@aura-stack/auth 0.5.0 → 0.7.0

package/dist/index-C9U6ICDT.d.ts

@@ -0,0 +1,2796 @@
+import * as _$_aura_stack_router0 from "@aura-stack/router";
+import { ClientOptions, GlobalContext } from "@aura-stack/router";
+import { ZodObject, ZodRawShape, ZodTypeAny, infer as __Infer, z } from "zod/v4";
+import { JWK, JWTPayload } from "@aura-stack/jose/jose";
+import { DecodeJWTOptions, EncodeJWTOptions, JWEHeaderParameters, JWTDecryptOptions, JWTHeaderParameters, JWTVerifyOptions, Prettify, TypedJWTPayload, TypedJWTPayload as TypedJWTPayload$1 } from "@aura-stack/jose";
+import { SerializeOptions } from "@aura-stack/router/cookie";
+import * as valibot from "valibot";
+import { AnySchema, BaseSchema, InferOutput, ObjectEntries, ObjectSchema } from "valibot";
+import { Type } from "arktype";
+import { Static, TObject, TProperties, TSchema, Type as Type$1 } from "typebox";
+import * as _$arktype_internal_variants_object_ts0 from "arktype/internal/variants/object.ts";
+import * as _$zod_v4_core0 from "zod/v4/core";
+import { infer as infer$1 } from "zod/v4/core";
+import * as _$zod from "zod";
+
+//#region src/schemas.d.ts
+/**
+ * Schema used in the callback action to validate the authorization error response when the resource owner
+ * has denied the authorization request.
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1
+ */
+declare const OAuthAuthorizationErrorResponse: z.ZodObject<{
+  error: z.ZodEnum<{
+    invalid_request: "invalid_request";
+    unauthorized_client: "unauthorized_client";
+    access_denied: "access_denied";
+    unsupported_response_type: "unsupported_response_type";
+    invalid_scope: "invalid_scope";
+    server_error: "server_error";
+    temporarily_unavailable: "temporarily_unavailable";
+  }>;
+  error_description: z.ZodOptional<z.ZodString>;
+  error_uri: z.ZodOptional<z.ZodString>;
+  state: z.ZodString;
+}, z.core.$strip>;
+/**
+ * Schema for OAuth Access Token Error Response
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+ */
+declare const OAuthAccessTokenErrorResponse: z.ZodObject<{
+  error: z.ZodEnum<{
+    invalid_request: "invalid_request";
+    unauthorized_client: "unauthorized_client";
+    invalid_scope: "invalid_scope";
+    invalid_client: "invalid_client";
+    invalid_grant: "invalid_grant";
+    unsupported_grant_type: "unsupported_grant_type";
+  }>;
+  error_description: z.ZodOptional<z.ZodString>;
+  error_uri: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+declare const OAuthEnvSchema: z.ZodObject<{
+  clientId: z.ZodString;
+  clientSecret: z.ZodString;
+}, z.core.$strip>;
+//#endregion
+//#region src/jose.d.ts
+/**
+ * Creates the JOSE instance used for signing and verifying tokens. It derives keys
+ * for session tokens and CSRF tokens. For security and determinism, it's required
+ * to set a salt value in `AURA_AUTH_SALT` or `AUTH_SALT` env.
+ *
+ * The instance respects the `SessionConfig` to determine:
+ * - **mode**: `signed` (JWS only), `encrypted` (JWE only), or `sealed` (JWS + JWE)
+ * - **algorithms**: signing, key-wrapping, and content-encryption algorithms
+ * - **claims**: audience, issuer, maxAge
+ *
+ * @param secret the base secret for key derivation
+ * @param session the session configuration that drives algorithm and mode selection
+ * @returns jose instance with methods for encoding/decoding JWTs and signing/verifying JWSs
+ */
+declare const createJoseInstance: <DefaultUser extends User = User>(secret?: JWTKey, session?: SessionConfig) => {
+  signJWS: (payload: TypedJWTPayload<Partial<DefaultUser>>, options?: JWTHeaderParameters) => Promise<string>;
+  verifyJWS: (token: string, options?: JWTVerifyOptions) => Promise<TypedJWTPayload<DefaultUser>>;
+  encryptJWE: (payload: TypedJWTPayload<Partial<DefaultUser>>, options?: JWEHeaderParameters) => Promise<string>;
+  decryptJWE: (token: string, options?: JWTDecryptOptions) => Promise<TypedJWTPayload<DefaultUser>>;
+  encodeJWT: (payload: TypedJWTPayload<Partial<DefaultUser>>, options?: EncodeJWTOptions) => Promise<string>;
+  decodeJWT: (token: string, options?: DecodeJWTOptions) => Promise<TypedJWTPayload<DefaultUser>>;
+};
+//#endregion
+//#region src/api/createApi.d.ts
+declare const createAuthAPI: <DefaultUser extends User = User>(ctx: GlobalContext) => {
+  /**
+   * Retrieves the current session data from the server-side.
+   *
+   * @param options - Options for the API call, including headers to verify `session_token` cookie.
+   * @returns An object containing session data see {@link User}
+   */
+  getSession: (options: GetSessionAPIOptions) => Promise<GetSessionAPIReturn<DefaultUser>>;
+  /**
+   * Initiates the sign-in flow on the server-side. By default the redirect is automatic, but it can be
+   * disabled by setting the `redirect` option to `false`. When redirect is disabled, the API returns the
+   * `signInURL` in the response for the client to handle the redirect manually.
+   *
+   * @param oauth - The OAuth provider to use for sign-in (e.g., "github", "gitlab", "bitbucket").
+   * @param options - Optional parameters for the sign-in process, including headers and redirect behavior.
+   * @returns The object returned by the API call {@link SignInAPIReturn}
+   * @example
+   * const response = await api.signIn("github", {
+   *   redirectTo: "/dashboard",
+   *   request: await getRequest(),
+   * })
+   */
+  signIn: (oauth: LiteralUnion<BuiltInOAuthProvider>, options?: SignInAPIOptions) => Promise<SignInAPIReturn>;
+  /**
+   * Signs in a user using credentials (`username` and `password`) on the server-side. The credentials must
+   * be verified by the `authorize` function provided in the `credentials` configuration option.
+   *
+   * @param options - Options for the API call, including the credentials payload, headers, and redirect behavior.
+   * @returns The object returned by the API call {@link SignInCredentialsAPIReturn}
+   * @example
+   * const response = await api.signInCredentials({
+   *   payload: {
+   *     username: "johndoe",
+   *     password: "1234567890"
+   *   },
+   *   redirectTo: "/dashboard",
+   *   request: await getRequest(),
+   * })
+   */
+  signInCredentials: (options: SignInCredentialsAPIOptions) => Promise<SignInCredentialsAPIReturn>;
+  /**
+   * Updates the current session on the server-side. It allows partial updates to the session object, such as
+   * modifying user fields or extending the session expiry. It implements CSRF Protection by default, for
+   * server-side calls it only verifies and validates the CSRF Token, it also provides Double-Submit
+   * Cookie protection by requiring the `session_token` cookie to be included in the request headers.
+   *
+   * @param options - Options for the API call, including the session updates, headers, redirect behavior, and CSRF check bypass.
+   * @returns The object returned by the API call {@link UpdateSessionAPIReturn}
+   * @example
+   * const response = await api.updateSession({
+   *   session: {
+   *     user: {
+   *       name: "John Doe",
+   *       email: "john.doe@example.com"
+   *     }
+   *   },
+   *   redirectTo: "/dashboard",
+   *   request: await getRequest()
+   * })
+   */
+  updateSession: (options: UpdateSessionAPIOptions<DefaultUser>) => Promise<UpdateSessionAPIReturn<DefaultUser>>;
+  /**
+   * Signs out the current session on the server-side. It implements CSRF Protection by default, for
+   * server-side calls it only verifies and validates the CSRF Token, it also provides Double-Submit
+   * Cookie protection by requiring the `session_token` cookie to be included in the request headers.
+   *
+   * @param options - Options for the API call, including headers, redirect behavior, and CSRF check bypass.
+   * @returns The object returned by the API call {@link SignOutAPIReturn}
+   * @example
+   * const response = await api.signOut({
+   *   redirectTo: "/goodbye",
+   *   headers: {
+   *     Cookie: "session_token=abc123; csrf_token=def456"
+   *   },
+   *   // Only set this to true for trusted server-side calls that have already verified the CSRF token
+   *   skipCSRFCheck: true
+   * })
+   */
+  signOut: (options: SignOutAPIOptions) => Promise<SignOutAPIReturn>;
+};
+//#endregion
+//#region src/shared/identity.d.ts
+declare const UserIdentity: z.ZodObject<{
+  sub: z.ZodString;
+  name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  image: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  email: z.ZodOptional<z.ZodNullable<z.ZodEmail>>;
+}, z.core.$strip>;
+declare const UserIdentityValibot: valibot.ObjectSchema<{
+  readonly sub: valibot.StringSchema<undefined>;
+  readonly name: valibot.OptionalSchema<valibot.NullableSchema<valibot.StringSchema<undefined>, undefined>, undefined>;
+  readonly image: valibot.OptionalSchema<valibot.NullableSchema<valibot.StringSchema<undefined>, undefined>, undefined>;
+  readonly email: valibot.OptionalSchema<valibot.NullableSchema<valibot.SchemaWithPipe<readonly [valibot.StringSchema<undefined>, valibot.EmailAction<string, undefined>]>, undefined>, undefined>;
+}, undefined>;
+declare const UserIdentityArkType: _$arktype_internal_variants_object_ts0.ObjectType<{
+  sub: string;
+  name?: string | null | undefined;
+  image?: string | null | undefined;
+  email?: string | null | undefined;
+}, {}>;
+declare const UserIdentityTypeBox: Type$1.TObject<{
+  sub: Type$1.TString;
+  name: Type$1.TOptional<Type$1.TUnion<[Type$1.TString, Type$1.TNull]>>;
+  image: Type$1.TOptional<Type$1.TUnion<[Type$1.TString, Type$1.TNull]>>;
+  email: Type$1.TOptional<Type$1.TUnion<[Type$1.TString, Type$1.TNull]>>;
+}>;
+type UserShape = typeof UserIdentity.shape;
+type UserShapeValibot = typeof UserIdentityValibot.entries;
+type UserShapeArkType = typeof UserIdentityArkType;
+type UserShapeTypeBox = typeof UserIdentityTypeBox.properties;
+type IsArkType<T extends Identities> = T extends EditableShapeArkType<UserShapeArkType> ? true : false;
+type IsZod<T extends Identities> = T extends EditableShape<UserShape> ? true : false;
+type IsValibot<T extends Identities> = T extends EditableShapeValibot<UserShapeValibot> ? true : false;
+type SchemaTypes = ZodObject<any> | valibot.ObjectSchema<any, undefined> | Type<{}> | Type$1.TObject;
+type Identities = EditableShape<UserShape> | EditableShapeValibot<UserShapeValibot> | EditableShapeArkType<UserShapeArkType> | EditableShapeTypebox<UserShapeTypeBox>;
+type ReturnShapeType<T> = T extends EditableShape<UserShape> ? z.ZodObject<T> : T extends EditableShapeValibot<UserShapeValibot> ? valibot.ObjectSchema<T, undefined> : T extends EditableShapeArkType<UserShapeArkType> ? T : T extends EditableShapeTypebox<UserShapeTypeBox> ? Type$1.TObject<T> : never;
+declare const createIdentity: <S extends Identities>(shape: S) => ReturnShapeType<S>;
+//#endregion
+//#region src/shared/logger.d.ts
+/**
+ * Log message definitions organized by category.
+ * Each message includes facility, severity, msgId, and default message.
