@aura-stack/auth 0.5.0 → 0.7.0

package/dist/index.d.ts

@@ -1,14 +1,2 @@
-export { q as AuthAPI, p as AuthClient, l as AuthClientOptions, A as AuthConfig, r as AuthInstance, B as BuiltInOAuthProvider, C as CookieConfig, E as ErrorType, G as GetSessionAPIOptions, s as JoseInstance, L as LogLevel, t as Logger, k as OAuthProvider, u as OAuthProviderConfig, j as OAuthProviderCredentials, m as Session, g as SignInAPIOptions, n as SignInOptions, i as SignOutAPIOptions, o as SignOutOptions, T as TrustedOrigin, U as User, v as builtInOAuthProviders, w as createAuth, x as createSyslogMessage } from './index-_aXtxb_s.js';
-export { createAuthClient, createClient } from './client/client.js';
-export { Client, ClientOptions } from '@aura-stack/router/types';
-export { LiteralUnion, Prettify } from './@types/utility.js';
-import 'zod';
-import './schemas.js';
-import 'zod/v4';
-import '@aura-stack/jose';
-import '@aura-stack/jose/jose';
-import '@aura-stack/jose/crypto';
-import '@aura-stack/router/cookie';
-import 'jose';
-import '@aura-stack/router';
-import 'zod/v4/core';
+import { R as createAuth, an as Session, ln as User, lt as AuthConfig, ut as AuthInstance } from "./index-C9U6ICDT.js";
+export { type AuthConfig, type AuthInstance, type Session, type User, createAuth };

