@cloudauth/core 0.1.0

package/dist/crypto.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Generate a cryptographically secure random session token (256-bit).
+ * Returns a base64url-encoded string.
+ */
+export declare function generateSessionToken(): string;
+/**
+ * Hash a session token using SHA-256.
+ * Returns a hex-encoded string for database storage.
+ */
+export declare function hashToken(token: string): Promise<string>;
+/**
+ * Generate a PKCE code verifier (64 random bytes, base64url encoded).
+ */
+export declare function generateCodeVerifier(): string;
+/**
+ * Generate an S256 PKCE code challenge from a code verifier.
+ */
+export declare function generateCodeChallenge(verifier: string): Promise<string>;
+/**
+ * Compare two strings in constant time to prevent timing attacks.
+ */
+export declare function constantTimeEqual(a: string, b: string): boolean;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAaA;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAI7C;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG9D;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAI7C;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG7E;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAS/D"}

package/dist/crypto.js

@@ -0,0 +1,57 @@
+function base64url(bytes) {
+    return btoa(String.fromCharCode(...bytes))
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/, '');
+}
+function hex(bytes) {
+    return Array.from(bytes)
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+/**
+ * Generate a cryptographically secure random session token (256-bit).
+ * Returns a base64url-encoded string.
+ */
+export function generateSessionToken() {
+    const bytes = new Uint8Array(32);
+    crypto.getRandomValues(bytes);
+    return base64url(bytes);
+}
+/**
+ * Hash a session token using SHA-256.
+ * Returns a hex-encoded string for database storage.
+ */
+export async function hashToken(token) {
+    const hash = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(token));
+    return hex(new Uint8Array(hash));
+}
+/**
+ * Generate a PKCE code verifier (64 random bytes, base64url encoded).
+ */
+export function generateCodeVerifier() {
+    const bytes = new Uint8Array(64);
+    crypto.getRandomValues(bytes);
+    return base64url(bytes);
+}
+/**
+ * Generate an S256 PKCE code challenge from a code verifier.
+ */
+export async function generateCodeChallenge(verifier) {
+    const hash = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
+    return base64url(new Uint8Array(hash));
+}
+/**
+ * Compare two strings in constant time to prevent timing attacks.
+ */
+export function constantTimeEqual(a, b) {
+    if (a.length !== b.length) {
+        return false;
+    }
+    let result = 0;
+    for (let i = 0; i < a.length; i++) {
+        result |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+    return result === 0;
+}
+//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,SAAS,SAAS,CAAC,KAAiB;IAClC,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC;SACvC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACvB,CAAC;AAED,SAAS,GAAG,CAAC,KAAiB;IAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IAChC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IAC7B,OAAO,SAAS,CAAC,KAAK,CAAC,CAAA;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa;IAC3C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IACnF,OAAO,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;AAClC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IAChC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IAC7B,OAAO,SAAS,CAAC,KAAK,CAAC,CAAA;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,QAAgB;IAC1D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;IACtF,OAAO,SAAS,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACpD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAC7C,CAAC;IACD,OAAO,MAAM,KAAK,CAAC,CAAA;AACrB,CAAC"}

package/dist/csrf.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Validate that a request's Origin or Referer header matches a trusted origin.
+ * This is a basic CSRF protection for POST endpoints (logout, account linking).
+ */
+export declare function validateCsrf(request: Request, trustedOrigins: string[]): boolean;
+//# sourceMappingURL=csrf.d.ts.map

package/dist/csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAoBhF"}

package/dist/csrf.js

@@ -0,0 +1,24 @@
+import { isTrustedOrigin } from './url.js';
+/**
+ * Validate that a request's Origin or Referer header matches a trusted origin.
+ * This is a basic CSRF protection for POST endpoints (logout, account linking).
+ */
+export function validateCsrf(request, trustedOrigins) {
+    // Check Origin header first (more reliable)
+    const origin = request.headers.get('origin');
+    if (origin && isTrustedOrigin(origin, trustedOrigins)) {
+        return true;
+    }
+    // Fall back to Referer header
+    const referer = request.headers.get('referer');
+    if (referer && isTrustedOrigin(referer, trustedOrigins)) {
+        return true;
+    }
+    // If no Origin or Referer header, allow through (e.g., server-to-server)
+    // In production, this should be handled by SameSite cookies
+    if (!origin && !referer) {
+        return true;
+    }
+    return false;
+}
+//# sourceMappingURL=csrf.js.map

