@aura-stack/auth 0.5.0 → 0.6.0

package/dist/oauth/x.cjs

@@ -1,49 +1 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/oauth/x.ts
-var x_exports = {};
-__export(x_exports, {
-  x: () => x
-});
-module.exports = __toCommonJS(x_exports);
-var x = (options) => {
-  return {
-    id: "x",
-    name: "X",
-    authorizeURL: "https://twitter.com/i/oauth2/authorize",
-    accessToken: "https://api.twitter.com/2/oauth2/token",
-    userInfo: "https://api.twitter.com/2/users/me?user.fields=profile_image_url",
-    scope: "tweet.read users.read offline.access",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.data.id,
-        name: profile.data.name,
-        image: profile.data.profile_image_url,
-        email: void 0
-      };
-    },
-    ...options
-  };
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  x
-});
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=e=>({id:`x`,name:`X`,authorize:{url:`https://twitter.com/i/oauth2/authorize`,params:{scope:`tweet.read users.read offline.access`,response_type:`code`}},accessToken:`https://api.twitter.com/2/oauth2/token`,userInfo:`https://api.twitter.com/2/users/me?user.fields=profile_image_url`,profile:e=>({sub:e.data.id,name:e.data.name,image:e.data.profile_image_url,email:void 0}),...e});exports.x=e;

package/dist/oauth/x.d.ts

@@ -1,12 +1,2 @@
-export { ah as XProfile, ai as x } from '../index-_aXtxb_s.js';
-import 'zod';
-import '../schemas.js';
-import 'zod/v4';
-import '@aura-stack/jose';
-import '@aura-stack/jose/jose';
-import '@aura-stack/jose/crypto';
-import '@aura-stack/router/cookie';
-import '../@types/utility.js';
-import 'jose';
-import '@aura-stack/router';
-import 'zod/v4/core';
+import { Cn as XProfile, wn as x } from "../index-nqLV2t91.js";
+export { XProfile, x };

package/dist/oauth/x.js

@@ -1,6 +1 @@
-import {
-  x
-} from "../chunk-EEE7UM5T.js";
-export {
-  x
-};
+const e=e=>({id:`x`,name:`X`,authorize:{url:`https://twitter.com/i/oauth2/authorize`,params:{scope:`tweet.read users.read offline.access`,response_type:`code`}},accessToken:`https://api.twitter.com/2/oauth2/token`,userInfo:`https://api.twitter.com/2/users/me?user.fields=profile_image_url`,profile:e=>({sub:e.data.id,name:e.data.name,image:e.data.profile_image_url,email:void 0}),...e});export{e as x};

