@aura-stack/auth 0.5.0 → 0.6.0

package/dist/index-BkpwQ0l4.d.cts

@@ -0,0 +1,2279 @@
+import { ZodObject, ZodRawShape, ZodTypeAny, z } from "zod/v4";
+import { JWTPayload } from "@aura-stack/jose/jose";
+import { DecodeJWTOptions, EncodeJWTOptions, JWEHeaderParameters, JWTDecryptOptions, JWTHeaderParameters, JWTVerifyOptions, Prettify, TypedJWTPayload, TypedJWTPayload as TypedJWTPayload$1 } from "@aura-stack/jose";
+import * as _$_aura_stack_router0 from "@aura-stack/router";
+import { ClientOptions, GlobalContext } from "@aura-stack/router";
+import { SerializeOptions } from "@aura-stack/router/cookie";
+import * as _$zod from "zod";
+import * as _$zod_v4_core0 from "zod/v4/core";
+
+//#region src/schemas.d.ts
+/**
+ * Schema used in the callback action to validate the authorization error response when the resource owner
+ * has denied the authorization request.
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1
+ */
+declare const OAuthAuthorizationErrorResponse: z.ZodObject<{
+  error: z.ZodEnum<{
+    invalid_request: "invalid_request";
+    unauthorized_client: "unauthorized_client";
+    access_denied: "access_denied";
+    unsupported_response_type: "unsupported_response_type";
+    invalid_scope: "invalid_scope";
+    server_error: "server_error";
+    temporarily_unavailable: "temporarily_unavailable";
+  }>;
+  error_description: z.ZodOptional<z.ZodString>;
+  error_uri: z.ZodOptional<z.ZodString>;
+  state: z.ZodString;
+}, z.core.$strip>;
+/**
+ * Schema for OAuth Access Token Error Response
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+ */
+declare const OAuthAccessTokenErrorResponse: z.ZodObject<{
+  error: z.ZodEnum<{
+    invalid_request: "invalid_request";
+    unauthorized_client: "unauthorized_client";
+    invalid_scope: "invalid_scope";
+    invalid_client: "invalid_client";
+    invalid_grant: "invalid_grant";
+    unsupported_grant_type: "unsupported_grant_type";
+  }>;
+  error_description: z.ZodOptional<z.ZodString>;
+  error_uri: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+declare const OAuthEnvSchema: z.ZodObject<{
+  clientId: z.ZodString;
+  clientSecret: z.ZodString;
+}, z.core.$strip>;
+//#endregion
+//#region src/jose.d.ts
+/**
+ * Creates the JOSE instance used for signing and verifying tokens. It derives keys
+ * for session tokens and CSRF tokens. For security and determinism, it's required
+ * to set a salt value in `AURA_AUTH_SALT` or `AUTH_SALT` env.
+ *
+ * The instance respects the `SessionConfig` to determine:
+ * - **mode**: `signed` (JWS only), `encrypted` (JWE only), or `sealed` (JWS + JWE)
+ * - **algorithms**: signing, key-wrapping, and content-encryption algorithms
+ * - **claims**: audience, issuer, maxAge
+ *
+ * @param secret the base secret for key derivation
+ * @param session the session configuration that drives algorithm and mode selection
+ * @returns jose instance with methods for encoding/decoding JWTs and signing/verifying JWSs
+ */
+declare const createJoseInstance: <DefaultUser extends User = User>(secret?: JWTKey, session?: SessionConfig) => {
+  signJWS: (payload: TypedJWTPayload<Partial<DefaultUser>>, options?: JWTHeaderParameters) => Promise<string>;
+  verifyJWS: (token: string, options?: JWTVerifyOptions) => Promise<TypedJWTPayload<DefaultUser>>;
+  encryptJWE: (payload: TypedJWTPayload<Partial<DefaultUser>>, options?: JWEHeaderParameters) => Promise<string>;
+  decryptJWE: (token: string, options?: JWTDecryptOptions) => Promise<TypedJWTPayload<DefaultUser>>;
+  encodeJWT: (payload: TypedJWTPayload<Partial<DefaultUser>>, options?: EncodeJWTOptions) => Promise<string>;
+  decodeJWT: (token: string, options?: DecodeJWTOptions) => Promise<TypedJWTPayload<DefaultUser>>;
+};
+//#endregion
+//#region src/shared/identity.d.ts
+declare const UserIdentity: z.ZodObject<{
+  sub: z.ZodString;
+  name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  image: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  email: z.ZodOptional<z.ZodNullable<z.ZodEmail>>;
+}, z.core.$strip>;
+type UserShape = (typeof UserIdentity)["shape"];
+type UserIdentityType = z.infer<typeof UserIdentity>;
+declare const createIdentity: <S extends EditableShape<UserShape>>(shape: S) => z.ZodObject<{ -readonly [P in keyof S]: S[P] }, z.core.$strip>;
+//#endregion
+//#region src/api/createApi.d.ts
+declare const createAuthAPI: <DefaultUser extends User = User>(ctx: GlobalContext) => {
+  /**
+   * Retrieves the current session data from the server-side.
+   *
+   * @param options - Options for the API call, including headers to verify `session_token` cookie.
+   * @returns An object containing session data see {@link User}
+   */
+  getSession: (options: GetSessionAPIOptions) => Promise<GetSessionAPIReturn<DefaultUser>>;
+  /**
+   * Initiates the sign-in flow on the server-side. By default the redirect is automatic, but it can be
+   * disabled by setting the `redirect` option to `false`. When redirect is disabled, the API returns the
+   * `signInURL` in the response for the client to handle the redirect manually.
+   *
+   * @param oauth - The OAuth provider to use for sign-in (e.g., "github", "gitlab", "bitbucket").
+   * @param options - Optional parameters for the sign-in process, including headers and redirect behavior.
+   * @returns The object returned by the API call {@link SignInAPIReturn}
+   * @example
+   * const response = await api.signIn("github", {
+   *   redirectTo: "/dashboard",
+   *   request: await getRequest(),
+   * })
+   */
+  signIn: (oauth: LiteralUnion<BuiltInOAuthProvider>, options?: SignInAPIOptions) => Promise<SignInAPIReturn>;
+  /**
+   * Signs in a user using credentials (`username` and `password`) on the server-side. The credentials must
+   * be verified by the `authorize` function provided in the `credentials` configuration option.
+   *
+   * @param options - Options for the API call, including the credentials payload, headers, and redirect behavior.
+   * @returns The object returned by the API call {@link SignInCredentialsAPIReturn}
+   * @example
+   * const response = await api.signInCredentials({
+   *   payload: {
+   *     username: "johndoe",
+   *     password: "1234567890"
+   *   },
+   *   redirectTo: "/dashboard",
+   *   request: await getRequest(),
+   * })
+   */
+  signInCredentials: (options: SignInCredentialsAPIOptions) => Promise<SignInCredentialsAPIReturn>;
+  /**
+   * Updates the current session on the server-side. It allows partial updates to the session object, such as
+   * modifying user fields or extending the session expiry. It implements CSRF Protection by default, for
+   * server-side calls it only verifies and validates the CSRF Token, it also provides Double-Submit
+   * Cookie protection by requiring the `session_token` cookie to be included in the request headers.
+   *
+   * @param options - Options for the API call, including the session updates, headers, redirect behavior, and CSRF check bypass.
+   * @returns The object returned by the API call {@link UpdateSessionAPIReturn}
+   * @example
+   * const response = await api.updateSession({
+   *   session: {
+   *     user: {
+   *       name: "John Doe",
+   *       email: "john.doe@example.com"
+   *     }
+   *   },
+   *   redirectTo: "/dashboard",
+   *   request: await getRequest()
+   * })
+   */
+  updateSession: (options: UpdateSessionAPIOptions<DefaultUser>) => Promise<UpdateSessionAPIReturn<DefaultUser>>;
+  /**
+   * Signs out the current session on the server-side. It implements CSRF Protection by default, for
+   * server-side calls it only verifies and validates the CSRF Token, it also provides Double-Submit
+   * Cookie protection by requiring the `session_token` cookie to be included in the request headers.
+   *
+   * @param options - Options for the API call, including headers, redirect behavior, and CSRF check bypass.
+   * @returns The object returned by the API call {@link SignOutAPIReturn}
+   * @example
+   * const response = await api.signOut({
+   *   redirectTo: "/goodbye",
+   *   headers: {
+   *     Cookie: "session_token=abc123; csrf_token=def456"
+   *   },
+   *   // Only set this to true for trusted server-side calls that have already verified the CSRF token
+   *   skipCSRFCheck: true
+   * })
+   */
+  signOut: (options: SignOutAPIOptions) => Promise<SignOutAPIReturn>;
+};
+//#endregion
+//#region src/shared/logger.d.ts
+/**
+ * Log message definitions organized by category.
+ * Each message includes facility, severity, msgId, and default message.