package/dist/index.js

@@ -1,59 +1 @@
-import "./chunk-5X7JZMEF.js";
-import {
-  createAuthClient,
-  createClient
-} from "./chunk-4RWSYUKX.js";
-import {
-  createAuth
-} from "./chunk-CWX724AG.js";
-import "./chunk-ITQ7352M.js";
-import "./chunk-NHZBQNRR.js";
-import "./chunk-GNNBM2WJ.js";
-import "./chunk-FPCVZUVG.js";
-import "./chunk-UN7X6SU5.js";
-import "./chunk-7YYXFKLR.js";
-import "./chunk-3J5TUH2I.js";
-import "./chunk-7BE46WWS.js";
-import "./chunk-LAYPUDQF.js";
-import "./chunk-CITNGXDA.js";
-import "./chunk-JOCGX3RP.js";
-import "./chunk-D2CSIUKP.js";
-import "./chunk-LATR3NIV.js";
-import "./chunk-KBXWTD6E.js";
-import "./chunk-ZNCZVF6U.js";
-import "./chunk-V6LLEAR4.js";
-import "./chunk-2IR674WX.js";
-import {
-  builtInOAuthProviders
-} from "./chunk-PDP3PHB3.js";
-import "./chunk-LDU7A2JE.js";
-import "./chunk-PHYNROD4.js";
-import "./chunk-E6G5YCI6.js";
-import "./chunk-IPKO6UQN.js";
-import "./chunk-54CZPKR4.js";
-import "./chunk-2GQLSIJ2.js";
-import "./chunk-EEE7UM5T.js";
-import "./chunk-C3A37LQC.js";
-import "./chunk-4YHJ4IEQ.js";
-import "./chunk-OVHNRULD.js";
-import "./chunk-QQEKY4XP.js";
-import "./chunk-KMMAZFSJ.js";
-import "./chunk-FW4W3REU.js";
-import "./chunk-5LZ7TOM3.js";
-import {
-  createSyslogMessage
-} from "./chunk-U4RK4LKJ.js";
-import "./chunk-2A5B7GWR.js";
-import "./chunk-UZQJJD6A.js";
-import "./chunk-LX3TJ2TJ.js";
-import "./chunk-XY5R3EHH.js";
-import "./chunk-WHNDRO3N.js";
-import "./chunk-U5663F2U.js";
-import "./chunk-EBAMFRB7.js";
-export {
-  builtInOAuthProviders,
-  createAuth,
-  createAuthClient,
-  createClient,
-  createSyslogMessage
-};
+import{a as e,c as t,d as n,f as r,l as i,n as a,o,p as s,r as c,s as l,u}from"./errors-Czt_w1t_.js";import{a as d,i as f,n as p,o as m,r as h,s as g}from"./oauth-D3_mnBOx.js";import{i as _,n as v,r as y,t as b}from"./env-CJtSi1eX.js";import{A as x,C as ee,D as S,E as C,O as te,T as ne,_ as w,b as T,d as E,k as re,m as D,t as O,u as k,v as ie,w as ae,x as oe}from"./assert-_fBNnaOk.js";import{a as se,d as ce,i as le,l as ue,s as de,t as A,u as fe}from"./crypto-DyrRzBSQ.js";import{t as pe}from"./logger-DjXkgSn5.js";import{UserIdentity as j}from"./shared/identity.js";import{HeadersBuilder as M,createEndpoint as N,createEndpointConfig as P,createRouter as me,isInvalidZodSchemaError as he,isRouterError as ge}from"@aura-stack/router";import{z as F}from"zod/v4";import{parse as _e,serialize as ve}from"@aura-stack/router/cookie";import*as I from"valibot";import{safeParse as ye}from"valibot";import{type as be}from"arktype";import{IsObject as L,Type as R}from"typebox";import{Value as z}from"typebox/value";const B={"Cache-Control":`no-store`,Pragma:`no-cache`,Expires:`0`,Vary:`Cookie`},xe={"Content-Security-Policy":[`default-src 'none'`,`script-src 'self'`,`frame-src 'none'`,`object-src 'none'`,`frame-ancestors 'none'`,`base-uri 'none'`].join(`; `)},Se={"X-Content-Type-Options":`nosniff`,"X-Frame-Options":`DENY`,"Referrer-Policy":`strict-origin-when-cross-origin`},V={...B,...xe,...Se},Ce=(e,t)=>{for(let[n,r]of Object.entries(t))r!==void 0&&r!==``&&e.searchParams.set(n,r)},we=(e,t,n,r,i)=>{let o=e.authorize,s=typeof o==`string`?o:o?.url??e.authorizeURL;if(!s)throw new a(`INVALID_OAUTH_CONFIGURATION`,`Missing authorization URL in OAuth provider configuration.`);let c=new URL(s),l=typeof o==`string`?void 0:o?.params;return Ce(c,{response_type:l?.responseType??e.responseType??`code`,client_id:e.clientId,redirect_uri:t,state:n,code_challenge:r,code_challenge_method:i,scope:l?.scope??e.scope,prompt:l?.prompt,response_mode:l?.responseMode,login_hint:l?.loginHint,nonce:l?.nonce,display:l?.display,audience:l?.audience}),c.toString()},Te=async(e,t,n)=>{let r=se(),{codeVerifier:i,codeChallenge:o,method:s}=await le(),c=we(e,t,r,o,s);if(!d.safeParse({...e,redirectURI:t,state:r,codeChallenge:o,codeChallengeMethod:s}).success)throw n?.logger?.log(`INVALID_OAUTH_CONFIGURATION`,{structuredData:{scope:e?.scope??``,redirect_uri:t,has_state:!!r,has_code_challenge:!!o,code_challenge_method:s}}),new a(`INVALID_OAUTH_CONFIGURATION`,`The OAuth provider configuration is invalid.`);return{authorization:c,state:r,codeVerifier:i,method:s}},H=async(e,t)=>{if(!t)return[];let n=typeof t==`function`?await t(e):t;return Array.isArray(n)?n:typeof n==`string`?[n]:[]},U=async({ctx:e,request:t,headers:n})=>{let r=v(`BASE_URL`)||e?.baseURL;if(r&&r!==`/`)return r;if(e?.trustedProxyHeaders){let e=n&&new Headers(n)||t?.headers,r=e?.get(`Forwarded`)?.match(/proto=([^;]+)/i)?.[1]??e?.get(`X-Forwarded-Proto`)??`http`,i=e?.get(`Host`)??e?.get(`Forwarded`)?.match(/host=([^;]+)/i)?.[1]??e?.get(`X-Forwarded-Host`)??null;if(i)return`${r}://${i}`;throw new a(`INVALID_OAUTH_CONFIGURATION`,`The URL cannot be constructed. Please set the BASE_URL environment variable or provide trusted proxy host headers.`)}try{return new URL(t?.url??`not-found`).origin}catch(e){throw new a(`INVALID_OAUTH_CONFIGURATION`,`The URL cannot be constructed. Please set the BASE_URL environment variable or enable trustedProxyHeaders.`,{cause:e})}},W=async(e,t)=>{let n=await H(e,t?.trustedOrigins);n.push(new URL(e.url).origin);let r=await U({request:e,ctx:t});if(!D(r,n))throw t?.logger?.log(`UNTRUSTED_ORIGIN`,{structuredData:{origin:r}}),new a(`UNTRUSTED_ORIGIN`,`The constructed origin URL is not trusted.`);return r},Ee=async(e,t,n)=>`${await W(e,n)}${n.basePath}/callback/${t}`,De=async({request:e,oauth:t,ctx:n,redirectTo:r})=>{let i=await W(e,n),a=new URLSearchParams;return r!==void 0&&a.set(`redirectTo`,String(r)),`${i}${n.basePath}/signIn/${t}?${a.toString()}`},G=async(e,t,n)=>{try{let r=e.headers,i=await W(e,n),a=await H(e,n?.trustedOrigins);return(t=>{if(!k(t)&&!ie(t))return`/`;if(k(t))return t;if(a.length>0){if(D(t,a)){let n=new URL(t).origin;for(let r of a){if(te(r)?.test(n))return E(t,e.url)?ae(t):t;if(ie(r)&&ee(new URL(r).origin,n))return t}}return n?.logger?.log(`OPEN_REDIRECT_ATTACK`),`/`}return E(t,i)?ae(t):(n?.logger?.log(`OPEN_REDIRECT_ATTACK`),`/`)})(t??r.get(`Referer`)??r.get(`Origin`)??`/`)}catch{return n?.logger?.log(`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`),`/`}},Oe=async(e,{ctx:n,request:r,headers:i,redirect:o,redirectTo:s})=>{try{let t=new Headers(i),c=n.oauth[e];if(!c)throw new a(`INVALID_OAUTH_CONFIGURATION`,`The OAuth provider "${e}" is not configured.`);let l=r;if(!l){let r=`${await U({ctx:n,headers:t})}${n.basePath}/signIn/${e}`;l=new Request(r,{headers:t})}if(o===!1){n?.logger?.log(`SIGN_IN_INITIATED`,{structuredData:{oauth_provider:e}});let t=await De({request:l,oauth:e,ctx:n,redirectTo:s}),r=new Headers(V);return{success:!0,redirect:!1,signInURL:t,headers:r,toResponse:()=>Response.json({success:!0,redirect:!1,signInURL:t},{status:200,headers:r})}}let u=await Ee(l,e,n),d=await G(l,s,n),{authorization:f,state:p,codeVerifier:m}=await Te(c,u,n);n?.logger?.log(`SIGN_IN_INITIATED`,{structuredData:{oauth_provider:e}});let h=new M(B).setHeader(`Location`,f).setCookie(n.cookies.state.name,p,n.cookies.state.attributes).setCookie(n.cookies.redirectURI.name,u,n.cookies.redirectURI.attributes).setCookie(n.cookies.redirectTo.name,d,n.cookies.redirectTo.attributes).setCookie(n.cookies.codeVerifier.name,m,n.cookies.codeVerifier.attributes).toHeaders();return{success:!0,redirect:!0,signInURL:f,headers:h,toResponse:()=>Response.json({success:!0,redirect:!0,signInURL:f},{status:302,headers:h})}}catch(e){let n=`AUTH_SIGN_IN_FAILED`,r=`An error occurred during the sign-in process.`;return t(e)&&(n=e.code,r=e.message),{success:!1,redirect:!1,signInURL:null,error:{code:n,message:r},headers:new Headers(V),toResponse:()=>Response.json({success:!1,redirect:!1,signInURL:null,error:{code:n,message:r}},{status:500,headers:V})}}},ke=async({ctx:e,payload:n,request:r,headers:i,redirectTo:a})=>{let{cookies:s,credentials:c,sessionStrategy:l,logger:u}=e;try{let t=r;if(!t){let n=`${await U({ctx:e,headers:i})}${e.basePath}/signIn/credentials`;t=new Request(n,{headers:i})}await W(t,e);let d=await c?.authorize({credentials:n,deriveSecret:c?.hash??de,verifySecret:c?.verify??fe});if(!d)throw new o(`INVALID_CREDENTIALS`,`The provided credentials are invalid.`);let f=await l.createSession(d),p=await A(e.jose);u?.log(`CREDENTIALS_SIGN_IN_SUCCESS`);let m=await G(t,a,e),h=new M(V).setHeader(`Location`,m).setCookie(s.csrfToken.name,p,s.csrfToken.attributes).setCookie(s.sessionToken.name,f,s.sessionToken.attributes).toHeaders();return{success:!0,headers:h,redirectURL:m,toResponse:()=>Response.json({success:!0,redirectURL:m},{headers:h})}}catch(e){let n=`CREDENTIALS_SIGN_IN_ERROR`,r=`An error occurred during credentials sign-in.`;t(e)&&(n=e.code,r=e.message);let i=new Headers(V),a={success:!1,headers:i,redirectURL:null,error:{code:n,message:r},toResponse:()=>Response.json({success:!1,redirectURL:null,error:{code:n,message:r}},{headers:i,status:401})};return e instanceof o?(u?.log(`INVALID_CREDENTIALS`,{severity:`warning`,structuredData:{path:`/signIn/credentials`}}),a):(u?.log(`CREDENTIALS_SIGN_IN_FAILED`,{severity:`error`,structuredData:{path:`/signIn/credentials`}}),a)}},Ae=async({ctx:e,request:t,headers:n,redirect:r,redirectTo:i,skipCSRFCheck:a=!1})=>{let o=await e.sessionStrategy.destroySession(new Headers(n),a),s=t;if(!s){let t=`${await U({ctx:e,headers:o})}${e.basePath}/signOut`;s=new Request(t,{headers:o})}let c=new M(o),l=await G(s,i,e);l&&c.setHeader(`Location`,l);let u=c.toHeaders();return{headers:u,redirect:r??!1,redirectURL:l,success:!0,toResponse:()=>Response.json({success:!0,redirect:r??!1,redirectURL:l},{headers:u,status:i?302:202})}},K={httpOnly:!0,sameSite:`lax`,path:`/`,maxAge:3600*24*15},je={secure:!1,httpOnly:!0},Me={secure:!0,httpOnly:!0},Ne={secure:!0,httpOnly:!0,path:`/`,domain:void 0},q={httpOnly:!0,maxAge:300,sameSite:`lax`,expires:new Date(Date.now()+300*1e3)},Pe=(e,t,n)=>ve(e,t,n),J=e=>({...e,expires:new Date(0),maxAge:0,secure:e?.secure??!0}),Y=(e,t)=>{let n=e instanceof Request?e.headers.get(`Cookie`):e.get(`Cookie`);if(!n)throw new a(`COOKIE_NOT_FOUND`,`No cookies found. There is no active session`);let r=_e(n)[t];if(!r)throw new a(`COOKIE_NOT_FOUND`,`Cookie "${t}" not found. There is no active session`);return r},X=(e,t,n,r)=>(t.httpOnly||r?.log(`COOKIE_HTTPONLY_DISABLED`),t.domain===`*`&&(t.domain=void 0,r?.log(`COOKIE_WILDCARD_DOMAIN`)),e?n===`host`?