...overrides?.sessionToken?.attributes
-        },
-        overrides?.sessionToken?.attributes?.strategy ?? "secure",
-        logger
-      )
-    },
-    state: {
-      name: `${securePrefix}${prefix}.${overrides?.state?.name ?? "state"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...oauthCookieOptions,
-          ...overrides?.state?.attributes
-        },
-        overrides?.state?.attributes?.strategy ?? "secure",
-        logger
-      )
-    },
-    csrfToken: {
-      name: `${hostPrefix}${prefix}.${overrides?.csrfToken?.name ?? "csrf_token"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...overrides?.csrfToken?.attributes,
-          ...defaultHostCookieConfig,
-          sameSite: "strict"
-        },
-        overrides?.csrfToken?.attributes?.strategy ?? "host",
-        logger
-      )
-    },
-    redirectTo: {
-      name: `${securePrefix}${prefix}.${overrides?.redirectTo?.name ?? "redirect_to"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...oauthCookieOptions,
-          ...overrides?.redirectTo?.attributes
-        },
-        overrides?.redirectTo?.attributes?.strategy ?? "secure",
-        logger
-      )
-    },
-    redirectURI: {
-      name: `${securePrefix}${prefix}.${overrides?.redirectURI?.name ?? "redirect_uri"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...oauthCookieOptions,
-          ...overrides?.redirectURI?.attributes
-        },
-        overrides?.redirectURI?.attributes?.strategy ?? "secure",
-        logger
-      )
-    },
-    codeVerifier: {
-      name: `${securePrefix}${prefix}.${overrides?.codeVerifier?.name ?? "code_verifier"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...oauthCookieOptions,
-          ...overrides?.codeVerifier?.attributes
-        },
-        overrides?.codeVerifier?.attributes?.strategy ?? "secure",
-        logger
-      )
-    }
-  };
-};
-
-// src/oauth/github.ts
-var github = (options2) => {
-  return {
-    id: "github",
-    name: "GitHub",
-    authorizeURL: "https://github.com/login/oauth/authorize",
-    accessToken: "https://github.com/login/oauth/access_token",
-    userInfo: "https://api.github.com/user",
-    scope: "read:user user:email",
-    responseType: "code",
-    profile: (profile) => {
-      return {
-        sub: profile.id.toString(),
-        name: profile.name ?? profile.login,
-        email: profile.email ?? void 0,
-        image: profile.avatar_url
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/bitbucket.ts
-var bitbucket = (options2) => {
-  return {
-    id: "bitbucket",
-    name: "Bitbucket",
-    authorizeURL: "https://bitbucket.org/site/oauth2/authorize",
-    accessToken: "https://bitbucket.org/site/oauth2/access_token",
-    userInfo: "https://api.bitbucket.org/2.0/user",
-    scope: "account email",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.uuid ?? profile.account_id,
-        name: profile.display_name ?? profile.nickname,
-        image: profile.links.avatar?.href,
-        email: void 0
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/figma.ts
-var figma = (options2) => {
-  return {
-    id: "figma",
-    name: "Figma",
-    authorizeURL: "https://www.figma.com/oauth",
-    accessToken: "https://api.figma.com/v1/oauth/token",
-    userInfo: "https://api.figma.com/v1/me",
-    scope: "current_user:read",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.id,
-        name: profile.handle,
-        email: profile.email,
-        image: profile.img_url
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/discord.ts
-var discord = (options2) => {
-  return {
-    id: "discord",
-    name: "Discord",
-    authorizeURL: "https://discord.com/oauth2/authorize",
-    accessToken: "https://discord.com/api/oauth2/token",
-    userInfo: "https://discord.com/api/users/@me",
