@aura-stack/auth 0.5.0 → 0.7.0

package/dist/oauth/x.cjs

@@ -1,49 +1 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/oauth/x.ts
-var x_exports = {};
-__export(x_exports, {
-  x: () => x
-});
-module.exports = __toCommonJS(x_exports);
-var x = (options) => {
-  return {
-    id: "x",
-    name: "X",
-    authorizeURL: "https://twitter.com/i/oauth2/authorize",
-    accessToken: "https://api.twitter.com/2/oauth2/token",
-    userInfo: "https://api.twitter.com/2/users/me?user.fields=profile_image_url",
-    scope: "tweet.read users.read offline.access",
-    responseType: "code",
-    profile(profile) {
-      return {
-        sub: profile.data.id,
-        name: profile.data.name,
-        image: profile.data.profile_image_url,
-        email: void 0
-      };
-    },
-    ...options
-  };
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  x
-});
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=e=>({id:`x`,name:`X`,authorize:{url:`https://twitter.com/i/oauth2/authorize`,params:{scope:`tweet.read users.read offline.access`,response_type:`code`}},accessToken:`https://api.twitter.com/2/oauth2/token`,userInfo:`https://api.twitter.com/2/users/me?user.fields=profile_image_url`,profile:e=>({sub:e.data.id,name:e.data.name,image:e.data.profile_image_url,email:void 0}),...e});exports.x=e;

package/dist/oauth/x.d.ts

@@ -1,12 +1,2 @@
-export { ah as XProfile, ai as x } from '../index-_aXtxb_s.js';
-import 'zod';
-import '../schemas.js';
-import 'zod/v4';
-import '@aura-stack/jose';
-import '@aura-stack/jose/jose';
-import '@aura-stack/jose/crypto';
-import '@aura-stack/router/cookie';
-import '../@types/utility.js';
-import 'jose';
-import '@aura-stack/router';
-import 'zod/v4/core';
+import { Gn as XProfile, Kn as x } from "../index-C9U6ICDT.js";
+export { XProfile, x };

package/dist/oauth/x.js

@@ -1,6 +1 @@
-import {
-  x
-} from "../chunk-EEE7UM5T.js";
-export {
-  x
-};
+const e=e=>({id:`x`,name:`X`,authorize:{url:`https://twitter.com/i/oauth2/authorize`,params:{scope:`tweet.read users.read offline.access`,response_type:`code`}},accessToken:`https://api.twitter.com/2/oauth2/token`,userInfo:`https://api.twitter.com/2/users/me?user.fields=profile_image_url`,profile:e=>({sub:e.data.id,name:e.data.name,image:e.data.profile_image_url,email:void 0}),...e});export{e as x};