+ */
+declare const logMessages: {
+  readonly ROUTER_INTERNAL_ERROR: {
+    readonly facility: 10;
+    readonly severity: "error";
+    readonly msgId: "ROUTER_INTERNAL_ERROR";
+    readonly message: "Unhandled router error while processing the request";
+  };
+  readonly INVALID_REQUEST: {
+    readonly facility: 10;
+    readonly severity: "warning";
+    readonly msgId: "INVALID_REQUEST";
+    readonly message: "Request validation failed against the expected schema";
+  };
+  readonly SERVER_ERROR: {
+    readonly facility: 10;
+    readonly severity: "error";
+    readonly msgId: "SERVER_ERROR";
+    readonly message: "Unexpected internal server error during authentication";
+  };
+  readonly OAUTH_PROTOCOL_ERROR: {
+    readonly facility: 10;
+    readonly severity: "warning";
+    readonly msgId: "OAUTH_PROTOCOL_ERROR";
+    readonly message: "OAuth provider returned an invalid or unexpected protocol response";
+  };
+  readonly OAUTH_AUTHORIZATION_ERROR: {
+    readonly facility: 10;
+    readonly severity: "error";
+    readonly msgId: "OAUTH_AUTHORIZATION_ERROR";
+    readonly message: "OAuth authorization request was rejected or failed";
+  };
+  readonly INVALID_OAUTH_CONFIGURATION: {
+    readonly facility: 10;
+    readonly severity: "error";
+    readonly msgId: "INVALID_OAUTH_CONFIGURATION";
+    readonly message: "The OAuth provider configuration is invalid or incomplete";
+  };
+  readonly OAUTH_ACCESS_TOKEN_REQUEST_INITIATED: {
+    readonly facility: 10;
+    readonly severity: "debug";
+    readonly msgId: "OAUTH_ACCESS_TOKEN_REQUEST_INITIATED";
+    readonly message: "Starting OAuth access token request to the provider";
+  };
+  readonly INVALID_OAUTH_ACCESS_TOKEN_RESPONSE: {
+    readonly facility: 10;
+    readonly severity: "error";
+    readonly msgId: "INVALID_OAUTH_ACCESS_TOKEN_RESPONSE";
+    readonly message: "OAuth access token endpoint returned an invalid or malformed response";
+  };
+  readonly OAUTH_ACCESS_TOKEN_ERROR: {
+    readonly facility: 10;
+    readonly severity: "error";
+    readonly msgId: "OAUTH_ACCESS_TOKEN_ERROR";
+    readonly message: "OAuth access token endpoint returned an error response";
+  };
+  readonly OAUTH_ACCESS_TOKEN_SUCCESS: {
+    readonly facility: 10;
+    readonly severity: "info";
+    readonly msgId: "OAUTH_ACCESS_TOKEN_SUCCESS";
+    readonly message: "Successfully retrieved OAuth access token from the provider";
+  };
+  readonly OAUTH_ACCESS_TOKEN_REQUEST_FAILED: {
+    readonly facility: 10;
+    readonly severity: "error";
+    readonly msgId: "OAUTH_ACCESS_TOKEN_REQUEST_FAILED";
+    readonly message: "Network or server error while requesting OAuth access token";
+  };
+  readonly OAUTH_USERINFO_REQUEST_INITIATED: {
+    readonly facility: 10;
+    readonly severity: "debug";
+    readonly msgId: "OAUTH_USERINFO_REQUEST_INITIATED";
+    readonly message: "Starting OAuth userinfo request to the provider";
+  };
+  readonly OAUTH_USERINFO_INVALID_RESPONSE: {
+    readonly facility: 10;
+    readonly severity: "error";
+    readonly msgId: "OAUTH_USERINFO_INVALID_RESPONSE";
+    readonly message: "OAuth userinfo endpoint returned an invalid or malformed response";
+  };
+  readonly OAUTH_USERINFO_ERROR: {
+    readonly facility: 10;
+    readonly severity: "error";
+    readonly msgId: "OAUTH_USERINFO_ERROR";
+    readonly message: "OAuth userinfo endpoint returned an error response";
+  };
+  readonly OAUTH_USERINFO_SUCCESS: {
+    readonly facility: 10;
+    readonly severity: "info";
+    readonly msgId: "OAUTH_USERINFO_SUCCESS";
+    readonly message: "Successfully retrieved user information from the OAuth provider";
+  };
+  readonly OAUTH_USERINFO_REQUEST_FAILED: {
+    readonly facility: 10;
+    readonly severity: "error";
+    readonly msgId: "OAUTH_USERINFO_REQUEST_FAILED";
+    readonly message: "Network or server error while requesting user information from the OAuth provider";
+  };
+  readonly OAUTH_CALLBACK_SUCCESS: {
+    readonly facility: 4;
+    readonly severity: "info";
+    readonly msgId: "OAUTH_CALLBACK_SUCCESS";
+    readonly message: "OAuth callback completed successfully and session was created";
+  };
+  readonly MISMATCHING_STATE: {
+    readonly facility: 4;
+    readonly severity: "critical";
+    readonly msgId: "MISMATCHING_STATE";
+    readonly message: "OAuth response state parameter does not match the stored state value";
+  };
+  readonly POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED: {
+    readonly facility: 4;
+    readonly severity: "critical";
+    readonly msgId: "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED";
+    readonly message: "Blocked redirect to untrusted or external URL (potential open redirect attack)";
+  };
+  readonly OPEN_REDIRECT_ATTACK: {
+    readonly facility: 4;
+    readonly severity: "warning";
+    readonly msgId: "OPEN_REDIRECT_ATTACK";
+    readonly message: "Detected redirect target that does not match the trusted origin";
+  };
+  readonly SESSION_TOKEN_MISSING: {
+    readonly facility: 4;
+    readonly severity: "warning";
+    readonly msgId: "SESSION_TOKEN_MISSING";
+    readonly message: "Session cookie is missing from the request";
+  };
+  readonly CSRF_TOKEN_MISSING: {
+    readonly facility: 4;
+    readonly severity: "warning";
+    readonly msgId: "CSRF_TOKEN_MISSING";
+    readonly message: "CSRF token cookie is missing from the request";
+  };
+  readonly CSRF_HEADER_MISSING: {
+    readonly facility: 4;
+    readonly severity: "warning";
+    readonly msgId: "CSRF_HEADER_MISSING";
+    readonly message: "CSRF header is missing from the request";
+  };
+  readonly CSRF_TOKEN_INVALID: {
+    readonly facility: 4;
+    readonly severity: "error";
+    readonly msgId: "CSRF_TOKEN_INVALID";
+    readonly message: "CSRF token verification failed or token is invalid";
+  };
+  readonly SIGN_IN_INITIATED: {
+    readonly facility: 4;
+    readonly severity: "info";
+    readonly msgId: "SIGN_IN_INITIATED";
+    readonly message: "Starting OAuth sign-in flow for the selected provider";
+  };
+  readonly SIGN_OUT_ATTEMPT: {
+    readonly facility: 4;
+    readonly severity: "debug";
+    readonly msgId: "SIGN_OUT_ATTEMPT";
+    readonly message: "Received sign-out request from client";
+  };
+  readonly SIGN_OUT_CSRF_VERIFIED: {
+    readonly facility: 4;
+    readonly severity: "info";
+    readonly msgId: "SIGN_OUT_CSRF_VERIFIED";
+    readonly message: "CSRF token was successfully verified during sign-out";
+  };
+  readonly SIGN_OUT_SUCCESS: {
+    readonly facility: 4;
+    readonly severity: "info";
+    readonly msgId: "SIGN_OUT_SUCCESS";
+    readonly message: "User session was cleared and sign-out completed successfully";
+  };
+  readonly SIGN_OUT_REDIRECT: {
+    readonly facility: 4;
+    readonly severity: "debug";
+    readonly msgId: "SIGN_OUT_REDIRECT";
+    readonly message: "Redirecting client after successful sign-out";
+  };
+  readonly AUTH_SESSION_VALID: {
+    readonly facility: 4;
+    readonly severity: "info";
+    readonly msgId: "AUTH_SESSION_VALID";
+    readonly message: "Session token is valid and user session was returned";
+  };
+  readonly AUTH_SESSION_INVALID: {
+    readonly facility: 4;
+    readonly severity: "notice";
+    readonly msgId: "AUTH_SESSION_INVALID";
+    readonly message: "Session token is missing, expired, or invalid";
+  };
+  readonly INVALID_JWT_TOKEN: {
+    readonly facility: 4;
+    readonly severity: "warning";
+    readonly msgId: "INVALID_JWT_TOKEN";
+    readonly message: "JWT session token failed validation during sign-out";
+  };
+  readonly CSRF_TOKEN_REQUESTED: {
+    readonly facility: 4;
+    readonly severity: "debug";
+    readonly msgId: "CSRF_TOKEN_REQUESTED";
+    readonly message: "Client requested a CSRF token";
+  };
+  readonly CSRF_TOKEN_ISSUED: {
+    readonly facility: 4;
+    readonly severity: "debug";
+    readonly msgId: "CSRF_TOKEN_ISSUED";
+    readonly message: "Issued a new CSRF token to the client";
+  };
+  readonly INVALID_URL: {
+    readonly facility: 10;
+    readonly severity: "error";
+    readonly msgId: "INVALID_URL";
+    readonly message: "Derived origin URL is invalid or malformed";
+  };
+  readonly COOKIE_HTTPONLY_DISABLED: {
+    readonly facility: 10;
+    readonly severity: "critical";
+    readonly msgId: "COOKIE_HTTPONLY_DISABLED";
+    readonly message: "Cookie is configured without HttpOnly. This allows JavaScript access via document.cookie and increases XSS exposure.";
+  };
+  readonly COOKIE_WILDCARD_DOMAIN: {
+    readonly facility: 10;
+    readonly severity: "critical";
+    readonly msgId: "COOKIE_WILDCARD_DOMAIN";
+    readonly message: "Cookie 'Domain' is set to a wildcard, which is insecure and should be avoided.";
+  };
+  readonly COOKIE_SECURE_DISABLED: {
+    readonly facility: 10;
+    readonly severity: "warning";
+    readonly msgId: "COOKIE_SECURE_DISABLED";
+    readonly message: "Cookie is configured with 'Secure' but the request is not HTTPS. The 'Secure' attribute will be ignored by the browser.";
+  };
+  readonly COOKIE_SAMESITE_NONE_WITHOUT_SECURE: {
+    readonly facility: 10;
+    readonly severity: "warning";
+    readonly msgId: "COOKIE_SAMESITE_NONE_WITHOUT_SECURE";
+    readonly message: "Cookie uses SameSite=None without Secure. Falling back to SameSite=Lax for safer defaults.";
+  };
+  readonly COOKIE_INSECURE_IN_PRODUCTION: {
+    readonly facility: 10;
+    readonly severity: "critical";
+    readonly msgId: "COOKIE_INSECURE_IN_PRODUCTION";
+    readonly message: "Cookies are being served over an insecure connection in production, which is a serious security risk.";
+  };
+  readonly COOKIE_HOST_STRATEGY_INSECURE: {
+    readonly facility: 10;
+    readonly severity: "critical";
+    readonly msgId: "COOKIE_HOST_STRATEGY_INSECURE";
+    readonly message: "__Host- cookies require a secure HTTPS context. Falling back to standard cookie settings.";
+  };
+  readonly UNTRUSTED_ORIGIN: {
+    readonly facility: 10;
+    readonly severity: "error";
+    readonly msgId: "UNTRUSTED_ORIGIN";
+    readonly message: "The constructed origin URL is not trusted.";
+  };
+  readonly SESSION_REFRESHED: {
+    readonly facility: 4;
+    readonly severity: "info";
+    readonly msgId: "SESSION_REFRESHED";
+    readonly message: "User session was refreshed with a new expiration time";
+  };
+  readonly AUTH_SECURITY_ERROR: {
+    readonly facility: 10;
+    readonly severity: "error";
+    readonly msgId: "AUTH_SECURITY_ERROR";
+    readonly message: "An authentication security error occurred";
+  };
+  readonly CSRF_TOKEN_VERIFIED: {
+    readonly facility: 4;
+    readonly severity: "info";
+    readonly msgId: "CSRF_TOKEN_VERIFIED";
+    readonly message: "CSRF token verification succeeded";
+  };
+  readonly IDENTITY_VALIDATION_DISABLED: {
+    readonly facility: 4;
+    readonly severity: "warning";
+    readonly msgId: "IDENTITY_VALIDATION_DISABLED";
+    readonly message: "Identity validation is disabled. User data will not be validated against a schema.";
+  };
+  readonly IDENTITY_VALIDATION_FAILED: {
+    readonly facility: 4;
+    readonly severity: "error";
+    readonly msgId: "IDENTITY_VALIDATION_FAILED";
+    readonly message: "User identity validation against the schema failed";
+  };
+  readonly CREDENTIALS_SIGN_IN_SUCCESS: {
+    readonly facility: 4;
+    readonly severity: "info";
+    readonly msgId: "CREDENTIALS_SIGN_IN_SUCCESS";
+    readonly message: "User successfully authenticated with credentials";
+  };
+  readonly INVALID_CREDENTIALS: {
+    readonly facility: 4;
+    readonly severity: "warning";
+    readonly msgId: "INVALID_CREDENTIALS";
+    readonly message: "Authentication failed due to invalid credentials";
+  };
+  readonly CREDENTIALS_SIGN_IN_FAILED: {
+    readonly facility: 4;
+    readonly severity: "error";
+    readonly msgId: "CREDENTIALS_SIGN_IN_FAILED";
+    readonly message: "An error occurred during credentials sign-in";
+  };
+};
+declare const createLogEntry: <T extends keyof typeof logMessages>(key: T, overrides?: Partial<SyslogOptions>) => SyslogOptions;
+declare const createSyslogMessage: (options: SyslogOptions) => string;
+//#endregion
+//#region src/validator/registry.d.ts
+declare const createSchemaRegistry: <Identity extends SchemaTypes>(config: IdentityConfig<Identity>) => {
+  parse: (data?: unknown) => Promise<any>;
+  parseAsPartial: (data?: unknown) => Promise<any>;
+  parseWithJWT: (data?: unknown) => Promise<any>;
+  schema: any;
+  schemaAsPartial: any;
+  schemaWithJWT: any;
+};
+//#endregion
+//#region src/oauth/github.d.ts
+/**
+ * @see [Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user)
+ */
+interface GitHubProfile {
+  login: string;
+  id: number;
+  user_view_type: string;
+  node_id: string;
+  avatar_url: string;
+  gravatar_id: string | null;
+  url: string;
+  html_url: string;
+  followers_url: string;
+  following_url: string;
+  gists_url: string;
+  starred_url: string;
+  subscriptions_url: string;
+  organizations_url: string;
+  repos_url: string;
+  events_url: string;
+  received_events_url: string;
+  type: string;
+  site_admin: boolean;
+  name: string | null;
+  company: string | null;
+  blog: string | null;
+  location: string | null;
+  email: string | null;
+  notification_email: string | null;
+  hireable: boolean | null;
+  bio: string | null;
+  twitter_username?: string | null;
+  public_repos: number;
+  public_gists: number;
+  followers: number;
+  following: number;
+  created_at: string;
+  updated_at: string;
+  private_gists?: number;
+  total_private_repos?: number;
+  owned_private_repos?: number;
+  disk_usage?: number;
+  collaborators?: number;
+  two_factor_authentication: boolean;
+  plan?: {
+    collaborators: number;
+    name: string;
+    space: number;
+    private_repos: number;
+  };
+}
+/**
+ * GitHub OAuth Provider
+ *
+ * @see [GitHub - Creating an OAuth App](https://docs.github.com/en/developers/apps/building-oauth-apps/creating-an-oauth-app)
+ * @see [GitHub - Authorizing OAuth Apps](https://docs.github.com/en/developers/apps/building-oauth-apps/authorizing-oauth-apps)
+ * @see [GitHub - Configure your GitHub OAuth Apps](https://github.com/settings/developers)
+ * @see [Github - Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user)
+ */
+declare const github: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<GitHubProfile, DefaultUser>>) => OAuthProviderCredentials<GitHubProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/bitbucket.d.ts
+/**
+ * @see [Get current user](https://developer.atlassian.com/cloud/bitbucket/rest/api-group-users/#api-user-get)
+ */
+interface BitbucketProfile {
+  display_name: string;
+  links: Record<LiteralUnion<"self" | "avatar" | "repositories" | "snippets" | "html" | "hooks">, {
+    href?: string;
+  }>;
+  created_on: string;
+  type: string;
+  uuid: string;
+  has_2fa_enabled: boolean;
+  username: string;
+  nickname: string;
+  is_staff: boolean;
+  account_id: string;
+  account_status: LiteralUnion<"active" | "inactive" | "closed">;
+  location: string | null;
+}
+/**
+ * Bitbucket OAuth Provider
+ *
+ * @see [Bitbucket - Official App](https://bitbucket.org/)
+ * @see [Bitbucket - Workspaces](https://bitbucket.org/account/workspaces/)
+ * @see [Bitbucket - Workspace Settings](https://bitbucket.org/{workspace-name}/workspace/settings/)
+ * @see [Bitbucket - OAuth 2.0](https://developer.atlassian.com/cloud/bitbucket/oauth-2/)
+ * @see [Bitbucket - Use OAuth on Bitbucket Cloud](https://support.atlassian.com/bitbucket-cloud/docs/use-oauth-on-bitbucket-cloud/)
+ * @see [Bitbucket - Cloud REST API](https://developer.atlassian.com/cloud/bitbucket/rest/intro/)
+ * @see [Bitbucket - User Endpoint](https://developer.atlassian.com/cloud/bitbucket/rest/api-group-users/#api-users-endpoint)
+ */
+declare const bitbucket: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<BitbucketProfile, DefaultUser>>) => OAuthProviderCredentials<BitbucketProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/figma.d.ts
+/**
+ * @see [Figma API - Users](https://developers.figma.com/docs/rest-api/users-types/)
+ */
+interface FigmaProfile {
+  id: string;
+  handle: string;
+  img_url: string;
+  email: string;
+}
+/**
+ * Figma OAuth Provider
+ * @see [Figma - REST API Introduction](https://developers.figma.com/docs/rest-api/)
+ * @see [Figma - OAuth App](https://www.figma.com/developers/apps/)
+ * @see [Figma - Create an OAuth App](https://developers.figma.com/docs/rest-api/authentication/#create-an-oauth-app)
+ * @see [Figma - OAuth Scopes](https://developers.figma.com/docs/rest-api/scopes/)
+ */
+declare const figma: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<FigmaProfile, DefaultUser>>) => OAuthProviderCredentials<FigmaProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/discord.d.ts
+/**
+ * @see [Discord - Nameplate Object](https://discord.com/developers/docs/resources/user#nameplate-nameplate-structure)
+ */
+interface Nameplate {
+  sku_id: string;
+  asset: string;
+  label: string;
+  palette: string;
+}
+/**
+ * The `snowflake` type is a string type. The attributes defined with this type are:
+ * - `id`: The unique identifier for the object.
