@aura-stack/auth 0.5.0 → 0.6.0

package/dist/request.d.ts

@@ -1,13 +0,0 @@
-/**
- * Fetches a resource with a timeout mechanism.
- *
- * @param url - The URL or Request object to fetch
- * @param options - Optional RequestInit configuration object
- * @param timeout - Timeout duration in milliseconds (default: 5000ms)
- * @returns A promise that resolves to the Response object
- * @example
- * const response = await fetchAsync('https://api.example.com/data', {}, 3000);
- */
-declare const fetchAsync: (url: string | Request, options?: RequestInit, timeout?: number) => Promise<Response>;
-
-export { fetchAsync };

package/dist/request.js

@@ -1,6 +0,0 @@
-import {
-  fetchAsync
-} from "./chunk-ZNCZVF6U.js";
-export {
-  fetchAsync
-};

package/dist/schemas.cjs

@@ -1,158 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/schemas.ts
-var schemas_exports = {};
-__export(schemas_exports, {
-  OAuthAccessToken: () => OAuthAccessToken,
-  OAuthAccessTokenErrorResponse: () => OAuthAccessTokenErrorResponse,
-  OAuthAccessTokenResponse: () => OAuthAccessTokenResponse,
-  OAuthAuthorization: () => OAuthAuthorization,
-  OAuthAuthorizationErrorResponse: () => OAuthAuthorizationErrorResponse,
-  OAuthAuthorizationResponse: () => OAuthAuthorizationResponse,
-  OAuthEnvSchema: () => OAuthEnvSchema,
-  OAuthErrorResponse: () => OAuthErrorResponse,
-  OAuthProviderConfigSchema: () => OAuthProviderConfigSchema,
-  OAuthProviderCredentialsSchema: () => OAuthProviderCredentialsSchema
-});
-module.exports = __toCommonJS(schemas_exports);
-var import_v4 = require("zod/v4");
-var AuthorizeConfigSchema = import_v4.z.union([
-  (0, import_v4.string)().url(),
-  (0, import_v4.object)({
-    url: (0, import_v4.string)().url(),
-    params: (0, import_v4.object)({
-      responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
-      scope: (0, import_v4.string)().optional()
-    })
-  })
-]);
-var AccessTokenConfigSchema = import_v4.z.union([
-  (0, import_v4.string)().url(),
-  (0, import_v4.object)({
-    url: (0, import_v4.string)().url(),
-    headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional()
-  })
-]);
-var UserInfoConfigSchema = import_v4.z.union([
-  (0, import_v4.string)().url(),
-  (0, import_v4.object)({
-    url: (0, import_v4.string)().url(),
-    headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional(),
-    method: (0, import_v4.string)().optional()
-  })
-]);
-var OAuthProviderCredentialsSchema = (0, import_v4.object)({
-  id: (0, import_v4.string)(),
-  name: (0, import_v4.string)(),
-  authorize: AuthorizeConfigSchema.optional(),
-  /** @deprecated */
-  authorizeURL: (0, import_v4.string)().url().optional(),
-  accessToken: AccessTokenConfigSchema,
-  /** @deprecated */
-  scope: (0, import_v4.string)().optional(),
-  userInfo: UserInfoConfigSchema,
-  /** @deprecated */
-  responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
-  clientId: (0, import_v4.string)(),
-  clientSecret: (0, import_v4.string)(),
-  profile: import_v4.z.function().optional()
-});
-var OAuthProviderConfigSchema = (0, import_v4.object)({
