@aura-stack/auth 0.6.0 → 0.7.0

package/dist/{index-BkpwQ0l4.d.cts → index-C9U6ICDT.d.ts}

@@ -1,11 +1,17 @@
-import { ZodObject, ZodRawShape, ZodTypeAny, z } from "zod/v4";
-import { JWTPayload } from "@aura-stack/jose/jose";
-import { DecodeJWTOptions, EncodeJWTOptions, JWEHeaderParameters, JWTDecryptOptions, JWTHeaderParameters, JWTVerifyOptions, Prettify, TypedJWTPayload, TypedJWTPayload as TypedJWTPayload$1 } from "@aura-stack/jose";
 import * as _$_aura_stack_router0 from "@aura-stack/router";
 import { ClientOptions, GlobalContext } from "@aura-stack/router";
+import { ZodObject, ZodRawShape, ZodTypeAny, infer as __Infer, z } from "zod/v4";
+import { JWK, JWTPayload } from "@aura-stack/jose/jose";
+import { DecodeJWTOptions, EncodeJWTOptions, JWEHeaderParameters, JWTDecryptOptions, JWTHeaderParameters, JWTVerifyOptions, Prettify, TypedJWTPayload, TypedJWTPayload as TypedJWTPayload$1 } from "@aura-stack/jose";
 import { SerializeOptions } from "@aura-stack/router/cookie";
-import * as _$zod from "zod";
+import * as valibot from "valibot";
+import { AnySchema, BaseSchema, InferOutput, ObjectEntries, ObjectSchema } from "valibot";
+import { Type } from "arktype";
+import { Static, TObject, TProperties, TSchema, Type as Type$1 } from "typebox";
+import * as _$arktype_internal_variants_object_ts0 from "arktype/internal/variants/object.ts";
 import * as _$zod_v4_core0 from "zod/v4/core";
+import { infer as infer$1 } from "zod/v4/core";
+import * as _$zod from "zod";
 
 //#region src/schemas.d.ts
 /**
@@ -72,17 +78,6 @@ declare const createJoseInstance: <DefaultUser extends User = User>(secret?: JWT
   decodeJWT: (token: string, options?: DecodeJWTOptions) => Promise<TypedJWTPayload<DefaultUser>>;
 };
 //#endregion
-//#region src/shared/identity.d.ts
-declare const UserIdentity: z.ZodObject<{
-  sub: z.ZodString;
-  name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-  image: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-  email: z.ZodOptional<z.ZodNullable<z.ZodEmail>>;
-}, z.core.$strip>;
-type UserShape = (typeof UserIdentity)["shape"];
-type UserIdentityType = z.infer<typeof UserIdentity>;
-declare const createIdentity: <S extends EditableShape<UserShape>>(shape: S) => z.ZodObject<{ -readonly [P in keyof S]: S[P] }, z.core.$strip>;
-//#endregion
 //#region src/api/createApi.d.ts
 declare const createAuthAPI: <DefaultUser extends User = User>(ctx: GlobalContext) => {
   /**
@@ -165,6 +160,43 @@ declare const createAuthAPI: <DefaultUser extends User = User>(ctx: GlobalContex
   signOut: (options: SignOutAPIOptions) => Promise<SignOutAPIReturn>;
 };
 //#endregion
+//#region src/shared/identity.d.ts
+declare const UserIdentity: z.ZodObject<{
+  sub: z.ZodString;
+  name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  image: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  email: z.ZodOptional<z.ZodNullable<z.ZodEmail>>;
+}, z.core.$strip>;
+declare const UserIdentityValibot: valibot.ObjectSchema<{
+  readonly sub: valibot.StringSchema<undefined>;
+  readonly name: valibot.OptionalSchema<valibot.NullableSchema<valibot.StringSchema<undefined>, undefined>, undefined>;
+  readonly image: valibot.OptionalSchema<valibot.NullableSchema<valibot.StringSchema<undefined>, undefined>, undefined>;
+  readonly email: valibot.OptionalSchema<valibot.NullableSchema<valibot.SchemaWithPipe<readonly [valibot.StringSchema<undefined>, valibot.EmailAction<string, undefined>]>, undefined>, undefined>;
+}, undefined>;
+declare const UserIdentityArkType: _$arktype_internal_variants_object_ts0.ObjectType<{
+  sub: string;
+  name?: string | null | undefined;
+  image?: string | null | undefined;
+  email?: string | null | undefined;
+}, {}>;
+declare const UserIdentityTypeBox: Type$1.TObject<{
+  sub: Type$1.TString;
+  name: Type$1.TOptional<Type$1.TUnion<[Type$1.TString, Type$1.TNull]>>;
+  image: Type$1.TOptional<Type$1.TUnion<[Type$1.TString, Type$1.TNull]>>;
+  email: Type$1.TOptional<Type$1.TUnion<[Type$1.TString, Type$1.TNull]>>;
+}>;
+type UserShape = typeof UserIdentity.shape;
+type UserShapeValibot = typeof UserIdentityValibot.entries;
+type UserShapeArkType = typeof UserIdentityArkType;
+type UserShapeTypeBox = typeof UserIdentityTypeBox.properties;
+type IsArkType<T extends Identities> = T extends EditableShapeArkType<UserShapeArkType> ? true : false;
+type IsZod<T extends Identities> = T extends EditableShape<UserShape> ? true : false;
+type IsValibot<T extends Identities> = T extends EditableShapeValibot<UserShapeValibot> ? true : false;
+type SchemaTypes = ZodObject<any> | valibot.ObjectSchema<any, undefined> | Type<{}> | Type$1.TObject;
+type Identities = EditableShape<UserShape> | EditableShapeValibot<UserShapeValibot> | EditableShapeArkType<UserShapeArkType> | EditableShapeTypebox<UserShapeTypeBox>;
+type ReturnShapeType<T> = T extends EditableShape<UserShape> ? z.ZodObject<T> : T extends EditableShapeValibot<UserShapeValibot> ? valibot.ObjectSchema<T, undefined> : T extends EditableShapeArkType<UserShapeArkType> ? T : T extends EditableShapeTypebox<UserShapeTypeBox> ? Type$1.TObject<T> : never;
+declare const createIdentity: <S extends Identities>(shape: S) => ReturnShapeType<S>;
+//#endregion
 //#region src/shared/logger.d.ts
 /**
  * Log message definitions organized by category.