package/dist/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAE1C;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAgB,EAAE,cAAwB;IACrE,4CAA4C;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5C,IAAI,MAAM,IAAI,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,8BAA8B;IAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC9C,IAAI,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,CAAC;QACxD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,yEAAyE;IACzE,4DAA4D;IAC5D,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACxB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/encryption.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Encrypt a plaintext string using AES-256-GCM.
+ * Returns a base64url-encoded string containing salt + iv + ciphertext.
+ */
+export declare function encrypt(plaintext: string, secret: string): Promise<string>;
+/**
+ * Decrypt a base64url-encoded string that was encrypted with encrypt().
+ */
+export declare function decrypt(encoded: string, secret: string): Promise<string>;
+//# sourceMappingURL=encryption.d.ts.map

package/dist/encryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../src/encryption.ts"],"names":[],"mappings":"AA+BA;;;GAGG;AACH,wBAAsB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBhF;AAED;;GAEG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAW9E"}

package/dist/encryption.js

@@ -0,0 +1,61 @@
+const ALGORITHM = 'AES-GCM';
+const KEY_LENGTH = 256;
+const IV_LENGTH = 12;
+/**
+ * Derive an AES-256-GCM key from a secret using PBKDF2.
+ * This allows using any string as the encryption key.
+ */
+async function deriveKey(secret, salt) {
+    const keyMaterial = await crypto.subtle.importKey('raw', new TextEncoder().encode(secret), 'PBKDF2', false, ['deriveKey']);
+    return crypto.subtle.deriveKey({
+        name: 'PBKDF2',
+        salt,
+        iterations: 100_000,
+        hash: 'SHA-256',
+    }, keyMaterial, { name: ALGORITHM, length: KEY_LENGTH }, false, ['encrypt', 'decrypt']);
+}
+/**
+ * Encrypt a plaintext string using AES-256-GCM.
+ * Returns a base64url-encoded string containing salt + iv + ciphertext.
+ */
+export async function encrypt(plaintext, secret) {
+    const salt = crypto.getRandomValues(new Uint8Array(16));
+    const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));
+    const key = await deriveKey(secret, salt);
+    const ciphertext = await crypto.subtle.encrypt({ name: ALGORITHM, iv }, key, new TextEncoder().encode(plaintext));
+    // Combine salt + iv + ciphertext into a single base64url string
+    const combined = new Uint8Array(salt.length + iv.length + ciphertext.byteLength);
+    combined.set(salt, 0);
+    combined.set(iv, salt.length);
+    combined.set(new Uint8Array(ciphertext), salt.length + iv.length);
+    return base64url(combined);
+}
+/**
+ * Decrypt a base64url-encoded string that was encrypted with encrypt().
+ */
+export async function decrypt(encoded, secret) {
+    const combined = base64urlDecode(encoded);
+    const salt = combined.slice(0, 16);
+    const iv = combined.slice(16, 16 + IV_LENGTH);
+    const ciphertext = combined.slice(16 + IV_LENGTH);
+    const key = await deriveKey(secret, salt);
+    const plaintext = await crypto.subtle.decrypt({ name: ALGORITHM, iv }, key, ciphertext);
+    return new TextDecoder().decode(plaintext);
+}
+function base64url(bytes) {
+    return btoa(String.fromCharCode(...bytes))
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/, '');
+}
+function base64urlDecode(str) {
+    const base64 = str.replace(/-/g, '+').replace(/_/g, '/');
+    const padding = base64.length % 4 === 0 ? '' : '='.repeat(4 - (base64.length % 4));
+    const binary = atob(base64 + padding);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+//# sourceMappingURL=encryption.js.map