package/dist/oauth-BntNm6aE.cjs

@@ -0,0 +1 @@
+const e=require(`./errors-CCYPHuBO.cjs`),t=require(`./env-bq387KyP.cjs`),n=require(`./assert-NJGroSJd.cjs`),r=require(`./oauth/github.cjs`),i=require(`./oauth/bitbucket.cjs`),a=require(`./oauth/figma.cjs`),o=require(`./oauth/discord.cjs`),s=require(`./oauth/gitlab.cjs`),c=require(`./oauth/spotify.cjs`),l=require(`./oauth/x.cjs`),u=require(`./oauth/strava.cjs`),d=require(`./oauth/mailchimp.cjs`),f=require(`./oauth/pinterest.cjs`),p=require(`./oauth/twitch.cjs`),m=require(`./oauth/notion.cjs`),h=require(`./oauth/dropbox.cjs`),g=require(`./oauth/atlassian.cjs`);let _=require(`zod/v4`);const v=_.z.union([(0,_.string)().url(),(0,_.object)({url:(0,_.string)().url(),params:(0,_.object)({owner:(0,_.string)().optional(),responseType:(0,_.enum)([`code`,`token`,`id_token`,`refresh_token`]).optional(),scope:(0,_.string)().optional()})})]),y=_.z.union([(0,_.string)().url(),(0,_.object)({url:(0,_.string)().url(),headers:_.z.record((0,_.string)(),(0,_.string)()).optional()})]),b=_.z.union([(0,_.string)().url(),(0,_.object)({url:(0,_.string)().url(),headers:_.z.record((0,_.string)(),(0,_.string)()).optional(),method:(0,_.string)().optional()})]),x=(0,_.object)({id:(0,_.string)(),name:(0,_.string)(),authorize:v.optional(),authorizeURL:(0,_.string)().url().optional(),accessToken:y,scope:(0,_.string)().optional(),userInfo:b,responseType:(0,_.enum)([`code`,`token`,`id_token`,`refresh_token`]).optional(),clientId:(0,_.string)(),clientSecret:(0,_.string)(),profile:_.z.function().optional()}),S=(0,_.object)({authorize:v.optional(),authorizeURL:(0,_.string)().url().optional(),accessToken:y,scope:(0,_.string)().optional(),userInfo:b,responseType:(0,_.enum)([`code`,`token`,`id_token`,`refresh_token`]).optional(),clientId:(0,_.string)(),clientSecret:(0,_.string)()}),C=S.extend({redirectURI:(0,_.string)(),state:(0,_.string)(),codeChallenge:(0,_.string)(),codeChallengeMethod:(0,_.enum)([`plain`,`S256`])});(0,_.object)({state:(0,_.string)({message:`Missing state parameter in the OAuth authorization response.`}),code:(0,_.string)({message:`Missing code parameter in the OAuth authorization response.`})});const w=(0,_.object)({error:(0,_.enum)([`invalid_request`,`unauthorized_client`,`access_denied`,`unsupported_response_type`,`invalid_scope`,`server_error`,`temporarily_unavailable`]),error_description:(0,_.string)().optional(),error_uri:(0,_.string)().optional(),state:(0,_.string)()});S.extend({redirectURI:(0,_.string)(),code:(0,_.string)(),codeVerifier:(0,_.string)().min(43).max(128)});const T=(0,_.object)({access_token:(0,_.string)(),token_type:(0,_.string)().optional(),expires_in:(0,_.number)().optional(),refresh_token:(0,_.string)().optional(),scope:(0,_.union)([(0,_.string)().optional().or((0,_.null)()),(0,_.array)((0,_.string)()).optional()])}),E=(0,_.object)({error:(0,_.enum)([`invalid_request`,`invalid_client`,`invalid_grant`,`unauthorized_client`,`unsupported_grant_type`,`invalid_scope`]),error_description:(0,_.string)().optional(),error_uri:(0,_.string)().optional()}),D=(0,_.object)({error:(0,_.string)(),error_description:(0,_.string)().optional()}),O=(0,_.object)({clientId:_.z.string().min(1,`OAuth Client ID is required in the environment variables.`),clientSecret:_.z.string().min(1,`OAuth Client Secret is required in the environment variables.`)}),k={github:r.github,bitbucket:i.bitbucket,figma:a.figma,discord:o.discord,gitlab:s.gitlab,spotify:c.spotify,x:l.x,strava:u.strava,mailchimp:d.mailchimp,pinterest:f.pinterest,twitch:p.twitch,notion:m.notion,dropbox:h.dropbox,atlassian:g.atlassian},A=r=>{let i=O.safeParse({clientId:t.n(`${r.toUpperCase()}_CLIENT_ID`),clientSecret:t.n(`${r.toUpperCase()}_CLIENT_SECRET`)});if(!i.success)throw new e.n(`INVALID_ENVIRONMENT_CONFIGURATION`,JSON.stringify({[r]:n.p(i.error)},null,2));return i.data},j=t=>{if(typeof t==`string`){let r=A(t),i=k[t](),a=x.safeParse({...i,...r});if(!a.success)throw new e.n(`INVALID_OAUTH_PROVIDER_CONFIGURATION`,`Invalid configuration for OAuth provider "${t}": ${JSON.stringify({[t]:n.p(a.error)},null,2)}`);return a.data}let r=t.clientId&&t.clientSecret?{}:A(t.id),i=x.safeParse({...r,...t});if(!i.success){let r=JSON.stringify({[t.id]:n.p(i.error)},null,2);throw new e.n(`INVALID_OAUTH_PROVIDER_CONFIGURATION`,`Invalid configuration for OAuth provider "${t.id}": ${r}`)}return i.data},M=(t=[])=>t.reduce((t,n)=>{let r=j(n);if(r.id in t)throw new e.n(`DUPLICATED_OAUTH_PROVIDER_ID`,`Duplicate OAuth provider id "${r.id}" found. Each provider must have a unique id.`);return{...t,[r.id]:r}},{});Object.defineProperty(exports,`a`,{enumerable:!0,get:function(){return C}}),Object.defineProperty(exports,`i`,{enumerable:!0,get:function(){return T}}),Object.defineProperty(exports,`n`,{enumerable:!0,get:function(){return M}}),Object.defineProperty(exports,`o`,{enumerable:!0,get:function(){return w}}),Object.defineProperty(exports,`r`,{enumerable:!0,get:function(){return E}}),Object.defineProperty(exports,`s`,{enumerable:!0,get:function(){return D}}),Object.defineProperty(exports,`t`,{enumerable:!0,get:function(){return k}});