@@ -475,6 +507,16 @@ declare const logMessages: {
 declare const createLogEntry: <T extends keyof typeof logMessages>(key: T, overrides?: Partial<SyslogOptions>) => SyslogOptions;
 declare const createSyslogMessage: (options: SyslogOptions) => string;
 //#endregion
+//#region src/validator/registry.d.ts
+declare const createSchemaRegistry: <Identity extends SchemaTypes>(config: IdentityConfig<Identity>) => {
+  parse: (data?: unknown) => Promise<any>;
+  parseAsPartial: (data?: unknown) => Promise<any>;
+  parseWithJWT: (data?: unknown) => Promise<any>;
+  schema: any;
+  schemaAsPartial: any;
+  schemaWithJWT: any;
+};
+//#endregion
 //#region src/oauth/github.d.ts
 /**
  * @see [Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user)
@@ -1044,6 +1086,73 @@ interface AtlassianProfile {
  */
 declare const atlassian: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<AtlassianProfile, DefaultUser>>) => OAuthProviderCredentials<AtlassianProfile, DefaultUser>;
 //#endregion
+//#region src/oauth/click-up.d.ts
+/**
+ * @see [Click Up - Get Authorized User](https://developer.clickup.com/reference/getauthorizeduser)
+ */
+interface ClickUpProfile {
+  user: {
+    id: number;
+    username: string;
+    email: string;
+    color: string;
+    profilePicture: string;
+    initials: string;
+    week_start_day: number;
+    global_font_support: boolean;
+    timezone: string;
+  };
+}
+/**
+ * ClickUp OAuth Provider
+ *
+ * @see [Click Up - Create your own app](https://help.clickup.com/hc/en-us/articles/6303422883095-Create-your-own-app-with-the-ClickUp-API)
+ * @see [Click Up - Authentication](https://developer.clickup.com/docs/authentication)
+ * @see [Click UP - Get Access Token](https://developer.clickup.com/reference/getaccesstoken)
+ * @see [Click Up - Get Authorized User](https://developer.clickup.com/reference/getauthorizeduser)
+ */
+declare const clickUp: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<ClickUpProfile, DefaultUser>>) => OAuthProviderCredentials<ClickUpProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/dribbble.d.ts
+/**
+ * @see [Dribble - User](https://developer.dribbble.com/v2/user/)
+ */
+interface DribbbleDefault {
+  id: number;
+  name: string;
+  login: string;
+  html_url: string;
+  avatar_url: string;
+  bio: string;
+  location: string;
+  links?: {
+    web?: string;
+    twitter?: string;
+  };
+  created_at: string;
+}
+interface DribbbleTeams extends DribbbleDefault {
+  type: "Team";
+  updated_at: string;
+}
+interface DribbbleProfile extends DribbbleDefault {
+  type: "User";
+  /** Not documented but available in the API response */
+  email: string | null;
+  can_upload_shot: boolean;
+  pro: boolean;
+  followers_count: number;
+  teams: DribbbleTeams[];
+}
+/**
+ * Dribbble OAuth provider
+ *
+ * @see [Dribbble - Register Application](https://dribbble.com/account/applications/new)
+ * @see [Dribbble - OAuth](https://developer.dribbble.com/v2/oauth/)
+ * @see [Dribbble - User](https://developer.dribbble.com/v2/user/)
+ */
+declare const dribbble: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<DribbbleProfile, DefaultUser>>) => OAuthProviderCredentials<DribbbleProfile, DefaultUser>;
+//#endregion
 //#region src/oauth/index.d.ts
 declare const builtInOAuthProviders: {
   readonly github: <DefaultUser extends User = {
@@ -1130,6 +1239,18 @@ declare const builtInOAuthProviders: {
     image?: string | null | undefined;
     email?: string | null | undefined;
   }>(options?: Partial<OAuthProviderCredentials<AtlassianProfile, DefaultUser>>) => OAuthProviderCredentials<AtlassianProfile, DefaultUser>;
+  readonly clickUp: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<ClickUpProfile, DefaultUser>>) => OAuthProviderCredentials<ClickUpProfile, DefaultUser>;
+  readonly dribbble: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<DribbbleProfile, DefaultUser>>) => OAuthProviderCredentials<DribbbleProfile, DefaultUser>;
 };
 /**
  * Constructs OAuth provider configurations from an array of provider names or configurations.
@@ -1147,6 +1268,196 @@ declare const builtInOAuthProviders: {
 declare const createBuiltInOAuthProviders: (oauth?: (BuiltInOAuthProvider | OAuthProviderCredentials<any>)[]) => Record<LiteralUnion<BuiltInOAuthProvider>, OAuthProviderCredentials<any>>;
 type BuiltInOAuthProvider = keyof typeof builtInOAuthProviders;
 //#endregion
+//#region src/@types/session.d.ts
+/** Application user type, inferred from the configured identity schema (defaults to the built-in user shape). */
+type User = infer$1<typeof UserIdentity>;
+/**
+ * Session data returned by the session endpoint.