package/dist/encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.js","sourceRoot":"","sources":["../src/encryption.ts"],"names":[],"mappings":"AAAA,MAAM,SAAS,GAAG,SAAS,CAAA;AAC3B,MAAM,UAAU,GAAG,GAAG,CAAA;AACtB,MAAM,SAAS,GAAG,EAAE,CAAA;AAEpB;;;GAGG;AACH,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,IAAgB;IACvD,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC/C,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,QAAQ,EACR,KAAK,EACL,CAAC,WAAW,CAAC,CACd,CAAA;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B;QACE,IAAI,EAAE,QAAQ;QACd,IAAI;QACJ,UAAU,EAAE,OAAO;QACnB,IAAI,EAAE,SAAS;KAChB,EACD,WAAW,EACX,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,EACvC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,SAAiB,EAAE,MAAc;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IACvD,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;IAC5D,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAEzC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EACvB,GAAG,EACH,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CACpC,CAAA;IAED,gEAAgE;IAChE,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAA;IAChF,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAC7B,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,CAAA;IAEjE,OAAO,SAAS,CAAC,QAAQ,CAAC,CAAA;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAe,EAAE,MAAc;IAC3D,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAClC,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,SAAS,CAAC,CAAA;IAC7C,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,SAAS,CAAC,CAAA;IAEjD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAEzC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAA;IAEvF,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;AAC5C,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC;SACvC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACvB,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACxD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAA;IAClF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,CAAA;IACrC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IACjC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,29 @@
+export declare class AuthError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export declare class OAuthCallbackError extends AuthError {
+    constructor(message: string, code?: string);
+}
+export declare class InvalidStateError extends AuthError {
+    constructor(message?: string);
+}
+export declare class ProviderProfileError extends AuthError {
+    constructor(message?: string);
+}
+export declare class ProviderUnreachableError extends AuthError {
+    constructor(message?: string);
+}
+export declare class AccountLinkingError extends AuthError {
+    constructor(message: string, code?: string);
+}
+export declare class SessionExpiredError extends AuthError {
+    constructor(message?: string);
+}
+export declare class UnauthorizedError extends AuthError {
+    constructor(message?: string);
+}
+export declare class ForbiddenCallbackURLError extends AuthError {
+    constructor(message?: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,SAAU,SAAQ,KAAK;IAClC,SAAgB,IAAI,EAAE,MAAM,CAAA;gBAEhB,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAED,qBAAa,kBAAmB,SAAQ,SAAS;gBACnC,OAAO,EAAE,MAAM,EAAE,IAAI,SAA0B;CAI5D;AAED,qBAAa,iBAAkB,SAAQ,SAAS;gBAClC,OAAO,SAAqD;CAIzE;AAED,qBAAa,oBAAqB,SAAQ,SAAS;gBACrC,OAAO,SAAqC;CAIzD;AAED,qBAAa,wBAAyB,SAAQ,SAAS;gBACzC,OAAO,SAAyC;CAI7D;AAED,qBAAa,mBAAoB,SAAQ,SAAS;gBACpC,OAAO,EAAE,MAAM,EAAE,IAAI,SAA2B;CAI7D;AAED,qBAAa,mBAAoB,SAAQ,SAAS;gBACpC,OAAO,SAAwB;CAI5C;AAED,qBAAa,iBAAkB,SAAQ,SAAS;gBAClC,OAAO,SAA4B;CAIhD;AAED,qBAAa,yBAA0B,SAAQ,SAAS;gBAC1C,OAAO,SAA2C;CAI/D"}

package/dist/errors.js

@@ -0,0 +1,57 @@
+export class AuthError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'AuthError';
+        this.code = code;
+    }
+}
+export class OAuthCallbackError extends AuthError {
+    constructor(message, code = 'OAUTH_CALLBACK_FAILED') {
+        super(code, message);
+        this.name = 'OAuthCallbackError';
+    }
+}
+export class InvalidStateError extends AuthError {
+    constructor(message = 'OAuth state is invalid, expired, or already used') {
+        super('INVALID_STATE', message);
+        this.name = 'InvalidStateError';
+    }
+}
+export class ProviderProfileError extends AuthError {
+    constructor(message = 'Failed to fetch provider profile') {
+        super('PROVIDER_PROFILE_FAILED', message);
+        this.name = 'ProviderProfileError';
+    }
+}
+export class ProviderUnreachableError extends AuthError {
+    constructor(message = 'Provider is unreachable or timed out') {
+        super('PROVIDER_UNREACHABLE', message);
+        this.name = 'ProviderUnreachableError';
+    }
+}
+export class AccountLinkingError extends AuthError {
+    constructor(message, code = 'ACCOUNT_LINKING_FAILED') {
+        super(code, message);
+        this.name = 'AccountLinkingError';
+    }
+}
+export class SessionExpiredError extends AuthError {
+    constructor(message = 'Session has expired') {
+        super('SESSION_EXPIRED', message);
+        this.name = 'SessionExpiredError';
+    }
+}
+export class UnauthorizedError extends AuthError {
+    constructor(message = 'Authentication required') {
+        super('UNAUTHORIZED', message);
+        this.name = 'UnauthorizedError';
+    }
+}
+export class ForbiddenCallbackURLError extends AuthError {
+    constructor(message = 'Callback URL is not in trusted origins') {
+        super('INVALID_CALLBACK_URL', message);
+        this.name = 'ForbiddenCallbackURLError';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClB,IAAI,CAAQ;IAE5B,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,WAAW,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,SAAS;IAC/C,YAAY,OAAe,EAAE,IAAI,GAAG,uBAAuB;QACzD,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACpB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;IAClC,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,SAAS;IAC9C,YAAY,OAAO,GAAG,kDAAkD;QACtE,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;QAC/B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAA;IACjC,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,SAAS;IACjD,YAAY,OAAO,GAAG,kCAAkC;QACtD,KAAK,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAA;QACzC,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;IACpC,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,SAAS;IACrD,YAAY,OAAO,GAAG,sCAAsC;QAC1D,KAAK,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAA;QACtC,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,SAAS;IAChD,YAAY,OAAe,EAAE,IAAI,GAAG,wBAAwB;QAC1D,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACpB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,SAAS;IAChD,YAAY,OAAO,GAAG,qBAAqB;QACzC,KAAK,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAA;QACjC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,SAAS;IAC9C,YAAY,OAAO,GAAG,yBAAyB;QAC7C,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,CAAA;QAC9B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAA;IACjC,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,SAAS;IACtD,YAAY,OAAO,GAAG,wCAAwC;QAC5D,KAAK,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAA;QACtC,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACzC,CAAC;CACF"}