-    scope: "identify email",
-    responseType: "code",
-    profile(profile) {
-      let image = "";
-      if (profile.avatar === null) {
-        const index = profile.discriminator === "0" ? (BigInt(profile.id) >> 22n) % 6n : Number(profile.discriminator) % 5;
-        image = `https://cdn.discordapp.com/embed/avatars/${index}.png`;
-      } else {
-        const format = profile.avatar.startsWith("a_") ? "gif" : "png";
-        image = `https://cdn.discordapp.com/avatars/${profile.id}/${profile.avatar}.${format}`;
-      }
-      return {
-        sub: profile.id,
-        name: profile.global_name ?? profile.username,
-        email: profile.email ?? "",
-        image
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/gitlab.ts
-var gitlab = (options2) => {
-  return {
-    id: "gitlab",
-    name: "GitLab",
-    authorizeURL: "https://gitlab.com/oauth/authorize",
-    accessToken: "https://gitlab.com/oauth/token",
-    userInfo: "https://gitlab.com/api/v4/user",
-    scope: "read_user",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.id.toString(),
-        name: profile.name ?? profile.username,
-        email: profile.email,
-        image: profile.avatar_url
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/spotify.ts
-var spotify = (options2) => {
-  return {
-    id: "spotify",
-    name: "Spotify",
-    authorizeURL: "https://accounts.spotify.com/authorize",
-    accessToken: "https://accounts.spotify.com/api/token",
-    userInfo: "https://api.spotify.com/v1/me",
-    scope: "user-read-private user-read-email",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.id,
-        name: profile.display_name,
-        email: profile.email,
-        image: profile.images[0]?.url ?? void 0
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/x.ts
-var x = (options2) => {
-  return {
-    id: "x",
-    name: "X",
-    authorizeURL: "https://twitter.com/i/oauth2/authorize",
-    accessToken: "https://api.twitter.com/2/oauth2/token",
-    userInfo: "https://api.twitter.com/2/users/me?user.fields=profile_image_url",
-    scope: "tweet.read users.read offline.access",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.data.id,
-        name: profile.data.name,
-        image: profile.data.profile_image_url,
-        email: void 0
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/strava.ts
-var strava = (options2) => {
-  return {
-    id: "strava",
-    name: "Strava",
-    authorizeURL: "https://www.strava.com/oauth/authorize",
-    accessToken: "https://www.strava.com/oauth/token",
-    userInfo: "https://www.strava.com/api/v3/athlete",
-    scope: "read",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.id.toString(),
-        name: `${profile.firstname} ${profile.lastname}`,
-        image: profile.profile,
-        email: void 0
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/mailchimp.ts
-var mailchimp = (options2) => {
-  return {
-    id: "mailchimp",
-    name: "Mailchimp",
-    authorizeURL: "https://login.mailchimp.com/oauth2/authorize",
-    accessToken: "https://login.mailchimp.com/oauth2/token",
-    userInfo: "https://login.mailchimp.com/oauth2/metadata",
-    scope: "",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.user_id,
-        name: profile.accountname,
-        email: profile.login.email,
-        image: profile.login.avatar
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/pinterest.ts
-var pinterest = (options2) => {
-  return {
-    id: "pinterest",
-    name: "Pinterest",
-    authorizeURL: "https://www.pinterest.com/oauth",
-    accessToken: "https://api.pinterest.com/v5/oauth/token",
-    userInfo: "https://api.pinterest.com/v5/user_account",
-    scope: "user_accounts:read",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.id,
-        name: profile.username,