+ */
+interface Session<DefaultUser extends User = User> {
+  user: DefaultUser;
+  expires: string;
+}
+interface CryptoSecret {
+  sign: CryptoKey | CryptoKeyPair | JWK | JsonWebKey | AsymmetricKeyPair;
+  encrypt: CryptoKey | CryptoKeyPair | JWK | JsonWebKey | AsymmetricKeyPair;
+}
+interface AsymmetricKeyPairFromEnv {
+  publicKey: string;
+  privateKey: string;
+}
+interface AsymmetricKeyPair {
+  publicKey: CryptoKey | JWK;
+  privateKey: CryptoKey | JWK;
+}
+/**
+ * A symmetric secret or asymmetric key pair used for JWT operations.
+ *
+ * - string / Uint8Array: used as-is for HMAC (signed) or AES (encrypted)
+ * - CryptoKey: Web Crypto API key, for environments that support it
+ * - CryptoKeyPair: asymmetric signing/encryption (RS256, ES256, EdDSA, RSA-OAEP, etc.)
+ */
+type SecretKey = string | Uint8Array | CryptoKey | CryptoKeyPair | CryptoSecret | JWK | AsymmetricKeyPair;
+/**
+ * @todo: add key rotation support for "SecretKey | CryptoKeyPair | [SecretKey | CryptoKeyPair, ...(SecretKey | CryptoKeyPair)[]]"
+ */
+type JWTKey = SecretKey;
+/**
+ * - "signed"    → standard JWS (e.g. HS256, RS256, ES256).
+ * - "encrypted" → JWE only. (e.g. A256GCM with RSA-OAEP key wrapping).
+ * - "sealed"    → JWS nested inside JWE (signed then encrypted).
+ */
+type JWTMode = "signed" | "encrypted" | "sealed";
+/**
+ * Signing algorithms for "signed" and "sealed" modes.
+ * Symmetric: HS256 | HS384 | HS512
+ * Asymmetric: RS256 | RS384 | RS512 | ES256 | ES384 | ES512 | EdDSA | PS256
+ */
+type JWTSigningAlgorithm = "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "EdDSA" | "PS256";
+/**
+ * Key-wrapping algorithms for "encrypted" and "sealed" modes.
+ * Symmetric: A128KW | A192KW | A256KW | dir (direct)
+ * ECDH:      ECDH-ES | ECDH-ES+A128KW | ECDH-ES+A256KW
+ * RSA:       RSA-OAEP | RSA-OAEP-256
+ */
+type JWTKeyAlgorithm = "A128KW" | "A192KW" | "A256KW" | "dir" | "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A256KW" | "RSA-OAEP" | "RSA-OAEP-256";
+/** Content-encryption algorithms for JWE. */
+type JWTEncryptionAlgorithm = "A128CBC-HS256" | "A192CBC-HS384" | "A256CBC-HS512" | "A128GCM" | "A192GCM" | "A256GCM";
+/** Signed JWT mode configuration. */
+type JWTSignedMode = {
+  mode: "signed";
+  signingAlgorithm?: JWTSigningAlgorithm;
+};
+/** Encrypted JWT mode configuration. */
+type JWTEncryptedMode = {
+  mode: "encrypted";
+  keyAlgorithm?: JWTKeyAlgorithm;
+  encryptionAlgorithm?: JWTEncryptionAlgorithm;
+};
+/** Signed and Encrypted JWT mode configuration. */
+type JWTSealedMode = {
+  mode?: "sealed";
+  signingAlgorithm?: JWTSigningAlgorithm;
+  keyAlgorithm?: JWTKeyAlgorithm;
+  encryptionAlgorithm?: JWTEncryptionAlgorithm;
+};
+/** Discriminated union of JWT wire format: signed JWS, encrypted JWE, or nested sealed (JWS in JWE). */
+type JWTConfigBase = JWTSignedMode | JWTEncryptedMode | JWTSealedMode;
+/** How session/JWT lifetime is enforced relative to `iat`, absolute caps, and sliding windows. */
+type JWTExpirationStrategy = "fixed" | "rolling" | "absolute" | "sliding";
+type JWTConfig = Prettify$1<{
+  /**
+   * Token lifetime.
+   */
+  maxAge?: number;
+  /**
+   * JWT `iss` (issuer) claim. Set this to your app's canonical URL.
+   * @example "https://auth.example.com"
+   */
+  issuer?: string;
+  /**
+   * JWT `aud` claim. Single value or array for multi-audience tokens.
+   * @example ["https://api.example.com", "https://app.example.com"]
+   */
+  audience?: string | string[];
+  /**
+   * Maximum absolute session duration in seconds.
+   * Required for "absolute" and "sliding" strategies.
+   * Enforced via jose's maxTokenAge against the iat claim.
+   */
+  maxExpiration?: number;
+  /**
+   * Policy for renewing or capping token lifetime (pairs with `maxExpiration` where applicable).
+   */
+  expirationStrategy?: JWTExpirationStrategy;
+} & JWTConfigBase>;
+/**
+ * Stateless JWT strategy.
+ * No database required. Tokens are self-contained and cannot be revoked
+ * before they expire — keep `jwt.maxAge` short or enable refresh tokens.
+ *
+ * @example
+ * {
+ *   strategy: "jwt",
+ *   jwt: { mode: "sealed", maxAge: "15m", issuer: "https://auth.example.com" },
+ *   refreshToken: { enabled: true, maxAge: "7d" },
+ * }
+ */
+type StatelessStrategyConfig = {
+  strategy?: "jwt";
+  jwt?: JWTConfig;
+};
+/**
+ * The session strategy. Determines which fields below are required.