-  authorize: AuthorizeConfigSchema.optional(),
-  /** @deprecated */
-  authorizeURL: (0, import_v4.string)().url().optional(),
-  accessToken: AccessTokenConfigSchema,
-  /** @deprecated */
-  scope: (0, import_v4.string)().optional(),
-  userInfo: UserInfoConfigSchema,
-  /** @deprecated */
-  responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
-  clientId: (0, import_v4.string)(),
-  clientSecret: (0, import_v4.string)()
-});
-var OAuthAuthorization = OAuthProviderConfigSchema.extend({
-  redirectURI: (0, import_v4.string)(),
-  state: (0, import_v4.string)(),
-  codeChallenge: (0, import_v4.string)(),
-  codeChallengeMethod: (0, import_v4.enum)(["plain", "S256"])
-});
-var OAuthAuthorizationResponse = (0, import_v4.object)({
-  state: (0, import_v4.string)({ message: "Missing state parameter in the OAuth authorization response." }),
-  code: (0, import_v4.string)({ message: "Missing code parameter in the OAuth authorization response." })
-});
-var OAuthAuthorizationErrorResponse = (0, import_v4.object)({
-  error: (0, import_v4.enum)([
-    "invalid_request",
-    "unauthorized_client",
-    "access_denied",
-    "unsupported_response_type",
-    "invalid_scope",
-    "server_error",
-    "temporarily_unavailable"
-  ]),
-  error_description: (0, import_v4.string)().optional(),
-  error_uri: (0, import_v4.string)().optional(),
-  state: (0, import_v4.string)()
-});
-var OAuthAccessToken = OAuthProviderConfigSchema.extend({
-  redirectURI: (0, import_v4.string)(),
-  code: (0, import_v4.string)(),
-  codeVerifier: (0, import_v4.string)().min(43).max(128)
-});
-var OAuthAccessTokenResponse = (0, import_v4.object)({
-  access_token: (0, import_v4.string)(),
-  token_type: (0, import_v4.string)().optional(),
-  expires_in: (0, import_v4.number)().optional(),
-  refresh_token: (0, import_v4.string)().optional(),
-  scope: (0, import_v4.union)([(0, import_v4.string)().optional().or((0, import_v4.null)()), (0, import_v4.array)((0, import_v4.string)()).optional()])
-});
-var OAuthAccessTokenErrorResponse = (0, import_v4.object)({
-  error: (0, import_v4.enum)([
-    "invalid_request",
-    "invalid_client",
-    "invalid_grant",
-    "unauthorized_client",
-    "unsupported_grant_type",
-    "invalid_scope"
-  ]),
-  error_description: (0, import_v4.string)().optional(),
-  error_uri: (0, import_v4.string)().optional()
-});
-var OAuthErrorResponse = (0, import_v4.object)({
-  error: (0, import_v4.string)(),
-  error_description: (0, import_v4.string)().optional()
-});
-var OAuthEnvSchema = (0, import_v4.object)({
-  clientId: import_v4.z.string().min(1, "OAuth Client ID is required in the environment variables."),
-  clientSecret: import_v4.z.string().min(1, "OAuth Client Secret is required in the environment variables.")
-});
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  OAuthAccessToken,
-  OAuthAccessTokenErrorResponse,
-  OAuthAccessTokenResponse,
-  OAuthAuthorization,
-  OAuthAuthorizationErrorResponse,
-  OAuthAuthorizationResponse,
-  OAuthEnvSchema,
-  OAuthErrorResponse,
-  OAuthProviderConfigSchema,
-  OAuthProviderCredentialsSchema
-});

