@aura-stack/auth 0.7.1 → 0.8.0

package/dist/index.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require(`./identity-n3aahaEr.cjs`),t=require(`./errors-DcK2ELlk.cjs`),n=require(`./env-BhQ2k7jj.cjs`),r=require(`./assert-DaZSf4SH.cjs`),i=require(`./crypto-BF4ETYC9.cjs`),a=require(`./logger-CVwkloPj.cjs`),o=require(`./@types/index.cjs`),s=require(`./oauth/index.cjs`);let c=require(`@aura-stack/router`),l=require(`zod/v4`),u=require(`arktype`),d=require(`typebox`),f=require(`@aura-stack/router/cookie`),p=require(`valibot`);p=e.o(p,1);let m=require(`typebox/value`);const h={"Cache-Control":`no-store`,Pragma:`no-cache`,Expires:`0`,Vary:`Cookie`},g={"Content-Security-Policy":[`default-src 'none'`,`script-src 'self'`,`frame-src 'none'`,`object-src 'none'`,`frame-ancestors 'none'`,`base-uri 'none'`].join(`; `)},_={"X-Content-Type-Options":`nosniff`,"X-Frame-Options":`DENY`,"Referrer-Policy":`strict-origin-when-cross-origin`},v={...h,...g,..._},y=(e,t)=>{for(let[n,r]of Object.entries(t))r!==void 0&&r!==``&&e.searchParams.set(n,r)},b=(e,n,r,i,a)=>{let o=e.authorize,s=typeof o==`string`?o:o?.url??e.authorizeURL;if(!s)throw new t.n(`INVALID_OAUTH_CONFIGURATION`,`Missing authorization URL in OAuth provider configuration.`);let c=new URL(s),l=typeof o==`string`?void 0:o?.params;return y(c,{response_type:l?.responseType??e.responseType??`code`,client_id:e.clientId,redirect_uri:n,state:r,code_challenge:i,code_challenge_method:a,scope:l?.scope??e.scope,prompt:l?.prompt,response_mode:l?.responseMode,login_hint:l?.loginHint,nonce:l?.nonce,display:l?.display,audience:l?.audience}),c.toString()},x=async(e,n,r)=>{let a=i.i(),{codeVerifier:s,codeChallenge:c,method:l}=await i.r(),u=b(e,n,a,c,l);if(!o.i.safeParse({...e,redirectURI:n,state:a,codeChallenge:c,codeChallengeMethod:l}).success)throw r?.logger?.log(`INVALID_OAUTH_CONFIGURATION`,{structuredData:{scope:e?.scope??``,redirect_uri:n,has_state:!!a,has_code_challenge:!!c,code_challenge_method:l}}),new t.n(`INVALID_OAUTH_CONFIGURATION`,`The OAuth provider configuration is invalid.`);return{authorization:u,state:a,codeVerifier:s,method:l}},S=async(e,t)=>{if(!t)return[];let n=typeof t==`function`?await t(e):t;return Array.isArray(n)?n:typeof n==`string`?[n]:[]},C=async({ctx:e,request:r,headers:i})=>{let a=n.n(`BASE_URL`)||e?.baseURL;if(a&&a!==`/`)return a;if(e?.trustedProxyHeaders){let e=i&&new Headers(i)||r?.headers,n=e?.get(`Forwarded`)?.match(/proto=([^;]+)/i)?.[1]??e?.get(`X-Forwarded-Proto`)??`http`,a=e?.get(`Host`)??e?.get(`Forwarded`)?.match(/host=([^;]+)/i)?.[1]??e?.get(`X-Forwarded-Host`)??null;if(a)return`${n}://${a}`;throw new t.n(`INVALID_OAUTH_CONFIGURATION`,`The URL cannot be constructed. Please set the BASE_URL environment variable or provide trusted proxy host headers.`)}try{return new URL(r?.url??`not-found`).origin}catch(e){throw new t.n(`INVALID_OAUTH_CONFIGURATION`,`The URL cannot be constructed. Please set the BASE_URL environment variable or enable trustedProxyHeaders.`,{cause:e})}},w=async(e,n)=>{let i=await S(e,n?.trustedOrigins);i.push(new URL(e.url).origin);let a=await C({request:e,ctx:n});if(!r.m(a,i))throw n?.logger?.log(`UNTRUSTED_ORIGIN`,{structuredData:{origin:a}}),new t.n(`UNTRUSTED_ORIGIN`,`The constructed origin URL is not trusted.`);return a},T=async(e,t,n)=>`${await w(e,n)}${n.basePath}/callback/${t}`,E=async({request:e,oauth:t,ctx:n,redirectTo:r})=>{let i=await w(e,n),a=new URLSearchParams;return r!==void 0&&a.set(`redirectTo`,String(r)),`${i}${n.basePath}/signIn/${t}?${a.toString()}`},D=async(e,t,n)=>{try{let i=e.headers,a=await w(e,n),o=await S(e,n?.trustedOrigins);return(t=>{if(!r.u(t)&&!r.v(t))return`/`;if(r.u(t))return t;if(o.length>0){if(r.m(t,o)){let n=new URL(t).origin;for(let i of o){if(r.O(i)?.test(n))return r.d(t,e.url)?r.w(t):t;if(r.v(i)&&r.C(new URL(i).origin,n))return t}}return n?.logger?.log(`OPEN_REDIRECT_ATTACK`),`/`}return r.d(t,a)?r.w(t):(n?.logger?.log(`OPEN_REDIRECT_ATTACK`),`/`)})(t??i.get(`Referer`)??i.get(`Origin`)??`/`)}catch{return n?.logger?.log(`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`),`/`}},O=async(e,{ctx:n,request:r,headers:i,redirect:a,redirectTo:o})=>{try{let s=new Headers(i),l=n.oauth[e];if(!l)throw new t.n(`INVALID_OAUTH_CONFIGURATION`,`The OAuth provider "${e}" is not configured.`);let u=r;if(!u){let t=`${await C({ctx:n,headers:s})}${n.basePath}/signIn/${e}`;u=new Request(t,{headers:s})}if(a===!1){n?.logger?.log(`SIGN_IN_INITIATED`,{structuredData:{oauth_provider:e}});let t=await E({request:u,oauth:e,ctx:n,redirectTo:o}),r=new Headers(v);return{success:!0,redirect:!1,signInURL:t,headers:r,toResponse:()=>Response.json({success:!0,redirect:!1,signInURL:t},{status:200,headers:r})}}let d=await T(u,e,n),f=await D(u,o,n),{authorization:p,state:m,codeVerifier:g}=await x(l,d,n);n?.logger?.log(`SIGN_IN_INITIATED`,{structuredData:{oauth_provider:e}});let _=new c.HeadersBuilder(h).setHeader(`Location`,p).setCookie(n.cookies.state.name,m,n.cookies.state.attributes).setCookie(n.cookies.redirectURI.name,d,n.cookies.redirectURI.attributes).setCookie(n.cookies.redirectTo.name,f,n.cookies.redirectTo.attributes).setCookie(n.cookies.codeVerifier.name,g,n.cookies.codeVerifier.attributes).toHeaders();return{success:!0,redirect:!0,signInURL:p,headers:_,toResponse:()=>Response.json({success:!0,redirect:!0,signInURL:p},{status:302,headers:_})}}catch(e){let n=`AUTH_SIGN_IN_FAILED`,r=`An error occurred during the sign-in process.`;return t.c(e)&&(n=e.code,r=e.message),{success:!1,redirect:!1,signInURL:null,error:{code:n,message:r},headers:new Headers(v),toResponse:()=>Response.json({success:!1,redirect:!1,signInURL:null,error:{code:n,message:r}},{status:500,headers:v})}}},k=async({ctx:e,payload:n,request:r,headers:a,redirect:o=!0,redirectTo:s})=>{let{cookies:l,credentials:u,sessionStrategy:d,logger:f}=e;try{let p=r;if(!p){let t=`${await C({ctx:e,headers:a})}${e.basePath}/signIn/credentials`;p=new Request(t,{headers:a})}await w(p,e);let m=await u?.authorize({credentials:n,deriveSecret:u?.hash??i.o,verifySecret:u?.verify??i.l});if(!m)throw new t.o(`INVALID_CREDENTIALS`,`The provided credentials are invalid.`);let h=await d.createSession(m),g=await i.t(e.jose);f?.log(`CREDENTIALS_SIGN_IN_SUCCESS`);let _=new c.HeadersBuilder(v).setCookie(l.csrfToken.name,g,l.csrfToken.attributes).setCookie(l.sessionToken.name,h,l.sessionToken.attributes),y=await D(p,s,e);y=s?y:y===`/`?null:y,o&&y&&_.setHeader(`Location`,y);let b=o&&!!y,x=_.toHeaders();return{success:!0,headers:x,redirect:b,redirectURL:o?null:y,toResponse:()=>Response.json({success:!0,redirect:b,redirectURL:b?null:y},{headers:x,status:b?302:200})}}catch(e){let n=`CREDENTIALS_SIGN_IN_ERROR`,r=`An error occurred during credentials sign-in.`;t.c(e)&&(n=e.code,r=e.message);let i=new Headers(v),a={success:!1,headers:i,redirect:!1,redirectURL:null,error:{code:n,message:r},toResponse:()=>Response.json({success:!1,redirect:!1,redirectURL:null},{headers:i,status:401})};return e instanceof t.o?(f?.log(`INVALID_CREDENTIALS`,{severity:`warning`,structuredData:{path:`/signIn/credentials`}}),a):(f?.log(`CREDENTIALS_SIGN_IN_FAILED`,{severity:`error`,structuredData:{path:`/signIn/credentials`}}),a)}},A=async({ctx:e,request:n,headers:r,redirect:i=!0,redirectTo:a,skipCSRFCheck:o=!1})=>{let s=await e.sessionStrategy.destroySession(new Headers(r),o);try{let t=n;if(!t){let n=`${await C({ctx:e,headers:s})}${e.basePath}/signOut`;t=new Request(n,{headers:s})}await w(t,e);let r=new c.HeadersBuilder(s),o=await D(t,a,e);o=a?o:o===`/`?null:o,i&&o&&r.setHeader(`Location`,o);let l=r.toHeaders(),u=i&&!!o;return{success:!0,headers:l,redirect:u,redirectURL:i?null:o,toResponse:()=>Response.json({success:!0,redirect:u,redirectURL:u?null:o},{headers:l,status:u?302:202})}}catch(e){let n=`SIGN_OUT_FAILED`,r=`Failed to sign-out session`;return t.c(e)&&(n=e.code,r=e.message),{success:!1,headers:s,redirect:!1,redirectURL:null,error:{code:n,message:r},toResponse:()=>Response.json({success:!1,redirect:!1,redirectsURL:null})}}},j={httpOnly:!0,sameSite:`lax`,path:`/`,maxAge:3600*24*15},M={secure:!1,httpOnly:!0},N={secure:!0,httpOnly:!0},P={secure:!0,httpOnly:!0,path:`/`,domain:void 0},F={httpOnly:!0,maxAge:300,sameSite:`lax`,expires:new Date(Date.now()+300*1e3)},I=(e,t,n)=>(0,f.serialize)(e,t,n),L=e=>({...e,expires:new Date(0),maxAge:0,secure:e?.secure??!0}),R=(e,n)=>{let r=e instanceof Request?e.headers.get(`Cookie`):e.get(`Cookie`);if(!r)throw new t.n(`COOKIE_NOT_FOUND`,`No cookies found. There is no active session`);let i=(0,f.parse)(r)[n];if(!i)throw new t.n(`COOKIE_NOT_FOUND`,`Cookie "${n}" not found. There is no active session`);return i},z=(e,t,r,i)=>(t.httpOnly||i?.log(`COOKIE_HTTPONLY_DISABLED`),t.domain===`*`&&(t.domain=void 0,i?.log(`COOKIE_WILDCARD_DOMAIN`)),e?r===`host`?{...j,...t,...P}:{...j,...t,...N}:(t.secure&&i?.log(`COOKIE_SECURE_DISABLED`),t.sameSite==`none`&&(t.sameSite=`lax`,i?.log(`COOKIE_SAMESITE_NONE_WITHOUT_SECURE`)),n.t.NODE_ENV===`production`&&i?.log(`COOKIE_INSECURE_IN_PRODUCTION`),r===`host`&&i?.log(`COOKIE_HOST_STRATEGY_INSECURE`),{...j,...t,...M})),B=(e,t,n,r)=>{t??=`aura-auth`;let i=e?`__Secure-`:``,a=e?`__Host-`:``;return{sessionToken:{name:`${i}${t}.${n?.sessionToken?.name??`session_token`}`,attributes:z(e,{...j,...n?.sessionToken?.attributes},n?.sessionToken?.attributes?.strategy??`secure`,r)},state:{name:`${i}${t}.${n?.state?.name??`state`}`,attributes:z(e,{...F,...n?.state?.attributes},n?.state?.attributes?.strategy??`secure`,r)},csrfToken:{name:`${a}${t}.${n?.csrfToken?.name??`csrf_token`}`,attributes:z(e,{...n?.csrfToken?.attributes,...P,sameSite:`strict`},n?.csrfToken?.attributes?.strategy??`host`,r)},redirectTo:{name:`${i}${t}.${n?.redirectTo?.name??`redirect_to`}`,attributes:z(e,{...F,...n?.redirectTo?.attributes},n?.redirectTo?.attributes?.strategy??`secure`,r)},redirectURI:{name:`${i}${t}.${n?.redirectURI?.name??`redirect_uri`}`,attributes:z(e,{...F,...n?.redirectURI?.attributes},n?.redirectURI?.attributes?.strategy??`secure`,r)},codeVerifier:{name:`${i}${t}.${n?.codeVerifier?.name??`code_verifier`}`,attributes:z(e,{...F,...n?.codeVerifier?.attributes},n?.codeVerifier?.attributes?.strategy??`secure`,r)}}},V=async({ctx:e,headers:t})=>{let n=new c.HeadersBuilder(v).setCookie(e.cookies.sessionToken.name,``,L(e.cookies.sessionToken.attributes)).setCookie(e.cookies.csrfToken.name,``,L(e.cookies.csrfToken.attributes)).toHeaders(),i={session:null,headers:n,success:!1,error:{code:`GET_SESSION_FAILED`,message:`Failed to retrieve session. The session token may be missing, expired, or invalid.`},toResponse:()=>Response.json({success:!1,session:null},{status:401,headers:n})};try{let{session:n,headers:a}=await e.sessionStrategy.getSession(new Headers(t));if(!n)return i;let o=r.A(a,v);return{session:n,headers:o,success:!0,toResponse:()=>Response.json({success:!0,session:n},{headers:o})}}catch(t){return e?.logger?.log(`AUTH_SESSION_INVALID`,{structuredData:{error_type:r.E(t)}}),i}},H=async({ctx:e,request:n,redirect:i=!0,headers:a,session:o,redirectTo:s,skipCSRFCheck:c=!1})=>{try{let{session:l,headers:u}=await e.sessionStrategy.refreshSession(new Headers(a),o,c);if(!l)throw new t.n(`UPDATE_SESSION_INVALID`,`Failed to update session.`);let d=r.A(u,v),f=n;if(!f){let t=`${await C({ctx:e,headers:u})}${e.basePath}/session`;f=new Request(t,{headers:d})}await w(f,e);let p=await D(f,s,e);p=s?p:p===`/`?null:p,i&&p&&d.set(`Location`,p);let m=i&&!!p;return{headers:d,session:l,success:!0,redirect:m,redirectURL:m?null:p,toResponse:()=>Response.json({success:!0,session:l,redirect:m,redirectURL:m?null:p},{headers:d,status:m?302:200})}}catch(e){let n=`UPDATE_SESSION_INVALID`,r=`Failed to update session.`;t.c(e)&&(n=e.code,r=e.message);let i=new Headers(v);return{headers:i,session:null,success:!1,redirect:!1,redirectURL:null,error:{code:n,message:r},toResponse:()=>Response.json({success:!1,session:null,redirect:!1,redirectURL:null},{status:400,headers:i})}}},ee=e=>({getSession:async t=>await V({ctx:e,headers:t.headers}),signIn:async(t,n)=>O(t,{ctx:e,...n}),signInCredentials:async t=>k({ctx:e,...t}),updateSession:async t=>H({ctx:e,...t,skipCSRFCheck:!0}),signOut:async t=>A({ctx:e,...t,skipCSRFCheck:!0})}),te=(e,n)=>{let r=e?.mode??`sealed`;if(![`sealed`,`signed`,`encrypted`].includes(r))throw new t.r(`[auth] invalid JWT mode "${r}". Valid options are: "sealed", "signed", "encrypted".`);return{createToken:r===`sealed`?n.encodeJWT:r===`signed`?n.signJWS:n.encryptJWE,verifyToken:r===`sealed`?n.decodeJWT:r===`signed`?n.verifyJWS:n.decryptJWE}},U=e=>({getCookie:t=>({sessionToken:R(t,e().sessionToken.name)}),setCookie:({sessionToken:t})=>new c.HeadersBuilder(v).setCookie(e().sessionToken.name,t,e().sessionToken.attributes).toHeaders(),clear:()=>new c.HeadersBuilder(v).setCookie(e().csrfToken.name,``,L(e().csrfToken.attributes)).setCookie(e().sessionToken.name,``,L(e().sessionToken.attributes)).toHeaders()}),W=({config:e,jose:n,logger:a,cookies:o,identity:s})=>{let c=te(e?.jwt,n),l=U(o),u=e?.jwt?.maxAge??3600*24*15,d=e?.jwt?.expirationStrategy??`absolute`,f=({exp:e})=>{if(!e)return null;let t=Math.floor(Date.now()/1e3);switch(d){case`fixed`:case`absolute`:return null;case`rolling`:return new Date((t+u)*1e3);case`sliding`:{let n=u*.25;return e-t<n?new Date((t+u)*1e3):null}default:return null}},p=async(e,s=!1)=>{let c=null,l=null,u=e.get(`X-CSRF-Token`);try{c=R(e,o().sessionToken.name)}catch{throw new t.a(`SESSION_TOKEN_MISSING`,`The sessionToken is missing.`)}try{l=R(e,o().csrfToken.name)}catch{throw new t.a(`CSRF_TOKEN_MISSING`,`The CSRF token is missing.`)}if(a?.log(`CSRF_TOKEN_REQUESTED`,{structuredData:{has_session:!!c,has_csrf_token:!!l,has_csrf_header:!!u,skip_csrf_check:s}}),!c)throw a?.log(`SESSION_TOKEN_MISSING`),new t.a(`SESSION_TOKEN_MISSING`,`The sessionToken is missing.`);if(!s){if(!l)throw a?.log(`CSRF_TOKEN_MISSING`),new t.a(`CSRF_TOKEN_MISSING`,`The CSRF token is missing.`);if(!u)throw a?.log(`CSRF_HEADER_MISSING`),new t.a(`CSRF_HEADER_MISSING`,`The CSRF header is missing.`);try{await i.c(n,l,u)}catch(e){throw a?.log(`CSRF_TOKEN_INVALID`,{structuredData:{error_type:r.E(e)}}),new t.a(`CSRF_TOKEN_INVALID`,`CSRF token verification failed`)}a?.log(`CSRF_TOKEN_VERIFIED`)}try{return await n.decodeJWT(c),!0}catch(e){return a?.log(`INVALID_JWT_TOKEN`,{structuredData:{error_type:r.E(e)}}),!1}};return{getSession:async e=>{let t=new Headers;try{let{sessionToken:n}=l.getCookie(e);if(!n)return{session:null,headers:t};let r=await c.verifyToken(n),i=s.skipValidation?r:await s.schemaRegistry.parseWithJWT(r),{exp:o,iat:u,mexp:p,...m}=i,h=await s.schemaRegistry.parse(m);if(!h.sub)return{session:null,headers:t};let g={user:h,expires:i.exp?new Date(o*1e3).toISOString():``},_=f({exp:o});if(!_)return{session:{expires:g.expires,user:h},headers:e};let v=d===`absolute`?i.iat:Math.floor(Date.now()/1e3),y=await c.createToken({...h,exp:Math.floor(_.getTime()/1e3),iat:v,mexp:i.mexp});return a?.log(`SESSION_REFRESHED`,{structuredData:{strategy:`stateless`,expiresAt:_.toISOString()}}),{session:{user:h,expires:_.toISOString()},headers:l.setCookie({sessionToken:y})}}catch(e){return a?.log(`AUTH_SESSION_INVALID`,{structuredData:{error_type:r.E(e)}}),{session:null,headers:t}}},createSession:async e=>{s.skipValidation&&a?.log(`IDENTITY_VALIDATION_DISABLED`,{structuredData:{identity_validation_disabled:!0}});let t=s.skipValidation?e:await s.schemaRegistry.parse(e);return c.createToken(t)},refreshSession:async(e,t,n=!1)=>{try{let{sessionToken:r}=l.getCookie(e);if(!r||!await p(e,n))return{session:null,headers:l.clear()};let i=await c.verifyToken(r),a=s.skipValidation?i:await s.schemaRegistry.parse(i),{exp:o,mexp:m,sub:h,iat:g}=a,_=s.skipValidation?t.user:await s.schemaRegistry.parseAsPartial(t.user),v=t.expires?new Date(t.expires):f({exp:o})??new Date(Date.now()+u*1e3),y={user:{...a,..._,sub:h},expires:v.toISOString()},b=d===`absolute`?g:Math.floor(Date.now()/1e3),x=await c.createToken({...y.user,exp:Math.floor(v.getTime()/1e3),iat:b,mexp:m});return y.expires=new Date(y.expires).toISOString(),{session:y,headers:l.setCookie({sessionToken:x})}}catch(e){return a?.log(`AUTH_SESSION_INVALID`,{structuredData:{error_type:r.E(e)}}),{session:null,headers:l.clear()}}},revokeSession:async e=>{},destroySession:async(e,t=!1)=>(await p(e,t),l.clear())}},G=({config:e,jose:n,cookies:r,logger:i,identity:a})=>{let o=e?.strategy??`jwt`;switch(o){case`jwt`:return W({jose:n,config:e,cookies:r,logger:i,identity:a});default:throw new t.r(`[auth] unknown session strategy "${o}". Valid options are: "jwt".`)}},K=e=>{if(!r.b(e)&&!r._(e)&&!r.t(e)&&!(0,d.IsObject)(e))throw Error(`Unsupported schema type`);return{validate:t=>{try{if(r.b(e)){let n=e.safeParse(t);return n.success?{success:!0,data:n.data,error:null}:{success:!1,data:null,error:n.error}}if(r._(e)){let n=(0,p.safeParse)(e,t);return n.success?{success:!0,data:n.output,error:null}:{success:!1,data:null,error:n.issues}}if(r.t(e)){let n=e(t);return e.allows(t)?{success:!0,data:n,error:null}:{success:!1,data:null,error:n}}if((0,d.IsObject)(e)){let n=t;return e.strip&&(n=m.Value.Clean(e,m.Value.Clone(t))),m.Value.Check(e,n)?{success:!0,data:n,error:null}:{success:!1,data:null,error:[...m.Value.Errors(e,n)]}}return{success:!1,data:null,error:Error(`Unsupported schema type`)}}catch(e){return{success:!1,data:null,error:e}}}}},q=(e,n=`strip`)=>{if(r.b(e))return n===`strip`?e.strip():n===`passthrough`?l.z.looseObject(e.shape):n===`strict`?e.strict():e.partial().optional();if(r._(e))return n===`strip`?p.object(e.entries):n===`passthrough`?p.looseObject(e.entries):n===`strict`?p.strictObject(e.entries):p.partial(e);if(r.t(e))return n===`strip`?e.onUndeclaredKey(`delete`):n===`passthrough`?e.onUndeclaredKey(`ignore`):n===`strict`?e.onUndeclaredKey(`reject`):e.partial();if((0,d.IsObject)(e))return n===`strip`?d.Type.Object(e.properties,{...e,additionalProperties:!1,strip:!0}):n===`passthrough`?d.Type.Object(e.properties,{...e,additionalProperties:!0}):n===`strict`?d.Type.Object(e.properties,{...e,additionalProperties:!1}):d.Type.Partial(e);throw new t.o(`INVALID_IDENTITY_VALIDATION_FAILED`,`Unsupported schema mode configuration. Valid options are: "strip", "passthrough", "strict" and "partial".`)},J=e=>{if(r._(e))return p.object({...e.entries,exp:p.number(),iat:p.number(),jti:p.string(),nbf:p.number(),aud:p.optional(p.string()),iss:p.optional(p.string()),mexp:p.optional(p.number())});if(r.t(e))return e.and({exp:`number`,iat:`number`,jti:`string`,nbf:`number`,aud:`string?`,iss:`string?`,mexp:`number?`});if((0,d.IsObject)(e))return d.Type.Object({...e.properties,exp:d.Type.Number(),iat:d.Type.Number(),jti:d.Type.String(),nbf:d.Type.Number(),aud:d.Type.Optional(d.Type.String()),iss:d.Type.Optional(d.Type.String()),mexp:d.Type.Optional(d.Type.Number())},{...e});if(r.b(e))return e.extend({exp:l.z.number(),iat:l.z.number(),jti:l.z.string(),nbf:l.z.number(),aud:l.z.string().optional(),iss:l.z.string().optional(),mexp:l.z.number().optional()});throw new t.o(`INVALID_IDENTITY_VALIDATION_FAILED`,`Unsupported schema type for JWT extension.`)},Y=e=>{if(r._(e))return p.object({user:e,expires:p.optional(p.pipe(p.string(),p.transform(e=>new Date(e)),p.date()))});if(r.t(e))return(0,u.type)({user:e,expires:(0,u.type)(`string`).pipe(e=>new Date(e)).optional()});if((0,d.IsObject)(e))return d.Type.Object({user:e,expires:d.Type.Optional(d.Type.String())});if(r.b(e))return l.z.object({user:e,expires:l.z.coerce.date().optional()});throw new t.o(`INVALID_IDENTITY_VALIDATION_FAILED`,`Unsupported schema type for schema  extension.`)},X=(e,n)=>{let i={};throw r.b(e)?i=r.T(n):r._(e)?i={issues:n}:r.t(e)?i={error:n}:(0,d.IsObject)(e)&&(i={errors:n}),new t.o(`INVALID_IDENTITY_VALIDATION_FAILED`,JSON.stringify(i,null,2),{cause:r.b(e)?n:void 0})},Z=t=>{let n=q(t.schema??e.t,t.unknownKeys),r=q(t.schema??e.t,`partial`),i=J(t.schema??e.t),a=K(n),o=K(r),s=K(i);return{parse:async(e={})=>{let{data:t,success:r,error:i}=a.validate(e);return r||X(n,i),t},parseAsPartial:async(e={})=>{let{data:t,success:n,error:i}=o.validate(e);return n||X(r,i),t},parseWithJWT:async(e={})=>{let{data:t,success:n,error:r}=s.validate(e);return n||X(i,r),t},schema:n,schemaAsPartial:r,schemaWithJWT:i}},ne=e=>{let t=n.n(`TRUSTED_PROXY_HEADERS`)===void 0?e?.trustedProxyHeaders??!1:n.i(`TRUSTED_PROXY_HEADERS`),r=a.t(e),o=e?.cookies?.prefix,c=e?.cookies?.overrides??{},l=B(!0,o,c,r),u=B(!1,o,c,r),d=i.u(e?.secret,e?.session),f=e?.identity?.unknownKeys??