+ */
+declare const logMessages: {
+  readonly ROUTER_INTERNAL_ERROR: {
+    readonly facility: 10;
+    readonly severity: "error";
+    readonly msgId: "ROUTER_INTERNAL_ERROR";
+    readonly message: "Unhandled router error while processing the request";
+  };
+  readonly INVALID_REQUEST: {
+    readonly facility: 10;
+    readonly severity: "warning";
+    readonly msgId: "INVALID_REQUEST";
+    readonly message: "Request validation failed against the expected schema";
+  };
+  readonly SERVER_ERROR: {
+    readonly facility: 10;
+    readonly severity: "error";
+    readonly msgId: "SERVER_ERROR";
+    readonly message: "Unexpected internal server error during authentication";
+  };
+  readonly OAUTH_PROTOCOL_ERROR: {
+    readonly facility: 10;
+    readonly severity: "warning";
+    readonly msgId: "OAUTH_PROTOCOL_ERROR";
+    readonly message: "OAuth provider returned an invalid or unexpected protocol response";
+  };
+  readonly OAUTH_AUTHORIZATION_ERROR: {
+    readonly facility: 10;
+    readonly severity: "error";
+    readonly msgId: "OAUTH_AUTHORIZATION_ERROR";
+    readonly message: "OAuth authorization request was rejected or failed";
+  };
+  readonly INVALID_OAUTH_CONFIGURATION: {
+    readonly facility: 10;
+    readonly severity: "error";
+    readonly msgId: "INVALID_OAUTH_CONFIGURATION";
+    readonly message: "The OAuth provider configuration is invalid or incomplete";
+  };
+  readonly OAUTH_ACCESS_TOKEN_REQUEST_INITIATED: {
+    readonly facility: 10;
+    readonly severity: "debug";
+    readonly msgId: "OAUTH_ACCESS_TOKEN_REQUEST_INITIATED";
+    readonly message: "Starting OAuth access token request to the provider";
+  };
+  readonly INVALID_OAUTH_ACCESS_TOKEN_RESPONSE: {
+    readonly facility: 10;
+    readonly severity: "error";
+    readonly msgId: "INVALID_OAUTH_ACCESS_TOKEN_RESPONSE";
+    readonly message: "OAuth access token endpoint returned an invalid or malformed response";
+  };
+  readonly OAUTH_ACCESS_TOKEN_ERROR: {
+    readonly facility: 10;
+    readonly severity: "error";
+    readonly msgId: "OAUTH_ACCESS_TOKEN_ERROR";
+    readonly message: "OAuth access token endpoint returned an error response";
+  };
+  readonly OAUTH_ACCESS_TOKEN_SUCCESS: {
+    readonly facility: 10;
+    readonly severity: "info";
+    readonly msgId: "OAUTH_ACCESS_TOKEN_SUCCESS";
+    readonly message: "Successfully retrieved OAuth access token from the provider";
+  };
+  readonly OAUTH_ACCESS_TOKEN_REQUEST_FAILED: {
+    readonly facility: 10;
+    readonly severity: "error";
+    readonly msgId: "OAUTH_ACCESS_TOKEN_REQUEST_FAILED";
+    readonly message: "Network or server error while requesting OAuth access token";
+  };
+  readonly OAUTH_USERINFO_REQUEST_INITIATED: {
+    readonly facility: 10;
+    readonly severity: "debug";
+    readonly msgId: "OAUTH_USERINFO_REQUEST_INITIATED";
+    readonly message: "Starting OAuth userinfo request to the provider";
+  };
+  readonly OAUTH_USERINFO_INVALID_RESPONSE: {
+    readonly facility: 10;
+    readonly severity: "error";
+    readonly msgId: "OAUTH_USERINFO_INVALID_RESPONSE";
+    readonly message: "OAuth userinfo endpoint returned an invalid or malformed response";
+  };
+  readonly OAUTH_USERINFO_ERROR: {
+    readonly facility: 10;
+    readonly severity: "error";
+    readonly msgId: "OAUTH_USERINFO_ERROR";
+    readonly message: "OAuth userinfo endpoint returned an error response";
+  };
+  readonly OAUTH_USERINFO_SUCCESS: {
+    readonly facility: 10;
+    readonly severity: "info";
+    readonly msgId: "OAUTH_USERINFO_SUCCESS";
+    readonly message: "Successfully retrieved user information from the OAuth provider";
+  };
+  readonly OAUTH_USERINFO_REQUEST_FAILED: {
+    readonly facility: 10;
+    readonly severity: "error";
+    readonly msgId: "OAUTH_USERINFO_REQUEST_FAILED";
+    readonly message: "Network or server error while requesting user information from the OAuth provider";
+  };
+  readonly OAUTH_CALLBACK_SUCCESS: {
+    readonly facility: 4;
+    readonly severity: "info";
+    readonly msgId: "OAUTH_CALLBACK_SUCCESS";
+    readonly message: "OAuth callback completed successfully and session was created";
+  };
+  readonly MISMATCHING_STATE: {
+    readonly facility: 4;
+    readonly severity: "critical";
+    readonly msgId: "MISMATCHING_STATE";
+    readonly message: "OAuth response state parameter does not match the stored state value";
+  };
+  readonly POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED: {
+    readonly facility: 4;
+    readonly severity: "critical";
+    readonly msgId: "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED";
+    readonly message: "Blocked redirect to untrusted or external URL (potential open redirect attack)";
+  };
+  readonly OPEN_REDIRECT_ATTACK: {
+    readonly facility: 4;
+    readonly severity: "warning";
+    readonly msgId: "OPEN_REDIRECT_ATTACK";
+    readonly message: "Detected redirect target that does not match the trusted origin";
+  };
+  readonly SESSION_TOKEN_MISSING: {
+    readonly facility: 4;
+    readonly severity: "warning";
+    readonly msgId: "SESSION_TOKEN_MISSING";
+    readonly message: "Session cookie is missing from the request";
+  };
+  readonly CSRF_TOKEN_MISSING: {
+    readonly facility: 4;
+    readonly severity: "warning";
+    readonly msgId: "CSRF_TOKEN_MISSING";
+    readonly message: "CSRF token cookie is missing from the request";
+  };
+  readonly CSRF_HEADER_MISSING: {
+    readonly facility: 4;
+    readonly severity: "warning";
+    readonly msgId: "CSRF_HEADER_MISSING";
+    readonly message: "CSRF header is missing from the request";
+  };
+  readonly CSRF_TOKEN_INVALID: {
+    readonly facility: 4;
+    readonly severity: "error";
+    readonly msgId: "CSRF_TOKEN_INVALID";
+    readonly message: "CSRF token verification failed or token is invalid";
+  };
+  readonly SIGN_IN_INITIATED: {
+    readonly facility: 4;
+    readonly severity: "info";
+    readonly msgId: "SIGN_IN_INITIATED";
+    readonly message: "Starting OAuth sign-in flow for the selected provider";
+  };
+  readonly SIGN_OUT_ATTEMPT: {
+    readonly facility: 4;
+    readonly severity: "debug";
+    readonly msgId: "SIGN_OUT_ATTEMPT";
+    readonly message: "Received sign-out request from client";
+  };
+  readonly SIGN_OUT_CSRF_VERIFIED: {
+    readonly facility: 4;
+    readonly severity: "info";
+    readonly msgId: "SIGN_OUT_CSRF_VERIFIED";
+    readonly message: "CSRF token was successfully verified during sign-out";
+  };
+  readonly SIGN_OUT_SUCCESS: {
+    readonly facility: 4;
+    readonly severity: "info";
+    readonly msgId: "SIGN_OUT_SUCCESS";
+    readonly message: "User session was cleared and sign-out completed successfully";
+  };
+  readonly SIGN_OUT_REDIRECT: {
+    readonly facility: 4;
+    readonly severity: "debug";
+    readonly msgId: "SIGN_OUT_REDIRECT";
+    readonly message: "Redirecting client after successful sign-out";
+  };
+  readonly AUTH_SESSION_VALID: {
+    readonly facility: 4;
+    readonly severity: "info";
+    readonly msgId: "AUTH_SESSION_VALID";
+    readonly message: "Session token is valid and user session was returned";
+  };
+  readonly AUTH_SESSION_INVALID: {
+    readonly facility: 4;
+    readonly severity: "notice";
+    readonly msgId: "AUTH_SESSION_INVALID";
+    readonly message: "Session token is missing, expired, or invalid";
+  };
+  readonly INVALID_JWT_TOKEN: {
+    readonly facility: 4;
+    readonly severity: "warning";
+    readonly msgId: "INVALID_JWT_TOKEN";
+    readonly message: "JWT session token failed validation during sign-out";
+  };
+  readonly CSRF_TOKEN_REQUESTED: {
+    readonly facility: 4;
+    readonly severity: "debug";
+    readonly msgId: "CSRF_TOKEN_REQUESTED";
+    readonly message: "Client requested a CSRF token";
+  };
+  readonly CSRF_TOKEN_ISSUED: {
+    readonly facility: 4;
+    readonly severity: "debug";
+    readonly msgId: "CSRF_TOKEN_ISSUED";
+    readonly message: "Issued a new CSRF token to the client";
+  };
+  readonly INVALID_URL: {
+    readonly facility: 10;
+    readonly severity: "error";
+    readonly msgId: "INVALID_URL";
+    readonly message: "Derived origin URL is invalid or malformed";
+  };
+  readonly COOKIE_HTTPONLY_DISABLED: {
+    readonly facility: 10;
+    readonly severity: "critical";
+    readonly msgId: "COOKIE_HTTPONLY_DISABLED";
+    readonly message: "Cookie is configured without HttpOnly. This allows JavaScript access via document.cookie and increases XSS exposure.";
+  };
+  readonly COOKIE_WILDCARD_DOMAIN: {
+    readonly facility: 10;
+    readonly severity: "critical";
+    readonly msgId: "COOKIE_WILDCARD_DOMAIN";
+    readonly message: "Cookie 'Domain' is set to a wildcard, which is insecure and should be avoided.";
+  };
+  readonly COOKIE_SECURE_DISABLED: {
+    readonly facility: 10;
+    readonly severity: "warning";
+    readonly msgId: "COOKIE_SECURE_DISABLED";
+    readonly message: "Cookie is configured with 'Secure' but the request is not HTTPS. The 'Secure' attribute will be ignored by the browser.";
+  };
+  readonly COOKIE_SAMESITE_NONE_WITHOUT_SECURE: {
+    readonly facility: 10;
+    readonly severity: "warning";
+    readonly msgId: "COOKIE_SAMESITE_NONE_WITHOUT_SECURE";
+    readonly message: "Cookie uses SameSite=None without Secure. Falling back to SameSite=Lax for safer defaults.";
+  };
+  readonly COOKIE_INSECURE_IN_PRODUCTION: {
+    readonly facility: 10;
+    readonly severity: "critical";
+    readonly msgId: "COOKIE_INSECURE_IN_PRODUCTION";
+    readonly message: "Cookies are being served over an insecure connection in production, which is a serious security risk.";
+  };
+  readonly COOKIE_HOST_STRATEGY_INSECURE: {
+    readonly facility: 10;
+    readonly severity: "critical";
+    readonly msgId: "COOKIE_HOST_STRATEGY_INSECURE";
+    readonly message: "__Host- cookies require a secure HTTPS context. Falling back to standard cookie settings.";
+  };
+  readonly UNTRUSTED_ORIGIN: {
+    readonly facility: 10;
+    readonly severity: "error";
+    readonly msgId: "UNTRUSTED_ORIGIN";
+    readonly message: "The constructed origin URL is not trusted.";
+  };
+  readonly SESSION_REFRESHED: {
+    readonly facility: 4;
+    readonly severity: "info";
+    readonly msgId: "SESSION_REFRESHED";
+    readonly message: "User session was refreshed with a new expiration time";
+  };
+  readonly AUTH_SECURITY_ERROR: {
+    readonly facility: 10;
+    readonly severity: "error";
+    readonly msgId: "AUTH_SECURITY_ERROR";
+    readonly message: "An authentication security error occurred";
+  };
+  readonly CSRF_TOKEN_VERIFIED: {
+    readonly facility: 4;
+    readonly severity: "info";
+    readonly msgId: "CSRF_TOKEN_VERIFIED";
+    readonly message: "CSRF token verification succeeded";
+  };
+  readonly IDENTITY_VALIDATION_DISABLED: {
+    readonly facility: 4;
+    readonly severity: "warning";
+    readonly msgId: "IDENTITY_VALIDATION_DISABLED";
+    readonly message: "Identity validation is disabled. User data will not be validated against a schema.";
+  };
+  readonly IDENTITY_VALIDATION_FAILED: {
+    readonly facility: 4;
+    readonly severity: "error";
+    readonly msgId: "IDENTITY_VALIDATION_FAILED";
+    readonly message: "User identity validation against the schema failed";
+  };
+  readonly CREDENTIALS_SIGN_IN_SUCCESS: {
+    readonly facility: 4;
+    readonly severity: "info";
+    readonly msgId: "CREDENTIALS_SIGN_IN_SUCCESS";
+    readonly message: "User successfully authenticated with credentials";
+  };
+  readonly INVALID_CREDENTIALS: {
+    readonly facility: 4;
+    readonly severity: "warning";
+    readonly msgId: "INVALID_CREDENTIALS";
+    readonly message: "Authentication failed due to invalid credentials";
+  };
+  readonly CREDENTIALS_SIGN_IN_FAILED: {
+    readonly facility: 4;
+    readonly severity: "error";
+    readonly msgId: "CREDENTIALS_SIGN_IN_FAILED";
+    readonly message: "An error occurred during credentials sign-in";
+  };
+};
+declare const createLogEntry: <T extends keyof typeof logMessages>(key: T, overrides?: Partial<SyslogOptions>) => SyslogOptions;
+declare const createSyslogMessage: (options: SyslogOptions) => string;
+//#endregion
+//#region src/oauth/github.d.ts
+/**
+ * @see [Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user)
+ */
+interface GitHubProfile {
+  login: string;
+  id: number;
+  user_view_type: string;
+  node_id: string;
+  avatar_url: string;
+  gravatar_id: string | null;
+  url: string;
+  html_url: string;
+  followers_url: string;
+  following_url: string;
+  gists_url: string;
+  starred_url: string;
+  subscriptions_url: string;
+  organizations_url: string;
+  repos_url: string;
+  events_url: string;
+  received_events_url: string;
+  type: string;
+  site_admin: boolean;
+  name: string | null;
+  company: string | null;
+  blog: string | null;
+  location: string | null;
+  email: string | null;
+  notification_email: string | null;
+  hireable: boolean | null;
+  bio: string | null;
+  twitter_username?: string | null;
+  public_repos: number;
+  public_gists: number;
+  followers: number;
+  following: number;
+  created_at: string;
+  updated_at: string;
+  private_gists?: number;
+  total_private_repos?: number;
+  owned_private_repos?: number;
+  disk_usage?: number;
+  collaborators?: number;
+  two_factor_authentication: boolean;
+  plan?: {
+    collaborators: number;
+    name: string;
+    space: number;
+    private_repos: number;
+  };
+}
+/**
+ * GitHub OAuth Provider
+ *
+ * @see [GitHub - Creating an OAuth App](https://docs.github.com/en/developers/apps/building-oauth-apps/creating-an-oauth-app)
+ * @see [GitHub - Authorizing OAuth Apps](https://docs.github.com/en/developers/apps/building-oauth-apps/authorizing-oauth-apps)
+ * @see [GitHub - Configure your GitHub OAuth Apps](https://github.com/settings/developers)
+ * @see [Github - Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user)
+ */
+declare const github: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<GitHubProfile, DefaultUser>>) => OAuthProviderCredentials<GitHubProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/bitbucket.d.ts
+/**
+ * @see [Get current user](https://developer.atlassian.com/cloud/bitbucket/rest/api-group-users/#api-user-get)
+ */
+interface BitbucketProfile {
+  display_name: string;
+  links: Record<LiteralUnion<"self" | "avatar" | "repositories" | "snippets" | "html" | "hooks">, {
+    href?: string;
+  }>;
+  created_on: string;
+  type: string;
+  uuid: string;
+  has_2fa_enabled: boolean;
+  username: string;
+  nickname: string;
+  is_staff: boolean;
+  account_id: string;
+  account_status: LiteralUnion<"active" | "inactive" | "closed">;
+  location: string | null;
+}
+/**
+ * Bitbucket OAuth Provider
+ *
+ * @see [Bitbucket - Official App](https://bitbucket.org/)
+ * @see [Bitbucket - Workspaces](https://bitbucket.org/account/workspaces/)
+ * @see [Bitbucket - Workspace Settings](https://bitbucket.org/{workspace-name}/workspace/settings/)
+ * @see [Bitbucket - OAuth 2.0](https://developer.atlassian.com/cloud/bitbucket/oauth-2/)
+ * @see [Bitbucket - Use OAuth on Bitbucket Cloud](https://support.atlassian.com/bitbucket-cloud/docs/use-oauth-on-bitbucket-cloud/)
+ * @see [Bitbucket - Cloud REST API](https://developer.atlassian.com/cloud/bitbucket/rest/intro/)
+ * @see [Bitbucket - User Endpoint](https://developer.atlassian.com/cloud/bitbucket/rest/api-group-users/#api-users-endpoint)
+ */
+declare const bitbucket: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<BitbucketProfile, DefaultUser>>) => OAuthProviderCredentials<BitbucketProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/figma.d.ts
+/**
+ * @see [Figma API - Users](https://developers.figma.com/docs/rest-api/users-types/)
+ */
+interface FigmaProfile {
+  id: string;
+  handle: string;
+  img_url: string;
+  email: string;
+}
+/**
+ * Figma OAuth Provider
+ * @see [Figma - REST API Introduction](https://developers.figma.com/docs/rest-api/)
+ * @see [Figma - OAuth App](https://www.figma.com/developers/apps/)
+ * @see [Figma - Create an OAuth App](https://developers.figma.com/docs/rest-api/authentication/#create-an-oauth-app)
+ * @see [Figma - OAuth Scopes](https://developers.figma.com/docs/rest-api/scopes/)
+ */
+declare const figma: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<FigmaProfile, DefaultUser>>) => OAuthProviderCredentials<FigmaProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/discord.d.ts
+/**
+ * @see [Discord - Nameplate Object](https://discord.com/developers/docs/resources/user#nameplate-nameplate-structure)
+ */
+interface Nameplate {
+  sku_id: string;
+  asset: string;
+  label: string;
+  palette: string;
+}
+/**
+ * The `snowflake` type is a string type. The attributes defined with this type are:
+ * - `id`: The unique identifier for the object.