package/dist/oauth-D3_mnBOx.js

@@ -0,0 +1 @@
+import{n as e}from"./errors-Czt_w1t_.js";import{n as t}from"./env-CJtSi1eX.js";import{T as n}from"./assert-_fBNnaOk.js";import{github as r}from"./oauth/github.js";import{bitbucket as i}from"./oauth/bitbucket.js";import{figma as a}from"./oauth/figma.js";import{discord as o}from"./oauth/discord.js";import{gitlab as s}from"./oauth/gitlab.js";import{spotify as c}from"./oauth/spotify.js";import{x as l}from"./oauth/x.js";import{strava as u}from"./oauth/strava.js";import{mailchimp as d}from"./oauth/mailchimp.js";import{pinterest as f}from"./oauth/pinterest.js";import{twitch as p}from"./oauth/twitch.js";import{notion as m}from"./oauth/notion.js";import{dropbox as h}from"./oauth/dropbox.js";import{atlassian as g}from"./oauth/atlassian.js";import{clickUp as _}from"./oauth/click-up.js";import{dribbble as v}from"./oauth/dribbble.js";import{array as y,enum as b,null as x,number as S,object as C,string as w,union as T,z as E}from"zod/v4";const D=E.union([w().url(),C({url:w().url(),params:C({owner:w().optional(),responseType:b([`code`,`token`,`id_token`,`refresh_token`]).optional(),scope:w().optional()})})]),O=E.union([w().url(),C({url:w().url(),headers:E.record(w(),w()).optional()})]),k=E.union([w().url(),C({url:w().url(),headers:E.record(w(),w()).optional(),method:w().optional()})]),A=C({id:w(),name:w(),authorize:D.optional(),authorizeURL:w().url().optional(),accessToken:O,scope:w().optional(),userInfo:k,responseType:b([`code`,`token`,`id_token`,`refresh_token`]).optional(),clientId:w(),clientSecret:w(),profile:E.function().optional()}),j=C({authorize:D.optional(),authorizeURL:w().url().optional(),accessToken:O,scope:w().optional(),userInfo:k,responseType:b([`code`,`token`,`id_token`,`refresh_token`]).optional(),clientId:w(),clientSecret:w()}),M=j.extend({redirectURI:w(),state:w(),codeChallenge:w(),codeChallengeMethod:b([`plain`,`S256`])});C({state:w({message:`Missing state parameter in the OAuth authorization response.`}),code:w({message:`Missing code parameter in the OAuth authorization response.`})});const N=C({error:b([`invalid_request`,`unauthorized_client`,`access_denied`,`unsupported_response_type`,`invalid_scope`,`server_error`,`temporarily_unavailable`]),error_description:w().optional(),error_uri:w().optional(),state:w()});j.extend({redirectURI:w(),code:w(),codeVerifier:w().min(43).max(128)});const P=C({access_token:w(),token_type:w().optional(),expires_in:S().optional(),refresh_token:w().optional(),scope:T([w().optional().or(x()),y(w()).optional()])}),F=C({error:b([`invalid_request`,`invalid_client`,`invalid_grant`,`unauthorized_client`,`unsupported_grant_type`,`invalid_scope`]),error_description:w().optional(),error_uri:w().optional()}),I=C({error:w(),error_description:w().optional()}),L=C({clientId:E.string().min(1,`OAuth Client ID is required in the environment variables.`),clientSecret:E.string().min(1,`OAuth Client Secret is required in the environment variables.`)}),R={github:r,bitbucket:i,figma:a,discord:o,gitlab:s,spotify:c,x:l,strava:u,mailchimp:d,pinterest:f,twitch:p,notion:m,dropbox:h,atlassian:g,clickUp:_,dribbble:v},z=r=>{let i=L.safeParse({clientId:t(`${r.replace(`-`,`_`).toUpperCase()}_CLIENT_ID`),clientSecret:t(`${r.replace(`-`,`_`).toUpperCase()}_CLIENT_SECRET`)});if(!i.success)throw new e(`INVALID_ENVIRONMENT_CONFIGURATION`,JSON.stringify({[r]:n(i.error)},null,2));return i.data},B=t=>{if(typeof t==`string`){let r=z(t),i=R[t](),a=A.safeParse({...i,...r});if(!a.success)throw new e(`INVALID_OAUTH_PROVIDER_CONFIGURATION`,`Invalid configuration for OAuth provider "${t}": ${JSON.stringify({[t]:n(a.error)},null,2)}`);return a.data}let r=t.clientId&&t.clientSecret?{}:z(t.id),i=A.safeParse({...r,...t});if(!i.success){let r=JSON.stringify({[t.id]:n(i.error)},null,2);throw new e(`INVALID_OAUTH_PROVIDER_CONFIGURATION`,`Invalid configuration for OAuth provider "${t.id}": ${r}`)}return i.data},V=(t=[])=>t.reduce((t,n)=>{let r=B(n);if(r.id in t)throw new e(`DUPLICATED_OAUTH_PROVIDER_ID`,`Duplicate OAuth provider id "${r.id}" found. Each provider must have a unique id.`);return{...t,[r.id]:r}},{});export{M as a,P as i,V as n,N as o,F as r,I as s,R as t};