package/dist/schemas.d.ts

@@ -1,229 +0,0 @@
-import { z } from 'zod/v4';
-
-declare const OAuthProviderCredentialsSchema: z.ZodObject<{
-    id: z.ZodString;
-    name: z.ZodString;
-    authorize: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
-        url: z.ZodString;
-        params: z.ZodObject<{
-            responseType: z.ZodOptional<z.ZodEnum<{
-                token: "token";
-                code: "code";
-                id_token: "id_token";
-                refresh_token: "refresh_token";
-            }>>;
-            scope: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>;
-    }, z.core.$strip>]>>;
-    authorizeURL: z.ZodOptional<z.ZodString>;
-    accessToken: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
-        url: z.ZodString;
-        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    }, z.core.$strip>]>;
-    scope: z.ZodOptional<z.ZodString>;
-    userInfo: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
-        url: z.ZodString;
-        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        method: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>]>;
-    responseType: z.ZodOptional<z.ZodEnum<{
-        token: "token";
-        code: "code";
-        id_token: "id_token";
-        refresh_token: "refresh_token";
-    }>>;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    profile: z.ZodOptional<z.ZodFunction<z.core.$ZodFunctionArgs, z.core.$ZodFunctionOut>>;
-}, z.core.$strip>;
-/**
- * Schema for OAuth Provider Configuration
- */
-declare const OAuthProviderConfigSchema: z.ZodObject<{
-    authorize: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
-        url: z.ZodString;
-        params: z.ZodObject<{
-            responseType: z.ZodOptional<z.ZodEnum<{
-                token: "token";
-                code: "code";
-                id_token: "id_token";
-                refresh_token: "refresh_token";
-            }>>;
-            scope: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>;
-    }, z.core.$strip>]>>;
-    authorizeURL: z.ZodOptional<z.ZodString>;
-    accessToken: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
-        url: z.ZodString;
-        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    }, z.core.$strip>]>;
-    scope: z.ZodOptional<z.ZodString>;
-    userInfo: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
-        url: z.ZodString;
-        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        method: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>]>;
-    responseType: z.ZodOptional<z.ZodEnum<{
-        token: "token";
-        code: "code";
-        id_token: "id_token";
-        refresh_token: "refresh_token";
-    }>>;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-}, z.core.$strip>;
-/**
- * Schema used to create the authorization URL for the OAuth flow and verify the
- * OAuth configuration.
- * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.1
- */
-declare const OAuthAuthorization: z.ZodObject<{
-    authorize: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
-        url: z.ZodString;
-        params: z.ZodObject<{
-            responseType: z.ZodOptional<z.ZodEnum<{
-                token: "token";
-                code: "code";
-                id_token: "id_token";
-                refresh_token: "refresh_token";
-            }>>;
-            scope: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>;
-    }, z.core.$strip>]>>;
-    authorizeURL: z.ZodOptional<z.ZodString>;
-    accessToken: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
-        url: z.ZodString;
-        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    }, z.core.$strip>]>;
-    scope: z.ZodOptional<z.ZodString>;
-    userInfo: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
-        url: z.ZodString;
-        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        method: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>]>;
-    responseType: z.ZodOptional<z.ZodEnum<{
-        token: "token";
-        code: "code";
-        id_token: "id_token";
-        refresh_token: "refresh_token";
-    }>>;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    redirectURI: z.ZodString;
-    state: z.ZodString;
-    codeChallenge: z.ZodString;
-    codeChallengeMethod: z.ZodEnum<{
-        plain: "plain";
-        S256: "S256";
-    }>;