package/dist/oauth-DmHy9VrB.js

@@ -0,0 +1 @@
+import{n as e}from"./errors-DFWHOho6.js";import{n as t}from"./env-nvh8QBNz.js";import{p as n}from"./assert-B3iQSYlK.js";import{github as r}from"./oauth/github.js";import{bitbucket as i}from"./oauth/bitbucket.js";import{figma as a}from"./oauth/figma.js";import{discord as o}from"./oauth/discord.js";import{gitlab as s}from"./oauth/gitlab.js";import{spotify as c}from"./oauth/spotify.js";import{x as l}from"./oauth/x.js";import{strava as u}from"./oauth/strava.js";import{mailchimp as d}from"./oauth/mailchimp.js";import{pinterest as f}from"./oauth/pinterest.js";import{twitch as p}from"./oauth/twitch.js";import{notion as m}from"./oauth/notion.js";import{dropbox as h}from"./oauth/dropbox.js";import{atlassian as g}from"./oauth/atlassian.js";import{array as _,enum as v,null as y,number as b,object as x,string as S,union as C,z as w}from"zod/v4";const T=w.union([S().url(),x({url:S().url(),params:x({owner:S().optional(),responseType:v([`code`,`token`,`id_token`,`refresh_token`]).optional(),scope:S().optional()})})]),E=w.union([S().url(),x({url:S().url(),headers:w.record(S(),S()).optional()})]),D=w.union([S().url(),x({url:S().url(),headers:w.record(S(),S()).optional(),method:S().optional()})]),O=x({id:S(),name:S(),authorize:T.optional(),authorizeURL:S().url().optional(),accessToken:E,scope:S().optional(),userInfo:D,responseType:v([`code`,`token`,`id_token`,`refresh_token`]).optional(),clientId:S(),clientSecret:S(),profile:w.function().optional()}),k=x({authorize:T.optional(),authorizeURL:S().url().optional(),accessToken:E,scope:S().optional(),userInfo:D,responseType:v([`code`,`token`,`id_token`,`refresh_token`]).optional(),clientId:S(),clientSecret:S()}),A=k.extend({redirectURI:S(),state:S(),codeChallenge:S(),codeChallengeMethod:v([`plain`,`S256`])});x({state:S({message:`Missing state parameter in the OAuth authorization response.`}),code:S({message:`Missing code parameter in the OAuth authorization response.`})});const j=x({error:v([`invalid_request`,`unauthorized_client`,`access_denied`,`unsupported_response_type`,`invalid_scope`,`server_error`,`temporarily_unavailable`]),error_description:S().optional(),error_uri:S().optional(),state:S()});k.extend({redirectURI:S(),code:S(),codeVerifier:S().min(43).max(128)});const M=x({access_token:S(),token_type:S().optional(),expires_in:b().optional(),refresh_token:S().optional(),scope:C([S().optional().or(y()),_(S()).optional()])}),N=x({error:v([`invalid_request`,`invalid_client`,`invalid_grant`,`unauthorized_client`,`unsupported_grant_type`,`invalid_scope`]),error_description:S().optional(),error_uri:S().optional()}),P=x({error:S(),error_description:S().optional()}),F=x({clientId:w.string().min(1,`OAuth Client ID is required in the environment variables.`),clientSecret:w.string().min(1,`OAuth Client Secret is required in the environment variables.`)}),I={github:r,bitbucket:i,figma:a,discord:o,gitlab:s,spotify:c,x:l,strava:u,mailchimp:d,pinterest:f,twitch:p,notion:m,dropbox:h,atlassian:g},L=r=>{let i=F.safeParse({clientId:t(`${r.toUpperCase()}_CLIENT_ID`),clientSecret:t(`${r.toUpperCase()}_CLIENT_SECRET`)});if(!i.success)throw new e(`INVALID_ENVIRONMENT_CONFIGURATION`,JSON.stringify({[r]:n(i.error)},null,2));return i.data},R=t=>{if(typeof t==`string`){let r=L(t),i=I[t](),a=O.safeParse({...i,...r});if(!a.success)throw new e(`INVALID_OAUTH_PROVIDER_CONFIGURATION`,`Invalid configuration for OAuth provider "${t}": ${JSON.stringify({[t]:n(a.error)},null,2)}`);return a.data}let r=t.clientId&&t.clientSecret?{}:L(t.id),i=O.safeParse({...r,...t});if(!i.success){let r=JSON.stringify({[t.id]:n(i.error)},null,2);throw new e(`INVALID_OAUTH_PROVIDER_CONFIGURATION`,`Invalid configuration for OAuth provider "${t.id}": ${r}`)}return i.data},z=(t=[])=>t.reduce((t,n)=>{let r=R(n);if(r.id in t)throw new e(`DUPLICATED_OAUTH_PROVIDER_ID`,`Duplicate OAuth provider id "${r.id}" found. Each provider must have a unique id.`);return{...t,[r.id]:r}},{});export{A as a,M as i,z as n,j as o,N as r,P as s,I as t};