+ *
+ * - "jwt": stateless. No database needed. JWTs are self-contained.
+ * - "database": stateful. Every request hits the DB to validate the session.
+ * - "hybrid": JWT transport + DB revocation. Best of both for most apps.
+ *
+ * @default "jwt"
+ */
+type SessionConfig = StatelessStrategyConfig;
+/** Result of reading a stateless (JWT) session from a request: session payload and outgoing header mutations. */
+interface GetStatelessSessionReturn<DefaultUser extends User = User> {
+  session: Session<DefaultUser> | null;
+  headers: Headers;
+}
+/**
+ * Abstraction layer for session management.
+ */
+interface SessionStrategy<DefaultUser extends User = User> {
+  /**
+   * Read and validate the session from an incoming request.
+   * Returns null if absent, invalid, or expired. Never throws on auth failure.
+   */
+  getSession(request: Headers): Promise<GetStatelessSessionReturn<DefaultUser>>;
+  /**
+   * Create a session after successful authentication.
+   * Signs the JWT / writes the DB row / sets cookies.
+   */
+  createSession(session: User): Promise<string>;
+  /**
+   * Attempt to refresh using the refresh token cookie.
+   * Returns null session + cookie-clearing response on any failure.
+   */
+  refreshSession(headers: Headers, session: DeepPartial<Session<DefaultUser>>, skipCSRFCheck?: boolean): Promise<{
+    session: Session<DefaultUser> | null;
+    headers: Headers;
+  }>;
+  /**
+   * Revoke a session by ID.
+   * JWT strategy: best-effort (clears cookies, no server state).
+   * Database / hybrid: marks row inactive.
+   */
+  revokeSession(sessionId: string): Promise<void>;
+  /**
+   * Destroy the session attached to this request (logout).
+   * Returns a response that clears cookies.
+   */
+  destroySession(request: Headers, skipCSRFCheck?: boolean): Promise<Headers>;
+}
+/** Inputs for constructing a session strategy implementation for a given identity schema. */
+interface CreateSessionStrategyOptions<Identity extends Identities> {
+  config?: SessionConfig;
+  jose: JoseInstance<FromShapeToObject<Identity> & User>;
+  cookies: () => CookieStoreConfig;
+  logger?: InternalLogger;
+  identity: SchemaRegistryContext;
+}
+/** Options specialized for the JWT-backed session strategy. */
+interface JWTStrategyOptions<DefaultUser extends User = User> {
+  config?: StatelessStrategyConfig;
+  jose: JoseInstance<DefaultUser>;
+  logger?: InternalLogger;
+  cookies: () => CookieStoreConfig;
+  identity: SchemaRegistryContext;
+}
+/** Minimal token issue/verify surface used by session code paths. */
+type JWTManager<DefaultUser extends User = User> = {
+  createToken(user: TypedJWTPayload<Partial<DefaultUser>>): Promise<string>;
+  verifyToken(token: string): Promise<TypedJWTPayload<DefaultUser>>;
+};
+//#endregion
 //#region src/@types/oauth.d.ts
 /** Known query parameter names supported when building an OAuth authorization URL. */
 type AuthorizeParams = LiteralUnion<"clientId" | "prompt" | "scope" | "responseMode" | "audience" | "loginHint" | "nonce" | "display">;
@@ -1214,7 +1525,7 @@ type OAuthProviderRecord<DefaultUser extends User = User> = Record<LiteralUnion<
  * Main configuration interface for Aura Auth.
  * This is the user-facing configuration object passed to `createAuth()`.
  */
-interface AuthConfig<Identity extends EditableShape<UserShape> = EditableShape<UserShape>> {
+type AuthConfig<Identity extends Identities> = {
   /**
    * OAuth providers available in the authentication and authorization flows. It provides a type-inference
    * for the OAuth providers that are supported by Aura Stack Auth; alternatively, you can provide a custom
@@ -1245,7 +1556,7 @@ interface AuthConfig<Identity extends EditableShape<UserShape> = EditableShape<U
    * ]
    * ```
    */
-  oauth: (BuiltInOAuthProvider | OAuthProviderCredentials<any, ShapeToObject<Identity>>)[];
+  oauth: (BuiltInOAuthProvider | OAuthProviderCredentials<any, FromShapeToObject<Identity>>)[];
   /**
    * Cookie options defines the configuration for cookies used in Aura Auth.
    * It includes a prefix for cookie names and flag options to determine
@@ -1269,6 +1580,27 @@ interface AuthConfig<Identity extends EditableShape<UserShape> = EditableShape<U
    * Secret used to sign and verify JWT tokens for session and csrf protection.
    * If not provided, it will load from the environment variable `AURA_AUTH_SECRET` or `AUTH_SECRET`, but if it
    * doesn't exist, it will throw an error during the initialization of the Auth module.
+   *
+   * > It can be a string, a Uint8Array, a CryptoKey, a CryptoKeyPair, or an object containing separate keys for
+   * signing and encryption. It depends on the JWT mode and algorithms you choose in the session configuration.
+   * The default mode is "sealed" (signing + encryption), so if the secret is a string or Uint8Array, it will derive
+   * separate keys for signing and encryption using HKDF, but if you provide a CryptoKeyPair, it will required to
+   * pass separate keys for signing and encryption in the `CryptoSecret` format.