-}, z.core.$strip>;
-/**
- * Schema used in the callback action to validate the authorization response when the resource owner
- * has granted.
- * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2
- */
-declare const OAuthAuthorizationResponse: z.ZodObject<{
-    state: z.ZodString;
-    code: z.ZodString;
-}, z.core.$strip>;
-/**
- * Schema used in the callback action to validate the authorization error response when the resource owner
- * has denied the authorization request.
- * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1
- */
-declare const OAuthAuthorizationErrorResponse: z.ZodObject<{
-    error: z.ZodEnum<{
-        invalid_request: "invalid_request";
-        unauthorized_client: "unauthorized_client";
-        access_denied: "access_denied";
-        unsupported_response_type: "unsupported_response_type";
-        invalid_scope: "invalid_scope";
-        server_error: "server_error";
-        temporarily_unavailable: "temporarily_unavailable";
-    }>;
-    error_description: z.ZodOptional<z.ZodString>;
-    error_uri: z.ZodOptional<z.ZodString>;
-    state: z.ZodString;
-}, z.core.$strip>;
-/**
- * Schema for OAuth Access Token Request and OAuth Configuration
- * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
- */
-declare const OAuthAccessToken: z.ZodObject<{
-    authorize: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
-        url: z.ZodString;
-        params: z.ZodObject<{
-            responseType: z.ZodOptional<z.ZodEnum<{
-                token: "token";
-                code: "code";
-                id_token: "id_token";
-                refresh_token: "refresh_token";
-            }>>;
-            scope: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>;
-    }, z.core.$strip>]>>;
-    authorizeURL: z.ZodOptional<z.ZodString>;
-    accessToken: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
-        url: z.ZodString;
-        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    }, z.core.$strip>]>;
-    scope: z.ZodOptional<z.ZodString>;
-    userInfo: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
-        url: z.ZodString;
-        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        method: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>]>;
-    responseType: z.ZodOptional<z.ZodEnum<{
-        token: "token";
-        code: "code";
-        id_token: "id_token";
-        refresh_token: "refresh_token";
-    }>>;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    redirectURI: z.ZodString;
-    code: z.ZodString;
-    codeVerifier: z.ZodString;
-}, z.core.$strip>;
-/**
- * Schema for OAuth Access Token Response
- * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.1
- * @see https://datatracker.ietf.org/doc/html/rfc7636#section-4
- */
-declare const OAuthAccessTokenResponse: z.ZodObject<{
-    access_token: z.ZodString;
-    token_type: z.ZodOptional<z.ZodString>;
-    expires_in: z.ZodOptional<z.ZodNumber>;
-    refresh_token: z.ZodOptional<z.ZodString>;
-    scope: z.ZodUnion<readonly [z.ZodUnion<[z.ZodOptional<z.ZodString>, z.ZodNull]>, z.ZodOptional<z.ZodArray<z.ZodString>>]>;
-}, z.core.$strip>;
-/**
- * Schema for OAuth Access Token Error Response
- * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
- */
-declare const OAuthAccessTokenErrorResponse: z.ZodObject<{
-    error: z.ZodEnum<{
-        invalid_request: "invalid_request";
-        unauthorized_client: "unauthorized_client";
-        invalid_scope: "invalid_scope";
-        invalid_client: "invalid_client";
-        invalid_grant: "invalid_grant";
-        unsupported_grant_type: "unsupported_grant_type";
-    }>;
-    error_description: z.ZodOptional<z.ZodString>;
-    error_uri: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-/**
- * @todo: verify if this schema is still needed
- * @deprecated
- */
-declare const OAuthErrorResponse: z.ZodObject<{
-    error: z.ZodString;
-    error_description: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-declare const OAuthEnvSchema: z.ZodObject<{
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-}, z.core.$strip>;
-
-export { OAuthAccessToken, OAuthAccessTokenErrorResponse, OAuthAccessTokenResponse, OAuthAuthorization, OAuthAuthorizationErrorResponse, OAuthAuthorizationResponse, OAuthEnvSchema, OAuthErrorResponse, OAuthProviderConfigSchema, OAuthProviderCredentialsSchema };