+ * - `primary_guild.identity_guild_id`: The unique identifier for the guild.
+ * - `avatar_decoration_data.sku_id`: The unique identifier for the SKU.
+ *
+ * @see [Discord - User Object](https://discord.com/developers/docs/resources/user#user-object)
+ */
+interface DiscordProfile {
+  id: string;
+  username: string;
+  discriminator: string;
+  global_name: string | null;
+  avatar: string | null;
+  bot?: boolean;
+  system?: boolean;
+  mfa_enabled?: boolean;
+  banner?: string | null;
+  accent_color?: number | null;
+  locale?: string;
+  verified?: boolean;
+  email?: string | null;
+  flags?: number;
+  premium_type?: number;
+  public_flags?: number;
+  avatar_decoration_data?: {
+    asset: string;
+    sku_id: string;
+  };
+  collections?: Record<string, Nameplate>;
+  primary_guild?: {
+    identity_guild_id: string;
+    identity_enabled: boolean | null;
+    tag: string | null;
+    badge: string | null;
+  };
+}
+/**
+ * Discord OAuth Provider
+ *
+ * @see [Discord - Applications](https://discord.com/developers/applications)
+ * @see [Discord - OAuth2](https://discord.com/developers/docs/topics/oauth2)
+ * @see [Discord - Get Current User](https://discord.com/developers/docs/resources/user#get-current-user)
+ * @see [Discord - User Object](https://discord.com/developers/docs/resources/user#user-object)
+ * @see [Discord - OAuth2 Scopes](https://discord.com/developers/docs/topics/oauth2#shared-resources-oauth2-scopes)
+ * @see [Discord - Image Formatting](https://discord.com/developers/docs/reference#image-formatting)
+ * @see [Discord - Display Names](https://discord.com/developers/docs/change-log#display-names)
+ */
+declare const discord: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<DiscordProfile, DefaultUser>>) => OAuthProviderCredentials<DiscordProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/gitlab.d.ts
+/**
+ * @see [GitLab - User Structure](https://docs.gitlab.com/ee/api/users.html#external-user-structure)
+ */
+interface GitLabProfile {
+  id: number;
+  username: string;
+  email: string;
+  name: string;
+  state: string;
+  locked: boolean;
+  avatar_url: string;
+  web_url: string;
+  created_at: string;
+  bio: string;
+  location: string | null;
+  public_email: string;
+  linkedin: string;
+  twitter: string;
+  discord: string;
+  github: string;
+  website_url: string;
+  organization: string;
+  job_title: string;
+  pronouns: string;
+  bot: boolean;
+  work_information: string | null;
+  followers: number;
+  following: number;
+  local_time: string;
+  last_sign_in_at: string;
+  confirmed_at: string;
+  theme_id: number;
+  last_activity_on: string;
+  color_scheme_id: number;
+  projects_limit: number;
+  current_sign_in_at: string;
+  identities: {
+    provider: string;
+    extern_uid: string;
+    saml_provider_id: number | null;
+  }[];
+  can_create_group: boolean;
+  can_create_project: boolean;
+  two_factor_enabled: boolean;
+  external: boolean;
+  private_profile: boolean;
+  commit_email: string;
+  preferred_language: string;
+  shared_runners_minutes_limit: number | null;
+  extra_shared_runners_minutes_limit: number | null;
+  scim_identities: unknown[];
+}
+/**
+ * GitLab OAuth Provider
+ *
+ * @see [GitLab - Applications](https://gitlab.com/-/user_settings/applications)
+ * @see [GitLab - OAuth 2.0 identify provider API](https://docs.gitlab.com/api/oauth2/)
+ * @see [GitLab - Scopes](https://docs.gitlab.com/integration/oauth_provider/#view-all-authorized-applications)
+ * @see [GitLab - Get current user](https://docs.gitlab.com/api/users/#get-the-current-user)
+ */
+declare const gitlab: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<GitLabProfile, DefaultUser>>) => OAuthProviderCredentials<GitLabProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/spotify.d.ts
+interface SpotifyImage {
+  url: string;
+  height: number;
+  width: number;
+}
+/**
+ * @see [Spotify - User Object](https://developer.spotify.com/documentation/web-api/reference/object-model/#user-object-private)
+ */
+interface SpotifyProfile {
+  id: string;
+  display_name: string;
+  email: string;
+  type: string;
+  uri: string;
+  country: string;
+  href: string;
+  images: SpotifyImage[];
+  product: string;
+  explicit_content: {
+    filter_enabled: boolean;
+    filter_locked: boolean;
+  };
+  external_urls: {
+    spotify: string;
+  };
+  followers: {
+    href: string;
+    total: number;
+  };
+}
+/**
+ * Spotify OAuth Provider
+ *
+ * @see [Spotify - Spotify Developer Dashboard](https://developer.spotify.com/dashboard)
+ * @see [Spotify - Getting started with Web API](https://developer.spotify.com/documentation/web-api/tutorials/getting-started)
+ * @see [Spotify - Get Current User's Profile](https://developer.spotify.com/documentation/web-api/reference/get-current-users-profile)
+ * @see [Spotify - Scopes](https://developer.spotify.com/documentation/web-api/concepts/scopes)
+ * @see [Spotify - Redirect URIs](https://developer.spotify.com/documentation/web-api/concepts/redirect_uri)
+ */
+declare const spotify: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<SpotifyProfile, DefaultUser>>) => OAuthProviderCredentials<SpotifyProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/x.d.ts
+/**
+ * @see [X - Get my User](https://docs.x.com/x-api/users/get-my-user)
+ */
+interface XProfile {
+  data: {
+    id: string;
+    name: string;
+    username: string;
+    profile_image_url: string;
+  };
+}
+/**
+ * X (Twitter) OAuth Provider
+ * @see [X - Developer Portal](https://developer.x.com/en/portal/projects-and-apps)
+ * @see [X - Get my User](https://docs.x.com/x-api/users/get-my-user)
+ * @see [X - OAuth 2.0 Authorization Code Flow with PKCE](https://docs.x.com/fundamentals/authentication/oauth-2-0/authorization-code)
+ * @see [X - OAuth 2.0 Scopes](https://docs.x.com/fundamentals/authentication/oauth-2-0/authorization-code#scopes)
+ * @see [X - OAuth 2.0 Bearer Token](https://docs.x.com/fundamentals/authentication/oauth-2-0/application-only)
+ */
+declare const x: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<XProfile, DefaultUser>>) => OAuthProviderCredentials<XProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/strava.d.ts
+/**
+ * @see [Strava - SummaryClub](https://developers.strava.com/docs/reference/#api-models-SummaryClub)
+ */
+interface SummaryClub {
+  id: number;
+  resource_state: number;
+  name: string;
+  profile_medium: string;
+  cover_photo: string;
+  cover_photo_small: string;
+  sport_type: "cycling" | "running" | "triathlon" | "other";
+  activity_types: string[];
+  city: string;
+  state: string;
+  country: string;
+  private: boolean;
+  member_count: number;
+  featured: boolean;
+  verified: boolean;
+  url: string;
+}
+/**
+ * @see [Strava - SummaryGear](https://developers.strava.com/docs/reference/#api-models-SummaryGear)
+ */
+interface SummaryGear {
+  id: string;
+  resource_state: number;
+  primary: boolean;
+  name: string;
+  distance: number;
+}
+/**
+ * @see [Strava - DetailedAthlete](https://developers.strava.com/docs/reference/#api-models-DetailedAthlete)
+ */
+interface StravaProfile {
+  id: number;
+  resource_state: number;
+  firstname: string;
+  lastname: string;
+  bio: string | null;
+  profile: string;
+  profile_medium: string;
+  city: string;
+  state: string;
+  country: string;
+  sex: string;
+  premium: boolean;
+  summit: boolean;
+  created_at: Date;
+  updated_at: Date;
+  badge_type_id: number;
+  weight: number;
+  friend: null;
+  follower: null;
+  follower_count: number;
+  friend_count: number;
+  measurement_preference: string;
+  ftp: number;
+  clubs: SummaryClub[];
+  bikes: SummaryGear[];
+  shoes: SummaryGear[];
+}
+/**
+ * Strava OAuth Provider
+ * @see [Strava - Getting Started with the Strava API](https://developers.strava.com/docs/getting-started/)
+ * @see [Strava - My Applications](https://www.strava.com/settings/api)
+ * @see [Strava - Authentication](https://developers.strava.com/docs/authentication/)
+ * @see [Strava - API Application](https://www.strava.com/settings/api)
+ * @see [Strava - API Reference](https://developers.strava.com/docs/reference/)
+ */
+declare const strava: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<StravaProfile, DefaultUser>>) => OAuthProviderCredentials<StravaProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/mailchimp.d.ts
+interface Login {
+  email: string;
+  avatar: string | null;
+  login_id: number;
+  login_name: string;
+  login_email: string;
+}
+/**
+ * @see [Mailchimp - API Root](https://mailchimp.com/developer/marketing/api/authentication/)
+ */
+interface MailchimpProfile {
+  dc: string;
+  role: string;
+  accountname: string;
+  user_id: string;
+  login: Login;
+  login_url: string;
+  api_endpoint: string;
+}
+/**
+ * Mailchimp OAuth Provider
+ * @see [Mailchimp - Marketing API](https://mailchimp.com/developer/marketing/api/)
+ * @see [Mailchimp - Apps](https://us1.admin.mailchimp.com/account/oauth2/)
+ * @see [Mailchimp - Create an Application](https://mailchimp.com/developer/marketing/guides/access-user-data-oauth-2/#register-your-app)
+ * @see [Mailchimp - OAuth 2.0 Docs](https://mailchimp.com/developer/marketing/guides/access-user-data-oauth-2/)
+ * @see [Mailchimp - API Root](https://mailchimp.com/developer/marketing/api/root/)
+ */
+declare const mailchimp: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<MailchimpProfile, DefaultUser>>) => OAuthProviderCredentials<MailchimpProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/pinterest.d.ts
+/**
+ * @see [Pinterest - Get User Account](https://developers.pinterest.com/docs/api/v5/user_account-get)
+ */
+interface PinterestProfile {
+  account_type: LiteralUnion<"PINNER">;
+  id: string;
+  profile_image: string;
+  website_url: string;
+  username: string;
+  about: string;
+  business_name: string;
+  board_count: number;
+  pin_count: number;
+  follower_count: number;
+  following_count: number;
+  monthly_views: number;
+}
+/**
+ * @see [Pinterest - Connect App](https://developers.pinterest.com/docs/getting-started/connect-app/)
+ * @see [Pinterest - My Apps](https://developers.pinterest.com/apps/)
+ * @see [Pinterest - Get User Account](https://developers.pinterest.com/docs/api/v5/user_account-get)
+ */
+declare const pinterest: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<PinterestProfile, DefaultUser>>) => OAuthProviderCredentials<PinterestProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/twitch.d.ts
+/**
+ * @see [Twitch - Get Users](https://dev.twitch.tv/docs/api/reference#get-users)
+ */
+interface TwitchProfile {