package/dist/oauth-gPiWxjBd.cjs

@@ -0,0 +1 @@
+require(`./identity-b8FCr0Oa.cjs`);const e=require(`./errors-DcK2ELlk.cjs`),t=require(`./env-7as-tgzO.cjs`),n=require(`./assert-hDwQ_SPO.cjs`),r=require(`./oauth/github.cjs`),i=require(`./oauth/bitbucket.cjs`),a=require(`./oauth/figma.cjs`),o=require(`./oauth/discord.cjs`),s=require(`./oauth/gitlab.cjs`),c=require(`./oauth/spotify.cjs`),l=require(`./oauth/x.cjs`),u=require(`./oauth/strava.cjs`),d=require(`./oauth/mailchimp.cjs`),f=require(`./oauth/pinterest.cjs`),p=require(`./oauth/twitch.cjs`),m=require(`./oauth/notion.cjs`),h=require(`./oauth/dropbox.cjs`),g=require(`./oauth/atlassian.cjs`),_=require(`./oauth/click-up.cjs`),v=require(`./oauth/dribbble.cjs`);let y=require(`zod/v4`);const b=y.z.union([(0,y.string)().url(),(0,y.object)({url:(0,y.string)().url(),params:(0,y.object)({owner:(0,y.string)().optional(),responseType:(0,y.enum)([`code`,`token`,`id_token`,`refresh_token`]).optional(),scope:(0,y.string)().optional()})})]),x=y.z.union([(0,y.string)().url(),(0,y.object)({url:(0,y.string)().url(),headers:y.z.record((0,y.string)(),(0,y.string)()).optional()})]),S=y.z.union([(0,y.string)().url(),(0,y.object)({url:(0,y.string)().url(),headers:y.z.record((0,y.string)(),(0,y.string)()).optional(),method:(0,y.string)().optional()})]),C=(0,y.object)({id:(0,y.string)(),name:(0,y.string)(),authorize:b.optional(),authorizeURL:(0,y.string)().url().optional(),accessToken:x,scope:(0,y.string)().optional(),userInfo:S,responseType:(0,y.enum)([`code`,`token`,`id_token`,`refresh_token`]).optional(),clientId:(0,y.string)(),clientSecret:(0,y.string)(),profile:y.z.function().optional()}),w=(0,y.object)({authorize:b.optional(),authorizeURL:(0,y.string)().url().optional(),accessToken:x,scope:(0,y.string)().optional(),userInfo:S,responseType:(0,y.enum)([`code`,`token`,`id_token`,`refresh_token`]).optional(),clientId:(0,y.string)(),clientSecret:(0,y.string)()}),T=w.extend({redirectURI:(0,y.string)(),state:(0,y.string)(),codeChallenge:(0,y.string)(),codeChallengeMethod:(0,y.enum)([`plain`,`S256`])});(0,y.object)({state:(0,y.string)({message:`Missing state parameter in the OAuth authorization response.`}),code:(0,y.string)({message:`Missing code parameter in the OAuth authorization response.`})});const E=(0,y.object)({error:(0,y.enum)([`invalid_request`,`unauthorized_client`,`access_denied`,`unsupported_response_type`,`invalid_scope`,`server_error`,`temporarily_unavailable`]),error_description:(0,y.string)().optional(),error_uri:(0,y.string)().optional(),state:(0,y.string)()});w.extend({redirectURI:(0,y.string)(),code:(0,y.string)(),codeVerifier:(0,y.string)().min(43).max(128)});const D=(0,y.object)({access_token:(0,y.string)(),token_type:(0,y.string)().optional(),expires_in:(0,y.number)().optional(),refresh_token:(0,y.string)().optional(),scope:(0,y.union)([(0,y.string)().optional().or((0,y.null)()),(0,y.array)((0,y.string)()).optional()])}),O=(0,y.object)({error:(0,y.enum)([`invalid_request`,`invalid_client`,`invalid_grant`,`unauthorized_client`,`unsupported_grant_type`,`invalid_scope`]),error_description:(0,y.string)().optional(),error_uri:(0,y.string)().optional()}),k=(0,y.object)({error:(0,y.string)(),error_description:(0,y.string)().optional()}),A=(0,y.object)({clientId:y.z.string().min(1,`OAuth Client ID is required in the environment variables.`),clientSecret:y.z.string().min(1,`OAuth Client Secret is required in the environment variables.`)}),j={github:r.github,bitbucket:i.bitbucket,figma:a.figma,discord:o.discord,gitlab:s.gitlab,spotify:c.spotify,x:l.x,strava:u.strava,mailchimp:d.mailchimp,pinterest:f.pinterest,twitch:p.twitch,notion:m.notion,dropbox:h.dropbox,atlassian:g.atlassian,clickUp:_.clickUp,dribbble:v.dribbble},M=r=>{let i=A.safeParse({clientId:t.n(`${r.replace(`-`,`_`).toUpperCase()}_CLIENT_ID`),clientSecret:t.n(`${r.replace(`-`,`_`).toUpperCase()}_CLIENT_SECRET`)});if(!i.success)throw new e.n(`INVALID_ENVIRONMENT_CONFIGURATION`,JSON.stringify({[r]:n.T(i.error)},null,2));return i.data},N=t=>{if(typeof t==`string`){let r=M(t),i=j[t](),a=C.safeParse({...i,...r});if(!a.success)throw new e.n(`INVALID_OAUTH_PROVIDER_CONFIGURATION`,`Invalid configuration for OAuth provider "${t}": ${JSON.stringify({[t]:n.T(a.error)},null,2)}`);return a.data}let r=t.clientId&&t.clientSecret?{}:M(t.id),i=C.safeParse({...r,...t});if(!i.success){let r=JSON.stringify({[t.id]:n.T(i.error)},null,2);throw new e.n(`INVALID_OAUTH_PROVIDER_CONFIGURATION`,`Invalid configuration for OAuth provider "${t.id}": ${r}`)}return i.data},P=(t=[])=>t.reduce((t,n)=>{let r=N(n);if(r.id in t)throw new e.n(`DUPLICATED_OAUTH_PROVIDER_ID`,`Duplicate OAuth provider id "${r.id}" found. Each provider must have a unique id.`);return{...t,[r.id]:r}},{});Object.defineProperty(exports,`a`,{enumerable:!0,get:function(){return T}}),Object.defineProperty(exports,`i`,{enumerable:!0,get:function(){return D}}),Object.defineProperty(exports,`n`,{enumerable:!0,get:function(){return P}}),Object.defineProperty(exports,`o`,{enumerable:!0,get:function(){return E}}),Object.defineProperty(exports,`r`,{enumerable:!0,get:function(){return O}}),Object.defineProperty(exports,`s`,{enumerable:!0,get:function(){return k}}),Object.defineProperty(exports,`t`,{enumerable:!0,get:function(){return j}});