package/dist/shared/crypto.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require(`../crypto-CoXA5w_4.cjs`);exports.createCSRF=e.t,exports.createHash=e.n,exports.createPKCE=e.r,exports.createSecretValue=e.i,exports.hashPassword=e.a,exports.verifyCSRF=e.o,exports.verifyPassword=e.s;

package/dist/shared/crypto.d.ts

@@ -0,0 +1,47 @@
+import { Nt as JoseInstance, _t as User, xt as AuthRuntimeConfig } from "../index-nqLV2t91.js";
+
+//#region src/shared/crypto.d.ts
+declare const createSecretValue: (length?: number) => string;
+declare const createHash: (data: string) => Promise<string>;
+/**
+ * Creates the code challenge flow for PKCE OAuth flow. It generates a code verifier and its corresponding
+ * code challenge using SHA-256 hashing.
+ *   - code_verifier: A cryptographically random string used to mitigate authorization code interception attacks.
+ *   - code_challenge: A hashed version of the code_verifier sent in the authorization request.
+ *   - method: The method used to generate the code challenge, typically "S256" for SHA-256.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc7636#section-4.1
+ */
+declare const createPKCE: (verifier?: string) => Promise<{
+  codeVerifier: string;
+  codeChallenge: string;
+  method: string;
+}>;
+/**
+ * Creates a CSRF token to be used in OAuth flows to prevent cross-site request forgery attacks.
+ *
+ * @param csrfCookie - Optional existing CSRF cookie to verify and reuse
+ * @returns Signed CSRF token
+ */
+declare const createCSRF: (jose: AuthRuntimeConfig["jose"], csrfCookie?: string) => Promise<string>;
+declare const verifyCSRF: <DefaultUser extends User = User>(jose: JoseInstance<DefaultUser>, cookie: string, header: string) => Promise<boolean>;
+/**
+ * Hashes a password using PBKDF2 with SHA-256.
+ * PBKDF2 is available in standard Web Crypto (SubtleCrypto).
+ *
+ * @param password - The password to hash.
+ * @param salt - Optional salt (base64url encoded). If not provided, a random salt will be generated.
+ * @param iterations - The number of PBKDF2 iterations. Default is 100,000.
+ * @returns The hashed password in the format `iterations:salt:hash` (all segments base64url encoded).
+ */
+declare const hashPassword: (password: string, salt?: string, iterations?: number) => Promise<string>;
+/**
+ * Verifies a password against a hashed value.
+ *
+ * @param password - The password to verify.
+ * @param hashedPassword - The hashed password to compare against.
+ * @returns A promise that resolves to true if the password matches the hash, false otherwise.
+ */
+declare const verifyPassword: (password: string, hashedPassword: string) => Promise<boolean>;
+//#endregion
+export { createCSRF, createHash, createPKCE, createSecretValue, hashPassword, verifyCSRF, verifyPassword };

package/dist/shared/crypto.js

@@ -0,0 +1 @@
+import{a as e,i as t,n,o as r,r as i,s as a,t as o}from"../crypto-Bz8nIciY.js";export{o as createCSRF,n as createHash,i as createPKCE,t as createSecretValue,e as hashPassword,r as verifyCSRF,a as verifyPassword};