package/dist/hooks.d.ts

@@ -0,0 +1,45 @@
+import type { User, Account, Session, ProviderProfile } from './types.js';
+import type { AuthAdapter } from './adapter.js';
+export interface HookContext {
+    adapter: AuthAdapter;
+    request?: Request;
+}
+export interface BeforeSignInCtx extends HookContext {
+    profile: ProviderProfile;
+}
+export interface AfterSignInCtx extends HookContext {
+    session: Session;
+    user: User;
+    profile: ProviderProfile;
+}
+export interface OnUserCreatedCtx extends HookContext {
+    user: User;
+}
+export interface OnAccountLinkedCtx extends HookContext {
+    account: Account;
+    user: User;
+}
+export interface BeforeSessionCreatedCtx extends HookContext {
+    user: User;
+}
+export interface AfterSessionCreatedCtx extends HookContext {
+    session: Session;
+    user: User;
+}
+export interface BeforeLogoutCtx extends HookContext {
+    session: Session;
+}
+export interface AfterLogoutCtx extends HookContext {
+    session: Session;
+}
+export interface HooksConfig {
+    beforeSignIn?: (ctx: BeforeSignInCtx) => Promise<void>;
+    afterSignIn?: (ctx: AfterSignInCtx) => Promise<void>;
+    onUserCreated?: (ctx: OnUserCreatedCtx) => Promise<void>;
+    onAccountLinked?: (ctx: OnAccountLinkedCtx) => Promise<void>;
+    beforeSessionCreated?: (ctx: BeforeSessionCreatedCtx) => Promise<void>;
+    afterSessionCreated?: (ctx: AfterSessionCreatedCtx) => Promise<void>;
+    beforeLogout?: (ctx: BeforeLogoutCtx) => Promise<void>;
+    afterLogout?: (ctx: AfterLogoutCtx) => Promise<void>;
+}
+//# sourceMappingURL=hooks.d.ts.map

package/dist/hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/C,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,WAAW,CAAA;IACpB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,eAAgB,SAAQ,WAAW;IAClD,OAAO,EAAE,eAAe,CAAA;CACzB;AAED,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,IAAI,CAAA;IACV,OAAO,EAAE,eAAe,CAAA;CACzB;AAED,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,IAAI,EAAE,IAAI,CAAA;CACX;AAED,MAAM,WAAW,kBAAmB,SAAQ,WAAW;IACrD,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,IAAI,CAAA;CACX;AAED,MAAM,WAAW,uBAAwB,SAAQ,WAAW;IAC1D,IAAI,EAAE,IAAI,CAAA;CACX;AAED,MAAM,WAAW,sBAAuB,SAAQ,WAAW;IACzD,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,IAAI,CAAA;CACX;AAED,MAAM,WAAW,eAAgB,SAAQ,WAAW;IAClD,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACtD,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACpD,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACxD,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5D,oBAAoB,CAAC,EAAE,CAAC,GAAG,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACtE,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,sBAAsB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACpE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACtD,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACrD"}