-        image: profile.profile_image,
-        email: void 0
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/twitch.ts
-var twitch = (options2) => {
-  const clientId = options2?.clientId ?? getEnv("TWITCH_CLIENT_ID");
-  return {
-    id: "twitch",
-    name: "Twitch",
-    authorize: {
-      url: "https://id.twitch.tv/oauth2/authorize",
-      params: { scope: "user:read:email", responseType: "code" }
-    },
-    accessToken: "https://id.twitch.tv/oauth2/token",
-    userInfo: {
-      url: "https://api.twitch.tv/helix/users",
-      headers: {
-        "Client-ID": clientId
-      }
-    },
-    profile(profile) {
-      const user = profile.data[0];
-      if (!user) {
-        throw new Error("No user data found in Twitch profile response");
-      }
-      return {
-        sub: user.id,
-        name: user.display_name,
-        email: user.email,
-        picture: user.profile_image_url
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/notion.ts
-var notion = (options2) => {
-  return {
-    id: "notion",
-    name: "Notion",
-    authorize: {
-      url: "https://api.notion.com/v1/oauth/authorize",
-      params: {
-        owner: "user",
-        scope: "user:read",
-        responseType: "code"
-      }
-    },
-    accessToken: {
-      url: "https://api.notion.com/v1/oauth/token",
-      headers: {
-        Authorization: createBasicAuthHeader(
-          options2?.clientId ?? "NOTION_CLIENT_ID",
-          options2?.clientSecret ?? "NOTION_CLIENT_SECRET"
-        )
-      }
-    },
-    userInfo: {
-      url: "https://api.notion.com/v1/users/me",
-      headers: {
-        "Notion-Version": "2022-06-28"
-      }
-    },
-    profile(profile) {
-      return {
-        sub: profile.id,
-        name: profile.name,
-        image: profile.avatar_url ?? "",
-        email: profile?.bot?.owner?.user?.person?.email
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/dropbox.ts
-var dropbox = (options2) => {
-  return {
-    id: "dropbox",
-    name: "Dropbox",
-    authorize: {
-      url: "https://www.dropbox.com/oauth2/authorize",
-      params: { scope: "account_info.read" }
-    },
-    accessToken: "https://api.dropboxapi.com/oauth2/token",
-    userInfo: {
-      method: "POST",
-      url: "https://api.dropboxapi.com/2/users/get_current_account"
-    },
-    profile(profile) {
-      return {
-        sub: profile.account_id,
-        name: profile.name.display_name,
-        email: profile.email,
-        image: profile.profile_photo_url
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/atlassian.ts
-var atlassian = (options2) => {
-  return {
-    id: "atlassian",
-    name: "Atlassian",
-    authorize: {
-      url: "https://auth.atlassian.com/authorize",
-      params: {
-        audience: "api.atlassian.com",
-        scope: "read:me read:account",
-        prompt: "consent"
-      }
-    },
-    authorizeURL: "https://auth.atlassian.com/authorize",
-    accessToken: "https://auth.atlassian.com/oauth/token",
-    userInfo: "https://api.atlassian.com/me",
-    scope: "read:me read:account",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.account_id,
-        name: profile.name,
-        email: profile.email,
-        image: profile.picture
-      };
-    },
-    ...options2
-  };
-};
-
-// src/schemas.ts
-var import_v4 = require("zod/v4");
-var AuthorizeConfigSchema = import_v4.z.union([
-  (0, import_v4.string)().url(),
-  (0, import_v4.object)({
-    url: (0, import_v4.string)().url(),
-    params: (0, import_v4.object)({
-      responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
-      scope: (0, import_v4.string)().optional()
-    })
-  })
-]);
-var AccessTokenConfigSchema = import_v4.z.union([
-  (0, import_v4.string)().url(),
-  (0, import_v4.object)({
-    url: (0, import_v4.string)().url(),