+   * @example
+   * import { createSecretValue } from "@aura-stack/auth/crypto"
+   *
+   * secret: createSecretValue(32)
+   *
+   * // For asymmetric keys, generate a key pair and pass the private
+   * import { createKeyPair } from "@aura-stack/auth/crypto"
+   *
+   * const signing = await createKeyPair("RS256", { extractable: true })
+   * const encryption = await createKeyPair("RSA-OAEP-256", { extractable: true })
+   *
+   * secret: {
+   *   sign: signing,
+   *   encrypt: encryption,
+   * }
    */
   secret?: JWTKey;
   /**
@@ -1279,45 +1611,11 @@ interface AuthConfig<Identity extends EditableShape<UserShape> = EditableShape<U
    * Base path for all authentication routes. Default is `/auth`.
    */
   basePath?: `/${string}`;
-  /**
-   * Enable trusted proxy headers for scenarios where the application is behind a reverse proxy or load balancer.
-   * This setting allows Aura Auth to correctly interpret headers like `X-Forwarded-For` and `X-Forwarded-Proto`
-   * to determine the original client IP address and protocol.
-   *
-   * Default is `false`. Enable this option only if you are certain that your application is behind a trusted proxy.
-   * Misconfiguration can lead to security vulnerabilities, such as incorrect handling of secure cookies or
-   * inaccurate client IP logging.
-   *
-   * This value can also be set via environment variable as `AURA_AUTH_TRUSTED_PROXY_HEADERS`
-   *
-   * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For
-   * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Proto
-   * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Forwarded
-   * @experimental
-   */
-  trustedProxyHeaders?: boolean;
   /**
    * Logger configuration for handling authentication-related logs and errors. It can be set to `true`,
    * `DEBUG=true`, `LOG_LEVEL=debug`, or a custom logger. It implements the syslog format.
    */
   logger?: boolean | Logger;
-  /**
-   * Defines trusted origins for your application to prevent open redirect attacks.
-   * URLs from the Referer header, Origin header, request URL, and redirectTo option
-   * are validated against this list before redirecting.
-   *
-   * - **Exact URL**: `https://example.com` matches only that origin.
-   * - **Subdomain wildcard**: `https://*.example.com` matches `https://app.example.com`, `https://api.example.com`, etc.
-   * @example
-   * trustedOrigins: ["https://example.com", "https://*.example.com", "http://localhost:3000"]
-   *
-   *
-   * trustedOrigins: async (request) => {
-   *   const origin = new URL(request.url).origin
-   *   return [origin, "https://admin.example.com"]
-   * }
-   */
-  trustedOrigins?: TrustedOrigin[] | ((request: Request) => Promise<TrustedOrigin[]> | TrustedOrigin[]);
   /**
    * Defines the session management strategy for Aura Auth. It determines how sessions are created, stored, and validated.
    */
@@ -1344,15 +1642,110 @@ interface AuthConfig<Identity extends EditableShape<UserShape> = EditableShape<U
    * }
    */
   identity?: Partial<{
+    /**
+     * Skip schema validation for session data, JWT payloads, and OAuth profiles.
+     * This can be useful for performance optimization if you are certain that the
+     * data is valid, but it can lead to security vulnerabilities if misused.
+     * > ⚠️ WARNING: Use this option with caution.
+     */
     skipValidation: boolean;
-    schema: ZodObject<Identity>;
+    /**
+     * Custom schema validation for user identity data. It supports any Zod, Arktype,
+     * Valibot or Typebox schema. Use `createIdentity` helper function to create a schema
+     * with the correct shape and inference.
+     */
+    schema: ConfigSchema<Identity>;
+    /**
+     * Defines how unknown keys are handled during schema validation. It can be set to:
+     * - `passthrough`: Unknown keys are allowed and included in the validated data.
+     * - `strict`: Unknown keys will cause validation to fail with an error.
+     * - `strip`: Unknown keys are removed from the validated data.
+     */
     unknownKeys: "passthrough" | "strict" | "strip";
   }>;
   /**
    * Credentials provider for username/password or similar authentication.
    */
   credentials?: CredentialsProvider<Identity>;
-}
+} & TrustedProxyHeadersConfig;
+type TrustedProxyHeadersConfig = {
+  /**
+   * Enable trusted proxy headers for scenarios where the application is behind a reverse proxy or load balancer.
+   * This setting allows Aura Auth to correctly interpret headers like `X-Forwarded-For` and `X-Forwarded-Proto`
+   * to determine the original client IP address and protocol.
+   *
+   * Default is `false`. Enable this option only if you are certain that your application is behind a trusted proxy.
+   * Misconfiguration can lead to security vulnerabilities, such as incorrect handling of secure cookies or
+   * inaccurate client IP logging.
+   *
+   * This value can also be set via environment variable as `AURA_AUTH_TRUSTED_PROXY_HEADERS`
+   *
+   * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For
+   * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Proto
+   * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Forwarded
+   * @experimental
+   */
+  trustedProxyHeaders: true;
+  /**
+   * Defines trusted origins for your application to prevent open redirect attacks.
+   * URLs from the Referer header, Origin header, request URL, and redirectTo option
+   * are validated against this list before redirecting.
+   *
+   * - **Exact URL**: `https://example.com` matches only that origin.
+   * - **Subdomain wildcard**: `https://*.example.com` matches `https://app.example.com`, `https://api.example.com`, etc.
+   *
+   * > **⚠️ WARNING:** Ensure that the trusted origins are configured correctly to prevent open redirect vulnerabilities.
+   * Only include origins that you control and trust.
+   *
+   * @example
+   * trustedOrigins: ["https://example.com", "https://*.example.com", "http://localhost:3000"]
+   *
+   * trustedOrigins: async (request) => {
+   *   const origin = new URL(request.url).origin
+   *   return [origin, "https://admin.example.com"]
+   * }
+   */
+  trustedOrigins: TrustedOrigin[] | ((request: Request) => Promise<TrustedOrigin[]> | TrustedOrigin[]);
+} | {
+  /**
+   * Enable trusted proxy headers for scenarios where the application is behind a reverse proxy or load balancer.