+ * - `primary_guild.identity_guild_id`: The unique identifier for the guild.
+ * - `avatar_decoration_data.sku_id`: The unique identifier for the SKU.
+ *
+ * @see [Discord - User Object](https://discord.com/developers/docs/resources/user#user-object)
+ */
+interface DiscordProfile {
+  id: string;
+  username: string;
+  discriminator: string;
+  global_name: string | null;
+  avatar: string | null;
+  bot?: boolean;
+  system?: boolean;
+  mfa_enabled?: boolean;
+  banner?: string | null;
+  accent_color?: number | null;
+  locale?: string;
+  verified?: boolean;
+  email?: string | null;
+  flags?: number;
+  premium_type?: number;
+  public_flags?: number;
+  avatar_decoration_data?: {
+    asset: string;
+    sku_id: string;
+  };
+  collections?: Record<string, Nameplate>;
+  primary_guild?: {
+    identity_guild_id: string;
+    identity_enabled: boolean | null;
+    tag: string | null;
+    badge: string | null;
+  };
+}
+/**
+ * Discord OAuth Provider
+ *
+ * @see [Discord - Applications](https://discord.com/developers/applications)
+ * @see [Discord - OAuth2](https://discord.com/developers/docs/topics/oauth2)
+ * @see [Discord - Get Current User](https://discord.com/developers/docs/resources/user#get-current-user)
+ * @see [Discord - User Object](https://discord.com/developers/docs/resources/user#user-object)
+ * @see [Discord - OAuth2 Scopes](https://discord.com/developers/docs/topics/oauth2#shared-resources-oauth2-scopes)
+ * @see [Discord - Image Formatting](https://discord.com/developers/docs/reference#image-formatting)
+ * @see [Discord - Display Names](https://discord.com/developers/docs/change-log#display-names)
+ */
+declare const discord: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<DiscordProfile, DefaultUser>>) => OAuthProviderCredentials<DiscordProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/gitlab.d.ts
+/**
+ * @see [GitLab - User Structure](https://docs.gitlab.com/ee/api/users.html#external-user-structure)
+ */
+interface GitLabProfile {
+  id: number;
+  username: string;
+  email: string;
+  name: string;
+  state: string;
+  locked: boolean;
+  avatar_url: string;
+  web_url: string;
+  created_at: string;
+  bio: string;
+  location: string | null;
+  public_email: string;
+  linkedin: string;
+  twitter: string;
+  discord: string;
+  github: string;
+  website_url: string;
+  organization: string;
+  job_title: string;
+  pronouns: string;
+  bot: boolean;
+  work_information: string | null;
+  followers: number;
+  following: number;
+  local_time: string;
+  last_sign_in_at: string;
+  confirmed_at: string;
+  theme_id: number;
+  last_activity_on: string;
+  color_scheme_id: number;
+  projects_limit: number;
+  current_sign_in_at: string;
+  identities: {
+    provider: string;
+    extern_uid: string;
+    saml_provider_id: number | null;
+  }[];
+  can_create_group: boolean;
+  can_create_project: boolean;
+  two_factor_enabled: boolean;
+  external: boolean;
+  private_profile: boolean;
+  commit_email: string;
+  preferred_language: string;
+  shared_runners_minutes_limit: number | null;
+  extra_shared_runners_minutes_limit: number | null;
+  scim_identities: unknown[];
+}
+/**
+ * GitLab OAuth Provider
+ *
+ * @see [GitLab - Applications](https://gitlab.com/-/user_settings/applications)
+ * @see [GitLab - OAuth 2.0 identify provider API](https://docs.gitlab.com/api/oauth2/)
+ * @see [GitLab - Scopes](https://docs.gitlab.com/integration/oauth_provider/#view-all-authorized-applications)
+ * @see [GitLab - Get current user](https://docs.gitlab.com/api/users/#get-the-current-user)
+ */
+declare const gitlab: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<GitLabProfile, DefaultUser>>) => OAuthProviderCredentials<GitLabProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/spotify.d.ts
+interface SpotifyImage {
+  url: string;
+  height: number;
+  width: number;
+}
+/**
+ * @see [Spotify - User Object](https://developer.spotify.com/documentation/web-api/reference/object-model/#user-object-private)
+ */
+interface SpotifyProfile {
+  id: string;
+  display_name: string;
+  email: string;
+  type: string;
+  uri: string;
+  country: string;
+  href: string;
+  images: SpotifyImage[];
+  product: string;
+  explicit_content: {
+    filter_enabled: boolean;
+    filter_locked: boolean;
+  };
+  external_urls: {
+    spotify: string;
+  };
+  followers: {
+    href: string;
+    total: number;
+  };
+}
+/**
+ * Spotify OAuth Provider
+ *
+ * @see [Spotify - Spotify Developer Dashboard](https://developer.spotify.com/dashboard)
+ * @see [Spotify - Getting started with Web API](https://developer.spotify.com/documentation/web-api/tutorials/getting-started)
+ * @see [Spotify - Get Current User's Profile](https://developer.spotify.com/documentation/web-api/reference/get-current-users-profile)
+ * @see [Spotify - Scopes](https://developer.spotify.com/documentation/web-api/concepts/scopes)
+ * @see [Spotify - Redirect URIs](https://developer.spotify.com/documentation/web-api/concepts/redirect_uri)
+ */
+declare const spotify: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<SpotifyProfile, DefaultUser>>) => OAuthProviderCredentials<SpotifyProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/x.d.ts
+/**
+ * @see [X - Get my User](https://docs.x.com/x-api/users/get-my-user)
+ */
+interface XProfile {
+  data: {
+    id: string;
+    name: string;
+    username: string;
+    profile_image_url: string;
+  };
+}
+/**
+ * X (Twitter) OAuth Provider
+ * @see [X - Developer Portal](https://developer.x.com/en/portal/projects-and-apps)
+ * @see [X - Get my User](https://docs.x.com/x-api/users/get-my-user)
+ * @see [X - OAuth 2.0 Authorization Code Flow with PKCE](https://docs.x.com/fundamentals/authentication/oauth-2-0/authorization-code)
+ * @see [X - OAuth 2.0 Scopes](https://docs.x.com/fundamentals/authentication/oauth-2-0/authorization-code#scopes)
+ * @see [X - OAuth 2.0 Bearer Token](https://docs.x.com/fundamentals/authentication/oauth-2-0/application-only)
+ */
+declare const x: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<XProfile, DefaultUser>>) => OAuthProviderCredentials<XProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/strava.d.ts
+/**
+ * @see [Strava - SummaryClub](https://developers.strava.com/docs/reference/#api-models-SummaryClub)
+ */
+interface SummaryClub {
+  id: number;
+  resource_state: number;
+  name: string;
+  profile_medium: string;
+  cover_photo: string;
+  cover_photo_small: string;
+  sport_type: "cycling" | "running" | "triathlon" | "other";
+  activity_types: string[];
+  city: string;
+  state: string;
+  country: string;
+  private: boolean;
+  member_count: number;
+  featured: boolean;
+  verified: boolean;
+  url: string;
+}
+/**
+ * @see [Strava - SummaryGear](https://developers.strava.com/docs/reference/#api-models-SummaryGear)
+ */
+interface SummaryGear {
+  id: string;
+  resource_state: number;
+  primary: boolean;
+  name: string;
+  distance: number;
+}
+/**
+ * @see [Strava - DetailedAthlete](https://developers.strava.com/docs/reference/#api-models-DetailedAthlete)
+ */
+interface StravaProfile {
+  id: number;
+  resource_state: number;
+  firstname: string;
+  lastname: string;
+  bio: string | null;
+  profile: string;
+  profile_medium: string;
+  city: string;
+  state: string;
+  country: string;
+  sex: string;
+  premium: boolean;
+  summit: boolean;
+  created_at: Date;
+  updated_at: Date;
+  badge_type_id: number;
+  weight: number;
+  friend: null;
+  follower: null;
+  follower_count: number;
+  friend_count: number;
+  measurement_preference: string;
+  ftp: number;
+  clubs: SummaryClub[];
+  bikes: SummaryGear[];
+  shoes: SummaryGear[];
+}
+/**
+ * Strava OAuth Provider
+ * @see [Strava - Getting Started with the Strava API](https://developers.strava.com/docs/getting-started/)
+ * @see [Strava - My Applications](https://www.strava.com/settings/api)
+ * @see [Strava - Authentication](https://developers.strava.com/docs/authentication/)
+ * @see [Strava - API Application](https://www.strava.com/settings/api)
+ * @see [Strava - API Reference](https://developers.strava.com/docs/reference/)
+ */
+declare const strava: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<StravaProfile, DefaultUser>>) => OAuthProviderCredentials<StravaProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/mailchimp.d.ts
+interface Login {
+  email: string;
+  avatar: string | null;
+  login_id: number;
+  login_name: string;
+  login_email: string;
+}
+/**
+ * @see [Mailchimp - API Root](https://mailchimp.com/developer/marketing/api/authentication/)
+ */
+interface MailchimpProfile {
+  dc: string;
+  role: string;
+  accountname: string;
+  user_id: string;
+  login: Login;
+  login_url: string;
+  api_endpoint: string;
+}
+/**
+ * Mailchimp OAuth Provider
+ * @see [Mailchimp - Marketing API](https://mailchimp.com/developer/marketing/api/)
+ * @see [Mailchimp - Apps](https://us1.admin.mailchimp.com/account/oauth2/)
+ * @see [Mailchimp - Create an Application](https://mailchimp.com/developer/marketing/guides/access-user-data-oauth-2/#register-your-app)
+ * @see [Mailchimp - OAuth 2.0 Docs](https://mailchimp.com/developer/marketing/guides/access-user-data-oauth-2/)
+ * @see [Mailchimp - API Root](https://mailchimp.com/developer/marketing/api/root/)
+ */
+declare const mailchimp: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<MailchimpProfile, DefaultUser>>) => OAuthProviderCredentials<MailchimpProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/pinterest.d.ts
+/**
+ * @see [Pinterest - Get User Account](https://developers.pinterest.com/docs/api/v5/user_account-get)
+ */
+interface PinterestProfile {
+  account_type: LiteralUnion<"PINNER">;
+  id: string;
+  profile_image: string;
+  website_url: string;
+  username: string;
+  about: string;
+  business_name: string;
+  board_count: number;
+  pin_count: number;
+  follower_count: number;
+  following_count: number;
+  monthly_views: number;
+}
+/**
+ * @see [Pinterest - Connect App](https://developers.pinterest.com/docs/getting-started/connect-app/)
+ * @see [Pinterest - My Apps](https://developers.pinterest.com/apps/)
+ * @see [Pinterest - Get User Account](https://developers.pinterest.com/docs/api/v5/user_account-get)
+ */
+declare const pinterest: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<PinterestProfile, DefaultUser>>) => OAuthProviderCredentials<PinterestProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/twitch.d.ts
+/**
+ * @see [Twitch - Get Users](https://dev.twitch.tv/docs/api/reference#get-users)
+ */
+interface TwitchProfile {
+  id: string;
+  login: string;
+  display_name: string;
+  type: string;
+  broadcaster_type: string;
+  description: string;
+  profile_image_url: string;
+  offline_image_url: string;
+  view_count: number;
+  email?: string;
+  created_at: string;
+}
+/**
+ * @see [Twitch - Get Started with the Twitch API](https://dev.twitch.tv/docs/api/get-started/)
+ * @see [Twitch - Authorization code grant flow](https://dev.twitch.tv/docs/authentication/getting-tokens-oauth/#authorization-code-grant-flow)
+ * @see [Twitch - Register Your App](https://dev.twitch.tv/docs/authentication/register-app)
+ * @see [Twitch - Setting up Two-Factor Authentication (2FA)](https://help.twitch.tv/s/article/two-factor-authentication?language=en_US)
+ * @see [Twitch - Security and Privacy](https://www.twitch.tv/settings/security)
+ * @see [Twitch - Get Users](https://dev.twitch.tv/docs/api/reference#get-users)
+ * @see [Twitch - Scopes](https://dev.twitch.tv/docs/authentication/scopes/)
+ */
+declare const twitch: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<TwitchProfile, DefaultUser>>) => OAuthProviderCredentials<TwitchProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/notion.d.ts
+interface Person {
+  email: string;
+}
+interface NotionUser {
+  object: "user";
+  id: string;
+  name: string;
+  avatar_url: string | null;
+  type: "person";
+  person: Person;
+}
+interface Owner {
+  type: "user";
+  user: NotionUser;
+}
+interface Bot {
+  owner: Owner;
+}
+/**
+ * @see [Notion - Retrieve your token's bot user](https://developers.notion.com/reference/get-self)
+ */
+interface NotionProfile {
+  object: "user";
+  id: string;
+  name: string;
+  avatar_url: string | null;
+  type: "bot";
+  bot: Bot;
+}
+/**
+ * @see [Notion - Developer Documentation](https://developers.notion.com/)
+ * @see [Notion - Authorization](https://developers.notion.com/docs/authorization)
+ * @see [Notion - Authentication](https://developers.notion.com/reference/authentication)
+ * @see [Notion - Retrieve your token's bot user](https://developers.notion.com/reference/get-self)
+ */
+declare const notion: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<NotionProfile, DefaultUser>>) => OAuthProviderCredentials<NotionProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/dropbox.d.ts
+type AccountType = "basic" | "pro" | "business";
+interface Name {
+  given_name: string;
+  surname: string;
+  familiar_name: string;
+  display_name: string;
+  abbreviated_name: string;
+}
+interface RootInfo {
+  team: RootInfo;
+  user: RootInfo;
+}
+interface FullTeam {
+  id: string;
+  name: string;
+  sharing_policies: Record<string, unknown>;
+  office_addin_policy: unknown;
+  top_level_content_policy: unknown;
+}
+interface DropboxProfile {
+  account_id: string;
+  name: Name;
+  email: string;
+  email_verified: boolean;
+  disabled: boolean;
+  locale: string;
+  referral_link: string;
+  is_paired: boolean;
+  account_type: AccountType;
+  root_info: unknown;
+  profile_photo_url?: string;
+  country: string;
+  team?: unknown;
+  team_member_id?: string;
+}
+/**
+ * @see [Dropbox - OAuth Guide](https://developers.dropbox.com/oauth-guide)