+  id: string;
+  login: string;
+  display_name: string;
+  type: string;
+  broadcaster_type: string;
+  description: string;
+  profile_image_url: string;
+  offline_image_url: string;
+  view_count: number;
+  email?: string;
+  created_at: string;
+}
+/**
+ * @see [Twitch - Get Started with the Twitch API](https://dev.twitch.tv/docs/api/get-started/)
+ * @see [Twitch - Authorization code grant flow](https://dev.twitch.tv/docs/authentication/getting-tokens-oauth/#authorization-code-grant-flow)
+ * @see [Twitch - Register Your App](https://dev.twitch.tv/docs/authentication/register-app)
+ * @see [Twitch - Setting up Two-Factor Authentication (2FA)](https://help.twitch.tv/s/article/two-factor-authentication?language=en_US)
+ * @see [Twitch - Security and Privacy](https://www.twitch.tv/settings/security)
+ * @see [Twitch - Get Users](https://dev.twitch.tv/docs/api/reference#get-users)
+ * @see [Twitch - Scopes](https://dev.twitch.tv/docs/authentication/scopes/)
+ */
+declare const twitch: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<TwitchProfile, DefaultUser>>) => OAuthProviderCredentials<TwitchProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/notion.d.ts
+interface Person {
+  email: string;
+}
+interface NotionUser {
+  object: "user";
+  id: string;
+  name: string;
+  avatar_url: string | null;
+  type: "person";
+  person: Person;
+}
+interface Owner {
+  type: "user";
+  user: NotionUser;
+}
+interface Bot {
+  owner: Owner;
+}
+/**
+ * @see [Notion - Retrieve your token's bot user](https://developers.notion.com/reference/get-self)
+ */
+interface NotionProfile {
+  object: "user";
+  id: string;
+  name: string;
+  avatar_url: string | null;
+  type: "bot";
+  bot: Bot;
+}
+/**
+ * @see [Notion - Developer Documentation](https://developers.notion.com/)
+ * @see [Notion - Authorization](https://developers.notion.com/docs/authorization)
+ * @see [Notion - Authentication](https://developers.notion.com/reference/authentication)
+ * @see [Notion - Retrieve your token's bot user](https://developers.notion.com/reference/get-self)
+ */
+declare const notion: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<NotionProfile, DefaultUser>>) => OAuthProviderCredentials<NotionProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/dropbox.d.ts
+type AccountType = "basic" | "pro" | "business";
+interface Name {
+  given_name: string;
+  surname: string;
+  familiar_name: string;
+  display_name: string;
+  abbreviated_name: string;
+}
+interface RootInfo {
+  team: RootInfo;
+  user: RootInfo;
+}
+interface FullTeam {
+  id: string;
+  name: string;
+  sharing_policies: Record<string, unknown>;
+  office_addin_policy: unknown;
+  top_level_content_policy: unknown;
+}
+interface DropboxProfile {
+  account_id: string;
+  name: Name;
+  email: string;
+  email_verified: boolean;
+  disabled: boolean;
+  locale: string;
+  referral_link: string;
+  is_paired: boolean;
+  account_type: AccountType;
+  root_info: unknown;
+  profile_photo_url?: string;
+  country: string;
+  team?: unknown;
+  team_member_id?: string;
+}
+/**
+ * @see [Dropbox - OAuth Guide](https://developers.dropbox.com/oauth-guide)
+ * @see [Dropbox - API v2](https://www.dropbox.com/developers/documentation/http/documentation)
+ * @see [Dropbox - Get Current Account](https://www.dropbox.com/developers/documentation/http/documentation#users-get_current_account)
+ * @see [Dropbox - My Apps](https://www.dropbox.com/developers/apps)
+ * @see [Dropbox - Developer Guide](https://www.dropbox.com/developers/reference/developer-guide)
+ */
+declare const dropbox: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<DropboxProfile, DefaultUser>>) => OAuthProviderCredentials<DropboxProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/atlassian.d.ts
+interface ExtendedProfile {
+  job_title: string;
+  organization: string;
+  department: string;
+  location: string;
+}
+interface AtlassianProfile {
+  account_id: string;
+  account_type: string;
+  account_status: LiteralUnion<"active">;
+  email: string;
+  email_verified: boolean;
+  name: string;
+  picture: string;
+  nickname: string;
+  zoneinfo: string;
+  locale: string;
+  extended_profile: ExtendedProfile;
+  last_updated: string;
+  created_at: string;
+}
+/**
+ * @see [Atlassian - OAuth Apps](https://developer.atlassian.com/cloud/jira/platform/oauth-2-3lo-apps/)
+ * @see [Atlassian - My Apps](https://developer.atlassian.com/console/myapps/)
+ * @see [Atlassian - Retrieve Authenticated User](https://developer.atlassian.com/cloud/jira/software/oauth-2-3lo-apps/#how-do-i-retrieve-the-public-profile-of-the-authenticated-user-)
+ */
+declare const atlassian: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<AtlassianProfile, DefaultUser>>) => OAuthProviderCredentials<AtlassianProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/index.d.ts
+declare const builtInOAuthProviders: {
+  readonly github: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<GitHubProfile, DefaultUser>>) => OAuthProviderCredentials<GitHubProfile, DefaultUser>;
+  readonly bitbucket: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<BitbucketProfile, DefaultUser>>) => OAuthProviderCredentials<BitbucketProfile, DefaultUser>;
+  readonly figma: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<FigmaProfile, DefaultUser>>) => OAuthProviderCredentials<FigmaProfile, DefaultUser>;
+  readonly discord: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<DiscordProfile, DefaultUser>>) => OAuthProviderCredentials<DiscordProfile, DefaultUser>;
+  readonly gitlab: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<GitLabProfile, DefaultUser>>) => OAuthProviderCredentials<GitLabProfile, DefaultUser>;
+  readonly spotify: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<SpotifyProfile, DefaultUser>>) => OAuthProviderCredentials<SpotifyProfile, DefaultUser>;
+  readonly x: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<XProfile, DefaultUser>>) => OAuthProviderCredentials<XProfile, DefaultUser>;
+  readonly strava: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<StravaProfile, DefaultUser>>) => OAuthProviderCredentials<StravaProfile, DefaultUser>;
+  readonly mailchimp: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<MailchimpProfile, DefaultUser>>) => OAuthProviderCredentials<MailchimpProfile, DefaultUser>;
+  readonly pinterest: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<PinterestProfile, DefaultUser>>) => OAuthProviderCredentials<PinterestProfile, DefaultUser>;
+  readonly twitch: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<TwitchProfile, DefaultUser>>) => OAuthProviderCredentials<TwitchProfile, DefaultUser>;
+  readonly notion: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<NotionProfile, DefaultUser>>) => OAuthProviderCredentials<NotionProfile, DefaultUser>;
+  readonly dropbox: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<DropboxProfile, DefaultUser>>) => OAuthProviderCredentials<DropboxProfile, DefaultUser>;
+  readonly atlassian: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<AtlassianProfile, DefaultUser>>) => OAuthProviderCredentials<AtlassianProfile, DefaultUser>;
+};
+/**
+ * Constructs OAuth provider configurations from an array of provider names or configurations.
+ * It loads the client ID and client secret from environment variables if only the provider name is provided.
+ *
+ * @param oauth - Array of OAuth provider configurations or provider names to be defined from environment variables
+ * @returns A record of OAuth provider configurations
+ * @example
+ * // Using built-in provider with env variables
+ * createBuiltInOAuthProviders(["github"])
+ *
+ * // Using built-in provider with explicit credentials via factory
+ * createBuiltInOAuthProviders([github({ clientId: "...", clientSecret: "..." })])
+ */
+declare const createBuiltInOAuthProviders: (oauth?: (BuiltInOAuthProvider | OAuthProviderCredentials<any>)[]) => Record<LiteralUnion<BuiltInOAuthProvider>, OAuthProviderCredentials<any>>;
+type BuiltInOAuthProvider = keyof typeof builtInOAuthProviders;
+//#endregion
+//#region src/@types/oauth.d.ts
+/** Known query parameter names supported when building an OAuth authorization URL. */
+type AuthorizeParams = LiteralUnion<"clientId" | "prompt" | "scope" | "responseMode" | "audience" | "loginHint" | "nonce" | "display">;
+/** OAuth 2.0 `response_type` values used in authorization requests. */
+type ResponseType = LiteralUnion<"code" | "token" | "refresh_token" | "id_token">;
+/**
+ * Configuration for an OAuth provider without credentials.
+ * Use this type when defining provider metadata and endpoints.
+ */
+interface OAuthProviderConfig<Profile extends object = Record<string, any>, DefaultUser = User> {
+  id: string;
+  name: string;
+  /**
+   * @deprecated
+   * use `authorize` instead of `authorizeURL`
+   */
+  authorizeURL?: string;
+  authorize: string | {
+    url: string;
+    params?: Partial<Record<AuthorizeParams, string> & {
+      responseType: ResponseType;
+    }>;
+  };
+  accessToken: string | {
+    url: string;
+    headers?: Record<string, string>;
+  };
+  userInfo: string | {
+    url: string;
+    headers?: Record<string, string>;
+    method?: string;
+  };
+  /**
+   * @deprecated
+   * use `authorize.params.scope` instead of `scope`
+   */
+  scope?: string;
+  /**
+   * @deprecated
+   * use `authorize.params.responseType` instead of `responseType`
+   */
+  responseType?: ResponseType;
+  profile?: (profile: Profile) => DefaultUser | Promise<DefaultUser>;
+}
+/**
+ * OAuth provider configuration with client credentials.
+ * Extends OAuthProviderConfig with clientId and clientSecret.
+ */
+interface OAuthProviderCredentials<Profile extends object = Record<string, any>, DefaultUser extends User = User> extends OAuthProviderConfig<Profile, DefaultUser> {
+  clientId?: string;
+  clientSecret?: string;
+}
+/**
+ * Complete OAuth provider type combining configuration and credentials.
+ */
+type OAuthProvider<Profile extends object = Record<string, any>, DefaultUser extends User = User> = OAuthProviderCredentials<Profile, DefaultUser>;
+/**
+ * Lookup table of configured OAuth providers keyed by built-in id or custom id.
+ * Values are full credential configs used at runtime for authorize/token/userinfo.
+ */
+type OAuthProviderRecord<DefaultUser extends User = User> = Record<LiteralUnion<BuiltInOAuthProvider>, OAuthProviderCredentials<any, DefaultUser>>;
+//#endregion
+//#region src/@types/config.d.ts
+/**
+ * Main configuration interface for Aura Auth.
+ * This is the user-facing configuration object passed to `createAuth()`.
