@aura-stack/auth 0.5.0 → 0.7.0

package/dist/index.cjs

@@ -1,2427 +1 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/index.ts
-var index_exports = {};
-__export(index_exports, {
-  builtInOAuthProviders: () => builtInOAuthProviders,
-  createAuth: () => createAuth,
-  createAuthClient: () => createAuthClient,
-  createClient: () => createClient,
-  createSyslogMessage: () => createSyslogMessage
-});
-module.exports = __toCommonJS(index_exports);
-
-// src/createAuth.ts
-var import_router9 = require("@aura-stack/router");
-
-// src/env.ts
-var import_meta = {};
-var env = new Proxy({}, {
-  get(_, prop) {
-    if (typeof prop !== "string") return void 0;
-    const hasProperty = (process2) => {
-      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
-    };
-    try {
-      if (typeof process !== "undefined" && hasProperty(process.env)) {
-        return process.env[prop];
-      }
-      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
-        return import_meta.env[prop];
-      }
-      if (typeof Deno !== "undefined" && Deno.env?.get) {
-        return Deno.env.get(prop);
-      }
-      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
-        return Bun.env[prop];
-      }
-      const globalValue = globalThis[prop];
-      return typeof globalValue === "string" ? globalValue : void 0;
-    } catch {
-      return void 0;
-    }
-  }
-});
-var getEnv = (key) => {
-  const keys = [`AURA_AUTH_${key.toUpperCase()}`, `AURA_${key.toUpperCase()}`, `AUTH_${key.toUpperCase()}`, key.toUpperCase()];
-  return env[keys.find((k) => env[k]) ?? ""];
-};
-var getEnvBoolean = (key) => {
-  const value = getEnv(key);
-  if (value === void 0) return false;
-  const normalized = value.trim().toLowerCase();
-  if (["1", "true", "yes", "on", "debug"].includes(normalized)) return true;
-  return false;
-};
-var getEnvArray = (key, defaultValue = []) => {
-  const value = getEnv(key);
-  if (!value) return defaultValue;
-  return value.split(/[,;\n]+/).map((v) => v.trim()).filter(Boolean);
-};
-
-// src/jose.ts
-var import_jose = require("@aura-stack/jose");
-
-// src/errors.ts
-var OAuthProtocolError = class extends Error {
-  type = "OAUTH_PROTOCOL_ERROR";
-  error;
-  errorURI;
-  constructor(error, description, errorURI, options2) {
-    super(description, options2);
-    this.error = error;
-    this.errorURI = errorURI;
-    this.name = new.target.name;
-    Error.captureStackTrace(this, new.target);
-  }
-};
-var AuthInternalError = class extends Error {
-  type = "AUTH_INTERNAL_ERROR";
-  code;
-  constructor(code, message, options2) {
-    super(message, options2);
-    this.code = code;
-    this.name = new.target.name;
-    Error.captureStackTrace(this, new.target);
-  }
-};
-var AuthSecurityError = class extends Error {
-  type = "AUTH_SECURITY_ERROR";
-  code;
-  constructor(code, message, options2) {
-    super(message, options2);
-    this.code = code;
-    this.name = new.target.name;
-    Error.captureStackTrace(this, new.target);
-  }
-};
-var AuthClientError = class extends Error {
-  type = "AUTH_CLIENT_ERROR";
-  code;
-  constructor(code, message, options2) {
-    super(message, options2);
-    this.code = code;
-    this.name = new.target.name;
-    Error.captureStackTrace(this, new.target);
-  }
-};
-var isNativeError = (error) => {
-  return error instanceof Error;
-};
-var isOAuthProtocolError = (error) => {
-  return error instanceof OAuthProtocolError;
-};
-var isAuthInternalError = (error) => {
-  return error instanceof AuthInternalError;
-};
-var isAuthSecurityError = (error) => {
-  return error instanceof AuthSecurityError;
-};
-
-// src/jose.ts
-var import_jose2 = require("@aura-stack/jose/jose");
-var import_crypto = require("@aura-stack/jose/crypto");
-var createJoseInstance = (secret) => {
-  secret ??= getEnv("SECRET");
-  if (!secret) {
-    throw new AuthInternalError(
-      "JOSE_INITIALIZATION_FAILED",
-      "AURA_AUTH_SECRET environment variable is not set and no secret was provided."
-    );
-  }
-  const salt = getEnv("SALT");
-  if (!salt) {
-    throw new AuthInternalError(
-      "JOSE_INITIALIZATION_FAILED",
-      "AURA_AUTH_SALT or AUTH_SALT environment variable is not set. A salt value is required for key derivation."
-    );
-  }
-  try {
-    (0, import_jose.createSecret)(salt);
-  } catch (error) {
-    throw new AuthInternalError(
-      "INVALID_SALT_SECRET_VALUE",
-      "AURA_AUTH_SALT/AUTH_SALT is invalid. It must be at least 32 bytes long and meet entropy requirements.",
-      { cause: error }
-    );
-  }
-  const jose = (async () => {
-    const derivedSigningKey = await (0, import_jose.createDeriveKey)(secret, salt, "signing");
-    const derivedEncryptionKey = await (0, import_jose.createDeriveKey)(secret, salt, "encryption");
-    const derivedCsrfTokenKey = await (0, import_jose.createDeriveKey)(secret, salt, "csrfToken");
-    return {
-      jwt: (0, import_jose.createJWT)({ jws: derivedSigningKey, jwe: derivedEncryptionKey }),
-      jws: (0, import_jose.createJWS)(derivedCsrfTokenKey),
-      jwe: (0, import_jose.createJWE)(derivedEncryptionKey)
-    };
-  })();
-  jose.catch(() => {
-  });
-  return {
-    decodeJWT: async (token, options2) => {
-      const { jwt } = await jose;
-      return jwt.decodeJWT(token, options2);
-    },
-    encodeJWT: async (payload) => {
-      const { jwt } = await jose;
-      return jwt.encodeJWT(payload);
-    },
-    signJWS: async (...args) => {
-      const { jws } = await jose;
-      return jws.signJWS(...args);
-    },
-    verifyJWS: async (...args) => {
-      const { jws } = await jose;
-      return jws.verifyJWS(...args);
-    },
-    encryptJWE: async (...args) => {
-      const { jwe } = await jose;
-      return jwe.encryptJWE(...args);
-    },
-    decryptJWE: async (...args) => {
-      const { jwe } = await jose;
-      return jwe.decryptJWE(...args);
-    }
-  };
-};
-var jwtVerificationOptions = {
-  algorithms: ["HS256"],
-  typ: "JWT"
-};
-
-// src/utils.ts
-var import_router = require("@aura-stack/router");
-
-// src/assert.ts
-var import_crypto2 = require("@aura-stack/jose/crypto");
-var unsafeChars = [
-  "<",
-  ">",
-  '"',
-  "`",
-  " ",
-  "\r",
-  "\n",
-  "	",
-  "\\",
-  "%2F",
-  "%5C",
-  "%2f",
-  "%5c",
-  "\r\n",
-  "%0A",
-  "%0D",
-  "%0a",
-  "%0d",
-  "..",
-  "//",
-  "///",
-  "...",
-  "%20",
-  "\0"
-];
-var isValidURL = (value) => {
-  if (!new RegExp(/^https?:\/\/[^/]/).test(value)) {
-    return false;
-  }
-  const match = value.match(/^(https?:\/\/)(.*)$/);
-  if (!match) return false;
-  const rest = match[2];
-  for (const char of unsafeChars) {
-    if (rest.includes(char)) return false;
-  }
-  const regex = /^https?:\/\/(?:[a-zA-Z0-9._-]+|localhost|\[[0-9a-fA-F:]+\])(?::\d{1,5})?(?:\/[a-zA-Z0-9._~!$&'()?#*+,;=:@-]*)*\/?$/;
-  return regex.test(match[0]);
-};
-var isJWTPayloadWithToken = (payload) => {
-  return typeof payload === "object" && payload !== null && "token" in payload && typeof payload?.token === "string";
-};
-var isRelativeURL = (value) => {
-  if (value.length > 100) return false;
-  for (const char of unsafeChars) {
-    if (value.includes(char)) return false;
-  }
-  const regex = /^\/[a-zA-Z0-9\-_\/.?&=#]*\/?$/;
-  return regex.test(value);
-};
-var isSameOrigin = (origin, expected) => {
-  const originURL = new URL(origin);
-  const expectedURL = new URL(expected);
-  return equals(originURL.origin, expectedURL.origin);
-};
-var patternToRegex = (pattern) => {
-  try {
-    if (pattern.length > 2048) return null;
-    pattern = pattern.replace(/\\/g, "");
-    const match = pattern.match(/^(https?):\/\/([a-zA-Z0-9.*-]{1,253})(?::(\d{1,5}|\*))?(?:\/.*)?$/);
-    if (!match) return null;
-    const [, protocol, host, port] = match;
-    const hasWildcard = host.includes("*");
-    if (hasWildcard && !host.startsWith("*.")) return null;
-    if (hasWildcard && host.slice(2).includes("*")) return null;
-    const domain = hasWildcard ? host.slice(2) : host;
-    const escapedDomain = domain.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const hostRegex = hasWildcard ? `[^.]+\\.${escapedDomain}` : escapedDomain;
-    const portRegex = port === "*" ? ":\\d{1,5}" : port ? `:${port}` : "";
-    return new RegExp(`^${protocol}:\\/\\/${hostRegex}${portRegex}$`);
-  } catch {
-    return null;
-  }
-};
-var isTrustedOrigin = (url, trustedOrigins) => {
-  if (!isValidURL(url) || trustedOrigins.length === 0) return false;
-  try {
-    const urlOrigin = new URL(url).origin;
-    for (const pattern of trustedOrigins) {
-      const regex = patternToRegex(pattern);
-      if (regex?.test(urlOrigin)) return true;
-      try {
-        if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return true;
-      } catch {
-      }
-    }
-  } catch {
-  }
-  return false;
-};
-var timingSafeEqual = (a, b) => {
-  const bufferA = import_crypto2.encoder.encode(a);
-  const bufferB = import_crypto2.encoder.encode(b);
-  const len = Math.max(bufferA.length, bufferB.length);
-  let diff = 0;
-  for (let i = 0; i < len; i++) {
-    diff |= (bufferA[i] ?? 0) ^ (bufferB[i] ?? 0);
-  }
-  return diff === 0 && bufferA.length === bufferB.length;
-};
-
-// src/utils.ts
-var AURA_AUTH_VERSION = "0.4.0";
-var equals = (a, b) => {
-  if (a === null || b === null || a === void 0 || b === void 0) return false;
-  return a === b;
-};
-var createErrorHandler = (logger) => {
-  return (error) => {
-    if ((0, import_router.isRouterError)(error)) {
-      const { message, status, statusText } = error;
-      logger?.log("ROUTER_INTERNAL_ERROR");
-      return Response.json({ type: "ROUTER_ERROR", code: "ROUTER_INTERNAL_ERROR", message }, { status, statusText });
-    }
-    if ((0, import_router.isInvalidZodSchemaError)(error)) {
-      logger?.log("INVALID_REQUEST");
-      return Response.json({ type: "ROUTER_ERROR", code: "INVALID_REQUEST", message: error.errors }, { status: 422 });
-    }
-    if (isOAuthProtocolError(error)) {
-      const { error: errorCode, message, type, errorURI } = error;
-      logger?.log("OAUTH_PROTOCOL_ERROR", {
-        structuredData: {
-          error: errorCode,
-          error_description: message,
-          error_uri: errorURI ?? ""
-        }
-      });
-      return Response.json(
-        {
-          type,
-          message
-        },
-        { status: 400 }
-      );
-    }
-    if (isAuthInternalError(error)) {
-      const { type, code, message } = error;
-      logger?.log("INVALID_OAUTH_CONFIGURATION", {
-        structuredData: {
-          error: code,
-          error_description: message
-        }
-      });
-      return Response.json(
-        {
-          type,
-          message
-        },
-        { status: 400 }
-      );
-    }
-    if (isAuthSecurityError(error)) {
-      const { type, code, message } = error;
-      logger?.log("INVALID_OAUTH_CONFIGURATION", {
-        structuredData: {
-          error: code,
-          error_description: message
-        }
-      });
-      return Response.json(
-        {
-          type,
-          code,
-          message
-        },
-        { status: 400 }
-      );
-    }
-    logger?.log("SERVER_ERROR");
-    return Response.json(
-      { type: "SERVER_ERROR", code: "SERVER_ERROR", message: "An unexpected error occurred" },
-      { status: 500 }
-    );
-  };
-};
-var getBaseURL = (request) => {
-  const url = new URL(request.url);
-  return `${url.origin}${url.pathname}`;
-};
-var toISOString = (date) => {
-  return new Date(date).toISOString();
-};
-var useSecureCookies = (request, trustedProxyHeaders) => {
-  const headers = request instanceof Headers ? request : request.headers;
-  const url = request instanceof Headers ? null : request.url;
-  return trustedProxyHeaders ? url?.startsWith("https://") || headers.get("X-Forwarded-Proto") === "https" || (headers.get("Forwarded")?.includes("proto=https") ?? false) : url?.startsWith("https://") ?? false;
-};
-var formatZodError = (error) => {
-  if (!error.issues || error.issues.length === 0) {
-    return {};
-  }
-  return error.issues.reduce((previous, issue) => {
-    const key = issue.path.join(".");
-    return {
-      ...previous,
-      [key]: {
-        code: issue.code,
-        message: issue.message
-      }
-    };
-  }, {});
-};
-var extractPath = (url) => {
-  const pathRegex = /^https?:\/\/[a-zA-Z0-9_\-\.]+(:\d+)?(\/.*)$/;
-  const match = url.match(pathRegex);
-  return match && match[2] ? match[2] : "/";
-};
-var createStructuredData = (data, sdID = "metadata") => {
-  const entries = Object.entries(data);
-  if (entries.length === 0) return `[${sdID}]`;
-  const values = entries.map(([key, value]) => `${key}="${String(value).replace(/(["\\\]])/g, "\\$1")}"`).join(" ");
-  return `[${sdID} ${values}]`;
-};
-var getErrorName = (error) => {
-  if (error instanceof Error) {
-    return error.name;
-  }
-  return typeof error === "string" ? error : "UnknownError";
-};
-var createBasicAuthHeader = (username, password) => {
-  const getUsername = getEnv(username.toUpperCase()) ?? username;
-  const getPassword = getEnv(password.toUpperCase()) ?? password;
-  if (!getUsername || !getPassword) {
-    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "Missing client credentials for OAuth provider configuration.");
-  }
-  const credentials = `${getUsername}:${getPassword}`;
-  return `Basic ${btoa(credentials)}`;
-};
-var validateRedirectTo = (url) => {
-  if (!isRelativeURL(url) && !isValidURL(url)) return "/";
-  if (isRelativeURL(url)) return url;
-  return "/";
-};
-
-// src/logger.ts
-var logMessages = {
-  ROUTER_INTERNAL_ERROR: {
-    facility: 10,
-    severity: "error",
-    msgId: "ROUTER_INTERNAL_ERROR",
-    message: "Unhandled router error while processing the request"
-  },
-  INVALID_REQUEST: {
-    facility: 10,
-    severity: "warning",
-    msgId: "INVALID_REQUEST",
-    message: "Request validation failed against the expected schema"
-  },
-  SERVER_ERROR: {
-    facility: 10,
-    severity: "error",
-    msgId: "SERVER_ERROR",
-    message: "Unexpected internal server error during authentication"
-  },
-  OAUTH_PROTOCOL_ERROR: {
-    facility: 10,
-    severity: "warning",
-    msgId: "OAUTH_PROTOCOL_ERROR",
-    message: "OAuth provider returned an invalid or unexpected protocol response"