+   * This setting allows Aura Auth to correctly interpret headers like `X-Forwarded-For` and `X-Forwarded-Proto`
+   * to determine the original client IP address and protocol.
+   *
+   * Default is `false`. Enable this option only if you are certain that your application is behind a trusted proxy.
+   * Misconfiguration can lead to security vulnerabilities, such as incorrect handling of secure cookies or
+   * inaccurate client IP logging.
+   *
+   * This value can also be set via environment variable as `AURA_AUTH_TRUSTED_PROXY_HEADERS`
+   *
+   * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For
+   * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Proto
+   * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Forwarded
+   * @experimental
+   */
+  trustedProxyHeaders?: false;
+  /**
+   * Defines trusted origins for your application to prevent open redirect attacks.
+   * URLs from the Referer header, Origin header, request URL, and redirectTo option
+   * are validated against this list before redirecting.
+   *
+   * - **Exact URL**: `https://example.com` matches only that origin.
+   * - **Subdomain wildcard**: `https://*.example.com` matches `https://app.example.com`, `https://api.example.com`, etc.
+   *
+   * > **⚠️ WARNING:** Ensure that the trusted origins are configured correctly to prevent open redirect vulnerabilities.
+   * Only include origins that you control and trust.
+   *
+   * @example
+   * trustedOrigins: ["https://example.com", "https://*.example.com", "http://localhost:3000"]
+   *
+   * trustedOrigins: async (request) => {
+   *   const origin = new URL(request.url).origin
+   *   return [origin, "https://admin.example.com"]
+   * }
+   *
+   */
+  trustedOrigins?: TrustedOrigin[] | ((request: Request) => Promise<TrustedOrigin[]> | TrustedOrigin[]);
+};
 /**
  * Cookie type with __Secure- prefix, must be Secure.
  * @see https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html#name-the-__secure-prefix
@@ -1386,10 +1779,9 @@ type CookieStrategyAttributes = StandardCookie | SecureCookie | HostCookie;
  * - `sessionToken`: User session JWT
  * - `csrfToken`: CSRF protection token
  * - `state`: OAuth state parameter for CSRF protection
- * - `code_verifier`: PKCE code verifier for authorization code flow
- * - `redirect_uri`: OAuth callback URI
- * - `redirect_to`: Post-authentication redirect path
- * - `nonce`: OpenID Connect nonce parameter
+ * - `codeVerifier`: PKCE code verifier for authorization code flow
+ * - `redirectURI`: OAuth callback URI
+ * - `redirectTo`: Post-authentication redirect path
  */
 type CookieName = "sessionToken" | "csrfToken" | "state" | "codeVerifier" | "redirectTo" | "redirectURI";
 /** Resolved cookie names and serialization attributes for each logical auth cookie. */
@@ -1402,6 +1794,10 @@ interface CookieConfig {
    * Prefix to be added to all cookie names. By default "aura-stack".
    */
   prefix?: string;
+  /**
+   * Overrides for individual cookie configurations.
+   * @see {@link CookieStoreConfig} for the structure of each cookie configuration.
+   */
   overrides?: Partial<CookieStoreConfig>;
 }
 /**
@@ -1454,8 +1850,9 @@ interface InternalLogger {
  * Identity validation settings used when building session strategy and OAuth profile mapping.
  * Controls the Zod schema and how unknown keys are handled on user objects.
  */
-interface IdentityConfig<Schema extends ZodObject<any> = typeof UserIdentity> {
+interface IdentityConfig<Schema extends SchemaTypes = typeof UserIdentity> {
   schema?: Schema;
+  schemaAsPartial?: Schema;
   skipValidation?: boolean;
   unknownKeys?: "passthrough" | "strict" | "strip";
 }
@@ -1485,14 +1882,14 @@ interface CredentialsProviderContext<T> {
 /**
  * Interface for the credentials provider.
  */
-interface CredentialsProvider<Identity extends EditableShape<UserShape> = EditableShape<UserShape>> {
+interface CredentialsProvider<Identity extends Identities> {
   hash?: (password: string, salt?: string, iterations?: number) => Promise<string>;
   verify?: (password: string, hashedPassword: string) => Promise<boolean>;
   /**
    * Authenticates a user using credentials.
    * Must return a User object or the identity type if the identity schema is provided.
    */
-  authorize: (ctx: CredentialsProviderContext<CredentialsPayload>) => Promise<ShapeToObject<Identity> | null> | ShapeToObject<Identity> | null;
+  authorize: (ctx: CredentialsProviderContext<CredentialsPayload>) => Promise<FromShapeToObject<Identity> | null> | FromShapeToObject<Identity> | null;
 }
 /**
  * Runtime context passed into auth actions and API handlers: OAuth map, cookies, JWT, session strategy, trusted origins, etc.
@@ -1510,11 +1907,12 @@ interface RouterGlobalContext<DefaultUser extends User = User> {
   trustedOrigins?: TrustedOrigin[] | ((request: Request) => Promise<TrustedOrigin[]> | TrustedOrigin[]);
   logger?: InternalLogger;
   sessionStrategy: SessionStrategy<DefaultUser>;
-  identity: {
-    unknownKeys: "passthrough" | "strict" | "strip";
-    schema: ZodObject<any>;
-    skipValidation?: boolean;
-  };
+  identity: SchemaRegistryContext;
+}
+interface SchemaRegistryContext {
+  schemaRegistry: ReturnType<typeof createSchemaRegistry>;
+  skipValidation?: boolean;
+  unknownKeys: "passthrough" | "strict" | "strip";
 }
 /**
  * Internal runtime configuration used within Aura Auth after initialization.