+ */
+interface AuthConfig<Identity extends EditableShape<UserShape> = EditableShape<UserShape>> {
+  /**
+   * OAuth providers available in the authentication and authorization flows. It provides a type-inference
+   * for the OAuth providers that are supported by Aura Stack Auth; alternatively, you can provide a custom
+   * OAuth third-party authorization service by implementing the `OAuthProviderCredentials` interface.
+   *
+   * Built-in OAuth providers:
+   * ```ts
+   * oauth: ["github", "google"]
+   * ```
+   * Custom credentials via factory:
+   * ```ts
+   * oauth: [github({ clientId: "...", clientSecret: "..." })]
+   * ```
+   * Custom OAuth providers:
+   * ```ts
+   * oauth: [
+   *   {
+   *     id: "oauth-providers",
+   *     name: "OAuth",
+   *     authorizeURL: "https://example.com/oauth/authorize",
+   *     accessToken: "https://example.com/oauth/token",
+   *     scope: "profile email",
+   *     responseType: "code",
+   *     userInfo: "https://example.com/oauth/userinfo",
+   *     clientId: process.env.AURA_AUTH_PROVIDER_CLIENT_ID,
+   *     clientSecret: process.env.AURA_AUTH_PROVIDER_CLIENT_SECRET,
+   *   }
+   * ]
+   * ```
+   */
+  oauth: (BuiltInOAuthProvider | OAuthProviderCredentials<any, ShapeToObject<Identity>>)[];
+  /**
+   * Cookie options defines the configuration for cookies used in Aura Auth.
+   * It includes a prefix for cookie names and flag options to determine
+   * the security and scope of the cookies.
+   *
+   * **⚠️ WARNING:** Ensure that the cookie options are configured correctly to
+   * maintain the security and integrity of the authentication process. `Aura Auth`
+   * is not responsible for misconfigured cookies that may lead to security vulnerabilities.
+   *
+   * - prefix: A string prefix to be added to all cookie names, by default "aura-stack".
+   * - flag options (This attributes help to define the security level of the cookies):
+   *   - secure: Cookies use the __Secure- prefix and are only sent over HTTPS connections.
+   *   - host: Cookies use the __Host- prefix and are only sent over HTTPS connections.
+   *   - standard: Cookies can be sent over both HTTP and HTTPS connections. (default in development)
+   *
+   * @see https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html#name-the-__secure-prefix
+   * @see https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html#name-the-__host-prefix
+   */
+  cookies?: Partial<CookieConfig>;
+  /**
+   * Secret used to sign and verify JWT tokens for session and csrf protection.
+   * If not provided, it will load from the environment variable `AURA_AUTH_SECRET` or `AUTH_SECRET`, but if it
+   * doesn't exist, it will throw an error during the initialization of the Auth module.
+   */
+  secret?: JWTKey;
+  /**
+   * Base URL of the application, used to construct the incoming request's origin.
+   */
+  baseURL?: string;
+  /**
+   * Base path for all authentication routes. Default is `/auth`.
+   */
+  basePath?: `/${string}`;
+  /**
+   * Enable trusted proxy headers for scenarios where the application is behind a reverse proxy or load balancer.
+   * This setting allows Aura Auth to correctly interpret headers like `X-Forwarded-For` and `X-Forwarded-Proto`
+   * to determine the original client IP address and protocol.
+   *
+   * Default is `false`. Enable this option only if you are certain that your application is behind a trusted proxy.
+   * Misconfiguration can lead to security vulnerabilities, such as incorrect handling of secure cookies or
+   * inaccurate client IP logging.
+   *
+   * This value can also be set via environment variable as `AURA_AUTH_TRUSTED_PROXY_HEADERS`
+   *
+   * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For
+   * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Proto
+   * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Forwarded
+   * @experimental
+   */
+  trustedProxyHeaders?: boolean;
+  /**
+   * Logger configuration for handling authentication-related logs and errors. It can be set to `true`,
+   * `DEBUG=true`, `LOG_LEVEL=debug`, or a custom logger. It implements the syslog format.
+   */
+  logger?: boolean | Logger;
+  /**
+   * Defines trusted origins for your application to prevent open redirect attacks.
+   * URLs from the Referer header, Origin header, request URL, and redirectTo option
+   * are validated against this list before redirecting.
+   *
+   * - **Exact URL**: `https://example.com` matches only that origin.
+   * - **Subdomain wildcard**: `https://*.example.com` matches `https://app.example.com`, `https://api.example.com`, etc.
+   * @example
+   * trustedOrigins: ["https://example.com", "https://*.example.com", "http://localhost:3000"]
+   *
+   *
+   * trustedOrigins: async (request) => {
+   *   const origin = new URL(request.url).origin
+   *   return [origin, "https://admin.example.com"]
+   * }
+   */
+  trustedOrigins?: TrustedOrigin[] | ((request: Request) => Promise<TrustedOrigin[]> | TrustedOrigin[]);
+  /**
+   * Defines the session management strategy for Aura Auth. It determines how sessions are created, stored, and validated.
+   */
+  session?: SessionConfig;
+  /**
+   * Identity schema configuration for user data validation.
+   * Allows you to define a custom Zod schema that will be used to validate:
+   * - OAuth provider profile data
+   * - Session user data
+   * - JWT payload data
+   *
+   * If not provided, the default `UserIdentity` schema will be used.
+   *
+   * @example
+   * identity: {
+   *   schema: z.object({
+   *     sub: z.string(),
+   *     email: z.string().email(),
+   *     name: z.string().optional(),
+   *     custom_field: z.string().optional(),
+   *   }),
+   *   skipValidation: false,
+   *   unknownKeys: "strip",
+   * }
+   */
+  identity?: Partial<{
+    skipValidation: boolean;
+    schema: ZodObject<Identity>;
+    unknownKeys: "passthrough" | "strict" | "strip";
+  }>;
+  /**
+   * Credentials provider for username/password or similar authentication.
+   */
+  credentials?: CredentialsProvider<Identity>;
+}
+/**
+ * Cookie type with __Secure- prefix, must be Secure.
+ * @see https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html#name-the-__secure-prefix
+ */
+type SecureCookie = {
+  strategy: "secure";
+} & Prettify$1<Omit<SerializeOptions, "secure" | "encode">>;
+/**
+ * Cookie type with __Host- prefix, must be Secure, Path=/, no Domain attribute.
+ * @see https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html#name-the-__host-prefix
+ */
+type HostCookie = {
+  strategy: "host";
+} & Prettify$1<Omit<SerializeOptions, "secure" | "path" | "domain" | "encode">>;
+/**
+ * Standard cookie type without security prefixes.
+ * Can be sent over both HTTP and HTTPS connections (default in development).
+ */
+type StandardCookie = {
+  strategy?: "standard";
+} & Prettify$1<Omit<SerializeOptions, "encode">>;
+/**
+ * Union type for cookie options based on the specified strategy.
+ * - `secure`: Cookies are only sent over HTTPS connections
+ * - `host`: Cookies use the __Host- prefix and are only sent over HTTPS connections
+ * - `standard`: Cookies can be sent over both HTTP and HTTPS connections (default in development)
+ */
+type CookieStrategyAttributes = StandardCookie | SecureCookie | HostCookie;
+/**
+ * Names of cookies used by Aura Auth for session management and OAuth flows.
+ * - `sessionToken`: User session JWT
+ * - `csrfToken`: CSRF protection token
+ * - `state`: OAuth state parameter for CSRF protection
+ * - `code_verifier`: PKCE code verifier for authorization code flow
+ * - `redirect_uri`: OAuth callback URI
+ * - `redirect_to`: Post-authentication redirect path
+ * - `nonce`: OpenID Connect nonce parameter
+ */
+type CookieName = "sessionToken" | "csrfToken" | "state" | "codeVerifier" | "redirectTo" | "redirectURI";
+/** Resolved cookie names and serialization attributes for each logical auth cookie. */
+type CookieStoreConfig = Record<CookieName, {
+  name: string;
+  attributes: CookieStrategyAttributes;
+}>;
+interface CookieConfig {
+  /**
+   * Prefix to be added to all cookie names. By default "aura-stack".
+   */
+  prefix?: string;
+  overrides?: Partial<CookieStoreConfig>;
+}
+/**
+ * A trusted origin URL or pattern. Supports:
+ * - Exact: `https://example.com`
+ * - Subdomain wildcard: `https://*.example.com`
+ */
+type TrustedOrigin = string;
+/**
+ * Log level for logger messages.
+ */
+type LogLevel = "warn" | "error" | "debug" | "info";
+/** Defines the Severity between 0 to 7 */
+type Severity = "emergency" | "alert" | "critical" | "error" | "warning" | "notice" | "info" | "debug";
+/**
+ * @see https://datatracker.ietf.org/doc/html/rfc5424
+ */
+type SyslogOptions = {
+  facility: 4 | 10;
+  severity: Severity;
+  timestamp?: string;
+  hostname?: string;
+  appName?: string;
+  procId?: string;
+  msgId: string;
+  message: string;
+  structuredData?: Record<string, string | number | boolean>;
+};
+/**
+ * Logger function interface for structured logging.
+ * Called when errors or warnings occur during authentication flows.
+ */
+interface Logger {
+  level?: LogLevel;
+  log?: (args: SyslogOptions) => void;
+}
+/**
+ * Programmatic auth API returned with the auth instance: `getSession`, `signIn`, `signInCredentials`, `signOut`, `updateSession`.
+ * Each method returns a result object plus `headers` and `toResponse()` for HTTP responses.
+ */
+type AuthAPI<DefaultUser extends User = User> = ReturnType<typeof createAuthAPI<DefaultUser>>;
+/** JWT and crypto helpers bound to the configured identity schema (sign, verify, claims). */
+type JoseInstance<DefaultUser extends User = User> = ReturnType<typeof createJoseInstance<DefaultUser>>;
+/** Normalized internal logger with resolved level and structured log function. */
+interface InternalLogger {
+  level: LogLevel;
+  log: typeof createLogEntry;
+}
+/**
+ * Identity validation settings used when building session strategy and OAuth profile mapping.
+ * Controls the Zod schema and how unknown keys are handled on user objects.
+ */
+interface IdentityConfig<Schema extends ZodObject<any> = typeof UserIdentity> {
+  schema?: Schema;
+  skipValidation?: boolean;
+  unknownKeys?: "passthrough" | "strict" | "strip";
+}
+/** Payload sent to the credentials sign-in endpoint (username/password flow). */
+interface CredentialsPayload {
+  username: string;
+  password: string;
+}
+/**
+ * Context provided to the credentials provider's authorize function.
+ * It includes the credentials sent by the user and hashing utilities.
+ */
+interface CredentialsProviderContext<T> {
+  /**
+   * User-provided credentials (e.g., email, password).
+   */
+  credentials: T;
+  /**
+   * Hashes a password using the internal hashing algorithm (PBKDF2).
+   */
+  deriveSecret: (password: string, salt?: string, iterations?: number) => Promise<string>;
+  /**
+   * Verifies a password against a hashed value.
+   */
+  verifySecret: (password: string, hashedPassword: string) => Promise<boolean>;
+}
+/**
+ * Interface for the credentials provider.
+ */
+interface CredentialsProvider<Identity extends EditableShape<UserShape> = EditableShape<UserShape>> {
+  hash?: (password: string, salt?: string, iterations?: number) => Promise<string>;
+  verify?: (password: string, hashedPassword: string) => Promise<boolean>;
+  /**
+   * Authenticates a user using credentials.
+   * Must return a User object or the identity type if the identity schema is provided.
+   */
+  authorize: (ctx: CredentialsProviderContext<CredentialsPayload>) => Promise<ShapeToObject<Identity> | null> | ShapeToObject<Identity> | null;
+}
+/**
+ * Runtime context passed into auth actions and API handlers: OAuth map, cookies, JWT, session strategy, trusted origins, etc.
+ * This is the fully resolved configuration surface after `createAuth` initializes defaults.
+ */
+interface RouterGlobalContext<DefaultUser extends User = User> {
+  oauth: OAuthProviderRecord;
+  credentials?: CredentialsProvider<any>;
+  cookies: CookieStoreConfig;
+  jose: JoseInstance<DefaultUser>;
+  secret?: JWTKey;
+  baseURL?: string;
+  basePath: string;
+  trustedProxyHeaders: boolean;
+  trustedOrigins?: TrustedOrigin[] | ((request: Request) => Promise<TrustedOrigin[]> | TrustedOrigin[]);
+  logger?: InternalLogger;
+  sessionStrategy: SessionStrategy<DefaultUser>;
+  identity: {
+    unknownKeys: "passthrough" | "strict" | "strip";
+    schema: ZodObject<any>;
+    skipValidation?: boolean;
+  };
+}
+/**
+ * Internal runtime configuration used within Aura Auth after initialization.