`strip`,p=e?.identity?.skipValidation??!1,m=Z({schema:e?.identity?.schema,unknownKeys:f,skipValidation:p}),h={oauth:s.createBuiltInOAuthProviders(e?.oauth),credentials:e?.credentials,cookies:u,jose:d,secret:e?.secret,basePath:e?.basePath??`/auth`,trustedProxyHeaders:t,trustedOrigins:n.r(`TRUSTED_ORIGINS`).length>0?n.r(`TRUSTED_ORIGINS`):e?.trustedOrigins,logger:r,cookieConfig:{secure:l,standard:u},baseURL:e?.baseURL,identity:{schemaRegistry:m,unknownKeys:f,skipValidation:p}};return h.sessionStrategy=G({cookies:()=>h.cookies,jose:h.jose,config:e?.session,logger:h.logger,identity:h.identity}),h},re=e=>n=>{if((0,c.isRouterError)(n)){let{message:t,status:r,statusText:i}=n;return e?.log(`ROUTER_INTERNAL_ERROR`),Response.json({type:`ROUTER_ERROR`,code:`ROUTER_INTERNAL_ERROR`,message:t},{status:r,statusText:i})}if((0,c.isInvalidZodSchemaError)(n))return e?.log(`INVALID_REQUEST`),Response.json({type:`ROUTER_ERROR`,code:`INVALID_REQUEST`,message:n.errors},{status:422});if(t.p(n)){let{error:t,message:r,type:i,errorURI:a}=n;return e?.log(`OAUTH_PROTOCOL_ERROR`,{structuredData:{error:t,error_description:r,error_uri:a??``}}),Response.json({type:i,message:r},{status:400})}if(t.l(n)){let{type:t,code:r,message:i}=n;return e?.log(`INVALID_OAUTH_CONFIGURATION`,{structuredData:{error:r,error_description:i}}),Response.json({type:t,message:i},{status:400})}if(t.u(n)){let{type:t,code:r,message:i}=n;return e?.log(`AUTH_SECURITY_ERROR`,{structuredData:{error:r,error_description:i}}),Response.json({type:t,code:r,message:i},{status:400})}if(t.d(n)){let{type:t,code:r,message:i}=n;return e?.log(`IDENTITY_VALIDATION_FAILED`,{structuredData:{error:r,error_description:i}}),Response.json({type:t,code:r,message:i},{status:422})}return e?.log(`SERVER_ERROR`,{structuredData:{error_type:n.name,error_message:n.message}}),Response.json({type:`SERVER_ERROR`,code:`SERVER_ERROR`,message:`An unexpected error occurred`},{status:500})},ie=e=>(0,c.createEndpointConfig)(`/signIn/:oauth`,{schemas:{params:l.z.object({oauth:l.z.enum(Object.keys(e),`The OAuth provider is not supported or invalid.`)}),searchParams:o.l}}),ae=e=>(0,c.createEndpoint)(`GET`,`/signIn/:oauth`,async e=>{let{toResponse:t}=await O(e.params.oauth,{ctx:e.context,request:e.request,headers:e.request.headers,redirect:e.searchParams.redirect,redirectTo:e.searchParams.redirectTo});return t()},ie(e)),oe=(0,c.createEndpointConfig)({schemas:{body:o.t,searchParams:o.l}}),se=(0,c.createEndpoint)(`POST`,`/signIn/credentials`,async e=>{let t=e.body,{toResponse:n}=await k({ctx:e.context,payload:t,request:e.request,headers:e.request.headers,redirect:e.searchParams.redirect,redirectTo:e.searchParams.redirectTo});return n()},oe),Q=async(e,t={},n=5e3)=>{let r=new AbortController,i=setTimeout(()=>r.abort(),n);return await fetch(e,{...t,signal:r.signal}).finally(()=>clearTimeout(i))},ce=e=>{let n=e?.id??e?.sub??e?.uid??e?.user_id??e?.account_id;if(!n)throw new t.s(`invalid_userinfo`,`OAuth provider did not return a stable user identifier (id/sub/uid).`);return{sub:n,email:e?.email,name:e?.name??e?.username??e?.nickname,image:e?.image??e?.picture}},le=async(e,n,i)=>{let a=e.userInfo,s=typeof a==`string`?a:a.url,c=typeof a==`string`?void 0:a.headers,l=typeof a==`string`?`GET`:(a.method??`GET`).toUpperCase();try{i?.log(`OAUTH_USERINFO_REQUEST_INITIATED`,{structuredData:{endpoint:s}});let a=await Q(s,{method:l,headers:{"User-Agent":`Aura Auth/${r.x}`,Accept:`application/json`,Authorization:`Bearer ${n}`,...c}});if(!a.ok)throw i?.log(`OAUTH_USERINFO_INVALID_RESPONSE`),new t.s(`INVALID_REQUEST`,`Invalid userinfo response format`);let u=await a.json(),{success:d,data:f}=o.s.safeParse(u);if(d)throw i?.log(`OAUTH_USERINFO_ERROR`,{message:`Error response received from OAuth userinfo endpoint`,structuredData:{error:f.error,error_description:f.error_description??``}}),new t.s(`INVALID_REQUEST`,`An error was received from the OAuth userinfo endpoint.`);return i?.log(`OAUTH_USERINFO_SUCCESS`),e?.profile?e.profile(u):ce(u)}catch(e){throw t.p(e)?e:(i?.log(`OAUTH_USERINFO_REQUEST_FAILED`),t.f(e)?new t.s(`SERVER_ERROR`,`Failed to fetch user information from OAuth provider`,``,{cause:e}):new t.s(`SERVER_ERROR`,`Failed to fetch user information`,``,{cause:e}))}},ue=async(e,n,r,i,a)=>{let{accessToken:s,clientId:c,clientSecret:l}=e;if(!c||!l||!n||!r||!i||!s)throw a?.log(`INVALID_OAUTH_CONFIGURATION`,{structuredData:{has_client_id:!!c,has_client_secret:!!l,has_access_token:!!s,has_redirect_uri:!!n,has_code:!!r,has_code_verifier:!!i}}),new t.n(`INVALID_OAUTH_CONFIGURATION`,`The OAuth provider configuration is invalid.`);let u=typeof s==`string`?s:s.url,d=typeof s==`string`?void 0:s.headers;try{a?.log(`OAUTH_ACCESS_TOKEN_REQUEST_INITIATED`,{structuredData:{has_client_id:!!c,redirect_uri:n,grant_type:`authorization_code`}});let e=await Q(u,{method:`POST`,headers:{...d,Accept:`application/json`,"Content-Type":`application/x-www-form-urlencoded`},body:new URLSearchParams({client_id:c,client_secret:l,code:r,redirect_uri:n,grant_type:`authorization_code`,code_verifier:i}).toString()});if(!e.ok)throw a?.log(`INVALID_OAUTH_ACCESS_TOKEN_RESPONSE`),new t.s(`invalid_request`,`Invalid access token response`);let s=await e.json(),f=o.r.safeParse(s);if(!f.success){let{success:e,data:n}=o.n.safeParse(s);throw e?(a?.log(`OAUTH_ACCESS_TOKEN_ERROR`,{structuredData:{error:n.error,error_description:n.error_description??``}}),new t.s(`INVALID_ACCESS_TOKEN`,`Failed to retrieve access token`)):(a?.log(`INVALID_OAUTH_ACCESS_TOKEN_RESPONSE`),new t.s(`invalid_request`,`Invalid access token response format`))}return a?.log(`OAUTH_ACCESS_TOKEN_SUCCESS`),f.data}catch(e){throw e instanceof t.s?e:(a?.log(`OAUTH_ACCESS_TOKEN_REQUEST_FAILED`),new t.s(`server_error`,`Failed to communicate with OAuth provider`,``,{cause:e}))}},de=e=>(0,c.createEndpointConfig)(`/callback/:oauth`,{schemas:{params:l.z.object({oauth:l.z.enum(Object.keys(e),`The OAuth provider is not supported or invalid.`)}),searchParams:l.z.object({code:l.z.string(`Missing code parameter in the OAuth authorization response.`),state:l.z.string(`Missing state parameter in the OAuth authorization response.`)})},use:[e=>{let{searchParams:n,context:{logger:r}}=e,i=o.a.safeParse(n);if(i.success){let{error:e,error_description:n}=i.data,a=[`access_denied`,`server_error`].includes(e.toLowerCase())?`critical`:`warning`;throw r?.log(`OAUTH_AUTHORIZATION_ERROR`,{severity:a,structuredData:{error:e,error_description:n??``}}),new t.s(e,n||`OAuth Authorization Error`)}return e}]}),fe=e=>(0,c.createEndpoint)(`GET`,`/callback/:oauth`,async e=>{let{request:n,params:{oauth:a},searchParams:{code:o,state:s},context:l}=e,{oauth:u,cookies:d,jose:f,logger:p,trustedOrigins:m}=l,g=u[a],_=R(n,d.state.name),v=R(n,d.codeVerifier.name),y=R(n,d.redirectTo.name),b=R(n,d.redirectURI.name),x=new c.HeadersBuilder(h).setCookie(d.state.name,``,L(d.state.attributes)).setCookie(d.redirectURI.name,``,L(d.redirectURI.attributes)).setCookie(d.redirectTo.name,``,L(d.redirectTo.attributes)).setCookie(d.codeVerifier.name,``,L(d.codeVerifier.attributes));if(!r.k(_,s))return p?.log(`MISMATCHING_STATE`,{structuredData:{oauth_provider:a}}),Response.json({type:`AUTH_SECURITY_ERROR`,code:`MISMATCHING_STATE`,message:`The provided state passed in the OAuth response does not match the stored state.`},{headers:x.toHeaders(),status:400});let C=await ue(g,b,o,v,p),T=await S(n,m),E=await w(n,l);if(!r.u(y)&&!(T.length>0?r.m(y,T):r.d(y,E)))throw p?.log(`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`,{structuredData:{redirect_path:y,provider:a,has_trusted_origins:T.length>0,request_origin:E}}),new t.a(`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`,`Invalid redirect path. Potential open redirect attack detected.`);let D=await le(g,C.access_token,p),O=await l.sessionStrategy.createSession(D),k=await i.t(f);p?.log(`OAUTH_CALLBACK_SUCCESS`,{structuredData:{provider:a}});let A=x.setHeader(`Location`,y).setCookie(d.sessionToken.name,O,d.sessionToken.attributes).setCookie(d.csrfToken.name,k,d.csrfToken.attributes).toHeaders();return Response.json({oauth:a},{status:302,headers:A})},de(e)),pe=(0,c.createEndpoint)(`GET`,`/session`,async e=>{let{toResponse:t}=await V({ctx:e.context,headers:e.request.headers});return t()}),$=(0,c.createEndpointConfig)({schemas:{searchParams:o.l.extend({token_type_hint:l.z.literal(`session_token`)})}}),me=(0,c.createEndpoint)(`POST`,`/signOut`,async e=>{let{toResponse:t}=await A({ctx:e.context,request:e.request,headers:e.request.headers,redirect:e.searchParams.redirect,redirectTo:e.searchParams.redirectTo});return t()},$),he=(e,t)=>{try{return R(e,t)}catch{return}},ge=(0,c.createEndpoint)(`GET`,`/csrfToken`,async e=>{let{request:t,context:{jose:n,cookies:r,logger:a}}=e,o=he(t,r.csrfToken.name);a?.log(`CSRF_TOKEN_REQUESTED`,{structuredData:{has_token:!!o}});let s=await i.t(n,o);a?.log(`CSRF_TOKEN_ISSUED`,{structuredData:{issued:!!s}});let c=new Headers(v);return c.append(`Set-Cookie`,I(r.csrfToken.name,s,r.csrfToken.attributes)),Response.json({csrfToken:s},{headers:c})}),_e=e=>(0,c.createEndpointConfig)({schemas:{body:Y(e.schemaRegistry.schemaAsPartial),searchParams:o.l}}),ve=e=>(0,c.createEndpoint)(`PATCH`,`/session`,async e=>{let{toResponse:t}=await H({ctx:e.context,request:e.request,headers:e.request.headers,redirect:e.searchParams.redirect,redirectTo:e.searchParams.redirectTo,session:{user:e.body?.user,expires:e.body?.expires?.toISOString()}});return t()},_e(e)),ye=e=>{let t=ne(e);return{basePath:e?.basePath??`/auth`,onError:re(t.logger),context:t,use:[e=>{let n=r.D(e.request,e.context.trustedProxyHeaders);return e.context.cookies=n?t.cookieConfig.secure:t.cookieConfig.standard,e}]}},be=e=>{let t=ye(e);return{handlers:(0,c.createRouter)([ae(t.context.oauth),se,fe(t.context.oauth),pe,me,ge,ve(t.context.identity)],t),jose:t.context.jose,api:ee(t.context)}},xe=e=>{let t=be(e);return t.handlers.ALL=async e=>{let n=e.method.toUpperCase(),r={GET:t.handlers.GET,POST:t.handlers.POST,PATCH:t.handlers.PATCH};return n in r?await r[n](e):new Response(`Method Not Allowed`,{status:405,headers:{Allow:Object.keys(r).join(`, `)}})},t};exports.createAuth=xe;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require(`./identity-CAygUyH6.cjs`),t=require(`./errors-BiBhdux1.cjs`),n=require(`./env-BhQ2k7jj.cjs`),r=require(`./crypto-Da-Q8hsP.cjs`),i=require(`./fetch-async-DlbcIcRD.cjs`),a=require(`./resolve-provider-C_clBCRg.cjs`),o=require(`./@types/index.cjs`),s=require(`./logger-DL-kEECn.cjs`);let c=require(`@aura-stack/router`),l=require(`@aura-stack/rate-limiter`),u=require(`zod/v4`),d=require(`arktype`),f=require(`typebox`),p=require(`@aura-stack/router/cookie`),m=require(`@aura-stack/jose/jose`),h=require(`valibot`);h=e.o(h,1);let g=require(`@aura-stack/router/validator`);const _={"Cache-Control":`no-store`,Pragma:`no-cache`,Expires:`0`,Vary:`Cookie`},v={"Content-Security-Policy":[`default-src 'none'`,`script-src 'self'`,`frame-src 'none'`,`object-src 'none'`,`frame-ancestors 'none'`,`base-uri 'none'`].join(`; `)},y={"X-Content-Type-Options":`nosniff`,"X-Frame-Options":`DENY`,"Referrer-Policy":`strict-origin-when-cross-origin`},b={..._,...v,...y},x=e=>{let t=(e,t)=>`rl:${t}:${e.headers.get(`cf-connecting-ip`)??e.headers.get(`x-forwarded-for`)?.split(`,`)[0]?.trim()??e.headers.get(`x-real-ip`)??`anon`}`;return(0,l.createRateLimiter)({rules:{signIn:{algorithm:`sliding-window`,limit:10,windowMs:900*1e3,keyGenerator:e=>t(e,`signIn`),...e?.signIn},signInCredentials:{algorithm:`sliding-window`,limit:8,windowMs:900*1e3,keyGenerator:e=>t(e,`signInCredentials`),...e?.signInCredentials},signUp:{algorithm:`fixed-window`,limit:5,windowMs:3600*1e3,keyGenerator:e=>t(e,`signUp`),...e?.signUp},updateSession:{algorithm:`token-bucket`,capacity:10,refillRate:1/6e4,keyGenerator:e=>t(e,`updateSession`),...e?.updateSession}}})},S=async(e,t,n)=>{let r=await e.rateLimiters[n].check(t);if(!r.ok){let e=r.toResponse();return{success:!1,redirect:!1,[n===`signIn`?`signInURL`:`redirectURL`]:null,error:{code:`RATE_LIMIT_EXCEEDED`,message:`Too many requests.`},headers:e.headers,toResponse:()=>e}}},C=(e,t)=>{for(let[n,r]of Object.entries(t))r!==void 0&&r!==``&&e.searchParams.set(n,r)},w=(e,n,r,i,a)=>{let o=e.authorize,s=typeof o==`string`?o:o?.url??e.authorizeURL;if(!s)throw new t.t({code:`INVALID_OAUTH_PROVIDER_URL_CONFIG`});let c;try{c=new URL(s)}catch(e){throw new t.t({code:`INVALID_OAUTH_PROVIDER_URL_CONFIG`,cause:e})}let l=typeof o==`string`?void 0:o?.params;return C(c,{response_type:l?.responseType??e.responseType??`code`,client_id:e.clientId,redirect_uri:n,state:r,code_challenge:i,code_challenge_method:a,scope:l?.scope??e.scope,prompt:l?.prompt,response_mode:l?.responseMode,login_hint:l?.loginHint,nonce:l?.nonce,display:l?.display,audience:l?.audience}),c.toString()},T=async(e,n,i)=>{let a=r.i(),{codeVerifier:s,codeChallenge:c,method:l}=await r.r(),u=w(e,n,a,c,l);if(!o.o.safeParse({...e,redirectURI:n,state:a,codeChallenge:c,codeChallengeMethod:l}).success)throw i?.logger?.log(`INVALID_OAUTH_CONFIGURATION`,{structuredData:{scope:e?.scope??``,redirect_uri:n,has_state:!!a,has_code_challenge:!!c,code_challenge_method:l}}),new t.t({code:`INVALID_OAUTH_PROVIDER_SCHEMA_CONFIG`});return{authorization:u,state:a,codeVerifier:s,method:l}},E=async(e,t,n)=>{let i=r.i(),a=e.authorize;return{...await T({...e,authorize:typeof a==`string`?{url:a,params:{nonce:i}}:{url:a.url,params:{...a.params,nonce:i}}},t,n),nonce:i}},D=async(e,t)=>{if(!t)return[];let n=typeof t==`function`?await t(e):t;return Array.isArray(n)?n:typeof n==`string`?[n]:[]},O=async({ctx:e,request:r,headers:i})=>{let a=n.n(`BASE_URL`)||e?.baseURL;if(a&&a!==`/`)return a;if(e?.trustedProxyHeaders){let e=i&&new Headers(i)||r?.headers,n=e?.get(`Forwarded`)?.match(/proto=([^;]+)/i)?.[1]??e?.get(`X-Forwarded-Proto`)??`http`,a=e?.get(`Host`)??e?.get(`Forwarded`)?.match(/host=([^;]+)/i)?.[1]??e?.get(`X-Forwarded-Host`)??null;if(a)return`${n}://${a}`;throw new t.t({code:`INVALID_AUTH_CONFIGURATION`})}try{return new URL(r?.url??`not-found`).origin}catch(e){throw new t.t({code:`INVALID_AUTH_CONFIGURATION`,cause:e})}},k=async(e,n)=>{let i=[...await D(e,n?.trustedOrigins)];if(!n?.trustedProxyHeaders){let t=new URL(e.url).origin;i.includes(t)||i.push(t)}let a=await O({request:e,ctx:n});if(!r.g(a,i))throw n?.logger?.log(`UNTRUSTED_ORIGIN`,{structuredData:{origin:a}}),new t.t({code:`INVALID_TRUSTED_ORIGIN`});return a},A=async(e,t,n)=>`${await k(e,n)}${n.basePath}/callback/${t}`,j=async({request:e,oauth:t,ctx:n,redirectTo:r})=>{let i=await k(e,n),a=new URLSearchParams;return r!==void 0&&a.set(`redirectTo`,String(r)),`${i}${n.basePath}/signIn/${t}?${a.toString()}`},M=async(e,t,n)=>{try{let i=e.headers,a=await k(e,n),o=await D(e,n?.trustedOrigins);return(t=>{if(!r.m(t)&&!r.b(t))return`/`;if(r.m(t))return t;if(o.length>0){if(r.g(t,o)){let n=new URL(t).origin;for(let i of o){if(r.k(i)?.test(n))return r.h(t,e.url)?r.E(t):t;if(r.b(i)&&r.T(new URL(i).origin,n))return t}}return n?.logger?.log(`OPEN_REDIRECT_ATTACK`),`/`}return r.h(t,a)?r.E(t):(n?.logger?.log(`OPEN_REDIRECT_ATTACK`),`/`)})(t??i.get(`Referer`)??i.get(`Origin`)??`/`)}catch{return n?.logger?.log(`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`),`/`}},N=async(e,{ctx:n,request:r,headers:i,redirect:o,redirectTo:s})=>{try{let l=new Headers(i),u=n.oauth[e];if(!u)throw new t.t({code:`UNSUPPORTED_OAUTH_CONFIGURATION`});let d=r;if(!d){let t=`${await O({ctx:n,headers:l})}${n.basePath}/signIn/${e}`;d=new Request(t,{headers:l})}let f=await S(n,d,`signIn`);if(f)return f;if(o===!1){n?.logger?.log(`SIGN_IN_INITIATED`,{structuredData:{oauth_provider:e}});let t=await j({request:d,oauth:e,ctx:n,redirectTo:s}),r=new Headers(b);return{success:!0,redirect:!1,signInURL:t,headers:r,toResponse:()=>Response.json({success:!0,redirect:!1,signInURL:t},{status:200,headers:r})}}let p=await A(d,e,n),m=await M(d,s,n),h=a.t(u);n.logger?.log(`SIGN_IN_PROVIDER_TYPE_DETECTED`,{structuredData:{oauth_provider:e,oidc:h}});let g=h?await a.n(u):u;h&&n.logger?.log(`OIDC_PROVIDER_RESOLVED`,{structuredData:{oauth_provider:e,oidc:h}});let v,y,x,C;if(h){let e=await E(g,p,n);v=e.authorization,y=e.state,x=e.codeVerifier,C=e.nonce}else{let e=await T(g,p,n);v=e.authorization,y=e.state,x=e.codeVerifier}n?.logger?.log(`SIGN_IN_INITIATED`,{structuredData:{oauth_provider:e,oidc:h}});let w=new c.HeadersBuilder(_).setHeader(`Location`,v).setCookie(n.cookies.state.name,y,n.cookies.state.attributes).setCookie(n.cookies.redirectURI.name,p,n.cookies.redirectURI.attributes).setCookie(n.cookies.redirectTo.name,m,n.cookies.redirectTo.attributes).setCookie(n.cookies.codeVerifier.name,x,n.cookies.codeVerifier.attributes);C&&w.setCookie(n.cookies.nonce.name,C,n.cookies.nonce.attributes);let D=w.toHeaders();return{success:!0,redirect:!0,signInURL:v,headers:D,toResponse:()=>Response.json({success:!0,redirect:!0,signInURL:v},{status:302,headers:D})}}catch(e){let n=`AUTH_SIGN_IN_FAILED`,r=`An error occurred during the sign-in process.`;return t.n(e)&&(n=e.code,r=e.userMessage),{success:!1,redirect:!1,signInURL:null,error:{code:n,message:r},headers:new Headers(b),toResponse:()=>Response.json({success:!1,redirect:!1,signInURL:null,error:{code:n,message:r}},{status:500,headers:b})}}},P=async({ctx:e,payload:n,request:i,headers:a,redirect:o=!0,redirectTo:s,skipCSRFCheck:l=!1})=>{let{cookies:u,credentials:d,sessionStrategy:f,logger:p}=e;try{await r.M({headers:new Headers(a),cookies:u,jose:e.jose,logger:e.logger,skipCSRFCheck:l});let m=i;if(!m){let t=`${await O({ctx:e,headers:a})}${e.basePath}/signIn/credentials`;m=new Request(t,{headers:a})}let h=await S(e,m,`signInCredentials`);if(h)return h;await k(m,e);let g=await d?.authorize({credentials:n,deriveSecret:d?.hash??r.o,verifySecret:d?.verify??r.l});if(!g)throw new t.t({code:`AUTH_CREDENTIALS_INVALID`});let _=await f.createSession(g),v=await r.t(e.jose);p?.log(`CREDENTIALS_SIGN_IN_SUCCESS`);let y=new c.HeadersBuilder(b).setCookie(u.csrfToken.name,v,u.csrfToken.attributes).setCookie(u.sessionToken.name,_,u.sessionToken.attributes),x=await M(m,s,e);x=s?x:x===`/`?null:x,o&&x&&y.setHeader(`Location`,x);let C=o&&!!x,w=y.toHeaders();return{success:!0,headers:w,redirect:C,redirectURL:o?null:x,toResponse:()=>Response.json({success:!0,redirect:C,redirectURL:C?null:x},{headers:w,status:C?302:200})}}catch(e){let n=`CREDENTIALS_SIGN_IN_ERROR`,r=`An error occurred during credentials sign-in.`,i=401;t.n(e)&&(n=e.code,r=e.userMessage,i=e.statusCode);let a=new Headers(b),o={success:!1,headers:a,redirect:!1,redirectURL:null,error:{code:n,message:r},toResponse:()=>Response.json({success:!1,redirect:!1,redirectURL:null},{headers:a,status:i})};return t.n(e)&&e.code===`AUTH_CREDENTIALS_INVALID`?(p?.log(`INVALID_CREDENTIALS`,{severity:`warning`,structuredData:{path:`/signIn/credentials`}}),o):(p?.log(`CREDENTIALS_SIGN_IN_FAILED`,{severity:`error`,structuredData:{path:`/signIn/credentials`}}),o)}},F=async({ctx:e,request:n,headers:r,redirect:i=!0,redirectTo:a,skipCSRFCheck:o=!1})=>{let s=new Headers(r);try{s=await e.sessionStrategy.destroySession(s,o);let t=n;if(!t){let n=`${await O({ctx:e,headers:s})}${e.basePath}/signOut`;t=new Request(n,{headers:s})}await k(t,e);let r=new c.HeadersBuilder(s),l=await M(t,a,e);l=a?l:l===`/`?null:l,i&&l&&r.setHeader(`Location`,l);let u=r.toHeaders(),d=i&&!!l;return{success:!0,headers:u,redirect:d,redirectURL:i?null:l,toResponse:()=>Response.json({success:!0,redirect:d,redirectURL:d?null:l},{headers:u,status:d?302:202})}}catch(e){let n=`SIGN_OUT_FAILED`,r=`Failed to sign-out session`,i=400;return t.n(e)&&(n=e.code,r=e.userMessage,i=e.statusCode),{success:!1,headers:s,redirect:!1,redirectURL:null,error:{code:n,message:r},toResponse:()=>Response.json({success:!1,redirect:!1,redirectURL:null},{headers:s,status:i})}}},I=async({ctx:e,headers:t})=>{let n=new c.HeadersBuilder(b).setCookie(e.cookies.sessionToken.name,``,r.I(e.cookies.sessionToken.attributes)).setCookie(e.cookies.csrfToken.name,``,r.I(e.cookies.csrfToken.attributes)).toHeaders(),i={session:null,headers:n,success:!1,error:{code:`GET_SESSION_FAILED`,message:`Failed to retrieve session. The session token may be missing, expired, or invalid.