+ * @see [Dropbox - API v2](https://www.dropbox.com/developers/documentation/http/documentation)
+ * @see [Dropbox - Get Current Account](https://www.dropbox.com/developers/documentation/http/documentation#users-get_current_account)
+ * @see [Dropbox - My Apps](https://www.dropbox.com/developers/apps)
+ * @see [Dropbox - Developer Guide](https://www.dropbox.com/developers/reference/developer-guide)
+ */
+declare const dropbox: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<DropboxProfile, DefaultUser>>) => OAuthProviderCredentials<DropboxProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/atlassian.d.ts
+interface ExtendedProfile {
+  job_title: string;
+  organization: string;
+  department: string;
+  location: string;
+}
+interface AtlassianProfile {
+  account_id: string;
+  account_type: string;
+  account_status: LiteralUnion<"active">;
+  email: string;
+  email_verified: boolean;
+  name: string;
+  picture: string;
+  nickname: string;
+  zoneinfo: string;
+  locale: string;
+  extended_profile: ExtendedProfile;
+  last_updated: string;
+  created_at: string;
+}
+/**
+ * @see [Atlassian - OAuth Apps](https://developer.atlassian.com/cloud/jira/platform/oauth-2-3lo-apps/)
+ * @see [Atlassian - My Apps](https://developer.atlassian.com/console/myapps/)
+ * @see [Atlassian - Retrieve Authenticated User](https://developer.atlassian.com/cloud/jira/software/oauth-2-3lo-apps/#how-do-i-retrieve-the-public-profile-of-the-authenticated-user-)
+ */
+declare const atlassian: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<AtlassianProfile, DefaultUser>>) => OAuthProviderCredentials<AtlassianProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/click-up.d.ts
+/**
+ * @see [Click Up - Get Authorized User](https://developer.clickup.com/reference/getauthorizeduser)
+ */
+interface ClickUpProfile {
+  user: {
+    id: number;
+    username: string;
+    email: string;
+    color: string;
+    profilePicture: string;
+    initials: string;
+    week_start_day: number;
+    global_font_support: boolean;
+    timezone: string;
+  };
+}
+/**
+ * ClickUp OAuth Provider
+ *
+ * @see [Click Up - Create your own app](https://help.clickup.com/hc/en-us/articles/6303422883095-Create-your-own-app-with-the-ClickUp-API)
+ * @see [Click Up - Authentication](https://developer.clickup.com/docs/authentication)
+ * @see [Click UP - Get Access Token](https://developer.clickup.com/reference/getaccesstoken)
+ * @see [Click Up - Get Authorized User](https://developer.clickup.com/reference/getauthorizeduser)
+ */
+declare const clickUp: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<ClickUpProfile, DefaultUser>>) => OAuthProviderCredentials<ClickUpProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/dribbble.d.ts
+/**
+ * @see [Dribble - User](https://developer.dribbble.com/v2/user/)
+ */
+interface DribbbleDefault {
+  id: number;
+  name: string;
+  login: string;
+  html_url: string;
+  avatar_url: string;
+  bio: string;
+  location: string;
+  links?: {
+    web?: string;
+    twitter?: string;
+  };
+  created_at: string;
+}
+interface DribbbleTeams extends DribbbleDefault {
+  type: "Team";
+  updated_at: string;
+}
+interface DribbbleProfile extends DribbbleDefault {
+  type: "User";
+  /** Not documented but available in the API response */
+  email: string | null;
+  can_upload_shot: boolean;
+  pro: boolean;
+  followers_count: number;
+  teams: DribbbleTeams[];
+}
+/**
+ * Dribbble OAuth provider
+ *
+ * @see [Dribbble - Register Application](https://dribbble.com/account/applications/new)
+ * @see [Dribbble - OAuth](https://developer.dribbble.com/v2/oauth/)
+ * @see [Dribbble - User](https://developer.dribbble.com/v2/user/)
+ */
+declare const dribbble: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<DribbbleProfile, DefaultUser>>) => OAuthProviderCredentials<DribbbleProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/index.d.ts
+declare const builtInOAuthProviders: {
+  readonly github: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<GitHubProfile, DefaultUser>>) => OAuthProviderCredentials<GitHubProfile, DefaultUser>;
+  readonly bitbucket: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<BitbucketProfile, DefaultUser>>) => OAuthProviderCredentials<BitbucketProfile, DefaultUser>;
+  readonly figma: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<FigmaProfile, DefaultUser>>) => OAuthProviderCredentials<FigmaProfile, DefaultUser>;
+  readonly discord: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<DiscordProfile, DefaultUser>>) => OAuthProviderCredentials<DiscordProfile, DefaultUser>;
+  readonly gitlab: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<GitLabProfile, DefaultUser>>) => OAuthProviderCredentials<GitLabProfile, DefaultUser>;
+  readonly spotify: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<SpotifyProfile, DefaultUser>>) => OAuthProviderCredentials<SpotifyProfile, DefaultUser>;
+  readonly x: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<XProfile, DefaultUser>>) => OAuthProviderCredentials<XProfile, DefaultUser>;
+  readonly strava: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<StravaProfile, DefaultUser>>) => OAuthProviderCredentials<StravaProfile, DefaultUser>;
+  readonly mailchimp: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<MailchimpProfile, DefaultUser>>) => OAuthProviderCredentials<MailchimpProfile, DefaultUser>;
+  readonly pinterest: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<PinterestProfile, DefaultUser>>) => OAuthProviderCredentials<PinterestProfile, DefaultUser>;
+  readonly twitch: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<TwitchProfile, DefaultUser>>) => OAuthProviderCredentials<TwitchProfile, DefaultUser>;
+  readonly notion: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<NotionProfile, DefaultUser>>) => OAuthProviderCredentials<NotionProfile, DefaultUser>;
+  readonly dropbox: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<DropboxProfile, DefaultUser>>) => OAuthProviderCredentials<DropboxProfile, DefaultUser>;
+  readonly atlassian: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<AtlassianProfile, DefaultUser>>) => OAuthProviderCredentials<AtlassianProfile, DefaultUser>;
+  readonly clickUp: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<ClickUpProfile, DefaultUser>>) => OAuthProviderCredentials<ClickUpProfile, DefaultUser>;
+  readonly dribbble: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<DribbbleProfile, DefaultUser>>) => OAuthProviderCredentials<DribbbleProfile, DefaultUser>;
+};
+/**
+ * Constructs OAuth provider configurations from an array of provider names or configurations.
+ * It loads the client ID and client secret from environment variables if only the provider name is provided.
+ *
+ * @param oauth - Array of OAuth provider configurations or provider names to be defined from environment variables
+ * @returns A record of OAuth provider configurations
+ * @example
+ * // Using built-in provider with env variables
+ * createBuiltInOAuthProviders(["github"])
+ *
+ * // Using built-in provider with explicit credentials via factory
+ * createBuiltInOAuthProviders([github({ clientId: "...", clientSecret: "..." })])
+ */
+declare const createBuiltInOAuthProviders: (oauth?: (BuiltInOAuthProvider | OAuthProviderCredentials<any>)[]) => Record<LiteralUnion<BuiltInOAuthProvider>, OAuthProviderCredentials<any>>;
+type BuiltInOAuthProvider = keyof typeof builtInOAuthProviders;
+//#endregion
+//#region src/@types/session.d.ts
+/** Application user type, inferred from the configured identity schema (defaults to the built-in user shape). */
+type User = infer$1<typeof UserIdentity>;
+/**
+ * Session data returned by the session endpoint.
+ */
+interface Session<DefaultUser extends User = User> {
+  user: DefaultUser;
+  expires: string;
+}
+interface CryptoSecret {
+  sign: CryptoKey | CryptoKeyPair | JWK | JsonWebKey | AsymmetricKeyPair;
+  encrypt: CryptoKey | CryptoKeyPair | JWK | JsonWebKey | AsymmetricKeyPair;
+}
+interface AsymmetricKeyPairFromEnv {
+  publicKey: string;
+  privateKey: string;
+}
+interface AsymmetricKeyPair {
+  publicKey: CryptoKey | JWK;
+  privateKey: CryptoKey | JWK;
+}
+/**
+ * A symmetric secret or asymmetric key pair used for JWT operations.
+ *
+ * - string / Uint8Array: used as-is for HMAC (signed) or AES (encrypted)
+ * - CryptoKey: Web Crypto API key, for environments that support it
+ * - CryptoKeyPair: asymmetric signing/encryption (RS256, ES256, EdDSA, RSA-OAEP, etc.)
+ */
+type SecretKey = string | Uint8Array | CryptoKey | CryptoKeyPair | CryptoSecret | JWK | AsymmetricKeyPair;
+/**
+ * @todo: add key rotation support for "SecretKey | CryptoKeyPair | [SecretKey | CryptoKeyPair, ...(SecretKey | CryptoKeyPair)[]]"
+ */
+type JWTKey = SecretKey;
+/**
+ * - "signed"    → standard JWS (e.g. HS256, RS256, ES256).
+ * - "encrypted" → JWE only. (e.g. A256GCM with RSA-OAEP key wrapping).
+ * - "sealed"    → JWS nested inside JWE (signed then encrypted).
+ */
+type JWTMode = "signed" | "encrypted" | "sealed";
+/**
+ * Signing algorithms for "signed" and "sealed" modes.
+ * Symmetric: HS256 | HS384 | HS512
+ * Asymmetric: RS256 | RS384 | RS512 | ES256 | ES384 | ES512 | EdDSA | PS256
+ */
+type JWTSigningAlgorithm = "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "EdDSA" | "PS256";
+/**
+ * Key-wrapping algorithms for "encrypted" and "sealed" modes.
+ * Symmetric: A128KW | A192KW | A256KW | dir (direct)
+ * ECDH:      ECDH-ES | ECDH-ES+A128KW | ECDH-ES+A256KW
+ * RSA:       RSA-OAEP | RSA-OAEP-256
+ */
+type JWTKeyAlgorithm = "A128KW" | "A192KW" | "A256KW" | "dir" | "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A256KW" | "RSA-OAEP" | "RSA-OAEP-256";
+/** Content-encryption algorithms for JWE. */
+type JWTEncryptionAlgorithm = "A128CBC-HS256" | "A192CBC-HS384" | "A256CBC-HS512" | "A128GCM" | "A192GCM" | "A256GCM";
+/** Signed JWT mode configuration. */
+type JWTSignedMode = {
+  mode: "signed";
+  signingAlgorithm?: JWTSigningAlgorithm;
+};
+/** Encrypted JWT mode configuration. */
+type JWTEncryptedMode = {
+  mode: "encrypted";
+  keyAlgorithm?: JWTKeyAlgorithm;
+  encryptionAlgorithm?: JWTEncryptionAlgorithm;
+};
+/** Signed and Encrypted JWT mode configuration. */
+type JWTSealedMode = {
+  mode?: "sealed";
+  signingAlgorithm?: JWTSigningAlgorithm;
+  keyAlgorithm?: JWTKeyAlgorithm;
+  encryptionAlgorithm?: JWTEncryptionAlgorithm;
+};
+/** Discriminated union of JWT wire format: signed JWS, encrypted JWE, or nested sealed (JWS in JWE). */
+type JWTConfigBase = JWTSignedMode | JWTEncryptedMode | JWTSealedMode;
+/** How session/JWT lifetime is enforced relative to `iat`, absolute caps, and sliding windows. */
+type JWTExpirationStrategy = "fixed" | "rolling" | "absolute" | "sliding";
+type JWTConfig = Prettify$1<{
+  /**
+   * Token lifetime.
+   */
+  maxAge?: number;
+  /**
+   * JWT `iss` (issuer) claim. Set this to your app's canonical URL.
+   * @example "https://auth.example.com"
+   */
+  issuer?: string;
+  /**
+   * JWT `aud` claim. Single value or array for multi-audience tokens.
+   * @example ["https://api.example.com", "https://app.example.com"]
+   */
+  audience?: string | string[];
+  /**
+   * Maximum absolute session duration in seconds.
+   * Required for "absolute" and "sliding" strategies.
+   * Enforced via jose's maxTokenAge against the iat claim.
+   */
+  maxExpiration?: number;
+  /**
+   * Policy for renewing or capping token lifetime (pairs with `maxExpiration` where applicable).
+   */
+  expirationStrategy?: JWTExpirationStrategy;
+} & JWTConfigBase>;
+/**
+ * Stateless JWT strategy.
+ * No database required. Tokens are self-contained and cannot be revoked
+ * before they expire — keep `jwt.maxAge` short or enable refresh tokens.
+ *
+ * @example
+ * {
+ *   strategy: "jwt",
+ *   jwt: { mode: "sealed", maxAge: "15m", issuer: "https://auth.example.com" },
+ *   refreshToken: { enabled: true, maxAge: "7d" },
+ * }
+ */
+type StatelessStrategyConfig = {
+  strategy?: "jwt";
+  jwt?: JWTConfig;
+};
+/**
+ * The session strategy. Determines which fields below are required.
+ *
+ * - "jwt": stateless. No database needed. JWTs are self-contained.
+ * - "database": stateful. Every request hits the DB to validate the session.
+ * - "hybrid": JWT transport + DB revocation. Best of both for most apps.
+ *
+ * @default "jwt"
+ */
+type SessionConfig = StatelessStrategyConfig;
+/** Result of reading a stateless (JWT) session from a request: session payload and outgoing header mutations. */
+interface GetStatelessSessionReturn<DefaultUser extends User = User> {
+  session: Session<DefaultUser> | null;
+  headers: Headers;
+}
+/**
+ * Abstraction layer for session management.
+ */
+interface SessionStrategy<DefaultUser extends User = User> {
+  /**
+   * Read and validate the session from an incoming request.
+   * Returns null if absent, invalid, or expired. Never throws on auth failure.
+   */
+  getSession(request: Headers): Promise<GetStatelessSessionReturn<DefaultUser>>;
+  /**
+   * Create a session after successful authentication.
+   * Signs the JWT / writes the DB row / sets cookies.
+   */
+  createSession(session: User): Promise<string>;
+  /**
+   * Attempt to refresh using the refresh token cookie.
+   * Returns null session + cookie-clearing response on any failure.
+   */
+  refreshSession(headers: Headers, session: DeepPartial<Session<DefaultUser>>, skipCSRFCheck?: boolean): Promise<{
+    session: Session<DefaultUser> | null;
+    headers: Headers;
+  }>;
+  /**
+   * Revoke a session by ID.
+   * JWT strategy: best-effort (clears cookies, no server state).
+   * Database / hybrid: marks row inactive.
+   */
+  revokeSession(sessionId: string): Promise<void>;
+  /**
+   * Destroy the session attached to this request (logout).
+   * Returns a response that clears cookies.