package/dist/shared/crypto.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`}),require(`../identity-b8FCr0Oa.cjs`);const e=require(`../crypto-D6_SoGMH.cjs`);let t=require(`@aura-stack/jose/jose`);exports.createCSRF=e.t,exports.createHash=e.n,Object.defineProperty(exports,`createKeyPair`,{enumerable:!0,get:function(){return t.generateKeyPair}}),exports.createPKCE=e.r,exports.createSecretValue=e.i,exports.exportJWKKeyPair=e.a,exports.hashPassword=e.o,exports.importPEMKeyPair=e.s,exports.verifyCSRF=e.c,exports.verifyPassword=e.l;

package/dist/shared/crypto.d.ts

@@ -0,0 +1,71 @@
+import { Ct as JoseInstance, Vt as AsymmetricKeyPairFromEnv, dt as AuthRuntimeConfig, ln as User } from "../index-C9U6ICDT.js";
+import * as _$_aura_stack_jose_jose0 from "@aura-stack/jose/jose";
+import { GenerateKeyPairOptions, generateKeyPair as createKeyPair } from "@aura-stack/jose/jose";
+
+//#region src/shared/crypto.d.ts
+declare const createSecretValue: (length?: number) => string;
+declare const createHash: (data: string) => Promise<string>;
+/**
+ * Creates the code challenge flow for PKCE OAuth flow. It generates a code verifier and its corresponding
+ * code challenge using SHA-256 hashing.
+ *   - code_verifier: A cryptographically random string used to mitigate authorization code interception attacks.
+ *   - code_challenge: A hashed version of the code_verifier sent in the authorization request.
+ *   - method: The method used to generate the code challenge, typically "S256" for SHA-256.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc7636#section-4.1
+ */
+declare const createPKCE: (verifier?: string) => Promise<{
+  codeVerifier: string;
+  codeChallenge: string;
+  method: string;
+}>;
+/**
+ * Creates a CSRF token to be used in OAuth flows to prevent cross-site request forgery attacks.
+ *
+ * @param csrfCookie - Optional existing CSRF cookie to verify and reuse
+ * @returns Signed CSRF token
+ */
+declare const createCSRF: (jose: AuthRuntimeConfig["jose"], csrfCookie?: string) => Promise<string>;
+declare const verifyCSRF: <DefaultUser extends User = User>(jose: JoseInstance<DefaultUser>, cookie: string, header: string) => Promise<boolean>;
+/**
+ * Hashes a password using PBKDF2 with SHA-256.
+ * PBKDF2 is available in standard Web Crypto (SubtleCrypto).
+ *
+ * @param password - The password to hash.
+ * @param salt - Optional salt (base64url encoded). If not provided, a random salt will be generated.
+ * @param iterations - The number of PBKDF2 iterations. Default is 100,000.
+ * @returns The hashed password in the format `iterations:salt:hash` (all segments base64url encoded).
+ */
+declare const hashPassword: (password: string, salt?: string, iterations?: number) => Promise<string>;
+/**
+ * Verifies a password against a hashed value.
+ *
+ * @param password - The password to verify.
+ * @param hashedPassword - The hashed password to compare against.
+ * @returns A promise that resolves to true if the password matches the hash, false otherwise.
+ */
+declare const verifyPassword: (password: string, hashedPassword: string) => Promise<boolean>;
+/**
+ * Imports a PEM-formatted asymmetric key pair from strings.
+ *
+ * @param key - An object containing the public and private keys as PEM-formatted strings
+ * @param algorithm - The intended algorithm for the keys (e.g. "RS256" for RSA signing, "RSA-OAEP" for RSA encryption)
+ * @returns A Promise that resolves to a CryptoKeyPair with the imported keys
+ */
+declare const importPEMKeyPair: (key: AsymmetricKeyPairFromEnv, algorithm: string) => Promise<{
+  publicKey: CryptoKey;
+  privateKey: CryptoKey;
+}>;
+/**
+ * Generates a new asymmetric key pair and exports it in JWK format.
+ *
+ * @param alg - The intended algorithm for the keys (e.g. "RS256" for RSA signing, "RSA-OAEP" for RSA encryption)
+ * @param options - Optional parameters for key generation (e.g. modulusLength for RSA)
+ * @returns A Promise that resolves to an object containing the public and private keys in JWK format
+ */
+declare const exportJWKKeyPair: (alg: string, options?: GenerateKeyPairOptions) => Promise<{
+  publicKey: _$_aura_stack_jose_jose0.JWK;
+  privateKey: _$_aura_stack_jose_jose0.JWK;
+}>;
+//#endregion
+export { createCSRF, createHash, createKeyPair, createPKCE, createSecretValue, exportJWKKeyPair, hashPassword, importPEMKeyPair, verifyCSRF, verifyPassword };