package/dist/shared/identity.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require(`zod/v4`);const t=e.z.object({sub:(0,e.string)(),name:(0,e.string)().nullable().optional(),image:(0,e.string)().nullable().optional(),email:(0,e.email)().nullable().optional()}),n=t=>e.z.object(t);exports.UserIdentity=t,exports.createIdentity=n;

package/dist/shared/identity.d.ts

@@ -0,0 +1,2 @@
+import { Bn as UserIdentity, G as InferShape, H as EditableShape, Hn as UserShape, U as InferAuthIdentity, Un as createIdentity, Vn as UserIdentityType, W as InferIdentity, Y as ShapeToObject } from "../index-nqLV2t91.js";
+export { EditableShape, InferAuthIdentity, InferIdentity, InferShape, ShapeToObject, UserIdentity, UserIdentityType, UserShape, createIdentity };

package/dist/shared/identity.js

@@ -0,0 +1 @@
+import{email as e,string as t,z as n}from"zod/v4";const r=n.object({sub:t(),name:t().nullable().optional(),image:t().nullable().optional(),email:e().nullable().optional()}),i=e=>n.object(e);export{r as UserIdentity,i as createIdentity};

package/dist/shared/index.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require(`../assert-NJGroSJd.cjs`),t=require(`../logger-UnUhYL2V.cjs`);exports.createBasicAuthHeader=e.u,exports.createSyslogMessage=t.n;

package/dist/shared/index.d.ts

@@ -0,0 +1,5 @@
+import { zn as createSyslogMessage } from "../index-nqLV2t91.js";
+//#region src/shared/utils.d.ts
+declare const createBasicAuthHeader: (username: string, password: string) => string;
+//#endregion
+export { createBasicAuthHeader, createSyslogMessage };

package/dist/shared/index.js

@@ -0,0 +1 @@
+import{u as e}from"../assert-B3iQSYlK.js";import{n as t}from"../logger-C59_CDMk.js";export{e as createBasicAuthHeader,t as createSyslogMessage};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aura-stack/auth",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "private": false,
   "type": "module",
   "description": "Core auth for @aura-stack/auth",
@@ -12,6 +12,7 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/@aura-stack/auth"
   },
+  "sideEffects": false,
   "files": [
     "dist"
   ],
@@ -21,6 +22,11 @@
       "import": "./dist/index.js",
       "require": "./dist/index.cjs"
     },
+    "./oauth": {
+      "types": "./dist/oauth/index.d.ts",
+      "import": "./dist/oauth/index.js",
+      "require": "./dist/oauth/index.cjs"
+    },
     "./oauth/*": {
       "types": "./dist/oauth/*.d.ts",
       "import": "./dist/oauth/*.js",
@@ -35,6 +41,21 @@
       "types": "./dist/client/index.d.ts",
       "import": "./dist/client/index.js",
       "require": "./dist/client/index.cjs"
+    },
+    "./identity": {
+      "types": "./dist/shared/identity.d.ts",
+      "import": "./dist/shared/identity.js",
+      "require": "./dist/shared/identity.cjs"
+    },
+    "./crypto": {
+      "types": "./dist/shared/crypto.d.ts",
+      "import": "./dist/shared/crypto.js",
+      "require": "./dist/shared/crypto.cjs"
+    },
+    "./shared": {
+      "types": "./dist/shared/index.d.ts",
+      "import": "./dist/shared/index.js",
+      "require": "./dist/shared/index.cjs"
     }
   },
   "keywords": [
@@ -51,24 +72,26 @@
   "dependencies": {
     "@aura-stack/router": "^0.6.0",
     "zod": "4.3.5",
-    "@aura-stack/jose": "0.4.0"
+    "@aura-stack/jose": "0.5.0"
   },
   "devDependencies": {
     "typescript": "^5.9.2",
+    "vitest": "4.1.4",
     "@aura-stack/tsconfig": "0.0.0",
-    "@aura-stack/tsup-config": "0.0.0"
+    "@aura-stack/tsdown-config": "0.0.0"
   },
   "scripts": {
-    "dev": "tsup --watch",
-    "build": "tsup",
+    "dev": "tsdown --watch",
+    "build": "tsdown",
+    "lint": "oxlint",
+    "lint:fix": "oxlint --fix",
     "test": "vitest --run",
     "test:watch": "vitest",
     "test:coverage": "vitest --run --coverage",
-    "format": "prettier --write . --cache --cache-location .cache/.prettiercache",
-    "format:check": "prettier --check . --cache --cache-location .cache/.prettiercache",
+    "format": "oxfmt",
+    "format:check": "oxfmt --check",
     "type-check": "tsc --noEmit",
     "clean": "rm -rf dist",
-    "clean:cts": "find dist -type f -name \"*.cts\" -delete",
-    "prepublish": "pnpm clean:cts"
+    "clean:cts": "if [ -d dist ]; then find dist -type f -name \"*.cts\" -delete; fi"
   }
 }