-  },
-  OAUTH_AUTHORIZATION_ERROR: {
-    facility: 10,
-    severity: "error",
-    msgId: "OAUTH_AUTHORIZATION_ERROR",
-    message: "OAuth authorization request was rejected or failed"
-  },
-  INVALID_OAUTH_CONFIGURATION: {
-    facility: 10,
-    severity: "error",
-    msgId: "INVALID_OAUTH_CONFIGURATION",
-    message: "The OAuth provider configuration is invalid or incomplete"
-  },
-  OAUTH_ACCESS_TOKEN_REQUEST_INITIATED: {
-    facility: 10,
-    severity: "debug",
-    msgId: "OAUTH_ACCESS_TOKEN_REQUEST_INITIATED",
-    message: "Starting OAuth access token request to the provider"
-  },
-  INVALID_OAUTH_ACCESS_TOKEN_RESPONSE: {
-    facility: 10,
-    severity: "error",
-    msgId: "INVALID_OAUTH_ACCESS_TOKEN_RESPONSE",
-    message: "OAuth access token endpoint returned an invalid or malformed response"
-  },
-  OAUTH_ACCESS_TOKEN_ERROR: {
-    facility: 10,
-    severity: "error",
-    msgId: "OAUTH_ACCESS_TOKEN_ERROR",
-    message: "OAuth access token endpoint returned an error response"
-  },
-  OAUTH_ACCESS_TOKEN_SUCCESS: {
-    facility: 10,
-    severity: "info",
-    msgId: "OAUTH_ACCESS_TOKEN_SUCCESS",
-    message: "Successfully retrieved OAuth access token from the provider"
-  },
-  OAUTH_ACCESS_TOKEN_REQUEST_FAILED: {
-    facility: 10,
-    severity: "error",
-    msgId: "OAUTH_ACCESS_TOKEN_REQUEST_FAILED",
-    message: "Network or server error while requesting OAuth access token"
-  },
-  OAUTH_USERINFO_REQUEST_INITIATED: {
-    facility: 10,
-    severity: "debug",
-    msgId: "OAUTH_USERINFO_REQUEST_INITIATED",
-    message: "Starting OAuth userinfo request to the provider"
-  },
-  OAUTH_USERINFO_INVALID_RESPONSE: {
-    facility: 10,
-    severity: "error",
-    msgId: "OAUTH_USERINFO_INVALID_RESPONSE",
-    message: "OAuth userinfo endpoint returned an invalid or malformed response"
-  },
-  OAUTH_USERINFO_ERROR: {
-    facility: 10,
-    severity: "error",
-    msgId: "OAUTH_USERINFO_ERROR",
-    message: "OAuth userinfo endpoint returned an error response"
-  },
-  OAUTH_USERINFO_SUCCESS: {
-    facility: 10,
-    severity: "info",
-    msgId: "OAUTH_USERINFO_SUCCESS",
-    message: "Successfully retrieved user information from the OAuth provider"
-  },
-  OAUTH_USERINFO_REQUEST_FAILED: {
-    facility: 10,
-    severity: "error",
-    msgId: "OAUTH_USERINFO_REQUEST_FAILED",
-    message: "Network or server error while requesting user information from the OAuth provider"
-  },
-  OAUTH_CALLBACK_SUCCESS: {
-    facility: 4,
-    severity: "info",
-    msgId: "OAUTH_CALLBACK_SUCCESS",
-    message: "OAuth callback completed successfully and session was created"
-  },
-  MISMATCHING_STATE: {
-    facility: 4,
-    severity: "critical",
-    msgId: "MISMATCHING_STATE",
-    message: "OAuth response state parameter does not match the stored state value"
-  },
-  POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED: {
-    facility: 4,
-    severity: "critical",
-    msgId: "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED",
-    message: "Blocked redirect to untrusted or external URL (potential open redirect attack)"
-  },
-  OPEN_REDIRECT_ATTACK: {
-    facility: 4,
-    severity: "warning",
-    msgId: "OPEN_REDIRECT_ATTACK",
-    message: "Detected redirect target that does not match the trusted origin"
-  },
-  SESSION_TOKEN_MISSING: {
-    facility: 4,
-    severity: "warning",
-    msgId: "SESSION_TOKEN_MISSING",
-    message: "Session cookie is missing from the request"
-  },
-  CSRF_TOKEN_MISSING: {
-    facility: 4,
-    severity: "warning",
-    msgId: "CSRF_TOKEN_MISSING",
-    message: "CSRF token cookie is missing from the request"
-  },
-  CSRF_HEADER_MISSING: {
-    facility: 4,
-    severity: "warning",
-    msgId: "CSRF_HEADER_MISSING",
-    message: "CSRF header is missing from the request"
-  },
-  CSRF_TOKEN_INVALID: {
-    facility: 4,
-    severity: "error",
-    msgId: "CSRF_TOKEN_INVALID",
-    message: "CSRF token verification failed or token is invalid"
-  },
-  SIGN_IN_INITIATED: {
-    facility: 4,
-    severity: "info",
-    msgId: "SIGN_IN_INITIATED",
-    message: "Starting OAuth sign-in flow for the selected provider"
-  },
-  SIGN_OUT_ATTEMPT: {
-    facility: 4,
-    severity: "debug",
-    msgId: "SIGN_OUT_ATTEMPT",
-    message: "Received sign-out request from client"
-  },
-  SIGN_OUT_CSRF_VERIFIED: {
-    facility: 4,
-    severity: "info",
-    msgId: "SIGN_OUT_CSRF_VERIFIED",
-    message: "CSRF token was successfully verified during sign-out"
-  },
-  SIGN_OUT_SUCCESS: {
-    facility: 4,
-    severity: "info",
-    msgId: "SIGN_OUT_SUCCESS",
-    message: "User session was cleared and sign-out completed successfully"
-  },
-  SIGN_OUT_REDIRECT: {
-    facility: 4,
-    severity: "debug",
-    msgId: "SIGN_OUT_REDIRECT",
-    message: "Redirecting client after successful sign-out"
-  },
-  AUTH_SESSION_VALID: {
-    facility: 4,
-    severity: "info",
-    msgId: "AUTH_SESSION_VALID",
-    message: "Session token is valid and user session was returned"
-  },
-  AUTH_SESSION_INVALID: {
-    facility: 4,
-    severity: "notice",
-    msgId: "AUTH_SESSION_INVALID",
-    message: "Session token is missing, expired, or invalid"
-  },
-  INVALID_JWT_TOKEN: {
-    facility: 4,
-    severity: "warning",
-    msgId: "INVALID_JWT_TOKEN",
-    message: "JWT session token failed validation during sign-out"
-  },
-  CSRF_TOKEN_REQUESTED: {
-    facility: 4,
-    severity: "debug",
-    msgId: "CSRF_TOKEN_REQUESTED",
-    message: "Client requested a CSRF token"
-  },
-  CSRF_TOKEN_ISSUED: {
-    facility: 4,
-    severity: "debug",
-    msgId: "CSRF_TOKEN_ISSUED",
-    message: "Issued a new CSRF token to the client"
-  },
-  INVALID_URL: {
-    facility: 10,
-    severity: "error",
-    msgId: "INVALID_URL",
-    message: "Derived origin URL is invalid or malformed"
-  },
-  COOKIE_HTTPONLY_DISABLED: {
-    facility: 10,
-    severity: "critical",
-    msgId: "COOKIE_HTTPONLY_DISABLED",
-    message: "Cookie is configured without HttpOnly. This allows JavaScript access via document.cookie and increases XSS exposure."
-  },
-  COOKIE_WILDCARD_DOMAIN: {
-    facility: 10,
-    severity: "critical",
-    msgId: "COOKIE_WILDCARD_DOMAIN",
-    message: "Cookie 'Domain' is set to a wildcard, which is insecure and should be avoided."
-  },
-  COOKIE_SECURE_DISABLED: {
-    facility: 10,
-    severity: "warning",
-    msgId: "COOKIE_SECURE_DISABLED",
-    message: "Cookie is configured with 'Secure' but the request is not HTTPS. The 'Secure' attribute will be ignored by the browser."
-  },
-  COOKIE_SAMESITE_NONE_WITHOUT_SECURE: {
-    facility: 10,
-    severity: "warning",
-    msgId: "COOKIE_SAMESITE_NONE_WITHOUT_SECURE",
-    message: "Cookie uses SameSite=None without Secure. Falling back to SameSite=Lax for safer defaults."
-  },
-  COOKIE_INSECURE_IN_PRODUCTION: {
-    facility: 10,
-    severity: "critical",
-    msgId: "COOKIE_INSECURE_IN_PRODUCTION",
-    message: "Cookies are being served over an insecure connection in production, which is a serious security risk."
-  },
-  COOKIE_HOST_STRATEGY_INSECURE: {
-    facility: 10,
-    severity: "critical",
-    msgId: "COOKIE_HOST_STRATEGY_INSECURE",
-    message: "__Host- cookies require a secure HTTPS context. Falling back to standard cookie settings."
-  },
-  UNTRUSTED_ORIGIN: {
-    facility: 10,
-    severity: "error",
-    msgId: "UNTRUSTED_ORIGIN",
-    message: "The constructed origin URL is not trusted."
-  }
-};
-var createLogEntry = (key, overrides) => {
-  const message = logMessages[key];
-  return {
-    ...message,
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    hostname: "aura-auth",
-    procId: typeof process !== "undefined" && process.pid ? process.pid.toString() : "-",
-    ...overrides
-  };
-};
-var logLevelToSeverity = {
-  debug: ["debug", "info", "notice", "warning", "error", "critical", "alert", "emergency"],
-  info: ["info", "notice", "warning", "error", "critical", "alert", "emergency"],
-  warn: ["warning", "error", "critical", "alert", "emergency"],
-  error: ["error", "critical", "alert", "emergency"]
-};
-var isValidLogLevel = (value) => {
-  return value === "debug" || value === "info" || value === "warn" || value === "error";
-};
-var getSeverityLevel = (severity) => {
-  const severities = {
-    emergency: 0,
-    alert: 1,
-    critical: 2,
-    error: 3,
-    warning: 4,
-    notice: 5,
-    info: 6,
-    debug: 7
-  };
-  return severities[severity] ?? 6;
-};
-var createSyslogMessage = (options2) => {
-  const { timestamp, hostname, appName = "aura-auth", procId = "-", msgId, structuredData, message } = options2;
-  const pri = (options2.facility ?? 16) * 8 + getSeverityLevel(options2.severity);
-  const structuredDataStr = createStructuredData(structuredData ?? {});
-  return `<${pri}>1 ${timestamp} ${hostname} ${appName} ${procId} ${msgId} ${structuredDataStr} ${message}`;
-};
-var createLogger = (logger) => {
-  if (!logger) return void 0;
-  const level = logger.level;
-  const allowedSeverities = logLevelToSeverity[level] ?? [];
-  return {
-    level,
-    log(key, overrides) {
-      const entry = createLogEntry(key, overrides);
-      if (!allowedSeverities.includes(entry.severity)) return entry;
-      logger.log({
-        timestamp: entry.timestamp,
-        appName: entry.appName ?? "aura-auth",
-        hostname: entry.hostname ?? "aura-auth",
-        ...entry
-      });
-      return entry;
-    }
-  };
-};
-var createProxyLogger = (config2) => {
-  const level = getEnv("LOG_LEVEL");
-  const debug = getEnvBoolean("DEBUG");
-  if (typeof config2?.logger === "object") {
-    return createLogger({
-      log: config2.logger?.log || createSyslogMessage,
-      level: isValidLogLevel(config2.logger?.level) ? config2.logger?.level : isValidLogLevel(level) ? level : "error"
-    });
-  }
-  if (debug || config2?.logger === true || level) {
-    return createLogger({
-      level: isValidLogLevel(level) ? level : "debug",
-      log: (options2) => {
-        const message = createSyslogMessage(options2);
-        console.log(message);
-      }
-    });
-  }
-  return void 0;
-};
-
-// src/cookie.ts
-var import_cookie = require("@aura-stack/router/cookie");
-var COOKIE_NAME = "aura-auth";
-var defaultCookieOptions = {
-  httpOnly: true,
-  sameSite: "lax",
-  path: "/",
-  maxAge: 60 * 60 * 24 * 15
-};
-var defaultStandardCookieConfig = {
-  secure: false,
-  httpOnly: true
-};
-var defaultSecureCookieConfig = {
-  secure: true,
-  httpOnly: true
-};
-var defaultHostCookieConfig = {
-  secure: true,
-  httpOnly: true,
-  path: "/",
-  domain: void 0
-};
-var oauthCookieOptions = {
-  httpOnly: true,
-  maxAge: 5 * 60,
-  sameSite: "lax",
-  expires: new Date(Date.now() + 5 * 60 * 1e3)
-};
-var setCookie = (cookieName, value, options2) => {
-  return (0, import_cookie.serialize)(cookieName, value, options2);
-};
-var expiredCookieAttributes = {
-  ...defaultCookieOptions,
-  expires: /* @__PURE__ */ new Date(0),
-  maxAge: 0,
-  secure: true
-};
-var getCookie = (request, cookieName) => {
-  const cookies = request instanceof Request ? request.headers.get("Cookie") : request.get("Cookie");
-  if (!cookies) {
-    throw new AuthInternalError("COOKIE_NOT_FOUND", "No cookies found. There is no active session");
-  }
-  const value = (0, import_cookie.parse)(cookies)[cookieName];
-  if (!value) {
-    throw new AuthInternalError("COOKIE_NOT_FOUND", `Cookie "${cookieName}" not found. There is no active session`);
-  }
-  return value;
-};
-var createSessionCookie = async (jose, session) => {
-  try {
-    const encoded = await jose.encodeJWT(session);
-    return encoded;
-  } catch (error) {
-    throw new AuthInternalError("INVALID_JWT_TOKEN", "Failed to create session cookie", { cause: error });
-  }
-};
-var defineSecureCookieOptions = (useSecure, attributes, strategy, logger) => {
-  if (!attributes.httpOnly) {
-    logger?.log("COOKIE_HTTPONLY_DISABLED");
-  }
-  if (attributes.domain === "*") {
-    attributes.domain = void 0;
-    logger?.log("COOKIE_WILDCARD_DOMAIN");
-  }
-  if (!useSecure) {
-    if (attributes.secure) {
-      logger?.log("COOKIE_SECURE_DISABLED");
-    }
-    if (attributes.sameSite == "none") {
-      attributes.sameSite = "lax";
-      logger?.log("COOKIE_SAMESITE_NONE_WITHOUT_SECURE");
-    }
-    if (env.NODE_ENV === "production") {
-      logger?.log("COOKIE_INSECURE_IN_PRODUCTION");
-    }
-    if (strategy === "host") {
-      logger?.log("COOKIE_HOST_STRATEGY_INSECURE");
-    }
-    return {
-      ...defaultCookieOptions,
-      ...attributes,
-      ...defaultStandardCookieConfig
-    };
-  }
-  return strategy === "host" ? {
-    ...defaultCookieOptions,
-    ...attributes,
-    ...defaultHostCookieConfig
-  } : { ...defaultCookieOptions, ...attributes, ...defaultSecureCookieConfig };
-};
-var createCookieStore = (useSecure, prefix, overrides, logger) => {
-  prefix ??= COOKIE_NAME;
-  const securePrefix = useSecure ? "__Secure-" : "";
-  const hostPrefix = useSecure ? "__Host-" : "";
-  return {
-    sessionToken: {
-      name: `${securePrefix}${prefix}.${overrides?.sessionToken?.name ?? "session_token"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...defaultCookieOptions,
-          ...overrides?.sessionToken?.attributes
-        },
-        overrides?.sessionToken?.attributes?.strategy ?? "secure",
-        logger
-      )
-    },
-    state: {
-      name: `${securePrefix}${prefix}.${overrides?.state?.name ?? "state"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...oauthCookieOptions,
-          ...overrides?.state?.attributes
-        },
-        overrides?.state?.attributes?.strategy ?? "secure",
-        logger
-      )
-    },
-    csrfToken: {
-      name: `${hostPrefix}${prefix}.${overrides?.csrfToken?.name ?? "csrf_token"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...overrides?.csrfToken?.attributes,
-          ...defaultHostCookieConfig,
-          sameSite: "strict"
-        },
-        overrides?.csrfToken?.attributes?.strategy ?? "host",
-        logger
-      )
-    },
-    redirectTo: {
-      name: `${securePrefix}${prefix}.${overrides?.redirectTo?.name ?? "redirect_to"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...oauthCookieOptions,