package/dist/schemas.js

@@ -1,24 +0,0 @@
-import {
-  OAuthAccessToken,
-  OAuthAccessTokenErrorResponse,
-  OAuthAccessTokenResponse,
-  OAuthAuthorization,
-  OAuthAuthorizationErrorResponse,
-  OAuthAuthorizationResponse,
-  OAuthEnvSchema,
-  OAuthErrorResponse,
-  OAuthProviderConfigSchema,
-  OAuthProviderCredentialsSchema
-} from "./chunk-2A5B7GWR.js";
-export {
-  OAuthAccessToken,
-  OAuthAccessTokenErrorResponse,
-  OAuthAccessTokenResponse,
-  OAuthAuthorization,
-  OAuthAuthorizationErrorResponse,
-  OAuthAuthorizationResponse,
-  OAuthEnvSchema,
-  OAuthErrorResponse,
-  OAuthProviderConfigSchema,
-  OAuthProviderCredentialsSchema
-};

package/dist/secure.cjs

@@ -1,170 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/secure.ts
-var secure_exports = {};
-__export(secure_exports, {
-  createCSRF: () => createCSRF,
-  createHash: () => createHash,
-  createPKCE: () => createPKCE,
-  createSecretValue: () => createSecretValue,
-  generateSecure: () => generateSecure,
-  verifyCSRF: () => verifyCSRF
-});
-module.exports = __toCommonJS(secure_exports);
-
-// src/utils.ts
-var import_router = require("@aura-stack/router");
-
-// src/errors.ts
-var AuthSecurityError = class extends Error {
-  type = "AUTH_SECURITY_ERROR";
-  code;
-  constructor(code, message, options) {
-    super(message, options);
-    this.code = code;
-    this.name = new.target.name;
-    Error.captureStackTrace(this, new.target);
-  }
-};
-
-// src/env.ts
-var import_meta = {};
-var env = new Proxy({}, {
-  get(_, prop) {
-    if (typeof prop !== "string") return void 0;
-    const hasProperty = (process2) => {
-      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
-    };
-    try {
-      if (typeof process !== "undefined" && hasProperty(process.env)) {
-        return process.env[prop];
-      }
-      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
-        return import_meta.env[prop];
-      }
-      if (typeof Deno !== "undefined" && Deno.env?.get) {
-        return Deno.env.get(prop);
-      }
-      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
-        return Bun.env[prop];
-      }
-      const globalValue = globalThis[prop];
-      return typeof globalValue === "string" ? globalValue : void 0;
-    } catch {
-      return void 0;
-    }
-  }
-});
-
-// src/assert.ts
-var import_crypto = require("@aura-stack/jose/crypto");
-var isJWTPayloadWithToken = (payload) => {
-  return typeof payload === "object" && payload !== null && "token" in payload && typeof payload?.token === "string";
-};
-var timingSafeEqual = (a, b) => {
-  const bufferA = import_crypto.encoder.encode(a);
-  const bufferB = import_crypto.encoder.encode(b);
-  const len = Math.max(bufferA.length, bufferB.length);
-  let diff = 0;
-  for (let i = 0; i < len; i++) {
-    diff |= (bufferA[i] ?? 0) ^ (bufferB[i] ?? 0);
-  }
-  return diff === 0 && bufferA.length === bufferB.length;
-};
-
-// src/utils.ts
-var equals = (a, b) => {
-  if (a === null || b === null || a === void 0 || b === void 0) return false;
-  return a === b;
-};
-
-// src/jose.ts
-var import_jose = require("@aura-stack/jose");
-var import_jose2 = require("@aura-stack/jose/jose");
-var import_crypto2 = require("@aura-stack/jose/crypto");
-var jwtVerificationOptions = {
-  algorithms: ["HS256"],
-  typ: "JWT"
-};
-
-// src/secure.ts
-var generateSecure = (length = 32) => {
-  return import_jose2.base64url.encode((0, import_crypto2.getRandomBytes)(length));
-};
-var createSecretValue = (length = 32) => {
-  return import_jose2.base64url.encode((0, import_crypto2.getRandomBytes)(length));
-};
-var createHash = async (data) => {
-  const subtle = (0, import_crypto2.getSubtleCrypto)();
-  const digest = await subtle.digest("SHA-256", import_crypto2.encoder.encode(data));
-  return import_jose2.base64url.encode(new Uint8Array(digest));
-};
-var createPKCE = async (verifier) => {
-  const byteLength = verifier ? void 0 : Math.floor(Math.random() * (96 - 32 + 1) + 32);
-  const codeVerifier = verifier ?? generateSecure(byteLength ?? 64);
-  if (codeVerifier.length < 43 || codeVerifier.length > 128) {
-    throw new AuthSecurityError("PKCE_VERIFIER_INVALID", "The code verifier must be between 43 and 128 characters in length.");
-  }
-  const codeChallenge = await createHash(codeVerifier);
-  return { codeVerifier, codeChallenge, method: "S256" };
-};
-var createCSRF = async (jose, csrfCookie) => {
-  try {
-    const token = generateSecure(32);
-    if (csrfCookie) {
-      await jose.verifyJWS(csrfCookie, jwtVerificationOptions);
-      return csrfCookie;
-    }
-    return jose.signJWS({ token });
-  } catch {
-    const token = generateSecure(32);
-    return jose.signJWS({ token });
-  }
-};
-var verifyCSRF = async (jose, cookie, header) => {
-  try {
-    const cookiePayload = await jose.verifyJWS(cookie, jwtVerificationOptions);
-    const headerPayload = await jose.verifyJWS(header, jwtVerificationOptions);
-    if (!isJWTPayloadWithToken(cookiePayload)) {
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "Cookie payload missing token field.");
-    }
-    if (!isJWTPayloadWithToken(headerPayload)) {
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "Header payload missing token field.");
-    }
-    if (!equals(cookiePayload.token.length, headerPayload.token.length)) {
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
-    }
-    if (!timingSafeEqual(cookiePayload.token, headerPayload.token)) {
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
-    }
-    return true;
-  } catch {
-    throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
-  }
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  createCSRF,
-  createHash,
-  createPKCE,
-  createSecretValue,
-  generateSecure,
-  verifyCSRF
-});