-    headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional()
-  })
-]);
-var UserInfoConfigSchema = import_v4.z.union([
-  (0, import_v4.string)().url(),
-  (0, import_v4.object)({
-    url: (0, import_v4.string)().url(),
-    headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional(),
-    method: (0, import_v4.string)().optional()
-  })
-]);
-var OAuthProviderCredentialsSchema = (0, import_v4.object)({
-  id: (0, import_v4.string)(),
-  name: (0, import_v4.string)(),
-  authorize: AuthorizeConfigSchema.optional(),
-  /** @deprecated */
-  authorizeURL: (0, import_v4.string)().url().optional(),
-  accessToken: AccessTokenConfigSchema,
-  /** @deprecated */
-  scope: (0, import_v4.string)().optional(),
-  userInfo: UserInfoConfigSchema,
-  /** @deprecated */
-  responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
-  clientId: (0, import_v4.string)(),
-  clientSecret: (0, import_v4.string)(),
-  profile: import_v4.z.function().optional()
-});
-var OAuthProviderConfigSchema = (0, import_v4.object)({
-  authorize: AuthorizeConfigSchema.optional(),
-  /** @deprecated */
-  authorizeURL: (0, import_v4.string)().url().optional(),
-  accessToken: AccessTokenConfigSchema,
-  /** @deprecated */
-  scope: (0, import_v4.string)().optional(),
-  userInfo: UserInfoConfigSchema,
-  /** @deprecated */
-  responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
-  clientId: (0, import_v4.string)(),
-  clientSecret: (0, import_v4.string)()
-});
-var OAuthAuthorization = OAuthProviderConfigSchema.extend({
-  redirectURI: (0, import_v4.string)(),
-  state: (0, import_v4.string)(),
-  codeChallenge: (0, import_v4.string)(),
-  codeChallengeMethod: (0, import_v4.enum)(["plain", "S256"])
-});
-var OAuthAuthorizationResponse = (0, import_v4.object)({
-  state: (0, import_v4.string)({ message: "Missing state parameter in the OAuth authorization response." }),
-  code: (0, import_v4.string)({ message: "Missing code parameter in the OAuth authorization response." })
-});
-var OAuthAuthorizationErrorResponse = (0, import_v4.object)({
-  error: (0, import_v4.enum)([
-    "invalid_request",
-    "unauthorized_client",
-    "access_denied",
-    "unsupported_response_type",
-    "invalid_scope",
-    "server_error",
-    "temporarily_unavailable"
-  ]),
-  error_description: (0, import_v4.string)().optional(),
-  error_uri: (0, import_v4.string)().optional(),
-  state: (0, import_v4.string)()
-});
-var OAuthAccessToken = OAuthProviderConfigSchema.extend({
-  redirectURI: (0, import_v4.string)(),
-  code: (0, import_v4.string)(),
-  codeVerifier: (0, import_v4.string)().min(43).max(128)
-});
-var OAuthAccessTokenResponse = (0, import_v4.object)({
-  access_token: (0, import_v4.string)(),
-  token_type: (0, import_v4.string)().optional(),
-  expires_in: (0, import_v4.number)().optional(),
-  refresh_token: (0, import_v4.string)().optional(),
-  scope: (0, import_v4.union)([(0, import_v4.string)().optional().or((0, import_v4.null)()), (0, import_v4.array)((0, import_v4.string)()).optional()])
-});
-var OAuthAccessTokenErrorResponse = (0, import_v4.object)({
-  error: (0, import_v4.enum)([
-    "invalid_request",
-    "invalid_client",
-    "invalid_grant",
-    "unauthorized_client",
-    "unsupported_grant_type",
-    "invalid_scope"
-  ]),
-  error_description: (0, import_v4.string)().optional(),
-  error_uri: (0, import_v4.string)().optional()
-});
-var OAuthErrorResponse = (0, import_v4.object)({
-  error: (0, import_v4.string)(),
-  error_description: (0, import_v4.string)().optional()
-});
-var OAuthEnvSchema = (0, import_v4.object)({
-  clientId: import_v4.z.string().min(1, "OAuth Client ID is required in the environment variables."),
-  clientSecret: import_v4.z.string().min(1, "OAuth Client Secret is required in the environment variables.")