package/dist/@types/router.d.cjs

@@ -1 +0,0 @@
-"use strict";

package/dist/@types/router.d.d.ts

@@ -1,16 +0,0 @@
-import { R as RouterGlobalContext } from '../index-_aXtxb_s.js';
-import 'zod';
-import '../schemas.js';
-import 'zod/v4';
-import '@aura-stack/jose';
-import '@aura-stack/jose/jose';
-import '@aura-stack/jose/crypto';
-import '@aura-stack/router/cookie';
-import './utility.js';
-import 'jose';
-import '@aura-stack/router';
-import 'zod/v4/core';
-
-declare module "@aura-stack/router" {
-    interface GlobalContext extends RouterGlobalContext {}
-}

package/dist/@types/utility.cjs

@@ -1,18 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/@types/utility.ts
-var utility_exports = {};
-module.exports = __toCommonJS(utility_exports);

package/dist/@types/utility.d.ts

@@ -1,6 +0,0 @@
-type Prettify<T> = {
-    [K in keyof T]: T[K];
-};
-type LiteralUnion<T extends U, U = string> = T | (U & Record<never, never>);
-
-export type { LiteralUnion, Prettify };

package/dist/@types/utility.js

@@ -1 +0,0 @@
-import "../chunk-PG7UYFG5.js";