package/dist/secure.d.ts

@@ -1,41 +0,0 @@
-import { c as AuthRuntimeConfig } from './index-_aXtxb_s.js';
-import 'zod';
-import './schemas.js';
-import 'zod/v4';
-import '@aura-stack/jose';
-import '@aura-stack/jose/jose';
-import '@aura-stack/jose/crypto';
-import '@aura-stack/router/cookie';
-import './@types/utility.js';
-import 'jose';
-import '@aura-stack/router';
-import 'zod/v4/core';
-
-/** @deprecated use `createSecretValue` instead */
-declare const generateSecure: (length?: number) => string;
-declare const createSecretValue: (length?: number) => string;
-declare const createHash: (data: string) => Promise<string>;
-/**
- * Creates the code challenge flow for PKCE OAuth flow. It generates a code verifier and its corresponding
- * code challenge using SHA-256 hashing.
- *   - code_verifier: A cryptographically random string used to mitigate authorization code interception attacks.
- *   - code_challenge: A hashed version of the code_verifier sent in the authorization request.
- *   - method: The method used to generate the code challenge, typically "S256" for SHA-256.
- *
- * @see https://datatracker.ietf.org/doc/html/rfc7636#section-4.1
- */
-declare const createPKCE: (verifier?: string) => Promise<{
-    codeVerifier: string;
-    codeChallenge: string;
-    method: string;
-}>;
-/**
- * Creates a CSRF token to be used in OAuth flows to prevent cross-site request forgery attacks.
- *
- * @param csrfCookie - Optional existing CSRF cookie to verify and reuse
- * @returns Signed CSRF token
- */
-declare const createCSRF: (jose: AuthRuntimeConfig["jose"], csrfCookie?: string) => Promise<string>;
-declare const verifyCSRF: (jose: AuthRuntimeConfig["jose"], cookie: string, header: string) => Promise<boolean>;
-
-export { createCSRF, createHash, createPKCE, createSecretValue, generateSecure, verifyCSRF };

package/dist/secure.js

@@ -1,20 +0,0 @@
-import {
-  createCSRF,
-  createHash,
-  createPKCE,
-  createSecretValue,
-  generateSecure,
-  verifyCSRF
-} from "./chunk-V6LLEAR4.js";
-import "./chunk-UZQJJD6A.js";
-import "./chunk-LX3TJ2TJ.js";
-import "./chunk-WHNDRO3N.js";
-import "./chunk-U5663F2U.js";
-export {
-  createCSRF,
-  createHash,
-  createPKCE,
-  createSecretValue,
-  generateSecure,
-  verifyCSRF
-};