@@ -1525,8 +1923,17 @@ type AuthRuntimeConfig<DefaultUser extends User = User> = RouterGlobalContext<De
  * Public auth instance: programmatic {@link AuthAPI}, {@link JoseInstance}, and HTTP {@link AuthClient} handlers.
  */
 interface AuthInstance<DefaultUser extends User = User> {
+  /**
+   * Programmatic API for authentication actions (getSession, signIn, signOut, etc.) that can be used in server-side contexts or API routes.
+   */
   api: AuthAPI<DefaultUser>;
+  /**
+   * JOSE helper functions for signin, encryption and verification of JWTs.
+   */
   jose: JoseInstance<DefaultUser>;
+  /**
+   * HTTP handlers for mounting on a router or server.
+   */
   handlers: {
     GET: (request: Request) => Response | Promise<Response>;
     POST: (request: Request) => Response | Promise<Response>;
@@ -1537,196 +1944,13 @@ interface AuthInstance<DefaultUser extends User = User> {
 /**
  * Extended context used inside the library with both secure and standard cookie materializations.
  */
-type InternalContext<Identity extends EditableShape<UserShape>> = RouterGlobalContext<ShapeToObject<Identity> & User> & {
+type InternalContext<Identity extends Identities> = RouterGlobalContext<FromShapeToObject<Identity> & User> & {
   cookieConfig: {
     secure: CookieStoreConfig;
     standard: CookieStoreConfig;
   };
 };
 //#endregion
-//#region src/@types/session.d.ts
-/** Application user type, inferred from the configured identity schema (defaults to the built-in user shape). */
-type User = UserIdentityType;
-/**
- * Session data returned by the session endpoint.
- */
-interface Session<DefaultUser extends User = User> {
-  user: DefaultUser;
-  expires: string;
-}
-/**
- * A symmetric secret or asymmetric key pair used for JWT operations.
- *
- * - string / Uint8Array: used as-is for HMAC (signed) or AES (encrypted)
- * - CryptoKey: Web Crypto API key, for environments that support it
- * - KeyPair: asymmetric signing (RS256, ES256, EdDSA, etc.)
- */
-type SecretKey = string | Uint8Array | CryptoKey;
-/** Asymmetric key pair for signing or key agreement (Web Crypto `CryptoKey` pair). */
-interface KeyPair {
-  privateKey: CryptoKey;
-  publicKey: CryptoKey;
-}
-/**
- * @todo: add key rotation support for "SecretKey | KeyPair | [SecretKey | KeyPair, ...(SecretKey | KeyPair)[]]"
- */
-type JWTKey = SecretKey;
-/**
- * - "signed"    → standard JWS (e.g. HS256, RS256, ES256).
- * - "encrypted" → JWE only. (e.g. A256GCM with RSA-OAEP key wrapping).
- * - "sealed"    → JWS nested inside JWE (signed then encrypted).
- */
-type JWTMode = "signed" | "encrypted" | "sealed";
-/**
- * Signing algorithms for "signed" and "sealed" modes.
- * Symmetric: HS256 | HS384 | HS512
- * Asymmetric: RS256 | RS384 | RS512 | ES256 | ES384 | ES512 | EdDSA | PS256
- */
-type JWTSigningAlgorithm = "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "EdDSA" | "PS256";
-/**
- * Key-wrapping algorithms for "encrypted" and "sealed" modes.
- * Symmetric: A128KW | A192KW | A256KW | dir (direct)
- * ECDH:      ECDH-ES | ECDH-ES+A128KW | ECDH-ES+A256KW
- * RSA:       RSA-OAEP | RSA-OAEP-256
- */
-type JWTKeyAlgorithm = "A128KW" | "A192KW" | "A256KW" | "dir" | "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A256KW" | "RSA-OAEP" | "RSA-OAEP-256";
-/** Content-encryption algorithms for JWE. */
-type JWTEncryptionAlgorithm = "A128CBC-HS256" | "A192CBC-HS384" | "A256CBC-HS512" | "A128GCM" | "A192GCM" | "A256GCM";
-/** Signed JWT mode configuration. */
-type JWTSignedMode = {
-  mode: "signed";
-  signingAlgorithm?: JWTSigningAlgorithm;
-};
-/** Encrypted JWT mode configuration. */
-type JWTEncryptedMode = {
-  mode: "encrypted";
-  keyAlgorithm?: JWTKeyAlgorithm;
-  encryptionAlgorithm?: JWTEncryptionAlgorithm;
-};
-/** Signed and Encrypted JWT mode configuration. */
-type JWTSealedMode = {
-  mode?: "sealed";
-  signingAlgorithm?: JWTSigningAlgorithm;
-  keyAlgorithm?: JWTKeyAlgorithm;
-  encryptionAlgorithm?: JWTEncryptionAlgorithm;
-};
-/** Discriminated union of JWT wire format: signed JWS, encrypted JWE, or nested sealed (JWS in JWE). */
-type JWTConfigBase = JWTSignedMode | JWTEncryptedMode | JWTSealedMode;
-/** How session/JWT lifetime is enforced relative to `iat`, absolute caps, and sliding windows. */
-type JWTExpirationStrategy = "fixed" | "rolling" | "absolute" | "sliding";
-type JWTConfig = {
-  /**
-   * Token lifetime.
-   */
-  maxAge?: number;
-  /**
-   * JWT `iss` (issuer) claim. Set this to your app's canonical URL.
-   * @example "https://auth.example.com"
-   */
-  issuer?: string;
-  /**
-   * JWT `aud` claim. Single value or array for multi-audience tokens.