+ * All optional fields from AuthConfig are resolved to their default values.
+ */
+type AuthRuntimeConfig<DefaultUser extends User = User> = RouterGlobalContext<DefaultUser>;
+/**
+ * Public auth instance: programmatic {@link AuthAPI}, {@link JoseInstance}, and HTTP {@link AuthClient} handlers.
+ */
+interface AuthInstance<DefaultUser extends User = User> {
+  api: AuthAPI<DefaultUser>;
+  jose: JoseInstance<DefaultUser>;
+  handlers: {
+    GET: (request: Request) => Response | Promise<Response>;
+    POST: (request: Request) => Response | Promise<Response>;
+    PATCH: (request: Request) => Response | Promise<Response>;
+    ALL: (request: Request) => Response | Promise<Response>;
+  };
+}
+/**
+ * Extended context used inside the library with both secure and standard cookie materializations.
+ */
+type InternalContext<Identity extends EditableShape<UserShape>> = RouterGlobalContext<ShapeToObject<Identity> & User> & {
+  cookieConfig: {
+    secure: CookieStoreConfig;
+    standard: CookieStoreConfig;
+  };
+};
+//#endregion
+//#region src/@types/session.d.ts
+/** Application user type, inferred from the configured identity schema (defaults to the built-in user shape). */
+type User = UserIdentityType;
+/**
+ * Session data returned by the session endpoint.
+ */
+interface Session<DefaultUser extends User = User> {
+  user: DefaultUser;
+  expires: string;
+}
+/**
+ * A symmetric secret or asymmetric key pair used for JWT operations.
+ *
+ * - string / Uint8Array: used as-is for HMAC (signed) or AES (encrypted)
+ * - CryptoKey: Web Crypto API key, for environments that support it
+ * - KeyPair: asymmetric signing (RS256, ES256, EdDSA, etc.)
+ */
+type SecretKey = string | Uint8Array | CryptoKey;
+/** Asymmetric key pair for signing or key agreement (Web Crypto `CryptoKey` pair). */
+interface KeyPair {
+  privateKey: CryptoKey;
+  publicKey: CryptoKey;
+}
+/**
+ * @todo: add key rotation support for "SecretKey | KeyPair | [SecretKey | KeyPair, ...(SecretKey | KeyPair)[]]"
+ */
+type JWTKey = SecretKey;
+/**
+ * - "signed"    → standard JWS (e.g. HS256, RS256, ES256).
+ * - "encrypted" → JWE only. (e.g. A256GCM with RSA-OAEP key wrapping).
+ * - "sealed"    → JWS nested inside JWE (signed then encrypted).
+ */
+type JWTMode = "signed" | "encrypted" | "sealed";
+/**
+ * Signing algorithms for "signed" and "sealed" modes.
+ * Symmetric: HS256 | HS384 | HS512
+ * Asymmetric: RS256 | RS384 | RS512 | ES256 | ES384 | ES512 | EdDSA | PS256
+ */
+type JWTSigningAlgorithm = "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "EdDSA" | "PS256";
+/**
+ * Key-wrapping algorithms for "encrypted" and "sealed" modes.
+ * Symmetric: A128KW | A192KW | A256KW | dir (direct)
+ * ECDH:      ECDH-ES | ECDH-ES+A128KW | ECDH-ES+A256KW
+ * RSA:       RSA-OAEP | RSA-OAEP-256
+ */
+type JWTKeyAlgorithm = "A128KW" | "A192KW" | "A256KW" | "dir" | "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A256KW" | "RSA-OAEP" | "RSA-OAEP-256";
+/** Content-encryption algorithms for JWE. */
+type JWTEncryptionAlgorithm = "A128CBC-HS256" | "A192CBC-HS384" | "A256CBC-HS512" | "A128GCM" | "A192GCM" | "A256GCM";
+/** Signed JWT mode configuration. */
+type JWTSignedMode = {
+  mode: "signed";
+  signingAlgorithm?: JWTSigningAlgorithm;
+};
+/** Encrypted JWT mode configuration. */
+type JWTEncryptedMode = {
+  mode: "encrypted";
+  keyAlgorithm?: JWTKeyAlgorithm;
+  encryptionAlgorithm?: JWTEncryptionAlgorithm;
+};
+/** Signed and Encrypted JWT mode configuration. */
+type JWTSealedMode = {
+  mode?: "sealed";
+  signingAlgorithm?: JWTSigningAlgorithm;
+  keyAlgorithm?: JWTKeyAlgorithm;
+  encryptionAlgorithm?: JWTEncryptionAlgorithm;
+};
+/** Discriminated union of JWT wire format: signed JWS, encrypted JWE, or nested sealed (JWS in JWE). */
+type JWTConfigBase = JWTSignedMode | JWTEncryptedMode | JWTSealedMode;
+/** How session/JWT lifetime is enforced relative to `iat`, absolute caps, and sliding windows. */
+type JWTExpirationStrategy = "fixed" | "rolling" | "absolute" | "sliding";
+type JWTConfig = {
+  /**
+   * Token lifetime.
+   */
+  maxAge?: number;
+  /**
+   * JWT `iss` (issuer) claim. Set this to your app's canonical URL.
+   * @example "https://auth.example.com"
+   */
+  issuer?: string;
+  /**
+   * JWT `aud` claim. Single value or array for multi-audience tokens.
+   * @example ["https://api.example.com", "https://app.example.com"]
+   */
+  audience?: string | string[];
+  /**
+   * Maximum absolute session duration in seconds.
+   * Required for "absolute" and "sliding" strategies.
+   * Enforced via jose's maxTokenAge against the iat claim.
+   */
+  maxExpiration?: number;
+  /**
+   * Policy for renewing or capping token lifetime (pairs with `maxExpiration` where applicable).
+   */
+  expirationStrategy?: JWTExpirationStrategy;
+} & JWTConfigBase;
+/**
+ * Stateless JWT strategy.
+ * No database required. Tokens are self-contained and cannot be revoked
+ * before they expire — keep `jwt.maxAge` short or enable refresh tokens.
+ *
+ * @example
+ * {
+ *   strategy: "jwt",
+ *   jwt: { mode: "sealed", maxAge: "15m", issuer: "https://auth.example.com" },
+ *   refreshToken: { enabled: true, maxAge: "7d" },
+ * }
+ */
+type StatelessStrategyConfig = {
+  strategy?: "jwt";
+  jwt?: JWTConfig;
+};
+/**
+ * The session strategy. Determines which fields below are required.
+ *
+ * - "jwt": stateless. No database needed. JWTs are self-contained.
+ * - "database": stateful. Every request hits the DB to validate the session.
+ * - "hybrid": JWT transport + DB revocation. Best of both for most apps.
+ *
+ * @default "jwt"
+ */
+type SessionConfig = StatelessStrategyConfig;
+/** Result of reading a stateless (JWT) session from a request: session payload and outgoing header mutations. */
+interface GetStatelessSessionReturn<DefaultUser extends User = User> {
+  session: Session<DefaultUser> | null;
+  headers: Headers;
+}
+/**
+ * Abstraction layer for session management.
+ */
+interface SessionStrategy<DefaultUser extends User = User> {
+  /**
+   * Read and validate the session from an incoming request.
+   * Returns null if absent, invalid, or expired. Never throws on auth failure.
+   */
+  getSession(request: Headers): Promise<GetStatelessSessionReturn<DefaultUser>>;
+  /**
+   * Create a session after successful authentication.
+   * Signs the JWT / writes the DB row / sets cookies.
+   */
+  createSession(session: User): Promise<string>;
+  /**
+   * Attempt to refresh using the refresh token cookie.
+   * Returns null session + cookie-clearing response on any failure.
+   */
+  refreshSession(headers: Headers, session: DeepPartial<Session<DefaultUser>>, skipCSRFCheck?: boolean): Promise<{
+    session: Session<DefaultUser> | null;
+    headers: Headers;
+  }>;
+  /**
+   * Revoke a session by ID.
+   * JWT strategy: best-effort (clears cookies, no server state).
+   * Database / hybrid: marks row inactive.
+   */
+  revokeSession(sessionId: string): Promise<void>;
+  /**
+   * Destroy the session attached to this request (logout).
+   * Returns a response that clears cookies.
+   */
+  destroySession(request: Headers, skipCSRFCheck?: boolean): Promise<Headers>;
+}
+/** Inputs for constructing a session strategy implementation for a given identity schema. */
+interface CreateSessionStrategyOptions<Identity extends EditableShape<UserShape>> {
+  config?: SessionConfig;
+  jose: JoseInstance<ShapeToObject<Identity> & User>;
+  cookies: () => CookieStoreConfig;
+  logger?: InternalLogger;
+  identity: IdentityConfig;
+}
+/** Options specialized for the JWT-backed session strategy. */
+interface JWTStrategyOptions<DefaultUser extends User = User> {
+  config?: StatelessStrategyConfig;
+  jose: JoseInstance<DefaultUser>;
+  logger?: InternalLogger;
+  cookies: () => CookieStoreConfig;
+  identity: IdentityConfig;
+}
+/** Minimal token issue/verify surface used by session code paths. */
+type JWTManager<DefaultUser extends User = User> = {
+  createToken(user: TypedJWTPayload<Partial<DefaultUser>>): Promise<string>;
+  verifyToken(token: string): Promise<TypedJWTPayload<DefaultUser>>;
+};
+//#endregion
+//#region src/@types/utility.d.ts
+/** Expands intersection types into a single flat object type for readable editor hints. */
+type Prettify$1<T> = { [K in keyof T]: T[K] };
+/**
+ * A string that must be one of the literals in `T`, or any other string (`U`).
+ * Useful for autocomplete on known keys while still allowing custom values.
+ */
+type LiteralUnion<T extends U, U = string> = T | (U & Record<never, never>);
+/**
+ * Transforms a Zod raw shape so nested `ZodObject` fields become editable (same structure, for config authoring).
+ */
+type EditableShape<T extends ZodRawShape> = { [K in keyof T]: T[K] extends ZodObject<infer Inner extends ZodRawShape> ? ZodObject<EditableShape<Inner>> : ZodTypeAny };
+/** Merges type `B` over `A`, replacing overlapping keys with `B`. */
+type Merge<A, B> = Omit<A, keyof B> & B;
+/**
+ * Infers the runtime object type from a Zod `shape` and intersects it with {@link User}
+ * so identity fields always include the base user contract.
+ */
+type ShapeToObject<S extends ZodRawShape = ZodRawShape> = Merge<{ [K in keyof S]: z.infer<S[K]> }, User>;
+/** Recursively makes every property required. */
+type DeepRequired<T> = { [K in keyof T]-?: T[K] extends object ? DeepRequired<T[K]> : T[K] };
+/** Recursively makes every property optional. */
+type DeepPartial<T> = { [P in keyof T]?: T[P] extends object ? DeepPartial<T[P]> : T[P] };
+/** Resolves the user identity type from an {@link AuthInstance} config, or falls back to {@link User}. */
+type InferAuthIdentity<Config> = Config extends AuthInstance<infer Identity> ? Prettify$1<Identity> : User;
+/** Shorthand for a Zod object’s `.shape` property. */
+type InferShape<T extends ZodObject> = T["shape"];
+/** Runtime user object type inferred from a Zod identity schema. */
+type InferIdentity<T extends ZodObject> = ShapeToObject<InferShape<T>>;
+/**
+ * HTTP `Response` with `json()` typed to resolve to `Body` (defaults to `unknown`).