package/dist/shared/crypto.js

@@ -0,0 +1 @@
+import{a as e,c as t,i as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"../crypto-DyrRzBSQ.js";export{c as createCSRF,i as createHash,o as createKeyPair,n as createPKCE,e as createSecretValue,a as exportJWKKeyPair,s as hashPassword,t as importPEMKeyPair,r as verifyCSRF,l as verifyPassword};

package/dist/shared/identity.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require(`../identity-b8FCr0Oa.cjs`);exports.UserIdentity=e.t,exports.UserIdentityArkType=e.n,exports.UserIdentityTypeBox=e.r,exports.UserIdentityValibot=e.i,exports.createIdentity=e.a;

package/dist/shared/identity.d.ts

@@ -0,0 +1,2 @@
+import { Q as InferZodShape, W as EditableShape, X as InferSession, Y as FromShapeToObject, Z as InferUser, _r as UserShape, at as ValibotShapeToObject, br as UserShapeValibot, cr as Identities, dr as IsZod, fr as SchemaTypes, gr as UserIdentityValibot, hr as UserIdentityTypeBox, it as UserFrom, lr as IsArkType, mr as UserIdentityArkType, nt as SessionFrom, pr as UserIdentity, rt as TypeboxShapeToObject, st as ZodShapeToObject, ur as IsValibot, vr as UserShapeArkType, xr as createIdentity, yr as UserShapeTypeBox, z as ArktypeShapeToObject } from "../index-C9U6ICDT.js";
+export { ArktypeShapeToObject, EditableShape, FromShapeToObject, Identities, InferSession, InferUser, InferZodShape, IsArkType, IsValibot, IsZod, SchemaTypes, SessionFrom, TypeboxShapeToObject, UserFrom, UserIdentity, UserIdentityArkType, UserIdentityTypeBox, UserIdentityValibot, UserShape, UserShapeArkType, UserShapeTypeBox, UserShapeValibot, ValibotShapeToObject, ZodShapeToObject, createIdentity };

package/dist/shared/identity.js

@@ -0,0 +1 @@
+import{g as e,h as t,t as n,y as r}from"../assert-_fBNnaOk.js";import{z as i}from"zod/v4";import*as a from"valibot";import{type as o}from"arktype";import{Type as s}from"typebox";const c=i.object({sub:i.string(),name:i.string().nullable().optional(),image:i.string().nullable().optional(),email:i.email().nullable().optional()}),l=a.object({sub:a.string(),name:a.optional(a.nullable(a.string())),image:a.optional(a.nullable(a.string())),email:a.optional(a.nullable(a.pipe(a.string(),a.email())))}),u=o({sub:`string`,name:`string | null?`,image:`string | null?`,email:`string.email | null?`}),d=s.Object({sub:s.String(),name:s.Optional(s.Union([s.String(),s.Null()])),image:s.Optional(s.Union([s.String(),s.Null()])),email:s.Optional(s.Union([s.String({format:`email`}),s.Null()]))}),f=o=>n(o)?o:e(o)?a.object(o):r(o)?i.object(o):t(o)?s.Object(o):i.object(o);export{c as UserIdentity,u as UserIdentityArkType,d as UserIdentityTypeBox,l as UserIdentityValibot,f as createIdentity};

package/dist/shared/index.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require(`../assert-hDwQ_SPO.cjs`),t=require(`../logger-G5PinyEc.cjs`);exports.createBasicAuthHeader=e.S,exports.createSyslogMessage=t.n;

package/dist/shared/index.d.ts

@@ -0,0 +1,5 @@
+import { sr as createSyslogMessage } from "../index-C9U6ICDT.js";
+//#region src/shared/utils.d.ts
+declare const createBasicAuthHeader: (username: string, password: string) => string;
+//#endregion
+export { createBasicAuthHeader, createSyslogMessage };