-          ...overrides?.redirectTo?.attributes
-        },
-        overrides?.redirectTo?.attributes?.strategy ?? "secure",
-        logger
-      )
-    },
-    redirectURI: {
-      name: `${securePrefix}${prefix}.${overrides?.redirectURI?.name ?? "redirect_uri"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...oauthCookieOptions,
-          ...overrides?.redirectURI?.attributes
-        },
-        overrides?.redirectURI?.attributes?.strategy ?? "secure",
-        logger
-      )
-    },
-    codeVerifier: {
-      name: `${securePrefix}${prefix}.${overrides?.codeVerifier?.name ?? "code_verifier"}`,
-      attributes: defineSecureCookieOptions(
-        useSecure,
-        {
-          ...oauthCookieOptions,
-          ...overrides?.codeVerifier?.attributes
-        },
-        overrides?.codeVerifier?.attributes?.strategy ?? "secure",
-        logger
-      )
-    }
-  };
-};
-
-// src/oauth/github.ts
-var github = (options2) => {
-  return {
-    id: "github",
-    name: "GitHub",
-    authorizeURL: "https://github.com/login/oauth/authorize",
-    accessToken: "https://github.com/login/oauth/access_token",
-    userInfo: "https://api.github.com/user",
-    scope: "read:user user:email",
-    responseType: "code",
-    profile: (profile) => {
-      return {
-        sub: profile.id.toString(),
-        name: profile.name ?? profile.login,
-        email: profile.email ?? void 0,
-        image: profile.avatar_url
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/bitbucket.ts
-var bitbucket = (options2) => {
-  return {
-    id: "bitbucket",
-    name: "Bitbucket",
-    authorizeURL: "https://bitbucket.org/site/oauth2/authorize",
-    accessToken: "https://bitbucket.org/site/oauth2/access_token",
-    userInfo: "https://api.bitbucket.org/2.0/user",
-    scope: "account email",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.uuid ?? profile.account_id,
-        name: profile.display_name ?? profile.nickname,
-        image: profile.links.avatar?.href,
-        email: void 0
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/figma.ts
-var figma = (options2) => {
-  return {
-    id: "figma",
-    name: "Figma",
-    authorizeURL: "https://www.figma.com/oauth",
-    accessToken: "https://api.figma.com/v1/oauth/token",
-    userInfo: "https://api.figma.com/v1/me",
-    scope: "current_user:read",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.id,
-        name: profile.handle,
-        email: profile.email,
-        image: profile.img_url
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/discord.ts
-var discord = (options2) => {
-  return {
-    id: "discord",
-    name: "Discord",
-    authorizeURL: "https://discord.com/oauth2/authorize",
-    accessToken: "https://discord.com/api/oauth2/token",
-    userInfo: "https://discord.com/api/users/@me",
-    scope: "identify email",
-    responseType: "code",
-    profile(profile) {
-      let image = "";
-      if (profile.avatar === null) {
-        const index = profile.discriminator === "0" ? (BigInt(profile.id) >> 22n) % 6n : Number(profile.discriminator) % 5;
-        image = `https://cdn.discordapp.com/embed/avatars/${index}.png`;
-      } else {
-        const format = profile.avatar.startsWith("a_") ? "gif" : "png";
-        image = `https://cdn.discordapp.com/avatars/${profile.id}/${profile.avatar}.${format}`;
-      }
-      return {
-        sub: profile.id,
-        name: profile.global_name ?? profile.username,
-        email: profile.email ?? "",
-        image
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/gitlab.ts
-var gitlab = (options2) => {
-  return {
-    id: "gitlab",
-    name: "GitLab",
-    authorizeURL: "https://gitlab.com/oauth/authorize",
-    accessToken: "https://gitlab.com/oauth/token",
-    userInfo: "https://gitlab.com/api/v4/user",
-    scope: "read_user",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.id.toString(),
-        name: profile.name ?? profile.username,
-        email: profile.email,
-        image: profile.avatar_url
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/spotify.ts
-var spotify = (options2) => {
-  return {
-    id: "spotify",
-    name: "Spotify",
-    authorizeURL: "https://accounts.spotify.com/authorize",
-    accessToken: "https://accounts.spotify.com/api/token",
-    userInfo: "https://api.spotify.com/v1/me",
-    scope: "user-read-private user-read-email",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.id,
-        name: profile.display_name,
-        email: profile.email,
-        image: profile.images[0]?.url ?? void 0
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/x.ts
-var x = (options2) => {
-  return {
-    id: "x",
-    name: "X",
-    authorizeURL: "https://twitter.com/i/oauth2/authorize",
-    accessToken: "https://api.twitter.com/2/oauth2/token",
-    userInfo: "https://api.twitter.com/2/users/me?user.fields=profile_image_url",
-    scope: "tweet.read users.read offline.access",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.data.id,
-        name: profile.data.name,
-        image: profile.data.profile_image_url,
-        email: void 0
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/strava.ts
-var strava = (options2) => {
-  return {
-    id: "strava",
-    name: "Strava",
-    authorizeURL: "https://www.strava.com/oauth/authorize",
-    accessToken: "https://www.strava.com/oauth/token",
-    userInfo: "https://www.strava.com/api/v3/athlete",
-    scope: "read",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.id.toString(),
-        name: `${profile.firstname} ${profile.lastname}`,
-        image: profile.profile,
-        email: void 0
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/mailchimp.ts
-var mailchimp = (options2) => {
-  return {
-    id: "mailchimp",
-    name: "Mailchimp",
-    authorizeURL: "https://login.mailchimp.com/oauth2/authorize",
-    accessToken: "https://login.mailchimp.com/oauth2/token",
-    userInfo: "https://login.mailchimp.com/oauth2/metadata",
-    scope: "",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.user_id,
-        name: profile.accountname,
-        email: profile.login.email,
-        image: profile.login.avatar
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/pinterest.ts
-var pinterest = (options2) => {
-  return {
-    id: "pinterest",
-    name: "Pinterest",
-    authorizeURL: "https://www.pinterest.com/oauth",
-    accessToken: "https://api.pinterest.com/v5/oauth/token",
-    userInfo: "https://api.pinterest.com/v5/user_account",
-    scope: "user_accounts:read",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.id,
-        name: profile.username,
-        image: profile.profile_image,
-        email: void 0
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/twitch.ts
-var twitch = (options2) => {
-  const clientId = options2?.clientId ?? getEnv("TWITCH_CLIENT_ID");
-  return {
-    id: "twitch",
-    name: "Twitch",
-    authorize: {
-      url: "https://id.twitch.tv/oauth2/authorize",
-      params: { scope: "user:read:email", responseType: "code" }
-    },
-    accessToken: "https://id.twitch.tv/oauth2/token",
-    userInfo: {
-      url: "https://api.twitch.tv/helix/users",
-      headers: {
-        "Client-ID": clientId
-      }
-    },
-    profile(profile) {
-      const user = profile.data[0];
-      if (!user) {
-        throw new Error("No user data found in Twitch profile response");
-      }
-      return {
-        sub: user.id,
-        name: user.display_name,
-        email: user.email,
-        picture: user.profile_image_url
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/notion.ts
-var notion = (options2) => {
-  return {
-    id: "notion",
-    name: "Notion",
-    authorize: {
-      url: "https://api.notion.com/v1/oauth/authorize",
-      params: {
-        owner: "user",
-        scope: "user:read",
-        responseType: "code"
-      }
-    },
-    accessToken: {
-      url: "https://api.notion.com/v1/oauth/token",
-      headers: {
-        Authorization: createBasicAuthHeader(
-          options2?.clientId ?? "NOTION_CLIENT_ID",
-          options2?.clientSecret ?? "NOTION_CLIENT_SECRET"
-        )
-      }
-    },
-    userInfo: {
-      url: "https://api.notion.com/v1/users/me",
-      headers: {
-        "Notion-Version": "2022-06-28"
-      }
-    },
-    profile(profile) {
-      return {
-        sub: profile.id,
-        name: profile.name,
-        image: profile.avatar_url ?? "",
-        email: profile?.bot?.owner?.user?.person?.email
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/dropbox.ts
-var dropbox = (options2) => {
-  return {
-    id: "dropbox",
-    name: "Dropbox",
-    authorize: {
-      url: "https://www.dropbox.com/oauth2/authorize",
-      params: { scope: "account_info.read" }
-    },
-    accessToken: "https://api.dropboxapi.com/oauth2/token",
-    userInfo: {
-      method: "POST",
-      url: "https://api.dropboxapi.com/2/users/get_current_account"
-    },
-    profile(profile) {
-      return {
-        sub: profile.account_id,
-        name: profile.name.display_name,
-        email: profile.email,
-        image: profile.profile_photo_url
-      };
-    },
-    ...options2
-  };
-};
-
-// src/oauth/atlassian.ts
-var atlassian = (options2) => {
-  return {
-    id: "atlassian",
-    name: "Atlassian",
-    authorize: {
-      url: "https://auth.atlassian.com/authorize",
-      params: {
-        audience: "api.atlassian.com",
-        scope: "read:me read:account",
-        prompt: "consent"
-      }
-    },
-    authorizeURL: "https://auth.atlassian.com/authorize",
-    accessToken: "https://auth.atlassian.com/oauth/token",
-    userInfo: "https://api.atlassian.com/me",
-    scope: "read:me read:account",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.account_id,
-        name: profile.name,
-        email: profile.email,
-        image: profile.picture
-      };
-    },
-    ...options2
-  };
-};
-
-// src/schemas.ts
-var import_v4 = require("zod/v4");
-var AuthorizeConfigSchema = import_v4.z.union([
-  (0, import_v4.string)().url(),
-  (0, import_v4.object)({
-    url: (0, import_v4.string)().url(),
-    params: (0, import_v4.object)({
-      responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
-      scope: (0, import_v4.string)().optional()
-    })
-  })
-]);
-var AccessTokenConfigSchema = import_v4.z.union([
-  (0, import_v4.string)().url(),
-  (0, import_v4.object)({
-    url: (0, import_v4.string)().url(),
-    headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional()
-  })
-]);
-var UserInfoConfigSchema = import_v4.z.union([
-  (0, import_v4.string)().url(),
-  (0, import_v4.object)({
-    url: (0, import_v4.string)().url(),
-    headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional(),
-    method: (0, import_v4.string)().optional()
-  })
-]);
-var OAuthProviderCredentialsSchema = (0, import_v4.object)({
-  id: (0, import_v4.string)(),
-  name: (0, import_v4.string)(),
-  authorize: AuthorizeConfigSchema.optional(),
-  /** @deprecated */
-  authorizeURL: (0, import_v4.string)().url().optional(),
-  accessToken: AccessTokenConfigSchema,
-  /** @deprecated */
-  scope: (0, import_v4.string)().optional(),
-  userInfo: UserInfoConfigSchema,
-  /** @deprecated */
-  responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
-  clientId: (0, import_v4.string)(),
-  clientSecret: (0, import_v4.string)(),
-  profile: import_v4.z.function().optional()
-});
-var OAuthProviderConfigSchema = (0, import_v4.object)({
-  authorize: AuthorizeConfigSchema.optional(),
-  /** @deprecated */
-  authorizeURL: (0, import_v4.string)().url().optional(),
-  accessToken: AccessTokenConfigSchema,
-  /** @deprecated */
-  scope: (0, import_v4.string)().optional(),
-  userInfo: UserInfoConfigSchema,
-  /** @deprecated */
-  responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
-  clientId: (0, import_v4.string)(),
-  clientSecret: (0, import_v4.string)()
-});
-var OAuthAuthorization = OAuthProviderConfigSchema.extend({
-  redirectURI: (0, import_v4.string)(),
-  state: (0, import_v4.string)(),
-  codeChallenge: (0, import_v4.string)(),
-  codeChallengeMethod: (0, import_v4.enum)(["plain", "S256"])
-});
-var OAuthAuthorizationResponse = (0, import_v4.object)({
-  state: (0, import_v4.string)({ message: "Missing state parameter in the OAuth authorization response." }),
-  code: (0, import_v4.string)({ message: "Missing code parameter in the OAuth authorization response." })
-});
-var OAuthAuthorizationErrorResponse = (0, import_v4.object)({
-  error: (0, import_v4.enum)([
-    "invalid_request",
-    "unauthorized_client",
-    "access_denied",
-    "unsupported_response_type",
-    "invalid_scope",
-    "server_error",
-    "temporarily_unavailable"
-  ]),
-  error_description: (0, import_v4.string)().optional(),
-  error_uri: (0, import_v4.string)().optional(),
-  state: (0, import_v4.string)()
-});
-var OAuthAccessToken = OAuthProviderConfigSchema.extend({
-  redirectURI: (0, import_v4.string)(),
-  code: (0, import_v4.string)(),
-  codeVerifier: (0, import_v4.string)().min(43).max(128)
-});
-var OAuthAccessTokenResponse = (0, import_v4.object)({
-  access_token: (0, import_v4.string)(),
-  token_type: (0, import_v4.string)().optional(),
-  expires_in: (0, import_v4.number)().optional(),
-  refresh_token: (0, import_v4.string)().optional(),
-  scope: (0, import_v4.union)([(0, import_v4.string)().optional().or((0, import_v4.null)()), (0, import_v4.array)((0, import_v4.string)()).optional()])
-});
-var OAuthAccessTokenErrorResponse = (0, import_v4.object)({
-  error: (0, import_v4.enum)([
-    "invalid_request",
-    "invalid_client",
-    "invalid_grant",
-    "unauthorized_client",
-    "unsupported_grant_type",
-    "invalid_scope"
-  ]),
-  error_description: (0, import_v4.string)().optional(),
-  error_uri: (0, import_v4.string)().optional()
-});
-var OAuthErrorResponse = (0, import_v4.object)({
-  error: (0, import_v4.string)(),
-  error_description: (0, import_v4.string)().optional()
-});
-var OAuthEnvSchema = (0, import_v4.object)({
-  clientId: import_v4.z.string().min(1, "OAuth Client ID is required in the environment variables."),
-  clientSecret: import_v4.z.string().min(1, "OAuth Client Secret is required in the environment variables.")