+ */
+type AuthResponse<Body = unknown> = Prettify$1<Omit<Response, "json"> & {
+  json(): Promise<Body>;
+}>;
+//#endregion
+//#region src/createAuth.d.ts
+declare const createAuthInstance: <Identity extends EditableShape<UserShape>>(authConfig: AuthConfig<Identity>) => {
+  handlers: _$_aura_stack_router0.Router<[_$_aura_stack_router0.RouteEndpoint<"GET", "/signIn/:oauth", {
+    schemas?: {
+      params: _$zod.ZodObject<{
+        oauth: _$zod.ZodEnum<{
+          [x: string & Record<never, never>]: string & Record<never, never>;
+          github: "github";
+          bitbucket: "bitbucket";
+          figma: "figma";
+          discord: "discord";
+          gitlab: "gitlab";
+          spotify: "spotify";
+          x: "x";
+          strava: "strava";
+          mailchimp: "mailchimp";
+          pinterest: "pinterest";
+          twitch: "twitch";
+          notion: "notion";
+          dropbox: "dropbox";
+          atlassian: "atlassian";
+        }>;
+      }, _$zod_v4_core0.$strip>;
+      searchParams: _$zod.ZodObject<{
+        redirect: _$zod.ZodDefault<_$zod.ZodOptional<_$zod.ZodCodec<_$zod.ZodString, _$zod.ZodBoolean>>>;
+        redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
+      }, _$zod_v4_core0.$strip>;
+    } | undefined;
+  }>, _$_aura_stack_router0.RouteEndpoint<"POST", "/signIn/credentials", {
+    schemas?: {
+      body: _$zod.ZodObject<{
+        username: _$zod.ZodString;
+        password: _$zod.ZodString;
+      }, _$zod_v4_core0.$strip>;
+      searchParams: _$zod.ZodObject<{
+        redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
+      }, _$zod_v4_core0.$strip>;
+    } | undefined;
+  }>, _$_aura_stack_router0.RouteEndpoint<"GET", "/callback/:oauth", {
+    schemas?: {
+      params: _$zod.ZodObject<{
+        oauth: _$zod.ZodEnum<{
+          [x: string & Record<never, never>]: string & Record<never, never>;
+          github: "github";
+          bitbucket: "bitbucket";
+          figma: "figma";
+          discord: "discord";
+          gitlab: "gitlab";
+          spotify: "spotify";
+          x: "x";
+          strava: "strava";
+          mailchimp: "mailchimp";
+          pinterest: "pinterest";
+          twitch: "twitch";
+          notion: "notion";
+          dropbox: "dropbox";
+          atlassian: "atlassian";
+        }>;
+      }, _$zod_v4_core0.$strip>;
+      searchParams: _$zod.ZodObject<{
+        code: _$zod.ZodString;
+        state: _$zod.ZodString;
+      }, _$zod_v4_core0.$strip>;
+    } | undefined;
+  }>, _$_aura_stack_router0.RouteEndpoint<"GET", "/session", {
+    schemas?: _$_aura_stack_router0.EndpointSchemas | undefined;
+  }>, _$_aura_stack_router0.RouteEndpoint<"POST", "/signOut", {
+    schemas?: {
+      searchParams: _$zod.ZodObject<{
+        token_type_hint: _$zod.ZodLiteral<"session_token">;
+        redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
+      }, _$zod_v4_core0.$strip>;
+    } | undefined;
+  }>, _$_aura_stack_router0.RouteEndpoint<"GET", "/csrfToken", {
+    schemas?: _$_aura_stack_router0.EndpointSchemas | undefined;
+  }>, _$_aura_stack_router0.RouteEndpoint<"PATCH", "/session", {
+    schemas?: {
+      body: _$zod.ZodObject<{
+        user: _$zod.ZodOptional<_$zod.ZodObject<{
+          sub: _$zod.ZodOptional<_$zod.ZodString>;
+          name: _$zod.ZodOptional<_$zod.ZodOptional<_$zod.ZodNullable<_$zod.ZodString>>>;
+          image: _$zod.ZodOptional<_$zod.ZodOptional<_$zod.ZodNullable<_$zod.ZodString>>>;
+          email: _$zod.ZodOptional<_$zod.ZodOptional<_$zod.ZodNullable<_$zod.ZodEmail>>>;
+        }, _$zod_v4_core0.$strip>> | undefined;
+        expires: _$zod.ZodOptional<_$zod.ZodCoercedDate<unknown>>;
+      }, _$zod_v4_core0.$strip>;
+    } | undefined;
+  }>]>;
+  jose: any;
+  api: {
+    getSession: (options: GetSessionAPIOptions) => Promise<GetSessionAPIReturn<{
+      sub: string;
+      name?: string | null | undefined;
+      image?: string | null | undefined;
+      email?: string | null | undefined;
+    }>>;
+    signIn: (oauth: LiteralUnion<BuiltInOAuthProvider>, options?: SignInAPIOptions) => Promise<SignInAPIReturn>;
+    signInCredentials: (options: SignInCredentialsAPIOptions) => Promise<SignInCredentialsAPIReturn>;
+    updateSession: (options: UpdateSessionAPIOptions<{
+      sub: string;
+      name?: string | null | undefined;
+      image?: string | null | undefined;
+      email?: string | null | undefined;
+    }>) => Promise<UpdateSessionAPIReturn<{
+      sub: string;
+      name?: string | null | undefined;
+      image?: string | null | undefined;
+      email?: string | null | undefined;
+    }>>;
+    signOut: (options: SignOutAPIOptions) => Promise<SignOutAPIReturn>;
+  };
+};
+/**
+ * Creates the authentication instance with the configuration provided for OAuth provider.
+ * > NOTE: The handlers returned by this function should be used in the server to handle the authentication routes
+ * and within the `/auth` base path
+ *
+ * @param authConfig - Authentication configuration including OAuth provider
+ * @returns Authentication instance with handlers to be used in the server
+ * @example
+ * const auth = createAuth({
+ *   oauth: ["github", {
+ *     id: "custom-oauth",
+ *     name: "custom-oauth",
+ *     authorize: {
+ *       url: "https://custom-oauth.com/oauth/authorize",
+ *       params: { responseType: "code", scope: "profile email" },
+ *     },
+ *     accessToken: "https://custom-oauth.com/oauth/token",
+ *     userInfo: "https://custom-oauth.com/api/userinfo",
+ *     clientId: process.env.AURA_AUTH_CUSTOM_OAUTH_CLIENT_ID!,
+ *     clientSecret: process.env.AURA_AUTH_CUSTOM_OAUTH_CLIENT_SECRET!,
+ *   }]
+ * })
+ */
+declare const createAuth: <Identity extends EditableShape<UserShape>>(config: AuthConfig<Identity>) => AuthInstance<ShapeToObject<Identity>>;
+//#endregion
+//#region src/@types/errors.d.ts
+/** Map of field or logical keys to API validation error payloads (code + message). */
+type APIErrorMap = Record<string, {
+  code: string;
+  message: string;
+}>;
+/**
+ * Base OAuth error response structure.
+ */
+interface OAuthError<T extends string> {
+  error: T;
+  error_description?: string;
+}
+/**
+ * OAuth 2.0 Authorization Error Response Types
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1
+ */
+type AuthorizationError = OAuthError<z.infer<typeof OAuthAuthorizationErrorResponse>["error"]>;
+/**
+ * OAuth 2.0 Access Token Error Response Types
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+ */
+type AccessTokenError = OAuthError<z.infer<typeof OAuthAccessTokenErrorResponse>["error"]>;
+/**
+ * OAuth 2.0 Token Revocation Error Response Types
+ * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.2.1
+ */
+type TokenRevocationError = OAuthError<"invalid_session_token">;
+/** Union of all OAuth-related `error` string values exposed by this package. */
+type ErrorType = AuthorizationError["error"] | AccessTokenError["error"] | TokenRevocationError["error"];
+/**
+ * Machine-readable codes for internal auth failures (configuration, crypto, environment, etc.).
+ * Used with {@link AuthInternalError} and logging.
+ */
+type AuthInternalErrorCode = "INVALID_OAUTH_CONFIGURATION" | "INVALID_JWT_TOKEN" | "JOSE_INITIALIZATION_FAILED" | "SESSION_STORE_NOT_INITIALIZED" | "COOKIE_STORE_NOT_INITIALIZED" | "COOKIE_PARSING_FAILED" | "COOKIE_NOT_FOUND" | "INVALID_ENVIRONMENT_CONFIGURATION" | "INVALID_URL" | "INVALID_SALT_SECRET_VALUE" | "UNTRUSTED_ORIGIN" | "INVALID_OAUTH_PROVIDER_CONFIGURATION" | "DUPLICATED_OAUTH_PROVIDER_ID" | "CREDENTIALS_PROVIDER_NOT_CONFIGURED" | "IDENTITY_VALIDATION_FAILED";
+/**
+ * Machine-readable codes for security-sensitive failures (CSRF, session, open redirect, OAuth state).
+ */
+type AuthSecurityErrorCode = "INVALID_STATE" | "MISMATCHING_STATE" | "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED" | "CSRF_TOKEN_INVALID" | "CSRF_TOKEN_MISSING" | "SESSION_TOKEN_MISSING";
+//#endregion
+//#region src/@types/api.d.ts
+/**
+ * Canonical return shape for server/programmatic API functions.
+ *
+ * - Success branch includes the payload fields from `Body` plus response metadata.
+ * - Failure branch includes `error` metadata and `toResponse()` for framework adapters.
+ * - Both branches expose `headers` so callers can forward cookies and auth-related headers.
+ *
+ * @typeParam Body - Union of success/failure payload variants.
+ * @typeParam ErrorCodes - Error code union for the failure branch (`error.code`).
+ */
+type AuthActionAPIReturn<Body extends object, ErrorCodes = any> = (Extract<Body, {
+  success: true;
+}> & {
+  headers: Headers;
+  toResponse: () => AuthResponse<Exclude<Body, {
+    success: false;
+  }>>;
+}) | (Extract<Body, {
+  success: false;
+}> & {
+  success: false;
+  headers: Headers; /** @todo: Add `docs` property */
+  error: {
+    code: ErrorCodes;
+    message: string;
+  };
+  toResponse: () => AuthResponse<Exclude<Body, {
+    success: true;
+  }>>;
+});
+/**
+ * Utility to merge the internal router global context (`ctx`) with per-function options.
+ * Used by implementation-level API functions in `src/api/*`.
+ */
+type FunctionAPIContext<Options extends object> = Prettify<{
+  ctx: RouterGlobalContext;
+} & Options>;
+interface OptionsWithRedirectTo {
+  /**
+   * Optional `redirect` flag used by `createAuthClient` to control client-side navigation behavior.
+   *
+   * By default, navigation is performed with `location.assign()`.
+   * When set to `false`, the API returns `redirectURL` so the caller can handle navigation manually.
+   * @default `true`
+   * @example
+   * redirect: true
+   */
+  redirect?: boolean;
+  /**
+   * Optional destination after a successful action.
+   *
+   * Supports relative paths and absolute URLs. The value is validated against `trustedOrigins`
+   * to ensure redirects are allowed.
+   * @example
+   * redirectTo: "/dashboard"
+   * redirectTo: "https://example.com/dashboard"
+   */
+  redirectTo?: string;
+}
+interface APIOptionsWithRedirectTo {
+  /**
+   * Optional redirect strategy for server/programmatic API functions.
+   *
+   * - `true`: the generated response is a redirect response.
+   * - `false`: the API returns redirect data (`signInURL` or `redirectURL`) for custom handling.
+   *
+   * Defaults are action-specific; see each API option type.
+   * @experimental
+   */
+  redirect?: boolean;
+  /**
+   * Optional destination after a successful action.
+   *
+   * Validation includes:
+   * - same-origin checks using the URL derived from `request`/`headers` and configured base URL
+   * - `trustedOrigins` checks from auth configuration
+   * @experimental
+   * @example
+   * // with `request`
+   * const response = await api.signIn("github", {
+   *   redirectTo: "/dashboard",
+   *   request: await getRequest(),
+   * })
+   *
+   * // with `baseURL`
+   * const { api: { signIn } } = await createAuth({
+   *   oauth: ["github"],
+   *   baseURL: "https://example.com"
+   * })
+   *
+   * const response = await signIn("github", {
+   *   redirectTo: "https://example.com/dashboard",
+   * })
+   */
+  redirectTo?: string;
+}
+interface APIOptionsWithRequest extends APIOptionsWithRedirectTo {
+  /**
+   * Optional `Request` object, useful for constructing the incoming URL on the server side.
+   * This option is required when the `redirectTo` option is defined, to ensure the `redirectTo`
+   * URL is same-origin or included in the `trustedOrigins` configuration option.