package/dist/shared/index.js

@@ -0,0 +1 @@
+import{S as e}from"../assert-_fBNnaOk.js";import{n as t}from"../logger-DjXkgSn5.js";export{e as createBasicAuthHeader,t as createSyslogMessage};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aura-stack/auth",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "private": false,
   "type": "module",
   "description": "Core auth for @aura-stack/auth",
@@ -12,6 +12,7 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/@aura-stack/auth"
   },
+  "sideEffects": false,
   "files": [
     "dist"
   ],
@@ -21,6 +22,11 @@
       "import": "./dist/index.js",
       "require": "./dist/index.cjs"
     },
+    "./oauth": {
+      "types": "./dist/oauth/index.d.ts",
+      "import": "./dist/oauth/index.js",
+      "require": "./dist/oauth/index.cjs"
+    },
     "./oauth/*": {
       "types": "./dist/oauth/*.d.ts",
       "import": "./dist/oauth/*.js",
@@ -35,6 +41,21 @@
       "types": "./dist/client/index.d.ts",
       "import": "./dist/client/index.js",
       "require": "./dist/client/index.cjs"
+    },
+    "./identity": {
+      "types": "./dist/shared/identity.d.ts",
+      "import": "./dist/shared/identity.js",
+      "require": "./dist/shared/identity.cjs"
+    },
+    "./crypto": {
+      "types": "./dist/shared/crypto.d.ts",
+      "import": "./dist/shared/crypto.js",
+      "require": "./dist/shared/crypto.cjs"
+    },
+    "./shared": {
+      "types": "./dist/shared/index.d.ts",
+      "import": "./dist/shared/index.js",
+      "require": "./dist/shared/index.cjs"
     }
   },
   "keywords": [
@@ -49,26 +70,31 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@aura-stack/router": "^0.6.0",
+    "@aura-stack/router": "^0.7.0",
+    "arktype": "^2.2.0",
+    "typebox": "^1.1.38",
+    "valibot": "^1.4.0",
     "zod": "4.3.5",
-    "@aura-stack/jose": "0.4.0"
+    "@aura-stack/jose": "0.6.0"
   },
   "devDependencies": {
     "typescript": "^5.9.2",
-    "@aura-stack/tsconfig": "0.0.0",
-    "@aura-stack/tsup-config": "0.0.0"
+    "vitest": "4.1.4",
+    "@aura-stack/tsdown-config": "0.0.0",
+    "@aura-stack/tsconfig": "0.0.0"
   },
   "scripts": {
-    "dev": "tsup --watch",
-    "build": "tsup",
+    "dev": "tsdown --watch",
+    "build": "tsdown",
+    "lint": "oxlint",
+    "lint:fix": "oxlint --fix",
     "test": "vitest --run",
     "test:watch": "vitest",
     "test:coverage": "vitest --run --coverage",
-    "format": "prettier --write . --cache --cache-location .cache/.prettiercache",
-    "format:check": "prettier --check . --cache --cache-location .cache/.prettiercache",
+    "format": "oxfmt",
+    "format:check": "oxfmt --check",
     "type-check": "tsc --noEmit",
     "clean": "rm -rf dist",
-    "clean:cts": "find dist -type f -name \"*.cts\" -delete",
-    "prepublish": "pnpm clean:cts"
+    "clean:cts": "find dist -type f -name \"*.cts\" -delete"
   }
 }

package/dist/@types/router.d.cjs

@@ -1 +0,0 @@
-"use strict";

package/dist/@types/router.d.d.ts

@@ -1,16 +0,0 @@
-import { R as RouterGlobalContext } from '../index-_aXtxb_s.js';
-import 'zod';
-import '../schemas.js';
-import 'zod/v4';
-import '@aura-stack/jose';
-import '@aura-stack/jose/jose';
-import '@aura-stack/jose/crypto';
-import '@aura-stack/router/cookie';
-import './utility.js';
-import 'jose';
-import '@aura-stack/router';
-import 'zod/v4/core';
-
-declare module "@aura-stack/router" {
-    interface GlobalContext extends RouterGlobalContext {}
-}

package/dist/@types/utility.cjs

@@ -1,18 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/@types/utility.ts
-var utility_exports = {};
-module.exports = __toCommonJS(utility_exports);

package/dist/@types/utility.d.ts

@@ -1,6 +0,0 @@
-type Prettify<T> = {
-    [K in keyof T]: T[K];
-};
-type LiteralUnion<T extends U, U = string> = T | (U & Record<never, never>);
-
-export type { LiteralUnion, Prettify };

package/dist/@types/utility.js

@@ -1 +0,0 @@
-import "../chunk-PG7UYFG5.js";