`},toResponse:()=>Response.json({success:!1,session:null},{status:401,headers:n})};try{let{session:n,headers:a}=await e.sessionStrategy.getSession(new Headers(t));if(!n)return i;let o=r.j(a,b);return{session:n,headers:o,success:!0,toResponse:()=>Response.json({success:!0,session:n},{headers:o})}}catch(t){return e?.logger?.log(`AUTH_SESSION_INVALID`,{structuredData:{error_type:r.D(t)}}),i}},L=async({ctx:e,request:n,redirect:i=!0,headers:a,session:o,redirectTo:s,skipCSRFCheck:c=!1})=>{try{let{session:l,headers:u}=await e.sessionStrategy.refreshSession(new Headers(a),o,c);if(!l)throw new t.t({code:`UPDATE_SESSION_INVALID`});let d=r.j(u,b),f=n;if(!f){let t=`${await O({ctx:e,headers:u})}${e.basePath}/session`;f=new Request(t,{headers:d})}await k(f,e);let p=await S(e,f,`updateSession`);if(p)return p;let m=await M(f,s,e);m=s?m:m===`/`?null:m,i&&m&&d.set(`Location`,m);let h=i&&!!m;return{headers:d,session:l,success:!0,redirect:h,redirectURL:h?null:m,toResponse:()=>Response.json({success:!0,session:l,redirect:h,redirectURL:h?null:m},{headers:d,status:h?302:200})}}catch(e){let n=`UPDATE_SESSION_INVALID`,r=`Failed to update session.`;t.n(e)&&(n=e.code,r=e.userMessage);let i=new Headers(b);return{headers:i,session:null,success:!1,redirect:!1,redirectURL:null,error:{code:n,message:r},toResponse:()=>Response.json({success:!1,session:null,redirect:!1,redirectURL:null},{status:400,headers:i})}}},R=async({ctx:e,payload:n,headers:i,request:a,redirect:o=!0,redirectTo:s,skipCSRFCheck:l=!1})=>{let{signUp:u,cookies:d,sessionStrategy:f,logger:p}=e;try{let m=a;if(!m){let t=`${await O({ctx:e,headers:i})}${e.basePath}/signUp`;m=new Request(t,{headers:i})}await k(m,e);let h=await S(e,m,`signUp`);if(h)return h;await r.M({headers:new Headers(i),cookies:d,jose:e.jose,logger:p,skipCSRFCheck:l});let g=await u?.onCreateUser({payload:n});if(!g)throw new t.t({code:`USER_CREATION_FAILED`});let _=await f.createSession(g),v=await r.t(e.jose);p?.log(`SIGN_UP_SUCCESS`);let y=new c.HeadersBuilder(b).setCookie(d.csrfToken.name,v,d.csrfToken.attributes).setCookie(d.sessionToken.name,_,d.sessionToken.attributes),x=await M(m,s,e);x=s?x:x===`/`?null:x,o&&x&&y.setHeader(`Location`,x);let C=o&&!!x,w=y.toHeaders();return{success:!0,redirect:C,redirectURL:o?null:x,headers:w,toResponse:()=>Response.json({success:!0,redirect:C,redirectURL:C?null:x},{headers:w,status:C?302:200})}}catch(e){let n=`SIGN_UP_ERROR`,r=`An error occurred during sign-up.`,i=400;return t.n(e)&&(n=e.code,r=e.userMessage,i=e.statusCode),{success:!1,error:{code:n,message:r},redirect:!1,headers:new Headers(b),redirectURL:null,toResponse:()=>Response.json({success:!1,redirect:!1,redirectURL:null},{headers:b,status:i})}}},z=e=>({getSession:async t=>await I({ctx:e,headers:t.headers}),signIn:async(t,n)=>N(t,{ctx:e,...n}),signInCredentials:async t=>P({ctx:e,...t,skipCSRFCheck:!0}),signUp:async t=>R({ctx:e,...t,skipCSRFCheck:!0}),updateSession:async t=>L({ctx:e,...t,skipCSRFCheck:!0}),signOut:async t=>F({ctx:e,...t,skipCSRFCheck:!0})}),B=(e,n)=>{let r=e?.mode??`sealed`;if(![`sealed`,`signed`,`encrypted`].includes(r))throw new t.t({code:`JWT_INVALID_MODE`});return{createToken:r===`sealed`?n.encodeJWT:r===`signed`?n.signJWS:n.encryptJWE,verifyToken:r===`sealed`?n.decodeJWT:r===`signed`?n.verifyJWS:n.decryptJWE}},ee=e=>({getCookie:t=>({sessionToken:r.F(t,e().sessionToken.name)}),setCookie:({sessionToken:t})=>new c.HeadersBuilder(b).setCookie(e().sessionToken.name,t,e().sessionToken.attributes).toHeaders(),clear:()=>new c.HeadersBuilder(b).setCookie(e().csrfToken.name,``,r.I(e().csrfToken.attributes)).setCookie(e().sessionToken.name,``,r.I(e().sessionToken.attributes)).toHeaders()}),te=({config:e,jose:t,logger:n,cookies:i,identity:a})=>{let o=B(e?.jwt,t),s=ee(i),c=e?.jwt?.maxAge??3600*24*15,l=e?.jwt?.expirationStrategy??`absolute`,u=({exp:e})=>{if(!e)return null;let t=Math.floor(Date.now()/1e3);switch(l){case`fixed`:case`absolute`:return null;case`rolling`:return new Date((t+c)*1e3);case`sliding`:{let n=c*.25;return e-t<n?new Date((t+c)*1e3):null}default:return null}};return{getSession:async e=>{let t=new Headers;try{let{sessionToken:r}=s.getCookie(e);if(!r)return{session:null,headers:t};let i=await o.verifyToken(r),c=a.skipValidation?i:await a.schemaRegistry.parseWithJWT(i),{exp:d,iat:f,mexp:p,...m}=c,h=await a.schemaRegistry.parse(m);if(!h.sub)return{session:null,headers:t};let g={user:h,expires:c.exp?new Date(d*1e3).toISOString():``},_=u({exp:d});if(!_)return{session:{expires:g.expires,user:h},headers:e};let v=l===`absolute`?c.iat:Math.floor(Date.now()/1e3),y=await o.createToken({...h,exp:Math.floor(_.getTime()/1e3),iat:v,mexp:c.mexp});return n?.log(`SESSION_REFRESHED`,{structuredData:{strategy:`stateless`,expiresAt:_.toISOString()}}),{session:{user:h,expires:_.toISOString()},headers:s.setCookie({sessionToken:y})}}catch(e){return n?.log(`AUTH_SESSION_INVALID`,{structuredData:{error_type:r.D(e)}}),{session:null,headers:t}}},createSession:async e=>{a.skipValidation&&n?.log(`IDENTITY_VALIDATION_DISABLED`,{structuredData:{identity_validation_disabled:!0}});let t=a.skipValidation?e:await a.schemaRegistry.parse(e);return o.createToken(t)},refreshSession:async(e,d,f=!1)=>{try{let{sessionToken:p}=s.getCookie(e);if(!p||!await r.M({headers:e,skipCSRFCheck:f,cookies:i(),logger:n,jose:t}))return{session:null,headers:s.clear()};let m=await o.verifyToken(p),h=a.skipValidation?m:await a.schemaRegistry.parseWithJWT(m),{exp:g,mexp:_,iat:v}=h,y=a.skipValidation?h:await a.schemaRegistry.parse(h),{sub:b}=y,x=a.skipValidation?d.user:await a.schemaRegistry.parseAsPartial(d.user),S=d.expires?new Date(Math.min(Date.now()+c*1e3,new Date(d.expires).getTime())):u({exp:g})??new Date(Date.now()+c*1e3),C={user:{...y,...x,sub:b},expires:S.toISOString()},w=await a.schemaRegistry.parse(C.user),T=l===`absolute`?v:Math.floor(Date.now()/1e3),E=await o.createToken({...w,exp:Math.floor(S.getTime()/1e3),iat:T,mexp:_});return C.expires=new Date(C.expires).toISOString(),{session:C,headers:s.setCookie({sessionToken:E})}}catch(e){return n?.log(`AUTH_SESSION_INVALID`,{structuredData:{error_type:r.D(e)}}),{session:null,headers:s.clear()}}},revokeSession:async e=>{},destroySession:async(e,a=!1)=>(await r.M({headers:e,skipCSRFCheck:a,cookies:i(),logger:n,jose:t}),await r.N({headers:e,cookies:i(),jwt:o,logger:n}),s.clear())}},ne=({config:e,jose:n,cookies:r,logger:i,identity:a})=>{switch(e?.strategy??`jwt`){case`jwt`:return te({jose:n,config:e,cookies:r,logger:i,identity:a});default:throw new t.t({code:`INVALID_SESSION_STRATEGY`})}},V=(e,n=`strip`)=>{if(r.S(e))return n===`strip`?e.strip():n===`passthrough`?u.z.looseObject(e.shape):n===`strict`?e.strict():e.partial().optional();if(r.y(e))return n===`strip`?h.object(e.entries):n===`passthrough`?h.looseObject(e.entries):n===`strict`?h.strictObject(e.entries):h.partial(e);if(r.f(e))return n===`strip`?e.onUndeclaredKey(`delete`):n===`passthrough`?e.onUndeclaredKey(`ignore`):n===`strict`?e.onUndeclaredKey(`reject`):e.partial();if((0,f.IsObject)(e))return n===`strip`?f.Type.Object(e.properties,{...e,additionalProperties:!1,strip:!0}):n===`passthrough`?f.Type.Object(e.properties,{...e,additionalProperties:!0}):n===`strict`?f.Type.Object(e.properties,{...e,additionalProperties:!1}):f.Type.Partial(e);throw new t.t({code:`SCHEMA_UNSUPPORTED`})},H=e=>{if(r.y(e))return h.object({...e.entries,exp:h.number(),iat:h.number(),jti:h.string(),nbf:h.number(),aud:h.optional(h.string()),iss:h.optional(h.string()),mexp:h.optional(h.number())});if(r.f(e))return e.and({exp:`number`,iat:`number`,jti:`string`,nbf:`number`,aud:`string?`,iss:`string?`,mexp:`number?`});if((0,f.IsObject)(e))return f.Type.Object({...e.properties,exp:f.Type.Number(),iat:f.Type.Number(),jti:f.Type.String(),nbf:f.Type.Number(),aud:f.Type.Optional(f.Type.String()),iss:f.Type.Optional(f.Type.String()),mexp:f.Type.Optional(f.Type.Number())},{...e});if(r.S(e))return e.extend({exp:u.z.number(),iat:u.z.number(),jti:u.z.string(),nbf:u.z.number(),aud:u.z.string().optional(),iss:u.z.string().optional(),mexp:u.z.number().optional()});throw new t.t({code:`SCHEMA_UNSUPPORTED`})},U=e=>{if(r.y(e))return h.object({user:e,expires:h.optional(h.pipe(h.string(),h.transform(e=>new Date(e)),h.date()))});if(r.f(e))return(0,d.type)({user:e,expires:(0,d.type)(`string`).pipe(e=>new Date(e)).optional()});if((0,f.IsObject)(e))return f.Type.Object({user:e,expires:f.Type.Optional(f.Type.String())});if(r.S(e))return u.z.object({user:e,expires:u.z.coerce.date().optional()});throw new t.t({code:`SCHEMA_UNSUPPORTED`})},W=n=>{let r=V(n.schema??e.t,n.unknownKeys),i=V(n.schema??e.t,`partial`),a=H(n.schema??e.t),o=(0,g.createValidator)(r),s=(0,g.createValidator)(i),c=(0,g.createValidator)(a);return{parse:async(e={})=>{let{data:n,success:r,error:i}=o.validate(e);if(!r)throw new t.t({code:`SCHEMA_PARSER_FAILED`,cause:i});return n},parseAsPartial:async(e={})=>{let{data:n,success:r,error:i}=s.validate(e);if(!r)throw new t.t({code:`SCHEMA_PARSER_FAILED`,cause:i});return n},parseWithJWT:async(e={})=>{let{data:n,success:r,error:i}=c.validate(e);if(!r)throw new t.t({code:`SCHEMA_PARSER_FAILED`,cause:i});return n},schema:r,schemaAsPartial:i,schemaWithJWT:a}},G=e=>{let i=n.n(`TRUSTED_PROXY_HEADERS`)===void 0?e?.trustedProxyHeaders??!1:n.i(`TRUSTED_PROXY_HEADERS`),o=n.r(`TRUSTED_ORIGINS`),c=o.length>0?o:e?.trustedOrigins,l=s.t(e),u=e?.cookies?.prefix,d=e?.cookies?.overrides??{},f=r.P(!0,u,d,l),p=r.P(!1,u,d,l),m=r.u(e?.secret,e?.session),h=e?.identity?.unknownKeys??`strip`,g=e?.identity?.skipValidation??!1,_=W({schema:e?.identity?.schema,unknownKeys:h,skipValidation:g});if(i&&(!c||Array.isArray(c)&&c.length===0))throw new t.t({code:`AUTH_INVALID_PROXY_HEADERS_CONFIG`});let v={oauth:a.i(e?.oauth),credentials:e?.credentials,cookies:p,jose:m,secret:e?.secret,basePath:e?.basePath??`/auth`,trustedProxyHeaders:i,trustedOrigins:c,logger:l,cookieConfig:{secure:f,standard:p},baseURL:e?.baseURL,identity:{schemaRegistry:_,unknownKeys:h,skipValidation:g},signUp:e?.signUp,jwtManager:B(e?.session?.jwt,m),rateLimiters:x(e?.rateLimiter)};return v.sessionStrategy=ne({cookies:()=>v.cookies,jose:v.jose,config:e?.session,logger:v.logger,identity:v.identity}),v},K=e=>n=>(0,c.isAuraRouterError)(n)||(0,c.isAuraRouterValidationError)(n)||t.n(n)?n.toResponse():(e?.log(`SERVER_ERROR`,{structuredData:{error_type:n.name,error_message:n.message}}),Response.json({type:`SERVER_ERROR`,code:`SERVER_ERROR`,message:`An unexpected error occurred`},{status:500})),q=e=>(0,c.createEndpointConfig)(`/signIn/:oauth`,{schemas:{params:u.z.object({oauth:u.z.enum(Object.keys(e),`The OAuth provider is not supported or invalid.`)}),searchParams:o.m}}),J=e=>(0,c.createEndpoint)(`GET`,`/signIn/:oauth`,async e=>{let{toResponse:t}=await N(e.params.oauth,{ctx:e.context,request:e.request,headers:e.request.headers,redirect:e.searchParams.redirect,redirectTo:e.searchParams.redirectTo});return t()},q(e)),Y=(0,c.createEndpointConfig)({schemas:{body:o.t,searchParams:o.m}}),X=(0,c.createEndpoint)(`POST`,`/signIn/credentials`,async e=>{let t=e.body,{toResponse:n}=await P({ctx:e.context,payload:t,request:e.request,headers:e.request.headers,redirect:e.searchParams.redirect,redirectTo:e.searchParams.redirectTo});return n()},Y),Z=e=>{let n=e?.id??e?.sub??e?.uid??e?.user_id??e?.account_id;if(!n)throw new t.t({code:`INVALID_USER_INFO`});return{sub:n,email:e?.email,name:e?.name??e?.username??e?.nickname,image:e?.image??e?.picture}},re=async(e,n,a)=>{let s=e.userInfo,c=typeof s==`string`?s:s.url,l=typeof s==`string`?void 0:s.headers,u=typeof s==`string`?`GET`:(s.method??`GET`).toUpperCase();try{a?.log(`OAUTH_USERINFO_REQUEST_INITIATED`,{structuredData:{endpoint:c}});let e=await i.t(c,{method:u,headers:{"User-Agent":`Aura Auth/${r.C}`,Accept:`application/json`,Authorization:`Bearer ${n}`,...l}});if(!e.ok)throw a?.log(`OAUTH_USERINFO_INVALID_RESPONSE`),new t.t({code:`INVALID_OAUTH_USER_INFO_RESPONSE`});r.d(e,a);let s=await e.json(),{success:d,data:f}=o.c.safeParse(s);if(d)throw a?.log(`OAUTH_USERINFO_ERROR`,{message:`Error response received from OAuth userinfo endpoint`,structuredData:{error:f.error,error_description:f.error_description??``}}),new t.t({code:`INVALID_OAUTH_USER_INFO_RES_FORMAT`});return a?.log(`OAUTH_USERINFO_SUCCESS`),s}catch(e){throw t.n(e)?e:(a?.log(`OAUTH_USERINFO_REQUEST_FAILED`),new t.t({code:`UNKNOWN_OAUTH_USER_INFO_ERROR`,cause:e}))}},ie=async(e,n,i)=>{try{let s={};if(r.p(e.userInfo)?(i?.log(`OAUTH_USERINFO_REQUEST_INITIATED`,{structuredData:{endpoint:e.name}}),s=await e.userInfo.request({accessToken:n.access_token,expiresIn:n?.expires_in,refreshToken:n?.refresh_token,scope:n?.scope,tokenType:n?.token_type,userInfoURL:e.userInfo.url})):s=await re(e,n.access_token,i),a.t(e)){let e=o.d.safeParse(s);if(!e.success)throw i?.log(`OAUTH_USERINFO_INVALID_RESPONSE`),new t.t({code:`OIDC_USERINFO_INVALID_SCHEMA`,cause:e.error});s=e.data}return e?.profile?e.profile(s):Z(s)}catch(e){throw t.n(e)?e:(i?.log(`OAUTH_USERINFO_REQUEST_FAILED`),new t.t({code:`UNKNOWN_CUSTOM_USER_INFO_ERROR`,cause:e}))}},ae=async(e,n,s,c,l)=>{let{accessToken:u,clientId:d,clientSecret:f}=e;if(!d||!f||!n||!s||!c||!u)throw l?.log(`INVALID_OAUTH_CONFIGURATION`,{structuredData:{has_client_id:!!d,has_client_secret:!!f,has_access_token:!!u,has_redirect_uri:!!n,has_code:!!s,has_code_verifier:!!c}}),new t.t({code:`INVALID_OAUTH_PROVIDER_URL_CONFIG`});let p=typeof u==`string`?u:u.url,m=typeof u==`string`?void 0:u.headers;try{l?.log(`OAUTH_ACCESS_TOKEN_REQUEST_INITIATED`,{structuredData:{has_client_id:!!d,redirect_uri:n,grant_type:`authorization_code`}});let u=await i.t(p,{method:`POST`,headers:{...m,Accept:`application/json`,"Content-Type":`application/x-www-form-urlencoded`},body:new URLSearchParams({client_id:d,client_secret:f,code:s,redirect_uri:n,grant_type:`authorization_code`,code_verifier:c}).toString()});if(!u.ok)throw l?.log(`INVALID_OAUTH_ACCESS_TOKEN_RESPONSE`),new t.t({code:`INVALID_OAUTH_ACCESS_TOKEN_RESPONSE`});r.d(u,l);let h=await u.json(),g=(a.t(e)?o.u:o.a).safeParse(h);if(!g.success){let{success:e,data:n}=o.i.safeParse(h);throw e?(l?.log(`OAUTH_ACCESS_TOKEN_ERROR`,{structuredData:{error:n.error,error_description:n.error_description??``}}),new t.t({code:`INVALID_OAUTH_ACCESS_TOKEN_RES_FORMAT`})):(l?.log(`INVALID_OAUTH_ACCESS_TOKEN_RESPONSE`),new t.t({code:`INVALID_OAUTH_ACCESS_TOKEN_RES_FORMAT`}))}return l?.log(`OAUTH_ACCESS_TOKEN_SUCCESS`),g.data}catch(e){throw t.n(e)?e:(l?.log(`OAUTH_ACCESS_TOKEN_REQUEST_FAILED`),new t.t({code:`UNKNOWN_OAUTH_ACCESS_TOKEN_ERROR`,cause:e}))}},Q=new Map,oe=async e=>{let n;try{n=await i.t(e,{headers:{Accept:`application/json`}}),r.d(n)}catch(e){throw new t.t({code:`OIDC_JWKS_INVALID_RESPONSE`,cause:e})}if(!n.ok)throw new t.t({code:`OIDC_JWKS_INVALID_RESPONSE`});let a;try{a=await n.json()}catch(e){throw new t.t({code:`OIDC_JWKS_INVALID_RESPONSE`,cause:e})}let s=o.r.safeParse(a);if(!s.success)throw new t.t({code:`OIDC_JWKS_INVALID_SCHEMA`,cause:s.error});return s.data.keys},se=async e=>{let t=Q.get(e);if(!t||Date.now()-t.fetchedAt>3e5){let t=await oe(e);Q.set(e,{verifier:(0,m.createLocalJWKSet)({keys:t}),fetchedAt:Date.now()})}return Q.get(e).verifier},ce=async e=>se(e),le=async(e,n)=>{let{issuer:i,clientId:s,nonce:c,jwks_uri:l}=n;try{let{payload:n}=await(0,m.jwtVerify)(e,await ce(l),{issuer:a.s(i),audience:s}),u=o.n.safeParse(n);if(!u.success)throw new t.t({code:`OIDC_ID_TOKEN_INVALID`,cause:u.error});if(!u.data.nonce||!r.A(u.data.nonce,c))throw new t.t({code:`OIDC_NONCE_MISMATCH`})}catch(e){throw e instanceof t.t?e:e instanceof m.errors.JWTExpired?new t.t({code:`JWT_EXPIRED`,cause:e}):e instanceof m.errors.JWTInvalid||e instanceof m.errors.JWSInvalid?new t.t({code:`JWT_MALFORMED`,cause:e}):e instanceof m.errors.JWSSignatureVerificationFailed?new t.t({code:`JWT_INVALID_SIGNATURE`,cause:e}):e instanceof m.errors.JOSEAlgNotAllowed?new t.t({code:`JWT_ALGORITHM_MISMATCH`,cause:e}):new t.t({code:`OIDC_ID_TOKEN_INVALID`,cause:e})}},ue=e=>(0,c.createEndpointConfig)({schemas:{params:u.z.object({oauth:u.z.enum(Object.keys(e),`The OAuth provider is not supported or invalid.`)}),searchParams:u.z.object({code:u.z.string(`Missing code parameter in the OAuth authorization response.`),state:u.z.string(`Missing state parameter in the OAuth authorization response.`)})}}),de=(e,t)=>{let n=e.headers.get(`Cookie`);if(n)return(0,p.parse)(n)[t]},fe=e=>(0,c.createEndpoint)(`GET`,`/callback/:oauth`,async e=>{let{request:n,params:{oauth:i},searchParams:{code:o,state:s},context:l}=e,{oauth:u,cookies:d,jose:f,logger:p,trustedOrigins:m}=l,h=u[i],g=a.t(h),v=r.F(n,d.state.name),y=r.F(n,d.codeVerifier.name),b=g?de(n,d.nonce.name):void 0,x=r.F(n,d.redirectTo.name),S=r.F(n,d.redirectURI.name),C=new c.HeadersBuilder(_).setCookie(d.state.name,``,r.I(d.state.attributes)).setCookie(d.redirectURI.name,``,r.I(d.redirectURI.attributes)).setCookie(d.redirectTo.name,``,r.I(d.redirectTo.attributes)).setCookie(d.codeVerifier.name,``,r.I(d.codeVerifier.attributes)).setCookie(d.nonce.name,``,r.I(d.nonce.attributes));if(!r.A(v,s))return p?.log(`MISMATCHING_STATE`,{structuredData:{oauth_provider:i}}),Response.json({type:`PROTOCOL`,code:`AUTH_MISMATCHING_STATE`,message:`The provided state passed in the OAuth response does not match the stored token state.`},{headers:C.toHeaders(),status:400});let w=g?await a.n(h):h,T=await ae(w,S,o,y,p);if(g){if(!T.id_token)throw new t.t({code:`OIDC_ID_TOKEN_INVALID`});let{issuer:e,jwks_uri:n}=w.oidc;if(!n||!b||!w.clientId)throw new t.t({code:`OIDC_ID_TOKEN_INVALID`});await le(T.id_token,{issuer:e,clientId:w.clientId,nonce:b,jwks_uri:n})}let E=await D(n,m),O=await k(n,l);if(!r.m(x)&&!(E.length>0?r.g(x,E):r.h(x,O)))throw p?.log(`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`,{structuredData:{redirect_path:x,provider:i,has_trusted_origins:E.length>0,request_origin:O}}),new t.t({code:`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`});let A=await ie(w,T,p),j=await l.sessionStrategy.createSession(A),M=await r.t(f);p?.log(`OAUTH_CALLBACK_SUCCESS`,{structuredData:{provider:i}});let N=C.setHeader(`Location`,x).setCookie(d.sessionToken.name,j,d.sessionToken.attributes).setCookie(d.csrfToken.name,M,d.csrfToken.attributes).toHeaders();return Response.json({oauth:i},{status:302,headers:N})},ue(e)),pe=(0,c.createEndpoint)(`GET`,`/session`,async e=>{let{toResponse:t}=await I({ctx:e.context,headers:e.request.headers});return t()}),me=(0,c.createEndpointConfig)({schemas:{searchParams:o.m.extend({token_type_hint:u.z.literal(`session_token`)})}}),he=(0,c.createEndpoint)(`POST`,`/signOut`,async e=>{let{toResponse:t}=await F({ctx:e.context,request:e.request,headers:e.request.headers,redirect:e.searchParams.redirect,redirectTo:e.searchParams.redirectTo});return t()},me),$=(e,t)=>{try{return r.F(e,t)}catch{return}},ge=(0,c.createEndpoint)(`GET`,`/csrfToken`,async e=>{let{request:t,context:{jose:n,cookies:i,logger:a}}=e,o=$(t,i.csrfToken.name);a?.log(`CSRF_TOKEN_REQUESTED`,{structuredData:{has_token:!!o}});let s=await r.t(n,o);a?.log(`CSRF_TOKEN_ISSUED`,{structuredData:{issued:!!s}});let c=new Headers(b);return c.append(`Set-Cookie`,r.L(i.csrfToken.name,s,i.csrfToken.attributes)),Response.json({csrfToken:s},{headers:c})}),_e=e=>(0,c.createEndpointConfig)({schemas:{body:U(e.schemaRegistry.schemaAsPartial),searchParams:o.m}}),ve=e=>(0,c.createEndpoint)(`PATCH`,`/session`,async e=>{let t=e.body,{toResponse:n}=await L({ctx:e.context,request:e.request,headers:e.request.headers,redirect:e.searchParams.redirect,redirectTo:e.searchParams.redirectTo,session:t});return n()},_e(e)),ye=e=>(0,c.createEndpointConfig)({schemas:{body:e?.schema,searchParams:o.m}}),be=e=>(0,c.createEndpoint)(`POST`,`/signUp`,async e=>{let t=e.body,{toResponse:n}=await R({ctx:e.context,payload:t,request:e.request,headers:e.request.headers,redirect:e.searchParams.redirect,redirectTo:e.searchParams.redirectTo,skipCSRFCheck:!1});return n()},ye(e)),xe=e=>{let t=G(e);return{basePath:e?.basePath??`/auth`,onError:K(t.logger),context:t,use:[e=>{let n=r.O(e.request,e.context.trustedProxyHeaders);return e.context.cookies=n?t.cookieConfig.secure:t.cookieConfig.standard,e}]}},Se=e=>{let t=xe(e);return{handlers:(0,c.createRouter)([J(t.context.oauth),X,fe(t.context.oauth),pe,he,ge,ve(t.context.identity),be(t.context.signUp)],t),jose:t.context.jose,api:z(t.context)}},Ce=e=>{let t=Se(e);return t.handlers.ALL=async e=>{let n=e.method.toUpperCase(),r={GET:t.handlers.GET,POST:t.handlers.POST,PATCH:t.handlers.PATCH};return n in r?await r[n](e):new Response(`Method Not Allowed`,{status:405,headers:{Allow:Object.keys(r).join(`, `)}})},t};exports.createAuth=Ce;