+   */
+  destroySession(request: Headers, skipCSRFCheck?: boolean): Promise<Headers>;
+}
+/** Inputs for constructing a session strategy implementation for a given identity schema. */
+interface CreateSessionStrategyOptions<Identity extends Identities> {
+  config?: SessionConfig;
+  jose: JoseInstance<FromShapeToObject<Identity> & User>;
+  cookies: () => CookieStoreConfig;
+  logger?: InternalLogger;
+  identity: SchemaRegistryContext;
+}
+/** Options specialized for the JWT-backed session strategy. */
+interface JWTStrategyOptions<DefaultUser extends User = User> {
+  config?: StatelessStrategyConfig;
+  jose: JoseInstance<DefaultUser>;
+  logger?: InternalLogger;
+  cookies: () => CookieStoreConfig;
+  identity: SchemaRegistryContext;
+}
+/** Minimal token issue/verify surface used by session code paths. */
+type JWTManager<DefaultUser extends User = User> = {
+  createToken(user: TypedJWTPayload<Partial<DefaultUser>>): Promise<string>;
+  verifyToken(token: string): Promise<TypedJWTPayload<DefaultUser>>;
+};
+//#endregion
+//#region src/@types/oauth.d.ts
+/** Known query parameter names supported when building an OAuth authorization URL. */
+type AuthorizeParams = LiteralUnion<"clientId" | "prompt" | "scope" | "responseMode" | "audience" | "loginHint" | "nonce" | "display">;
+/** OAuth 2.0 `response_type` values used in authorization requests. */
+type ResponseType = LiteralUnion<"code" | "token" | "refresh_token" | "id_token">;
+/**
+ * Configuration for an OAuth provider without credentials.
+ * Use this type when defining provider metadata and endpoints.
+ */
+interface OAuthProviderConfig<Profile extends object = Record<string, any>, DefaultUser = User> {
+  id: string;
+  name: string;
+  /**
+   * @deprecated
+   * use `authorize` instead of `authorizeURL`
+   */
+  authorizeURL?: string;
+  authorize: string | {
+    url: string;
+    params?: Partial<Record<AuthorizeParams, string> & {
+      responseType: ResponseType;
+    }>;
+  };
+  accessToken: string | {
+    url: string;
+    headers?: Record<string, string>;
+  };
+  userInfo: string | {
+    url: string;
+    headers?: Record<string, string>;
+    method?: string;
+  };
+  /**
+   * @deprecated
+   * use `authorize.params.scope` instead of `scope`
+   */
+  scope?: string;
+  /**
+   * @deprecated
+   * use `authorize.params.responseType` instead of `responseType`
+   */
+  responseType?: ResponseType;
+  profile?: (profile: Profile) => DefaultUser | Promise<DefaultUser>;
+}
+/**
+ * OAuth provider configuration with client credentials.
+ * Extends OAuthProviderConfig with clientId and clientSecret.
+ */
+interface OAuthProviderCredentials<Profile extends object = Record<string, any>, DefaultUser extends User = User> extends OAuthProviderConfig<Profile, DefaultUser> {
+  clientId?: string;
+  clientSecret?: string;
+}
+/**
+ * Complete OAuth provider type combining configuration and credentials.
+ */
+type OAuthProvider<Profile extends object = Record<string, any>, DefaultUser extends User = User> = OAuthProviderCredentials<Profile, DefaultUser>;
+/**
+ * Lookup table of configured OAuth providers keyed by built-in id or custom id.
+ * Values are full credential configs used at runtime for authorize/token/userinfo.
+ */
+type OAuthProviderRecord<DefaultUser extends User = User> = Record<LiteralUnion<BuiltInOAuthProvider>, OAuthProviderCredentials<any, DefaultUser>>;
+//#endregion
+//#region src/@types/config.d.ts
+/**
+ * Main configuration interface for Aura Auth.
+ * This is the user-facing configuration object passed to `createAuth()`.
+ */
+type AuthConfig<Identity extends Identities> = {
+  /**
+   * OAuth providers available in the authentication and authorization flows. It provides a type-inference
+   * for the OAuth providers that are supported by Aura Stack Auth; alternatively, you can provide a custom
+   * OAuth third-party authorization service by implementing the `OAuthProviderCredentials` interface.
+   *
+   * Built-in OAuth providers:
+   * ```ts
+   * oauth: ["github", "google"]
+   * ```
+   * Custom credentials via factory:
+   * ```ts
+   * oauth: [github({ clientId: "...", clientSecret: "..." })]
+   * ```
+   * Custom OAuth providers:
+   * ```ts
+   * oauth: [
+   *   {
+   *     id: "oauth-providers",
+   *     name: "OAuth",
+   *     authorizeURL: "https://example.com/oauth/authorize",
+   *     accessToken: "https://example.com/oauth/token",
+   *     scope: "profile email",
+   *     responseType: "code",
+   *     userInfo: "https://example.com/oauth/userinfo",
+   *     clientId: process.env.AURA_AUTH_PROVIDER_CLIENT_ID,
+   *     clientSecret: process.env.AURA_AUTH_PROVIDER_CLIENT_SECRET,
+   *   }
+   * ]
+   * ```
+   */
+  oauth: (BuiltInOAuthProvider | OAuthProviderCredentials<any, FromShapeToObject<Identity>>)[];
+  /**
+   * Cookie options defines the configuration for cookies used in Aura Auth.
+   * It includes a prefix for cookie names and flag options to determine
+   * the security and scope of the cookies.
+   *
+   * **⚠️ WARNING:** Ensure that the cookie options are configured correctly to
+   * maintain the security and integrity of the authentication process. `Aura Auth`
+   * is not responsible for misconfigured cookies that may lead to security vulnerabilities.
+   *
+   * - prefix: A string prefix to be added to all cookie names, by default "aura-stack".
+   * - flag options (This attributes help to define the security level of the cookies):
+   *   - secure: Cookies use the __Secure- prefix and are only sent over HTTPS connections.
+   *   - host: Cookies use the __Host- prefix and are only sent over HTTPS connections.
+   *   - standard: Cookies can be sent over both HTTP and HTTPS connections. (default in development)
+   *
+   * @see https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html#name-the-__secure-prefix
+   * @see https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html#name-the-__host-prefix
+   */
+  cookies?: Partial<CookieConfig>;
+  /**
+   * Secret used to sign and verify JWT tokens for session and csrf protection.
+   * If not provided, it will load from the environment variable `AURA_AUTH_SECRET` or `AUTH_SECRET`, but if it
+   * doesn't exist, it will throw an error during the initialization of the Auth module.
+   *
+   * > It can be a string, a Uint8Array, a CryptoKey, a CryptoKeyPair, or an object containing separate keys for
+   * signing and encryption. It depends on the JWT mode and algorithms you choose in the session configuration.
+   * The default mode is "sealed" (signing + encryption), so if the secret is a string or Uint8Array, it will derive
+   * separate keys for signing and encryption using HKDF, but if you provide a CryptoKeyPair, it will required to
+   * pass separate keys for signing and encryption in the `CryptoSecret` format.
+   * @example
+   * import { createSecretValue } from "@aura-stack/auth/crypto"
+   *
+   * secret: createSecretValue(32)
+   *
+   * // For asymmetric keys, generate a key pair and pass the private
+   * import { createKeyPair } from "@aura-stack/auth/crypto"
+   *
+   * const signing = await createKeyPair("RS256", { extractable: true })
+   * const encryption = await createKeyPair("RSA-OAEP-256", { extractable: true })
+   *
+   * secret: {
+   *   sign: signing,
+   *   encrypt: encryption,
+   * }
+   */
+  secret?: JWTKey;
+  /**
+   * Base URL of the application, used to construct the incoming request's origin.
+   */
+  baseURL?: string;
+  /**
+   * Base path for all authentication routes. Default is `/auth`.
+   */
+  basePath?: `/${string}`;
+  /**
+   * Logger configuration for handling authentication-related logs and errors. It can be set to `true`,
+   * `DEBUG=true`, `LOG_LEVEL=debug`, or a custom logger. It implements the syslog format.
+   */
+  logger?: boolean | Logger;
+  /**
+   * Defines the session management strategy for Aura Auth. It determines how sessions are created, stored, and validated.
+   */
+  session?: SessionConfig;
+  /**
+   * Identity schema configuration for user data validation.
+   * Allows you to define a custom Zod schema that will be used to validate:
+   * - OAuth provider profile data
+   * - Session user data
+   * - JWT payload data
+   *
+   * If not provided, the default `UserIdentity` schema will be used.
+   *
+   * @example
+   * identity: {
+   *   schema: z.object({
+   *     sub: z.string(),
+   *     email: z.string().email(),
+   *     name: z.string().optional(),
+   *     custom_field: z.string().optional(),
+   *   }),
+   *   skipValidation: false,
+   *   unknownKeys: "strip",
+   * }
+   */
+  identity?: Partial<{
+    /**
+     * Skip schema validation for session data, JWT payloads, and OAuth profiles.
+     * This can be useful for performance optimization if you are certain that the
+     * data is valid, but it can lead to security vulnerabilities if misused.
+     * > ⚠️ WARNING: Use this option with caution.
+     */
+    skipValidation: boolean;
+    /**
+     * Custom schema validation for user identity data. It supports any Zod, Arktype,
+     * Valibot or Typebox schema. Use `createIdentity` helper function to create a schema
+     * with the correct shape and inference.
+     */
+    schema: ConfigSchema<Identity>;
+    /**
+     * Defines how unknown keys are handled during schema validation. It can be set to:
+     * - `passthrough`: Unknown keys are allowed and included in the validated data.
+     * - `strict`: Unknown keys will cause validation to fail with an error.
+     * - `strip`: Unknown keys are removed from the validated data.
+     */
+    unknownKeys: "passthrough" | "strict" | "strip";
+  }>;
+  /**
+   * Credentials provider for username/password or similar authentication.
+   */
+  credentials?: CredentialsProvider<Identity>;
+} & TrustedProxyHeadersConfig;
+type TrustedProxyHeadersConfig = {
+  /**
+   * Enable trusted proxy headers for scenarios where the application is behind a reverse proxy or load balancer.
+   * This setting allows Aura Auth to correctly interpret headers like `X-Forwarded-For` and `X-Forwarded-Proto`
+   * to determine the original client IP address and protocol.
+   *
+   * Default is `false`. Enable this option only if you are certain that your application is behind a trusted proxy.
+   * Misconfiguration can lead to security vulnerabilities, such as incorrect handling of secure cookies or
+   * inaccurate client IP logging.
+   *
+   * This value can also be set via environment variable as `AURA_AUTH_TRUSTED_PROXY_HEADERS`
+   *
+   * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For
+   * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Proto
+   * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Forwarded
+   * @experimental
+   */
+  trustedProxyHeaders: true;
+  /**
+   * Defines trusted origins for your application to prevent open redirect attacks.
+   * URLs from the Referer header, Origin header, request URL, and redirectTo option
+   * are validated against this list before redirecting.
+   *
+   * - **Exact URL**: `https://example.com` matches only that origin.
+   * - **Subdomain wildcard**: `https://*.example.com` matches `https://app.example.com`, `https://api.example.com`, etc.
+   *
+   * > **⚠️ WARNING:** Ensure that the trusted origins are configured correctly to prevent open redirect vulnerabilities.
+   * Only include origins that you control and trust.
+   *
+   * @example
+   * trustedOrigins: ["https://example.com", "https://*.example.com", "http://localhost:3000"]
+   *
+   * trustedOrigins: async (request) => {
+   *   const origin = new URL(request.url).origin
+   *   return [origin, "https://admin.example.com"]
+   * }
+   */
+  trustedOrigins: TrustedOrigin[] | ((request: Request) => Promise<TrustedOrigin[]> | TrustedOrigin[]);
+} | {
+  /**
+   * Enable trusted proxy headers for scenarios where the application is behind a reverse proxy or load balancer.
+   * This setting allows Aura Auth to correctly interpret headers like `X-Forwarded-For` and `X-Forwarded-Proto`
+   * to determine the original client IP address and protocol.
+   *
+   * Default is `false`. Enable this option only if you are certain that your application is behind a trusted proxy.
+   * Misconfiguration can lead to security vulnerabilities, such as incorrect handling of secure cookies or
+   * inaccurate client IP logging.
+   *
+   * This value can also be set via environment variable as `AURA_AUTH_TRUSTED_PROXY_HEADERS`
+   *
+   * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For
+   * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Proto
+   * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Forwarded
+   * @experimental
+   */
+  trustedProxyHeaders?: false;
+  /**
+   * Defines trusted origins for your application to prevent open redirect attacks.
+   * URLs from the Referer header, Origin header, request URL, and redirectTo option
+   * are validated against this list before redirecting.
+   *
+   * - **Exact URL**: `https://example.com` matches only that origin.
+   * - **Subdomain wildcard**: `https://*.example.com` matches `https://app.example.com`, `https://api.example.com`, etc.
+   *
+   * > **⚠️ WARNING:** Ensure that the trusted origins are configured correctly to prevent open redirect vulnerabilities.
+   * Only include origins that you control and trust.
+   *
+   * @example
+   * trustedOrigins: ["https://example.com", "https://*.example.com", "http://localhost:3000"]
+   *
+   * trustedOrigins: async (request) => {
+   *   const origin = new URL(request.url).origin
+   *   return [origin, "https://admin.example.com"]
+   * }
+   *
+   */
+  trustedOrigins?: TrustedOrigin[] | ((request: Request) => Promise<TrustedOrigin[]> | TrustedOrigin[]);
+};
+/**
+ * Cookie type with __Secure- prefix, must be Secure.
+ * @see https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html#name-the-__secure-prefix
+ */
+type SecureCookie = {
+  strategy: "secure";
+} & Prettify$1<Omit<SerializeOptions, "secure" | "encode">>;
+/**
+ * Cookie type with __Host- prefix, must be Secure, Path=/, no Domain attribute.
+ * @see https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html#name-the-__host-prefix
+ */
+type HostCookie = {
+  strategy: "host";
+} & Prettify$1<Omit<SerializeOptions, "secure" | "path" | "domain" | "encode">>;
+/**
+ * Standard cookie type without security prefixes.
+ * Can be sent over both HTTP and HTTPS connections (default in development).
+ */
+type StandardCookie = {
+  strategy?: "standard";
+} & Prettify$1<Omit<SerializeOptions, "encode">>;
+/**
+ * Union type for cookie options based on the specified strategy.
+ * - `secure`: Cookies are only sent over HTTPS connections
+ * - `host`: Cookies use the __Host- prefix and are only sent over HTTPS connections
+ * - `standard`: Cookies can be sent over both HTTP and HTTPS connections (default in development)
+ */
+type CookieStrategyAttributes = StandardCookie | SecureCookie | HostCookie;
+/**
+ * Names of cookies used by Aura Auth for session management and OAuth flows.
+ * - `sessionToken`: User session JWT
+ * - `csrfToken`: CSRF protection token
+ * - `state`: OAuth state parameter for CSRF protection
+ * - `codeVerifier`: PKCE code verifier for authorization code flow
+ * - `redirectURI`: OAuth callback URI
+ * - `redirectTo`: Post-authentication redirect path
+ */
+type CookieName = "sessionToken" | "csrfToken" | "state" | "codeVerifier" | "redirectTo" | "redirectURI";
+/** Resolved cookie names and serialization attributes for each logical auth cookie. */
+type CookieStoreConfig = Record<CookieName, {
+  name: string;
+  attributes: CookieStrategyAttributes;
+}>;
+interface CookieConfig {
+  /**
+   * Prefix to be added to all cookie names. By default "aura-stack".
+   */
+  prefix?: string;
+  /**
+   * Overrides for individual cookie configurations.
+   * @see {@link CookieStoreConfig} for the structure of each cookie configuration.
+   */
+  overrides?: Partial<CookieStoreConfig>;
+}
+/**
+ * A trusted origin URL or pattern. Supports:
+ * - Exact: `https://example.com`
+ * - Subdomain wildcard: `https://*.example.com`
+ */
+type TrustedOrigin = string;
+/**
+ * Log level for logger messages.