{...K,...t,...Ne}:{...K,...t,...Me}:(t.secure&&r?.log(`COOKIE_SECURE_DISABLED`),t.sameSite==`none`&&(t.sameSite=`lax`,r?.log(`COOKIE_SAMESITE_NONE_WITHOUT_SECURE`)),b.NODE_ENV===`production`&&r?.log(`COOKIE_INSECURE_IN_PRODUCTION`),n===`host`&&r?.log(`COOKIE_HOST_STRATEGY_INSECURE`),{...K,...t,...je})),Fe=(e,t,n,r)=>{t??=`aura-auth`;let i=e?`__Secure-`:``,a=e?`__Host-`:``;return{sessionToken:{name:`${i}${t}.${n?.sessionToken?.name??`session_token`}`,attributes:X(e,{...K,...n?.sessionToken?.attributes},n?.sessionToken?.attributes?.strategy??`secure`,r)},state:{name:`${i}${t}.${n?.state?.name??`state`}`,attributes:X(e,{...q,...n?.state?.attributes},n?.state?.attributes?.strategy??`secure`,r)},csrfToken:{name:`${a}${t}.${n?.csrfToken?.name??`csrf_token`}`,attributes:X(e,{...n?.csrfToken?.attributes,...Ne,sameSite:`strict`},n?.csrfToken?.attributes?.strategy??`host`,r)},redirectTo:{name:`${i}${t}.${n?.redirectTo?.name??`redirect_to`}`,attributes:X(e,{...q,...n?.redirectTo?.attributes},n?.redirectTo?.attributes?.strategy??`secure`,r)},redirectURI:{name:`${i}${t}.${n?.redirectURI?.name??`redirect_uri`}`,attributes:X(e,{...q,...n?.redirectURI?.attributes},n?.redirectURI?.attributes?.strategy??`secure`,r)},codeVerifier:{name:`${i}${t}.${n?.codeVerifier?.name??`code_verifier`}`,attributes:X(e,{...q,...n?.codeVerifier?.attributes},n?.codeVerifier?.attributes?.strategy??`secure`,r)}}},Ie=async({ctx:e,headers:t})=>{let n=new M(V).setCookie(e.cookies.sessionToken.name,``,J(e.cookies.sessionToken.attributes)).setCookie(e.cookies.csrfToken.name,``,J(e.cookies.csrfToken.attributes)).toHeaders(),r={session:null,headers:n,success:!1,error:{code:`GET_SESSION_FAILED`,message:`Failed to retrieve session. The session token may be missing, expired, or invalid.`},toResponse:()=>Response.json({success:!1,session:null},{status:401,headers:n})};try{let{session:n,headers:i}=await e.sessionStrategy.getSession(new Headers(t));if(!n)return r;let a=x(i,V);return{session:n,headers:a,success:!0,toResponse:()=>Response.json({success:!0,session:n},{headers:a})}}catch(t){return e?.logger?.log(`AUTH_SESSION_INVALID`,{structuredData:{error_type:C(t)}}),r}},Le=async({ctx:e,request:n,headers:r,session:i,redirectTo:a,skipCSRFCheck:o=!1})=>{try{let{session:t,headers:s}=await e.sessionStrategy.refreshSession(new Headers(r),i,o),c=x(s,V),l=null;if(a){let t=n;if(!t){let n=`${await U({ctx:e,headers:s})}${e.basePath}/updateSession`;t=new Request(n,{headers:c})}l=await G(t,a,e)}return{headers:c,session:t,success:!!t,redirectURL:l,toResponse:()=>Response.json({success:!!t,session:t,redirectURL:l},{headers:c,status:t?200:401})}}catch(e){let n=`UPDATE_SESSION_INVALID`,r=`Failed to update session.`;t(e)&&(n=e.code,r=e.message);let i=new Headers(V);return{success:!1,headers:i,session:null,redirectURL:null,error:{code:n,message:r},toResponse:()=>Response.json({success:!1,session:null,redirectURL:null,error:{code:n,message:r}},{status:400,headers:i})}}},Re=e=>({getSession:async t=>await Ie({ctx:e,headers:t.headers}),signIn:async(t,n)=>Oe(t,{ctx:e,...n}),signInCredentials:async t=>ke({ctx:e,...t}),updateSession:async t=>Le({ctx:e,...t,skipCSRFCheck:!0}),signOut:async t=>Ae({ctx:e,...t,skipCSRFCheck:!0})}),ze=(e,t)=>{let n=e?.mode??`sealed`;if(![`sealed`,`signed`,`encrypted`].includes(n))throw new c(`[auth] invalid JWT mode "${n}". Valid options are: "sealed", "signed", "encrypted".`);return{createToken:n===`sealed`?t.encodeJWT:n===`signed`?t.signJWS:t.encryptJWE,verifyToken:n===`sealed`?t.decodeJWT:n===`signed`?t.verifyJWS:t.decryptJWE}},Be=e=>({getCookie:t=>({sessionToken:Y(t,e().sessionToken.name)}),setCookie:({sessionToken:t})=>new M(V).setCookie(e().sessionToken.name,t,e().sessionToken.attributes).toHeaders(),clear:()=>new M(V).setCookie(e().csrfToken.name,``,J(e().csrfToken.attributes)).setCookie(e().sessionToken.name,``,J(e().sessionToken.attributes)).toHeaders()}),Ve=({config:t,jose:n,logger:r,cookies:i,identity:a})=>{let o=ze(t?.jwt,n),s=Be(i),c=t?.jwt?.maxAge??3600*24*15,l=t?.jwt?.expirationStrategy??`absolute`,u=({exp:e})=>{if(!e)return null;let t=Math.floor(Date.now()/1e3);switch(l){case`fixed`:case`absolute`:return null;case`rolling`:return new Date((t+c)*1e3);case`sliding`:{let n=c*.25;return e-t<n?new Date((t+c)*1e3):null}default:return null}},d=async(t,a=!1)=>{let o=null,s=null,c=t.get(`X-CSRF-Token`);try{o=Y(t,i().sessionToken.name)}catch{throw new e(`SESSION_TOKEN_MISSING`,`The sessionToken is missing.`)}try{s=Y(t,i().csrfToken.name)}catch{throw new e(`CSRF_TOKEN_MISSING`,`The CSRF token is missing.`)}if(r?.log(`CSRF_TOKEN_REQUESTED`,{structuredData:{has_session:!!o,has_csrf_token:!!s,has_csrf_header:!!c,skip_csrf_check:a}}),!o)throw r?.log(`SESSION_TOKEN_MISSING`),new e(`SESSION_TOKEN_MISSING`,`The sessionToken is missing.`);if(!a){if(!s)throw r?.log(`CSRF_TOKEN_MISSING`),new e(`CSRF_TOKEN_MISSING`,`The CSRF token is missing.`);if(!c)throw r?.log(`CSRF_HEADER_MISSING`),new e(`CSRF_HEADER_MISSING`,`The CSRF header is missing.`);try{await ue(n,s,c)}catch(t){throw r?.log(`CSRF_TOKEN_INVALID`,{structuredData:{error_type:C(t)}}),new e(`CSRF_TOKEN_INVALID`,`CSRF token verification failed`)}r?.log(`CSRF_TOKEN_VERIFIED`)}try{return await n.decodeJWT(o),!0}catch(e){return r?.log(`INVALID_JWT_TOKEN`,{structuredData:{error_type:C(e)}}),!1}};return{getSession:async e=>{let t=new Headers;try{let{sessionToken:n}=s.getCookie(e);if(!n)return{session:null,headers:t};let i=await o.verifyToken(n),c=a.skipValidation?i:await a.schemaRegistry.parseWithJWT(i),{exp:d,iat:f,mexp:p,...m}=c,h=await a.schemaRegistry.parse(m);if(!h.sub)return{session:null,headers:t};let g={user:h,expires:c.exp?new Date(d*1e3).toISOString():``},_=u({exp:d});if(!_)return{session:{expires:g.expires,user:h},headers:e};let v=l===`absolute`?c.iat:Math.floor(Date.now()/1e3),y=await o.createToken({...h,exp:Math.floor(_.getTime()/1e3),iat:v,mexp:c.mexp});return r?.log(`SESSION_REFRESHED`,{structuredData:{strategy:`stateless`,expiresAt:_.toISOString()}}),{session:{user:h,expires:_.toISOString()},headers:s.setCookie({sessionToken:y})}}catch(e){return r?.log(`AUTH_SESSION_INVALID`,{structuredData:{error_type:C(e)}}),{session:null,headers:t}}},createSession:async e=>{a.skipValidation&&r?.log(`IDENTITY_VALIDATION_DISABLED`,{structuredData:{identity_validation_disabled:!0}});let t=a.skipValidation?e:await a.schemaRegistry.parse(e);return o.createToken(t)},refreshSession:async(e,t,n=!1)=>{try{let{sessionToken:r}=s.getCookie(e);if(!r||!await d(e,n))return{session:null,headers:s.clear()};let i=await o.verifyToken(r),f=a.skipValidation?i:await a.schemaRegistry.parse(i),{exp:p,mexp:m,sub:h,iat:g}=f,_=a.skipValidation?t.user:await a.schemaRegistry.parseAsPartial(t.user),v=t.expires?new Date(t.expires):u({exp:p})??new Date(Date.now()+c*1e3),y={user:{...f,..._,sub:h},expires:v.toISOString()},b=l===`absolute`?g:Math.floor(Date.now()/1e3),x=await o.createToken({...y.user,exp:Math.floor(v.getTime()/1e3),iat:b,mexp:m});return y.expires=new Date(y.expires).toISOString(),{session:y,headers:s.setCookie({sessionToken:x})}}catch(e){return r?.log(`AUTH_SESSION_INVALID`,{structuredData:{error_type:C(e)}}),{session:null,headers:s.clear()}}},revokeSession:async e=>{},destroySession:async(e,t=!1)=>(await d(e,t),s.clear())}},He=({config:e,jose:t,cookies:n,logger:r,identity:i})=>{let a=e?.strategy??`jwt`;switch(a){case`jwt`:return Ve({jose:t,config:e,cookies:n,logger:r,identity:i});default:throw new c(`[auth] unknown session strategy "${a}". Valid options are: "jwt".`)}},Z=e=>{if(!T(e)&&!w(e)&&!O(e)&&!L(e))throw Error(`Unsupported schema type`);return{validate:t=>{try{if(T(e)){let n=e.safeParse(t);return n.success?{success:!0,data:n.data,error:null}:{success:!1,data:null,error:n.error}}if(w(e)){let n=ye(e,t);return n.success?{success:!0,data:n.output,error:null}:{success:!1,data:null,error:n.issues}}if(O(e)){let n=e(t);return e.allows(t)?{success:!0,data:n,error:null}:{success:!1,data:null,error:n}}if(L(e)){let n=t;return e.strip&&(n=z.Clean(e,z.Clone(t))),z.Check(e,n)?{success:!0,data:n,error:null}:{success:!1,data:null,error:[...z.Errors(e,n)]}}return{success:!1,data:null,error:Error(`Unsupported schema type`)}}catch(e){return{success:!1,data:null,error:e}}}}},Ue=(e,t=`strip`)=>{if(T(e))return t===`strip`?e.strip():t===`passthrough`?F.looseObject(e.shape):t===`strict`?e.strict():e.partial().optional();if(w(e))return t===`strip`?I.object(e.entries):t===`passthrough`?I.looseObject(e.entries):t===`strict`?I.strictObject(e.entries):I.partial(e);if(O(e))return t===`strip`?e.onUndeclaredKey(`delete`):t===`passthrough`?e.onUndeclaredKey(`ignore`):t===`strict`?e.onUndeclaredKey(`reject`):e.partial();if(L(e))return t===`strip`?R.Object(e.properties,{...e,additionalProperties:!1,strip:!0}):t===`passthrough`?R.Object(e.properties,{...e,additionalProperties:!0}):t===`strict`?R.Object(e.properties,{...e,additionalProperties:!1}):R.Partial(e);throw new o(`INVALID_IDENTITY_VALIDATION_FAILED`,`Unsupported schema mode configuration. Valid options are: "strip", "passthrough", "strict" and "partial".`)},We=e=>{if(w(e))return I.object({...e.entries,exp:I.number(),iat:I.number(),jti:I.string(),nbf:I.number(),aud:I.optional(I.string()),iss:I.optional(I.string()),mexp:I.optional(I.number())});if(O(e))return e.and({exp:`number`,iat:`number`,jti:`string`,nbf:`number`,aud:`string?`,iss:`string?`,mexp:`number?`});if(L(e))return R.Object({...e.properties,exp:R.Number(),iat:R.Number(),jti:R.String(),nbf:R.Number(),aud:R.Optional(R.String()),iss:R.Optional(R.String()),mexp:R.Optional(R.Number())},{...e});if(T(e))return e.extend({exp:F.number(),iat:F.number(),jti:F.string(),nbf:F.number(),aud:F.string().optional(),iss:F.string().optional(),mexp:F.number().optional()});throw new o(`INVALID_IDENTITY_VALIDATION_FAILED`,`Unsupported schema type for JWT extension.`)},Ge=e=>{if(w(e))return I.object({user:e,expires:I.optional(I.pipe(I.string(),I.transform(e=>new Date(e)),I.date()))});if(O(e))return be({user:e,expires:be(`string`).pipe(e=>new Date(e)).optional()});if(L(e))return R.Object({user:e,expires:R.Optional(R.String())});if(T(e))return F.object({user:e,expires:F.coerce.date().optional()});throw new o(`INVALID_IDENTITY_VALIDATION_FAILED`,`Unsupported schema type for schema  extension.