package/dist/actions/callback/access-token.cjs

@@ -1,250 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/actions/callback/access-token.ts
-var access_token_exports = {};
-__export(access_token_exports, {
-  createAccessToken: () => createAccessToken
-});
-module.exports = __toCommonJS(access_token_exports);
-
-// src/request.ts
-var fetchAsync = async (url, options2 = {}, timeout = 5e3) => {
-  const controller = new AbortController();
-  const timeoutId = setTimeout(() => controller.abort(), timeout);
-  const response = await fetch(url, {
-    ...options2,
-    signal: controller.signal
-  }).finally(() => clearTimeout(timeoutId));
-  return response;
-};
-
-// src/errors.ts
-var OAuthProtocolError = class extends Error {
-  type = "OAUTH_PROTOCOL_ERROR";
-  error;
-  errorURI;
-  constructor(error, description, errorURI, options2) {
-    super(description, options2);
-    this.error = error;
-    this.errorURI = errorURI;
-    this.name = new.target.name;
-    Error.captureStackTrace(this, new.target);
-  }
-};
-var AuthInternalError = class extends Error {
-  type = "AUTH_INTERNAL_ERROR";
-  code;
-  constructor(code, message, options2) {
-    super(message, options2);
-    this.code = code;
-    this.name = new.target.name;
-    Error.captureStackTrace(this, new.target);
-  }
-};
-
-// src/schemas.ts
-var import_v4 = require("zod/v4");
-var AuthorizeConfigSchema = import_v4.z.union([
-  (0, import_v4.string)().url(),
-  (0, import_v4.object)({
-    url: (0, import_v4.string)().url(),
-    params: (0, import_v4.object)({
-      responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
-      scope: (0, import_v4.string)().optional()
-    })
-  })
-]);
-var AccessTokenConfigSchema = import_v4.z.union([
-  (0, import_v4.string)().url(),
-  (0, import_v4.object)({
-    url: (0, import_v4.string)().url(),
-    headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional()
-  })
-]);
-var UserInfoConfigSchema = import_v4.z.union([
-  (0, import_v4.string)().url(),
-  (0, import_v4.object)({
-    url: (0, import_v4.string)().url(),
-    headers: import_v4.z.record((0, import_v4.string)(), (0, import_v4.string)()).optional(),
-    method: (0, import_v4.string)().optional()
-  })
-]);
-var OAuthProviderCredentialsSchema = (0, import_v4.object)({
-  id: (0, import_v4.string)(),
-  name: (0, import_v4.string)(),
-  authorize: AuthorizeConfigSchema.optional(),
-  /** @deprecated */
-  authorizeURL: (0, import_v4.string)().url().optional(),
-  accessToken: AccessTokenConfigSchema,
-  /** @deprecated */
-  scope: (0, import_v4.string)().optional(),
-  userInfo: UserInfoConfigSchema,
-  /** @deprecated */
-  responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
-  clientId: (0, import_v4.string)(),
-  clientSecret: (0, import_v4.string)(),
-  profile: import_v4.z.function().optional()
-});
-var OAuthProviderConfigSchema = (0, import_v4.object)({
-  authorize: AuthorizeConfigSchema.optional(),
-  /** @deprecated */
-  authorizeURL: (0, import_v4.string)().url().optional(),
-  accessToken: AccessTokenConfigSchema,
-  /** @deprecated */
-  scope: (0, import_v4.string)().optional(),
-  userInfo: UserInfoConfigSchema,
-  /** @deprecated */
-  responseType: (0, import_v4.enum)(["code", "token", "id_token", "refresh_token"]).optional(),
-  clientId: (0, import_v4.string)(),
-  clientSecret: (0, import_v4.string)()
-});
-var OAuthAuthorization = OAuthProviderConfigSchema.extend({
-  redirectURI: (0, import_v4.string)(),
-  state: (0, import_v4.string)(),
-  codeChallenge: (0, import_v4.string)(),
-  codeChallengeMethod: (0, import_v4.enum)(["plain", "S256"])
-});
-var OAuthAuthorizationResponse = (0, import_v4.object)({
-  state: (0, import_v4.string)({ message: "Missing state parameter in the OAuth authorization response." }),
-  code: (0, import_v4.string)({ message: "Missing code parameter in the OAuth authorization response." })
-});
-var OAuthAuthorizationErrorResponse = (0, import_v4.object)({
-  error: (0, import_v4.enum)([
-    "invalid_request",
-    "unauthorized_client",
-    "access_denied",
-    "unsupported_response_type",
-    "invalid_scope",
-    "server_error",
-    "temporarily_unavailable"
-  ]),
-  error_description: (0, import_v4.string)().optional(),
-  error_uri: (0, import_v4.string)().optional(),
-  state: (0, import_v4.string)()
-});
-var OAuthAccessToken = OAuthProviderConfigSchema.extend({
-  redirectURI: (0, import_v4.string)(),
-  code: (0, import_v4.string)(),
-  codeVerifier: (0, import_v4.string)().min(43).max(128)
-});
-var OAuthAccessTokenResponse = (0, import_v4.object)({
-  access_token: (0, import_v4.string)(),
-  token_type: (0, import_v4.string)().optional(),
-  expires_in: (0, import_v4.number)().optional(),
-  refresh_token: (0, import_v4.string)().optional(),
-  scope: (0, import_v4.union)([(0, import_v4.string)().optional().or((0, import_v4.null)()), (0, import_v4.array)((0, import_v4.string)()).optional()])
-});
-var OAuthAccessTokenErrorResponse = (0, import_v4.object)({
-  error: (0, import_v4.enum)([
-    "invalid_request",
-    "invalid_client",
-    "invalid_grant",
-    "unauthorized_client",
-    "unsupported_grant_type",
-    "invalid_scope"
-  ]),
-  error_description: (0, import_v4.string)().optional(),
-  error_uri: (0, import_v4.string)().optional()
-});
-var OAuthErrorResponse = (0, import_v4.object)({
-  error: (0, import_v4.string)(),
-  error_description: (0, import_v4.string)().optional()
-});
-var OAuthEnvSchema = (0, import_v4.object)({
-  clientId: import_v4.z.string().min(1, "OAuth Client ID is required in the environment variables."),
-  clientSecret: import_v4.z.string().min(1, "OAuth Client Secret is required in the environment variables.")
-});
-
-// src/actions/callback/access-token.ts
-var createAccessToken = async (oauthConfig, redirectURI, code, codeVerifier, logger) => {
-  const { accessToken, clientId, clientSecret } = oauthConfig;
-  if (!clientId || !clientSecret || !redirectURI || !code || !codeVerifier || !accessToken) {
-    logger?.log("INVALID_OAUTH_CONFIGURATION", {
-      structuredData: {
-        has_client_id: Boolean(clientId),
-        has_client_secret: Boolean(clientSecret),
-        has_access_token: Boolean(accessToken),
-        has_redirect_uri: Boolean(redirectURI),
-        has_code: Boolean(code),
-        has_code_verifier: Boolean(codeVerifier)
-      }
-    });
-    throw new AuthInternalError("INVALID_OAUTH_CONFIGURATION", "The OAuth provider configuration is invalid.");
-  }
-  const tokenURL = typeof accessToken === "string" ? accessToken : accessToken.url;
-  const extraHeaders = typeof accessToken === "string" ? void 0 : accessToken.headers;
-  try {
-    logger?.log("OAUTH_ACCESS_TOKEN_REQUEST_INITIATED", {
-      structuredData: {
-        has_client_id: Boolean(clientId),
-        redirect_uri: redirectURI,
-        grant_type: "authorization_code"
-      }
-    });
-    const response = await fetchAsync(tokenURL, {
-      method: "POST",
-      headers: {
-        ...extraHeaders ?? {},
-        Accept: "application/json",
-        "Content-Type": "application/x-www-form-urlencoded"
-      },
-      body: new URLSearchParams({
-        client_id: clientId,
-        client_secret: clientSecret,
-        code,
-        redirect_uri: redirectURI,
-        grant_type: "authorization_code",
-        code_verifier: codeVerifier
-      }).toString()
-    });
-    if (!response.ok) {
-      logger?.log("INVALID_OAUTH_ACCESS_TOKEN_RESPONSE");
-      throw new OAuthProtocolError("invalid_request", "Invalid access token response");
-    }
-    const json = await response.json();
-    const token = OAuthAccessTokenResponse.safeParse(json);
-    if (!token.success) {
-      const { success, data } = OAuthAccessTokenErrorResponse.safeParse(json);
-      if (!success) {
-        logger?.log("INVALID_OAUTH_ACCESS_TOKEN_RESPONSE");
-        throw new OAuthProtocolError("invalid_request", "Invalid access token response format");
-      }
-      logger?.log("OAUTH_ACCESS_TOKEN_ERROR", {
-        structuredData: {
-          error: data.error,
-          error_description: data.error_description ?? ""
-        }
-      });
-      throw new OAuthProtocolError("INVALID_ACCESS_TOKEN", "Failed to retrieve access token");
-    }
-    logger?.log("OAUTH_ACCESS_TOKEN_SUCCESS");
-    return token.data;
-  } catch (error) {
-    logger?.log("OAUTH_ACCESS_TOKEN_REQUEST_FAILED");
-    if (error instanceof Error) {
-      throw new OAuthProtocolError("server_error", "Failed to communicate with OAuth provider", "", { cause: error });
-    }
-    throw error;
-  }
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  createAccessToken
-});