-});
-
-// src/oauth/index.ts
-var builtInOAuthProviders = {
-  github,
-  bitbucket,
-  figma,
-  discord,
-  gitlab,
-  spotify,
-  x,
-  strava,
-  mailchimp,
-  pinterest,
-  twitch,
-  notion,
-  dropbox,
-  atlassian
-};
-var defineOAuthEnvironment = (oauth) => {
-  const loadEnvs = OAuthEnvSchema.safeParse({
-    clientId: getEnv(`${oauth.toUpperCase()}_CLIENT_ID`),
-    clientSecret: getEnv(`${oauth.toUpperCase()}_CLIENT_SECRET`)
-  });
-  if (!loadEnvs.success) {
-    const msg = JSON.stringify({ [oauth]: formatZodError(loadEnvs.error) }, null, 2);
-    throw new AuthInternalError("INVALID_ENVIRONMENT_CONFIGURATION", msg);
-  }
-  return loadEnvs.data;
-};
-var defineOAuthProviderConfig = (config2) => {
-  if (typeof config2 === "string") {
-    const definition = defineOAuthEnvironment(config2);
-    const oauthConfig = builtInOAuthProviders[config2]();
-    const parsed2 = OAuthProviderCredentialsSchema.safeParse({ ...oauthConfig, ...definition });
-    if (!parsed2.success) {
-      const details = JSON.stringify({ [config2]: formatZodError(parsed2.error) }, null, 2);
-      throw new AuthInternalError(
-        "INVALID_OAUTH_PROVIDER_CONFIGURATION",
-        `Invalid configuration for OAuth provider "${config2}": ${details}`
-      );
-    }
-    return parsed2.data;
-  }
-  const hasCredentials = config2.clientId && config2.clientSecret;
-  const envConfig = hasCredentials ? {} : defineOAuthEnvironment(config2.id);
-  const parsed = OAuthProviderCredentialsSchema.safeParse({ ...envConfig, ...config2 });
-  if (!parsed.success) {
-    const details = JSON.stringify({ [config2.id]: formatZodError(parsed.error) }, null, 2);
-    throw new AuthInternalError(
-      "INVALID_OAUTH_PROVIDER_CONFIGURATION",
-      `Invalid configuration for OAuth provider "${config2.id}": ${details}`
-    );
-  }
-  return parsed.data;
-};
-var createBuiltInOAuthProviders = (oauth = []) => {
-  return oauth.reduce((previous, config2) => {
-    const oauthConfig = defineOAuthProviderConfig(config2);
-    if (oauthConfig.id in previous) {
-      throw new AuthInternalError(
-        "DUPLICATED_OAUTH_PROVIDER_ID",
-        `Duplicate OAuth provider id "${oauthConfig.id}" found. Each provider must have a unique id.`
-      );
-    }
-    return { ...previous, [oauthConfig.id]: oauthConfig };
-  }, {});
-};
-
-// src/context.ts
-var createContext = (config2) => {
-  const trustedProxyHeadersEnv = getEnv("TRUSTED_PROXY_HEADERS");
-  const useProxyHeaders = trustedProxyHeadersEnv === void 0 ? config2?.trustedProxyHeaders ?? false : getEnvBoolean("TRUSTED_PROXY_HEADERS");
-  const logger = createProxyLogger(config2);
-  const cookiePrefix = config2?.cookies?.prefix;
-  const cookieOverrides = config2?.cookies?.overrides ?? {};
-  const secureCookieStore = createCookieStore(true, cookiePrefix, cookieOverrides, logger);
-  const standardCookieStore = createCookieStore(false, cookiePrefix, cookieOverrides, logger);
-  return {
-    oauth: createBuiltInOAuthProviders(config2?.oauth),
-    cookies: standardCookieStore,
-    jose: createJoseInstance(config2?.secret),
-    secret: config2?.secret,
-    basePath: config2?.basePath ?? "/auth",
-    trustedProxyHeaders: useProxyHeaders,
-    trustedOrigins: getEnvArray("TRUSTED_ORIGINS").length > 0 ? getEnvArray("TRUSTED_ORIGINS") : config2?.trustedOrigins,
-    logger,
-    cookieConfig: { secure: secureCookieStore, standard: standardCookieStore },
-    baseURL: config2?.baseURL
-  };
-};
-
-// src/headers.ts
-var cacheControl = {
-  "Cache-Control": "no-store",
-  Pragma: "no-cache",
-  Expires: "0",
-  Vary: "Cookie"
-};
-var contentSecurityPolicy = {
-  "Content-Security-Policy": [
-    "default-src 'none'",
-    "script-src 'self'",
-    "frame-src 'none'",
-    "object-src 'none'",
-    "frame-ancestors 'none'",
-    "base-uri 'none'"
-  ].join("; ")
-};
-var secureHeaders = {
-  "X-Content-Type-Options": "nosniff",
-  "X-Frame-Options": "DENY",
-  "Referrer-Policy": "strict-origin-when-cross-origin"
-};
-var secureApiHeaders = {
-  ...cacheControl,
-  ...contentSecurityPolicy,
-  ...secureHeaders
-};
-
-// src/api/signIn.ts
-var import_router2 = require("@aura-stack/router");
-
-// src/secure.ts
-var generateSecure = (length = 32) => {
-  return import_jose2.base64url.encode((0, import_crypto.getRandomBytes)(length));
-};
-var createSecretValue = (length = 32) => {
-  return import_jose2.base64url.encode((0, import_crypto.getRandomBytes)(length));
-};
-var createHash = async (data) => {
-  const subtle = (0, import_crypto.getSubtleCrypto)();
-  const digest = await subtle.digest("SHA-256", import_crypto.encoder.encode(data));
-  return import_jose2.base64url.encode(new Uint8Array(digest));
-};
-var createPKCE = async (verifier) => {
-  const byteLength = verifier ? void 0 : Math.floor(Math.random() * (96 - 32 + 1) + 32);
-  const codeVerifier = verifier ?? generateSecure(byteLength ?? 64);
-  if (codeVerifier.length < 43 || codeVerifier.length > 128) {
-    throw new AuthSecurityError("PKCE_VERIFIER_INVALID", "The code verifier must be between 43 and 128 characters in length.");
-  }
-  const codeChallenge = await createHash(codeVerifier);
-  return { codeVerifier, codeChallenge, method: "S256" };
-};
-var createCSRF = async (jose, csrfCookie) => {
-  try {
-    const token = generateSecure(32);
-    if (csrfCookie) {
-      await jose.verifyJWS(csrfCookie, jwtVerificationOptions);
-      return csrfCookie;
-    }
-    return jose.signJWS({ token });
-  } catch {
-    const token = generateSecure(32);
-    return jose.signJWS({ token });
-  }
-};
-var verifyCSRF = async (jose, cookie, header) => {
-  try {
-    const cookiePayload = await jose.verifyJWS(cookie, jwtVerificationOptions);
-    const headerPayload = await jose.verifyJWS(header, jwtVerificationOptions);
-    if (!isJWTPayloadWithToken(cookiePayload)) {
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "Cookie payload missing token field.");
-    }
-    if (!isJWTPayloadWithToken(headerPayload)) {
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "Header payload missing token field.");
-    }
-    if (!equals(cookiePayload.token.length, headerPayload.token.length)) {
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
-    }
-    if (!timingSafeEqual(cookiePayload.token, headerPayload.token)) {
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
-    }
-    return true;
-  } catch {
-    throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
-  }
-};
-
-// src/actions/signIn/authorization-url.ts
-var setSearchParams = (url, params) => {
-  for (const [key, value] of Object.entries(params)) {
-    if (value !== void 0 && value !== "") {
-      url.searchParams.set(key, value);
-    }
-  }
-};
-var buildAuthorizationURL = (oauth, redirect_uri, state, code_challenge, code_challenge_method) => {
-  const authorizeConfig = oauth.authorize;
-  const baseURL = typeof authorizeConfig === "string" ? authorizeConfig : authorizeConfig?.url ?? oauth.authorizeURL;
-  if (!baseURL) {
-    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "Missing authorization URL in OAuth provider configuration.");
-  }
-  const url = new URL(baseURL);
-  const authorizeParams = typeof authorizeConfig === "string" ? void 0 : authorizeConfig?.params;
-  setSearchParams(url, {
-    response_type: authorizeParams?.responseType ?? oauth.responseType ?? "code",
-    client_id: oauth.clientId,
-    redirect_uri,
-    state,
-    code_challenge,
-    code_challenge_method,
-    scope: authorizeParams?.scope ?? oauth.scope,
-    prompt: authorizeParams?.prompt,
-    response_mode: authorizeParams?.responseMode,
-    login_hint: authorizeParams?.loginHint,
-    nonce: authorizeParams?.nonce,
-    display: authorizeParams?.display,
-    audience: authorizeParams?.audience
-  });
-  return url.toString();
-};
-var createAuthorizationURL = async (oauth, redirectURI, ctx) => {
-  const state = createSecretValue();
-  const { codeVerifier, codeChallenge, method } = await createPKCE();
-  const authorization = buildAuthorizationURL(oauth, redirectURI, state, codeChallenge, method);
-  const parsed = OAuthAuthorization.safeParse({ ...oauth, redirectURI, state, codeChallenge, codeChallengeMethod: method });
-  if (!parsed.success) {
-    ctx?.logger?.log("INVALID_OAUTH_CONFIGURATION", {
-      structuredData: {
-        scope: oauth?.scope ?? "",
-        redirect_uri: redirectURI,
-        has_state: Boolean(state),
-        has_code_challenge: Boolean(codeChallenge),
-        code_challenge_method: method
-      }
-    });
-    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "The OAuth provider configuration is invalid.");
-  }
-  return {
-    authorization,
-    state,
-    codeVerifier,
-    method
-  };
-};
-
-// src/actions/signIn/authorization.ts
-var getTrustedOrigins = async (request, trustedOrigins) => {
-  if (!trustedOrigins) return [];
-  const raw = typeof trustedOrigins === "function" ? await trustedOrigins(request) : trustedOrigins;
-  return Array.isArray(raw) ? raw : typeof raw === "string" ? [raw] : [];
-};
-var getBaseURL2 = async ({
-  ctx,
-  request,
-  headers: headersInit
-}) => {
-  const origin = getEnv("BASE_URL") || ctx?.baseURL;
-  if (origin && origin !== "/") return origin;
-  if (ctx?.trustedProxyHeaders) {
-    const headers = headersInit && new Headers(headersInit) || request?.headers;
-    const protocol = headers?.get("Forwarded")?.match(/proto=([^;]+)/i)?.[1] ?? headers?.get("X-Forwarded-Proto") ?? "http";
-    const host = headers?.get("Host") ?? headers?.get("Forwarded")?.match(/host=([^;]+)/i)?.[1] ?? headers?.get("X-Forwarded-Host") ?? null;
-    if (host) return `${protocol}://${host}`;
-    throw new AuthInternalError(
-      "INVALID_OAUTH_CONFIGURATION",
-      "The URL cannot be constructed. Please set the BASE_URL environment variable or provide trusted proxy host headers."
-    );
-  }
-  try {
-    return new URL(request?.url ?? "not-found").origin;
-  } catch (error) {
-    throw new AuthInternalError(
-      "INVALID_OAUTH_CONFIGURATION",
-      "The URL cannot be constructed. Please set the BASE_URL environment variable or enable trustedProxyHeaders.",
-      { cause: error }
-    );
-  }
-};
-var getOriginURL = async (request, context) => {
-  const trustedOrigins = await getTrustedOrigins(request, context?.trustedOrigins);
-  trustedOrigins.push(new URL(request.url).origin);
-  const origin = await getBaseURL2({ request, ctx: context });
-  if (!isTrustedOrigin(origin, trustedOrigins)) {
-    context?.logger?.log("UNTRUSTED_ORIGIN", { structuredData: { origin } });
-    throw new AuthInternalError("UNTRUSTED_ORIGIN", "The constructed origin URL is not trusted.");
-  }
-  return origin;
-};
-var createRedirectURI = async (request, oauth, context) => {
-  const origin = await getOriginURL(request, context);
-  return `${origin}${context.basePath}/callback/${oauth}`;
-};
-var createSignInURL = async ({
-  request,
-  oauth,
-  ctx,
-  redirectTo
-}) => {
-  const origin = await getOriginURL(request, ctx);
-  const searchParams = new URLSearchParams();
-  if (redirectTo !== void 0) searchParams.set("redirectTo", String(redirectTo));
-  return `${origin}${ctx.basePath}/signIn/${oauth}?${searchParams.toString()}`;
-};
-var createRedirectTo = async (request, redirectTo, context) => {
-  try {
-    const headers = request.headers;
-    const requestOrigin = await getOriginURL(request, context);
-    const origins = await getTrustedOrigins(request, context?.trustedOrigins);
-    const validateURL = (url) => {
-      if (!isRelativeURL(url) && !isValidURL(url)) return "/";
-      if (isRelativeURL(url)) return url;
-      if (origins.length > 0) {
-        if (isTrustedOrigin(url, origins)) {
-          const urlOrigin = new URL(url).origin;
-          for (const pattern of origins) {
-            const regex = patternToRegex(pattern);
-            if (regex?.test(urlOrigin)) {
-              return isSameOrigin(url, request.url) ? extractPath(url) : url;
-            }
-            if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return url;
-          }
-        }
-        context?.logger?.log("OPEN_REDIRECT_ATTACK");
-        return "/";
-      }
-      if (isSameOrigin(url, requestOrigin)) {
-        return extractPath(url);
-      }
-      context?.logger?.log("OPEN_REDIRECT_ATTACK");
-      return "/";
-    };
-    return validateURL(redirectTo ?? headers.get("Referer") ?? headers.get("Origin") ?? "/");
-  } catch (error) {
-    context?.logger?.log("POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED");
-    return "/";
-  }
-};
-
-// src/api/signIn.ts
-var signIn = async (oauth, {
-  ctx,
-  headers: headersInit,
-  redirectTo = "/",
-  redirect,
-  request: requestInit
-}) => {
-  const headers = new Headers(headersInit);
-  const provider = ctx.oauth[oauth];
-  if (!provider) {
-    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", `The OAuth provider "${oauth}" is not configured.`);
-  }
-  let request = requestInit;
-  if (!request) {
-    const origin = await getBaseURL2({ ctx, headers });
-    const url = `${origin}${ctx.basePath}/signIn/${oauth}`;
-    request = new Request(url, { headers });
-  }
-  if (redirect === false) {
-    const signInURL = await createSignInURL({ request, oauth, ctx, redirectTo });
-    return { redirect: false, signInURL };
-  }
-  const redirectURI = await createRedirectURI(request, oauth, ctx);
-  const redirectToValue = await createRedirectTo(request, redirectTo, ctx);
-  const { authorization, state, codeVerifier } = await createAuthorizationURL(provider, redirectURI, ctx);
-  ctx?.logger?.log("SIGN_IN_INITIATED", {
-    structuredData: { oauth_provider: oauth }
-  });
-  const headersList = new import_router2.HeadersBuilder(cacheControl).setHeader("Location", authorization).setCookie(ctx.cookies.state.name, state, ctx.cookies.state.attributes).setCookie(ctx.cookies.redirectURI.name, redirectURI, ctx.cookies.redirectURI.attributes).setCookie(ctx.cookies.redirectTo.name, redirectToValue, ctx.cookies.redirectTo.attributes).setCookie(ctx.cookies.codeVerifier.name, codeVerifier, ctx.cookies.codeVerifier.attributes).toHeaders();
-  return Response.json(
-    { redirect: redirect ?? true, signInURL: authorization },
-    {
-      status: redirect ?? true ? 302 : 200,
-      headers: headersList
-    }
-  );
-};
-
-// src/api/signOut.ts
-var import_router3 = require("@aura-stack/router");
-var signOut = async ({
-  ctx,
-  headers: headersInit,
-  redirectTo = "/",
-  skipCSRFCheck = false
-}) => {
-  const headers = new Headers(headersInit);
-  const header = headers.get("X-CSRF-Token");
-  let session = null;
-  let csrfToken = null;
-  try {
-    session = getCookie(headers, ctx.cookies.sessionToken.name);
-  } catch {
-    throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
-  }
-  try {
-    csrfToken = getCookie(headers, ctx.cookies.csrfToken.name);
-  } catch {
-    throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF token is missing.");
-  }
-  ctx?.logger?.log("SIGN_OUT_ATTEMPT", {
-    structuredData: {
-      has_session: Boolean(session),
-      has_csrf_token: Boolean(csrfToken),
-      has_csrf_header: Boolean(header),
-      skip_csrf_check: skipCSRFCheck
-    }
-  });
-  if (!session) {
-    ctx?.logger?.log("SESSION_TOKEN_MISSING");
-    throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
-  }
-  if (!skipCSRFCheck) {
-    if (!csrfToken) {
-      ctx?.logger?.log("CSRF_TOKEN_MISSING");
-      throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF token is missing.");
-    }
-    if (!header) {
-      ctx?.logger?.log("CSRF_HEADER_MISSING");
-      throw new AuthSecurityError("CSRF_HEADER_MISSING", "The CSRF header is missing.");
-    }
-    try {
-      await verifyCSRF(ctx.jose, csrfToken, header);
-    } catch (error) {
-      ctx?.logger?.log("CSRF_TOKEN_INVALID", { structuredData: { error_type: getErrorName(error) } });
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "CSRF token verification failed");
-    }
-    ctx?.logger?.log("SIGN_OUT_CSRF_VERIFIED");
-  } else {
-    try {
-      await ctx.jose.verifyJWS(csrfToken);
-    } catch (error) {
-      ctx?.logger?.log("CSRF_TOKEN_INVALID", { structuredData: { error_type: getErrorName(error) } });
-      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "CSRF token verification failed");
-    }
-  }
-  try {
-    await ctx.jose.decodeJWT(session);
-    ctx?.logger?.log("SIGN_OUT_SUCCESS");
-  } catch (error) {
-    ctx?.logger?.log("INVALID_JWT_TOKEN", { structuredData: { error_type: getErrorName(error) } });
-  }
-  const headersList = new import_router3.HeadersBuilder(secureApiHeaders).setHeader("Location", redirectTo).setCookie(ctx.cookies.csrfToken.name, "", expiredCookieAttributes).setCookie(ctx.cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
-  return Response.json(
-    { redirect: Boolean(redirectTo), url: redirectTo },
-    {
-      status: 202,
-      headers: headersList
-    }
-  );
-};
-
-// src/api/getSession.ts
-var getSession = async ({ ctx, headers }) => {
-  try {
-    const session = getCookie(new Headers(headers), ctx.cookies.sessionToken.name);
-    const decoded = await ctx.jose.decodeJWT(session);
-    ctx?.logger?.log("AUTH_SESSION_VALID");
-    const { exp, iat, jti, nbf, aud, iss, ...user } = decoded;
-    return {
-      session: {
-        user,
-        expires: toISOString(exp * 1e3)
-      },
-      authenticated: true
-    };
-  } catch (error) {
-    ctx?.logger?.log("AUTH_SESSION_INVALID", { structuredData: { error_type: getErrorName(error) } });
-    return { session: null, authenticated: false };
-  }
-};
-
-// src/api/createApi.ts
-var createAuthAPI = (ctx) => {
-  return {
-    getSession: async (options2) => {
-      const session = await getSession({ ctx, headers: options2.headers });
-      return session;
-    },
-    signIn: async (oauth, options2) => {
-      return signIn(oauth, {
-        ctx,
-        headers: options2?.headers,
-        request: options2?.request,
-        redirect: options2?.redirect,
-        redirectTo: options2?.redirectTo
-      });
-    },
-    signOut: async (options2) => {
-      const redirectTo = validateRedirectTo(options2?.redirectTo ?? "/");
-      return signOut({ ctx, headers: options2.headers, redirectTo, skipCSRFCheck: true });
-    }
-  };
-};
-
-// src/actions/signIn/signIn.ts
-var import_v42 = require("zod/v4");
-var import_router4 = require("@aura-stack/router");
-var signInConfig = (oauth) => {
-  return (0, import_router4.createEndpointConfig)("/signIn/:oauth", {
-    schemas: {
-      params: import_v42.z.object({
-        oauth: import_v42.z.enum(
-          Object.keys(oauth),
-          "The OAuth provider is not supported or invalid."