`)},Q=(e,t)=>{let n={};throw T(e)?n=ne(t):w(e)?n={issues:t}:O(e)?n={error:t}:L(e)&&(n={errors:t}),new o(`INVALID_IDENTITY_VALIDATION_FAILED`,JSON.stringify(n,null,2),{cause:T(e)?t:void 0})},Ke=e=>{let t=Ue(e.schema??j,e.unknownKeys),n=Ue(e.schema??j,`partial`),r=We(e.schema??j),i=Z(t),a=Z(n),o=Z(r);return{parse:async(e={})=>{let{data:n,success:r,error:a}=i.validate(e);return r||Q(t,a),n},parseAsPartial:async(e={})=>{let{data:t,success:r,error:i}=a.validate(e);return r||Q(n,i),t},parseWithJWT:async(e={})=>{let{data:t,success:n,error:i}=o.validate(e);return n||Q(r,i),t},schema:t,schemaAsPartial:n,schemaWithJWT:r}},qe=e=>{let t=v(`TRUSTED_PROXY_HEADERS`)===void 0?e?.trustedProxyHeaders??!1:_(`TRUSTED_PROXY_HEADERS`),n=pe(e),r=e?.cookies?.prefix,i=e?.cookies?.overrides??{},a=Fe(!0,r,i,n),o=Fe(!1,r,i,n),s=ce(e?.secret,e?.session),c=e?.identity?.unknownKeys??`strip`,l=e?.identity?.skipValidation??!1,u=Ke({schema:e?.identity?.schema,unknownKeys:c,skipValidation:l}),d={oauth:p(e?.oauth),credentials:e?.credentials,cookies:o,jose:s,secret:e?.secret,basePath:e?.basePath??`/auth`,trustedProxyHeaders:t,trustedOrigins:y(`TRUSTED_ORIGINS`).length>0?y(`TRUSTED_ORIGINS`):e?.trustedOrigins,logger:n,cookieConfig:{secure:a,standard:o},baseURL:e?.baseURL,identity:{schemaRegistry:u,unknownKeys:c,skipValidation:l}};return d.sessionStrategy=He({cookies:()=>d.cookies,jose:d.jose,config:e?.session,logger:d.logger,identity:d.identity}),d},Je=e=>t=>{if(ge(t)){let{message:n,status:r,statusText:i}=t;return e?.log(`ROUTER_INTERNAL_ERROR`),Response.json({type:`ROUTER_ERROR`,code:`ROUTER_INTERNAL_ERROR`,message:n},{status:r,statusText:i})}if(he(t))return e?.log(`INVALID_REQUEST`),Response.json({type:`ROUTER_ERROR`,code:`INVALID_REQUEST`,message:t.errors},{status:422});if(s(t)){let{error:n,message:r,type:i,errorURI:a}=t;return e?.log(`OAUTH_PROTOCOL_ERROR`,{structuredData:{error:n,error_description:r,error_uri:a??``}}),Response.json({type:i,message:r},{status:400})}if(i(t)){let{type:n,code:r,message:i}=t;return e?.log(`INVALID_OAUTH_CONFIGURATION`,{structuredData:{error:r,error_description:i}}),Response.json({type:n,message:i},{status:400})}if(u(t)){let{type:n,code:r,message:i}=t;return e?.log(`AUTH_SECURITY_ERROR`,{structuredData:{error:r,error_description:i}}),Response.json({type:n,code:r,message:i},{status:400})}if(n(t)){let{type:n,code:r,message:i}=t;return e?.log(`IDENTITY_VALIDATION_FAILED`,{structuredData:{error:r,error_description:i}}),Response.json({type:n,code:r,message:i},{status:422})}return e?.log(`SERVER_ERROR`,{structuredData:{error_type:t.name,error_message:t.message}}),Response.json({type:`SERVER_ERROR`,code:`SERVER_ERROR`,message:`An unexpected error occurred`},{status:500})},Ye=e=>P(`/signIn/:oauth`,{schemas:{params:F.object({oauth:F.enum(Object.keys(e),`The OAuth provider is not supported or invalid.`)}),searchParams:F.object({redirect:F.stringbool().optional().default(!0),redirectTo:F.string().optional()})}}),Xe=e=>N(`GET`,`/signIn/:oauth`,async e=>{let{toResponse:t}=await Oe(e.params.oauth,{ctx:e.context,request:e.request,headers:e.request.headers,redirect:e.searchParams.redirect,redirectTo:e.searchParams.redirectTo});return t()},Ye(e)),Ze=N(`POST`,`/signIn/credentials`,async e=>{let t=e.body,{toResponse:n}=await ke({ctx:e.context,payload:t,request:e.request,headers:e.request.headers,redirectTo:e.searchParams.redirectTo});return n()},P({schemas:{body:F.object({username:F.string(),password:F.string()}),searchParams:F.object({redirectTo:F.string().optional()})}})),$=async(e,t={},n=5e3)=>{let r=new AbortController,i=setTimeout(()=>r.abort(),n);return await fetch(e,{...t,signal:r.signal}).finally(()=>clearTimeout(i))},Qe=e=>{let t=e?.id??e?.sub??e?.uid??e?.user_id??e?.account_id;if(!t)throw new l(`invalid_userinfo`,`OAuth provider did not return a stable user identifier (id/sub/uid).`);return{sub:t,email:e?.email,name:e?.name??e?.username??e?.nickname,image:e?.image??e?.picture}},$e=async(e,t,n)=>{let i=e.userInfo,a=typeof i==`string`?i:i.url,o=typeof i==`string`?void 0:i.headers,c=typeof i==`string`?`GET`:(i.method??`GET`).toUpperCase();try{n?.log(`OAUTH_USERINFO_REQUEST_INITIATED`,{structuredData:{endpoint:a}});let r=await $(a,{method:c,headers:{"User-Agent":`Aura Auth/${oe}`,Accept:`application/json`,Authorization:`Bearer ${t}`,...o}});if(!r.ok)throw n?.log(`OAUTH_USERINFO_INVALID_RESPONSE`),new l(`INVALID_REQUEST`,`Invalid userinfo response format`);let i=await r.json(),{success:s,data:u}=g.safeParse(i);if(s)throw n?.log(`OAUTH_USERINFO_ERROR`,{message:`Error response received from OAuth userinfo endpoint`,structuredData:{error:u.error,error_description:u.error_description??``}}),new l(`INVALID_REQUEST`,`An error was received from the OAuth userinfo endpoint.`);return n?.log(`OAUTH_USERINFO_SUCCESS`),e?.profile?e.profile(i):Qe(i)}catch(e){throw s(e)?e:(n?.log(`OAUTH_USERINFO_REQUEST_FAILED`),r(e)?new l(`SERVER_ERROR`,`Failed to fetch user information from OAuth provider`,``,{cause:e}):new l(`SERVER_ERROR`,`Failed to fetch user information`,``,{cause:e}))}},et=async(e,t,n,r,i)=>{let{accessToken:o,clientId:s,clientSecret:c}=e;if(!s||!c||!t||!n||!r||!o)throw i?.log(`INVALID_OAUTH_CONFIGURATION`,{structuredData:{has_client_id:!!s,has_client_secret:!!c,has_access_token:!!o,has_redirect_uri:!!t,has_code:!!n,has_code_verifier:!!r}}),new a(`INVALID_OAUTH_CONFIGURATION`,`The OAuth provider configuration is invalid.`);let u=typeof o==`string`?o:o.url,d=typeof o==`string`?void 0:o.headers;try{i?.log(`OAUTH_ACCESS_TOKEN_REQUEST_INITIATED`,{structuredData:{has_client_id:!!s,redirect_uri:t,grant_type:`authorization_code`}});let e=await $(u,{method:`POST`,headers:{...d,Accept:`application/json`,"Content-Type":`application/x-www-form-urlencoded`},body:new URLSearchParams({client_id:s,client_secret:c,code:n,redirect_uri:t,grant_type:`authorization_code`,code_verifier:r}).toString()});if(!e.ok)throw i?.log(`INVALID_OAUTH_ACCESS_TOKEN_RESPONSE`),new l(`invalid_request`,`Invalid access token response`);let a=await e.json(),o=f.safeParse(a);if(!o.success){let{success:e,data:t}=h.safeParse(a);throw e?(i?.log(`OAUTH_ACCESS_TOKEN_ERROR`,{structuredData:{error:t.error,error_description:t.error_description??``}}),new l(`INVALID_ACCESS_TOKEN`,`Failed to retrieve access token`)):(i?.log(`INVALID_OAUTH_ACCESS_TOKEN_RESPONSE`),new l(`invalid_request`,`Invalid access token response format`))}return i?.log(`OAUTH_ACCESS_TOKEN_SUCCESS`),o.data}catch(e){throw e instanceof l?e:(i?.log(`OAUTH_ACCESS_TOKEN_REQUEST_FAILED`),new l(`server_error`,`Failed to communicate with OAuth provider`,``,{cause:e}))}},tt=e=>P(`/callback/:oauth`,{schemas:{params:F.object({oauth:F.enum(Object.keys(e),`The OAuth provider is not supported or invalid.`)}),searchParams:F.object({code:F.string(`Missing code parameter in the OAuth authorization response.`),state:F.string(`Missing state parameter in the OAuth authorization response.`)})},use:[e=>{let{searchParams:t,context:{logger:n}}=e,r=m.safeParse(t);if(r.success){let{error:e,error_description:t}=r.data,i=[`access_denied`,`server_error`].includes(e.toLowerCase())?`critical`:`warning`;throw n?.log(`OAUTH_AUTHORIZATION_ERROR`,{severity:i,structuredData:{error:e,error_description:t??``}}),new l(e,t||`OAuth Authorization Error`)}return e}]}),nt=t=>N(`GET`,`/callback/:oauth`,async t=>{let{request:n,params:{oauth:r},searchParams:{code:i,state:a},context:o}=t,{oauth:s,cookies:c,jose:l,logger:u,trustedOrigins:d}=o,f=s[r],p=Y(n,c.state.name),m=Y(n,c.codeVerifier.name),h=Y(n,c.redirectTo.name),g=Y(n,c.redirectURI.name),_=new M(B).setCookie(c.state.name,``,J(c.state.attributes)).setCookie(c.redirectURI.name,``,J(c.redirectURI.attributes)).setCookie(c.redirectTo.name,``,J(c.redirectTo.attributes)).setCookie(c.codeVerifier.name,``,J(c.codeVerifier.attributes));if(!re(p,a))return u?.log(`MISMATCHING_STATE`,{structuredData:{oauth_provider:r}}),Response.json({type:`AUTH_SECURITY_ERROR`,code:`MISMATCHING_STATE`,message:`The provided state passed in the OAuth response does not match the stored state.`},{headers:_.toHeaders(),status:400});let v=await et(f,g,i,m,u),y=await H(n,d),b=await W(n,o);if(!k(h)&&!(y.length>0?D(h,y):E(h,b)))throw u?.log(`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`,{structuredData:{redirect_path:h,provider:r,has_trusted_origins:y.length>0,request_origin:b}}),new e(`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`,`Invalid redirect path. Potential open redirect attack detected.`);let x=await $e(f,v.access_token,u),ee=await o.sessionStrategy.createSession(x),S=await A(l);u?.log(`OAUTH_CALLBACK_SUCCESS`,{structuredData:{provider:r}});let C=_.setHeader(`Location`,h).setCookie(c.sessionToken.name,ee,c.sessionToken.attributes).setCookie(c.csrfToken.name,S,c.csrfToken.attributes).toHeaders();return Response.json({oauth:r},{status:302,headers:C})},tt(t)),rt=N(`GET`,`/session`,async e=>{let{toResponse:t}=await Ie({ctx:e.context,headers:e.request.headers});return t()}),it=N(`POST`,`/signOut`,async e=>{let{toResponse:t}=await Ae({ctx:e.context,request:e.request,headers:e.request.headers,redirectTo:e.searchParams.redirectTo});return t()},P({schemas:{searchParams:F.object({token_type_hint:F.literal(`session_token`),redirectTo:F.string().optional()})}})),at=(e,t)=>{try{return Y(e,t)}catch{return}},ot=N(`GET`,`/csrfToken`,async e=>{let{request:t,context:{jose:n,cookies:r,logger:i}}=e,a=at(t,r.csrfToken.name);i?.log(`CSRF_TOKEN_REQUESTED`,{structuredData:{has_token:!!a}});let o=await A(n,a);i?.log(`CSRF_TOKEN_ISSUED`,{structuredData:{issued:!!o}});let s=new Headers(V);return s.append(`Set-Cookie`,Pe(r.csrfToken.name,o,r.csrfToken.attributes)),Response.json({csrfToken:o},{headers:s})}),st=e=>P({schemas:{body:Ge(e.schemaRegistry.schemaAsPartial)}}),ct=e=>N(`PATCH`,`/session`,async e=>{let{toResponse:t}=await Le({ctx:e.context,headers:e.request.headers,session:{user:e.body?.user,expires:e.body?.expires?.toISOString()}});return t()},st(e)),lt=e=>{let t=qe(e);return{basePath:e?.basePath??`/auth`,onError:Je(t.logger),context:t,use:[e=>{let n=S(e.request,e.context.trustedProxyHeaders);return e.context.cookies=n?t.cookieConfig.secure:t.cookieConfig.standard,e}]}},ut=e=>{let t=lt(e);return{handlers:me([Xe(t.context.oauth),Ze,nt(t.context.oauth),rt,it,ot,ct(t.context.identity)],t),jose:t.context.jose,api:Re(t.context)}},dt=e=>{let t=ut(e);return t.handlers.ALL=async e=>{let n=e.method.toUpperCase(),r={GET:t.handlers.GET,POST:t.handlers.POST,PATCH:t.handlers.PATCH};return n in r?await r[n](e):new Response(`Method Not Allowed`,{status:405,headers:{Allow:Object.keys(r).join(`, `)}})},t};export{dt as createAuth};