-});
-
-// src/oauth/index.ts
-var builtInOAuthProviders = {
-  github,
-  bitbucket,
-  figma,
-  discord,
-  gitlab,
-  spotify,
-  x,
-  strava,
-  mailchimp,
-  pinterest,
-  twitch,
-  notion,
-  dropbox,
-  atlassian
-};
-var defineOAuthEnvironment = (oauth) => {
-  const loadEnvs = OAuthEnvSchema.safeParse({
-    clientId: getEnv(`${oauth.toUpperCase()}_CLIENT_ID`),
-    clientSecret: getEnv(`${oauth.toUpperCase()}_CLIENT_SECRET`)
-  });
-  if (!loadEnvs.success) {
-    const msg = JSON.stringify({ [oauth]: formatZodError(loadEnvs.error) }, null, 2);
-    throw new AuthInternalError("INVALID_ENVIRONMENT_CONFIGURATION", msg);
-  }
-  return loadEnvs.data;
-};
-var defineOAuthProviderConfig = (config) => {
-  if (typeof config === "string") {
-    const definition = defineOAuthEnvironment(config);
-    const oauthConfig = builtInOAuthProviders[config]();
-    const parsed2 = OAuthProviderCredentialsSchema.safeParse({ ...oauthConfig, ...definition });
-    if (!parsed2.success) {
-      const details = JSON.stringify({ [config]: formatZodError(parsed2.error) }, null, 2);
-      throw new AuthInternalError(
-        "INVALID_OAUTH_PROVIDER_CONFIGURATION",
-        `Invalid configuration for OAuth provider "${config}": ${details}`
-      );
-    }
-    return parsed2.data;
-  }
-  const hasCredentials = config.clientId && config.clientSecret;
-  const envConfig = hasCredentials ? {} : defineOAuthEnvironment(config.id);
-  const parsed = OAuthProviderCredentialsSchema.safeParse({ ...envConfig, ...config });
-  if (!parsed.success) {
-    const details = JSON.stringify({ [config.id]: formatZodError(parsed.error) }, null, 2);
-    throw new AuthInternalError(
-      "INVALID_OAUTH_PROVIDER_CONFIGURATION",
-      `Invalid configuration for OAuth provider "${config.id}": ${details}`
-    );
-  }
-  return parsed.data;
-};
-var createBuiltInOAuthProviders = (oauth = []) => {
-  return oauth.reduce((previous, config) => {
-    const oauthConfig = defineOAuthProviderConfig(config);
-    if (oauthConfig.id in previous) {
-      throw new AuthInternalError(
-        "DUPLICATED_OAUTH_PROVIDER_ID",
-        `Duplicate OAuth provider id "${oauthConfig.id}" found. Each provider must have a unique id.`
-      );
-    }
-    return { ...previous, [oauthConfig.id]: oauthConfig };
-  }, {});
-};
-
-// src/context.ts
-var createContext = (config) => {
-  const trustedProxyHeadersEnv = getEnv("TRUSTED_PROXY_HEADERS");
-  const useProxyHeaders = trustedProxyHeadersEnv === void 0 ? config?.trustedProxyHeaders ?? false : getEnvBoolean("TRUSTED_PROXY_HEADERS");
-  const logger = createProxyLogger(config);
-  const cookiePrefix = config?.cookies?.prefix;
-  const cookieOverrides = config?.cookies?.overrides ?? {};
-  const secureCookieStore = createCookieStore(true, cookiePrefix, cookieOverrides, logger);
-  const standardCookieStore = createCookieStore(false, cookiePrefix, cookieOverrides, logger);
-  return {
-    oauth: createBuiltInOAuthProviders(config?.oauth),
-    cookies: standardCookieStore,
-    jose: createJoseInstance(config?.secret),
-    secret: config?.secret,
-    basePath: config?.basePath ?? "/auth",
-    trustedProxyHeaders: useProxyHeaders,
-    trustedOrigins: getEnvArray("TRUSTED_ORIGINS").length > 0 ? getEnvArray("TRUSTED_ORIGINS") : config?.trustedOrigins,
-    logger,
-    cookieConfig: { secure: secureCookieStore, standard: standardCookieStore },
-    baseURL: config?.baseURL
-  };
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  createContext
-});