+   */
+  request?: Request;
+  /**
+   * Optional `HeadersInit` object, useful for constructing the incoming URL from proxy headers
+   * such as `X-Forwarded-Host` and `X-Forwarded-Proto` when the auth instance is behind a proxy
+   * or load balancer, or when the URL is built from headers instead of the `Request` object.
+   * This option requires enabling the `trustedProxyHeaders` option in the global configuration.
+   */
+  headers?: HeadersInit;
+}
+interface APIOptionsWithSkipCSRFCheck {
+  /**
+   * Optional `skipCSRFCheck` flag to bypass the Double-Submit Cookie validation.
+   *
+   * The CSRF token is still required and validated to preserve request integrity.
+   * Use this only for trusted server-side flows.
+   * @default `false`
+   */
+  skipCSRFCheck?: boolean;
+}
+/** Options to get the current session. */
+interface GetSessionAPIOptions {
+  /** The headers containing the `session_token` cookie */
+  headers: HeadersInit;
+}
+/** Programmatic `getSession` result with session payload and `toResponse()` metadata. */
+type GetSessionAPIReturn<DefaultUser extends User = User> = AuthActionAPIReturn<{
+  success: true;
+  session: Session<DefaultUser>;
+} | {
+  success: false;
+  session: null;
+}>;
+/**
+ * Client-side options for `createAuthClient().signIn(...)`.
+ */
+interface SignInOptions extends OptionsWithRedirectTo {}
+/**
+ * Client-side `signIn` return type.
+ *
+ * - Redirect mode (`redirect: true`): returns `void` because navigation is handled by the client.
+ * - Manual mode (`redirect: false`): returns `signInURL` for caller-controlled navigation.
+ */
+type SignInReturn<Options extends SignInOptions> = Options extends {
+  redirect: false;
+} ? {
+  success: true;
+  redirect: false;
+  signInURL: string;
+} | {
+  success: false;
+  redirect: false;
+  signInURL: null;
+} : void;
+/**
+ * Server/programmatic options for `signIn` API.
+ */
+interface SignInAPIOptions extends APIOptionsWithRedirectTo, APIOptionsWithRequest {}
+/**
+ * Server/programmatic `signIn` result.
+ *
+ * Includes `signInURL` and response metadata to support both framework-managed redirects
+ * and custom response handling through `toResponse()`.
+ */
+type SignInAPIReturn = AuthActionAPIReturn<{
+  success: true;
+  redirect: boolean;
+  signInURL: string;
+} | {
+  success: false;
+  redirect: false;
+  signInURL: null;
+}>;
+interface SignInCredentialsOptions extends OptionsWithRedirectTo {
+  /**
+   * Credentials payload validated by the configured `credentials.authorize` function.
+   * @example
+   * {
+   *   username: "johndoe",
+   *   password: "1234567890"
+   * }
+   */
+  payload: CredentialsPayload;
+}
+/** Client-side credentials sign-in return type (redirect mode or manual redirect data). */
+type SignInCredentialsReturn<Options extends SignInCredentialsOptions> = Options extends {
+  redirect: false;
+} ? {
+  success: true;
+  redirectURL: string;
+} | {
+  success: false;
+  redirectURL: null;
+} : void;
+/** Server/programmatic credentials sign-in options. */
+interface SignInCredentialsAPIOptions extends APIOptionsWithRedirectTo, APIOptionsWithRequest {
+  /**
+   * Credentials payload validated by the configured `credentials.authorize` function.
+   * @example
+   * {
+   *   username: "johndoe",
+   *   password: "1234567890"
+   * }
+   */
+  payload: CredentialsPayload;
+}
+/** Programmatic credentials sign-in result with response metadata and `toResponse()`. */
+type SignInCredentialsAPIReturn = AuthActionAPIReturn<{
+  success: true;
+  redirectURL: string;
+} | {
+  success: false;
+  redirectURL: null;
+}>;
+/** Client-side sign-out options. */
+interface SignOutOptions extends OptionsWithRedirectTo {}
+/** Client-side sign-out return type (redirect mode or manual redirect data). */
+type SignOutReturn<Options extends SignOutOptions> = Options extends {
+  redirect: false;
+} ? {
+  success: true;
+  redirect: false;
+  redirectURL: string;
+} | {
+  success: false;
+  redirect: false;
+  redirectURL: null;
+} : void;
+/** Server/programmatic options for `signOut` API. */
+interface SignOutAPIOptions extends APIOptionsWithRedirectTo, APIOptionsWithSkipCSRFCheck {
+  /**
+   * Required headers used to execute sign-out.
+   * Must include `session_token` and `csrf_token` cookies for CSRF validation.
+   * @example
+   * {
+   *   Cookie: "session_token=abc123; csrf_token=def456"
+   * }
+   */
+  headers: HeadersInit;
+  /**
+   * Optional `Request` object as an alternative to manually providing `headers`.
+   */
+  request?: Request;
+}
+/** Programmatic sign-out result with redirect metadata and `toResponse()`. */
+type SignOutAPIReturn = AuthActionAPIReturn<{
+  success: true;
+  redirect: boolean;
+  redirectURL: string;
+} | {
+  success: false;
+  redirect: boolean;
+  redirectURL: null;
+}>;
+/** Client-side `updateSession` options: partial session payload plus optional redirect behavior. */
+interface UpdateSessionOptions<DefaultUser extends User = User> extends OptionsWithRedirectTo {
+  /** Partial session data to merge into the current session. */
+  session: DeepPartial<Session<DefaultUser>>;
+}
+/** Client-side `updateSession` return type. */
+type UpdateSessionReturn<Options extends UpdateSessionOptions, DefaultUser extends User = User> = Options extends {
+  redirect: false;
+} ? {
+  success: true;
+  session: Session<DefaultUser>;
+} | {
+  success: false;
+  session: null;
+} : void;
+/** Server/programmatic options for `updateSession` API. */
+interface UpdateSessionAPIOptions<DefaultUser extends User = User> extends APIOptionsWithRequest, APIOptionsWithSkipCSRFCheck {
+  /**
+   * Required headers used to execute session update.
+   * Must include `session_token` and `csrf_token` cookies for CSRF validation.
+   * @example
+   * {
+   *  Cookie: "session_token=abc123; csrf_token=def456"
+   * }
+   */
+  headers: HeadersInit;
+  /**
+   * Optional `Request` object as an alternative to manually providing `headers`.
+   */
+  request?: Request;
+  /**
+   * Partial session payload used to update the current session.
+   * @see Session
+   * @example
+   * session: {
+   *   user: {
+   *     name: "John Doe",
+   *     email: "john.doe@example.com"
+   *   }
+   * }
+   */
+  session: DeepPartial<Session<DefaultUser>>;
+}
+/** Programmatic session update result with redirect metadata and `toResponse()`. */
+type UpdateSessionAPIReturn<DefaultUser extends User = User> = AuthActionAPIReturn<{
+  success: true;
+  session: Session<DefaultUser>;
+  redirectURL: string;
+} | {
+  success: false;
+  session: null;
+  redirectURL: null;
+}>;
+//#endregion
+//#region src/@types/index.d.ts
+/**
+ * Standard JWT claims that are managed internally by the token system.
+ * These fields are typically filtered out before returning user data.
+ */
+type JWTStandardClaims = Pick<JWTPayload, "exp" | "iat" | "jti" | "nbf" | "sub" | "aud" | "iss">;
+/**
+ * JWT payload structure that includes a mandatory `token` field used to verify CSRF Tokens
+ */
+type JWTPayloadWithToken = JWTPayload & {
+  token: string;
+};
+/** Environment variables for OAuth client credentials, inferred from `OAuthEnvSchema`. */
+type OAuthEnv = z.infer<typeof OAuthEnvSchema>;
+/**
+ * HTTP route handlers exposed by the auth instance (`GET`, `POST`, `PATCH`, `ALL`) for mounting on your app router.
+ */
+type AuthClient = ReturnType<typeof createAuthInstance>["handlers"];
+/**
+ * Options for {@link createAuthClient} (browser HTTP client). Extends the router client with an optional `baseURL`
+ * when the client runs outside the browser (e.g. server-side fetch to your app origin).
+ */
+type AuthClientOptions = Prettify$1<Omit<ClientOptions, "baseURL"> & {
+  baseURL?: string;
+}>;
+//#endregion
+export { JWTConfigBase as $, atlassian as $t, APIErrorMap as A, DiscordProfile as An, IdentityConfig as At, DeepPartial as B, UserIdentity as Bn, SyslogOptions as Bt, SignOutAPIReturn as C, XProfile as Cn, CookieName as Ct, UpdateSessionAPIReturn as D, spotify as Dn, CredentialsProvider as Dt, UpdateSessionAPIOptions as E, SpotifyProfile as En, CredentialsPayload as Et, ErrorType as F, BitbucketProfile as Fn, Logger as Ft, InferShape as G, OAuthProviderCredentials as Gt, EditableShape as H, UserShape as Hn, AuthorizeParams as Ht, OAuthError as I, bitbucket as In, RouterGlobalContext as It, Prettify$1 as J, BuiltInOAuthProvider as Jt, LiteralUnion as K, OAuthProviderRecord as Kt, TokenRevocationError as L, GitHubProfile as Ln, SecureCookie as Lt, AuthInternalErrorCode as M, discord as Mn, InternalLogger as Mt, AuthSecurityErrorCode as N, FigmaProfile as Nn, JoseInstance as Nt, UpdateSessionOptions as O, GitLabProfile as On, CredentialsProviderContext as Ot, AuthorizationError as P, figma as Pn, LogLevel as Pt, JWTConfig as Q, ExtendedProfile as Qt, createAuth as R, github as Rn, Severity as Rt, SignOutAPIOptions as S, strava as Sn, CookieConfig as St, SignOutReturn as T, SpotifyImage as Tn, CookieStrategyAttributes as Tt, InferAuthIdentity as U, createIdentity as Un, OAuthProvider as Ut, DeepRequired as V, UserIdentityType as Vn, TrustedOrigin as Vt, InferIdentity as W, OAuthProviderConfig as Wt, CreateSessionStrategyOptions as X, createBuiltInOAuthProviders as Xt, ShapeToObject as Y, builtInOAuthProviders as Yt, GetStatelessSessionReturn as Z, AtlassianProfile as Zt, SignInCredentialsAPIReturn as _, MailchimpProfile as _n, User as _t, OAuthEnv as a, dropbox as an, JWTManager as at, SignInOptions as b, SummaryClub as bn, AuthInstance as bt, APIOptionsWithRequest as c, NotionUser as cn, JWTSignedMode as ct, GetSessionAPIOptions as d, notion as dn, KeyPair as dt, AccountType as en, JWTEncryptedMode as et, GetSessionAPIReturn as f, TwitchProfile as fn, SecretKey as ft, SignInCredentialsAPIOptions as g, Login as gn, StatelessStrategyConfig as gt, SignInAPIReturn as h, pinterest as hn, SessionStrategy as ht, JWTStandardClaims as i, RootInfo as in, JWTKeyAlgorithm as it, AccessTokenError as j, Nameplate as jn, InternalContext as jt, UpdateSessionReturn as k, gitlab as kn, HostCookie as kt, APIOptionsWithSkipCSRFCheck as l, Owner as ln, JWTSigningAlgorithm as lt, SignInAPIOptions as m, PinterestProfile as mn, SessionConfig as mt, AuthClientOptions as n, FullTeam as nn, JWTExpirationStrategy as nt, TypedJWTPayload$1 as o, Bot as on, JWTMode as ot, OptionsWithRedirectTo as p, twitch as pn, Session as pt, Merge as q, ResponseType as qt, JWTPayloadWithToken as r, Name as rn, JWTKey as rt, APIOptionsWithRedirectTo as s, NotionProfile as sn, JWTSealedMode as st, AuthClient as t, DropboxProfile as tn, JWTEncryptionAlgorithm as tt, FunctionAPIContext as u, Person as un, JWTStrategyOptions as ut, SignInCredentialsOptions as v, mailchimp as vn, AuthAPI as vt, SignOutOptions as w, x as wn, CookieStoreConfig as wt, SignInReturn as x, SummaryGear as xn, AuthRuntimeConfig as xt, SignInCredentialsReturn as y, StravaProfile as yn, AuthConfig as yt, AuthResponse as z, createSyslogMessage as zn, StandardCookie as zt };