package/dist/logger-DjXkgSn5.js

@@ -0,0 +1 @@
+import{i as e,n as t}from"./env-CJtSi1eX.js";const n={ROUTER_INTERNAL_ERROR:{facility:10,severity:`error`,msgId:`ROUTER_INTERNAL_ERROR`,message:`Unhandled router error while processing the request`},INVALID_REQUEST:{facility:10,severity:`warning`,msgId:`INVALID_REQUEST`,message:`Request validation failed against the expected schema`},SERVER_ERROR:{facility:10,severity:`error`,msgId:`SERVER_ERROR`,message:`Unexpected internal server error during authentication`},OAUTH_PROTOCOL_ERROR:{facility:10,severity:`warning`,msgId:`OAUTH_PROTOCOL_ERROR`,message:`OAuth provider returned an invalid or unexpected protocol response`},OAUTH_AUTHORIZATION_ERROR:{facility:10,severity:`error`,msgId:`OAUTH_AUTHORIZATION_ERROR`,message:`OAuth authorization request was rejected or failed`},INVALID_OAUTH_CONFIGURATION:{facility:10,severity:`error`,msgId:`INVALID_OAUTH_CONFIGURATION`,message:`The OAuth provider configuration is invalid or incomplete`},OAUTH_ACCESS_TOKEN_REQUEST_INITIATED:{facility:10,severity:`debug`,msgId:`OAUTH_ACCESS_TOKEN_REQUEST_INITIATED`,message:`Starting OAuth access token request to the provider`},INVALID_OAUTH_ACCESS_TOKEN_RESPONSE:{facility:10,severity:`error`,msgId:`INVALID_OAUTH_ACCESS_TOKEN_RESPONSE`,message:`OAuth access token endpoint returned an invalid or malformed response`},OAUTH_ACCESS_TOKEN_ERROR:{facility:10,severity:`error`,msgId:`OAUTH_ACCESS_TOKEN_ERROR`,message:`OAuth access token endpoint returned an error response`},OAUTH_ACCESS_TOKEN_SUCCESS:{facility:10,severity:`info`,msgId:`OAUTH_ACCESS_TOKEN_SUCCESS`,message:`Successfully retrieved OAuth access token from the provider`},OAUTH_ACCESS_TOKEN_REQUEST_FAILED:{facility:10,severity:`error`,msgId:`OAUTH_ACCESS_TOKEN_REQUEST_FAILED`,message:`Network or server error while requesting OAuth access token`},OAUTH_USERINFO_REQUEST_INITIATED:{facility:10,severity:`debug`,msgId:`OAUTH_USERINFO_REQUEST_INITIATED`,message:`Starting OAuth userinfo request to the provider`},OAUTH_USERINFO_INVALID_RESPONSE:{facility:10,severity:`error`,msgId:`OAUTH_USERINFO_INVALID_RESPONSE`,message:`OAuth userinfo endpoint returned an invalid or malformed response`},OAUTH_USERINFO_ERROR:{facility:10,severity:`error`,msgId:`OAUTH_USERINFO_ERROR`,message:`OAuth userinfo endpoint returned an error response`},OAUTH_USERINFO_SUCCESS:{facility:10,severity:`info`,msgId:`OAUTH_USERINFO_SUCCESS`,message:`Successfully retrieved user information from the OAuth provider`},OAUTH_USERINFO_REQUEST_FAILED:{facility:10,severity:`error`,msgId:`OAUTH_USERINFO_REQUEST_FAILED`,message:`Network or server error while requesting user information from the OAuth provider`},OAUTH_CALLBACK_SUCCESS:{facility:4,severity:`info`,msgId:`OAUTH_CALLBACK_SUCCESS`,message:`OAuth callback completed successfully and session was created`},MISMATCHING_STATE:{facility:4,severity:`critical`,msgId:`MISMATCHING_STATE`,message:`OAuth response state parameter does not match the stored state value`},POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED:{facility:4,severity:`critical`,msgId:`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`,message:`Blocked redirect to untrusted or external URL (potential open redirect attack)`},OPEN_REDIRECT_ATTACK:{facility:4,severity:`warning`,msgId:`OPEN_REDIRECT_ATTACK`,message:`Detected redirect target that does not match the trusted origin`},SESSION_TOKEN_MISSING:{facility:4,severity:`warning`,msgId:`SESSION_TOKEN_MISSING`,message:`Session cookie is missing from the request`},CSRF_TOKEN_MISSING:{facility:4,severity:`warning`,msgId:`CSRF_TOKEN_MISSING`,message:`CSRF token cookie is missing from the request`},CSRF_HEADER_MISSING:{facility:4,severity:`warning`,msgId:`CSRF_HEADER_MISSING`,message:`CSRF header is missing from the request`},CSRF_TOKEN_INVALID:{facility:4,severity:`error`,msgId:`CSRF_TOKEN_INVALID`,message:`CSRF token verification failed or token is invalid`},SIGN_IN_INITIATED:{facility:4,severity:`info`,msgId:`SIGN_IN_INITIATED`,message:`Starting OAuth sign-in flow for the selected provider`},SIGN_OUT_ATTEMPT:{facility:4,severity:`debug`,msgId:`SIGN_OUT_ATTEMPT`,message:`Received sign-out request from client`},SIGN_OUT_CSRF_VERIFIED:{facility:4,severity:`info`,msgId:`SIGN_OUT_CSRF_VERIFIED`,message:`CSRF token was successfully verified during sign-out`},SIGN_OUT_SUCCESS:{facility:4,severity:`info`,msgId:`SIGN_OUT_SUCCESS`,message:`User session was cleared and sign-out completed successfully`},SIGN_OUT_REDIRECT:{facility:4,severity:`debug`,msgId:`SIGN_OUT_REDIRECT`,message:`Redirecting client after successful sign-out`},AUTH_SESSION_VALID:{facility:4,severity:`info`,msgId:`AUTH_SESSION_VALID`,message:`Session token is valid and user session was returned`},AUTH_SESSION_INVALID:{facility:4,severity:`notice`,msgId:`AUTH_SESSION_INVALID`,message:`Session token is missing, expired, or invalid`},INVALID_JWT_TOKEN:{facility:4,severity:`warning`,msgId:`INVALID_JWT_TOKEN`,message:`JWT session token failed validation during sign-out`},CSRF_TOKEN_REQUESTED:{facility:4,severity:`debug`,msgId:`CSRF_TOKEN_REQUESTED`,message:`Client requested a CSRF token`},CSRF_TOKEN_ISSUED:{facility:4,severity:`debug`,msgId:`CSRF_TOKEN_ISSUED`,message:`Issued a new CSRF token to the client`},INVALID_URL:{facility:10,severity:`error`,msgId:`INVALID_URL`,message:`Derived origin URL is invalid or malformed`},COOKIE_HTTPONLY_DISABLED:{facility:10,severity:`critical`,msgId:`COOKIE_HTTPONLY_DISABLED`,message:`Cookie is configured without HttpOnly. This allows JavaScript access via document.cookie and increases XSS exposure.`},COOKIE_WILDCARD_DOMAIN:{facility:10,severity:`critical`,msgId:`COOKIE_WILDCARD_DOMAIN`,message:`Cookie 'Domain' is set to a wildcard, which is insecure and should be avoided.`},COOKIE_SECURE_DISABLED:{facility:10,severity:`warning`,msgId:`COOKIE_SECURE_DISABLED`,message:`Cookie is configured with 'Secure' but the request is not HTTPS. The 'Secure' attribute will be ignored by the browser.`},COOKIE_SAMESITE_NONE_WITHOUT_SECURE:{facility:10,severity:`warning`,msgId:`COOKIE_SAMESITE_NONE_WITHOUT_SECURE`,message:`Cookie uses SameSite=None without Secure. Falling back to SameSite=Lax for safer defaults.`},COOKIE_INSECURE_IN_PRODUCTION:{facility:10,severity:`critical`,msgId:`COOKIE_INSECURE_IN_PRODUCTION`,message:`Cookies are being served over an insecure connection in production, which is a serious security risk.`},COOKIE_HOST_STRATEGY_INSECURE:{facility:10,severity:`critical`,msgId:`COOKIE_HOST_STRATEGY_INSECURE`,message:`__Host- cookies require a secure HTTPS context. Falling back to standard cookie settings.`},UNTRUSTED_ORIGIN:{facility:10,severity:`error`,msgId:`UNTRUSTED_ORIGIN`,message:`The constructed origin URL is not trusted.`},SESSION_REFRESHED:{facility:4,severity:`info`,msgId:`SESSION_REFRESHED`,message:`User session was refreshed with a new expiration time`},AUTH_SECURITY_ERROR:{facility:10,severity:`error`,msgId:`AUTH_SECURITY_ERROR`,message:`An authentication security error occurred`},CSRF_TOKEN_VERIFIED:{facility:4,severity:`info`,msgId:`CSRF_TOKEN_VERIFIED`,message:`CSRF token verification succeeded`},IDENTITY_VALIDATION_DISABLED:{facility:4,severity:`warning`,msgId:`IDENTITY_VALIDATION_DISABLED`,message:`Identity validation is disabled. User data will not be validated against a schema.`},IDENTITY_VALIDATION_FAILED:{facility:4,severity:`error`,msgId:`IDENTITY_VALIDATION_FAILED`,message:`User identity validation against the schema failed`},CREDENTIALS_SIGN_IN_SUCCESS:{facility:4,severity:`info`,msgId:`CREDENTIALS_SIGN_IN_SUCCESS`,message:`User successfully authenticated with credentials`},INVALID_CREDENTIALS:{facility:4,severity:`warning`,msgId:`INVALID_CREDENTIALS`,message:`Authentication failed due to invalid credentials`},CREDENTIALS_SIGN_IN_FAILED:{facility:4,severity:`error`,msgId:`CREDENTIALS_SIGN_IN_FAILED`,message:`An error occurred during credentials sign-in`}},r=(e,t)=>({...n[e],timestamp:new Date().toISOString(),hostname:`aura-auth`,...t}),i={debug:[`debug`,`info`,`notice`,`warning`,`error`,`critical`,`alert`,`emergency`],info:[`info`,`notice`,`warning`,`error`,`critical`,`alert`,`emergency`],warn:[`warning`,`error`,`critical`,`alert`,`emergency`],error:[`error`,`critical`,`alert`,`emergency`]},a=e=>e===`debug`||e===`info`||e===`warn`||e===`error`,o=e=>({emergency:0,alert:1,critical:2,error:3,warning:4,notice:5,info:6,debug:7})[e]??6,s=(e,t=`metadata`)=>{let n=Object.entries(e);return n.length===0?`[${t}]`:`[${t} ${n.map(([e,t])=>`${e}="${String(t).replace(/(["\\\]])/g,`\\$1`)}"`).join(` `)}]`},c=e=>{let{timestamp:t,hostname:n,appName:r=`aura-auth`,procId:i=`-`,msgId:a,structuredData:c,message:l}=e;return`<${(e.facility??16)*8+o(e.severity)}>1 ${t} ${n} ${r} ${i} ${a} ${s(c??{})} ${l}`},l=e=>{if(!e)return;let t=e.level,n=i[t]??[];return{level:t,log(t,i){let a=r(t,i);return n.includes(a.severity)&&e.log({timestamp:a.timestamp,appName:a.appName??`aura-auth`,hostname:a.hostname??`aura-auth`,...a}),a}}},u=n=>{let r=t(`LOG_LEVEL`),i=e(`DEBUG`);if(typeof n?.logger==`object`)return l({log:n.logger?.log||c,level:a(n.logger?.level)?n.logger?.level:a(r)?r:`error`});if(i||n?.logger===!0||r)return l({level:a(r)?r:`debug`,log:e=>{let t=c(e);console.log(t)}})};export{c as n,u as t};