+ */
+type LogLevel = "warn" | "error" | "debug" | "info";
+/** Defines the Severity between 0 to 7 */
+type Severity = "emergency" | "alert" | "critical" | "error" | "warning" | "notice" | "info" | "debug";
+/**
+ * @see https://datatracker.ietf.org/doc/html/rfc5424
+ */
+type SyslogOptions = {
+  facility: 4 | 10;
+  severity: Severity;
+  timestamp?: string;
+  hostname?: string;
+  appName?: string;
+  procId?: string;
+  msgId: string;
+  message: string;
+  structuredData?: Record<string, string | number | boolean>;
+};
+/**
+ * Logger function interface for structured logging.
+ * Called when errors or warnings occur during authentication flows.
+ */
+interface Logger {
+  level?: LogLevel;
+  log?: (args: SyslogOptions) => void;
+}
+/**
+ * Programmatic auth API returned with the auth instance: `getSession`, `signIn`, `signInCredentials`, `signOut`, `updateSession`.
+ * Each method returns a result object plus `headers` and `toResponse()` for HTTP responses.
+ */
+type AuthAPI<DefaultUser extends User = User> = ReturnType<typeof createAuthAPI<DefaultUser>>;
+/** JWT and crypto helpers bound to the configured identity schema (sign, verify, claims). */
+type JoseInstance<DefaultUser extends User = User> = ReturnType<typeof createJoseInstance<DefaultUser>>;
+/** Normalized internal logger with resolved level and structured log function. */
+interface InternalLogger {
+  level: LogLevel;
+  log: typeof createLogEntry;
+}
+/**
+ * Identity validation settings used when building session strategy and OAuth profile mapping.
+ * Controls the Zod schema and how unknown keys are handled on user objects.
+ */
+interface IdentityConfig<Schema extends SchemaTypes = typeof UserIdentity> {
+  schema?: Schema;
+  schemaAsPartial?: Schema;
+  skipValidation?: boolean;
+  unknownKeys?: "passthrough" | "strict" | "strip";
+}
+/** Payload sent to the credentials sign-in endpoint (username/password flow). */
+interface CredentialsPayload {
+  username: string;
+  password: string;
+}
+/**
+ * Context provided to the credentials provider's authorize function.
+ * It includes the credentials sent by the user and hashing utilities.
+ */
+interface CredentialsProviderContext<T> {
+  /**
+   * User-provided credentials (e.g., email, password).
+   */
+  credentials: T;
+  /**
+   * Hashes a password using the internal hashing algorithm (PBKDF2).
+   */
+  deriveSecret: (password: string, salt?: string, iterations?: number) => Promise<string>;
+  /**
+   * Verifies a password against a hashed value.
+   */
+  verifySecret: (password: string, hashedPassword: string) => Promise<boolean>;
+}
+/**
+ * Interface for the credentials provider.
+ */
+interface CredentialsProvider<Identity extends Identities> {
+  hash?: (password: string, salt?: string, iterations?: number) => Promise<string>;
+  verify?: (password: string, hashedPassword: string) => Promise<boolean>;
+  /**
+   * Authenticates a user using credentials.
+   * Must return a User object or the identity type if the identity schema is provided.
+   */
+  authorize: (ctx: CredentialsProviderContext<CredentialsPayload>) => Promise<FromShapeToObject<Identity> | null> | FromShapeToObject<Identity> | null;
+}
+/**
+ * Runtime context passed into auth actions and API handlers: OAuth map, cookies, JWT, session strategy, trusted origins, etc.
+ * This is the fully resolved configuration surface after `createAuth` initializes defaults.
+ */
+interface RouterGlobalContext<DefaultUser extends User = User> {
+  oauth: OAuthProviderRecord;
+  credentials?: CredentialsProvider<any>;
+  cookies: CookieStoreConfig;
+  jose: JoseInstance<DefaultUser>;
+  secret?: JWTKey;
+  baseURL?: string;
+  basePath: string;
+  trustedProxyHeaders: boolean;
+  trustedOrigins?: TrustedOrigin[] | ((request: Request) => Promise<TrustedOrigin[]> | TrustedOrigin[]);
+  logger?: InternalLogger;
+  sessionStrategy: SessionStrategy<DefaultUser>;
+  identity: SchemaRegistryContext;
+}
+interface SchemaRegistryContext {
+  schemaRegistry: ReturnType<typeof createSchemaRegistry>;
+  skipValidation?: boolean;
+  unknownKeys: "passthrough" | "strict" | "strip";
+}
+/**
+ * Internal runtime configuration used within Aura Auth after initialization.
+ * All optional fields from AuthConfig are resolved to their default values.
+ */
+type AuthRuntimeConfig<DefaultUser extends User = User> = RouterGlobalContext<DefaultUser>;
+/**
+ * Public auth instance: programmatic {@link AuthAPI}, {@link JoseInstance}, and HTTP {@link AuthClient} handlers.
+ */
+interface AuthInstance<DefaultUser extends User = User> {
+  /**
+   * Programmatic API for authentication actions (getSession, signIn, signOut, etc.) that can be used in server-side contexts or API routes.
+   */
+  api: AuthAPI<DefaultUser>;
+  /**
+   * JOSE helper functions for signin, encryption and verification of JWTs.
+   */
+  jose: JoseInstance<DefaultUser>;
+  /**
+   * HTTP handlers for mounting on a router or server.
+   */
+  handlers: {
+    GET: (request: Request) => Response | Promise<Response>;
+    POST: (request: Request) => Response | Promise<Response>;
+    PATCH: (request: Request) => Response | Promise<Response>;
+    ALL: (request: Request) => Response | Promise<Response>;
+  };
+}
+/**
+ * Extended context used inside the library with both secure and standard cookie materializations.
+ */
+type InternalContext<Identity extends Identities> = RouterGlobalContext<FromShapeToObject<Identity> & User> & {
+  cookieConfig: {
+    secure: CookieStoreConfig;
+    standard: CookieStoreConfig;
+  };
+};
+//#endregion
+//#region src/@types/utility.d.ts
+/** Expands intersection types into a single flat object type for readable editor hints. */
+type Prettify$1<T> = { [K in keyof T]: T[K] };
+/**
+ * A string that must be one of the literals in `T`, or any other string (`U`).
+ * Useful for autocomplete on known keys while still allowing custom values.
+ */
+type LiteralUnion<T extends U, U = string> = T | (U & Record<never, never>);
+/**
+ * Transforms a Zod raw shape so nested `ZodObject` fields become editable (same structure, for config authoring).
+ */
+type EditableShape<T extends ZodRawShape> = { [K in keyof T]: T[K] extends ZodObject<infer Inner extends ZodRawShape> ? ZodObject<EditableShape<Inner>> : ZodTypeAny };
+type EditableShapeZod<T extends ZodRawShape> = EditableShape<T>;
+type AnyShape = Record<string, AnySchema>;
+type EditableShapeValibot<T extends ObjectEntries> = { [K in keyof T]: T[K] extends ObjectSchema<infer Inner extends AnyShape, undefined> ? ObjectSchema<EditableShapeValibot<Inner>, undefined> : BaseSchema<any, any, any> };
+type EditableShapeTypebox<T extends TProperties> = { [K in keyof T]: T[K] extends TObject ? Wrap<EditableShapeTypebox<T[K]["properties"]>> : TSchema };
+type ConfigSchema<T extends Identities> = IsZod<T> extends true ? ZodObject<T & ZodRawShape> : T extends EditableShapeValibot<UserShapeValibot> ? ObjectSchema<T & ObjectEntries, undefined> : IsArkType<T> extends true ? T : T extends EditableShapeTypebox<UserShapeTypeBox> ? TObject<T & TProperties> : never;
+type ValibotShapeToObject<S extends ObjectEntries> = Merge<InferOutput<ObjectSchema<S, undefined>>, User>;
+type ArktypeShapeToObject<S extends Type> = S extends Type<infer Shape> ? Wrap<Merge<Shape, User>> : never;
+type TypeboxShapeToObject<S extends TProperties> = S extends TProperties ? Wrap<Merge<Static<TObject<S>>, User>> : never;
+type EditableShapeArkType<T extends Type> = T extends Type<infer Shape> ? Type<{ [K in keyof Shape]: any }> : never;
+/** Merges type `B` over `A`, replacing overlapping keys with `B`. */
+type Merge<A, B> = Omit<A, keyof B> & B;
+/**
+ * Infers the runtime object type from a Zod `shape` and intersects it with {@link User}
+ * so identity fields always include the base user contract.
+ */
+type ZodShapeToObject<S extends ZodRawShape = ZodRawShape> = Merge<__Infer<ZodObject<S>>, User>;
+type FromShapeToObject<S> = S extends ZodRawShape ? ZodShapeToObject<S> : S extends ObjectEntries ? ValibotShapeToObject<S> : S extends Type ? ArktypeShapeToObject<S> : S extends TProperties ? TypeboxShapeToObject<S> : never;
+/** Recursively makes every property required. */
+type DeepRequired<T> = { [K in keyof T]-?: T[K] extends object ? DeepRequired<T[K]> : T[K] };
+/** Recursively makes every property optional. */
+type DeepPartial<T> = { [P in keyof T]?: T[P] extends object ? DeepPartial<T[P]> : T[P] };
+/** Wraps a type in an object with the same keys. */
+type Wrap<T> = T extends any ? { [K in keyof T]: T[K] } : never;
+/**
+ * Infers the user type from an {@link AuthInstance} config, or falls back to {@link User}.
+ * @example
+ * const auth = createAuth({
+ *   oauth: [],
+ *   identity: UserIdentity.extend({
+ *     role: z.string().nullable().optional(),
+ *     username: z.string().optional(),
+ *   })
+ * })
+ *
+ * type User = InferUser<typeof auth>
+ */
+type InferUser<Config extends AuthInstance> = Config extends AuthInstance<infer Identity> ? Prettify$1<Identity> : User;
+/**
+ * Infers the session type from an {@link AuthInstance} config.
+ * @example
+ * const auth = createAuth({
+ *   oauth: [],
+ *   identity: UserIdentity.extend({
+ *     role: z.string().nullable().optional(),
+ *     username: z.string().optional(),
+ *   })
+ * })
+ *
+ * type Session = InferSession<typeof auth>
+ */
+type InferSession<Config extends AuthInstance> = Prettify$1<Session<Wrap<InferUser<Config>>>>;
+/**
+ * Shorthand for a Zod object’s `.shape` property.
+ */
+type InferZodShape<T extends ZodObject> = T["shape"];
+/**
+ * Infers the user type from a Zod identity schema, or falls back to {@link User}.
+ * @example
+ * const schema = z.object({
+ *   sub: z.string(),
+ *   role: z.string().nullable().optional(),
+ *   username: z.string().optional(),
+ * })
+ *
+ * type User = UserFrom<typeof schema>
+ */
+type UserFrom<T extends ZodObject> = Prettify$1<ZodShapeToObject<InferZodShape<T>>>;
+/**
+ * Infers the session type from a Zod identity schema.
+ * @example
+ * const schema = z.object({
+ *   sub: z.string(),
+ *   role: z.string().nullable().optional(),
+ *   username: z.string().optional(),
+ * })
+ *
+ * type Session = SessionFrom<typeof schema>
+ */
+type SessionFrom<T extends ZodObject> = Wrap<Session<Wrap<UserFrom<T>>>>;
+/**
+ * HTTP `Response` with `json()` typed to resolve to `Body` (defaults to `unknown`).