package/dist/hooks.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=hooks.js.map

package/dist/hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":""}

package/dist/http.d.ts

@@ -0,0 +1,23 @@
+import type { TokenSet, ProviderProfile } from './types.js';
+export interface ProviderHttpOptions {
+    timeout?: number;
+    retries?: number;
+    retryDelay?: number;
+}
+/**
+ * Exchange an authorization code for tokens at the provider's token endpoint.
+ * Uses POST with application/x-www-form-urlencoded body.
+ */
+export declare function exchangeCode(tokenEndpoint: string, params: {
+    clientId: string;
+    clientSecret: string;
+    code: string;
+    codeVerifier: string;
+    redirectUri: string;
+}, options?: ProviderHttpOptions): Promise<TokenSet>;
+/**
+ * Fetch a provider's user profile from the userinfo endpoint.
+ * The access token is sent as a Bearer token in the Authorization header.
+ */
+export declare function fetchProfile(userinfoEndpoint: string, accessToken: string, options?: ProviderHttpOptions): Promise<ProviderProfile>;
+//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAG3D,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AA2DD;;;GAGG;AACH,wBAAsB,YAAY,CAChC,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE;IACN,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;CACpB,EACD,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,QAAQ,CAAC,CAwDnB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,gBAAgB,EAAE,MAAM,EACxB,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,eAAe,CAAC,CA6C1B"}