package/dist/logger-G5PinyEc.cjs

@@ -0,0 +1 @@
+const e=require(`./env-7as-tgzO.cjs`),t={ROUTER_INTERNAL_ERROR:{facility:10,severity:`error`,msgId:`ROUTER_INTERNAL_ERROR`,message:`Unhandled router error while processing the request`},INVALID_REQUEST:{facility:10,severity:`warning`,msgId:`INVALID_REQUEST`,message:`Request validation failed against the expected schema`},SERVER_ERROR:{facility:10,severity:`error`,msgId:`SERVER_ERROR`,message:`Unexpected internal server error during authentication`},OAUTH_PROTOCOL_ERROR:{facility:10,severity:`warning`,msgId:`OAUTH_PROTOCOL_ERROR`,message:`OAuth provider returned an invalid or unexpected protocol response`},OAUTH_AUTHORIZATION_ERROR:{facility:10,severity:`error`,msgId:`OAUTH_AUTHORIZATION_ERROR`,message:`OAuth authorization request was rejected or failed`},INVALID_OAUTH_CONFIGURATION:{facility:10,severity:`error`,msgId:`INVALID_OAUTH_CONFIGURATION`,message:`The OAuth provider configuration is invalid or incomplete`},OAUTH_ACCESS_TOKEN_REQUEST_INITIATED:{facility:10,severity:`debug`,msgId:`OAUTH_ACCESS_TOKEN_REQUEST_INITIATED`,message:`Starting OAuth access token request to the provider`},INVALID_OAUTH_ACCESS_TOKEN_RESPONSE:{facility:10,severity:`error`,msgId:`INVALID_OAUTH_ACCESS_TOKEN_RESPONSE`,message:`OAuth access token endpoint returned an invalid or malformed response`},OAUTH_ACCESS_TOKEN_ERROR:{facility:10,severity:`error`,msgId:`OAUTH_ACCESS_TOKEN_ERROR`,message:`OAuth access token endpoint returned an error response`},OAUTH_ACCESS_TOKEN_SUCCESS:{facility:10,severity:`info`,msgId:`OAUTH_ACCESS_TOKEN_SUCCESS`,message:`Successfully retrieved OAuth access token from the provider`},OAUTH_ACCESS_TOKEN_REQUEST_FAILED:{facility:10,severity:`error`,msgId:`OAUTH_ACCESS_TOKEN_REQUEST_FAILED`,message:`Network or server error while requesting OAuth access token`},OAUTH_USERINFO_REQUEST_INITIATED:{facility:10,severity:`debug`,msgId:`OAUTH_USERINFO_REQUEST_INITIATED`,message:`Starting OAuth userinfo request to the provider`},OAUTH_USERINFO_INVALID_RESPONSE:{facility:10,severity:`error`,msgId:`OAUTH_USERINFO_INVALID_RESPONSE`,message:`OAuth userinfo endpoint returned an invalid or malformed response`},OAUTH_USERINFO_ERROR:{facility:10,severity:`error`,msgId:`OAUTH_USERINFO_ERROR`,message:`OAuth userinfo endpoint returned an error response`},OAUTH_USERINFO_SUCCESS:{facility:10,severity:`info`,msgId:`OAUTH_USERINFO_SUCCESS`,message:`Successfully retrieved user information from the OAuth provider`},OAUTH_USERINFO_REQUEST_FAILED:{facility:10,severity:`error`,msgId:`OAUTH_USERINFO_REQUEST_FAILED`,message:`Network or server error while requesting user information from the OAuth provider`},OAUTH_CALLBACK_SUCCESS:{facility:4,severity:`info`,msgId:`OAUTH_CALLBACK_SUCCESS`,message:`OAuth callback completed successfully and session was created`},MISMATCHING_STATE:{facility:4,severity:`critical`,msgId:`MISMATCHING_STATE`,message:`OAuth response state parameter does not match the stored state value`},POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED:{facility:4,severity:`critical`,msgId:`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`,message:`Blocked redirect to untrusted or external URL (potential open redirect attack)`},OPEN_REDIRECT_ATTACK:{facility:4,severity:`warning`,msgId:`OPEN_REDIRECT_ATTACK`,message:`Detected redirect target that does not match the trusted origin`},SESSION_TOKEN_MISSING:{facility:4,severity:`warning`,msgId:`SESSION_TOKEN_MISSING`,message:`Session cookie is missing from the request`},CSRF_TOKEN_MISSING:{facility:4,severity:`warning`,msgId:`CSRF_TOKEN_MISSING`,message:`CSRF token cookie is missing from the request`},CSRF_HEADER_MISSING:{facility:4,severity:`warning`,msgId:`CSRF_HEADER_MISSING`,message:`CSRF header is missing from the request`},CSRF_TOKEN_INVALID:{facility:4,severity:`error`,msgId:`CSRF_TOKEN_INVALID`,message:`CSRF token verification failed or token is invalid`},SIGN_IN_INITIATED:{facility:4,severity:`info`,msgId:`SIGN_IN_INITIATED`,message:`Starting OAuth sign-in flow for the selected provider`},SIGN_OUT_ATTEMPT:{facility:4,severity:`debug`,msgId:`SIGN_OUT_ATTEMPT`,message:`Received sign-out request from client`},SIGN_OUT_CSRF_VERIFIED:{facility:4,severity:`info`,msgId:`SIGN_OUT_CSRF_VERIFIED`,message:`CSRF token was successfully verified during sign-out`},SIGN_OUT_SUCCESS:{facility:4,severity:`info`,msgId:`SIGN_OUT_SUCCESS`,message:`User session was cleared and sign-out completed successfully`},SIGN_OUT_REDIRECT:{facility:4,severity:`debug`,msgId:`SIGN_OUT_REDIRECT`,message:`Redirecting client after successful sign-out`},AUTH_SESSION_VALID:{facility:4,severity:`info`,msgId:`AUTH_SESSION_VALID`,message:`Session token is valid and user session was returned`},AUTH_SESSION_INVALID:{facility:4,severity:`notice`,msgId:`AUTH_SESSION_INVALID`,message:`Session token is missing, expired, or invalid`},INVALID_JWT_TOKEN:{facility:4,severity:`warning`,msgId:`INVALID_JWT_TOKEN`,message:`JWT session token failed validation during sign-out`},CSRF_TOKEN_REQUESTED:{facility:4,severity:`debug`,msgId:`CSRF_TOKEN_REQUESTED`,message:`Client requested a CSRF token`},CSRF_TOKEN_ISSUED:{facility:4,severity:`debug`,msgId:`CSRF_TOKEN_ISSUED`,message:`Issued a new CSRF token to the client`},INVALID_URL:{facility:10,severity:`error`,msgId:`INVALID_URL`,message:`Derived origin URL is invalid or malformed`},COOKIE_HTTPONLY_DISABLED:{facility:10,severity:`critical`,msgId:`COOKIE_HTTPONLY_DISABLED`,message:`Cookie is configured without HttpOnly. This allows JavaScript access via document.cookie and increases XSS exposure.`},COOKIE_WILDCARD_DOMAIN:{facility:10,severity:`critical`,msgId:`COOKIE_WILDCARD_DOMAIN`,message:`Cookie 'Domain' is set to a wildcard, which is insecure and should be avoided.`},COOKIE_SECURE_DISABLED:{facility:10,severity:`warning`,msgId:`COOKIE_SECURE_DISABLED`,message:`Cookie is configured with 'Secure' but the request is not HTTPS. The 'Secure' attribute will be ignored by the browser.`},COOKIE_SAMESITE_NONE_WITHOUT_SECURE:{facility:10,severity:`warning`,msgId:`COOKIE_SAMESITE_NONE_WITHOUT_SECURE`,message:`Cookie uses SameSite=None without Secure. Falling back to SameSite=Lax for safer defaults.`},COOKIE_INSECURE_IN_PRODUCTION:{facility:10,severity:`critical`,msgId:`COOKIE_INSECURE_IN_PRODUCTION`,message:`Cookies are being served over an insecure connection in production, which is a serious security risk.`},COOKIE_HOST_STRATEGY_INSECURE:{facility:10,severity:`critical`,msgId:`COOKIE_HOST_STRATEGY_INSECURE`,message:`__Host- cookies require a secure HTTPS context. Falling back to standard cookie settings.`},UNTRUSTED_ORIGIN:{facility:10,severity:`error`,msgId:`UNTRUSTED_ORIGIN`,message:`The constructed origin URL is not trusted.`},SESSION_REFRESHED:{facility:4,severity:`info`,msgId:`SESSION_REFRESHED`,message:`User session was refreshed with a new expiration time`},AUTH_SECURITY_ERROR:{facility:10,severity:`error`,msgId:`AUTH_SECURITY_ERROR`,message:`An authentication security error occurred`},CSRF_TOKEN_VERIFIED:{facility:4,severity:`info`,msgId:`CSRF_TOKEN_VERIFIED`,message:`CSRF token verification succeeded`},IDENTITY_VALIDATION_DISABLED:{facility:4,severity:`warning`,msgId:`IDENTITY_VALIDATION_DISABLED`,message:`Identity validation is disabled. User data will not be validated against a schema.`},IDENTITY_VALIDATION_FAILED:{facility:4,severity:`error`,msgId:`IDENTITY_VALIDATION_FAILED`,message:`User identity validation against the schema failed`},CREDENTIALS_SIGN_IN_SUCCESS:{facility:4,severity:`info`,msgId:`CREDENTIALS_SIGN_IN_SUCCESS`,message:`User successfully authenticated with credentials`},INVALID_CREDENTIALS:{facility:4,severity:`warning`,msgId:`INVALID_CREDENTIALS`,message:`Authentication failed due to invalid credentials`},CREDENTIALS_SIGN_IN_FAILED:{facility:4,severity:`error`,msgId:`CREDENTIALS_SIGN_IN_FAILED`,message:`An error occurred during credentials sign-in`}},n=(e,n)=>({...t[e],timestamp:new Date().toISOString(),hostname:`aura-auth`,...n}),r={debug:[`debug`,`info`,`notice`,`warning`,`error`,`critical`,`alert`,`emergency`],info:[`info`,`notice`,`warning`,`error`,`critical`,`alert`,`emergency`],warn:[`warning`,`error`,`critical`,`alert`,`emergency`],error:[`error`,`critical`,`alert`,`emergency`]},i=e=>e===`debug`||e===`info`||e===`warn`||e===`error`,a=e=>({emergency:0,alert:1,critical:2,error:3,warning:4,notice:5,info:6,debug:7})[e]??6,o=(e,t=`metadata`)=>{let n=Object.entries(e);return n.length===0?`[${t}]`:`[${t} ${n.map(([e,t])=>`${e}="${String(t).replace(/(["\\\]])/g,`\\$1`)}"`).join(` `)}]`},s=e=>{let{timestamp:t,hostname:n,appName:r=`aura-auth`,procId:i=`-`,msgId:s,structuredData:c,message:l}=e;return`<${(e.facility??16)*8+a(e.severity)}>1 ${t} ${n} ${r} ${i} ${s} ${o(c??{})} ${l}`},c=e=>{if(!e)return;let t=e.level,i=r[t]??[];return{level:t,log(t,r){let a=n(t,r);return i.includes(a.severity)&&e.log({timestamp:a.timestamp,appName:a.appName??`aura-auth`,hostname:a.hostname??`aura-auth`,...a}),a}}},l=t=>{let n=e.n(`LOG_LEVEL`),r=e.i(`DEBUG`);if(typeof t?.logger==`object`)return c({log:t.logger?.log||s,level:i(t.logger?.level)?t.logger?.level:i(n)?n:`error`});if(r||t?.logger===!0||n)return c({level:i(n)?n:`debug`,log:e=>{let t=s(e);console.log(t)}})};Object.defineProperty(exports,`n`,{enumerable:!0,get:function(){return s}}),Object.defineProperty(exports,`t`,{enumerable:!0,get:function(){return l}});