+ */
+type AuthResponse<Body = unknown> = Prettify$1<Omit<Response, "json"> & {
+  json(): Promise<Body>;
+}>;
+//#endregion
+//#region src/createAuth.d.ts
+declare const createAuthInstance: <Identity extends Identities>(authConfig: AuthConfig<Identity>) => {
+  handlers: _$_aura_stack_router0.Router<[_$_aura_stack_router0.RouteEndpoint<"GET", "/signIn/:oauth", {
+    schemas?: {
+      params: _$zod.ZodObject<{
+        oauth: _$zod.ZodEnum<{
+          [x: string & Record<never, never>]: string & Record<never, never>;
+          github: "github";
+          bitbucket: "bitbucket";
+          figma: "figma";
+          discord: "discord";
+          gitlab: "gitlab";
+          spotify: "spotify";
+          x: "x";
+          strava: "strava";
+          mailchimp: "mailchimp";
+          pinterest: "pinterest";
+          twitch: "twitch";
+          notion: "notion";
+          dropbox: "dropbox";
+          atlassian: "atlassian";
+          clickUp: "clickUp";
+          dribbble: "dribbble";
+        }>;
+      }, _$zod_v4_core0.$strip>;
+      searchParams: _$zod.ZodObject<{
+        redirect: _$zod.ZodDefault<_$zod.ZodOptional<_$zod.ZodCodec<_$zod.ZodString, _$zod.ZodBoolean>>>;
+        redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
+      }, _$zod_v4_core0.$strip>;
+    } | undefined;
+    use?: _$_aura_stack_router0.MiddlewareFunction<"/signIn/:oauth", {
+      params: _$zod.ZodObject<{
+        oauth: _$zod.ZodEnum<{
+          [x: string & Record<never, never>]: string & Record<never, never>;
+          github: "github";
+          bitbucket: "bitbucket";
+          figma: "figma";
+          discord: "discord";
+          gitlab: "gitlab";
+          spotify: "spotify";
+          x: "x";
+          strava: "strava";
+          mailchimp: "mailchimp";
+          pinterest: "pinterest";
+          twitch: "twitch";
+          notion: "notion";
+          dropbox: "dropbox";
+          atlassian: "atlassian";
+          clickUp: "clickUp";
+          dribbble: "dribbble";
+        }>;
+      }, _$zod_v4_core0.$strip>;
+      searchParams: _$zod.ZodObject<{
+        redirect: _$zod.ZodDefault<_$zod.ZodOptional<_$zod.ZodCodec<_$zod.ZodString, _$zod.ZodBoolean>>>;
+        redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
+      }, _$zod_v4_core0.$strip>;
+    }>[] | undefined;
+  }, (ctx: {
+    params: {
+      oauth: "github" | "bitbucket" | "figma" | "discord" | "gitlab" | "spotify" | "x" | "strava" | "mailchimp" | "pinterest" | "twitch" | "notion" | "dropbox" | "atlassian" | "clickUp" | "dribbble" | (string & Record<never, never>);
+    };
+    body: undefined;
+    searchParams: {
+      redirect: boolean;
+      redirectTo?: string | undefined;
+    };
+    headers: _$_aura_stack_router0.HeadersBuilder;
+    request: Request;
+    url: URL;
+    method: "GET";
+    route: "/signIn/:oauth";
+    context: _$_aura_stack_router0.GlobalContext;
+    json: <T>(data: T, init?: ResponseInit) => _$_aura_stack_router0.JsonResponse<T>;
+  }) => Promise<Prettify$1<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: true;
+      redirect: boolean;
+      signInURL: string;
+    }>;
+  }> | Prettify$1<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: false;
+      redirect: false;
+      signInURL: null;
+    }>;
+  }>>>, _$_aura_stack_router0.RouteEndpoint<"POST", `/${string}`, {
+    schemas?: {
+      body: _$zod.ZodObject<{
+        username: _$zod.ZodString;
+        password: _$zod.ZodString;
+      }, _$zod_v4_core0.$strip>;
+      searchParams: _$zod.ZodObject<{
+        redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
+      }, _$zod_v4_core0.$strip>;
+    } | undefined;
+    use?: _$_aura_stack_router0.MiddlewareFunction<`/${string}`, {
+      body: _$zod.ZodObject<{
+        username: _$zod.ZodString;
+        password: _$zod.ZodString;
+      }, _$zod_v4_core0.$strip>;
+      searchParams: _$zod.ZodObject<{
+        redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
+      }, _$zod_v4_core0.$strip>;
+    }>[] | undefined;
+  }, (ctx: {
+    params: {};
+    body: {
+      username: string;
+      password: string;
+    };
+    searchParams: {
+      redirectTo?: string | undefined;
+    };
+    headers: _$_aura_stack_router0.HeadersBuilder;
+    request: Request;
+    url: URL;
+    method: "POST";
+    route: `/${string}`;
+    context: _$_aura_stack_router0.GlobalContext;
+    json: <T>(data: T, init?: ResponseInit) => _$_aura_stack_router0.JsonResponse<T>;
+  }) => Promise<Prettify$1<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: true;
+      redirectURL: string;
+    }>;
+  }> | Prettify$1<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: false;
+      redirectURL: null;
+    }>;
+  }>>>, _$_aura_stack_router0.RouteEndpoint<"GET", "/callback/:oauth", {
+    schemas?: {
+      params: _$zod.ZodObject<{
+        oauth: _$zod.ZodEnum<{
+          [x: string & Record<never, never>]: string & Record<never, never>;
+          github: "github";
+          bitbucket: "bitbucket";
+          figma: "figma";
+          discord: "discord";
+          gitlab: "gitlab";
+          spotify: "spotify";
+          x: "x";
+          strava: "strava";
+          mailchimp: "mailchimp";
+          pinterest: "pinterest";
+          twitch: "twitch";
+          notion: "notion";
+          dropbox: "dropbox";
+          atlassian: "atlassian";
+          clickUp: "clickUp";
+          dribbble: "dribbble";
+        }>;
+      }, _$zod_v4_core0.$strip>;
+      searchParams: _$zod.ZodObject<{
+        code: _$zod.ZodString;
+        state: _$zod.ZodString;
+      }, _$zod_v4_core0.$strip>;
+    } | undefined;
+    use?: _$_aura_stack_router0.MiddlewareFunction<"/callback/:oauth", {
+      params: _$zod.ZodObject<{
+        oauth: _$zod.ZodEnum<{
+          [x: string & Record<never, never>]: string & Record<never, never>;
+          github: "github";
+          bitbucket: "bitbucket";
+          figma: "figma";
+          discord: "discord";
+          gitlab: "gitlab";
+          spotify: "spotify";
+          x: "x";
+          strava: "strava";
+          mailchimp: "mailchimp";
+          pinterest: "pinterest";
+          twitch: "twitch";
+          notion: "notion";
+          dropbox: "dropbox";
+          atlassian: "atlassian";
+          clickUp: "clickUp";
+          dribbble: "dribbble";
+        }>;
+      }, _$zod_v4_core0.$strip>;
+      searchParams: _$zod.ZodObject<{
+        code: _$zod.ZodString;
+        state: _$zod.ZodString;
+      }, _$zod_v4_core0.$strip>;
+    }>[] | undefined;
+  }, (ctx: {
+    params: {
+      oauth: "github" | "bitbucket" | "figma" | "discord" | "gitlab" | "spotify" | "x" | "strava" | "mailchimp" | "pinterest" | "twitch" | "notion" | "dropbox" | "atlassian" | "clickUp" | "dribbble" | (string & Record<never, never>);
+    };
+    body: undefined;
+    searchParams: {
+      code: string;
+      state: string;
+    };
+    headers: _$_aura_stack_router0.HeadersBuilder;
+    request: Request;
+    url: URL;
+    method: "GET";
+    route: "/callback/:oauth";
+    context: _$_aura_stack_router0.GlobalContext;
+    json: <T>(data: T, init?: ResponseInit) => _$_aura_stack_router0.JsonResponse<T>;
+  }) => Promise<Response>>, _$_aura_stack_router0.RouteEndpoint<"GET", "/session", {
+    schemas?: _$_aura_stack_router0.EndpointSchemas | undefined;
+    use?: _$_aura_stack_router0.MiddlewareFunction<"/session", _$_aura_stack_router0.EndpointSchemas>[] | undefined;
+  }, (ctx: {
+    params: {};
+    body: undefined;
+    searchParams: URLSearchParams;
+    headers: _$_aura_stack_router0.HeadersBuilder;
+    request: Request;
+    url: URL;
+    method: "GET";
+    route: "/session";
+    context: _$_aura_stack_router0.GlobalContext;
+    json: <T>(data: T, init?: ResponseInit) => _$_aura_stack_router0.JsonResponse<T>;
+  }) => Promise<Prettify$1<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: true;
+      session: Session<{
+        sub: string;
+        name?: string | null | undefined;
+        image?: string | null | undefined;
+        email?: string | null | undefined;
+      }>;
+    }>;
+  }> | Prettify$1<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: false;
+      session: null;
+    }>;
+  }>>>, _$_aura_stack_router0.RouteEndpoint<"POST", `/${string}`, {
+    schemas?: {
+      searchParams: _$zod.ZodObject<{
+        token_type_hint: _$zod.ZodLiteral<"session_token">;
+        redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
+      }, _$zod_v4_core0.$strip>;
+    } | undefined;
+    use?: _$_aura_stack_router0.MiddlewareFunction<`/${string}`, {
+      searchParams: _$zod.ZodObject<{
+        token_type_hint: _$zod.ZodLiteral<"session_token">;
+        redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
+      }, _$zod_v4_core0.$strip>;
+    }>[] | undefined;
+  }, (ctx: {
+    params: {};
+    body: undefined;
+    searchParams: {
+      token_type_hint: "session_token";
+      redirectTo?: string | undefined;
+    };
+    headers: _$_aura_stack_router0.HeadersBuilder;
+    request: Request;
+    url: URL;
+    method: "POST";
+    route: `/${string}`;
+    context: _$_aura_stack_router0.GlobalContext;
+    json: <T>(data: T, init?: ResponseInit) => _$_aura_stack_router0.JsonResponse<T>;
+  }) => Promise<Prettify$1<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: true;
+      redirect: boolean;
+      redirectURL: string;
+    }>;
+  }> | Prettify$1<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: false;
+      redirect: boolean;
+      redirectURL: null;
+    }>;
+  }>>>, _$_aura_stack_router0.RouteEndpoint<"GET", "/csrfToken", {
+    schemas?: _$_aura_stack_router0.EndpointSchemas | undefined;
+    use?: _$_aura_stack_router0.MiddlewareFunction<"/csrfToken", _$_aura_stack_router0.EndpointSchemas>[] | undefined;
+  }, (ctx: {
+    params: {};
+    body: undefined;
+    searchParams: URLSearchParams;
+    headers: _$_aura_stack_router0.HeadersBuilder;
+    request: Request;
+    url: URL;
+    method: "GET";
+    route: "/csrfToken";
+    context: _$_aura_stack_router0.GlobalContext;
+    json: <T>(data: T, init?: ResponseInit) => _$_aura_stack_router0.JsonResponse<T>;
+  }) => Promise<Response>>, _$_aura_stack_router0.RouteEndpoint<"PATCH", `/${string}`, {
+    schemas?: {
+      body: any;
+    } | undefined;
+    use?: _$_aura_stack_router0.MiddlewareFunction<`/${string}`, {
+      body: any;
+    }>[] | undefined;
+  }, (ctx: {
+    params: {};
+    body: any;
+    searchParams: URLSearchParams;
+    headers: _$_aura_stack_router0.HeadersBuilder;
+    request: Request;
+    url: URL;
+    method: "PATCH";
+    route: `/${string}`;
+    context: _$_aura_stack_router0.GlobalContext;
+    json: <T>(data: T, init?: ResponseInit) => _$_aura_stack_router0.JsonResponse<T>;
+  }) => Promise<Prettify$1<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: true;
+      session: Session<{
+        sub: string;
+        name?: string | null | undefined;
+        image?: string | null | undefined;
+        email?: string | null | undefined;
+      }>;
+      redirectURL: string;
+    }>;
+  }> | Prettify$1<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: false;
+      session: null;
+      redirectURL: null;
+    }>;
+  }>>>]>;
+  jose: any;
+  api: {
+    getSession: (options: GetSessionAPIOptions) => Promise<GetSessionAPIReturn<{
+      sub: string;
+      name?: string | null | undefined;
+      image?: string | null | undefined;
+      email?: string | null | undefined;
+    }>>;
+    signIn: (oauth: LiteralUnion<BuiltInOAuthProvider>, options?: SignInAPIOptions) => Promise<SignInAPIReturn>;
+    signInCredentials: (options: SignInCredentialsAPIOptions) => Promise<SignInCredentialsAPIReturn>;
+    updateSession: (options: UpdateSessionAPIOptions<{
+      sub: string;
+      name?: string | null | undefined;
+      image?: string | null | undefined;
+      email?: string | null | undefined;
+    }>) => Promise<UpdateSessionAPIReturn<{
+      sub: string;
+      name?: string | null | undefined;
+      image?: string | null | undefined;
+      email?: string | null | undefined;
+    }>>;
+    signOut: (options: SignOutAPIOptions) => Promise<SignOutAPIReturn>;
+  };
+};
+/**
+ * Creates the authentication instance with the configuration provided for OAuth provider.
+ * > NOTE: The handlers returned by this function should be used in the server to handle the authentication routes
+ * and within the `/auth` base path
+ *
+ * @param authConfig - Authentication configuration including OAuth provider
+ * @returns Authentication instance with handlers to be used in the server
+ * @example
+ * const auth = createAuth({
+ *   oauth: ["github", {
+ *     id: "custom-oauth",
+ *     name: "custom-oauth",
+ *     authorize: {
+ *       url: "https://custom-oauth.com/oauth/authorize",
+ *       params: { responseType: "code", scope: "profile email" },
+ *     },
+ *     accessToken: "https://custom-oauth.com/oauth/token",
+ *     userInfo: "https://custom-oauth.com/api/userinfo",
+ *     clientId: process.env.AURA_AUTH_CUSTOM_OAUTH_CLIENT_ID!,
+ *     clientSecret: process.env.AURA_AUTH_CUSTOM_OAUTH_CLIENT_SECRET!,
+ *   }]
+ * })
+ */
+declare const createAuth: <Identity extends Identities = EditableShape<UserShape>>(config: AuthConfig<Identity>) => AuthInstance<FromShapeToObject<Identity>>;
+//#endregion
+//#region src/@types/errors.d.ts
+/** Map of field or logical keys to API validation error payloads (code + message). */
+type APIErrorMap = Record<string, {
+  code: string;
+  message: string;
+}>;
+/**
+ * Base OAuth error response structure.
+ */
+interface OAuthError<T extends string> {
+  error: T;
+  error_description?: string;
+}
+/**
+ * OAuth 2.0 Authorization Error Response Types
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1
+ */
+type AuthorizationError = OAuthError<z.infer<typeof OAuthAuthorizationErrorResponse>["error"]>;
+/**
+ * OAuth 2.0 Access Token Error Response Types
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+ */
+type AccessTokenError = OAuthError<z.infer<typeof OAuthAccessTokenErrorResponse>["error"]>;
+/**
+ * OAuth 2.0 Token Revocation Error Response Types
+ * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.2.1
+ */
+type TokenRevocationError = OAuthError<"invalid_session_token">;
+/** Union of all OAuth-related `error` string values exposed by this package. */
+type ErrorType = AuthorizationError["error"] | AccessTokenError["error"] | TokenRevocationError["error"];
+/**
+ * Machine-readable codes for internal auth failures (configuration, crypto, environment, etc.).
+ * Used with {@link AuthInternalError} and logging.
+ */
+type AuthInternalErrorCode = "INVALID_OAUTH_CONFIGURATION" | "INVALID_JWT_TOKEN" | "JOSE_INITIALIZATION_FAILED" | "SESSION_STORE_NOT_INITIALIZED" | "COOKIE_STORE_NOT_INITIALIZED" | "COOKIE_PARSING_FAILED" | "COOKIE_NOT_FOUND" | "INVALID_ENVIRONMENT_CONFIGURATION" | "INVALID_URL" | "INVALID_SALT_SECRET_VALUE" | "UNTRUSTED_ORIGIN" | "INVALID_OAUTH_PROVIDER_CONFIGURATION" | "DUPLICATED_OAUTH_PROVIDER_ID" | "CREDENTIALS_PROVIDER_NOT_CONFIGURED" | "IDENTITY_VALIDATION_FAILED";
+/**
+ * Machine-readable codes for security-sensitive failures (CSRF, session, open redirect, OAuth state).
+ */
+type AuthSecurityErrorCode = "INVALID_STATE" | "MISMATCHING_STATE" | "POTENTIAL_OPEN_REDIRECT_ATTACK_DETECTED" | "CSRF_TOKEN_INVALID" | "CSRF_TOKEN_MISSING" | "SESSION_TOKEN_MISSING";
+//#endregion
+//#region src/@types/api.d.ts
+/**
+ * Canonical return shape for server/programmatic API functions.
+ *
+ * - Success branch includes the payload fields from `Body` plus response metadata.
+ * - Failure branch includes `error` metadata and `toResponse()` for framework adapters.
+ * - Both branches expose `headers` so callers can forward cookies and auth-related headers.
+ *
+ * @typeParam Body - Union of success/failure payload variants.
+ * @typeParam ErrorCodes - Error code union for the failure branch (`error.code`).
+ */
+type AuthActionAPIReturn<Body extends object, ErrorCodes = any> = (Extract<Body, {
+  success: true;
+}> & {
+  headers: Headers;
+  toResponse: () => AuthResponse<Exclude<Body, {
+    success: false;
+  }>>;
+}) | (Extract<Body, {
+  success: false;
+}> & {
+  success: false;
+  headers: Headers; /** @todo: Add `docs` property */
+  error: {
+    code: ErrorCodes;
+    message: string;
+  };
+  toResponse: () => AuthResponse<Exclude<Body, {
+    success: true;
+  }>>;
+});
+/**
+ * Utility to merge the internal router global context (`ctx`) with per-function options.
+ * Used by implementation-level API functions in `src/api/*`.
+ */
+type FunctionAPIContext<Options extends object> = Prettify<{
+  ctx: RouterGlobalContext;
+} & Options>;
+interface OptionsWithRedirectTo {
+  /**
+   * Optional `redirect` flag used by `createAuthClient` to control client-side navigation behavior.
+   *
+   * By default, navigation is performed with `location.assign()`.
+   * When set to `false`, the API returns `redirectURL` so the caller can handle navigation manually.