-        )
-      }),
-      searchParams: import_v42.z.object({
-        redirect: import_v42.z.stringbool().optional().default(true),
-        redirectTo: import_v42.z.string().optional()
-      })
-    }
-  });
-};
-var signInAction = (oauth) => {
-  return (0, import_router4.createEndpoint)(
-    "GET",
-    "/signIn/:oauth",
-    async (ctx) => {
-      const {
-        request,
-        params: { oauth: oauth2 },
-        searchParams: { redirectTo, redirect },
-        context
-      } = ctx;
-      const signInResult = await signIn(oauth2, {
-        ctx: context,
-        headers: request.headers,
-        redirect,
-        redirectTo,
-        request
-      });
-      if (!redirect) {
-        return Response.json(signInResult, { status: 200 });
-      }
-      return signInResult;
-    },
-    signInConfig(oauth)
-  );
-};
-
-// src/actions/callback/callback.ts
-var import_v43 = require("zod/v4");
-var import_router5 = require("@aura-stack/router");
-
-// src/request.ts
-var fetchAsync = async (url, options2 = {}, timeout = 5e3) => {
-  const controller = new AbortController();
-  const timeoutId = setTimeout(() => controller.abort(), timeout);
-  const response = await fetch(url, {
-    ...options2,
-    signal: controller.signal
-  }).finally(() => clearTimeout(timeoutId));
-  return response;
-};
-
-// src/actions/callback/userinfo.ts
-var getDefaultUserInfo = (profile) => {
-  const sub = generateSecure(16);
-  return {
-    sub: profile?.id ?? profile?.sub ?? sub,
-    email: profile?.email,
-    name: profile?.name ?? profile?.username ?? profile?.nickname,
-    image: profile?.image ?? profile?.picture
-  };
-};
-var getUserInfo = async (oauthConfig, accessToken, logger) => {
-  const userInfoConfig = oauthConfig.userInfo;
-  const userinfoURL = typeof userInfoConfig === "string" ? userInfoConfig : userInfoConfig.url;
-  const extraHeaders = typeof userInfoConfig === "string" ? void 0 : userInfoConfig.headers;
-  const method = typeof userInfoConfig === "string" ? "GET" : (userInfoConfig.method ?? "GET").toUpperCase();
-  try {
-    logger?.log("OAUTH_USERINFO_REQUEST_INITIATED", {
-      structuredData: {
-        endpoint: userinfoURL
-      }
-    });
-    const response = await fetchAsync(userinfoURL, {
-      method,
-      headers: {
-        "User-Agent": `Aura Auth/${AURA_AUTH_VERSION}`,
-        Accept: "application/json",
-        Authorization: `Bearer ${accessToken}`,
-        ...extraHeaders ?? {}
-      }
-    });
-    if (!response.ok) {
-      logger?.log("OAUTH_USERINFO_INVALID_RESPONSE");
-      throw new OAuthProtocolError("INVALID_REQUEST", "Invalid userinfo response format");
-    }
-    const json = await response.json();
-    const { success, data } = OAuthErrorResponse.safeParse(json);
-    if (success) {
-      logger?.log("OAUTH_USERINFO_ERROR", {
-        message: "Error response received from OAuth userinfo endpoint",
-        structuredData: {
-          error: data.error,
-          error_description: data.error_description ?? ""
-        }
-      });
-      throw new OAuthProtocolError("INVALID_REQUEST", "An error was received from the OAuth userinfo endpoint.");
-    }
-    logger?.log("OAUTH_USERINFO_SUCCESS");
-    return oauthConfig?.profile ? oauthConfig.profile(json) : getDefaultUserInfo(json);
-  } catch (error) {
-    if (isOAuthProtocolError(error)) {
-      throw error;
-    }
-    logger?.log("OAUTH_USERINFO_REQUEST_FAILED");
-    if (isNativeError(error)) {
-      throw new OAuthProtocolError("SERVER_ERROR", "Failed to fetch user information from OAuth provider", "", {
-        cause: error
-      });
-    }
-    throw new OAuthProtocolError("SERVER_ERROR", "Failed to fetch user information", "", { cause: error });
-  }
-};
-
-// src/actions/callback/access-token.ts
-var createAccessToken = async (oauthConfig, redirectURI, code, codeVerifier, logger) => {
-  const { accessToken, clientId, clientSecret } = oauthConfig;
-  if (!clientId || !clientSecret || !redirectURI || !code || !codeVerifier || !accessToken) {
-    logger?.log("INVALID_OAUTH_CONFIGURATION", {
-      structuredData: {
-        has_client_id: Boolean(clientId),
-        has_client_secret: Boolean(clientSecret),
-        has_access_token: Boolean(accessToken),
-        has_redirect_uri: Boolean(redirectURI),
-        has_code: Boolean(code),
-        has_code_verifier: Boolean(codeVerifier)
-      }
-    });
-    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "The OAuth provider configuration is invalid.");
-  }
-  const tokenURL = typeof accessToken === "string" ? accessToken : accessToken.url;
-  const extraHeaders = typeof accessToken === "string" ? void 0 : accessToken.headers;
-  try {
-    logger?.log("OAUTH_ACCESS_TOKEN_REQUEST_INITIATED", {
-      structuredData: {
-        has_client_id: Boolean(clientId),
-        redirect_uri: redirectURI,
-        grant_type: "authorization_code"
-      }
-    });
-    const response = await fetchAsync(tokenURL, {
-      method: "POST",
-      headers: {
-        ...extraHeaders ?? {},
-        Accept: "application/json",
-        "Content-Type": "application/x-www-form-urlencoded"
-      },
-      body: new URLSearchParams({
-        client_id: clientId,
-        client_secret: clientSecret,
-        code,
-        redirect_uri: redirectURI,
-        grant_type: "authorization_code",
-        code_verifier: codeVerifier
-      }).toString()
-    });
-    if (!response.ok) {
-      logger?.log("INVALID_OAUTH_ACCESS_TOKEN_RESPONSE");
-      throw new OAuthProtocolError("invalid_request", "Invalid access token response");
-    }
-    const json = await response.json();
-    const token = OAuthAccessTokenResponse.safeParse(json);
-    if (!token.success) {
-      const { success, data } = OAuthAccessTokenErrorResponse.safeParse(json);
-      if (!success) {
-        logger?.log("INVALID_OAUTH_ACCESS_TOKEN_RESPONSE");
-        throw new OAuthProtocolError("invalid_request", "Invalid access token response format");
-      }
-      logger?.log("OAUTH_ACCESS_TOKEN_ERROR", {
-        structuredData: {
-          error: data.error,
-          error_description: data.error_description ?? ""
-        }
-      });
-      throw new OAuthProtocolError("INVALID_ACCESS_TOKEN", "Failed to retrieve access token");
-    }
-    logger?.log("OAUTH_ACCESS_TOKEN_SUCCESS");
-    return token.data;
-  } catch (error) {
-    logger?.log("OAUTH_ACCESS_TOKEN_REQUEST_FAILED");
-    if (error instanceof Error) {
-      throw new OAuthProtocolError("server_error", "Failed to communicate with OAuth provider", "", { cause: error });
-    }
-    throw error;
-  }
-};
-
-// src/actions/callback/callback.ts
-var callbackConfig = (oauth) => {
-  return (0, import_router5.createEndpointConfig)("/callback/:oauth", {
-    schemas: {
-      params: import_v43.z.object({
-        oauth: import_v43.z.enum(
-          Object.keys(oauth),
-          "The OAuth provider is not supported or invalid."
-        )
-      }),
-      searchParams: import_v43.z.object({
-        code: import_v43.z.string("Missing code parameter in the OAuth authorization response."),
-        state: import_v43.z.string("Missing state parameter in the OAuth authorization response.")
-      })
-    },
-    use: [
-      (ctx) => {
-        const {
-          searchParams,
-          context: { logger }
-        } = ctx;
-        const response = OAuthAuthorizationErrorResponse.safeParse(searchParams);
-        if (response.success) {
-          const { error, error_description } = response.data;
-          const criticalAuthErrors = ["access_denied", "server_error"];
-          const severity = criticalAuthErrors.includes(error.toLowerCase()) ? "critical" : "warning";
-          logger?.log("OAUTH_AUTHORIZATION_ERROR", {
-            severity,
-            structuredData: {
-              error,
-              error_description: error_description ?? ""
-            }
-          });
-          throw new OAuthProtocolError(error, error_description || "OAuth Authorization Error");
-        }
-        return ctx;
-      }
-    ]
-  });
-};
-var callbackAction = (oauth) => {
-  return (0, import_router5.createEndpoint)(
-    "GET",
-    "/callback/:oauth",
-    async (ctx) => {
-      const {
-        request,
-        params: { oauth: oauth2 },
-        searchParams: { code, state },
-        context
-      } = ctx;
-      const { oauth: providers, cookies, jose, logger, trustedOrigins } = context;
-      const oauthConfig = providers[oauth2];
-      const cookieState = getCookie(request, cookies.state.name);
-      const codeVerifier = getCookie(request, cookies.codeVerifier.name);
-      const cookieRedirectTo = getCookie(request, cookies.redirectTo.name);
-      const cookieRedirectURI = getCookie(request, cookies.redirectURI.name);
-      if (!timingSafeEqual(cookieState, state)) {
-        logger?.log("MISMATCHING_STATE", {
-          structuredData: {
-            oauth_provider: oauth2
-          }
-        });
-        throw new AuthSecurityError(
-          "MISMATCHING_STATE",
-          "The provided state passed in the OAuth response does not match the stored state."
-        );
-      }
-      const accessToken = await createAccessToken(oauthConfig, cookieRedirectURI, code, codeVerifier, logger);
-      const origins = await getTrustedOrigins(request, trustedOrigins);
-      const requestOrigin = await getOriginURL(request, context);
-      if (!isRelativeURL(cookieRedirectTo)) {
-        const isValid = origins.length > 0 ? isTrustedOrigin(cookieRedirectTo, origins) : isSameOrigin(cookieRedirectTo, requestOrigin);
-        if (!isValid) {
-          logger?.log("POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED", {
-            structuredData: {
-              redirect_path: cookieRedirectTo,
-              provider: oauth2,
-              has_trusted_origins: origins.length > 0,
-              request_origin: requestOrigin
-            }
-          });
-          throw new AuthSecurityError(
-            "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED",
-            "Invalid redirect path. Potential open redirect attack detected."