package/dist/index.d.ts

@@ -1,2 +1,2 @@
-import { V as createAuth, ht as AuthInstance, mn as User, mt as AuthConfig, un as Session } from "./index-1ADcIVGC.js";
+import { Ct as AuthConfig, Fn as Session, K as createAuth, wt as AuthInstance, zn as User } from "./index-DIcbmH1M.js";
 export { type AuthConfig, type AuthInstance, type Session, type User, createAuth };

package/dist/index.js

@@ -1 +1 @@
-import{a as e,c as t,d as n,f as r,l as i,n as a,o,p as s,r as c,s as l,u}from"./errors-Czt_w1t_.js";import{i as d,n as f,r as p,t as m}from"./env-BG1x-kSX.js";import{A as h,C as g,D as _,E as v,O as y,T as b,_ as x,b as S,d as C,k as ee,m as w,t as T,u as E,v as D,w as O,x as te}from"./assert-av6s0a6t.js";import{a as ne,d as re,i as ie,l as ae,s as oe,t as k,u as se}from"./crypto-D6aq4c8x.js";import{t as ce}from"./logger-BfUjjtxf.js";import{UserIdentity as A}from"./shared/identity.js";import{a as le,i as ue,l as j,n as de,r as fe,s as pe,t as me}from"./@types/index.js";import{createBuiltInOAuthProviders as he}from"./oauth/index.js";import{HeadersBuilder as M,createEndpoint as N,createEndpointConfig as P,createRouter as ge,isInvalidZodSchemaError as _e,isRouterError as ve}from"@aura-stack/router";import{z as F}from"zod/v4";import{type as ye}from"arktype";import{IsObject as I,Type as L}from"typebox";import{parse as be,serialize as xe}from"@aura-stack/router/cookie";import*as R from"valibot";import{safeParse as Se}from"valibot";import{Value as z}from"typebox/value";const B={"Cache-Control":`no-store`,Pragma:`no-cache`,Expires:`0`,Vary:`Cookie`},Ce={"Content-Security-Policy":[`default-src 'none'`,`script-src 'self'`,`frame-src 'none'`,`object-src 'none'`,`frame-ancestors 'none'`,`base-uri 'none'`].join(`; `)},we={"X-Content-Type-Options":`nosniff`,"X-Frame-Options":`DENY`,"Referrer-Policy":`strict-origin-when-cross-origin`},V={...B,...Ce,...we},Te=(e,t)=>{for(let[n,r]of Object.entries(t))r!==void 0&&r!==``&&e.searchParams.set(n,r)},Ee=(e,t,n,r,i)=>{let o=e.authorize,s=typeof o==`string`?o:o?.url??e.authorizeURL;if(!s)throw new a(`INVALID_OAUTH_CONFIGURATION`,`Missing authorization URL in OAuth provider configuration.`);let c=new URL(s),l=typeof o==`string`?void 0:o?.params;return Te(c,{response_type:l?.responseType??e.responseType??`code`,client_id:e.clientId,redirect_uri:t,state:n,code_challenge:r,code_challenge_method:i,scope:l?.scope??e.scope,prompt:l?.prompt,response_mode:l?.responseMode,login_hint:l?.loginHint,nonce:l?.nonce,display:l?.display,audience:l?.audience}),c.toString()},De=async(e,t,n)=>{let r=ne(),{codeVerifier:i,codeChallenge:o,method:s}=await ie(),c=Ee(e,t,r,o,s);if(!ue.safeParse({...e,redirectURI:t,state:r,codeChallenge:o,codeChallengeMethod:s}).success)throw n?.logger?.log(`INVALID_OAUTH_CONFIGURATION`,{structuredData:{scope:e?.scope??``,redirect_uri:t,has_state:!!r,has_code_challenge:!!o,code_challenge_method:s}}),new a(`INVALID_OAUTH_CONFIGURATION`,`The OAuth provider configuration is invalid.`);return{authorization:c,state:r,codeVerifier:i,method:s}},H=async(e,t)=>{if(!t)return[];let n=typeof t==`function`?await t(e):t;return Array.isArray(n)?n:typeof n==`string`?[n]:[]},U=async({ctx:e,request:t,headers:n})=>{let r=f(`BASE_URL`)||e?.baseURL;if(r&&r!==`/`)return r;if(e?.trustedProxyHeaders){let e=n&&new Headers(n)||t?.headers,r=e?.get(`Forwarded`)?.match(/proto=([^;]+)/i)?.[1]??e?.get(`X-Forwarded-Proto`)??`http`,i=e?.get(`Host`)??e?.get(`Forwarded`)?.match(/host=([^;]+)/i)?.[1]??e?.get(`X-Forwarded-Host`)??null;if(i)return`${r}://${i}`;throw new a(`INVALID_OAUTH_CONFIGURATION`,`The URL cannot be constructed. Please set the BASE_URL environment variable or provide trusted proxy host headers.`)}try{return new URL(t?.url??`not-found`).origin}catch(e){throw new a(`INVALID_OAUTH_CONFIGURATION`,`The URL cannot be constructed. Please set the BASE_URL environment variable or enable trustedProxyHeaders.`,{cause:e})}},W=async(e,t)=>{let n=await H(e,t?.trustedOrigins);n.push(new URL(e.url).origin);let r=await U({request:e,ctx:t});if(!w(r,n))throw t?.logger?.log(`UNTRUSTED_ORIGIN`,{structuredData:{origin:r}}),new a(`UNTRUSTED_ORIGIN`,`The constructed origin URL is not trusted.`);return r},Oe=async(e,t,n)=>`${await W(e,n)}${n.basePath}/callback/${t}`,ke=async({request:e,oauth:t,ctx:n,redirectTo:r})=>{let i=await W(e,n),a=new URLSearchParams;return r!==void 0&&a.set(`redirectTo`,String(r)),`${i}${n.basePath}/signIn/${t}?${a.toString()}`},G=async(e,t,n)=>{try{let r=e.headers,i=await W(e,n),a=await H(e,n?.trustedOrigins);return(t=>{if(!E(t)&&!D(t))return`/`;if(E(t))return t;if(a.length>0){if(w(t,a)){let n=new URL(t).origin;for(let r of a){if(y(r)?.test(n))return C(t,e.url)?O(t):t;if(D(r)&&g(new URL(r).origin,n))return t}}return n?.logger?.log(`OPEN_REDIRECT_ATTACK`),`/`}return C(t,i)?O(t):(n?.logger?.log(`OPEN_REDIRECT_ATTACK`),`/`)})(t??r.get(`Referer`)??r.get(`Origin`)??`/`)}catch{return n?.logger?.log(`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`),`/`}},K=async(e,{ctx:n,request:r,headers:i,redirect:o,redirectTo:s})=>{try{let t=new Headers(i),c=n.oauth[e];if(!c)throw new a(`INVALID_OAUTH_CONFIGURATION`,`The OAuth provider "${e}" is not configured.`);let l=r;if(!l){let r=`${await U({ctx:n,headers:t})}${n.basePath}/signIn/${e}`;l=new Request(r,{headers:t})}if(o===!1){n?.logger?.log(`SIGN_IN_INITIATED`,{structuredData:{oauth_provider:e}});let t=await ke({request:l,oauth:e,ctx:n,redirectTo:s}),r=new Headers(V);return{success:!0,redirect:!1,signInURL:t,headers:r,toResponse:()=>Response.json({success:!0,redirect:!1,signInURL:t},{status:200,headers:r})}}let u=await Oe(l,e,n),d=await G(l,s,n),{authorization:f,state:p,codeVerifier:m}=await De(c,u,n);n?.logger?.log(`SIGN_IN_INITIATED`,{structuredData:{oauth_provider:e}});let h=new M(B).setHeader(`Location`,f).setCookie(n.cookies.state.name,p,n.cookies.state.attributes).setCookie(n.cookies.redirectURI.name,u,n.cookies.redirectURI.attributes).setCookie(n.cookies.redirectTo.name,d,n.cookies.redirectTo.attributes).setCookie(n.cookies.codeVerifier.name,m,n.cookies.codeVerifier.attributes).toHeaders();return{success:!0,redirect:!0,signInURL:f,headers:h,toResponse:()=>Response.json({success:!0,redirect:!0,signInURL:f},{status:302,headers:h})}}catch(e){let n=`AUTH_SIGN_IN_FAILED`,r=`An error occurred during the sign-in process.`;return t(e)&&(n=e.code,r=e.message),{success:!1,redirect:!1,signInURL:null,error:{code:n,message:r},headers:new Headers(V),toResponse:()=>Response.json({success:!1,redirect:!1,signInURL:null,error:{code:n,message:r}},{status:500,headers:V})}}},Ae=async({ctx:e,payload:n,request:r,headers:i,redirect:a=!0,redirectTo:s})=>{let{cookies:c,credentials:l,sessionStrategy:u,logger:d}=e;try{let t=r;if(!t){let n=`${await U({ctx:e,headers:i})}${e.basePath}/signIn/credentials`;t=new Request(n,{headers:i})}await W(t,e);let f=await l?.authorize({credentials:n,deriveSecret:l?.hash??oe,verifySecret:l?.verify??se});if(!f)throw new o(`INVALID_CREDENTIALS`,`The provided credentials are invalid.`);let p=await u.createSession(f),m=await k(e.jose);d?.log(`CREDENTIALS_SIGN_IN_SUCCESS`);let h=new M(V).setCookie(c.csrfToken.name,m,c.csrfToken.attributes).setCookie(c.sessionToken.name,p,c.sessionToken.attributes),g=await G(t,s,e);g=s?g:g===`/`?null:g,a&&g&&h.setHeader(`Location`,g);let _=a&&!!g,v=h.toHeaders();return{success:!0,headers:v,redirect:_,redirectURL:a?null:g,toResponse:()=>Response.json({success:!0,redirect:_,redirectURL:_?null:g},{headers:v,status:_?302:200})}}catch(e){let n=`CREDENTIALS_SIGN_IN_ERROR`,r=`An error occurred during credentials sign-in.`;t(e)&&(n=e.code,r=e.message);let i=new Headers(V),a={success:!1,headers:i,redirect:!1,redirectURL:null,error:{code:n,message:r},toResponse:()=>Response.json({success:!1,redirect:!1,redirectURL:null},{headers:i,status:401})};return e instanceof o?(d?.log(`INVALID_CREDENTIALS`,{severity:`warning`,structuredData:{path:`/signIn/credentials`}}),a):(d?.log(`CREDENTIALS_SIGN_IN_FAILED`,{severity:`error`,structuredData:{path:`/signIn/credentials`}}),a)}},je=async({ctx:e,request:n,headers:r,redirect:i=!0,redirectTo:a,skipCSRFCheck:o=!1})=>{let s=await e.sessionStrategy.destroySession(new Headers(r),o);try{let t=n;if(!t){let n=`${await U({ctx:e,headers:s})}${e.basePath}/signOut`;t=new Request(n,{headers:s})}await W(t,e);let r=new M(s),o=await G(t,a,e);o=a?o:o===`/`?null:o,i&&o&&r.setHeader(`Location`,o);let c=r.toHeaders(),l=i&&!!o;return{success:!0,headers:c,redirect:l,redirectURL:i?null:o,toResponse:()=>Response.json({success:!0,redirect:l,redirectURL:l?null:o},{headers:c,status:l?302:202})}}catch(e){let n=`SIGN_OUT_FAILED`,r=`Failed to sign-out session`;return t(e)&&(n=e.code,r=e.message),{success:!1,headers:s,redirect:!1,redirectURL:null,error:{code:n,message:r},toResponse:()=>Response.json({success:!1,redirect:!1,redirectsURL:null})}}},q={httpOnly:!0,sameSite:`lax`,path:`/`,maxAge:3600*24*15},Me={secure:!1,httpOnly:!0},Ne={secure:!0,httpOnly:!0},Pe={secure:!0,httpOnly:!0,path:`/`,domain:void 0},J={httpOnly:!0,maxAge:300,sameSite:`lax`,expires:new Date(Date.now()+300*1e3)},Fe=(e,t,n)=>xe(e,t,n),Y=e=>({...e,expires:new Date(0),maxAge:0,secure:e?.secure??!0}),X=(e,t)=>{let n=e instanceof Request?e.headers.get(`Cookie`):e.get(`Cookie`);if(!n)throw new a(`COOKIE_NOT_FOUND`,`No cookies found. There is no active session`);let r=be(n)[t];if(!r)throw new a(`COOKIE_NOT_FOUND`,`Cookie "${t}" not found. There is no active session`);return r},Z=(e,t,n,r)=>(t.httpOnly||r?.log(`COOKIE_HTTPONLY_DISABLED`),t.domain===`*`&&(t.domain=void 0,r?.log(`COOKIE_WILDCARD_DOMAIN`)),e?n===`host`?{...q,...t,...Pe}:{...q,...t,...Ne}:(t.secure&&r?.log(`COOKIE_SECURE_DISABLED`),t.sameSite==`none`&&(t.sameSite=`lax`,r?.log(`COOKIE_SAMESITE_NONE_WITHOUT_SECURE`)),m.NODE_ENV===`production`&&r?.log(`COOKIE_INSECURE_IN_PRODUCTION`),n===`host`&&r?.log(`COOKIE_HOST_STRATEGY_INSECURE`),{...q,...t,...Me})),Ie=(e,t,n,r)=>{t??=`aura-auth`;let i=e?`__Secure-`:``,a=e?`__Host-`:``;return{sessionToken:{name:`${i}${t}.${n?.sessionToken?.name??`session_token`}`,attributes:Z(e,{...q,...n?.sessionToken?.attributes},n?.sessionToken?.attributes?.strategy??`secure`,r)},state:{name:`${i}${t}.${n?.state?.name??`state`}`,attributes:Z(e,{...J,...n?.state?.attributes},n?.state?.attributes?.strategy??`secure`,r)},csrfToken:{name:`${a}${t}.${n?.csrfToken?.name??`csrf_token`}`,attributes:Z(e,{...n?.csrfToken?.attributes,...Pe,sameSite:`strict`},n?.csrfToken?.attributes?.strategy??`host`,r)},redirectTo:{name:`${i}${t}.${n?.redirectTo?.name??`redirect_to`}`,attributes:Z(e,{...J,...n?.redirectTo?.attributes},n?.redirectTo?.attributes?.strategy??`secure`,r)},redirectURI:{name:`${i}${t}.${n?.redirectURI?.name??`redirect_uri`}`,attributes:Z(e,{...J,...n?.redirectURI?.attributes},n?.redirectURI?.attributes?.strategy??`secure`,r)},codeVerifier:{name:`${i}${t}.${n?.codeVerifier?.name??`code_verifier`}`,attributes:Z(e,{...J,...n?.codeVerifier?.attributes},n?.codeVerifier?.attributes?.strategy??`secure`,r)}}},Le=async({ctx:e,headers:t})=>{let n=new M(V).setCookie(e.cookies.sessionToken.name,``,Y(e.cookies.sessionToken.attributes)).setCookie(e.cookies.csrfToken.name,``,Y(e.cookies.csrfToken.attributes)).toHeaders(),r={session:null,headers:n,success:!1,error:{code:`GET_SESSION_FAILED`,message:`Failed to retrieve session. The session token may be missing, expired, or invalid.`},toResponse:()=>Response.json({success:!1,session:null},{status:401,headers:n})};try{let{session:n,headers:i}=await e.sessionStrategy.getSession(new Headers(t));if(!n)return r;let a=h(i,V);return{session:n,headers:a,success:!0,toResponse:()=>Response.json({success:!0,session:n},{headers:a})}}catch(t){return e?.logger?.log(`AUTH_SESSION_INVALID`,{structuredData:{error_type:v(t)}}),r}},Re=async({ctx:e,request:n,redirect:r=!0,headers:i,session:o,redirectTo:s,skipCSRFCheck:c=!1})=>{try{let{session:t,headers:l}=await e.sessionStrategy.refreshSession(new Headers(i),o,c);if(!t)throw new a(`UPDATE_SESSION_INVALID`,`Failed to update session.`);let u=h(l,V),d=n;if(!d){let t=`${await U({ctx:e,headers:l})}${e.basePath}/session`;d=new Request(t,{headers:u})}await W(d,e);let f=await G(d,s,e);f=s?f:f===`/`?null:f,r&&f&&u.set(`Location`,f);let p=r&&!!f;return{headers:u,session:t,success:!0,redirect:p,redirectURL:p?null:f,toResponse:()=>Response.json({success:!0,session:t,redirect:p,redirectURL:p?null:f},{headers:u,status:p?302:200})}}catch(e){let n=`UPDATE_SESSION_INVALID`,r=`Failed to update session.`;t(e)&&(n=e.code,r=e.message);let i=new Headers(V);return{headers:i,session:null,success:!1,redirect:!1,redirectURL:null,error:{code:n,message:r},toResponse:()=>Response.json({success:!1,session:null,redirect:!1,redirectURL:null},{status:400,headers:i})}}},ze=e=>({getSession:async t=>await Le({ctx:e,headers:t.headers}),signIn:async(t,n)=>K(t,{ctx:e,...n}),signInCredentials:async t=>Ae({ctx:e,...t}),updateSession:async t=>Re({ctx:e,...t,skipCSRFCheck:!0}),signOut:async t=>je({ctx:e,...t,skipCSRFCheck:!0})}),Be=(e,t)=>{let n=e?.mode??`sealed`;if(![`sealed`,`signed`,`encrypted`].includes(n))throw new c(`[auth] invalid JWT mode "${n}". Valid options are: "sealed", "signed", "encrypted".`);return{createToken:n===`sealed`?t.encodeJWT:n===`signed`?t.signJWS:t.encryptJWE,verifyToken:n===`sealed`?t.decodeJWT:n===`signed`?t.verifyJWS:t.decryptJWE}},Ve=e=>({getCookie:t=>({sessionToken:X(t,e().sessionToken.name)}),setCookie:({sessionToken:t})=>new M(V).setCookie(e().sessionToken.name,t,e().sessionToken.attributes).toHeaders(),clear:()=>new M(V).setCookie(e().csrfToken.name,``,Y(e().csrfToken.attributes)).setCookie(e().sessionToken.name,``,Y(e().sessionToken.attributes)).toHeaders()}),He=({config:t,jose:n,logger:r,cookies:i,identity:a})=>{let o=Be(t?.jwt,n),s=Ve(i),c=t?.jwt?.maxAge??3600*24*15,l=t?.jwt?.expirationStrategy??`absolute`,u=({exp:e})=>{if(!e)return null;let t=Math.floor(Date.now()/1e3);switch(l){case`fixed`:case`absolute`:return null;case`rolling`:return new Date((t+c)*1e3);case`sliding`:{let n=c*.25;return e-t<n?new Date((t+c)*1e3):null}default:return null}},d=async(t,a=!1)=>{let o=null,s=null,c=t.get(`X-CSRF-Token`);try{o=X(t,i().sessionToken.name)}catch{throw new e(`SESSION_TOKEN_MISSING`,`The sessionToken is missing.`)}try{s=X(t,i().csrfToken.name)}catch{throw new e(`CSRF_TOKEN_MISSING`,`The CSRF token is missing.`)}if(r?.log(`CSRF_TOKEN_REQUESTED`,{structuredData:{has_session:!!o,has_csrf_token:!!s,has_csrf_header:!!c,skip_csrf_check:a}}),!o)throw r?.log(`SESSION_TOKEN_MISSING`),new e(`SESSION_TOKEN_MISSING`,`The sessionToken is missing.`);if(!a){if(!s)throw r?.log(`CSRF_TOKEN_MISSING`),new e(`CSRF_TOKEN_MISSING`,`The CSRF token is missing.`);if(!c)throw r?.log(`CSRF_HEADER_MISSING`),new e(`CSRF_HEADER_MISSING`,`The CSRF header is missing.`);try{await ae(n,s,c)}catch(t){throw r?.log(`CSRF_TOKEN_INVALID`,{structuredData:{error_type:v(t)}}),new e(`CSRF_TOKEN_INVALID`,`CSRF token verification failed`)}r?.log(`CSRF_TOKEN_VERIFIED`)}try{return await n.decodeJWT(o),!0}catch(e){return r?.log(`INVALID_JWT_TOKEN`,{structuredData:{error_type:v(e)}}),!1}};return{getSession:async e=>{let t=new Headers;try{let{sessionToken:n}=s.getCookie(e);if(!n)return{session:null,headers:t};let i=await o.verifyToken(n),c=a.skipValidation?i:await a.schemaRegistry.parseWithJWT(i),{exp:d,iat:f,mexp:p,...m}=c,h=await a.schemaRegistry.parse(m);if(!h.sub)return{session:null,headers:t};let g={user:h,expires:c.exp?new Date(d*1e3).toISOString():``},_=u({exp:d});if(!_)return{session:{expires:g.expires,user:h},headers:e};let v=l===`absolute`?c.iat:Math.floor(Date.now()/1e3),y=await o.createToken({...h,exp:Math.floor(_.getTime()/1e3),iat:v,mexp:c.mexp});return r?.log(`SESSION_REFRESHED`,{structuredData:{strategy:`stateless`,expiresAt:_.toISOString()}}),{session:{user:h,expires:_.toISOString()},headers:s.setCookie({sessionToken:y})}}catch(e){return r?.log(`AUTH_SESSION_INVALID`,{structuredData:{error_type:v(e)}}),{session:null,headers:t}}},createSession:async e=>{a.skipValidation&&r?.log(`IDENTITY_VALIDATION_DISABLED`,{structuredData:{identity_validation_disabled:!0}});let t=a.skipValidation?e:await a.schemaRegistry.parse(e);return o.createToken(t)},refreshSession:async(e,t,n=!1)=>{try{let{sessionToken:r}=s.getCookie(e);if(!r||!await d(e,n))return{session:null,headers:s.clear()};let i=await o.verifyToken(r),f=a.skipValidation?i:await a.schemaRegistry.parse(i),{exp:p,mexp:m,sub:h,iat:g}=f,_=a.skipValidation?t.user:await a.schemaRegistry.parseAsPartial(t.user),v=t.expires?new Date(t.expires):u({exp:p})??new Date(Date.now()+c*1e3),y={user:{...f,..._,sub:h},expires:v.toISOString()},b=l===`absolute`?g:Math.floor(Date.now()/1e3),x=await o.createToken({...y.user,exp:Math.floor(v.getTime()/1e3),iat:b,mexp:m});return y.expires=new Date(y.expires).toISOString(),{session:y,headers:s.setCookie({sessionToken:x})}}catch(e){return r?.log(`AUTH_SESSION_INVALID`,{structuredData:{error_type:v(e)}}),{session:null,headers:s.clear()}}},revokeSession:async e=>{},destroySession:async(e,t=!1)=>(await d(e,t),s.clear())}},Ue=({config:e,jose:t,cookies:n,logger:r,identity:i})=>{let a=e?.strategy??`jwt`;switch(a){case`jwt`:return He({jose:t,config:e,cookies:n,logger:r,identity:i});default:throw new c(`[auth] unknown session strategy "${a}". Valid options are: "jwt".`)}},Q=e=>{if(!S(e)&&!x(e)&&!T(e)&&!I(e))throw Error(`Unsupported schema type`);return{validate:t=>{try{if(S(e)){let n=e.safeParse(t);return n.success?{success:!0,data:n.data,error:null}:{success:!1,data:null,error:n.error}}if(x(e)){let n=Se(e,t);return n.success?{success:!0,data:n.output,error:null}:{success:!1,data:null,error:n.issues}}if(T(e)){let n=e(t);return e.allows(t)?{success:!0,data:n,error:null}:{success:!1,data:null,error:n}}if(I(e)){let n=t;return e.strip&&(n=z.Clean(e,z.Clone(t))),z.Check(e,n)?{success:!0,data:n,error:null}:{success:!1,data:null,error:[...z.Errors(e,n)]}}return{success:!1,data:null,error:Error(`Unsupported schema type`)}}catch(e){return{success:!1,data:null,error:e}}}}},We=(e,t=`strip`)=>{if(S(e))return t===`strip`?e.strip():t===`passthrough`?F.looseObject(e.shape):t===`strict`?e.strict():e.partial().optional();if(x(e))return t===`strip`?R.object(e.entries):t===`passthrough`?R.looseObject(e.entries):t===`strict`?R.strictObject(e.entries):R.partial(e);if(T(e))return t===`strip`?e.onUndeclaredKey(`delete`):t===`passthrough`?e.onUndeclaredKey(`ignore`):t===`strict`?e.onUndeclaredKey(`reject`):e.partial();if(I(e))return t===`strip`?L.Object(e.properties,{...e,additionalProperties:!1,strip:!0}):t===`passthrough`?L.Object(e.properties,{...e,additionalProperties:!0}):t===`strict`?L.Object(e.properties,{...e,additionalProperties:!1}):L.Partial(e);throw new o(`INVALID_IDENTITY_VALIDATION_FAILED`,`Unsupported schema mode configuration. Valid options are: "strip", "passthrough", "strict" and "partial".`)},Ge=e=>{if(x(e))return R.object({...e.entries,exp:R.number(),iat:R.number(),jti:R.string(),nbf:R.number(),aud:R.optional(R.string()),iss:R.optional(R.string()),mexp:R.optional(R.number())});if(T(e))return e.and({exp:`number`,iat:`number`,jti:`string`,nbf:`number`,aud:`string?`,iss:`string?`,mexp:`number?`});if(I(e))return L.Object({...e.properties,exp:L.Number(),iat:L.Number(),jti:L.String(),nbf:L.Number(),aud:L.Optional(L.String()),iss:L.Optional(L.String()),mexp:L.Optional(L.Number())},{...e});if(S(e))return e.extend({exp:F.number(),iat:F.number(),jti:F.string(),nbf:F.number(),aud:F.string().optional(),iss:F.string().optional(),mexp:F.number().optional()});throw new o(`INVALID_IDENTITY_VALIDATION_FAILED`,`Unsupported schema type for JWT extension.`)},Ke=e=>{if(x(e))return R.object({user:e,expires:R.optional(R.pipe(R.string(),R.transform(e=>new Date(e)),R.date()))});if(T(e))return ye({user:e,expires:ye(`string`).pipe(e=>new Date(e)).optional()});if(I(e))return L.Object({user:e,expires:L.Optional(L.String())});if(S(e))return F.object({user:e,expires:F.coerce.date().optional()});throw new o(`INVALID_IDENTITY_VALIDATION_FAILED`,`Unsupported schema type for schema  extension.`)},$=(e,t)=>{let n={};throw S(e)?n=b(t):x(e)?n={issues:t}:T(e)?n={error:t}:I(e)&&(n={errors:t}),new o(`INVALID_IDENTITY_VALIDATION_FAILED`,JSON.stringify(n,null,2),{cause:S(e)?t:void 0})},qe=e=>{let t=We(e.schema??A,e.unknownKeys),n=We(e.schema??A,`partial`),r=Ge(e.schema??A),i=Q(t),a=Q(n),o=Q(r);return{parse:async(e={})=>{let{data:n,success:r,error:a}=i.validate(e);return r||$(t,a),n},parseAsPartial:async(e={})=>{let{data:t,success:r,error:i}=a.validate(e);return r||$(n,i),t},parseWithJWT:async(e={})=>{let{data:t,success:n,error:i}=o.validate(e);return n||$(r,i),t},schema:t,schemaAsPartial:n,schemaWithJWT:r}},Je=e=>{let t=f(`TRUSTED_PROXY_HEADERS`)===void 0?e?.trustedProxyHeaders??!1:d(`TRUSTED_PROXY_HEADERS`),n=ce(e),r=e?.cookies?.prefix,i=e?.cookies?.overrides??{},a=Ie(!0,r,i,n),o=Ie(!1,r,i,n),s=re(e?.secret,e?.session),c=e?.identity?.unknownKeys??`strip`,l=e?.identity?.skipValidation??!1,u=qe({schema:e?.identity?.schema,unknownKeys:c,skipValidation:l}),m={oauth:he(e?.oauth),credentials:e?.credentials,cookies:o,jose:s,secret:e?.secret,basePath:e?.basePath??`/auth`,trustedProxyHeaders:t,trustedOrigins:p(`TRUSTED_ORIGINS`).length>0?p(`TRUSTED_ORIGINS`):e?.trustedOrigins,logger:n,cookieConfig:{secure:a,standard:o},baseURL:e?.baseURL,identity:{schemaRegistry:u,unknownKeys:c,skipValidation:l}};return m.sessionStrategy=Ue({cookies:()=>m.cookies,jose:m.jose,config:e?.session,logger:m.logger,identity:m.identity}),m},Ye=e=>t=>{if(ve(t)){let{message:n,status:r,statusText:i}=t;return e?.log(`ROUTER_INTERNAL_ERROR`),Response.json({type:`ROUTER_ERROR`,code:`ROUTER_INTERNAL_ERROR`,message:n},{status:r,statusText:i})}if(_e(t))return e?.log(`INVALID_REQUEST`),Response.json({type:`ROUTER_ERROR`,code:`INVALID_REQUEST`,message:t.errors},{status:422});if(s(t)){let{error:n,message:r,type:i,errorURI:a}=t;return e?.log(`OAUTH_PROTOCOL_ERROR`,{structuredData:{error:n,error_description:r,error_uri:a??``}}),Response.json({type:i,message:r},{status:400})}if(i(t)){let{type:n,code:r,message:i}=t;return e?.log(`INVALID_OAUTH_CONFIGURATION`,{structuredData:{error:r,error_description:i}}),Response.json({type:n,message:i},{status:400})}if(u(t)){let{type:n,code:r,message:i}=t;return e?.log(`AUTH_SECURITY_ERROR`,{structuredData:{error:r,error_description:i}}),Response.json({type:n,code:r,message:i},{status:400})}if(n(t)){let{type:n,code:r,message:i}=t;return e?.log(`IDENTITY_VALIDATION_FAILED`,{structuredData:{error:r,error_description:i}}),Response.json({type:n,code:r,message:i},{status:422})}return e?.log(`SERVER_ERROR`,{structuredData:{error_type:t.name,error_message:t.message}}),Response.json({type:`SERVER_ERROR`,code:`SERVER_ERROR`,message:`An unexpected error occurred`},{status:500})},Xe=e=>P(`/signIn/:oauth`,{schemas:{params:F.object({oauth:F.enum(Object.keys(e),`The OAuth provider is not supported or invalid.`)}),searchParams:j}}),Ze=e=>N(`GET`,`/signIn/:oauth`,async e=>{let{toResponse:t}=await K(e.params.oauth,{ctx:e.context,request:e.request,headers:e.request.headers,redirect:e.searchParams.redirect,redirectTo:e.searchParams.redirectTo});return t()},Xe(e)),Qe=N(`POST`,`/signIn/credentials`,async e=>{let t=e.body,{toResponse:n}=await Ae({ctx:e.context,payload:t,request:e.request,headers:e.request.headers,redirect:e.searchParams.redirect,redirectTo:e.searchParams.redirectTo});return n()},P({schemas:{body:me,searchParams:j}})),$e=async(e,t={},n=5e3)=>{let r=new AbortController,i=setTimeout(()=>r.abort(),n);return await fetch(e,{...t,signal:r.signal}).finally(()=>clearTimeout(i))},et=e=>{let t=e?.id??e?.sub??e?.uid??e?.user_id??e?.account_id;if(!t)throw new l(`invalid_userinfo`,`OAuth provider did not return a stable user identifier (id/sub/uid).`);return{sub:t,email:e?.email,name:e?.name??e?.username??e?.nickname,image:e?.image??e?.picture}},tt=async(e,t,n)=>{let i=e.userInfo,a=typeof i==`string`?i:i.url,o=typeof i==`string`?void 0:i.headers,c=typeof i==`string`?`GET`:(i.method??`GET`).toUpperCase();try{n?.log(`OAUTH_USERINFO_REQUEST_INITIATED`,{structuredData:{endpoint:a}});let r=await $e(a,{method:c,headers:{"User-Agent":`Aura Auth/${te}`,Accept:`application/json`,Authorization:`Bearer ${t}`,...o}});if(!r.ok)throw n?.log(`OAUTH_USERINFO_INVALID_RESPONSE`),new l(`INVALID_REQUEST`,`Invalid userinfo response format`);let i=await r.json(),{success:s,data:u}=pe.safeParse(i);if(s)throw n?.log(`OAUTH_USERINFO_ERROR`,{message:`Error response received from OAuth userinfo endpoint`,structuredData:{error:u.error,error_description:u.error_description??``}}),new l(`INVALID_REQUEST`,`An error was received from the OAuth userinfo endpoint.`);return n?.log(`OAUTH_USERINFO_SUCCESS`),e?.profile?e.profile(i):et(i)}catch(e){throw s(e)?e:(n?.log(`OAUTH_USERINFO_REQUEST_FAILED`),r(e)?new l(`SERVER_ERROR`,`Failed to fetch user information from OAuth provider`,``,{cause:e}):new l(`SERVER_ERROR`,`Failed to fetch user information`,``,{cause:e}))}},nt=async(e,t,n,r,i)=>{let{accessToken:o,clientId:s,clientSecret:c}=e;if(!s||!c||!t||!n||!r||!o)throw i?.log(`INVALID_OAUTH_CONFIGURATION`,{structuredData:{has_client_id:!!s,has_client_secret:!!c,has_access_token:!!o,has_redirect_uri:!!t,has_code:!!n,has_code_verifier:!!r}}),new a(`INVALID_OAUTH_CONFIGURATION`,`The OAuth provider configuration is invalid.`);let u=typeof o==`string`?o:o.url,d=typeof o==`string`?void 0:o.headers;try{i?.log(`OAUTH_ACCESS_TOKEN_REQUEST_INITIATED`,{structuredData:{has_client_id:!!s,redirect_uri:t,grant_type:`authorization_code`}});let e=await $e(u,{method:`POST`,headers:{...d,Accept:`application/json`,"Content-Type":`application/x-www-form-urlencoded`},body:new URLSearchParams({client_id:s,client_secret:c,code:n,redirect_uri:t,grant_type:`authorization_code`,code_verifier:r}).toString()});if(!e.ok)throw i?.log(`INVALID_OAUTH_ACCESS_TOKEN_RESPONSE`),new l(`invalid_request`,`Invalid access token response`);let a=await e.json(),o=fe.safeParse(a);if(!o.success){let{success:e,data:t}=de.safeParse(a);throw e?(i?.log(`OAUTH_ACCESS_TOKEN_ERROR`,{structuredData:{error:t.error,error_description:t.error_description??``}}),new l(`INVALID_ACCESS_TOKEN`,`Failed to retrieve access token`)):(i?.log(`INVALID_OAUTH_ACCESS_TOKEN_RESPONSE`),new l(`invalid_request`,`Invalid access token response format`))}return i?.log(`OAUTH_ACCESS_TOKEN_SUCCESS`),o.data}catch(e){throw e instanceof l?e:(i?.log(`OAUTH_ACCESS_TOKEN_REQUEST_FAILED`),new l(`server_error`,`Failed to communicate with OAuth provider`,``,{cause:e}))}},rt=e=>P(`/callback/:oauth`,{schemas:{params:F.object({oauth:F.enum(Object.keys(e),`The OAuth provider is not supported or invalid.`)}),searchParams:F.object({code:F.string(`Missing code parameter in the OAuth authorization response.`),state:F.string(`Missing state parameter in the OAuth authorization response.`)})},use:[e=>{let{searchParams:t,context:{logger:n}}=e,r=le.safeParse(t);if(r.success){let{error:e,error_description:t}=r.data,i=[`access_denied`,`server_error`].includes(e.toLowerCase())?`critical`:`warning`;throw n?.log(`OAUTH_AUTHORIZATION_ERROR`,{severity:i,structuredData:{error:e,error_description:t??``}}),new l(e,t||`OAuth Authorization Error`)}return e}]}),it=t=>N(`GET`,`/callback/:oauth`,async t=>{let{request:n,params:{oauth:r},searchParams:{code:i,state:a},context:o}=t,{oauth:s,cookies:c,jose:l,logger:u,trustedOrigins:d}=o,f=s[r],p=X(n,c.state.name),m=X(n,c.codeVerifier.name),h=X(n,c.redirectTo.name),g=X(n,c.redirectURI.name),_=new M(B).setCookie(c.state.name,``,Y(c.state.attributes)).setCookie(c.redirectURI.name,``,Y(c.redirectURI.attributes)).setCookie(c.redirectTo.name,``,Y(c.redirectTo.attributes)).setCookie(c.codeVerifier.name,``,Y(c.codeVerifier.attributes));if(!ee(p,a))return u?.log(`MISMATCHING_STATE`,{structuredData:{oauth_provider:r}}),Response.json({type:`AUTH_SECURITY_ERROR`,code:`MISMATCHING_STATE`,message:`The provided state passed in the OAuth response does not match the stored state.`},{headers:_.toHeaders(),status:400});let v=await nt(f,g,i,m,u),y=await H(n,d),b=await W(n,o);if(!E(h)&&!(y.length>0?w(h,y):C(h,b)))throw u?.log(`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`,{structuredData:{redirect_path:h,provider:r,has_trusted_origins:y.length>0,request_origin:b}}),new e(`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`,`Invalid redirect path. Potential open redirect attack detected.`);let x=await tt(f,v.access_token,u),S=await o.sessionStrategy.createSession(x),T=await k(l);u?.log(`OAUTH_CALLBACK_SUCCESS`,{structuredData:{provider:r}});let D=_.setHeader(`Location`,h).setCookie(c.sessionToken.name,S,c.sessionToken.attributes).setCookie(c.csrfToken.name,T,c.csrfToken.attributes).toHeaders();return Response.json({oauth:r},{status:302,headers:D})},rt(t)),at=N(`GET`,`/session`,async e=>{let{toResponse:t}=await Le({ctx:e.context,headers:e.request.headers});return t()}),ot=N(`POST`,`/signOut`,async e=>{let{toResponse:t}=await je({ctx:e.context,request:e.request,headers:e.request.headers,redirect:e.searchParams.redirect,redirectTo:e.searchParams.redirectTo});return t()},P({schemas:{searchParams:j.extend({token_type_hint:F.literal(`session_token`)})}})),st=(e,t)=>{try{return X(e,t)}catch{return}},ct=N(`GET`,`/csrfToken`,async e=>{let{request:t,context:{jose:n,cookies:r,logger:i}}=e,a=st(t,r.csrfToken.name);i?.log(`CSRF_TOKEN_REQUESTED`,{structuredData:{has_token:!!a}});let o=await k(n,a);i?.log(`CSRF_TOKEN_ISSUED`,{structuredData:{issued:!!o}});let s=new Headers(V);return s.append(`Set-Cookie`,Fe(r.csrfToken.name,o,r.csrfToken.attributes)),Response.json({csrfToken:o},{headers:s})}),lt=e=>P({schemas:{body:Ke(e.schemaRegistry.schemaAsPartial),searchParams:j}}),ut=e=>N(`PATCH`,`/session`,async e=>{let{toResponse:t}=await Re({ctx:e.context,request:e.request,headers:e.request.headers,redirect:e.searchParams.redirect,redirectTo:e.searchParams.redirectTo,session:{user:e.body?.user,expires:e.body?.expires?.toISOString()}});return t()},lt(e)),dt=e=>{let t=Je(e);return{basePath:e?.basePath??`/auth`,onError:Ye(t.logger),context:t,use:[e=>{let n=_(e.request,e.context.trustedProxyHeaders);return e.context.cookies=n?t.cookieConfig.secure:t.cookieConfig.standard,e}]}},ft=e=>{let t=dt(e);return{handlers:ge([Ze(t.context.oauth),Qe,it(t.context.oauth),at,ot,ct,ut(t.context.identity)],t),jose:t.context.jose,api:ze(t.context)}},pt=e=>{let t=ft(e);return t.handlers.ALL=async e=>{let n=e.method.toUpperCase(),r={GET:t.handlers.GET,POST:t.handlers.POST,PATCH:t.handlers.PATCH};return n in r?await r[n](e):new Response(`Method Not Allowed`,{status:405,headers:{Allow:Object.keys(r).join(`, `)}})},t};export{pt as createAuth};