package/dist/oauth/atlassian.cjs

@@ -1,57 +1 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/oauth/atlassian.ts
-var atlassian_exports = {};
-__export(atlassian_exports, {
-  atlassian: () => atlassian
-});
-module.exports = __toCommonJS(atlassian_exports);
-var atlassian = (options) => {
-  return {
-    id: "atlassian",
-    name: "Atlassian",
-    authorize: {
-      url: "https://auth.atlassian.com/authorize",
-      params: {
-        audience: "api.atlassian.com",
-        scope: "read:me read:account",
-        prompt: "consent"
-      }
-    },
-    authorizeURL: "https://auth.atlassian.com/authorize",
-    accessToken: "https://auth.atlassian.com/oauth/token",
-    userInfo: "https://api.atlassian.com/me",
-    scope: "read:me read:account",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.account_id,
-        name: profile.name,
-        email: profile.email,
-        image: profile.picture
-      };
-    },
-    ...options
-  };
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  atlassian
-});
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=e=>({id:`atlassian`,name:`Atlassian`,authorize:{url:`https://auth.atlassian.com/authorize`,params:{audience:`api.atlassian.com`,scope:`read:me read:account`,prompt:`consent`}},authorizeURL:`https://auth.atlassian.com/authorize`,accessToken:`https://auth.atlassian.com/oauth/token`,userInfo:`https://api.atlassian.com/me`,profile:e=>({sub:e.account_id,name:e.name,email:e.email,image:e.picture}),...e});exports.atlassian=e;

package/dist/oauth/atlassian.d.ts

@@ -1,12 +1,2 @@
-export { P as AtlassianProfile, Q as ExtendedProfile, V as atlassian } from '../index-_aXtxb_s.js';
-import '../@types/utility.js';
-import 'zod';
-import '../schemas.js';
-import 'zod/v4';
-import '@aura-stack/jose';
-import '@aura-stack/jose/jose';
-import '@aura-stack/jose/crypto';
-import '@aura-stack/router/cookie';
-import 'jose';
-import '@aura-stack/router';
-import 'zod/v4/core';
+import { bn as ExtendedProfile, xn as atlassian, yn as AtlassianProfile } from "../index-C9U6ICDT.js";
+export { AtlassianProfile, ExtendedProfile, atlassian };

package/dist/oauth/atlassian.js

@@ -1,6 +1 @@
-import {
-  atlassian
-} from "../chunk-C3A37LQC.js";
-export {
-  atlassian
-};
+const e=e=>({id:`atlassian`,name:`Atlassian`,authorize:{url:`https://auth.atlassian.com/authorize`,params:{audience:`api.atlassian.com`,scope:`read:me read:account`,prompt:`consent`}},authorizeURL:`https://auth.atlassian.com/authorize`,accessToken:`https://auth.atlassian.com/oauth/token`,userInfo:`https://api.atlassian.com/me`,profile:e=>({sub:e.account_id,name:e.name,email:e.email,image:e.picture}),...e});export{e as atlassian};

package/dist/oauth/bitbucket.cjs

@@ -1,49 +1 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/oauth/bitbucket.ts
-var bitbucket_exports = {};
-__export(bitbucket_exports, {
-  bitbucket: () => bitbucket
-});
-module.exports = __toCommonJS(bitbucket_exports);
-var bitbucket = (options) => {
-  return {
-    id: "bitbucket",
-    name: "Bitbucket",
-    authorizeURL: "https://bitbucket.org/site/oauth2/authorize",
-    accessToken: "https://bitbucket.org/site/oauth2/access_token",
-    userInfo: "https://api.bitbucket.org/2.0/user",
-    scope: "account email",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.uuid ?? profile.account_id,
-        name: profile.display_name ?? profile.nickname,
-        image: profile.links.avatar?.href,
-        email: void 0
-      };
-    },
-    ...options
-  };
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  bitbucket
-});
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=e=>({id:`bitbucket`,name:`Bitbucket`,authorize:{url:`https://bitbucket.org/site/oauth2/authorize`,params:{scope:`account email`,responseType:`code`}},authorizeURL:`https://bitbucket.org/site/oauth2/authorize`,accessToken:`https://bitbucket.org/site/oauth2/access_token`,userInfo:`https://api.bitbucket.org/2.0/user`,profile:e=>({sub:e.uuid??e.account_id,name:e.display_name??e.nickname,image:e.links.avatar?.href,email:void 0}),...e});exports.bitbucket=e;

package/dist/oauth/bitbucket.d.ts

@@ -1,12 +1,2 @@
-export { at as BitbucketProfile, au as bitbucket } from '../index-_aXtxb_s.js';
-import '../@types/utility.js';
-import 'zod';
-import '../schemas.js';
-import 'zod/v4';
-import '@aura-stack/jose';
-import '@aura-stack/jose/jose';
-import '@aura-stack/jose/crypto';
-import '@aura-stack/router/cookie';
-import 'jose';
-import '@aura-stack/router';
-import 'zod/v4/core';
+import { ir as bitbucket, rr as BitbucketProfile } from "../index-C9U6ICDT.js";
+export { BitbucketProfile, bitbucket };

package/dist/oauth/bitbucket.js

@@ -1,6 +1 @@
-import {
-  bitbucket
-} from "../chunk-4YHJ4IEQ.js";
-export {
-  bitbucket
-};
+const e=e=>({id:`bitbucket`,name:`Bitbucket`,authorize:{url:`https://bitbucket.org/site/oauth2/authorize`,params:{scope:`account email`,responseType:`code`}},authorizeURL:`https://bitbucket.org/site/oauth2/authorize`,accessToken:`https://bitbucket.org/site/oauth2/access_token`,userInfo:`https://api.bitbucket.org/2.0/user`,profile:e=>({sub:e.uuid??e.account_id,name:e.display_name??e.nickname,image:e.links.avatar?.href,email:void 0}),...e});export{e as bitbucket};

package/dist/oauth/click-up.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=e=>({id:`click-up`,name:`ClickUp`,authorize:`https://app.clickup.com/api`,accessToken:`https://api.clickup.com/api/v2/oauth/token`,userInfo:`https://api.clickup.com/api/v2/user`,profile:e=>({sub:String(e.user.id),name:e.user.username,email:e.user.email,image:e.user.profilePicture}),...e});exports.clickUp=e;

package/dist/oauth/click-up.d.ts

@@ -0,0 +1,2 @@
+import { _n as ClickUpProfile, vn as clickUp } from "../index-C9U6ICDT.js";
+export { ClickUpProfile, clickUp };

package/dist/oauth/click-up.js

@@ -0,0 +1 @@
+const e=e=>({id:`click-up`,name:`ClickUp`,authorize:`https://app.clickup.com/api`,accessToken:`https://api.clickup.com/api/v2/oauth/token`,userInfo:`https://api.clickup.com/api/v2/user`,profile:e=>({sub:String(e.user.id),name:e.user.username,email:e.user.email,image:e.user.profilePicture}),...e});export{e as clickUp};