-          );
-        }
-      }
-      const userInfo = await getUserInfo(oauthConfig, accessToken.access_token, logger);
-      const sessionCookie = await createSessionCookie(jose, userInfo);
-      const csrfToken = await createCSRF(jose);
-      logger?.log("OAUTH_CALLBACK_SUCCESS", {
-        structuredData: {
-          provider: oauth2
-        }
-      });
-      const headers = new import_router5.HeadersBuilder(cacheControl).setHeader("Location", cookieRedirectTo).setCookie(cookies.sessionToken.name, sessionCookie, cookies.sessionToken.attributes).setCookie(cookies.csrfToken.name, csrfToken, cookies.csrfToken.attributes).setCookie(cookies.state.name, "", expiredCookieAttributes).setCookie(cookies.redirectURI.name, "", expiredCookieAttributes).setCookie(cookies.redirectTo.name, "", expiredCookieAttributes).setCookie(cookies.codeVerifier.name, "", expiredCookieAttributes).toHeaders();
-      return Response.json({ oauth: oauth2 }, { status: 302, headers });
-    },
-    callbackConfig(oauth)
-  );
-};
-
-// src/actions/session/session.ts
-var import_router6 = require("@aura-stack/router");
-var sessionAction = (0, import_router6.createEndpoint)("GET", "/session", async (ctx) => {
-  const {
-    request,
-    context: { cookies }
-  } = ctx;
-  try {
-    const session = await getSession({ ctx: ctx.context, headers: request.headers });
-    if (!session.authenticated) {
-      throw new AuthInternalError("INVALID_JWT_TOKEN", "Session not authenticated");
-    }
-    return Response.json(session, { headers: secureApiHeaders });
-  } catch (error) {
-    const headers = new import_router6.HeadersBuilder(secureApiHeaders).setCookie(cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
-    return Response.json({ session: null, authenticated: false }, { status: 401, headers });
-  }
-});
-
-// src/actions/signOut/signOut.ts
-var import_v44 = require("zod/v4");
-var import_router7 = require("@aura-stack/router");
-var config = (0, import_router7.createEndpointConfig)({
-  schemas: {
-    searchParams: import_v44.z.object({
-      token_type_hint: import_v44.z.literal("session_token"),
-      redirectTo: import_v44.z.string().optional()
-    })
-  }
-});
-var signOutAction = (0, import_router7.createEndpoint)(
-  "POST",
-  "/signOut",
-  async (ctx) => {
-    const {
-      request,
-      searchParams: { redirectTo },
-      context
-    } = ctx;
-    const baseURL = getBaseURL(request);
-    const location = await createRedirectTo(
-      new Request(baseURL, {
-        headers: request.headers
-      }),
-      redirectTo,
-      context
-    );
-    return await signOut({
-      ctx: context,
-      headers: request.headers,
-      redirectTo: location
-    });
-  },
-  config
-);
-
-// src/actions/csrfToken/csrfToken.ts
-var import_router8 = require("@aura-stack/router");
-var getCSRFToken = (request, cookieName) => {
-  try {
-    return getCookie(request, cookieName);
-  } catch {
-    return void 0;
-  }
-};
-var csrfTokenAction = (0, import_router8.createEndpoint)("GET", "/csrfToken", async (ctx) => {
-  const {
-    request,
-    context: { jose, cookies, logger }
-  } = ctx;
-  const token = getCSRFToken(request, cookies.csrfToken.name);
-  logger?.log("CSRF_TOKEN_REQUESTED", { structuredData: { has_token: Boolean(token) } });
-  const csrfToken = await createCSRF(jose, token);
-  logger?.log("CSRF_TOKEN_ISSUED", { structuredData: { issued: Boolean(csrfToken) } });
-  const headers = new Headers(secureApiHeaders);
-  headers.append("Set-Cookie", setCookie(cookies.csrfToken.name, csrfToken, cookies.csrfToken.attributes));
-  return Response.json({ csrfToken }, { headers });
-});
-
-// src/createAuth.ts
-var createInternalConfig = (authConfig) => {
-  const context = createContext(authConfig);
-  return {
-    basePath: authConfig?.basePath ?? "/auth",
-    onError: createErrorHandler(context.logger),
-    context,
-    use: [
-      (ctx) => {
-        const useSecure = useSecureCookies(ctx.request, ctx.context.trustedProxyHeaders);
-        ctx.context.cookies = useSecure ? context.cookieConfig.secure : context.cookieConfig.standard;
-        return ctx;
-      }
-    ]
-  };
-};
-var createAuthInstance = (authConfig) => {
-  const config2 = createInternalConfig(authConfig);
-  const router = (0, import_router9.createRouter)(
-    [signInAction(config2.context.oauth), callbackAction(config2.context.oauth), sessionAction, signOutAction, csrfTokenAction],
-    config2
-  );
-  return {
-    handlers: router,
-    jose: config2.context.jose,
-    api: createAuthAPI(config2.context)
-  };
-};
-var createAuth = (config2) => {
-  const authInstance = createAuthInstance(config2);
-  authInstance.handlers.ALL = async (request) => {
-    const method = request.method.toUpperCase();
-    const methodHandlers = {
-      GET: authInstance.handlers.GET,
-      POST: authInstance.handlers.POST
-    };
-    if (method in methodHandlers) {
-      return await methodHandlers[method](request);
-    }
-    return new Response("Method Not Allowed", {
-      status: 405,
-      headers: { Allow: Object.keys(methodHandlers).join(", ") }
-    });
-  };
-  return authInstance;
-};
-
-// src/client/client.ts
-var import_router10 = require("@aura-stack/router");
-var createClient = import_router10.createClient;
-var createAuthClient = (options2) => {
-  if (typeof window === "undefined" && !options2.baseURL) {
-    throw new AuthClientError("`baseURL` is required when createAuthClient is used outside the browser.");
-  }
-  const client = createClient({
-    cache: "no-store",
-    credentials: "include",
-    baseURL: options2.baseURL ?? window.location.origin,
-    ...options2
-  });
-  const getCSRFToken2 = async () => {
-    try {
-      const response = await client.get("/csrfToken");
-      if (!response.ok) return null;
-      const data = await response.json();
-      return data.csrfToken;
-    } catch (error) {
-      console.error("Error fetching CSRF token:", error);
-      return null;
-    }
-  };
-  const getSession2 = async () => {
-    try {
-      const response = await client.get("/session");
-      if (!response.ok) return null;
-      const session = await response.json();
-      if (!session?.authenticated) return null;
-      return session.session;
-    } catch (error) {
-      console.error("Error fetching session:", error);
-      return null;
-    }
-  };
-  const signIn2 = async (oauth, options3) => {
-    try {
-      const response = await client.get("/signIn/:oauth", {
-        params: {
-          oauth
-        },
-        searchParams: {
-          ...options3,
-          redirect: false
-        }
-      });
-      const json = await response.json();
-      if ((options3?.redirect ?? true) && typeof window !== "undefined" && json?.signInURL) {
-        window.location.assign(json.signInURL);
-      }
-      return json;
-    } catch (error) {
-      console.error("Error during sign-in:", error);
-      return { redirect: false, signInURL: "/" };
-    }
-  };
-  const signOut2 = async (options3) => {
-    try {
-      const csrfToken = await getCSRFToken2();
-      if (!csrfToken) {
-        throw new AuthClientError("Failed to fetch CSRF token for sign-out.");
-      }
-      const response = await client.post("/signOut", {
-        searchParams: {
-          redirectTo: options3?.redirectTo ?? "/",
-          token_type_hint: "session_token"
-        },
-        headers: {
-          "X-CSRF-Token": csrfToken
-        }
-      });
-      const json = await response.json();
-      if ((options3?.redirect ?? true) && typeof window !== "undefined" && json?.url) {
-        window.location.assign(json.url);
-      }
-      return json;
-    } catch (error) {
-      console.error("Error during sign-out:", error);
-      throw isNativeError(error) ? error : new AuthClientError("Sign-out failed.", "The sign-out request failed.", { cause: error });
-    }
-  };
-  return {
-    getSession: getSession2,
-    signIn: signIn2,
-    signOut: signOut2
-  };
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  builtInOAuthProviders,
-  createAuth,
-  createAuthClient,
-  createClient,
-  createSyslogMessage
-});
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require(`./identity-b8FCr0Oa.cjs`),t=require(`./errors-DcK2ELlk.cjs`),n=require(`./oauth-gPiWxjBd.cjs`),r=require(`./env-7as-tgzO.cjs`),i=require(`./assert-hDwQ_SPO.cjs`),a=require(`./crypto-D6_SoGMH.cjs`),o=require(`./logger-G5PinyEc.cjs`);let s=require(`@aura-stack/router`),c=require(`zod/v4`),l=require(`@aura-stack/router/cookie`),u=require(`valibot`);u=e.o(u,1);let d=require(`arktype`),f=require(`typebox`),p=require(`typebox/value`);const m={"Cache-Control":`no-store`,Pragma:`no-cache`,Expires:`0`,Vary:`Cookie`},h={"Content-Security-Policy":[`default-src 'none'`,`script-src 'self'`,`frame-src 'none'`,`object-src 'none'`,`frame-ancestors 'none'`,`base-uri 'none'`].join(`; `)},g={"X-Content-Type-Options":`nosniff`,"X-Frame-Options":`DENY`,"Referrer-Policy":`strict-origin-when-cross-origin`},_={...m,...h,...g},v=(e,t)=>{for(let[n,r]of Object.entries(t))r!==void 0&&r!==``&&e.searchParams.set(n,r)},y=(e,n,r,i,a)=>{let o=e.authorize,s=typeof o==`string`?o:o?.url??e.authorizeURL;if(!s)throw new t.n(`INVALID_OAUTH_CONFIGURATION`,`Missing authorization URL in OAuth provider configuration.`);let c=new URL(s),l=typeof o==`string`?void 0:o?.params;return v(c,{response_type:l?.responseType??e.responseType??`code`,client_id:e.clientId,redirect_uri:n,state:r,code_challenge:i,code_challenge_method:a,scope:l?.scope??e.scope,prompt:l?.prompt,response_mode:l?.responseMode,login_hint:l?.loginHint,nonce:l?.nonce,display:l?.display,audience:l?.audience}),c.toString()},b=async(e,r,i)=>{let o=a.i(),{codeVerifier:s,codeChallenge:c,method:l}=await a.r(),u=y(e,r,o,c,l);if(!n.a.safeParse({...e,redirectURI:r,state:o,codeChallenge:c,codeChallengeMethod:l}).success)throw i?.logger?.log(`INVALID_OAUTH_CONFIGURATION`,{structuredData:{scope:e?.scope??``,redirect_uri:r,has_state:!!o,has_code_challenge:!!c,code_challenge_method:l}}),new t.n(`INVALID_OAUTH_CONFIGURATION`,`The OAuth provider configuration is invalid.`);return{authorization:u,state:o,codeVerifier:s,method:l}},x=async(e,t)=>{if(!t)return[];let n=typeof t==`function`?await t(e):t;return Array.isArray(n)?n:typeof n==`string`?[n]:[]},S=async({ctx:e,request:n,headers:i})=>{let a=r.n(`BASE_URL`)||e?.baseURL;if(a&&a!==`/`)return a;if(e?.trustedProxyHeaders){let e=i&&new Headers(i)||n?.headers,r=e?.get(`Forwarded`)?.match(/proto=([^;]+)/i)?.[1]??e?.get(`X-Forwarded-Proto`)??`http`,a=e?.get(`Host`)??e?.get(`Forwarded`)?.match(/host=([^;]+)/i)?.[1]??e?.get(`X-Forwarded-Host`)??null;if(a)return`${r}://${a}`;throw new t.n(`INVALID_OAUTH_CONFIGURATION`,`The URL cannot be constructed. Please set the BASE_URL environment variable or provide trusted proxy host headers.`)}try{return new URL(n?.url??`not-found`).origin}catch(e){throw new t.n(`INVALID_OAUTH_CONFIGURATION`,`The URL cannot be constructed. Please set the BASE_URL environment variable or enable trustedProxyHeaders.`,{cause:e})}},C=async(e,n)=>{let r=await x(e,n?.trustedOrigins);r.push(new URL(e.url).origin);let a=await S({request:e,ctx:n});if(!i.m(a,r))throw n?.logger?.log(`UNTRUSTED_ORIGIN`,{structuredData:{origin:a}}),new t.n(`UNTRUSTED_ORIGIN`,`The constructed origin URL is not trusted.`);return a},w=async(e,t,n)=>`${await C(e,n)}${n.basePath}/callback/${t}`,T=async({request:e,oauth:t,ctx:n,redirectTo:r})=>{let i=await C(e,n),a=new URLSearchParams;return r!==void 0&&a.set(`redirectTo`,String(r)),`${i}${n.basePath}/signIn/${t}?${a.toString()}`},E=async(e,t,n)=>{try{let r=e.headers,a=await C(e,n),o=await x(e,n?.trustedOrigins);return(t=>{if(!i.u(t)&&!i.v(t))return`/`;if(i.u(t))return t;if(o.length>0){if(i.m(t,o)){let n=new URL(t).origin;for(let r of o){if(i.O(r)?.test(n))return i.d(t,e.url)?i.w(t):t;if(i.v(r)&&i.C(new URL(r).origin,n))return t}}return n?.logger?.log(`OPEN_REDIRECT_ATTACK`),`/`}return i.d(t,a)?i.w(t):(n?.logger?.log(`OPEN_REDIRECT_ATTACK`),`/`)})(t??r.get(`Referer`)??r.get(`Origin`)??`/`)}catch{return n?.logger?.log(`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`),`/`}},D=async(e,{ctx:n,request:r,headers:i,redirect:a,redirectTo:o})=>{try{let c=new Headers(i),l=n.oauth[e];if(!l)throw new t.n(`INVALID_OAUTH_CONFIGURATION`,`The OAuth provider "${e}" is not configured.