package/dist/http.js

@@ -0,0 +1,126 @@
+import { ProviderUnreachableError, ProviderProfileError } from './errors.js';
+const DEFAULT_TIMEOUT = 10_000; // 10 seconds
+const DEFAULT_RETRIES = 0;
+const DEFAULT_RETRY_DELAY = 1_000; // 1 second
+async function fetchWithTimeout(url, options) {
+    const timeout = options.timeout ?? DEFAULT_TIMEOUT;
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => {
+        controller.abort();
+    }, timeout);
+    try {
+        const response = await fetch(url, {
+            ...options,
+            signal: controller.signal,
+        });
+        return response;
+    }
+    finally {
+        clearTimeout(timeoutId);
+    }
+}
+function isNetworkError(error) {
+    return (error instanceof TypeError || (error instanceof DOMException && error.name === 'AbortError'));
+}
+function sleep(ms) {
+    return new Promise((resolve) => {
+        setTimeout(resolve, ms);
+    });
+}
+/**
+ * Exchange an authorization code for tokens at the provider's token endpoint.
+ * Uses POST with application/x-www-form-urlencoded body.
+ */
+export async function exchangeCode(tokenEndpoint, params, options) {
+    const timeout = options?.timeout ?? DEFAULT_TIMEOUT;
+    const retries = options?.retries ?? DEFAULT_RETRIES;
+    const retryDelay = options?.retryDelay ?? DEFAULT_RETRY_DELAY;
+    const body = new URLSearchParams({
+        client_id: params.clientId,
+        client_secret: params.clientSecret,
+        code: params.code,
+        code_verifier: params.codeVerifier,
+        redirect_uri: params.redirectUri,
+        grant_type: 'authorization_code',
+    });
+    let lastError;
+    for (let attempt = 0; attempt <= retries; attempt++) {
+        try {
+            const response = await fetchWithTimeout(tokenEndpoint, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body,
+                timeout,
+            });
+            if (response.ok) {
+                const data = (await response.json());
+                return {
+                    accessToken: data.access_token ?? '',
+                    refreshToken: data.refresh_token,
+                    idToken: data.id_token,
+                    scope: data.scope,
+                    tokenType: data.token_type,
+                    expiresAt: data.expires_in,
+                };
+            }
+            // Non-retryable HTTP error
+            const errorBody = await response.text().catch(() => 'unknown error');
+            throw new ProviderUnreachableError(`Token endpoint returned ${String(response.status)}: ${errorBody}`);
+        }
+        catch (error) {
+            lastError = error;
+            // Only retry on network errors, not 4xx/5xx responses
+            if (isNetworkError(error) && attempt < retries) {
+                await sleep(retryDelay);
+                continue;
+            }
+            throw error;
+        }
+    }
+    throw lastError;
+}
+/**
+ * Fetch a provider's user profile from the userinfo endpoint.
+ * The access token is sent as a Bearer token in the Authorization header.
+ */
+export async function fetchProfile(userinfoEndpoint, accessToken, options) {
+    const timeout = options?.timeout ?? DEFAULT_TIMEOUT;
+    const retries = options?.retries ?? DEFAULT_RETRIES;
+    const retryDelay = options?.retryDelay ?? DEFAULT_RETRY_DELAY;
+    let lastError;
+    for (let attempt = 0; attempt <= retries; attempt++) {
+        try {
+            const response = await fetchWithTimeout(userinfoEndpoint, {
+                method: 'GET',
+                headers: {
+                    Authorization: `Bearer ${accessToken}`,
+                    Accept: 'application/json',
+                },
+                timeout,
+            });
+            if (response.ok) {
+                const data = (await response.json());
+                return {
+                    provider: data.provider ?? '',
+                    providerAccountId: data.sub ?? data.id ?? '',
+                    email: data.email,
+                    emailVerified: data.email_verified,
+                    name: data.name,
+                    image: data.picture,
+                    raw: data,
+                };
+            }
+            throw new ProviderProfileError(`Userinfo endpoint returned ${String(response.status)}`);
+        }
+        catch (error) {
+            lastError = error;
+            if (isNetworkError(error) && attempt < retries) {
+                await sleep(retryDelay);
+                continue;
+            }
+            throw error;
+        }
+    }
+    throw lastError;
+}
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAQ5E,MAAM,eAAe,GAAG,MAAM,CAAA,CAAC,aAAa;AAC5C,MAAM,eAAe,GAAG,CAAC,CAAA;AACzB,MAAM,mBAAmB,GAAG,KAAK,CAAA,CAAC,WAAW;AAsB7C,KAAK,UAAU,gBAAgB,CAC7B,GAAW,EACX,OAA2C;IAE3C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,eAAe,CAAA;IAClD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;QAChC,UAAU,CAAC,KAAK,EAAE,CAAA;IACpB,CAAC,EAAE,OAAO,CAAC,CAAA;IAEX,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,GAAG,OAAO;YACV,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAA;QACF,OAAO,QAAQ,CAAA;IACjB,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,SAAS,CAAC,CAAA;IACzB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,CACL,KAAK,YAAY,SAAS,IAAI,CAAC,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,CAC7F,CAAA;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,aAAqB,EACrB,MAMC,EACD,OAA6B;IAE7B,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,eAAe,CAAA;IACnD,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,eAAe,CAAA;IACnD,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,mBAAmB,CAAA;IAE7D,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,UAAU,EAAE,oBAAoB;KACjC,CAAC,CAAA;IAEF,IAAI,SAAkB,CAAA;IAEtB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,aAAa,EAAE;gBACrD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI;gBACJ,OAAO;aACR,CAAC,CAAA;YAEF,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAA;gBAC7D,OAAO;oBACL,WAAW,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;oBACpC,YAAY,EAAE,IAAI,CAAC,aAAa;oBAChC,OAAO,EAAE,IAAI,CAAC,QAAQ;oBACtB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,SAAS,EAAE,IAAI,CAAC,UAAU;oBAC1B,SAAS,EAAE,IAAI,CAAC,UAAU;iBAC3B,CAAA;YACH,CAAC;YAED,2BAA2B;YAC3B,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAA;YACpE,MAAM,IAAI,wBAAwB,CAChC,2BAA2B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CACnE,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAK,CAAA;YAEjB,sDAAsD;YACtD,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,OAAO,GAAG,OAAO,EAAE,CAAC;gBAC/C,MAAM,KAAK,CAAC,UAAU,CAAC,CAAA;gBACvB,SAAQ;YACV,CAAC;YAED,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAED,MAAM,SAAS,CAAA;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,gBAAwB,EACxB,WAAmB,EACnB,OAA6B;IAE7B,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,eAAe,CAAA;IACnD,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,eAAe,CAAA;IACnD,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,mBAAmB,CAAA;IAE7D,IAAI,SAAkB,CAAA;IAEtB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,EAAE;gBACxD,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,WAAW,EAAE;oBACtC,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,OAAO;aACR,CAAC,CAAA;YAEF,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqB,CAAA;gBACxD,OAAO;oBACL,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;oBAC7B,iBAAiB,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,IAAI,EAAE;oBAC5C,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,aAAa,EAAE,IAAI,CAAC,cAAc;oBAClC,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,KAAK,EAAE,IAAI,CAAC,OAAO;oBACnB,GAAG,EAAE,IAAI;iBACV,CAAA;YACH,CAAC;YAED,MAAM,IAAI,oBAAoB,CAAC,8BAA8B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACzF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAK,CAAA;YAEjB,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,OAAO,GAAG,OAAO,EAAE,CAAC;gBAC/C,MAAM,KAAK,CAAC,UAAU,CAAC,CAAA;gBACvB,SAAQ;YACV,CAAC;YAED,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAED,MAAM,SAAS,CAAA;AACjB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,23 @@
+export type { User, Account, Session, SessionWithUser, OAuthState, ProviderProfile, TokenSet, CreateUserInput, UpdateUserInput, CreateAccountInput, CreateSessionInput, UpdateSessionInput, CreateOAuthStateInput, } from './types.js';
+export type { AuthProvider, AuthorizationParams, ExchangeCodeParams } from './provider.js';
+export type { AuthAdapter } from './adapter.js';
+export { AuthError, OAuthCallbackError, InvalidStateError, ProviderProfileError, ProviderUnreachableError, AccountLinkingError, SessionExpiredError, UnauthorizedError, ForbiddenCallbackURLError, } from './errors.js';
+export type { AdditionalField, AdditionalFieldsConfig, StringField, BooleanField, NumberField, DateField, InferFieldType, InferAdditionalFields, InferTypes, } from './additional-fields.js';
+export type { HookContext, BeforeSignInCtx, AfterSignInCtx, OnUserCreatedCtx, OnAccountLinkedCtx, BeforeSessionCreatedCtx, AfterSessionCreatedCtx, BeforeLogoutCtx, AfterLogoutCtx, HooksConfig, } from './hooks.js';
+export type { SessionConfig, UserConfig, AccountLinkingConfig, SecurityConfig, AuthConfig, CloudAuthInstance, } from './config.js';
+export { generateSessionToken, hashToken, generateCodeVerifier, generateCodeChallenge, constantTimeEqual, } from './crypto.js';
+export { serializeCookie, parseCookie, signCookie, verifyCookie } from './cookies.js';
+export type { CookieOptions } from './cookies.js';
+export { isTrustedOrigin, buildCallbackURL } from './url.js';
+export { exchangeCode, fetchProfile } from './http.js';
+export type { ProviderHttpOptions } from './http.js';
+export { inMemoryRateLimiter, defaultRateLimits } from './rate-limiter.js';
+export type { RateLimiter, RateLimitResult } from './rate-limiter.js';
+export { validateCsrf } from './csrf.js';
+export { encrypt, decrypt } from './encryption.js';
+export { createAuthUrl, handleCallback, getSession as getSessionFromAuth, signOut as signOutFromAuth, } from './auth.js';
+export type { AuthResponse } from './auth.js';
+import type { AuthConfig, CloudAuthInstance } from './config.js';
+export declare function cloudAuth(config: AuthConfig): CloudAuthInstance;
+export declare const version = "0.0.1";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,IAAI,EACJ,OAAO,EACP,OAAO,EACP,eAAe,EACf,UAAU,EACV,eAAe,EACf,QAAQ,EACR,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,YAAY,CAAA;AAGnB,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAG1F,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAG/C,OAAO,EACL,SAAS,EACT,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,aAAa,CAAA;AAGpB,YAAY,EACV,eAAe,EACf,sBAAsB,EACtB,WAAW,EACX,YAAY,EACZ,WAAW,EACX,SAAS,EACT,cAAc,EACd,qBAAqB,EACrB,UAAU,GACX,MAAM,wBAAwB,CAAA;AAG/B,YAAY,EACV,WAAW,EACX,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,eAAe,EACf,cAAc,EACd,WAAW,GACZ,MAAM,YAAY,CAAA;AAGnB,YAAY,EACV,aAAa,EACb,UAAU,EACV,oBAAoB,EACpB,cAAc,EACd,UAAU,EACV,iBAAiB,GAClB,MAAM,aAAa,CAAA;AAGpB,OAAO,EACL,oBAAoB,EACpB,SAAS,EACT,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,aAAa,CAAA;AAGpB,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AACrF,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAGjD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAG5D,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACtD,YAAY,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAGpD,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC1E,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAGrE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAGxC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAGlD,OAAO,EACL,aAAa,EACb,cAAc,EACd,UAAU,IAAI,kBAAkB,EAChC,OAAO,IAAI,eAAe,GAC3B,MAAM,WAAW,CAAA;AAClB,YAAY,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAI7C,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAQhE,wBAAgB,SAAS,CAAC,MAAM,EAAE,UAAU,GAAG,iBAAiB,CAoC/D;AAED,eAAO,MAAM,OAAO,UAAU,CAAA"}