package/dist/oauth/discord.cjs

@@ -1,57 +1 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/oauth/discord.ts
-var discord_exports = {};
-__export(discord_exports, {
-  discord: () => discord
-});
-module.exports = __toCommonJS(discord_exports);
-var discord = (options) => {
-  return {
-    id: "discord",
-    name: "Discord",
-    authorizeURL: "https://discord.com/oauth2/authorize",
-    accessToken: "https://discord.com/api/oauth2/token",
-    userInfo: "https://discord.com/api/users/@me",
-    scope: "identify email",
-    responseType: "code",
-    profile(profile) {
-      let image = "";
-      if (profile.avatar === null) {
-        const index = profile.discriminator === "0" ? (BigInt(profile.id) >> 22n) % 6n : Number(profile.discriminator) % 5;
-        image = `https://cdn.discordapp.com/embed/avatars/${index}.png`;
-      } else {
-        const format = profile.avatar.startsWith("a_") ? "gif" : "png";
-        image = `https://cdn.discordapp.com/avatars/${profile.id}/${profile.avatar}.${format}`;
-      }
-      return {
-        sub: profile.id,
-        name: profile.global_name ?? profile.username,
-        email: profile.email ?? "",
-        image
-      };
-    },
-    ...options
-  };
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  discord
-});
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=e=>({id:`discord`,name:`Discord`,authorize:{url:`https://discord.com/oauth2/authorize`,params:{scope:`identify email`,responseType:`code`}},authorizeURL:`https://discord.com/oauth2/authorize`,accessToken:`https://discord.com/api/oauth2/token`,userInfo:`https://discord.com/api/users/@me`,profile(e){let t=``;if(e.avatar===null)t=`https://cdn.discordapp.com/embed/avatars/${e.discriminator===`0`?(BigInt(e.id)>>22n)%6n:Number(e.discriminator)%5}.png`;else{let n=e.avatar.startsWith(`a_`)?`gif`:`png`;t=`https://cdn.discordapp.com/avatars/${e.id}/${e.avatar}.${n}`}return{sub:e.id,name:e.global_name??e.username,email:e.email??``,image:t}},...e});exports.discord=e;

package/dist/oauth/discord.d.ts

@@ -1,12 +1,2 @@
-export { ao as DiscordProfile, ap as Nameplate, aq as discord } from '../index-_aXtxb_s.js';
-import 'zod';
-import '../schemas.js';
-import 'zod/v4';
-import '@aura-stack/jose';
-import '@aura-stack/jose/jose';
-import '@aura-stack/jose/crypto';
-import '@aura-stack/router/cookie';
-import '../@types/utility.js';
-import 'jose';
-import '@aura-stack/router';
-import 'zod/v4/core';
+import { $n as Nameplate, Qn as DiscordProfile, er as discord } from "../index-C9U6ICDT.js";
+export { DiscordProfile, Nameplate, discord };

package/dist/oauth/discord.js

@@ -1,6 +1 @@
-import {
-  discord
-} from "../chunk-OVHNRULD.js";
-export {
-  discord
-};
+const e=e=>({id:`discord`,name:`Discord`,authorize:{url:`https://discord.com/oauth2/authorize`,params:{scope:`identify email`,responseType:`code`}},authorizeURL:`https://discord.com/oauth2/authorize`,accessToken:`https://discord.com/api/oauth2/token`,userInfo:`https://discord.com/api/users/@me`,profile(e){let t=``;if(e.avatar===null)t=`https://cdn.discordapp.com/embed/avatars/${e.discriminator===`0`?(BigInt(e.id)>>22n)%6n:Number(e.discriminator)%5}.png`;else{let n=e.avatar.startsWith(`a_`)?`gif`:`png`;t=`https://cdn.discordapp.com/avatars/${e.id}/${e.avatar}.${n}`}return{sub:e.id,name:e.global_name??e.username,email:e.email??``,image:t}},...e});export{e as discord};

package/dist/oauth/dribbble.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=e=>({id:`dribbble`,name:`Dribbble`,authorize:{url:`https://dribbble.com/oauth/authorize`,params:{scope:`public`}},accessToken:`https://dribbble.com/oauth/token`,userInfo:`https://api.dribbble.com/v2/user`,profile:e=>({sub:String(e.id),name:e.name,image:e.avatar_url,email:e.email}),...e});exports.dribbble=e;

package/dist/oauth/dribbble.d.ts

@@ -0,0 +1,2 @@
+import { gn as dribbble, hn as DribbbleTeams, mn as DribbbleProfile, pn as DribbbleDefault } from "../index-C9U6ICDT.js";
+export { DribbbleDefault, DribbbleProfile, DribbbleTeams, dribbble };

package/dist/oauth/dribbble.js

@@ -0,0 +1 @@
+const e=e=>({id:`dribbble`,name:`Dribbble`,authorize:{url:`https://dribbble.com/oauth/authorize`,params:{scope:`public`}},accessToken:`https://dribbble.com/oauth/token`,userInfo:`https://api.dribbble.com/v2/user`,profile:e=>({sub:String(e.id),name:e.name,image:e.avatar_url,email:e.email}),...e});export{e as dribbble};

package/dist/oauth/dropbox.cjs

@@ -1,53 +1 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/oauth/dropbox.ts
-var dropbox_exports = {};
-__export(dropbox_exports, {
-  dropbox: () => dropbox
-});
-module.exports = __toCommonJS(dropbox_exports);
-var dropbox = (options) => {
-  return {
-    id: "dropbox",
-    name: "Dropbox",
-    authorize: {
-      url: "https://www.dropbox.com/oauth2/authorize",
-      params: { scope: "account_info.read" }
-    },
-    accessToken: "https://api.dropboxapi.com/oauth2/token",
-    userInfo: {
-      method: "POST",
-      url: "https://api.dropboxapi.com/2/users/get_current_account"
-    },
-    profile(profile) {
-      return {
-        sub: profile.account_id,
-        name: profile.name.display_name,
-        email: profile.email,
-        image: profile.profile_photo_url
-      };
-    },
-    ...options
-  };
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  dropbox
-});
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=e=>({id:`dropbox`,name:`Dropbox`,authorize:{url:`https://www.dropbox.com/oauth2/authorize`,params:{scope:`account_info.read`}},accessToken:`https://api.dropboxapi.com/oauth2/token`,userInfo:{method:`POST`,url:`https://api.dropboxapi.com/2/users/get_current_account`},profile:e=>({sub:e.account_id,name:e.name.display_name,email:e.email,image:e.profile_photo_url}),...e});exports.dropbox=e;

package/dist/oauth/dropbox.d.ts

@@ -1,12 +1,2 @@
-export { W as AccountType, X as DropboxProfile, Y as FullTeam, Z as Name, _ as RootInfo, $ as dropbox } from '../index-_aXtxb_s.js';
-import 'zod';
-import '../schemas.js';
-import 'zod/v4';
-import '@aura-stack/jose';
-import '@aura-stack/jose/jose';
-import '@aura-stack/jose/crypto';
-import '@aura-stack/router/cookie';
-import '../@types/utility.js';
-import 'jose';
-import '@aura-stack/router';
-import 'zod/v4/core';
+import { Cn as DropboxProfile, Dn as dropbox, En as RootInfo, Sn as AccountType, Tn as Name, wn as FullTeam } from "../index-C9U6ICDT.js";
+export { AccountType, DropboxProfile, FullTeam, Name, RootInfo, dropbox };

package/dist/oauth/dropbox.js

@@ -1,6 +1 @@
-import {
-  dropbox
-} from "../chunk-QQEKY4XP.js";
-export {
-  dropbox
-};
+const e=e=>({id:`dropbox`,name:`Dropbox`,authorize:{url:`https://www.dropbox.com/oauth2/authorize`,params:{scope:`account_info.read`}},accessToken:`https://api.dropboxapi.com/oauth2/token`,userInfo:{method:`POST`,url:`https://api.dropboxapi.com/2/users/get_current_account`},profile:e=>({sub:e.account_id,name:e.name.display_name,email:e.email,image:e.profile_photo_url}),...e});export{e as dropbox};

package/dist/oauth/figma.cjs

@@ -1,49 +1 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/oauth/figma.ts
-var figma_exports = {};
-__export(figma_exports, {
-  figma: () => figma
-});
-module.exports = __toCommonJS(figma_exports);
-var figma = (options) => {
-  return {
-    id: "figma",
-    name: "Figma",
-    authorizeURL: "https://www.figma.com/oauth",
-    accessToken: "https://api.figma.com/v1/oauth/token",
-    userInfo: "https://api.figma.com/v1/me",
-    scope: "current_user:read",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.id,
-        name: profile.handle,
-        email: profile.email,
-        image: profile.img_url
-      };
-    },
-    ...options
-  };
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  figma
-});
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=e=>({id:`figma`,name:`Figma`,authorize:{url:`https://www.figma.com/oauth`,params:{scope:`current_user:read`,responseType:`code`}},accessToken:`https://api.figma.com/v1/oauth/token`,userInfo:`https://api.figma.com/v1/me`,profile:e=>({sub:e.id,name:e.handle,email:e.email,image:e.img_url}),...e});exports.figma=e;

package/dist/oauth/figma.d.ts

@@ -1,12 +1,2 @@
-export { ar as FigmaProfile, as as figma } from '../index-_aXtxb_s.js';
-import 'zod';
-import '../schemas.js';
-import 'zod/v4';
-import '@aura-stack/jose';
-import '@aura-stack/jose/jose';
-import '@aura-stack/jose/crypto';
-import '@aura-stack/router/cookie';
-import '../@types/utility.js';
-import 'jose';
-import '@aura-stack/router';
-import 'zod/v4/core';
+import { nr as figma, tr as FigmaProfile } from "../index-C9U6ICDT.js";
+export { FigmaProfile, figma };

package/dist/oauth/figma.js

@@ -1,6 +1 @@
-import {
-  figma
-} from "../chunk-KMMAZFSJ.js";
-export {
-  figma
-};
+const e=e=>({id:`figma`,name:`Figma`,authorize:{url:`https://www.figma.com/oauth`,params:{scope:`current_user:read`,responseType:`code`}},accessToken:`https://api.figma.com/v1/oauth/token`,userInfo:`https://api.figma.com/v1/me`,profile:e=>({sub:e.id,name:e.handle,email:e.email,image:e.img_url}),...e});export{e as figma};