package/dist/actions/callback/access-token.d.ts

@@ -1,33 +0,0 @@
-import { j as OAuthProviderCredentials, a as InternalLogger } from '../../index-_aXtxb_s.js';
-import 'zod';
-import '../../schemas.js';
-import 'zod/v4';
-import '@aura-stack/jose';
-import '@aura-stack/jose/jose';
-import '@aura-stack/jose/crypto';
-import '@aura-stack/router/cookie';
-import '../../@types/utility.js';
-import 'jose';
-import '@aura-stack/router';
-import 'zod/v4/core';
-
-/**
- * Make a request to the OAuth provider to the token endpoint to exchange the authorization code provided
- * by the authorization server.
- *
- * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
- * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5
- * @param oauthConfig - OAuth provider configuration
- * @param redirectURI - The redirect URI registered in the Resource Owner's authorization request and sent in the authorization code exchange
- * @param code - The authorization code received from the OAuth server
- * @returns The access token response from the OAuth server
- */
-declare const createAccessToken: (oauthConfig: OAuthProviderCredentials, redirectURI: string, code: string, codeVerifier: string, logger?: InternalLogger) => Promise<{
-    access_token: string;
-    token_type?: string | undefined;
-    expires_in?: number | undefined;
-    refresh_token?: string | undefined;
-    scope?: string | string[] | null | undefined;
-}>;
-
-export { createAccessToken };

package/dist/actions/callback/access-token.js

@@ -1,9 +0,0 @@
-import {
-  createAccessToken
-} from "../../chunk-7BE46WWS.js";
-import "../../chunk-ZNCZVF6U.js";
-import "../../chunk-2A5B7GWR.js";
-import "../../chunk-U5663F2U.js";
-export {
-  createAccessToken
-};