package/dist/index.js

@@ -0,0 +1,53 @@
+// Errors
+export { AuthError, OAuthCallbackError, InvalidStateError, ProviderProfileError, ProviderUnreachableError, AccountLinkingError, SessionExpiredError, UnauthorizedError, ForbiddenCallbackURLError, } from './errors.js';
+// Crypto utilities
+export { generateSessionToken, hashToken, generateCodeVerifier, generateCodeChallenge, constantTimeEqual, } from './crypto.js';
+// Cookie utilities
+export { serializeCookie, parseCookie, signCookie, verifyCookie } from './cookies.js';
+// URL utilities
+export { isTrustedOrigin, buildCallbackURL } from './url.js';
+// Provider HTTP client
+export { exchangeCode, fetchProfile } from './http.js';
+// Rate limiter
+export { inMemoryRateLimiter, defaultRateLimits } from './rate-limiter.js';
+// CSRF protection
+export { validateCsrf } from './csrf.js';
+// Token encryption
+export { encrypt, decrypt } from './encryption.js';
+// Auth engine
+export { createAuthUrl, handleCallback, getSession as getSessionFromAuth, signOut as signOutFromAuth, } from './auth.js';
+import { createAuthUrl, handleCallback, getSession as getSessionFromAuth, signOut as signOutFromAuth, } from './auth.js';
+export function cloudAuth(config) {
+    // Validate required config
+    if (!config.appName) {
+        throw new Error('cloudAuth: appName is required');
+    }
+    if (!config.baseURL) {
+        throw new Error('cloudAuth: baseURL is required');
+    }
+    /* eslint-disable @typescript-eslint/no-unnecessary-condition */
+    if (!config.providers || config.providers.length === 0) {
+        throw new Error('cloudAuth: at least one provider is required');
+    }
+    if (!config.database) {
+        throw new Error('cloudAuth: database adapter is required');
+    }
+    /* eslint-enable @typescript-eslint/no-unnecessary-condition */
+    return {
+        $Infer: {},
+        createAuthUrl(providerId, request) {
+            return createAuthUrl(config, providerId, request);
+        },
+        handleCallback(providerId, request) {
+            return handleCallback(config, providerId, request, config.hooks);
+        },
+        getSession(request) {
+            return getSessionFromAuth(config, request);
+        },
+        signOut(request) {
+            return signOutFromAuth(config, request, config.hooks);
+        },
+    };
+}
+export const version = '0.0.1';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAuBA,SAAS;AACT,OAAO,EACL,SAAS,EACT,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,aAAa,CAAA;AAuCpB,mBAAmB;AACnB,OAAO,EACL,oBAAoB,EACpB,SAAS,EACT,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,aAAa,CAAA;AAEpB,mBAAmB;AACnB,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAGrF,gBAAgB;AAChB,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAE5D,uBAAuB;AACvB,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAGtD,eAAe;AACf,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAG1E,kBAAkB;AAClB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAExC,mBAAmB;AACnB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAElD,cAAc;AACd,OAAO,EACL,aAAa,EACb,cAAc,EACd,UAAU,IAAI,kBAAkB,EAChC,OAAO,IAAI,eAAe,GAC3B,MAAM,WAAW,CAAA;AAMlB,OAAO,EACL,aAAa,EACb,cAAc,EACd,UAAU,IAAI,kBAAkB,EAChC,OAAO,IAAI,eAAe,GAC3B,MAAM,WAAW,CAAA;AAElB,MAAM,UAAU,SAAS,CAAC,MAAkB;IAC1C,2BAA2B;IAC3B,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IACnD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IACnD,CAAC;IACD,gEAAgE;IAChE,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IACD,+DAA+D;IAE/D,OAAO;QACL,MAAM,EAAE,EAAiC;QAEzC,aAAa,CAAC,UAAkB,EAAE,OAAiB;YACjD,OAAO,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;QACnD,CAAC;QAED,cAAc,CAAC,UAAkB,EAAE,OAAgB;YACjD,OAAO,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QAClE,CAAC;QAED,UAAU,CAAC,OAAgB;YACzB,OAAO,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC5C,CAAC;QAED,OAAO,CAAC,OAAgB;YACtB,OAAO,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QACvD,CAAC;KACF,CAAA;AACH,CAAC;AAED,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAA"}