+   * @default `true`
+   * @example
+   * redirect: true
+   */
+  redirect?: boolean;
+  /**
+   * Optional destination after a successful action.
+   *
+   * Supports relative paths and absolute URLs. The value is validated against `trustedOrigins`
+   * to ensure redirects are allowed.
+   * @example
+   * redirectTo: "/dashboard"
+   * redirectTo: "https://example.com/dashboard"
+   */
+  redirectTo?: string;
+}
+interface APIOptionsWithRedirectTo {
+  /**
+   * Optional redirect strategy for server/programmatic API functions.
+   *
+   * - `true`: the generated response is a redirect response.
+   * - `false`: the API returns redirect data (`signInURL` or `redirectURL`) for custom handling.
+   *
+   * Defaults are action-specific; see each API option type.
+   * @experimental
+   */
+  redirect?: boolean;
+  /**
+   * Optional destination after a successful action.
+   *
+   * Validation includes:
+   * - same-origin checks using the URL derived from `request`/`headers` and configured base URL
+   * - `trustedOrigins` checks from auth configuration
+   * @experimental
+   * @example
+   * // with `request`
+   * const response = await api.signIn("github", {
+   *   redirectTo: "/dashboard",
+   *   request: await getRequest(),
+   * })
+   *
+   * // with `baseURL`
+   * const { api: { signIn } } = await createAuth({
+   *   oauth: ["github"],
+   *   baseURL: "https://example.com"
+   * })
+   *
+   * const response = await signIn("github", {
+   *   redirectTo: "https://example.com/dashboard",
+   * })
+   */
+  redirectTo?: string;
+}
+interface APIOptionsWithRequest extends APIOptionsWithRedirectTo {
+  /**
+   * Optional `Request` object, useful for constructing the incoming URL on the server side.
+   * This option is required when the `redirectTo` option is defined, to ensure the `redirectTo`
+   * URL is same-origin or included in the `trustedOrigins` configuration option.
+   */
+  request?: Request;
+  /**
+   * Optional `HeadersInit` object, useful for constructing the incoming URL from proxy headers
+   * such as `X-Forwarded-Host` and `X-Forwarded-Proto` when the auth instance is behind a proxy
+   * or load balancer, or when the URL is built from headers instead of the `Request` object.
+   * This option requires enabling the `trustedProxyHeaders` option in the global configuration.
+   */
+  headers?: HeadersInit;
+}
+interface APIOptionsWithSkipCSRFCheck {
+  /**
+   * Optional `skipCSRFCheck` flag to bypass the Double-Submit Cookie validation.
+   *
+   * The CSRF token is still required and validated to preserve request integrity.
+   * Use this only for trusted server-side flows.
+   * @default `false`
+   */
+  skipCSRFCheck?: boolean;
+}
+/** Options to get the current session. */
+interface GetSessionAPIOptions {
+  /** The headers containing the `session_token` cookie */
+  headers: HeadersInit;
+}
+/** Programmatic `getSession` result with session payload and `toResponse()` metadata. */
+type GetSessionAPIReturn<DefaultUser extends User = User> = AuthActionAPIReturn<{
+  success: true;
+  session: Session<DefaultUser>;
+} | {
+  success: false;
+  session: null;
+}>;
+/**
+ * Client-side options for `createAuthClient().signIn(...)`.
+ */
+interface SignInOptions extends OptionsWithRedirectTo {}
+/**
+ * Client-side `signIn` return type.
+ *
+ * - Redirect mode (`redirect: true`): returns `void` because navigation is handled by the client.
+ * - Manual mode (`redirect: false`): returns `signInURL` for caller-controlled navigation.
+ */
+type SignInReturn<Options extends SignInOptions> = Options extends {
+  redirect: false;
+} ? {
+  success: true;
+  redirect: false;
+  signInURL: string;
+} | {
+  success: false;
+  redirect: false;
+  signInURL: null;
+} : void;
+/**
+ * Server/programmatic options for `signIn` API.
+ */
+interface SignInAPIOptions extends APIOptionsWithRedirectTo, APIOptionsWithRequest {}
+/**
+ * Server/programmatic `signIn` result.
+ *
+ * Includes `signInURL` and response metadata to support both framework-managed redirects
+ * and custom response handling through `toResponse()`.
+ */
+type SignInAPIReturn = AuthActionAPIReturn<{
+  success: true;
+  redirect: boolean;
+  signInURL: string;
+} | {
+  success: false;
+  redirect: false;
+  signInURL: null;
+}>;
+interface SignInCredentialsOptions extends OptionsWithRedirectTo {
+  /**
+   * Credentials payload validated by the configured `credentials.authorize` function.
+   * @example
+   * {
+   *   username: "johndoe",
+   *   password: "1234567890"
+   * }
+   */
+  payload: CredentialsPayload;
+}
+/** Client-side credentials sign-in return type (redirect mode or manual redirect data). */
+type SignInCredentialsReturn<Options extends SignInCredentialsOptions> = Options extends {
+  redirect: false;
+} ? {
+  success: true;
+  redirectURL: string;
+} | {
+  success: false;
+  redirectURL: null;
+} : void;
+/** Server/programmatic credentials sign-in options. */
+interface SignInCredentialsAPIOptions extends APIOptionsWithRedirectTo, APIOptionsWithRequest {
+  /**
+   * Credentials payload validated by the configured `credentials.authorize` function.
+   * @example
+   * {
+   *   username: "johndoe",
+   *   password: "1234567890"
+   * }
+   */
+  payload: CredentialsPayload;
+}
+/** Programmatic credentials sign-in result with response metadata and `toResponse()`. */
+type SignInCredentialsAPIReturn = AuthActionAPIReturn<{
+  success: true;
+  redirectURL: string;
+} | {
+  success: false;
+  redirectURL: null;
+}>;
+/** Client-side sign-out options. */
+interface SignOutOptions extends OptionsWithRedirectTo {}
+/** Client-side sign-out return type (redirect mode or manual redirect data). */
+type SignOutReturn<Options extends SignOutOptions> = Options extends {
+  redirect: false;
+} ? {
+  success: true;
+  redirect: false;
+  redirectURL: string;
+} | {
+  success: false;
+  redirect: false;
+  redirectURL: null;
+} : void;
+/** Server/programmatic options for `signOut` API. */
+interface SignOutAPIOptions extends APIOptionsWithRedirectTo, APIOptionsWithSkipCSRFCheck {
+  /**
+   * Required headers used to execute sign-out.
+   * Must include `session_token` and `csrf_token` cookies for CSRF validation.
+   * @example
+   * {
+   *   Cookie: "session_token=abc123; csrf_token=def456"
+   * }
+   */
+  headers: HeadersInit;
+  /**
+   * Optional `Request` object as an alternative to manually providing `headers`.
+   */
+  request?: Request;
+}
+/** Programmatic sign-out result with redirect metadata and `toResponse()`. */
+type SignOutAPIReturn = AuthActionAPIReturn<{
+  success: true;
+  redirect: boolean;
+  redirectURL: string;
+} | {
+  success: false;
+  redirect: boolean;
+  redirectURL: null;
+}>;
+/** Client-side `updateSession` options: partial session payload plus optional redirect behavior. */
+interface UpdateSessionOptions<DefaultUser extends User = User> extends OptionsWithRedirectTo {
+  /** Partial session data to merge into the current session. */
+  session: DeepPartial<Session<DefaultUser>>;
+}
+/** Client-side `updateSession` return type. */
+type UpdateSessionReturn<Options extends UpdateSessionOptions, DefaultUser extends User = User> = Options extends {
+  redirect: false;
+} ? {
+  success: true;
+  session: Session<DefaultUser>;
+} | {
+  success: false;
+  session: null;
+} : void;
+/** Server/programmatic options for `updateSession` API. */
+interface UpdateSessionAPIOptions<DefaultUser extends User = User> extends APIOptionsWithRequest, APIOptionsWithSkipCSRFCheck {
+  /**
+   * Required headers used to execute session update.
+   * Must include `session_token` and `csrf_token` cookies for CSRF validation.
+   * @example
+   * {
+   *  Cookie: "session_token=abc123; csrf_token=def456"
+   * }
+   */
+  headers: HeadersInit;
+  /**
+   * Optional `Request` object as an alternative to manually providing `headers`.
+   */
+  request?: Request;
+  /**
+   * Partial session payload used to update the current session.
+   * @see Session
+   * @example
+   * session: {
+   *   user: {
+   *     name: "John Doe",
+   *     email: "john.doe@example.com"
+   *   }
+   * }
+   */
+  session: DeepPartial<Session<DefaultUser>>;
+}
+/** Programmatic session update result with redirect metadata and `toResponse()`. */
+type UpdateSessionAPIReturn<DefaultUser extends User = User> = AuthActionAPIReturn<{
+  success: true;
+  session: Session<DefaultUser>;
+  redirectURL: string;
+} | {
+  success: false;
+  session: null;
+  redirectURL: null;
+}>;
+//#endregion
+//#region src/@types/index.d.ts
+/**
+ * Standard JWT claims that are managed internally by the token system.
+ * These fields are typically filtered out before returning user data.
+ */
+type JWTStandardClaims = Pick<JWTPayload, "exp" | "iat" | "jti" | "nbf" | "sub" | "aud" | "iss">;
+/**
+ * JWT payload structure that includes a mandatory `token` field used to verify CSRF Tokens
+ */
+type JWTPayloadWithToken = JWTPayload & {
+  token: string;
+};
+/** Environment variables for OAuth client credentials, inferred from `OAuthEnvSchema`. */
+type OAuthEnv = z.infer<typeof OAuthEnvSchema>;
+/**
+ * HTTP route handlers exposed by the auth instance (`GET`, `POST`, `PATCH`, `ALL`) for mounting on your app router.
+ */
+type AuthClient = ReturnType<typeof createAuthInstance>["handlers"];
+/**
+ * Options for {@link createAuthClient} (browser HTTP client). Extends the router client with an optional `baseURL`
+ * when the client runs outside the browser (e.g. server-side fetch to your app origin).
+ */
+type AuthClientOptions = Prettify$1<Omit<ClientOptions, "baseURL"> & {
+  baseURL?: string;
+}>;
+//#endregion
+export { LiteralUnion as $, Nameplate as $n, JWTMode as $t, APIErrorMap as A, NotionUser as An, StandardCookie as At, AuthResponse as B, mailchimp as Bn, AsymmetricKeyPair as Bt, SignOutAPIReturn as C, DropboxProfile as Cn, JoseInstance as Ct, UpdateSessionAPIReturn as D, dropbox as Dn, SchemaRegistryContext as Dt, UpdateSessionAPIOptions as E, RootInfo as En, RouterGlobalContext as Et, ErrorType as F, twitch as Fn, OAuthProvider as Ft, EditableShapeArkType as G, XProfile as Gn, JWTConfig as Gt, DeepPartial as H, SummaryClub as Hn, CreateSessionStrategyOptions as Ht, OAuthError as I, PinterestProfile as In, OAuthProviderConfig as It, EditableShapeZod as J, SpotifyProfile as Jn, JWTEncryptionAlgorithm as Jt, EditableShapeTypebox as K, x as Kn, JWTConfigBase as Kt, TokenRevocationError as L, pinterest as Ln, OAuthProviderCredentials as Lt, AuthInternalErrorCode as M, Person as Mn, TrustedOrigin as Mt, AuthSecurityErrorCode as N, notion as Nn, TrustedProxyHeadersConfig as Nt, UpdateSessionOptions as O, Bot as On, SecureCookie as Ot, AuthorizationError as P, TwitchProfile as Pn, AuthorizeParams as Pt, InferZodShape as Q, DiscordProfile as Qn, JWTManager as Qt, createAuth as R, Login as Rn, OAuthProviderRecord as Rt, SignOutAPIOptions as S, AccountType as Sn, InternalLogger as St, SignOutReturn as T, Name as Tn, Logger as Tt, DeepRequired as U, SummaryGear as Un, CryptoSecret as Ut, ConfigSchema as V, StravaProfile as Vn, AsymmetricKeyPairFromEnv as Vt, EditableShape as W, strava as Wn, GetStatelessSessionReturn as Wt, InferSession as X, GitLabProfile as Xn, JWTKey as Xt, FromShapeToObject as Y, spotify as Yn, JWTExpirationStrategy as Yt, InferUser as Z, gitlab as Zn, JWTKeyAlgorithm as Zt, SignInCredentialsAPIReturn as _, ClickUpProfile as _n, UserShape as _r, CredentialsProvider as _t, OAuthEnv as a, Session as an, GitHubProfile as ar, ValibotShapeToObject as at, SignInOptions as b, ExtendedProfile as bn, UserShapeValibot as br, IdentityConfig as bt, APIOptionsWithRequest as c, StatelessStrategyConfig as cn, Identities as cr, AuthAPI as ct, GetSessionAPIOptions as d, builtInOAuthProviders as dn, IsZod as dr, AuthRuntimeConfig as dt, JWTSealedMode as en, discord as er, Merge as et, GetSessionAPIReturn as f, createBuiltInOAuthProviders as fn, SchemaTypes as fr, CookieConfig as ft, SignInCredentialsAPIOptions as g, dribbble as gn, UserIdentityValibot as gr, CredentialsPayload as gt, SignInAPIReturn as h, DribbbleTeams as hn, UserIdentityTypeBox as hr, CookieStrategyAttributes as ht, JWTStandardClaims as i, SecretKey as in, bitbucket as ir, UserFrom as it, AccessTokenError as j, Owner as jn, SyslogOptions as jt, UpdateSessionReturn as k, NotionProfile as kn, Severity as kt, APIOptionsWithSkipCSRFCheck as l, User as ln, IsArkType as lr, AuthConfig as lt, SignInAPIOptions as m, DribbbleProfile as mn, UserIdentityArkType as mr, CookieStoreConfig as mt, AuthClientOptions as n, JWTSigningAlgorithm as nn, figma as nr, SessionFrom as nt, TypedJWTPayload$1 as o, SessionConfig as on, github as or, Wrap as ot, OptionsWithRedirectTo as p, DribbbleDefault as pn, UserIdentity as pr, CookieName as pt, EditableShapeValibot as q, SpotifyImage as qn, JWTEncryptedMode as qt, JWTPayloadWithToken as r, JWTStrategyOptions as rn, BitbucketProfile as rr, TypeboxShapeToObject as rt, APIOptionsWithRedirectTo as s, SessionStrategy as sn, createSyslogMessage as sr, ZodShapeToObject as st, AuthClient as t, JWTSignedMode as tn, FigmaProfile as tr, Prettify$1 as tt, FunctionAPIContext as u, BuiltInOAuthProvider as un, IsValibot as ur, AuthInstance as ut, SignInCredentialsOptions as v, clickUp as vn, UserShapeArkType as vr, CredentialsProviderContext as vt, SignOutOptions as w, FullTeam as wn, LogLevel as wt, SignInReturn as x, atlassian as xn, createIdentity as xr, InternalContext as xt, SignInCredentialsReturn as y, AtlassianProfile as yn, UserShapeTypeBox as yr, HostCookie as yt, ArktypeShapeToObject as z, MailchimpProfile as zn, ResponseType as zt };