`);let u=r;if(!u){let t=`${await S({ctx:n,headers:c})}${n.basePath}/signIn/${e}`;u=new Request(t,{headers:c})}if(a===!1){n?.logger?.log(`SIGN_IN_INITIATED`,{structuredData:{oauth_provider:e}});let t=await T({request:u,oauth:e,ctx:n,redirectTo:o}),r=new Headers(_);return{success:!0,redirect:!1,signInURL:t,headers:r,toResponse:()=>Response.json({success:!0,redirect:!1,signInURL:t},{status:200,headers:r})}}let d=await w(u,e,n),f=await E(u,o,n),{authorization:p,state:h,codeVerifier:g}=await b(l,d,n);n?.logger?.log(`SIGN_IN_INITIATED`,{structuredData:{oauth_provider:e}});let v=new s.HeadersBuilder(m).setHeader(`Location`,p).setCookie(n.cookies.state.name,h,n.cookies.state.attributes).setCookie(n.cookies.redirectURI.name,d,n.cookies.redirectURI.attributes).setCookie(n.cookies.redirectTo.name,f,n.cookies.redirectTo.attributes).setCookie(n.cookies.codeVerifier.name,g,n.cookies.codeVerifier.attributes).toHeaders();return{success:!0,redirect:!0,signInURL:p,headers:v,toResponse:()=>Response.json({success:!0,redirect:!0,signInURL:p},{status:302,headers:v})}}catch(e){let n=`AUTH_SIGN_IN_FAILED`,r=`An error occurred during the sign-in process.`;return t.c(e)&&(n=e.code,r=e.message),{success:!1,redirect:!1,signInURL:null,error:{code:n,message:r},headers:new Headers(_),toResponse:()=>Response.json({success:!1,redirect:!1,signInURL:null,error:{code:n,message:r}},{status:500,headers:_})}}},O=async({ctx:e,payload:n,request:r,headers:i,redirectTo:o})=>{let{cookies:c,credentials:l,sessionStrategy:u,logger:d}=e;try{let f=r;if(!f){let t=`${await S({ctx:e,headers:i})}${e.basePath}/signIn/credentials`;f=new Request(t,{headers:i})}await C(f,e);let p=await l?.authorize({credentials:n,deriveSecret:l?.hash??a.o,verifySecret:l?.verify??a.l});if(!p)throw new t.o(`INVALID_CREDENTIALS`,`The provided credentials are invalid.`);let m=await u.createSession(p),h=await a.t(e.jose);d?.log(`CREDENTIALS_SIGN_IN_SUCCESS`);let g=await E(f,o,e),v=new s.HeadersBuilder(_).setHeader(`Location`,g).setCookie(c.csrfToken.name,h,c.csrfToken.attributes).setCookie(c.sessionToken.name,m,c.sessionToken.attributes).toHeaders();return{success:!0,headers:v,redirectURL:g,toResponse:()=>Response.json({success:!0,redirectURL:g},{headers:v})}}catch(e){let n=`CREDENTIALS_SIGN_IN_ERROR`,r=`An error occurred during credentials sign-in.`;t.c(e)&&(n=e.code,r=e.message);let i=new Headers(_),a={success:!1,headers:i,redirectURL:null,error:{code:n,message:r},toResponse:()=>Response.json({success:!1,redirectURL:null,error:{code:n,message:r}},{headers:i,status:401})};return e instanceof t.o?(d?.log(`INVALID_CREDENTIALS`,{severity:`warning`,structuredData:{path:`/signIn/credentials`}}),a):(d?.log(`CREDENTIALS_SIGN_IN_FAILED`,{severity:`error`,structuredData:{path:`/signIn/credentials`}}),a)}},k=async({ctx:e,request:t,headers:n,redirect:r,redirectTo:i,skipCSRFCheck:a=!1})=>{let o=await e.sessionStrategy.destroySession(new Headers(n),a),c=t;if(!c){let t=`${await S({ctx:e,headers:o})}${e.basePath}/signOut`;c=new Request(t,{headers:o})}let l=new s.HeadersBuilder(o),u=await E(c,i,e);u&&l.setHeader(`Location`,u);let d=l.toHeaders();return{headers:d,redirect:r??!1,redirectURL:u,success:!0,toResponse:()=>Response.json({success:!0,redirect:r??!1,redirectURL:u},{headers:d,status:i?302:202})}},A={httpOnly:!0,sameSite:`lax`,path:`/`,maxAge:3600*24*15},j={secure:!1,httpOnly:!0},M={secure:!0,httpOnly:!0},N={secure:!0,httpOnly:!0,path:`/`,domain:void 0},P={httpOnly:!0,maxAge:300,sameSite:`lax`,expires:new Date(Date.now()+300*1e3)},F=(e,t,n)=>(0,l.serialize)(e,t,n),I=e=>({...e,expires:new Date(0),maxAge:0,secure:e?.secure??!0}),L=(e,n)=>{let r=e instanceof Request?e.headers.get(`Cookie`):e.get(`Cookie`);if(!r)throw new t.n(`COOKIE_NOT_FOUND`,`No cookies found. There is no active session`);let i=(0,l.parse)(r)[n];if(!i)throw new t.n(`COOKIE_NOT_FOUND`,`Cookie "${n}" not found. There is no active session`);return i},R=(e,t,n,i)=>(t.httpOnly||i?.log(`COOKIE_HTTPONLY_DISABLED`),t.domain===`*`&&(t.domain=void 0,i?.log(`COOKIE_WILDCARD_DOMAIN`)),e?n===`host`?{...A,...t,...N}:{...A,...t,...M}:(t.secure&&i?.log(`COOKIE_SECURE_DISABLED`),t.sameSite==`none`&&(t.sameSite=`lax`,i?.log(`COOKIE_SAMESITE_NONE_WITHOUT_SECURE`)),r.t.NODE_ENV===`production`&&i?.log(`COOKIE_INSECURE_IN_PRODUCTION`),n===`host`&&i?.log(`COOKIE_HOST_STRATEGY_INSECURE`),{...A,...t,...j})),z=(e,t,n,r)=>{t??=`aura-auth`;let i=e?`__Secure-`:``,a=e?`__Host-`:``;return{sessionToken:{name:`${i}${t}.${n?.sessionToken?.name??`session_token`}`,attributes:R(e,{...A,...n?.sessionToken?.attributes},n?.sessionToken?.attributes?.strategy??`secure`,r)},state:{name:`${i}${t}.${n?.state?.name??`state`}`,attributes:R(e,{...P,...n?.state?.attributes},n?.state?.attributes?.strategy??`secure`,r)},csrfToken:{name:`${a}${t}.${n?.csrfToken?.name??`csrf_token`}`,attributes:R(e,{...n?.csrfToken?.attributes,...N,sameSite:`strict`},n?.csrfToken?.attributes?.strategy??`host`,r)},redirectTo:{name:`${i}${t}.${n?.redirectTo?.name??`redirect_to`}`,attributes:R(e,{...P,...n?.redirectTo?.attributes},n?.redirectTo?.attributes?.strategy??`secure`,r)},redirectURI:{name:`${i}${t}.${n?.redirectURI?.name??`redirect_uri`}`,attributes:R(e,{...P,...n?.redirectURI?.attributes},n?.redirectURI?.attributes?.strategy??`secure`,r)},codeVerifier:{name:`${i}${t}.${n?.codeVerifier?.name??`code_verifier`}`,attributes:R(e,{...P,...n?.codeVerifier?.attributes},n?.codeVerifier?.attributes?.strategy??`secure`,r)}}},B=async({ctx:e,headers:t})=>{let n=new s.HeadersBuilder(_).setCookie(e.cookies.sessionToken.name,``,I(e.cookies.sessionToken.attributes)).setCookie(e.cookies.csrfToken.name,``,I(e.cookies.csrfToken.attributes)).toHeaders(),r={session:null,headers:n,success:!1,error:{code:`GET_SESSION_FAILED`,message:`Failed to retrieve session. The session token may be missing, expired, or invalid.`},toResponse:()=>Response.json({success:!1,session:null},{status:401,headers:n})};try{let{session:n,headers:a}=await e.sessionStrategy.getSession(new Headers(t));if(!n)return r;let o=i.A(a,_);return{session:n,headers:o,success:!0,toResponse:()=>Response.json({success:!0,session:n},{headers:o})}}catch(t){return e?.logger?.log(`AUTH_SESSION_INVALID`,{structuredData:{error_type:i.E(t)}}),r}},V=async({ctx:e,request:n,headers:r,session:a,redirectTo:o,skipCSRFCheck:s=!1})=>{try{let{session:t,headers:c}=await e.sessionStrategy.refreshSession(new Headers(r),a,s),l=i.A(c,_),u=null;if(o){let t=n;if(!t){let n=`${await S({ctx:e,headers:c})}${e.basePath}/updateSession`;t=new Request(n,{headers:l})}u=await E(t,o,e)}return{headers:l,session:t,success:!!t,redirectURL:u,toResponse:()=>Response.json({success:!!t,session:t,redirectURL:u},{headers:l,status:t?200:401})}}catch(e){let n=`UPDATE_SESSION_INVALID`,r=`Failed to update session.`;t.c(e)&&(n=e.code,r=e.message);let i=new Headers(_);return{success:!1,headers:i,session:null,redirectURL:null,error:{code:n,message:r},toResponse:()=>Response.json({success:!1,session:null,redirectURL:null,error:{code:n,message:r}},{status:400,headers:i})}}},H=e=>({getSession:async t=>await B({ctx:e,headers:t.headers}),signIn:async(t,n)=>D(t,{ctx:e,...n}),signInCredentials:async t=>O({ctx:e,...t}),updateSession:async t=>V({ctx:e,...t,skipCSRFCheck:!0}),signOut:async t=>k({ctx:e,...t,skipCSRFCheck:!0})}),ee=(e,n)=>{let r=e?.mode??`sealed`;if(![`sealed`,`signed`,`encrypted`].includes(r))throw new t.r(`[auth] invalid JWT mode "${r}". Valid options are: "sealed", "signed", "encrypted".`);return{createToken:r===`sealed`?n.encodeJWT:r===`signed`?n.signJWS:n.encryptJWE,verifyToken:r===`sealed`?n.decodeJWT:r===`signed`?n.verifyJWS:n.decryptJWE}},U=e=>({getCookie:t=>({sessionToken:L(t,e().sessionToken.name)}),setCookie:({sessionToken:t})=>new s.HeadersBuilder(_).setCookie(e().sessionToken.name,t,e().sessionToken.attributes).toHeaders(),clear:()=>new s.HeadersBuilder(_).setCookie(e().csrfToken.name,``,I(e().csrfToken.attributes)).setCookie(e().sessionToken.name,``,I(e().sessionToken.attributes)).toHeaders()}),W=({config:e,jose:n,logger:r,cookies:o,identity:s})=>{let c=ee(e?.jwt,n),l=U(o),u=e?.jwt?.maxAge??3600*24*15,d=e?.jwt?.expirationStrategy??`absolute`,f=({exp:e})=>{if(!e)return null;let t=Math.floor(Date.now()/1e3);switch(d){case`fixed`:case`absolute`:return null;case`rolling`:return new Date((t+u)*1e3);case`sliding`:{let n=u*.25;return e-t<n?new Date((t+u)*1e3):null}default:return null}},p=async(e,s=!1)=>{let c=null,l=null,u=e.get(`X-CSRF-Token`);try{c=L(e,o().sessionToken.name)}catch{throw new t.a(`SESSION_TOKEN_MISSING`,`The sessionToken is missing.`)}try{l=L(e,o().csrfToken.name)}catch{throw new t.a(`CSRF_TOKEN_MISSING`,`The CSRF token is missing.`)}if(r?.log(`CSRF_TOKEN_REQUESTED`,{structuredData:{has_session:!!c,has_csrf_token:!!l,has_csrf_header:!!u,skip_csrf_check:s}}),!c)throw r?.log(`SESSION_TOKEN_MISSING`),new t.a(`SESSION_TOKEN_MISSING`,`The sessionToken is missing.`);if(!s){if(!l)throw r?.log(`CSRF_TOKEN_MISSING`),new t.a(`CSRF_TOKEN_MISSING`,`The CSRF token is missing.`);if(!u)throw r?.log(`CSRF_HEADER_MISSING`),new t.a(`CSRF_HEADER_MISSING`,`The CSRF header is missing.`);try{await a.c(n,l,u)}catch(e){throw r?.log(`CSRF_TOKEN_INVALID`,{structuredData:{error_type:i.E(e)}}),new t.a(`CSRF_TOKEN_INVALID`,`CSRF token verification failed`)}r?.log(`CSRF_TOKEN_VERIFIED`)}try{return await n.decodeJWT(c),!0}catch(e){return r?.log(`INVALID_JWT_TOKEN`,{structuredData:{error_type:i.E(e)}}),!1}};return{getSession:async e=>{let t=new Headers;try{let{sessionToken:n}=l.getCookie(e);if(!n)return{session:null,headers:t};let i=await c.verifyToken(n),a=s.skipValidation?i:await s.schemaRegistry.parseWithJWT(i),{exp:o,iat:u,mexp:p,...m}=a,h=await s.schemaRegistry.parse(m);if(!h.sub)return{session:null,headers:t};let g={user:h,expires:a.exp?new Date(o*1e3).toISOString():``},_=f({exp:o});if(!_)return{session:{expires:g.expires,user:h},headers:e};let v=d===`absolute`?a.iat:Math.floor(Date.now()/1e3),y=await c.createToken({...h,exp:Math.floor(_.getTime()/1e3),iat:v,mexp:a.mexp});return r?.log(`SESSION_REFRESHED`,{structuredData:{strategy:`stateless`,expiresAt:_.toISOString()}}),{session:{user:h,expires:_.toISOString()},headers:l.setCookie({sessionToken:y})}}catch(e){return r?.log(`AUTH_SESSION_INVALID`,{structuredData:{error_type:i.E(e)}}),{session:null,headers:t}}},createSession:async e=>{s.skipValidation&&r?.log(`IDENTITY_VALIDATION_DISABLED`,{structuredData:{identity_validation_disabled:!0}});let t=s.skipValidation?e:await s.schemaRegistry.parse(e);return c.createToken(t)},refreshSession:async(e,t,n=!1)=>{try{let{sessionToken:r}=l.getCookie(e);if(!r||!await p(e,n))return{session:null,headers:l.clear()};let i=await c.verifyToken(r),a=s.skipValidation?i:await s.schemaRegistry.parse(i),{exp:o,mexp:m,sub:h,iat:g}=a,_=s.skipValidation?t.user:await s.schemaRegistry.parseAsPartial(t.user),v=t.expires?new Date(t.expires):f({exp:o})??new Date(Date.now()+u*1e3),y={user:{...a,..._,sub:h},expires:v.toISOString()},b=d===`absolute`?g:Math.floor(Date.now()/1e3),x=await c.createToken({...y.user,exp:Math.floor(v.getTime()/1e3),iat:b,mexp:m});return y.expires=new Date(y.expires).toISOString(),{session:y,headers:l.setCookie({sessionToken:x})}}catch(e){return r?.log(`AUTH_SESSION_INVALID`,{structuredData:{error_type:i.E(e)}}),{session:null,headers:l.clear()}}},revokeSession:async e=>{},destroySession:async(e,t=!1)=>(await p(e,t),l.clear())}},G=({config:e,jose:n,cookies:r,logger:i,identity:a})=>{let o=e?.strategy??`jwt`;switch(o){case`jwt`:return W({jose:n,config:e,cookies:r,logger:i,identity:a});default:throw new t.r(`[auth] unknown session strategy "${o}". Valid options are: "jwt".`)}},K=e=>{if(!i.b(e)&&!i._(e)&&!i.t(e)&&!(0,f.IsObject)(e))throw Error(`Unsupported schema type`);return{validate:t=>{try{if(i.b(e)){let n=e.safeParse(t);return n.success?{success:!0,data:n.data,error:null}:{success:!1,data:null,error:n.error}}if(i._(e)){let n=(0,u.safeParse)(e,t);return n.success?{success:!0,data:n.output,error:null}:{success:!1,data:null,error:n.issues}}if(i.t(e)){let n=e(t);return e.allows(t)?{success:!0,data:n,error:null}:{success:!1,data:null,error:n}}if((0,f.IsObject)(e)){let n=t;return e.strip&&(n=p.Value.Clean(e,p.Value.Clone(t))),p.Value.Check(e,n)?{success:!0,data:n,error:null}:{success:!1,data:null,error:[...p.Value.Errors(e,n)]}}return{success:!1,data:null,error:Error(`Unsupported schema type`)}}catch(e){return{success:!1,data:null,error:e}}}}},q=(e,n=`strip`)=>{if(i.b(e))return n===`strip`?e.strip():n===`passthrough`?c.z.looseObject(e.shape):n===`strict`?e.strict():e.partial().optional();if(i._(e))return n===`strip`?u.object(e.entries):n===`passthrough`?u.looseObject(e.entries):n===`strict`?u.strictObject(e.entries):u.partial(e);if(i.t(e))return n===`strip`?e.onUndeclaredKey(`delete`):n===`passthrough`?e.onUndeclaredKey(`ignore`):n===`strict`?e.onUndeclaredKey(`reject`):e.partial();if((0,f.IsObject)(e))return n===`strip`?f.Type.Object(e.properties,{...e,additionalProperties:!1,strip:!0}):n===`passthrough`?f.Type.Object(e.properties,{...e,additionalProperties:!0}):n===`strict`?f.Type.Object(e.properties,{...e,additionalProperties:!1}):f.Type.Partial(e);throw new t.o(`INVALID_IDENTITY_VALIDATION_FAILED`,`Unsupported schema mode configuration. Valid options are: "strip", "passthrough", "strict" and "partial".