package/dist/actions/callback/access-token.cjs

@@ -1,250 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/actions/callback/access-token.ts
-var access_token_exports = {};
-__export(access_token_exports, {
-  createAccessToken: () => createAccessToken
-});
-module.exports = __toCommonJS(access_token_exports);
-
-// src/request.ts
-var fetchAsync = async (url, options2 = {}, timeout = 5e3) => {
-  const controller = new AbortController();
-  const timeoutId = setTimeout(() => controller.abort(), timeout);
-  const response = await fetch(url, {
-    ...options2,
-    signal: controller.signal
-  }).finally(() => clearTimeout(timeoutId));
-  return response;
-};
-
-// src/errors.ts
-var OAuthProtocolError = class extends Error {
-  type = "OAUTH_PROTOCOL_ERROR";
-  error;
-  errorURI;
-  constructor(error, description, errorURI, options2) {
-    super(description, options2);
-    this.error = error;
-    this.errorURI = errorURI;
-    this.name = new.target.name;
-    Error.captureStackTrace(this, new.target);
-  }
-};
-var AuthInternalError = class extends Error {
-  type = "AUTH_INTERNAL_ERROR";
-  code;
-  constructor(code, message, options2) {
-    super(message, options2);
-    this.code = code;
-    this.name = new.target.name;
-    Error.captureStackTrace(this, new.target);
-  }
-};
-
-// src/schemas.ts
-var import_v4 = require("zod/v4");
-var AuthorizeConfigSchema = import_v4.z.union([
-  (0, import_v4.string)().url(),
-  (0, import_v4.object)({
-    url: (0, import_v4.string)().url(),
-    params: (0, import_v4.object)({
-      responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
-      scope: (0, import_v4.string)().optional()
-    })
-  })
-]);
-var AccessTokenConfigSchema = import_v4.z.union([
-  (0, import_v4.string)().url(),
-  (0, import_v4.object)({
-    url: (0, import_v4.string)().url(),
-    headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional()
-  })
-]);
-var UserInfoConfigSchema = import_v4.z.union([
-  (0, import_v4.string)().url(),
-  (0, import_v4.object)({
-    url: (0, import_v4.string)().url(),
-    headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional(),
-    method: (0, import_v4.string)().optional()
-  })
-]);
-var OAuthProviderCredentialsSchema = (0, import_v4.object)({
-  id: (0, import_v4.string)(),
-  name: (0, import_v4.string)(),
-  authorize: AuthorizeConfigSchema.optional(),
-  /** @deprecated */
-  authorizeURL: (0, import_v4.string)().url().optional(),
-  accessToken: AccessTokenConfigSchema,
-  /** @deprecated */
-  scope: (0, import_v4.string)().optional(),
-  userInfo: UserInfoConfigSchema,
-  /** @deprecated */
-  responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
-  clientId: (0, import_v4.string)(),
-  clientSecret: (0, import_v4.string)(),
-  profile: import_v4.z.function().optional()
-});
-var OAuthProviderConfigSchema = (0, import_v4.object)({
-  authorize: AuthorizeConfigSchema.optional(),
-  /** @deprecated */
-  authorizeURL: (0, import_v4.string)().url().optional(),
-  accessToken: AccessTokenConfigSchema,
-  /** @deprecated */
-  scope: (0, import_v4.string)().optional(),
-  userInfo: UserInfoConfigSchema,
-  /** @deprecated */
-  responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
-  clientId: (0, import_v4.string)(),
-  clientSecret: (0, import_v4.string)()
-});
-var OAuthAuthorization = OAuthProviderConfigSchema.extend({
-  redirectURI: (0, import_v4.string)(),
-  state: (0, import_v4.string)(),
-  codeChallenge: (0, import_v4.string)(),
-  codeChallengeMethod: (0, import_v4.enum)(["plain", "S256"])
-});
-var OAuthAuthorizationResponse = (0, import_v4.object)({
-  state: (0, import_v4.string)({ message: "Missing state parameter in the OAuth authorization response." }),
-  code: (0, import_v4.string)({ message: "Missing code parameter in the OAuth authorization response." })
-});
-var OAuthAuthorizationErrorResponse = (0, import_v4.object)({
-  error: (0, import_v4.enum)([
-    "invalid_request",
-    "unauthorized_client",
-    "access_denied",
-    "unsupported_response_type",
-    "invalid_scope",
-    "server_error",
-    "temporarily_unavailable"
-  ]),
-  error_description: (0, import_v4.string)().optional(),
-  error_uri: (0, import_v4.string)().optional(),
-  state: (0, import_v4.string)()
-});
-var OAuthAccessToken = OAuthProviderConfigSchema.extend({
-  redirectURI: (0, import_v4.string)(),
-  code: (0, import_v4.string)(),
-  codeVerifier: (0, import_v4.string)().min(43).max(128)
-});
-var OAuthAccessTokenResponse = (0, import_v4.object)({
-  access_token: (0, import_v4.string)(),
-  token_type: (0, import_v4.string)().optional(),
-  expires_in: (0, import_v4.number)().optional(),
-  refresh_token: (0, import_v4.string)().optional(),
-  scope: (0, import_v4.union)([(0, import_v4.string)().optional().or((0, import_v4.null)()), (0, import_v4.array)((0, import_v4.string)()).optional()])
-});
-var OAuthAccessTokenErrorResponse = (0, import_v4.object)({
-  error: (0, import_v4.enum)([
-    "invalid_request",
-    "invalid_client",
-    "invalid_grant",
-    "unauthorized_client",
-    "unsupported_grant_type",
-    "invalid_scope"
-  ]),
-  error_description: (0, import_v4.string)().optional(),
-  error_uri: (0, import_v4.string)().optional()
-});
-var OAuthErrorResponse = (0, import_v4.object)({
-  error: (0, import_v4.string)(),
-  error_description: (0, import_v4.string)().optional()
-});
-var OAuthEnvSchema = (0, import_v4.object)({
-  clientId: import_v4.z.string().min(1, "OAuth Client ID is required in the environment variables."),
-  clientSecret: import_v4.z.string().min(1, "OAuth Client Secret is required in the environment variables.")
-});
-
-// src/actions/callback/access-token.ts
-var createAccessToken = async (oauthConfig, redirectURI, code, codeVerifier, logger) => {
-  const { accessToken, clientId, clientSecret } = oauthConfig;
-  if (!clientId || !clientSecret || !redirectURI || !code || !codeVerifier || !accessToken) {
-    logger?.log("INVALID_OAUTH_CONFIGURATION", {
-      structuredData: {
-        has_client_id: Boolean(clientId),
-        has_client_secret: Boolean(clientSecret),
-        has_access_token: Boolean(accessToken),
-        has_redirect_uri: Boolean(redirectURI),
-        has_code: Boolean(code),
-        has_code_verifier: Boolean(codeVerifier)
-      }
-    });
-    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "The OAuth provider configuration is invalid.");
-  }
-  const tokenURL = typeof accessToken === "string" ? accessToken : accessToken.url;
-  const extraHeaders = typeof accessToken === "string" ? void 0 : accessToken.headers;
-  try {
-    logger?.log("OAUTH_ACCESS_TOKEN_REQUEST_INITIATED", {
-      structuredData: {
-        has_client_id: Boolean(clientId),
-        redirect_uri: redirectURI,
-        grant_type: "authorization_code"
-      }
-    });
-    const response = await fetchAsync(tokenURL, {
-      method: "POST",
-      headers: {
-        ...extraHeaders ?? {},
-        Accept: "application/json",
-        "Content-Type": "application/x-www-form-urlencoded"
-      },
-      body: new URLSearchParams({
-        client_id: clientId,
-        client_secret: clientSecret,
-        code,
-        redirect_uri: redirectURI,
-        grant_type: "authorization_code",
-        code_verifier: codeVerifier
-      }).toString()
-    });
-    if (!response.ok) {
-      logger?.log("INVALID_OAUTH_ACCESS_TOKEN_RESPONSE");
-      throw new OAuthProtocolError("invalid_request", "Invalid access token response");
-    }
-    const json = await response.json();
-    const token = OAuthAccessTokenResponse.safeParse(json);
-    if (!token.success) {
-      const { success, data } = OAuthAccessTokenErrorResponse.safeParse(json);
-      if (!success) {
-        logger?.log("INVALID_OAUTH_ACCESS_TOKEN_RESPONSE");
-        throw new OAuthProtocolError("invalid_request", "Invalid access token response format");
-      }
-      logger?.log("OAUTH_ACCESS_TOKEN_ERROR", {
-        structuredData: {
-          error: data.error,
-          error_description: data.error_description ?? ""
-        }
-      });
-      throw new OAuthProtocolError("INVALID_ACCESS_TOKEN", "Failed to retrieve access token");
-    }
-    logger?.log("OAUTH_ACCESS_TOKEN_SUCCESS");
-    return token.data;
-  } catch (error) {
-    logger?.log("OAUTH_ACCESS_TOKEN_REQUEST_FAILED");
-    if (error instanceof Error) {
-      throw new OAuthProtocolError("server_error", "Failed to communicate with OAuth provider", "", { cause: error });
-    }
-    throw error;
-  }
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  createAccessToken
-});