+import{n as e,t}from"./errors-BWpHquVG.js";import{i as n,n as r,r as i}from"./env-BG1x-kSX.js";import{A as a,C as o,D as s,E as c,F as l,I as u,L as d,M as f,N as p,O as m,P as h,R as g,_,a as v,b as y,d as b,f as x,g as S,h as C,i as w,j as T,k as E,m as D,p as O,s as k,t as A,u as ee,w as j,x as M}from"./crypto-BRrGB5wn.js";import{t as N}from"./fetch-async-DL6uySSm.js";import{i as te,n as ne,s as re,t as P}from"./resolve-provider-CaDu98x6.js";import{a as ie,c as ae,d as oe,i as se,m as F,n as ce,o as le,r as ue,t as de,u as fe}from"./@types/index.js";import{t as pe}from"./logger-BleaYLUV.js";import{UserIdentity as I}from"./shared/identity.js";import{HeadersBuilder as L,createEndpoint as R,createEndpointConfig as z,createRouter as me,isAuraRouterError as he,isAuraRouterValidationError as ge}from"@aura-stack/router";import{createRateLimiter as _e}from"@aura-stack/rate-limiter";import{z as B}from"zod/v4";import{type as ve}from"arktype";import{IsObject as V,Type as H}from"typebox";import{parse as ye}from"@aura-stack/router/cookie";import{createLocalJWKSet as be,errors as U,jwtVerify as xe}from"@aura-stack/jose/jose";import*as W from"valibot";import{createValidator as G}from"@aura-stack/router/validator";const K={"Cache-Control":`no-store`,Pragma:`no-cache`,Expires:`0`,Vary:`Cookie`},Se={"Content-Security-Policy":[`default-src 'none'`,`script-src 'self'`,`frame-src 'none'`,`object-src 'none'`,`frame-ancestors 'none'`,`base-uri 'none'`].join(`; `)},Ce={"X-Content-Type-Options":`nosniff`,"X-Frame-Options":`DENY`,"Referrer-Policy":`strict-origin-when-cross-origin`},q={...K,...Se,...Ce},we=e=>{let t=(e,t)=>`rl:${t}:${e.headers.get(`cf-connecting-ip`)??e.headers.get(`x-forwarded-for`)?.split(`,`)[0]?.trim()??e.headers.get(`x-real-ip`)??`anon`}`;return _e({rules:{signIn:{algorithm:`sliding-window`,limit:10,windowMs:900*1e3,keyGenerator:e=>t(e,`signIn`),...e?.signIn},signInCredentials:{algorithm:`sliding-window`,limit:8,windowMs:900*1e3,keyGenerator:e=>t(e,`signInCredentials`),...e?.signInCredentials},signUp:{algorithm:`fixed-window`,limit:5,windowMs:3600*1e3,keyGenerator:e=>t(e,`signUp`),...e?.signUp},updateSession:{algorithm:`token-bucket`,capacity:10,refillRate:1/6e4,keyGenerator:e=>t(e,`updateSession`),...e?.updateSession}}})},J=async(e,t,n)=>{let r=await e.rateLimiters[n].check(t);if(!r.ok){let e=r.toResponse();return{success:!1,redirect:!1,[n===`signIn`?`signInURL`:`redirectURL`]:null,error:{code:`RATE_LIMIT_EXCEEDED`,message:`Too many requests.`},headers:e.headers,toResponse:()=>e}}},Te=(e,t)=>{for(let[n,r]of Object.entries(t))r!==void 0&&r!==``&&e.searchParams.set(n,r)},Ee=(e,n,r,i,a)=>{let o=e.authorize,s=typeof o==`string`?o:o?.url??e.authorizeURL;if(!s)throw new t({code:`INVALID_OAUTH_PROVIDER_URL_CONFIG`});let c;try{c=new URL(s)}catch(e){throw new t({code:`INVALID_OAUTH_PROVIDER_URL_CONFIG`,cause:e})}let l=typeof o==`string`?void 0:o?.params;return Te(c,{response_type:l?.responseType??e.responseType??`code`,client_id:e.clientId,redirect_uri:n,state:r,code_challenge:i,code_challenge_method:a,scope:l?.scope??e.scope,prompt:l?.prompt,response_mode:l?.responseMode,login_hint:l?.loginHint,nonce:l?.nonce,display:l?.display,audience:l?.audience}),c.toString()},De=async(e,n,r)=>{let i=v(),{codeVerifier:a,codeChallenge:o,method:s}=await w(),c=Ee(e,n,i,o,s);if(!le.safeParse({...e,redirectURI:n,state:i,codeChallenge:o,codeChallengeMethod:s}).success)throw r?.logger?.log(`INVALID_OAUTH_CONFIGURATION`,{structuredData:{scope:e?.scope??``,redirect_uri:n,has_state:!!i,has_code_challenge:!!o,code_challenge_method:s}}),new t({code:`INVALID_OAUTH_PROVIDER_SCHEMA_CONFIG`});return{authorization:c,state:i,codeVerifier:a,method:s}},Oe=async(e,t,n)=>{let r=v(),i=e.authorize;return{...await De({...e,authorize:typeof i==`string`?{url:i,params:{nonce:r}}:{url:i.url,params:{...i.params,nonce:r}}},t,n),nonce:r}},Y=async(e,t)=>{if(!t)return[];let n=typeof t==`function`?await t(e):t;return Array.isArray(n)?n:typeof n==`string`?[n]:[]},X=async({ctx:e,request:n,headers:i})=>{let a=r(`BASE_URL`)||e?.baseURL;if(a&&a!==`/`)return a;if(e?.trustedProxyHeaders){let e=i&&new Headers(i)||n?.headers,r=e?.get(`Forwarded`)?.match(/proto=([^;]+)/i)?.[1]??e?.get(`X-Forwarded-Proto`)??`http`,a=e?.get(`Host`)??e?.get(`Forwarded`)?.match(/host=([^;]+)/i)?.[1]??e?.get(`X-Forwarded-Host`)??null;if(a)return`${r}://${a}`;throw new t({code:`INVALID_AUTH_CONFIGURATION`})}try{return new URL(n?.url??`not-found`).origin}catch(e){throw new t({code:`INVALID_AUTH_CONFIGURATION`,cause:e})}},Z=async(e,n)=>{let r=[...await Y(e,n?.trustedOrigins)];if(!n?.trustedProxyHeaders){let t=new URL(e.url).origin;r.includes(t)||r.push(t)}let i=await X({request:e,ctx:n});if(!_(i,r))throw n?.logger?.log(`UNTRUSTED_ORIGIN`,{structuredData:{origin:i}}),new t({code:`INVALID_TRUSTED_ORIGIN`});return i},ke=async(e,t,n)=>`${await Z(e,n)}${n.basePath}/callback/${t}`,Ae=async({request:e,oauth:t,ctx:n,redirectTo:r})=>{let i=await Z(e,n),a=new URLSearchParams;return r!==void 0&&a.set(`redirectTo`,String(r)),`${i}${n.basePath}/signIn/${t}?${a.toString()}`},Q=async(e,t,n)=>{try{let r=e.headers,i=await Z(e,n),o=await Y(e,n?.trustedOrigins);return(t=>{if(!C(t)&&!M(t))return`/`;if(C(t))return t;if(o.length>0){if(_(t,o)){let n=new URL(t).origin;for(let r of o){if(a(r)?.test(n))return S(t,e.url)?s(t):t;if(M(r)&&c(new URL(r).origin,n))return t}}return n?.logger?.log(`OPEN_REDIRECT_ATTACK`),`/`}return S(t,i)?s(t):(n?.logger?.log(`OPEN_REDIRECT_ATTACK`),`/`)})(t??r.get(`Referer`)??r.get(`Origin`)??`/`)}catch{return n?.logger?.log(`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`),`/`}},je=async(n,{ctx:r,request:i,headers:a,redirect:o,redirectTo:s})=>{try{let e=new Headers(a),c=r.oauth[n];if(!c)throw new t({code:`UNSUPPORTED_OAUTH_CONFIGURATION`});let l=i;if(!l){let t=`${await X({ctx:r,headers:e})}${r.basePath}/signIn/${n}`;l=new Request(t,{headers:e})}let u=await J(r,l,`signIn`);if(u)return u;if(o===!1){r?.logger?.log(`SIGN_IN_INITIATED`,{structuredData:{oauth_provider:n}});let e=await Ae({request:l,oauth:n,ctx:r,redirectTo:s}),t=new Headers(q);return{success:!0,redirect:!1,signInURL:e,headers:t,toResponse:()=>Response.json({success:!0,redirect:!1,signInURL:e},{status:200,headers:t})}}let d=await ke(l,n,r),f=await Q(l,s,r),p=P(c);r.logger?.log(`SIGN_IN_PROVIDER_TYPE_DETECTED`,{structuredData:{oauth_provider:n,oidc:p}});let m=p?await ne(c):c;p&&r.logger?.log(`OIDC_PROVIDER_RESOLVED`,{structuredData:{oauth_provider:n,oidc:p}});let h,g,_,v;if(p){let e=await Oe(m,d,r);h=e.authorization,g=e.state,_=e.codeVerifier,v=e.nonce}else{let e=await De(m,d,r);h=e.authorization,g=e.state,_=e.codeVerifier}r?.logger?.log(`SIGN_IN_INITIATED`,{structuredData:{oauth_provider:n,oidc:p}});let y=new L(K).setHeader(`Location`,h).setCookie(r.cookies.state.name,g,r.cookies.state.attributes).setCookie(r.cookies.redirectURI.name,d,r.cookies.redirectURI.attributes).setCookie(r.cookies.redirectTo.name,f,r.cookies.redirectTo.attributes).setCookie(r.cookies.codeVerifier.name,_,r.cookies.codeVerifier.attributes);v&&y.setCookie(r.cookies.nonce.name,v,r.cookies.nonce.attributes);let b=y.toHeaders();return{success:!0,redirect:!0,signInURL:h,headers:b,toResponse:()=>Response.json({success:!0,redirect:!0,signInURL:h},{status:302,headers:b})}}catch(t){let n=`AUTH_SIGN_IN_FAILED`,r=`An error occurred during the sign-in process.`;return e(t)&&(n=t.code,r=t.userMessage),{success:!1,redirect:!1,signInURL:null,error:{code:n,message:r},headers:new Headers(q),toResponse:()=>Response.json({success:!1,redirect:!1,signInURL:null,error:{code:n,message:r}},{status:500,headers:q})}}},Me=async({ctx:n,payload:r,request:i,headers:a,redirect:o=!0,redirectTo:s,skipCSRFCheck:c=!1})=>{let{cookies:l,credentials:u,sessionStrategy:d,logger:f}=n;try{await p({headers:new Headers(a),cookies:l,jose:n.jose,logger:n.logger,skipCSRFCheck:c});let e=i;if(!e){let t=`${await X({ctx:n,headers:a})}${n.basePath}/signIn/credentials`;e=new Request(t,{headers:a})}let m=await J(n,e,`signInCredentials`);if(m)return m;await Z(e,n);let h=await u?.authorize({credentials:r,deriveSecret:u?.hash??k,verifySecret:u?.verify??ee});if(!h)throw new t({code:`AUTH_CREDENTIALS_INVALID`});let g=await d.createSession(h),_=await A(n.jose);f?.log(`CREDENTIALS_SIGN_IN_SUCCESS`);let v=new L(q).setCookie(l.csrfToken.name,_,l.csrfToken.attributes).setCookie(l.sessionToken.name,g,l.sessionToken.attributes),y=await Q(e,s,n);y=s?y:y===`/`?null:y,o&&y&&v.setHeader(`Location`,y);let b=o&&!!y,x=v.toHeaders();return{success:!0,headers:x,redirect:b,redirectURL:o?null:y,toResponse:()=>Response.json({success:!0,redirect:b,redirectURL:b?null:y},{headers:x,status:b?302:200})}}catch(t){let n=`CREDENTIALS_SIGN_IN_ERROR`,r=`An error occurred during credentials sign-in.`,i=401;e(t)&&(n=t.code,r=t.userMessage,i=t.statusCode);let a=new Headers(q),o={success:!1,headers:a,redirect:!1,redirectURL:null,error:{code:n,message:r},toResponse:()=>Response.json({success:!1,redirect:!1,redirectURL:null},{headers:a,status:i})};return e(t)&&t.code===`AUTH_CREDENTIALS_INVALID`?(f?.log(`INVALID_CREDENTIALS`,{severity:`warning`,structuredData:{path:`/signIn/credentials`}}),o):(f?.log(`CREDENTIALS_SIGN_IN_FAILED`,{severity:`error`,structuredData:{path:`/signIn/credentials`}}),o)}},Ne=async({ctx:t,request:n,headers:r,redirect:i=!0,redirectTo:a,skipCSRFCheck:o=!1})=>{let s=new Headers(r);try{s=await t.sessionStrategy.destroySession(s,o);let e=n;if(!e){let n=`${await X({ctx:t,headers:s})}${t.basePath}/signOut`;e=new Request(n,{headers:s})}await Z(e,t);let r=new L(s),c=await Q(e,a,t);c=a?c:c===`/`?null:c,i&&c&&r.setHeader(`Location`,c);let l=r.toHeaders(),u=i&&!!c;return{success:!0,headers:l,redirect:u,redirectURL:i?null:c,toResponse:()=>Response.json({success:!0,redirect:u,redirectURL:u?null:c},{headers:l,status:u?302:202})}}catch(t){let n=`SIGN_OUT_FAILED`,r=`Failed to sign-out session`,i=400;return e(t)&&(n=t.code,r=t.userMessage,i=t.statusCode),{success:!1,headers:s,redirect:!1,redirectURL:null,error:{code:n,message:r},toResponse:()=>Response.json({success:!1,redirect:!1,redirectURL:null},{headers:s,status:i})}}},Pe=async({ctx:e,headers:t})=>{let n=new L(q).setCookie(e.cookies.sessionToken.name,``,d(e.cookies.sessionToken.attributes)).setCookie(e.cookies.csrfToken.name,``,d(e.cookies.csrfToken.attributes)).toHeaders(),r={session:null,headers:n,success:!1,error:{code:`GET_SESSION_FAILED`,message:`Failed to retrieve session. The session token may be missing, expired, or invalid.`},toResponse:()=>Response.json({success:!1,session:null},{status:401,headers:n})};try{let{session:n,headers:i}=await e.sessionStrategy.getSession(new Headers(t));if(!n)return r;let a=f(i,q);return{session:n,headers:a,success:!0,toResponse:()=>Response.json({success:!0,session:n},{headers:a})}}catch(t){return e?.logger?.log(`AUTH_SESSION_INVALID`,{structuredData:{error_type:m(t)}}),r}},Fe=async({ctx:n,request:r,redirect:i=!0,headers:a,session:o,redirectTo:s,skipCSRFCheck:c=!1})=>{try{let{session:e,headers:l}=await n.sessionStrategy.refreshSession(new Headers(a),o,c);if(!e)throw new t({code:`UPDATE_SESSION_INVALID`});let u=f(l,q),d=r;if(!d){let e=`${await X({ctx:n,headers:l})}${n.basePath}/session`;d=new Request(e,{headers:u})}await Z(d,n);let p=await J(n,d,`updateSession`);if(p)return p;let m=await Q(d,s,n);m=s?m:m===`/`?null:m,i&&m&&u.set(`Location`,m);let h=i&&!!m;return{headers:u,session:e,success:!0,redirect:h,redirectURL:h?null:m,toResponse:()=>Response.json({success:!0,session:e,redirect:h,redirectURL:h?null:m},{headers:u,status:h?302:200})}}catch(t){let n=`UPDATE_SESSION_INVALID`,r=`Failed to update session.`;e(t)&&(n=t.code,r=t.userMessage);let i=new Headers(q);return{headers:i,session:null,success:!1,redirect:!1,redirectURL:null,error:{code:n,message:r},toResponse:()=>Response.json({success:!1,session:null,redirect:!1,redirectURL:null},{status:400,headers:i})}}},Ie=async({ctx:n,payload:r,headers:i,request:a,redirect:o=!0,redirectTo:s,skipCSRFCheck:c=!1})=>{let{signUp:l,cookies:u,sessionStrategy:d,logger:f}=n;try{let e=a;if(!e){let t=`${await X({ctx:n,headers:i})}${n.basePath}/signUp`;e=new Request(t,{headers:i})}await Z(e,n);let m=await J(n,e,`signUp`);if(m)return m;await p({headers:new Headers(i),cookies:u,jose:n.jose,logger:f,skipCSRFCheck:c});let h=await l?.onCreateUser({payload:r});if(!h)throw new t({code:`USER_CREATION_FAILED`});let g=await d.createSession(h),_=await A(n.jose);f?.log(`SIGN_UP_SUCCESS`);let v=new L(q).setCookie(u.csrfToken.name,_,u.csrfToken.attributes).setCookie(u.sessionToken.name,g,u.sessionToken.attributes),y=await Q(e,s,n);y=s?y:y===`/`?null:y,o&&y&&v.setHeader(`Location`,y);let b=o&&!!y,x=v.toHeaders();return{success:!0,redirect:b,redirectURL:o?null:y,headers:x,toResponse:()=>Response.json({success:!0,redirect:b,redirectURL:b?null:y},{headers:x,status:b?302:200})}}catch(t){let n=`SIGN_UP_ERROR`,r=`An error occurred during sign-up.`,i=400;return e(t)&&(n=t.code,r=t.userMessage,i=t.statusCode),{success:!1,error:{code:n,message:r},redirect:!1,headers:new Headers(q),redirectURL:null,toResponse:()=>Response.json({success:!1,redirect:!1,redirectURL:null},{headers:q,status:i})}}},Le=e=>({getSession:async t=>await Pe({ctx:e,headers:t.headers}),signIn:async(t,n)=>je(t,{ctx:e,...n}),signInCredentials:async t=>Me({ctx:e,...t,skipCSRFCheck:!0}),signUp:async t=>Ie({ctx:e,...t,skipCSRFCheck:!0}),updateSession:async t=>Fe({ctx:e,...t,skipCSRFCheck:!0}),signOut:async t=>Ne({ctx:e,...t,skipCSRFCheck:!0})}),Re=(e,n)=>{let r=e?.mode??`sealed`;if(![`sealed`,`signed`,`encrypted`].includes(r))throw new t({code:`JWT_INVALID_MODE`});return{createToken:r===`sealed`?n.encodeJWT:r===`signed`?n.signJWS:n.encryptJWE,verifyToken:r===`sealed`?n.decodeJWT:r===`signed`?n.verifyJWS:n.decryptJWE}},ze=e=>({getCookie:t=>({sessionToken:u(t,e().sessionToken.name)}),setCookie:({sessionToken:t})=>new L(q).setCookie(e().sessionToken.name,t,e().sessionToken.attributes).toHeaders(),clear:()=>new L(q).setCookie(e().csrfToken.name,``,d(e().csrfToken.attributes)).setCookie(e().sessionToken.name,``,d(e().sessionToken.attributes)).toHeaders()}),Be=({config:e,jose:t,logger:n,cookies:r,identity:i})=>{let a=Re(e?.jwt,t),o=ze(r),s=e?.jwt?.maxAge??3600*24*15,c=e?.jwt?.expirationStrategy??`absolute`,l=({exp:e})=>{if(!e)return null;let t=Math.floor(Date.now()/1e3);switch(c){case`fixed`:case`absolute`:return null;case`rolling`:return new Date((t+s)*1e3);case`sliding`:{let n=s*.25;return e-t<n?new Date((t+s)*1e3):null}default:return null}};return{getSession:async e=>{let t=new Headers;try{let{sessionToken:r}=o.getCookie(e);if(!r)return{session:null,headers:t};let s=await a.verifyToken(r),u=i.skipValidation?s:await i.schemaRegistry.parseWithJWT(s),{exp:d,iat:f,mexp:p,...m}=u,h=await i.schemaRegistry.parse(m);if(!h.sub)return{session:null,headers:t};let g={user:h,expires:u.exp?new Date(d*1e3).toISOString():``},_=l({exp:d});if(!_)return{session:{expires:g.expires,user:h},headers:e};let v=c===`absolute`?u.iat:Math.floor(Date.now()/1e3),y=await a.createToken({...h,exp:Math.floor(_.getTime()/1e3),iat:v,mexp:u.mexp});return n?.log(`SESSION_REFRESHED`,{structuredData:{strategy:`stateless`,expiresAt:_.toISOString()}}),{session:{user:h,expires:_.toISOString()},headers:o.setCookie({sessionToken:y})}}catch(e){return n?.log(`AUTH_SESSION_INVALID`,{structuredData:{error_type:m(e)}}),{session:null,headers:t}}},createSession:async e=>{i.skipValidation&&n?.log(`IDENTITY_VALIDATION_DISABLED`,{structuredData:{identity_validation_disabled:!0}});let t=i.skipValidation?e:await i.schemaRegistry.parse(e);return a.createToken(t)},refreshSession:async(e,u,d=!1)=>{try{let{sessionToken:f}=o.getCookie(e);if(!f||!await p({headers:e,skipCSRFCheck:d,cookies:r(),logger:n,jose:t}))return{session:null,headers:o.clear()};let m=await a.verifyToken(f),h=i.skipValidation?m:await i.schemaRegistry.parseWithJWT(m),{exp:g,mexp:_,iat:v}=h,y=i.skipValidation?h:await i.schemaRegistry.parse(h),{sub:b}=y,x=i.skipValidation?u.user:await i.schemaRegistry.parseAsPartial(u.user),S=u.expires?new Date(Math.min(Date.now()+s*1e3,new Date(u.expires).getTime())):l({exp:g})??new Date(Date.now()+s*1e3),C={user:{...y,...x,sub:b},expires:S.toISOString()},w=await i.schemaRegistry.parse(C.user),T=c===`absolute`?v:Math.floor(Date.now()/1e3),E=await a.createToken({...w,exp:Math.floor(S.getTime()/1e3),iat:T,mexp:_});return C.expires=new Date(C.expires).toISOString(),{session:C,headers:o.setCookie({sessionToken:E})}}catch(e){return n?.log(`AUTH_SESSION_INVALID`,{structuredData:{error_type:m(e)}}),{session:null,headers:o.clear()}}},revokeSession:async e=>{},destroySession:async(e,i=!1)=>(await p({headers:e,skipCSRFCheck:i,cookies:r(),logger:n,jose:t}),await h({headers:e,cookies:r(),jwt:a,logger:n}),o.clear())}},Ve=({config:e,jose:n,cookies:r,logger:i,identity:a})=>{switch(e?.strategy??`jwt`){case`jwt`:return Be({jose:n,config:e,cookies:r,logger:i,identity:a});default:throw new t({code:`INVALID_SESSION_STRATEGY`})}},He=(e,n=`strip`)=>{if(o(e))return n===`strip`?e.strip():n===`passthrough`?B.looseObject(e.shape):n===`strict`?e.strict():e.partial().optional();if(y(e))return n===`strip`?W.object(e.entries):n===`passthrough`?W.looseObject(e.entries):n===`strict`?W.strictObject(e.entries):W.partial(e);if(O(e))return n===`strip`?e.onUndeclaredKey(`delete`):n===`passthrough`?e.onUndeclaredKey(`ignore`):n===`strict`?e.onUndeclaredKey(`reject`):e.partial();if(V(e))return n===`strip`?H.Object(e.properties,{...e,additionalProperties:!1,strip:!0}):n===`passthrough`?H.Object(e.properties,{...e,additionalProperties:!0}):n===`strict`?H.Object(e.properties,{...e,additionalProperties:!1}):H.Partial(e);throw new t({code:`SCHEMA_UNSUPPORTED`})},Ue=e=>{if(y(e))return W.object({...e.entries,exp:W.number(),iat:W.number(),jti:W.string(),nbf:W.number(),aud:W.optional(W.string()),iss:W.optional(W.string()),mexp:W.optional(W.number())});if(O(e))return e.and({exp:`number`,iat:`number`,jti:`string`,nbf:`number`,aud:`string?`,iss:`string?`,mexp:`number?`});if(V(e))return H.Object({...e.properties,exp:H.Number(),iat:H.Number(),jti:H.String(),nbf:H.Number(),aud:H.Optional(H.String()),iss:H.Optional(H.String()),mexp:H.Optional(H.Number())},{...e});if(o(e))return e.extend({exp:B.number(),iat:B.number(),jti:B.string(),nbf:B.number(),aud:B.string().optional(),iss:B.string().optional(),mexp:B.number().optional()});throw new t({code:`SCHEMA_UNSUPPORTED`})},We=e=>{if(y(e))return W.object({user:e,expires:W.optional(W.pipe(W.string(),W.transform(e=>new Date(e)),W.date()))});if(O(e))return ve({user:e,expires:ve(`string`).pipe(e=>new Date(e)).optional()});if(V(e))return H.Object({user:e,expires:H.Optional(H.String())});if(o(e))return B.object({user:e,expires:B.coerce.date().optional()});throw new t({code:`SCHEMA_UNSUPPORTED`})},Ge=e=>{let n=He(e.schema??I,e.unknownKeys),r=He(e.schema??I,`partial`),i=Ue(e.schema??I),a=G(n),o=G(r),s=G(i);return{parse:async(e={})=>{let{data:n,success:r,error:i}=a.validate(e);if(!r)throw new t({code:`SCHEMA_PARSER_FAILED`,cause:i});return n},parseAsPartial:async(e={})=>{let{data:n,success:r,error:i}=o.validate(e);if(!r)throw new t({code:`SCHEMA_PARSER_FAILED`,cause:i});return n},parseWithJWT:async(e={})=>{let{data:n,success:r,error:i}=s.validate(e);if(!r)throw new t({code:`SCHEMA_PARSER_FAILED`,cause:i});return n},schema:n,schemaAsPartial:r,schemaWithJWT:i}},Ke=e=>{let a=r(`TRUSTED_PROXY_HEADERS`)===void 0?e?.trustedProxyHeaders??!1:n(`TRUSTED_PROXY_HEADERS`),o=i(`TRUSTED_ORIGINS`),s=o.length>0?o:e?.trustedOrigins,c=pe(e),u=e?.cookies?.prefix,d=e?.cookies?.overrides??{},f=l(!0,u,d,c),p=l(!1,u,d,c),m=b(e?.secret,e?.session),h=e?.identity?.unknownKeys??`strip`,g=e?.identity?.skipValidation??!1,_=Ge({schema:e?.identity?.schema,unknownKeys:h,skipValidation:g});if(a&&(!s||Array.isArray(s)&&s.length===0))throw new t({code:`AUTH_INVALID_PROXY_HEADERS_CONFIG`});let v={oauth:te(e?.oauth),credentials:e?.credentials,cookies:p,jose:m,secret:e?.secret,basePath:e?.basePath??`/auth`,trustedProxyHeaders:a,trustedOrigins:s,logger:c,cookieConfig:{secure:f,standard:p},baseURL:e?.baseURL,identity:{schemaRegistry:_,unknownKeys:h,skipValidation:g},signUp:e?.signUp,jwtManager:Re(e?.session?.jwt,m),rateLimiters:we(e?.rateLimiter)};return v.sessionStrategy=Ve({cookies:()=>v.cookies,jose:v.jose,config:e?.session,logger:v.logger,identity:v.identity}),v},qe=t=>n=>he(n)||ge(n)||e(n)?n.toResponse():(t?.log(`SERVER_ERROR`,{structuredData:{error_type:n.name,error_message:n.message}}),Response.json({type:`SERVER_ERROR`,code:`SERVER_ERROR`,message:`An unexpected error occurred`},{status:500})),Je=e=>z(`/signIn/:oauth`,{schemas:{params:B.object({oauth:B.enum(Object.keys(e),`The OAuth provider is not supported or invalid.`)}),searchParams:F}}),Ye=e=>R(`GET`,`/signIn/:oauth`,async e=>{let{toResponse:t}=await je(e.params.oauth,{ctx:e.context,request:e.request,headers:e.request.headers,redirect:e.searchParams.redirect,redirectTo:e.searchParams.redirectTo});return t()},Je(e)),Xe=R(`POST`,`/signIn/credentials`,async e=>{let t=e.body,{toResponse:n}=await Me({ctx:e.context,payload:t,request:e.request,headers:e.request.headers,redirect:e.searchParams.redirect,redirectTo:e.searchParams.redirectTo});return n()},z({schemas:{body:de,searchParams:F}})),Ze=e=>{let n=e?.id??e?.sub??e?.uid??e?.user_id??e?.account_id;if(!n)throw new t({code:`INVALID_USER_INFO`});return{sub:n,email:e?.email,name:e?.name??e?.username??e?.nickname,image:e?.image??e?.picture}},Qe=async(n,r,i)=>{let a=n.userInfo,o=typeof a==`string`?a:a.url,s=typeof a==`string`?void 0:a.headers,c=typeof a==`string`?`GET`:(a.method??`GET`).toUpperCase();try{i?.log(`OAUTH_USERINFO_REQUEST_INITIATED`,{structuredData:{endpoint:o}});let e=await N(o,{method:c,headers:{"User-Agent":`Aura Auth/${j}`,Accept:`application/json`,Authorization:`Bearer ${r}`,...s}});if(!e.ok)throw i?.log(`OAUTH_USERINFO_INVALID_RESPONSE`),new t({code:`INVALID_OAUTH_USER_INFO_RESPONSE`});x(e,i);let n=await e.json(),{success:a,data:l}=ae.safeParse(n);if(a)throw i?.log(`OAUTH_USERINFO_ERROR`,{message:`Error response received from OAuth userinfo endpoint`,structuredData:{error:l.error,error_description:l.error_description??``}}),new t({code:`INVALID_OAUTH_USER_INFO_RES_FORMAT`});return i?.log(`OAUTH_USERINFO_SUCCESS`),n}catch(n){throw e(n)?n:(i?.log(`OAUTH_USERINFO_REQUEST_FAILED`),new t({code:`UNKNOWN_OAUTH_USER_INFO_ERROR`,cause:n}))}},$e=async(n,r,i)=>{try{let e={};if(D(n.userInfo)?(i?.log(`OAUTH_USERINFO_REQUEST_INITIATED`,{structuredData:{endpoint:n.name}}),e=await n.userInfo.request({accessToken:r.access_token,expiresIn:r?.expires_in,refreshToken:r?.refresh_token,scope:r?.scope,tokenType:r?.token_type,userInfoURL:n.userInfo.url})):e=await Qe(n,r.access_token,i),P(n)){let n=oe.safeParse(e);if(!n.success)throw i?.log(`OAUTH_USERINFO_INVALID_RESPONSE`),new t({code:`OIDC_USERINFO_INVALID_SCHEMA`,cause:n.error});e=n.data}return n?.profile?n.profile(e):Ze(e)}catch(n){throw e(n)?n:(i?.log(`OAUTH_USERINFO_REQUEST_FAILED`),new t({code:`UNKNOWN_CUSTOM_USER_INFO_ERROR`,cause:n}))}},et=async(n,r,i,a,o)=>{let{accessToken:s,clientId:c,clientSecret:l}=n;if(!c||!l||!r||!i||!a||!s)throw o?.log(`INVALID_OAUTH_CONFIGURATION`,{structuredData:{has_client_id:!!c,has_client_secret:!!l,has_access_token:!!s,has_redirect_uri:!!r,has_code:!!i,has_code_verifier:!!a}}),new t({code:`INVALID_OAUTH_PROVIDER_URL_CONFIG`});let u=typeof s==`string`?s:s.url,d=typeof s==`string`?void 0:s.headers;try{o?.log(`OAUTH_ACCESS_TOKEN_REQUEST_INITIATED`,{structuredData:{has_client_id:!!c,redirect_uri:r,grant_type:`authorization_code`}});let e=await N(u,{method:`POST`,headers:{...d,Accept:`application/json`,"Content-Type":`application/x-www-form-urlencoded`},body:new URLSearchParams({client_id:c,client_secret:l,code:i,redirect_uri:r,grant_type:`authorization_code`,code_verifier:a}).toString()});if(!e.ok)throw o?.log(`INVALID_OAUTH_ACCESS_TOKEN_RESPONSE`),new t({code:`INVALID_OAUTH_ACCESS_TOKEN_RESPONSE`});x(e,o);let s=await e.json(),f=(P(n)?fe:ie).safeParse(s);if(!f.success){let{success:e,data:n}=se.safeParse(s);throw e?(o?.log(`OAUTH_ACCESS_TOKEN_ERROR`,{structuredData:{error:n.error,error_description:n.error_description??``}}),new t({code:`INVALID_OAUTH_ACCESS_TOKEN_RES_FORMAT`})):(o?.log(`INVALID_OAUTH_ACCESS_TOKEN_RESPONSE`),new t({code:`INVALID_OAUTH_ACCESS_TOKEN_RES_FORMAT`}))}return o?.log(`OAUTH_ACCESS_TOKEN_SUCCESS`),f.data}catch(n){throw e(n)?n:(o?.log(`OAUTH_ACCESS_TOKEN_REQUEST_FAILED`),new t({code:`UNKNOWN_OAUTH_ACCESS_TOKEN_ERROR`,cause:n}))}},$=new Map,tt=async e=>{let n;try{n=await N(e,{headers:{Accept:`application/json`}}),x(n)}catch(e){throw new t({code:`OIDC_JWKS_INVALID_RESPONSE`,cause:e})}if(!n.ok)throw new t({code:`OIDC_JWKS_INVALID_RESPONSE`});let r;try{r=await n.json()}catch(e){throw new t({code:`OIDC_JWKS_INVALID_RESPONSE`,cause:e})}let i=ue.safeParse(r);if(!i.success)throw new t({code:`OIDC_JWKS_INVALID_SCHEMA`,cause:i.error});return i.data.keys},nt=async e=>{let t=$.get(e);if(!t||Date.now()-t.fetchedAt>3e5){let t=await tt(e);$.set(e,{verifier:be({keys:t}),fetchedAt:Date.now()})}return $.get(e).verifier},rt=async e=>nt(e),it=async(e,n)=>{let{issuer:r,clientId:i,nonce:a,jwks_uri:o}=n;try{let{payload:n}=await xe(e,await rt(o),{issuer:re(r),audience:i}),s=ce.safeParse(n);if(!s.success)throw new t({code:`OIDC_ID_TOKEN_INVALID`,cause:s.error});if(!s.data.nonce||!T(s.data.nonce,a))throw new t({code:`OIDC_NONCE_MISMATCH`})}catch(e){throw e instanceof t?e:e instanceof U.JWTExpired?new t({code:`JWT_EXPIRED`,cause:e}):e instanceof U.JWTInvalid||e instanceof U.JWSInvalid?new t({code:`JWT_MALFORMED`,cause:e}):e instanceof U.JWSSignatureVerificationFailed?new t({code:`JWT_INVALID_SIGNATURE`,cause:e}):e instanceof U.JOSEAlgNotAllowed?new t({code:`JWT_ALGORITHM_MISMATCH`,cause:e}):new t({code:`OIDC_ID_TOKEN_INVALID`,cause:e})}},at=e=>z({schemas:{params:B.object({oauth:B.enum(Object.keys(e),`The OAuth provider is not supported or invalid.`)}),searchParams:B.object({code:B.string(`Missing code parameter in the OAuth authorization response.`),state:B.string(`Missing state parameter in the OAuth authorization response.`)})}}),ot=(e,t)=>{let n=e.headers.get(`Cookie`);if(n)return ye(n)[t]},st=e=>R(`GET`,`/callback/:oauth`,async e=>{let{request:n,params:{oauth:r},searchParams:{code:i,state:a},context:o}=e,{oauth:s,cookies:c,jose:l,logger:f,trustedOrigins:p}=o,m=s[r],h=P(m),g=u(n,c.state.name),v=u(n,c.codeVerifier.name),y=h?ot(n,c.nonce.name):void 0,b=u(n,c.redirectTo.name),x=u(n,c.redirectURI.name),w=new L(K).setCookie(c.state.name,``,d(c.state.attributes)).setCookie(c.redirectURI.name,``,d(c.redirectURI.attributes)).setCookie(c.redirectTo.name,``,d(c.redirectTo.attributes)).setCookie(c.codeVerifier.name,``,d(c.codeVerifier.attributes)).setCookie(c.nonce.name,``,d(c.nonce.attributes));if(!T(g,a))return f?.log(`MISMATCHING_STATE`,{structuredData:{oauth_provider:r}}),Response.json({type:`PROTOCOL`,code:`AUTH_MISMATCHING_STATE`,message:`The provided state passed in the OAuth response does not match the stored token state.`},{headers:w.toHeaders(),status:400});let E=h?await ne(m):m,D=await et(E,x,i,v,f);if(h){if(!D.id_token)throw new t({code:`OIDC_ID_TOKEN_INVALID`});let{issuer:e,jwks_uri:n}=E.oidc;if(!n||!y||!E.clientId)throw new t({code:`OIDC_ID_TOKEN_INVALID`});await it(D.id_token,{issuer:e,clientId:E.clientId,nonce:y,jwks_uri:n})}let O=await Y(n,p),k=await Z(n,o);if(!C(b)&&!(O.length>0?_(b,O):S(b,k)))throw f?.log(`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`,{structuredData:{redirect_path:b,provider:r,has_trusted_origins:O.length>0,request_origin:k}}),new t({code:`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`});let ee=await $e(E,D,f),j=await o.sessionStrategy.createSession(ee),M=await A(l);f?.log(`OAUTH_CALLBACK_SUCCESS`,{structuredData:{provider:r}});let N=w.setHeader(`Location`,b).setCookie(c.sessionToken.name,j,c.sessionToken.attributes).setCookie(c.csrfToken.name,M,c.csrfToken.attributes).toHeaders();return Response.json({oauth:r},{status:302,headers:N})},at(e)),ct=R(`GET`,`/session`,async e=>{let{toResponse:t}=await Pe({ctx:e.context,headers:e.request.headers});return t()}),lt=R(`POST`,`/signOut`,async e=>{let{toResponse:t}=await Ne({ctx:e.context,request:e.request,headers:e.request.headers,redirect:e.searchParams.redirect,redirectTo:e.searchParams.redirectTo});return t()},z({schemas:{searchParams:F.extend({token_type_hint:B.literal(`session_token`)})}})),ut=(e,t)=>{try{return u(e,t)}catch{return}},dt=R(`GET`,`/csrfToken`,async e=>{let{request:t,context:{jose:n,cookies:r,logger:i}}=e,a=ut(t,r.csrfToken.name);i?.log(`CSRF_TOKEN_REQUESTED`,{structuredData:{has_token:!!a}});let o=await A(n,a);i?.log(`CSRF_TOKEN_ISSUED`,{structuredData:{issued:!!o}});let s=new Headers(q);return s.append(`Set-Cookie`,g(r.csrfToken.name,o,r.csrfToken.attributes)),Response.json({csrfToken:o},{headers:s})}),ft=e=>z({schemas:{body:We(e.schemaRegistry.schemaAsPartial),searchParams:F}}),pt=e=>R(`PATCH`,`/session`,async e=>{let t=e.body,{toResponse:n}=await Fe({ctx:e.context,request:e.request,headers:e.request.headers,redirect:e.searchParams.redirect,redirectTo:e.searchParams.redirectTo,session:t});return n()},ft(e)),mt=e=>z({schemas:{body:e?.schema,searchParams:F}}),ht=e=>R(`POST`,`/signUp`,async e=>{let t=e.body,{toResponse:n}=await Ie({ctx:e.context,payload:t,request:e.request,headers:e.request.headers,redirect:e.searchParams.redirect,redirectTo:e.searchParams.redirectTo,skipCSRFCheck:!1});return n()},mt(e)),gt=e=>{let t=Ke(e);return{basePath:e?.basePath??`/auth`,onError:qe(t.logger),context:t,use:[e=>{let n=E(e.request,e.context.trustedProxyHeaders);return e.context.cookies=n?t.cookieConfig.secure:t.cookieConfig.standard,e}]}},_t=e=>{let t=gt(e);return{handlers:me([Ye(t.context.oauth),Xe,st(t.context.oauth),ct,lt,dt,pt(t.context.identity),ht(t.context.signUp)],t),jose:t.context.jose,api:Le(t.context)}},vt=e=>{let t=_t(e);return t.handlers.ALL=async e=>{let n=e.method.toUpperCase(),r={GET:t.handlers.GET,POST:t.handlers.POST,PATCH:t.handlers.PATCH};return n in r?await r[n](e):new Response(`Method Not Allowed`,{status:405,headers:{Allow:Object.keys(r).join(`, `)}})},t};export{vt as createAuth};