`)},J=e=>{if(i._(e))return u.object({...e.entries,exp:u.number(),iat:u.number(),jti:u.string(),nbf:u.number(),aud:u.optional(u.string()),iss:u.optional(u.string()),mexp:u.optional(u.number())});if(i.t(e))return e.and({exp:`number`,iat:`number`,jti:`string`,nbf:`number`,aud:`string?`,iss:`string?`,mexp:`number?`});if((0,f.IsObject)(e))return f.Type.Object({...e.properties,exp:f.Type.Number(),iat:f.Type.Number(),jti:f.Type.String(),nbf:f.Type.Number(),aud:f.Type.Optional(f.Type.String()),iss:f.Type.Optional(f.Type.String()),mexp:f.Type.Optional(f.Type.Number())},{...e});if(i.b(e))return e.extend({exp:c.z.number(),iat:c.z.number(),jti:c.z.string(),nbf:c.z.number(),aud:c.z.string().optional(),iss:c.z.string().optional(),mexp:c.z.number().optional()});throw new t.o(`INVALID_IDENTITY_VALIDATION_FAILED`,`Unsupported schema type for JWT extension.`)},Y=e=>{if(i._(e))return u.object({user:e,expires:u.optional(u.pipe(u.string(),u.transform(e=>new Date(e)),u.date()))});if(i.t(e))return(0,d.type)({user:e,expires:(0,d.type)(`string`).pipe(e=>new Date(e)).optional()});if((0,f.IsObject)(e))return f.Type.Object({user:e,expires:f.Type.Optional(f.Type.String())});if(i.b(e))return c.z.object({user:e,expires:c.z.coerce.date().optional()});throw new t.o(`INVALID_IDENTITY_VALIDATION_FAILED`,`Unsupported schema type for schema  extension.`)},X=(e,n)=>{let r={};throw i.b(e)?r=i.T(n):i._(e)?r={issues:n}:i.t(e)?r={error:n}:(0,f.IsObject)(e)&&(r={errors:n}),new t.o(`INVALID_IDENTITY_VALIDATION_FAILED`,JSON.stringify(r,null,2),{cause:i.b(e)?n:void 0})},Z=t=>{let n=q(t.schema??e.t,t.unknownKeys),r=q(t.schema??e.t,`partial`),i=J(t.schema??e.t),a=K(n),o=K(r),s=K(i);return{parse:async(e={})=>{let{data:t,success:r,error:i}=a.validate(e);return r||X(n,i),t},parseAsPartial:async(e={})=>{let{data:t,success:n,error:i}=o.validate(e);return n||X(r,i),t},parseWithJWT:async(e={})=>{let{data:t,success:n,error:r}=s.validate(e);return n||X(i,r),t},schema:n,schemaAsPartial:r,schemaWithJWT:i}},Q=e=>{let t=r.n(`TRUSTED_PROXY_HEADERS`)===void 0?e?.trustedProxyHeaders??!1:r.i(`TRUSTED_PROXY_HEADERS`),i=o.t(e),s=e?.cookies?.prefix,c=e?.cookies?.overrides??{},l=z(!0,s,c,i),u=z(!1,s,c,i),d=a.u(e?.secret,e?.session),f=e?.identity?.unknownKeys??`strip`,p=e?.identity?.skipValidation??!1,m=Z({schema:e?.identity?.schema,unknownKeys:f,skipValidation:p}),h={oauth:n.n(e?.oauth),credentials:e?.credentials,cookies:u,jose:d,secret:e?.secret,basePath:e?.basePath??`/auth`,trustedProxyHeaders:t,trustedOrigins:r.r(`TRUSTED_ORIGINS`).length>0?r.r(`TRUSTED_ORIGINS`):e?.trustedOrigins,logger:i,cookieConfig:{secure:l,standard:u},baseURL:e?.baseURL,identity:{schemaRegistry:m,unknownKeys:f,skipValidation:p}};return h.sessionStrategy=G({cookies:()=>h.cookies,jose:h.jose,config:e?.session,logger:h.logger,identity:h.identity}),h},te=e=>n=>{if((0,s.isRouterError)(n)){let{message:t,status:r,statusText:i}=n;return e?.log(`ROUTER_INTERNAL_ERROR`),Response.json({type:`ROUTER_ERROR`,code:`ROUTER_INTERNAL_ERROR`,message:t},{status:r,statusText:i})}if((0,s.isInvalidZodSchemaError)(n))return e?.log(`INVALID_REQUEST`),Response.json({type:`ROUTER_ERROR`,code:`INVALID_REQUEST`,message:n.errors},{status:422});if(t.p(n)){let{error:t,message:r,type:i,errorURI:a}=n;return e?.log(`OAUTH_PROTOCOL_ERROR`,{structuredData:{error:t,error_description:r,error_uri:a??``}}),Response.json({type:i,message:r},{status:400})}if(t.l(n)){let{type:t,code:r,message:i}=n;return e?.log(`INVALID_OAUTH_CONFIGURATION`,{structuredData:{error:r,error_description:i}}),Response.json({type:t,message:i},{status:400})}if(t.u(n)){let{type:t,code:r,message:i}=n;return e?.log(`AUTH_SECURITY_ERROR`,{structuredData:{error:r,error_description:i}}),Response.json({type:t,code:r,message:i},{status:400})}if(t.d(n)){let{type:t,code:r,message:i}=n;return e?.log(`IDENTITY_VALIDATION_FAILED`,{structuredData:{error:r,error_description:i}}),Response.json({type:t,code:r,message:i},{status:422})}return e?.log(`SERVER_ERROR`,{structuredData:{error_type:n.name,error_message:n.message}}),Response.json({type:`SERVER_ERROR`,code:`SERVER_ERROR`,message:`An unexpected error occurred`},{status:500})},ne=e=>(0,s.createEndpointConfig)(`/signIn/:oauth`,{schemas:{params:c.z.object({oauth:c.z.enum(Object.keys(e),`The OAuth provider is not supported or invalid.`)}),searchParams:c.z.object({redirect:c.z.stringbool().optional().default(!0),redirectTo:c.z.string().optional()})}}),re=e=>(0,s.createEndpoint)(`GET`,`/signIn/:oauth`,async e=>{let{toResponse:t}=await D(e.params.oauth,{ctx:e.context,request:e.request,headers:e.request.headers,redirect:e.searchParams.redirect,redirectTo:e.searchParams.redirectTo});return t()},ne(e)),ie=(0,s.createEndpointConfig)({schemas:{body:c.z.object({username:c.z.string(),password:c.z.string()}),searchParams:c.z.object({redirectTo:c.z.string().optional()})}}),ae=(0,s.createEndpoint)(`POST`,`/signIn/credentials`,async e=>{let t=e.body,{toResponse:n}=await O({ctx:e.context,payload:t,request:e.request,headers:e.request.headers,redirectTo:e.searchParams.redirectTo});return n()},ie),$=async(e,t={},n=5e3)=>{let r=new AbortController,i=setTimeout(()=>r.abort(),n);return await fetch(e,{...t,signal:r.signal}).finally(()=>clearTimeout(i))},oe=e=>{let n=e?.id??e?.sub??e?.uid??e?.user_id??e?.account_id;if(!n)throw new t.s(`invalid_userinfo`,`OAuth provider did not return a stable user identifier (id/sub/uid).`);return{sub:n,email:e?.email,name:e?.name??e?.username??e?.nickname,image:e?.image??e?.picture}},se=async(e,r,a)=>{let o=e.userInfo,s=typeof o==`string`?o:o.url,c=typeof o==`string`?void 0:o.headers,l=typeof o==`string`?`GET`:(o.method??`GET`).toUpperCase();try{a?.log(`OAUTH_USERINFO_REQUEST_INITIATED`,{structuredData:{endpoint:s}});let o=await $(s,{method:l,headers:{"User-Agent":`Aura Auth/${i.x}`,Accept:`application/json`,Authorization:`Bearer ${r}`,...c}});if(!o.ok)throw a?.log(`OAUTH_USERINFO_INVALID_RESPONSE`),new t.s(`INVALID_REQUEST`,`Invalid userinfo response format`);let u=await o.json(),{success:d,data:f}=n.s.safeParse(u);if(d)throw a?.log(`OAUTH_USERINFO_ERROR`,{message:`Error response received from OAuth userinfo endpoint`,structuredData:{error:f.error,error_description:f.error_description??``}}),new t.s(`INVALID_REQUEST`,`An error was received from the OAuth userinfo endpoint.`);return a?.log(`OAUTH_USERINFO_SUCCESS`),e?.profile?e.profile(u):oe(u)}catch(e){throw t.p(e)?e:(a?.log(`OAUTH_USERINFO_REQUEST_FAILED`),t.f(e)?new t.s(`SERVER_ERROR`,`Failed to fetch user information from OAuth provider`,``,{cause:e}):new t.s(`SERVER_ERROR`,`Failed to fetch user information`,``,{cause:e}))}},ce=async(e,r,i,a,o)=>{let{accessToken:s,clientId:c,clientSecret:l}=e;if(!c||!l||!r||!i||!a||!s)throw o?.log(`INVALID_OAUTH_CONFIGURATION`,{structuredData:{has_client_id:!!c,has_client_secret:!!l,has_access_token:!!s,has_redirect_uri:!!r,has_code:!!i,has_code_verifier:!!a}}),new t.n(`INVALID_OAUTH_CONFIGURATION`,`The OAuth provider configuration is invalid.`);let u=typeof s==`string`?s:s.url,d=typeof s==`string`?void 0:s.headers;try{o?.log(`OAUTH_ACCESS_TOKEN_REQUEST_INITIATED`,{structuredData:{has_client_id:!!c,redirect_uri:r,grant_type:`authorization_code`}});let e=await $(u,{method:`POST`,headers:{...d,Accept:`application/json`,"Content-Type":`application/x-www-form-urlencoded`},body:new URLSearchParams({client_id:c,client_secret:l,code:i,redirect_uri:r,grant_type:`authorization_code`,code_verifier:a}).toString()});if(!e.ok)throw o?.log(`INVALID_OAUTH_ACCESS_TOKEN_RESPONSE`),new t.s(`invalid_request`,`Invalid access token response`);let s=await e.json(),f=n.i.safeParse(s);if(!f.success){let{success:e,data:r}=n.r.safeParse(s);throw e?(o?.log(`OAUTH_ACCESS_TOKEN_ERROR`,{structuredData:{error:r.error,error_description:r.error_description??``}}),new t.s(`INVALID_ACCESS_TOKEN`,`Failed to retrieve access token`)):(o?.log(`INVALID_OAUTH_ACCESS_TOKEN_RESPONSE`),new t.s(`invalid_request`,`Invalid access token response format`))}return o?.log(`OAUTH_ACCESS_TOKEN_SUCCESS`),f.data}catch(e){throw e instanceof t.s?e:(o?.log(`OAUTH_ACCESS_TOKEN_REQUEST_FAILED`),new t.s(`server_error`,`Failed to communicate with OAuth provider`,``,{cause:e}))}},le=e=>(0,s.createEndpointConfig)(`/callback/:oauth`,{schemas:{params:c.z.object({oauth:c.z.enum(Object.keys(e),`The OAuth provider is not supported or invalid.`)}),searchParams:c.z.object({code:c.z.string(`Missing code parameter in the OAuth authorization response.`),state:c.z.string(`Missing state parameter in the OAuth authorization response.`)})},use:[e=>{let{searchParams:r,context:{logger:i}}=e,a=n.o.safeParse(r);if(a.success){let{error:e,error_description:n}=a.data,r=[`access_denied`,`server_error`].includes(e.toLowerCase())?`critical`:`warning`;throw i?.log(`OAUTH_AUTHORIZATION_ERROR`,{severity:r,structuredData:{error:e,error_description:n??``}}),new t.s(e,n||`OAuth Authorization Error`)}return e}]}),ue=e=>(0,s.createEndpoint)(`GET`,`/callback/:oauth`,async e=>{let{request:n,params:{oauth:r},searchParams:{code:o,state:c},context:l}=e,{oauth:u,cookies:d,jose:f,logger:p,trustedOrigins:h}=l,g=u[r],_=L(n,d.state.name),v=L(n,d.codeVerifier.name),y=L(n,d.redirectTo.name),b=L(n,d.redirectURI.name),S=new s.HeadersBuilder(m).setCookie(d.state.name,``,I(d.state.attributes)).setCookie(d.redirectURI.name,``,I(d.redirectURI.attributes)).setCookie(d.redirectTo.name,``,I(d.redirectTo.attributes)).setCookie(d.codeVerifier.name,``,I(d.codeVerifier.attributes));if(!i.k(_,c))return p?.log(`MISMATCHING_STATE`,{structuredData:{oauth_provider:r}}),Response.json({type:`AUTH_SECURITY_ERROR`,code:`MISMATCHING_STATE`,message:`The provided state passed in the OAuth response does not match the stored state.`},{headers:S.toHeaders(),status:400});let w=await ce(g,b,o,v,p),T=await x(n,h),E=await C(n,l);if(!i.u(y)&&!(T.length>0?i.m(y,T):i.d(y,E)))throw p?.log(`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`,{structuredData:{redirect_path:y,provider:r,has_trusted_origins:T.length>0,request_origin:E}}),new t.a(`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`,`Invalid redirect path. Potential open redirect attack detected.`);let D=await se(g,w.access_token,p),O=await l.sessionStrategy.createSession(D),k=await a.t(f);p?.log(`OAUTH_CALLBACK_SUCCESS`,{structuredData:{provider:r}});let A=S.setHeader(`Location`,y).setCookie(d.sessionToken.name,O,d.sessionToken.attributes).setCookie(d.csrfToken.name,k,d.csrfToken.attributes).toHeaders();return Response.json({oauth:r},{status:302,headers:A})},le(e)),de=(0,s.createEndpoint)(`GET`,`/session`,async e=>{let{toResponse:t}=await B({ctx:e.context,headers:e.request.headers});return t()}),fe=(0,s.createEndpointConfig)({schemas:{searchParams:c.z.object({token_type_hint:c.z.literal(`session_token`),redirectTo:c.z.string().optional()})}}),pe=(0,s.createEndpoint)(`POST`,`/signOut`,async e=>{let{toResponse:t}=await k({ctx:e.context,request:e.request,headers:e.request.headers,redirectTo:e.searchParams.redirectTo});return t()},fe),me=(e,t)=>{try{return L(e,t)}catch{return}},he=(0,s.createEndpoint)(`GET`,`/csrfToken`,async e=>{let{request:t,context:{jose:n,cookies:r,logger:i}}=e,o=me(t,r.csrfToken.name);i?.log(`CSRF_TOKEN_REQUESTED`,{structuredData:{has_token:!!o}});let s=await a.t(n,o);i?.log(`CSRF_TOKEN_ISSUED`,{structuredData:{issued:!!s}});let c=new Headers(_);return c.append(`Set-Cookie`,F(r.csrfToken.name,s,r.csrfToken.attributes)),Response.json({csrfToken:s},{headers:c})}),ge=e=>(0,s.createEndpointConfig)({schemas:{body:Y(e.schemaRegistry.schemaAsPartial)}}),_e=e=>(0,s.createEndpoint)(`PATCH`,`/session`,async e=>{let{toResponse:t}=await V({ctx:e.context,headers:e.request.headers,session:{user:e.body?.user,expires:e.body?.expires?.toISOString()}});return t()},ge(e)),ve=e=>{let t=Q(e);return{basePath:e?.basePath??`/auth`,onError:te(t.logger),context:t,use:[e=>{let n=i.D(e.request,e.context.trustedProxyHeaders);return e.context.cookies=n?t.cookieConfig.secure:t.cookieConfig.standard,e}]}},ye=e=>{let t=ve(e);return{handlers:(0,s.createRouter)([re(t.context.oauth),ae,ue(t.context.oauth),de,pe,he,_e(t.context.identity)],t),jose:t.context.jose,api:H(t.context)}},be=e=>{let t=ye(e);return t.handlers.ALL=async e=>{let n=e.method.toUpperCase(),r={GET:t.handlers.GET,POST:t.handlers.POST,PATCH:t.handlers.PATCH};return n in r?await r[n](e):new Response(`Method Not Allowed`,{status:405,headers:{Allow:Object.keys(r).join(`, `)}})},t};exports.createAuth=be;