package/dist/actions/callback/access-token.d.ts

@@ -1,33 +0,0 @@
-import { j as OAuthProviderCredentials, a as InternalLogger } from '../../index-_aXtxb_s.js';
-import 'zod';
-import '../../schemas.js';
-import 'zod/v4';
-import '@aura-stack/jose';
-import '@aura-stack/jose/jose';
-import '@aura-stack/jose/crypto';
-import '@aura-stack/router/cookie';
-import '../../@types/utility.js';
-import 'jose';
-import '@aura-stack/router';
-import 'zod/v4/core';
-
-/**
- * Make a request to the OAuth provider to the token endpoint to exchange the authorization code provided
- * by the authorization server.
- *
- * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
- * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5
- * @param oauthConfig - OAuth provider configuration
- * @param redirectURI - The redirect URI registered in the Resource Owner's authorization request and sent in the authorization code exchange
- * @param code - The authorization code received from the OAuth server
- * @returns The access token response from the OAuth server
- */
-declare const createAccessToken: (oauthConfig: OAuthProviderCredentials, redirectURI: string, code: string, codeVerifier: string, logger?: InternalLogger) => Promise<{
-    access_token: string;
-    token_type?: string | undefined;
-    expires_in?: number | undefined;
-    refresh_token?: string | undefined;
-    scope?: string | string[] | null | undefined;
-}>;
-
-export { createAccessToken };

package/dist/actions/callback/access-token.js

@@ -1,9 +0,0 @@
-import {
-  createAccessToken
-} from "../../chunk-7BE46WWS.js";
-import "../../chunk-ZNCZVF6U.js";
-import "../../chunk-2A5B7GWR.js";
-import "../../chunk-U5663F2U.js";
-export {
-  createAccessToken
-};