package/dist/{logger-BfUjjtxf.js → logger-BleaYLUV.js}

@@ -1 +1 @@
-import{i as e,n as t}from"./env-BG1x-kSX.js";const n={ROUTER_INTERNAL_ERROR:{facility:10,severity:`error`,msgId:`ROUTER_INTERNAL_ERROR`,message:`Unhandled router error while processing the request`},INVALID_REQUEST:{facility:10,severity:`warning`,msgId:`INVALID_REQUEST`,message:`Request validation failed against the expected schema`},SERVER_ERROR:{facility:10,severity:`error`,msgId:`SERVER_ERROR`,message:`Unexpected internal server error during authentication`},OAUTH_PROTOCOL_ERROR:{facility:10,severity:`warning`,msgId:`OAUTH_PROTOCOL_ERROR`,message:`OAuth provider returned an invalid or unexpected protocol response`},OAUTH_AUTHORIZATION_ERROR:{facility:10,severity:`error`,msgId:`OAUTH_AUTHORIZATION_ERROR`,message:`OAuth authorization request was rejected or failed`},INVALID_OAUTH_CONFIGURATION:{facility:10,severity:`error`,msgId:`INVALID_OAUTH_CONFIGURATION`,message:`The OAuth provider configuration is invalid or incomplete`},OAUTH_ACCESS_TOKEN_REQUEST_INITIATED:{facility:10,severity:`debug`,msgId:`OAUTH_ACCESS_TOKEN_REQUEST_INITIATED`,message:`Starting OAuth access token request to the provider`},INVALID_OAUTH_ACCESS_TOKEN_RESPONSE:{facility:10,severity:`error`,msgId:`INVALID_OAUTH_ACCESS_TOKEN_RESPONSE`,message:`OAuth access token endpoint returned an invalid or malformed response`},OAUTH_ACCESS_TOKEN_ERROR:{facility:10,severity:`error`,msgId:`OAUTH_ACCESS_TOKEN_ERROR`,message:`OAuth access token endpoint returned an error response`},OAUTH_ACCESS_TOKEN_SUCCESS:{facility:10,severity:`info`,msgId:`OAUTH_ACCESS_TOKEN_SUCCESS`,message:`Successfully retrieved OAuth access token from the provider`},OAUTH_ACCESS_TOKEN_REQUEST_FAILED:{facility:10,severity:`error`,msgId:`OAUTH_ACCESS_TOKEN_REQUEST_FAILED`,message:`Network or server error while requesting OAuth access token`},OAUTH_USERINFO_REQUEST_INITIATED:{facility:10,severity:`debug`,msgId:`OAUTH_USERINFO_REQUEST_INITIATED`,message:`Starting OAuth userinfo request to the provider`},OAUTH_USERINFO_INVALID_RESPONSE:{facility:10,severity:`error`,msgId:`OAUTH_USERINFO_INVALID_RESPONSE`,message:`OAuth userinfo endpoint returned an invalid or malformed response`},OAUTH_USERINFO_ERROR:{facility:10,severity:`error`,msgId:`OAUTH_USERINFO_ERROR`,message:`OAuth userinfo endpoint returned an error response`},OAUTH_USERINFO_SUCCESS:{facility:10,severity:`info`,msgId:`OAUTH_USERINFO_SUCCESS`,message:`Successfully retrieved user information from the OAuth provider`},OAUTH_USERINFO_REQUEST_FAILED:{facility:10,severity:`error`,msgId:`OAUTH_USERINFO_REQUEST_FAILED`,message:`Network or server error while requesting user information from the OAuth provider`},OAUTH_CALLBACK_SUCCESS:{facility:4,severity:`info`,msgId:`OAUTH_CALLBACK_SUCCESS`,message:`OAuth callback completed successfully and session was created`},MISMATCHING_STATE:{facility:4,severity:`critical`,msgId:`MISMATCHING_STATE`,message:`OAuth response state parameter does not match the stored state value`},POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED:{facility:4,severity:`critical`,msgId:`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`,message:`Blocked redirect to untrusted or external URL (potential open redirect attack)`},OPEN_REDIRECT_ATTACK:{facility:4,severity:`warning`,msgId:`OPEN_REDIRECT_ATTACK`,message:`Detected redirect target that does not match the trusted origin`},SESSION_TOKEN_MISSING:{facility:4,severity:`warning`,msgId:`SESSION_TOKEN_MISSING`,message:`Session cookie is missing from the request`},CSRF_TOKEN_MISSING:{facility:4,severity:`warning`,msgId:`CSRF_TOKEN_MISSING`,message:`CSRF token cookie is missing from the request`},CSRF_HEADER_MISSING:{facility:4,severity:`warning`,msgId:`CSRF_HEADER_MISSING`,message:`CSRF header is missing from the request`},CSRF_TOKEN_INVALID:{facility:4,severity:`error`,msgId:`CSRF_TOKEN_INVALID`,message:`CSRF token verification failed or token is invalid`},SIGN_IN_INITIATED:{facility:4,severity:`info`,msgId:`SIGN_IN_INITIATED`,message:`Starting OAuth sign-in flow for the selected provider`},SIGN_OUT_ATTEMPT:{facility:4,severity:`debug`,msgId:`SIGN_OUT_ATTEMPT`,message:`Received sign-out request from client`},SIGN_OUT_CSRF_VERIFIED:{facility:4,severity:`info`,msgId:`SIGN_OUT_CSRF_VERIFIED`,message:`CSRF token was successfully verified during sign-out`},SIGN_OUT_SUCCESS:{facility:4,severity:`info`,msgId:`SIGN_OUT_SUCCESS`,message:`User session was cleared and sign-out completed successfully`},SIGN_OUT_REDIRECT:{facility:4,severity:`debug`,msgId:`SIGN_OUT_REDIRECT`,message:`Redirecting client after successful sign-out`},AUTH_SESSION_VALID:{facility:4,severity:`info`,msgId:`AUTH_SESSION_VALID`,message:`Session token is valid and user session was returned`},AUTH_SESSION_INVALID:{facility:4,severity:`notice`,msgId:`AUTH_SESSION_INVALID`,message:`Session token is missing, expired, or invalid`},INVALID_JWT_TOKEN:{facility:4,severity:`warning`,msgId:`INVALID_JWT_TOKEN`,message:`JWT session token failed validation during sign-out`},CSRF_TOKEN_REQUESTED:{facility:4,severity:`debug`,msgId:`CSRF_TOKEN_REQUESTED`,message:`Client requested a CSRF token`},CSRF_TOKEN_ISSUED:{facility:4,severity:`debug`,msgId:`CSRF_TOKEN_ISSUED`,message:`Issued a new CSRF token to the client`},INVALID_URL:{facility:10,severity:`error`,msgId:`INVALID_URL`,message:`Derived origin URL is invalid or malformed`},COOKIE_HTTPONLY_DISABLED:{facility:10,severity:`critical`,msgId:`COOKIE_HTTPONLY_DISABLED`,message:`Cookie is configured without HttpOnly. This allows JavaScript access via document.cookie and increases XSS exposure.`},COOKIE_WILDCARD_DOMAIN:{facility:10,severity:`critical`,msgId:`COOKIE_WILDCARD_DOMAIN`,message:`Cookie 'Domain' is set to a wildcard, which is insecure and should be avoided.`},COOKIE_SECURE_DISABLED:{facility:10,severity:`warning`,msgId:`COOKIE_SECURE_DISABLED`,message:`Cookie is configured with 'Secure' but the request is not HTTPS. The 'Secure' attribute will be ignored by the browser.`},COOKIE_SAMESITE_NONE_WITHOUT_SECURE:{facility:10,severity:`warning`,msgId:`COOKIE_SAMESITE_NONE_WITHOUT_SECURE`,message:`Cookie uses SameSite=None without Secure. Falling back to SameSite=Lax for safer defaults.`},COOKIE_INSECURE_IN_PRODUCTION:{facility:10,severity:`critical`,msgId:`COOKIE_INSECURE_IN_PRODUCTION`,message:`Cookies are being served over an insecure connection in production, which is a serious security risk.`},COOKIE_HOST_STRATEGY_INSECURE:{facility:10,severity:`critical`,msgId:`COOKIE_HOST_STRATEGY_INSECURE`,message:`__Host- cookies require a secure HTTPS context. Falling back to standard cookie settings.`},UNTRUSTED_ORIGIN:{facility:10,severity:`error`,msgId:`UNTRUSTED_ORIGIN`,message:`The constructed origin URL is not trusted.`},SESSION_REFRESHED:{facility:4,severity:`info`,msgId:`SESSION_REFRESHED`,message:`User session was refreshed with a new expiration time`},AUTH_SECURITY_ERROR:{facility:10,severity:`error`,msgId:`AUTH_SECURITY_ERROR`,message:`An authentication security error occurred`},CSRF_TOKEN_VERIFIED:{facility:4,severity:`info`,msgId:`CSRF_TOKEN_VERIFIED`,message:`CSRF token verification succeeded`},IDENTITY_VALIDATION_DISABLED:{facility:4,severity:`warning`,msgId:`IDENTITY_VALIDATION_DISABLED`,message:`Identity validation is disabled. User data will not be validated against a schema.`},IDENTITY_VALIDATION_FAILED:{facility:4,severity:`error`,msgId:`IDENTITY_VALIDATION_FAILED`,message:`User identity validation against the schema failed`},CREDENTIALS_SIGN_IN_SUCCESS:{facility:4,severity:`info`,msgId:`CREDENTIALS_SIGN_IN_SUCCESS`,message:`User successfully authenticated with credentials`},INVALID_CREDENTIALS:{facility:4,severity:`warning`,msgId:`INVALID_CREDENTIALS`,message:`Authentication failed due to invalid credentials`},CREDENTIALS_SIGN_IN_FAILED:{facility:4,severity:`error`,msgId:`CREDENTIALS_SIGN_IN_FAILED`,message:`An error occurred during credentials sign-in`}},r=(e,t)=>({...n[e],timestamp:new Date().toISOString(),hostname:`aura-auth`,...t}),i={debug:[`debug`,`info`,`notice`,`warning`,`error`,`critical`,`alert`,`emergency`],info:[`info`,`notice`,`warning`,`error`,`critical`,`alert`,`emergency`],warn:[`warning`,`error`,`critical`,`alert`,`emergency`],error:[`error`,`critical`,`alert`,`emergency`]},a=e=>e===`debug`||e===`info`||e===`warn`||e===`error`,o=e=>({emergency:0,alert:1,critical:2,error:3,warning:4,notice:5,info:6,debug:7})[e]??6,s=(e,t=`metadata`)=>{let n=Object.entries(e);return n.length===0?`[${t}]`:`[${t} ${n.map(([e,t])=>`${e}="${String(t).replace(/(["\\\]])/g,`\\$1`)}"`).join(` `)}]`},c=e=>{let{timestamp:t,hostname:n,appName:r=`aura-auth`,procId:i=`-`,msgId:a,structuredData:c,message:l}=e;return`<${(e.facility??16)*8+o(e.severity)}>1 ${t} ${n} ${r} ${i} ${a} ${s(c??{})} ${l}`},l=e=>{if(!e)return;let t=e.level,n=i[t]??[];return{level:t,log(t,i){let a=r(t,i);return n.includes(a.severity)&&e.log({timestamp:a.timestamp,appName:a.appName??`aura-auth`,hostname:a.hostname??`aura-auth`,...a}),a}}},u=n=>{let r=t(`LOG_LEVEL`),i=e(`DEBUG`);if(typeof n?.logger==`object`)return l({log:n.logger?.log||c,level:a(n.logger?.level)?n.logger?.level:a(r)?r:`error`});if(i||n?.logger===!0||r)return l({level:a(r)?r:`debug`,log:e=>{let t=c(e);console.log(t)}})};export{c as n,u as t};
+import{i as e,n as t}from"./env-BG1x-kSX.js";const n={ROUTER_INTERNAL_ERROR:{facility:10,severity:`error`,msgId:`ROUTER_INTERNAL_ERROR`,message:`Unhandled router error while processing the request`},INVALID_REQUEST:{facility:10,severity:`warning`,msgId:`INVALID_REQUEST`,message:`Request validation failed against the expected schema`},SERVER_ERROR:{facility:10,severity:`error`,msgId:`SERVER_ERROR`,message:`Unexpected internal server error during authentication`},OAUTH_PROTOCOL_ERROR:{facility:10,severity:`warning`,msgId:`OAUTH_PROTOCOL_ERROR`,message:`OAuth provider returned an invalid or unexpected protocol response`},OAUTH_AUTHORIZATION_ERROR:{facility:10,severity:`error`,msgId:`OAUTH_AUTHORIZATION_ERROR`,message:`OAuth authorization request was rejected or failed`},INVALID_OAUTH_CONFIGURATION:{facility:10,severity:`error`,msgId:`INVALID_OAUTH_CONFIGURATION`,message:`The OAuth provider configuration is invalid or incomplete`},OAUTH_ACCESS_TOKEN_REQUEST_INITIATED:{facility:10,severity:`debug`,msgId:`OAUTH_ACCESS_TOKEN_REQUEST_INITIATED`,message:`Starting OAuth access token request to the provider`},INVALID_OAUTH_ACCESS_TOKEN_RESPONSE:{facility:10,severity:`error`,msgId:`INVALID_OAUTH_ACCESS_TOKEN_RESPONSE`,message:`OAuth access token endpoint returned an invalid or malformed response`},OAUTH_ACCESS_TOKEN_ERROR:{facility:10,severity:`error`,msgId:`OAUTH_ACCESS_TOKEN_ERROR`,message:`OAuth access token endpoint returned an error response`},OAUTH_ACCESS_TOKEN_SUCCESS:{facility:10,severity:`info`,msgId:`OAUTH_ACCESS_TOKEN_SUCCESS`,message:`Successfully retrieved OAuth access token from the provider`},OAUTH_ACCESS_TOKEN_REQUEST_FAILED:{facility:10,severity:`error`,msgId:`OAUTH_ACCESS_TOKEN_REQUEST_FAILED`,message:`Network or server error while requesting OAuth access token`},OAUTH_USERINFO_REQUEST_INITIATED:{facility:10,severity:`debug`,msgId:`OAUTH_USERINFO_REQUEST_INITIATED`,message:`Starting OAuth userinfo request to the provider`},OAUTH_USERINFO_INVALID_RESPONSE:{facility:10,severity:`error`,msgId:`OAUTH_USERINFO_INVALID_RESPONSE`,message:`OAuth userinfo endpoint returned an invalid or malformed response`},OAUTH_USERINFO_ERROR:{facility:10,severity:`error`,msgId:`OAUTH_USERINFO_ERROR`,message:`OAuth userinfo endpoint returned an error response`},OAUTH_USERINFO_SUCCESS:{facility:10,severity:`info`,msgId:`OAUTH_USERINFO_SUCCESS`,message:`Successfully retrieved user information from the OAuth provider`},OAUTH_USERINFO_REQUEST_FAILED:{facility:10,severity:`error`,msgId:`OAUTH_USERINFO_REQUEST_FAILED`,message:`Network or server error while requesting user information from the OAuth provider`},OAUTH_CALLBACK_SUCCESS:{facility:4,severity:`info`,msgId:`OAUTH_CALLBACK_SUCCESS`,message:`OAuth callback completed successfully and session was created`},MISMATCHING_STATE:{facility:4,severity:`critical`,msgId:`MISMATCHING_STATE`,message:`OAuth response state parameter does not match the stored state value`},POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED:{facility:4,severity:`critical`,msgId:`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`,message:`Blocked redirect to untrusted or external URL (potential open redirect attack)`},OPEN_REDIRECT_ATTACK:{facility:4,severity:`warning`,msgId:`OPEN_REDIRECT_ATTACK`,message:`Detected redirect target that does not match the trusted origin`},SESSION_TOKEN_MISSING:{facility:4,severity:`warning`,msgId:`SESSION_TOKEN_MISSING`,message:`Session cookie is missing from the request`},CSRF_TOKEN_MISSING:{facility:4,severity:`warning`,msgId:`CSRF_TOKEN_MISSING`,message:`CSRF token cookie is missing from the request`},CSRF_HEADER_MISSING:{facility:4,severity:`warning`,msgId:`CSRF_HEADER_MISSING`,message:`CSRF header is missing from the request`},CSRF_TOKEN_INVALID:{facility:4,severity:`error`,msgId:`CSRF_TOKEN_INVALID`,message:`CSRF token verification failed or token is invalid`},SIGN_IN_INITIATED:{facility:4,severity:`info`,msgId:`SIGN_IN_INITIATED`,message:`Starting OAuth sign-in flow for the selected provider`},SIGN_OUT_ATTEMPT:{facility:4,severity:`debug`,msgId:`SIGN_OUT_ATTEMPT`,message:`Received sign-out request from client`},SIGN_OUT_CSRF_VERIFIED:{facility:4,severity:`info`,msgId:`SIGN_OUT_CSRF_VERIFIED`,message:`CSRF token was successfully verified during sign-out`},SIGN_OUT_SUCCESS:{facility:4,severity:`info`,msgId:`SIGN_OUT_SUCCESS`,message:`User session was cleared and sign-out completed successfully`},SIGN_OUT_REDIRECT:{facility:4,severity:`debug`,msgId:`SIGN_OUT_REDIRECT`,message:`Redirecting client after successful sign-out`},AUTH_SESSION_VALID:{facility:4,severity:`info`,msgId:`AUTH_SESSION_VALID`,message:`Session token is valid and user session was returned`},AUTH_SESSION_INVALID:{facility:4,severity:`notice`,msgId:`AUTH_SESSION_INVALID`,message:`Session token is missing, expired, or invalid`},INVALID_JWT_TOKEN:{facility:4,severity:`warning`,msgId:`INVALID_JWT_TOKEN`,message:`JWT session token failed validation during sign-out`},CSRF_TOKEN_REQUESTED:{facility:4,severity:`debug`,msgId:`CSRF_TOKEN_REQUESTED`,message:`Client requested a CSRF token`},CSRF_TOKEN_ISSUED:{facility:4,severity:`debug`,msgId:`CSRF_TOKEN_ISSUED`,message:`Issued a new CSRF token to the client`},INVALID_URL:{facility:10,severity:`error`,msgId:`INVALID_URL`,message:`Derived origin URL is invalid or malformed`},COOKIE_HTTPONLY_DISABLED:{facility:10,severity:`critical`,msgId:`COOKIE_HTTPONLY_DISABLED`,message:`Cookie is configured without HttpOnly. This allows JavaScript access via document.cookie and increases XSS exposure.`},COOKIE_WILDCARD_DOMAIN:{facility:10,severity:`critical`,msgId:`COOKIE_WILDCARD_DOMAIN`,message:`Cookie 'Domain' is set to a wildcard, which is insecure and should be avoided.`},COOKIE_SECURE_DISABLED:{facility:10,severity:`warning`,msgId:`COOKIE_SECURE_DISABLED`,message:`Cookie is configured with 'Secure' but the request is not HTTPS. The 'Secure' attribute will be ignored by the browser.`},COOKIE_SAMESITE_NONE_WITHOUT_SECURE:{facility:10,severity:`warning`,msgId:`COOKIE_SAMESITE_NONE_WITHOUT_SECURE`,message:`Cookie uses SameSite=None without Secure. Falling back to SameSite=Lax for safer defaults.`},COOKIE_INSECURE_IN_PRODUCTION:{facility:10,severity:`critical`,msgId:`COOKIE_INSECURE_IN_PRODUCTION`,message:`Cookies are being served over an insecure connection in production, which is a serious security risk.`},COOKIE_HOST_STRATEGY_INSECURE:{facility:10,severity:`critical`,msgId:`COOKIE_HOST_STRATEGY_INSECURE`,message:`__Host- cookies require a secure HTTPS context. Falling back to standard cookie settings.`},UNTRUSTED_ORIGIN:{facility:10,severity:`error`,msgId:`UNTRUSTED_ORIGIN`,message:`The constructed origin URL is not trusted.`},SESSION_REFRESHED:{facility:4,severity:`info`,msgId:`SESSION_REFRESHED`,message:`User session was refreshed with a new expiration time`},AUTH_SECURITY_ERROR:{facility:10,severity:`error`,msgId:`AUTH_SECURITY_ERROR`,message:`An authentication security error occurred`},CSRF_TOKEN_VERIFIED:{facility:4,severity:`info`,msgId:`CSRF_TOKEN_VERIFIED`,message:`CSRF token verification succeeded`},IDENTITY_VALIDATION_DISABLED:{facility:4,severity:`warning`,msgId:`IDENTITY_VALIDATION_DISABLED`,message:`Identity validation is disabled. User data will not be validated against a schema.`},IDENTITY_VALIDATION_FAILED:{facility:4,severity:`error`,msgId:`IDENTITY_VALIDATION_FAILED`,message:`User identity validation against the schema failed`},CREDENTIALS_SIGN_IN_SUCCESS:{facility:4,severity:`info`,msgId:`CREDENTIALS_SIGN_IN_SUCCESS`,message:`User successfully authenticated with credentials`},INVALID_CREDENTIALS:{facility:4,severity:`warning`,msgId:`INVALID_CREDENTIALS`,message:`Authentication failed due to invalid credentials`},CREDENTIALS_SIGN_IN_FAILED:{facility:4,severity:`error`,msgId:`CREDENTIALS_SIGN_IN_FAILED`,message:`An error occurred during credentials sign-in`},SIGN_UP_SUCCESS:{facility:4,severity:`info`,msgId:`SIGN_UP_SUCCESS`,message:`User successfully signed up and authenticated`},SESSION_NOT_FOUND:{facility:4,severity:`error`,msgId:`SESSION_NOT_FOUND`,message:`Session token was not found in the request cookies`},OAUTH_INVALID_CONTENT_TYPE:{facility:10,severity:`error`,msgId:`OAUTH_INVALID_CONTENT_TYPE`,message:`OAuth endpoint returned an invalid Content-Type header`},SIGN_IN_PROVIDER_TYPE_DETECTED:{facility:4,severity:`info`,msgId:`SIGN_IN_PROVIDER_TYPE_DETECTED`,message:`Detected OAuth provider type (OIDC or standard)`},OIDC_PROVIDER_RESOLVED:{facility:4,severity:`info`,msgId:`OIDC_PROVIDER_RESOLVED`,message:`OIDC provider configuration resolved successfully`}},r=(e,t)=>({...n[e],timestamp:new Date().toISOString(),hostname:`aura-auth`,...t}),i={debug:[`debug`,`info`,`notice`,`warning`,`error`,`critical`,`alert`,`emergency`],info:[`info`,`notice`,`warning`,`error`,`critical`,`alert`,`emergency`],warn:[`warning`,`error`,`critical`,`alert`,`emergency`],error:[`error`,`critical`,`alert`,`emergency`]},a=e=>e===`debug`||e===`info`||e===`warn`||e===`error`,o=e=>({emergency:0,alert:1,critical:2,error:3,warning:4,notice:5,info:6,debug:7})[e]??6,s=(e,t=`metadata`)=>{let n=Object.entries(e);return n.length===0?`[${t}]`:`[${t} ${n.map(([e,t])=>`${e}="${String(t).replace(/(["\\\]])/g,`\\$1`)}"`).join(` `)}]`},c=e=>{let{timestamp:t,hostname:n,appName:r=`aura-auth`,procId:i=`-`,msgId:a,structuredData:c,message:l}=e;return`<${(e.facility??16)*8+o(e.severity)}>1 ${t} ${n} ${r} ${i} ${a} ${s(c??{})} ${l}`},l=e=>{if(!e)return;let t=e.level,n=i[t]??[];return{level:t,log(t,i){let a=r(t,i);return n.includes(a.severity)&&e.log({timestamp:a.timestamp,appName:a.appName??`aura-auth`,hostname:a.hostname??`aura-auth`,...a}),a}}},u=n=>{let r=t(`LOG_LEVEL`),i=e(`DEBUG`);if(typeof n?.logger==`object`)return l({log:n.logger?.log||c,level:a(n.logger?.level)?n.logger?.level:a(r)?r:`error`});if(i||n?.logger===!0||r)return l({level:a(r)?r:`debug`,log:e=>{let t=c(e);console.log(t)}})};export{c as n,u as t};

package/dist/{logger-CVwkloPj.cjs → logger-DL-kEECn.cjs}

@@ -1 +1 @@
-const e=require(`./env-BhQ2k7jj.cjs`),t={ROUTER_INTERNAL_ERROR:{facility:10,severity:`error`,msgId:`ROUTER_INTERNAL_ERROR`,message:`Unhandled router error while processing the request`},INVALID_REQUEST:{facility:10,severity:`warning`,msgId:`INVALID_REQUEST`,message:`Request validation failed against the expected schema`},SERVER_ERROR:{facility:10,severity:`error`,msgId:`SERVER_ERROR`,message:`Unexpected internal server error during authentication`},OAUTH_PROTOCOL_ERROR:{facility:10,severity:`warning`,msgId:`OAUTH_PROTOCOL_ERROR`,message:`OAuth provider returned an invalid or unexpected protocol response`},OAUTH_AUTHORIZATION_ERROR:{facility:10,severity:`error`,msgId:`OAUTH_AUTHORIZATION_ERROR`,message:`OAuth authorization request was rejected or failed`},INVALID_OAUTH_CONFIGURATION:{facility:10,severity:`error`,msgId:`INVALID_OAUTH_CONFIGURATION`,message:`The OAuth provider configuration is invalid or incomplete`},OAUTH_ACCESS_TOKEN_REQUEST_INITIATED:{facility:10,severity:`debug`,msgId:`OAUTH_ACCESS_TOKEN_REQUEST_INITIATED`,message:`Starting OAuth access token request to the provider`},INVALID_OAUTH_ACCESS_TOKEN_RESPONSE:{facility:10,severity:`error`,msgId:`INVALID_OAUTH_ACCESS_TOKEN_RESPONSE`,message:`OAuth access token endpoint returned an invalid or malformed response`},OAUTH_ACCESS_TOKEN_ERROR:{facility:10,severity:`error`,msgId:`OAUTH_ACCESS_TOKEN_ERROR`,message:`OAuth access token endpoint returned an error response`},OAUTH_ACCESS_TOKEN_SUCCESS:{facility:10,severity:`info`,msgId:`OAUTH_ACCESS_TOKEN_SUCCESS`,message:`Successfully retrieved OAuth access token from the provider`},OAUTH_ACCESS_TOKEN_REQUEST_FAILED:{facility:10,severity:`error`,msgId:`OAUTH_ACCESS_TOKEN_REQUEST_FAILED`,message:`Network or server error while requesting OAuth access token`},OAUTH_USERINFO_REQUEST_INITIATED:{facility:10,severity:`debug`,msgId:`OAUTH_USERINFO_REQUEST_INITIATED`,message:`Starting OAuth userinfo request to the provider`},OAUTH_USERINFO_INVALID_RESPONSE:{facility:10,severity:`error`,msgId:`OAUTH_USERINFO_INVALID_RESPONSE`,message:`OAuth userinfo endpoint returned an invalid or malformed response`},OAUTH_USERINFO_ERROR:{facility:10,severity:`error`,msgId:`OAUTH_USERINFO_ERROR`,message:`OAuth userinfo endpoint returned an error response`},OAUTH_USERINFO_SUCCESS:{facility:10,severity:`info`,msgId:`OAUTH_USERINFO_SUCCESS`,message:`Successfully retrieved user information from the OAuth provider`},OAUTH_USERINFO_REQUEST_FAILED:{facility:10,severity:`error`,msgId:`OAUTH_USERINFO_REQUEST_FAILED`,message:`Network or server error while requesting user information from the OAuth provider`},OAUTH_CALLBACK_SUCCESS:{facility:4,severity:`info`,msgId:`OAUTH_CALLBACK_SUCCESS`,message:`OAuth callback completed successfully and session was created`},MISMATCHING_STATE:{facility:4,severity:`critical`,msgId:`MISMATCHING_STATE`,message:`OAuth response state parameter does not match the stored state value`},POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED:{facility:4,severity:`critical`,msgId:`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`,message:`Blocked redirect to untrusted or external URL (potential open redirect attack)`},OPEN_REDIRECT_ATTACK:{facility:4,severity:`warning`,msgId:`OPEN_REDIRECT_ATTACK`,message:`Detected redirect target that does not match the trusted origin`},SESSION_TOKEN_MISSING:{facility:4,severity:`warning`,msgId:`SESSION_TOKEN_MISSING`,message:`Session cookie is missing from the request`},CSRF_TOKEN_MISSING:{facility:4,severity:`warning`,msgId:`CSRF_TOKEN_MISSING`,message:`CSRF token cookie is missing from the request`},CSRF_HEADER_MISSING:{facility:4,severity:`warning`,msgId:`CSRF_HEADER_MISSING`,message:`CSRF header is missing from the request`},CSRF_TOKEN_INVALID:{facility:4,severity:`error`,msgId:`CSRF_TOKEN_INVALID`,message:`CSRF token verification failed or token is invalid`},SIGN_IN_INITIATED:{facility:4,severity:`info`,msgId:`SIGN_IN_INITIATED`,message:`Starting OAuth sign-in flow for the selected provider`},SIGN_OUT_ATTEMPT:{facility:4,severity:`debug`,msgId:`SIGN_OUT_ATTEMPT`,message:`Received sign-out request from client`},SIGN_OUT_CSRF_VERIFIED:{facility:4,severity:`info`,msgId:`SIGN_OUT_CSRF_VERIFIED`,message:`CSRF token was successfully verified during sign-out`},SIGN_OUT_SUCCESS:{facility:4,severity:`info`,msgId:`SIGN_OUT_SUCCESS`,message:`User session was cleared and sign-out completed successfully`},SIGN_OUT_REDIRECT:{facility:4,severity:`debug`,msgId:`SIGN_OUT_REDIRECT`,message:`Redirecting client after successful sign-out`},AUTH_SESSION_VALID:{facility:4,severity:`info`,msgId:`AUTH_SESSION_VALID`,message:`Session token is valid and user session was returned`},AUTH_SESSION_INVALID:{facility:4,severity:`notice`,msgId:`AUTH_SESSION_INVALID`,message:`Session token is missing, expired, or invalid`},INVALID_JWT_TOKEN:{facility:4,severity:`warning`,msgId:`INVALID_JWT_TOKEN`,message:`JWT session token failed validation during sign-out`},CSRF_TOKEN_REQUESTED:{facility:4,severity:`debug`,msgId:`CSRF_TOKEN_REQUESTED`,message:`Client requested a CSRF token`},CSRF_TOKEN_ISSUED:{facility:4,severity:`debug`,msgId:`CSRF_TOKEN_ISSUED`,message:`Issued a new CSRF token to the client`},INVALID_URL:{facility:10,severity:`error`,msgId:`INVALID_URL`,message:`Derived origin URL is invalid or malformed`},COOKIE_HTTPONLY_DISABLED:{facility:10,severity:`critical`,msgId:`COOKIE_HTTPONLY_DISABLED`,message:`Cookie is configured without HttpOnly. This allows JavaScript access via document.cookie and increases XSS exposure.`},COOKIE_WILDCARD_DOMAIN:{facility:10,severity:`critical`,msgId:`COOKIE_WILDCARD_DOMAIN`,message:`Cookie 'Domain' is set to a wildcard, which is insecure and should be avoided.`},COOKIE_SECURE_DISABLED:{facility:10,severity:`warning`,msgId:`COOKIE_SECURE_DISABLED`,message:`Cookie is configured with 'Secure' but the request is not HTTPS. The 'Secure' attribute will be ignored by the browser.`},COOKIE_SAMESITE_NONE_WITHOUT_SECURE:{facility:10,severity:`warning`,msgId:`COOKIE_SAMESITE_NONE_WITHOUT_SECURE`,message:`Cookie uses SameSite=None without Secure. Falling back to SameSite=Lax for safer defaults.`},COOKIE_INSECURE_IN_PRODUCTION:{facility:10,severity:`critical`,msgId:`COOKIE_INSECURE_IN_PRODUCTION`,message:`Cookies are being served over an insecure connection in production, which is a serious security risk.`},COOKIE_HOST_STRATEGY_INSECURE:{facility:10,severity:`critical`,msgId:`COOKIE_HOST_STRATEGY_INSECURE`,message:`__Host- cookies require a secure HTTPS context. Falling back to standard cookie settings.`},UNTRUSTED_ORIGIN:{facility:10,severity:`error`,msgId:`UNTRUSTED_ORIGIN`,message:`The constructed origin URL is not trusted.`},SESSION_REFRESHED:{facility:4,severity:`info`,msgId:`SESSION_REFRESHED`,message:`User session was refreshed with a new expiration time`},AUTH_SECURITY_ERROR:{facility:10,severity:`error`,msgId:`AUTH_SECURITY_ERROR`,message:`An authentication security error occurred`},CSRF_TOKEN_VERIFIED:{facility:4,severity:`info`,msgId:`CSRF_TOKEN_VERIFIED`,message:`CSRF token verification succeeded`},IDENTITY_VALIDATION_DISABLED:{facility:4,severity:`warning`,msgId:`IDENTITY_VALIDATION_DISABLED`,message:`Identity validation is disabled. User data will not be validated against a schema.`},IDENTITY_VALIDATION_FAILED:{facility:4,severity:`error`,msgId:`IDENTITY_VALIDATION_FAILED`,message:`User identity validation against the schema failed`},CREDENTIALS_SIGN_IN_SUCCESS:{facility:4,severity:`info`,msgId:`CREDENTIALS_SIGN_IN_SUCCESS`,message:`User successfully authenticated with credentials`},INVALID_CREDENTIALS:{facility:4,severity:`warning`,msgId:`INVALID_CREDENTIALS`,message:`Authentication failed due to invalid credentials`},CREDENTIALS_SIGN_IN_FAILED:{facility:4,severity:`error`,msgId:`CREDENTIALS_SIGN_IN_FAILED`,message:`An error occurred during credentials sign-in`}},n=(e,n)=>({...t[e],timestamp:new Date().toISOString(),hostname:`aura-auth`,...n}),r={debug:[`debug`,`info`,`notice`,`warning`,`error`,`critical`,`alert`,`emergency`],info:[`info`,`notice`,`warning`,`error`,`critical`,`alert`,`emergency`],warn:[`warning`,`error`,`critical`,`alert`,`emergency`],error:[`error`,`critical`,`alert`,`emergency`]},i=e=>e===`debug`||e===`info`||e===`warn`||e===`error`,a=e=>({emergency:0,alert:1,critical:2,error:3,warning:4,notice:5,info:6,debug:7})[e]??6,o=(e,t=`metadata`)=>{let n=Object.entries(e);return n.length===0?`[${t}]`:`[${t} ${n.map(([e,t])=>`${e}="${String(t).replace(/(["\\\]])/g,`\\$1`)}"`).join(` `)}]`},s=e=>{let{timestamp:t,hostname:n,appName:r=`aura-auth`,procId:i=`-`,msgId:s,structuredData:c,message:l}=e;return`<${(e.facility??16)*8+a(e.severity)}>1 ${t} ${n} ${r} ${i} ${s} ${o(c??{})} ${l}`},c=e=>{if(!e)return;let t=e.level,i=r[t]??[];return{level:t,log(t,r){let a=n(t,r);return i.includes(a.severity)&&e.log({timestamp:a.timestamp,appName:a.appName??`aura-auth`,hostname:a.hostname??`aura-auth`,...a}),a}}},l=t=>{let n=e.n(`LOG_LEVEL`),r=e.i(`DEBUG`);if(typeof t?.logger==`object`)return c({log:t.logger?.log||s,level:i(t.logger?.level)?t.logger?.level:i(n)?n:`error`});if(r||t?.logger===!0||n)return c({level:i(n)?n:`debug`,log:e=>{let t=s(e);console.log(t)}})};Object.defineProperty(exports,`n`,{enumerable:!0,get:function(){return s}}),Object.defineProperty(exports,`t`,{enumerable:!0,get:function(){return l}});
+const e=require(`./env-BhQ2k7jj.cjs`),t={ROUTER_INTERNAL_ERROR:{facility:10,severity:`error`,msgId:`ROUTER_INTERNAL_ERROR`,message:`Unhandled router error while processing the request`},INVALID_REQUEST:{facility:10,severity:`warning`,msgId:`INVALID_REQUEST`,message:`Request validation failed against the expected schema`},SERVER_ERROR:{facility:10,severity:`error`,msgId:`SERVER_ERROR`,message:`Unexpected internal server error during authentication`},OAUTH_PROTOCOL_ERROR:{facility:10,severity:`warning`,msgId:`OAUTH_PROTOCOL_ERROR`,message:`OAuth provider returned an invalid or unexpected protocol response`},OAUTH_AUTHORIZATION_ERROR:{facility:10,severity:`error`,msgId:`OAUTH_AUTHORIZATION_ERROR`,message:`OAuth authorization request was rejected or failed`},INVALID_OAUTH_CONFIGURATION:{facility:10,severity:`error`,msgId:`INVALID_OAUTH_CONFIGURATION`,message:`The OAuth provider configuration is invalid or incomplete`},OAUTH_ACCESS_TOKEN_REQUEST_INITIATED:{facility:10,severity:`debug`,msgId:`OAUTH_ACCESS_TOKEN_REQUEST_INITIATED`,message:`Starting OAuth access token request to the provider`},INVALID_OAUTH_ACCESS_TOKEN_RESPONSE:{facility:10,severity:`error`,msgId:`INVALID_OAUTH_ACCESS_TOKEN_RESPONSE`,message:`OAuth access token endpoint returned an invalid or malformed response`},OAUTH_ACCESS_TOKEN_ERROR:{facility:10,severity:`error`,msgId:`OAUTH_ACCESS_TOKEN_ERROR`,message:`OAuth access token endpoint returned an error response`},OAUTH_ACCESS_TOKEN_SUCCESS:{facility:10,severity:`info`,msgId:`OAUTH_ACCESS_TOKEN_SUCCESS`,message:`Successfully retrieved OAuth access token from the provider`},OAUTH_ACCESS_TOKEN_REQUEST_FAILED:{facility:10,severity:`error`,msgId:`OAUTH_ACCESS_TOKEN_REQUEST_FAILED`,message:`Network or server error while requesting OAuth access token`},OAUTH_USERINFO_REQUEST_INITIATED:{facility:10,severity:`debug`,msgId:`OAUTH_USERINFO_REQUEST_INITIATED`,message:`Starting OAuth userinfo request to the provider`},OAUTH_USERINFO_INVALID_RESPONSE:{facility:10,severity:`error`,msgId:`OAUTH_USERINFO_INVALID_RESPONSE`,message:`OAuth userinfo endpoint returned an invalid or malformed response`},OAUTH_USERINFO_ERROR:{facility:10,severity:`error`,msgId:`OAUTH_USERINFO_ERROR`,message:`OAuth userinfo endpoint returned an error response`},OAUTH_USERINFO_SUCCESS:{facility:10,severity:`info`,msgId:`OAUTH_USERINFO_SUCCESS`,message:`Successfully retrieved user information from the OAuth provider`},OAUTH_USERINFO_REQUEST_FAILED:{facility:10,severity:`error`,msgId:`OAUTH_USERINFO_REQUEST_FAILED`,message:`Network or server error while requesting user information from the OAuth provider`},OAUTH_CALLBACK_SUCCESS:{facility:4,severity:`info`,msgId:`OAUTH_CALLBACK_SUCCESS`,message:`OAuth callback completed successfully and session was created`},MISMATCHING_STATE:{facility:4,severity:`critical`,msgId:`MISMATCHING_STATE`,message:`OAuth response state parameter does not match the stored state value`},POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED:{facility:4,severity:`critical`,msgId:`POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED`,message:`Blocked redirect to untrusted or external URL (potential open redirect attack)`},OPEN_REDIRECT_ATTACK:{facility:4,severity:`warning`,msgId:`OPEN_REDIRECT_ATTACK`,message:`Detected redirect target that does not match the trusted origin`},SESSION_TOKEN_MISSING:{facility:4,severity:`warning`,msgId:`SESSION_TOKEN_MISSING`,message:`Session cookie is missing from the request`},CSRF_TOKEN_MISSING:{facility:4,severity:`warning`,msgId:`CSRF_TOKEN_MISSING`,message:`CSRF token cookie is missing from the request`},CSRF_HEADER_MISSING:{facility:4,severity:`warning`,msgId:`CSRF_HEADER_MISSING`,message:`CSRF header is missing from the request`},CSRF_TOKEN_INVALID:{facility:4,severity:`error`,msgId:`CSRF_TOKEN_INVALID`,message:`CSRF token verification failed or token is invalid`},SIGN_IN_INITIATED:{facility:4,severity:`info`,msgId:`SIGN_IN_INITIATED`,message:`Starting OAuth sign-in flow for the selected provider`},SIGN_OUT_ATTEMPT:{facility:4,severity:`debug`,msgId:`SIGN_OUT_ATTEMPT`,message:`Received sign-out request from client`},SIGN_OUT_CSRF_VERIFIED:{facility:4,severity:`info`,msgId:`SIGN_OUT_CSRF_VERIFIED`,message:`CSRF token was successfully verified during sign-out`},SIGN_OUT_SUCCESS:{facility:4,severity:`info`,msgId:`SIGN_OUT_SUCCESS`,message:`User session was cleared and sign-out completed successfully`},SIGN_OUT_REDIRECT:{facility:4,severity:`debug`,msgId:`SIGN_OUT_REDIRECT`,message:`Redirecting client after successful sign-out`},AUTH_SESSION_VALID:{facility:4,severity:`info`,msgId:`AUTH_SESSION_VALID`,message:`Session token is valid and user session was returned`},AUTH_SESSION_INVALID:{facility:4,severity:`notice`,msgId:`AUTH_SESSION_INVALID`,message:`Session token is missing, expired, or invalid`},INVALID_JWT_TOKEN:{facility:4,severity:`warning`,msgId:`INVALID_JWT_TOKEN`,message:`JWT session token failed validation during sign-out`},CSRF_TOKEN_REQUESTED:{facility:4,severity:`debug`,msgId:`CSRF_TOKEN_REQUESTED`,message:`Client requested a CSRF token`},CSRF_TOKEN_ISSUED:{facility:4,severity:`debug`,msgId:`CSRF_TOKEN_ISSUED`,message:`Issued a new CSRF token to the client`},INVALID_URL:{facility:10,severity:`error`,msgId:`INVALID_URL`,message:`Derived origin URL is invalid or malformed`},COOKIE_HTTPONLY_DISABLED:{facility:10,severity:`critical`,msgId:`COOKIE_HTTPONLY_DISABLED`,message:`Cookie is configured without HttpOnly. This allows JavaScript access via document.cookie and increases XSS exposure.`},COOKIE_WILDCARD_DOMAIN:{facility:10,severity:`critical`,msgId:`COOKIE_WILDCARD_DOMAIN`,message:`Cookie 'Domain' is set to a wildcard, which is insecure and should be avoided.`},COOKIE_SECURE_DISABLED:{facility:10,severity:`warning`,msgId:`COOKIE_SECURE_DISABLED`,message:`Cookie is configured with 'Secure' but the request is not HTTPS. The 'Secure' attribute will be ignored by the browser.`},COOKIE_SAMESITE_NONE_WITHOUT_SECURE:{facility:10,severity:`warning`,msgId:`COOKIE_SAMESITE_NONE_WITHOUT_SECURE`,message:`Cookie uses SameSite=None without Secure. Falling back to SameSite=Lax for safer defaults.`},COOKIE_INSECURE_IN_PRODUCTION:{facility:10,severity:`critical`,msgId:`COOKIE_INSECURE_IN_PRODUCTION`,message:`Cookies are being served over an insecure connection in production, which is a serious security risk.`},COOKIE_HOST_STRATEGY_INSECURE:{facility:10,severity:`critical`,msgId:`COOKIE_HOST_STRATEGY_INSECURE`,message:`__Host- cookies require a secure HTTPS context. Falling back to standard cookie settings.`},UNTRUSTED_ORIGIN:{facility:10,severity:`error`,msgId:`UNTRUSTED_ORIGIN`,message:`The constructed origin URL is not trusted.`},SESSION_REFRESHED:{facility:4,severity:`info`,msgId:`SESSION_REFRESHED`,message:`User session was refreshed with a new expiration time`},AUTH_SECURITY_ERROR:{facility:10,severity:`error`,msgId:`AUTH_SECURITY_ERROR`,message:`An authentication security error occurred`},CSRF_TOKEN_VERIFIED:{facility:4,severity:`info`,msgId:`CSRF_TOKEN_VERIFIED`,message:`CSRF token verification succeeded`},IDENTITY_VALIDATION_DISABLED:{facility:4,severity:`warning`,msgId:`IDENTITY_VALIDATION_DISABLED`,message:`Identity validation is disabled. User data will not be validated against a schema.`},IDENTITY_VALIDATION_FAILED:{facility:4,severity:`error`,msgId:`IDENTITY_VALIDATION_FAILED`,message:`User identity validation against the schema failed`},CREDENTIALS_SIGN_IN_SUCCESS:{facility:4,severity:`info`,msgId:`CREDENTIALS_SIGN_IN_SUCCESS`,message:`User successfully authenticated with credentials`},INVALID_CREDENTIALS:{facility:4,severity:`warning`,msgId:`INVALID_CREDENTIALS`,message:`Authentication failed due to invalid credentials`},CREDENTIALS_SIGN_IN_FAILED:{facility:4,severity:`error`,msgId:`CREDENTIALS_SIGN_IN_FAILED`,message:`An error occurred during credentials sign-in`},SIGN_UP_SUCCESS:{facility:4,severity:`info`,msgId:`SIGN_UP_SUCCESS`,message:`User successfully signed up and authenticated`},SESSION_NOT_FOUND:{facility:4,severity:`error`,msgId:`SESSION_NOT_FOUND`,message:`Session token was not found in the request cookies`},OAUTH_INVALID_CONTENT_TYPE:{facility:10,severity:`error`,msgId:`OAUTH_INVALID_CONTENT_TYPE`,message:`OAuth endpoint returned an invalid Content-Type header`},SIGN_IN_PROVIDER_TYPE_DETECTED:{facility:4,severity:`info`,msgId:`SIGN_IN_PROVIDER_TYPE_DETECTED`,message:`Detected OAuth provider type (OIDC or standard)`},OIDC_PROVIDER_RESOLVED:{facility:4,severity:`info`,msgId:`OIDC_PROVIDER_RESOLVED`,message:`OIDC provider configuration resolved successfully`}},n=(e,n)=>({...t[e],timestamp:new Date().toISOString(),hostname:`aura-auth`,...n}),r={debug:[`debug`,`info`,`notice`,`warning`,`error`,`critical`,`alert`,`emergency`],info:[`info`,`notice`,`warning`,`error`,`critical`,`alert`,`emergency`],warn:[`warning`,`error`,`critical`,`alert`,`emergency`],error:[`error`,`critical`,`alert`,`emergency`]},i=e=>e===`debug`||e===`info`||e===`warn`||e===`error`,a=e=>({emergency:0,alert:1,critical:2,error:3,warning:4,notice:5,info:6,debug:7})[e]??6,o=(e,t=`metadata`)=>{let n=Object.entries(e);return n.length===0?`[${t}]`:`[${t} ${n.map(([e,t])=>`${e}="${String(t).replace(/(["\\\]])/g,`\\$1`)}"`).join(` `)}]`},s=e=>{let{timestamp:t,hostname:n,appName:r=`aura-auth`,procId:i=`-`,msgId:s,structuredData:c,message:l}=e;return`<${(e.facility??16)*8+a(e.severity)}>1 ${t} ${n} ${r} ${i} ${s} ${o(c??{})} ${l}`},c=e=>{if(!e)return;let t=e.level,i=r[t]??[];return{level:t,log(t,r){let a=n(t,r);return i.includes(a.severity)&&e.log({timestamp:a.timestamp,appName:a.appName??`aura-auth`,hostname:a.hostname??`aura-auth`,...a}),a}}},l=t=>{let n=e.n(`LOG_LEVEL`),r=e.i(`DEBUG`);if(typeof t?.logger==`object`)return c({log:t.logger?.log||s,level:i(t.logger?.level)?t.logger?.level:i(n)?n:`error`});if(r||t?.logger===!0||n)return c({level:i(n)?n:`debug`,log:e=>{let t=s(e);console.log(t)}})};Object.defineProperty(exports,`n`,{enumerable:!0,get:function(){return s}}),Object.defineProperty(exports,`t`,{enumerable:!0,get:function(){return l}});

package/dist/oauth/atlassian.d.ts

@@ -1,2 +1,2 @@
-import { En as atlassian, Tn as ExtendedProfile, wn as AtlassianProfile } from "../index-1ADcIVGC.js";
+import { ar as atlassian, ir as ExtendedProfile, rr as AtlassianProfile } from "../index-DIcbmH1M.js";
 export { AtlassianProfile, ExtendedProfile, atlassian };

package/dist/oauth/authentik.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=e=>({id:`authentik`,name:`Authentik`,issuer:`https://authentik.company/application/o/:application_slug`,profile:e=>({sub:e.sub,name:e.given_name,email:e.email,image:null}),...e});exports.authentik=e;

package/dist/oauth/authentik.d.ts

@@ -0,0 +1,2 @@
+import { Bn as AuthentikProfile, Vn as authentik } from "../index-DIcbmH1M.js";
+export { AuthentikProfile, authentik };

package/dist/oauth/authentik.js

@@ -0,0 +1 @@
+const e=e=>({id:`authentik`,name:`Authentik`,issuer:`https://authentik.company/application/o/:application_slug`,profile:e=>({sub:e.sub,name:e.given_name,email:e.email,image:null}),...e});export{e as authentik};

package/dist/oauth/bitbucket.d.ts

@@ -1,2 +1,2 @@
-import { cr as BitbucketProfile, lr as bitbucket } from "../index-1ADcIVGC.js";
+import { Hr as bitbucket, Vr as BitbucketProfile } from "../index-DIcbmH1M.js";
 export { BitbucketProfile, bitbucket };

package/dist/oauth/click-up.d.ts

@@ -1,2 +1,2 @@
-import { Cn as clickUp, Sn as ClickUpProfile } from "../index-1ADcIVGC.js";
+import { nr as clickUp, tr as ClickUpProfile } from "../index-DIcbmH1M.js";
 export { ClickUpProfile, clickUp };

package/dist/oauth/discord.d.ts

@@ -1,2 +1,2 @@
-import { ar as discord, ir as Nameplate, rr as DiscordProfile } from "../index-1ADcIVGC.js";
+import { Ir as DiscordProfile, Lr as Nameplate, Rr as discord } from "../index-DIcbmH1M.js";
 export { DiscordProfile, Nameplate, discord };

package/dist/oauth/dribbble.d.ts

@@ -1,2 +1,2 @@
-import { bn as DribbbleTeams, vn as DribbbleDefault, xn as dribbble, yn as DribbbleProfile } from "../index-1ADcIVGC.js";
+import { $n as DribbbleTeams, Qn as DribbbleProfile, Zn as DribbbleDefault, er as dribbble } from "../index-DIcbmH1M.js";
 export { DribbbleDefault, DribbbleProfile, DribbbleTeams, dribbble };

package/dist/oauth/dropbox.d.ts

@@ -1,2 +1,2 @@
-import { An as Name, Dn as AccountType, Mn as dropbox, On as DropboxProfile, jn as RootInfo, kn as FullTeam } from "../index-1ADcIVGC.js";
+import { cr as FullTeam, dr as dropbox, lr as Name, or as AccountType, sr as DropboxProfile, ur as RootInfo } from "../index-DIcbmH1M.js";
 export { AccountType, DropboxProfile, FullTeam, Name, RootInfo, dropbox };

package/dist/oauth/figma.d.ts

@@ -1,2 +1,2 @@
-import { or as FigmaProfile, sr as figma } from "../index-1ADcIVGC.js";
+import { Br as figma, zr as FigmaProfile } from "../index-DIcbmH1M.js";
 export { FigmaProfile, figma };

package/dist/oauth/github.d.ts

@@ -1,2 +1,2 @@
-import { dr as github, ur as GitHubProfile } from "../index-1ADcIVGC.js";
+import { Ur as GitHubProfile, Wr as github } from "../index-DIcbmH1M.js";
 export { GitHubProfile, github };

package/dist/oauth/gitlab.d.ts

@@ -1,2 +1,2 @@
-import { nr as gitlab, tr as GitLabProfile } from "../index-1ADcIVGC.js";
+import { Fr as gitlab, Pr as GitLabProfile } from "../index-DIcbmH1M.js";
 export { GitLabProfile, gitlab };

package/dist/oauth/google.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=e=>({id:`google`,name:`Google`,issuer:`https://accounts.google.com`,profile:e=>({sub:e.sub,name:e.name,email:e.email,image:e.picture}),...e});exports.google=e;

package/dist/oauth/google.d.ts

@@ -0,0 +1,2 @@
+import { Kn as GoogleProfile, qn as google } from "../index-DIcbmH1M.js";
+export { GoogleProfile, google };

package/dist/oauth/google.js

@@ -0,0 +1 @@
+const e=e=>({id:`google`,name:`Google`,issuer:`https://accounts.google.com`,profile:e=>({sub:e.sub,name:e.name,email:e.email,image:e.picture}),...e});export{e as google};

package/dist/oauth/hubspot.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=e=>({id:`hubspot`,name:`HubSpot`,authorize:{url:`https://app.hubspot.com/oauth/authorize`,params:{scope:`oauth`}},accessToken:`https://api.hubapi.com/oauth/v1/token`,userInfo:{url:`https://api.hubapi.com/oauth/v1/access-tokens`,request:async({accessToken:e})=>await(await fetch(`https://api.hubapi.com/oauth/v1/access-tokens/${e}`)).json()},profile:e=>({sub:String(e.user_id),name:e.user,email:null,image:null}),...e});exports.hubspot=e;

package/dist/oauth/hubspot.d.ts

@@ -0,0 +1,2 @@
+import { Jn as HubSportSignedAccessToken, Xn as hubspot, Yn as HubSpotProfile } from "../index-DIcbmH1M.js";
+export { HubSportSignedAccessToken, HubSpotProfile, hubspot };

package/dist/oauth/hubspot.js

@@ -0,0 +1 @@
+const e=e=>({id:`hubspot`,name:`HubSpot`,authorize:{url:`https://app.hubspot.com/oauth/authorize`,params:{scope:`oauth`}},accessToken:`https://api.hubapi.com/oauth/v1/token`,userInfo:{url:`https://api.hubapi.com/oauth/v1/access-tokens`,request:async({accessToken:e})=>await(await fetch(`https://api.hubapi.com/oauth/v1/access-tokens/${e}`)).json()},profile:e=>({sub:String(e.user_id),name:e.user,email:null,image:null}),...e});export{e as hubspot};

package/dist/oauth/huggingface.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=e=>({id:`huggingface`,name:`Hugging Face`,issuer:`https://huggingface.co`,profile:e=>({sub:e.sub,name:e.name,email:e.email,image:e.picture}),...e});exports.huggingface=e;

package/dist/oauth/huggingface.d.ts

@@ -0,0 +1,2 @@
+import { Gn as huggingface, Hn as HuggingFaceOrg, Un as HuggingFaceProfile, Wn as HuggingFaceResourceGroup } from "../index-DIcbmH1M.js";
+export { HuggingFaceOrg, HuggingFaceProfile, HuggingFaceResourceGroup, huggingface };

package/dist/oauth/huggingface.js

@@ -0,0 +1 @@
+const e=e=>({id:`huggingface`,name:`Hugging Face`,issuer:`https://huggingface.co`,profile:e=>({sub:e.sub,name:e.name,email:e.email,image:e.picture}),...e});export{e as huggingface};

package/dist/oauth/index.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require(`../errors-DcK2ELlk.cjs`),t=require(`../env-BhQ2k7jj.cjs`),n=require(`../assert-DaZSf4SH.cjs`),r=require(`../@types/index.cjs`),i=require(`./github.cjs`),a=require(`./bitbucket.cjs`),o=require(`./figma.cjs`),s=require(`./discord.cjs`),c=require(`./gitlab.cjs`),l=require(`./spotify.cjs`),u=require(`./x.cjs`),d=require(`./strava.cjs`),f=require(`./mailchimp.cjs`),p=require(`./pinterest.cjs`),m=require(`./twitch.cjs`),h=require(`./notion.cjs`),g=require(`./dropbox.cjs`),_=require(`./atlassian.cjs`),v=require(`./click-up.cjs`),y=require(`./dribbble.cjs`),b={github:i.github,bitbucket:a.bitbucket,figma:o.figma,discord:s.discord,gitlab:c.gitlab,spotify:l.spotify,x:u.x,strava:d.strava,mailchimp:f.mailchimp,pinterest:p.pinterest,twitch:m.twitch,notion:h.notion,dropbox:g.dropbox,atlassian:_.atlassian,clickUp:v.clickUp,dribbble:y.dribbble},x=i=>{let a=r.o.safeParse({clientId:t.n(`${i.replace(`-`,`_`).toUpperCase()}_CLIENT_ID`),clientSecret:t.n(`${i.replace(`-`,`_`).toUpperCase()}_CLIENT_SECRET`)});if(!a.success)throw new e.n(`INVALID_ENVIRONMENT_CONFIGURATION`,JSON.stringify({[i]:n.T(a.error)},null,2));return a.data},S=t=>{if(typeof t==`string`){let i=x(t),a=b[t](),o=r.c.safeParse({...a,...i});if(!o.success)throw new e.n(`INVALID_OAUTH_PROVIDER_CONFIGURATION`,`Invalid configuration for OAuth provider "${t}": ${JSON.stringify({[t]:n.T(o.error)},null,2)}`);return o.data}let i=t.clientId&&t.clientSecret?{}:x(t.id),a=r.c.safeParse({...i,...t});if(!a.success){let r=JSON.stringify({[t.id]:n.T(a.error)},null,2);throw new e.n(`INVALID_OAUTH_PROVIDER_CONFIGURATION`,`Invalid configuration for OAuth provider "${t.id}": ${r}`)}return a.data},C=(t=[])=>t.reduce((t,n)=>{let r=S(n);if(r.id in t)throw new e.n(`DUPLICATED_OAUTH_PROVIDER_ID`,`Duplicate OAuth provider id "${r.id}" found. Each provider must have a unique id.`);return{...t,[r.id]:r}},{});exports.atlassian=_.atlassian,exports.bitbucket=a.bitbucket,exports.builtInOAuthProviders=b,exports.clickUp=v.clickUp,exports.createBuiltInOAuthProviders=C,exports.discord=s.discord,exports.dribbble=y.dribbble,exports.dropbox=g.dropbox,exports.figma=o.figma,exports.github=i.github,exports.gitlab=c.gitlab,exports.mailchimp=f.mailchimp,exports.notion=h.notion,exports.pinterest=p.pinterest,exports.spotify=l.spotify,exports.strava=d.strava,exports.twitch=m.twitch,exports.x=u.x;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require(`../resolve-provider-C_clBCRg.cjs`),t=require(`./github.cjs`),n=require(`./bitbucket.cjs`),r=require(`./figma.cjs`),i=require(`./discord.cjs`),a=require(`./gitlab.cjs`),o=require(`./spotify.cjs`),s=require(`./x.cjs`),c=require(`./strava.cjs`),l=require(`./mailchimp.cjs`),u=require(`./pinterest.cjs`),d=require(`./twitch.cjs`),f=require(`./notion.cjs`),p=require(`./dropbox.cjs`),m=require(`./atlassian.cjs`),h=require(`./click-up.cjs`),g=require(`./dribbble.cjs`),_=require(`./hubspot.cjs`),v=require(`./google.cjs`),y=require(`./huggingface.cjs`),b=require(`./authentik.cjs`);exports.atlassian=m.atlassian,exports.authentik=b.authentik,exports.bitbucket=n.bitbucket,exports.builtInOAuthProviders=e.r,exports.clickUp=h.clickUp,exports.createBuiltInOAuthProviders=e.i,exports.defineOpenIDProviderConfig=e.a,exports.discord=i.discord,exports.dribbble=g.dribbble,exports.dropbox=p.dropbox,exports.figma=r.figma,exports.github=t.github,exports.gitlab=a.gitlab,exports.google=v.google,exports.hubspot=_.hubspot,exports.huggingface=y.huggingface,exports.mailchimp=l.mailchimp,exports.notion=f.notion,exports.pinterest=u.pinterest,exports.setDynamicParams=e.o,exports.spotify=o.spotify,exports.strava=c.strava,exports.twitch=d.twitch,exports.x=s.x;

package/dist/oauth/index.d.ts

@@ -1,2 +1,2 @@
-import { $n as SpotifyProfile, An as Name, Bn as twitch, Cn as clickUp, Dn as AccountType, En as atlassian, Fn as NotionUser, Gn as mailchimp, Hn as pinterest, In as Owner, Jn as SummaryGear, Kn as StravaProfile, Ln as Person, Mn as dropbox, Nn as Bot, On as DropboxProfile, Pn as NotionProfile, Qn as SpotifyImage, Rn as notion, Sn as ClickUpProfile, Tn as ExtendedProfile, Un as Login, Vn as PinterestProfile, Wn as MailchimpProfile, Xn as XProfile, Yn as strava, Zn as x, _n as createBuiltInOAuthProviders, ar as discord, bn as DribbbleTeams, cr as BitbucketProfile, dr as github, er as spotify, gn as builtInOAuthProviders, hn as BuiltInOAuthProvider, ir as Nameplate, jn as RootInfo, kn as FullTeam, lr as bitbucket, nr as gitlab, or as FigmaProfile, qn as SummaryClub, rr as DiscordProfile, sr as figma, tr as GitLabProfile, ur as GitHubProfile, vn as DribbbleDefault, wn as AtlassianProfile, xn as dribbble, yn as DribbbleProfile, zn as TwitchProfile } from "../index-1ADcIVGC.js";
-export { AccountType, AtlassianProfile, BitbucketProfile, Bot, BuiltInOAuthProvider, ClickUpProfile, DiscordProfile, DribbbleDefault, DribbbleProfile, DribbbleTeams, DropboxProfile, ExtendedProfile, FigmaProfile, FullTeam, GitHubProfile, GitLabProfile, Login, MailchimpProfile, Name, Nameplate, NotionProfile, NotionUser, Owner, Person, PinterestProfile, RootInfo, SpotifyImage, SpotifyProfile, StravaProfile, SummaryClub, SummaryGear, TwitchProfile, XProfile, atlassian, bitbucket, builtInOAuthProviders, clickUp, createBuiltInOAuthProviders, discord, dribbble, dropbox, figma, github, gitlab, mailchimp, notion, pinterest, spotify, strava, twitch, x };
+import { $n as DribbbleTeams, Ar as x, Bn as AuthentikProfile, Br as figma, Cr as MailchimpProfile, Dr as SummaryGear, Er as SummaryClub, Fr as gitlab, Gn as huggingface, Hn as HuggingFaceOrg, Hr as bitbucket, Ir as DiscordProfile, Jn as HubSportSignedAccessToken, Kn as GoogleProfile, Lr as Nameplate, Mr as SpotifyProfile, Nr as spotify, Or as strava, Pr as GitLabProfile, Qn as DribbbleProfile, Rr as discord, Sr as Login, Tr as StravaProfile, Un as HuggingFaceProfile, Ur as GitHubProfile, Vn as authentik, Vr as BitbucketProfile, Wn as HuggingFaceResourceGroup, Wr as github, Xn as hubspot, Yn as HubSpotProfile, Zn as DribbbleDefault, _r as notion, ar as atlassian, br as PinterestProfile, cr as FullTeam, dn as createBuiltInOAuthProviders, dr as dropbox, er as dribbble, fn as defineOpenIDProviderConfig, fr as Bot, gr as Person, hr as Owner, ir as ExtendedProfile, jr as SpotifyImage, kr as XProfile, ln as BuiltInOAuthProvider, lr as Name, mr as NotionUser, nr as clickUp, or as AccountType, pn as setDynamicParams, pr as NotionProfile, qn as google, rr as AtlassianProfile, sr as DropboxProfile, tr as ClickUpProfile, un as builtInOAuthProviders, ur as RootInfo, vr as TwitchProfile, wr as mailchimp, xr as pinterest, yr as twitch, zr as FigmaProfile } from "../index-DIcbmH1M.js";
+export { AccountType, AtlassianProfile, AuthentikProfile, BitbucketProfile, Bot, BuiltInOAuthProvider, ClickUpProfile, DiscordProfile, DribbbleDefault, DribbbleProfile, DribbbleTeams, DropboxProfile, ExtendedProfile, FigmaProfile, FullTeam, GitHubProfile, GitLabProfile, GoogleProfile, HubSportSignedAccessToken, HubSpotProfile, HuggingFaceOrg, HuggingFaceProfile, HuggingFaceResourceGroup, Login, MailchimpProfile, Name, Nameplate, NotionProfile, NotionUser, Owner, Person, PinterestProfile, RootInfo, SpotifyImage, SpotifyProfile, StravaProfile, SummaryClub, SummaryGear, TwitchProfile, XProfile, atlassian, authentik, bitbucket, builtInOAuthProviders, clickUp, createBuiltInOAuthProviders, defineOpenIDProviderConfig, discord, dribbble, dropbox, figma, github, gitlab, google, hubspot, huggingface, mailchimp, notion, pinterest, setDynamicParams, spotify, strava, twitch, x };

package/dist/oauth/index.js

@@ -1 +1 @@
-import{n as e}from"../errors-Czt_w1t_.js";import{n as t}from"../env-BG1x-kSX.js";import{T as n}from"../assert-av6s0a6t.js";import{c as r,o as i}from"../@types/index.js";import{github as a}from"./github.js";import{bitbucket as o}from"./bitbucket.js";import{figma as s}from"./figma.js";import{discord as c}from"./discord.js";import{gitlab as l}from"./gitlab.js";import{spotify as u}from"./spotify.js";import{x as d}from"./x.js";import{strava as f}from"./strava.js";import{mailchimp as p}from"./mailchimp.js";import{pinterest as m}from"./pinterest.js";import{twitch as h}from"./twitch.js";import{notion as g}from"./notion.js";import{dropbox as _}from"./dropbox.js";import{atlassian as v}from"./atlassian.js";import{clickUp as y}from"./click-up.js";import{dribbble as b}from"./dribbble.js";const x={github:a,bitbucket:o,figma:s,discord:c,gitlab:l,spotify:u,x:d,strava:f,mailchimp:p,pinterest:m,twitch:h,notion:g,dropbox:_,atlassian:v,clickUp:y,dribbble:b},S=r=>{let a=i.safeParse({clientId:t(`${r.replace(`-`,`_`).toUpperCase()}_CLIENT_ID`),clientSecret:t(`${r.replace(`-`,`_`).toUpperCase()}_CLIENT_SECRET`)});if(!a.success)throw new e(`INVALID_ENVIRONMENT_CONFIGURATION`,JSON.stringify({[r]:n(a.error)},null,2));return a.data},C=t=>{if(typeof t==`string`){let i=S(t),a=x[t](),o=r.safeParse({...a,...i});if(!o.success)throw new e(`INVALID_OAUTH_PROVIDER_CONFIGURATION`,`Invalid configuration for OAuth provider "${t}": ${JSON.stringify({[t]:n(o.error)},null,2)}`);return o.data}let i=t.clientId&&t.clientSecret?{}:S(t.id),a=r.safeParse({...i,...t});if(!a.success){let r=JSON.stringify({[t.id]:n(a.error)},null,2);throw new e(`INVALID_OAUTH_PROVIDER_CONFIGURATION`,`Invalid configuration for OAuth provider "${t.id}": ${r}`)}return a.data},w=(t=[])=>t.reduce((t,n)=>{let r=C(n);if(r.id in t)throw new e(`DUPLICATED_OAUTH_PROVIDER_ID`,`Duplicate OAuth provider id "${r.id}" found. Each provider must have a unique id.`);return{...t,[r.id]:r}},{});export{v as atlassian,o as bitbucket,x as builtInOAuthProviders,y as clickUp,w as createBuiltInOAuthProviders,c as discord,b as dribbble,_ as dropbox,s as figma,a as github,l as gitlab,p as mailchimp,g as notion,m as pinterest,u as spotify,f as strava,h as twitch,d as x};
+import{a as e,i as t,o as n,r}from"../resolve-provider-CaDu98x6.js";import{github as i}from"./github.js";import{bitbucket as a}from"./bitbucket.js";import{figma as o}from"./figma.js";import{discord as s}from"./discord.js";import{gitlab as c}from"./gitlab.js";import{spotify as l}from"./spotify.js";import{x as u}from"./x.js";import{strava as d}from"./strava.js";import{mailchimp as f}from"./mailchimp.js";import{pinterest as p}from"./pinterest.js";import{twitch as m}from"./twitch.js";import{notion as h}from"./notion.js";import{dropbox as g}from"./dropbox.js";import{atlassian as _}from"./atlassian.js";import{clickUp as v}from"./click-up.js";import{dribbble as y}from"./dribbble.js";import{hubspot as b}from"./hubspot.js";import{google as x}from"./google.js";import{huggingface as S}from"./huggingface.js";import{authentik as C}from"./authentik.js";export{_ as atlassian,C as authentik,a as bitbucket,r as builtInOAuthProviders,v as clickUp,t as createBuiltInOAuthProviders,e as defineOpenIDProviderConfig,s as discord,y as dribbble,g as dropbox,o as figma,i as github,c as gitlab,x as google,b as hubspot,S as huggingface,f as mailchimp,h as notion,p as pinterest,n as setDynamicParams,l as spotify,d as strava,m as twitch,u as x};

package/dist/oauth/mailchimp.d.ts

@@ -1,2 +1,2 @@
-import { Gn as mailchimp, Un as Login, Wn as MailchimpProfile } from "../index-1ADcIVGC.js";
+import { Cr as MailchimpProfile, Sr as Login, wr as mailchimp } from "../index-DIcbmH1M.js";
 export { Login, MailchimpProfile, mailchimp };

package/dist/oauth/notion.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require(`../assert-DaZSf4SH.cjs`),t=t=>({id:`notion`,name:`Notion`,authorize:{url:`https://api.notion.com/v1/oauth/authorize`,params:{owner:`user`,scope:`user:read`,responseType:`code`}},accessToken:{url:`https://api.notion.com/v1/oauth/token`,headers:{Authorization:e.S(t?.clientId??`NOTION_CLIENT_ID`,t?.clientSecret??`NOTION_CLIENT_SECRET`)}},userInfo:{url:`https://api.notion.com/v1/users/me`,headers:{"Notion-Version":`2022-06-28`}},profile:e=>({sub:e.id,name:e.name,image:e.avatar_url??``,email:e?.bot?.owner?.user?.person?.email}),...t});exports.notion=t;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require(`../crypto-Da-Q8hsP.cjs`),t=t=>({id:`notion`,name:`Notion`,authorize:{url:`https://api.notion.com/v1/oauth/authorize`,params:{owner:`user`,scope:`user:read`,responseType:`code`}},accessToken:{url:`https://api.notion.com/v1/oauth/token`,headers:{Authorization:e.w(t?.clientId??`NOTION_CLIENT_ID`,t?.clientSecret??`NOTION_CLIENT_SECRET`)}},userInfo:{url:`https://api.notion.com/v1/users/me`,headers:{"Notion-Version":`2022-06-28`}},profile:e=>({sub:e.id,name:e.name,image:e.avatar_url??``,email:e?.bot?.owner?.user?.person?.email}),...t});exports.notion=t;

package/dist/oauth/notion.d.ts

@@ -1,2 +1,2 @@
-import { Fn as NotionUser, In as Owner, Ln as Person, Nn as Bot, Pn as NotionProfile, Rn as notion } from "../index-1ADcIVGC.js";
+import { _r as notion, fr as Bot, gr as Person, hr as Owner, mr as NotionUser, pr as NotionProfile } from "../index-DIcbmH1M.js";
 export { Bot, NotionProfile, NotionUser, Owner, Person, notion };

package/dist/oauth/notion.js

@@ -1 +1 @@
-import{S as e}from"../assert-av6s0a6t.js";const t=t=>({id:`notion`,name:`Notion`,authorize:{url:`https://api.notion.com/v1/oauth/authorize`,params:{owner:`user`,scope:`user:read`,responseType:`code`}},accessToken:{url:`https://api.notion.com/v1/oauth/token`,headers:{Authorization:e(t?.clientId??`NOTION_CLIENT_ID`,t?.clientSecret??`NOTION_CLIENT_SECRET`)}},userInfo:{url:`https://api.notion.com/v1/users/me`,headers:{"Notion-Version":`2022-06-28`}},profile:e=>({sub:e.id,name:e.name,image:e.avatar_url??``,email:e?.bot?.owner?.user?.person?.email}),...t});export{t as notion};
+import{T as e}from"../crypto-BRrGB5wn.js";const t=t=>({id:`notion`,name:`Notion`,authorize:{url:`https://api.notion.com/v1/oauth/authorize`,params:{owner:`user`,scope:`user:read`,responseType:`code`}},accessToken:{url:`https://api.notion.com/v1/oauth/token`,headers:{Authorization:e(t?.clientId??`NOTION_CLIENT_ID`,t?.clientSecret??`NOTION_CLIENT_SECRET`)}},userInfo:{url:`https://api.notion.com/v1/users/me`,headers:{"Notion-Version":`2022-06-28`}},profile:e=>({sub:e.id,name:e.name,image:e.avatar_url??``,email:e?.bot?.owner?.user?.person?.email}),...t});export{t as notion};

package/dist/oauth/pinterest.d.ts

@@ -1,2 +1,2 @@
-import { Hn as pinterest, Vn as PinterestProfile } from "../index-1ADcIVGC.js";
+import { br as PinterestProfile, xr as pinterest } from "../index-DIcbmH1M.js";
 export { PinterestProfile, pinterest };

package/dist/oauth/spotify.d.ts

@@ -1,2 +1,2 @@
-import { $n as SpotifyProfile, Qn as SpotifyImage, er as spotify } from "../index-1ADcIVGC.js";
+import { Mr as SpotifyProfile, Nr as spotify, jr as SpotifyImage } from "../index-DIcbmH1M.js";
 export { SpotifyImage, SpotifyProfile, spotify };