-   * @example ["https://api.example.com", "https://app.example.com"]
-   */
-  audience?: string | string[];
-  /**
-   * Maximum absolute session duration in seconds.
-   * Required for "absolute" and "sliding" strategies.
-   * Enforced via jose's maxTokenAge against the iat claim.
-   */
-  maxExpiration?: number;
-  /**
-   * Policy for renewing or capping token lifetime (pairs with `maxExpiration` where applicable).
-   */
-  expirationStrategy?: JWTExpirationStrategy;
-} & JWTConfigBase;
-/**
- * Stateless JWT strategy.
- * No database required. Tokens are self-contained and cannot be revoked
- * before they expire — keep `jwt.maxAge` short or enable refresh tokens.
- *
- * @example
- * {
- *   strategy: "jwt",
- *   jwt: { mode: "sealed", maxAge: "15m", issuer: "https://auth.example.com" },
- *   refreshToken: { enabled: true, maxAge: "7d" },
- * }
- */
-type StatelessStrategyConfig = {
-  strategy?: "jwt";
-  jwt?: JWTConfig;
-};
-/**
- * The session strategy. Determines which fields below are required.
- *
- * - "jwt": stateless. No database needed. JWTs are self-contained.
- * - "database": stateful. Every request hits the DB to validate the session.
- * - "hybrid": JWT transport + DB revocation. Best of both for most apps.
- *
- * @default "jwt"
- */
-type SessionConfig = StatelessStrategyConfig;
-/** Result of reading a stateless (JWT) session from a request: session payload and outgoing header mutations. */
-interface GetStatelessSessionReturn<DefaultUser extends User = User> {
-  session: Session<DefaultUser> | null;
-  headers: Headers;
-}
-/**
- * Abstraction layer for session management.
- */
-interface SessionStrategy<DefaultUser extends User = User> {
-  /**
-   * Read and validate the session from an incoming request.
-   * Returns null if absent, invalid, or expired. Never throws on auth failure.
-   */
-  getSession(request: Headers): Promise<GetStatelessSessionReturn<DefaultUser>>;
-  /**
-   * Create a session after successful authentication.
-   * Signs the JWT / writes the DB row / sets cookies.
-   */
-  createSession(session: User): Promise<string>;
-  /**
-   * Attempt to refresh using the refresh token cookie.
-   * Returns null session + cookie-clearing response on any failure.
-   */
-  refreshSession(headers: Headers, session: DeepPartial<Session<DefaultUser>>, skipCSRFCheck?: boolean): Promise<{
-    session: Session<DefaultUser> | null;
-    headers: Headers;
-  }>;
-  /**
-   * Revoke a session by ID.
-   * JWT strategy: best-effort (clears cookies, no server state).
-   * Database / hybrid: marks row inactive.
-   */
-  revokeSession(sessionId: string): Promise<void>;
-  /**
-   * Destroy the session attached to this request (logout).
-   * Returns a response that clears cookies.
-   */
-  destroySession(request: Headers, skipCSRFCheck?: boolean): Promise<Headers>;
-}
-/** Inputs for constructing a session strategy implementation for a given identity schema. */
-interface CreateSessionStrategyOptions<Identity extends EditableShape<UserShape>> {
-  config?: SessionConfig;
-  jose: JoseInstance<ShapeToObject<Identity> & User>;
-  cookies: () => CookieStoreConfig;
-  logger?: InternalLogger;
-  identity: IdentityConfig;
-}
-/** Options specialized for the JWT-backed session strategy. */
-interface JWTStrategyOptions<DefaultUser extends User = User> {
-  config?: StatelessStrategyConfig;
-  jose: JoseInstance<DefaultUser>;
-  logger?: InternalLogger;
-  cookies: () => CookieStoreConfig;
-  identity: IdentityConfig;
-}
-/** Minimal token issue/verify surface used by session code paths. */
-type JWTManager<DefaultUser extends User = User> = {
-  createToken(user: TypedJWTPayload<Partial<DefaultUser>>): Promise<string>;
-  verifyToken(token: string): Promise<TypedJWTPayload<DefaultUser>>;
-};
-//#endregion
 //#region src/@types/utility.d.ts
 /** Expands intersection types into a single flat object type for readable editor hints. */
 type Prettify$1<T> = { [K in keyof T]: T[K] };
@@ -1739,23 +1963,85 @@ type LiteralUnion<T extends U, U = string> = T | (U & Record<never, never>);
  * Transforms a Zod raw shape so nested `ZodObject` fields become editable (same structure, for config authoring).
  */
 type EditableShape<T extends ZodRawShape> = { [K in keyof T]: T[K] extends ZodObject<infer Inner extends ZodRawShape> ? ZodObject<EditableShape<Inner>> : ZodTypeAny };
+type EditableShapeZod<T extends ZodRawShape> = EditableShape<T>;
+type AnyShape = Record<string, AnySchema>;
+type EditableShapeValibot<T extends ObjectEntries> = { [K in keyof T]: T[K] extends ObjectSchema<infer Inner extends AnyShape, undefined> ? ObjectSchema<EditableShapeValibot<Inner>, undefined> : BaseSchema<any, any, any> };
+type EditableShapeTypebox<T extends TProperties> = { [K in keyof T]: T[K] extends TObject ? Wrap<EditableShapeTypebox<T[K]["properties"]>> : TSchema };
+type ConfigSchema<T extends Identities> = IsZod<T> extends true ? ZodObject<T & ZodRawShape> : T extends EditableShapeValibot<UserShapeValibot> ? ObjectSchema<T & ObjectEntries, undefined> : IsArkType<T> extends true ? T : T extends EditableShapeTypebox<UserShapeTypeBox> ? TObject<T & TProperties> : never;
+type ValibotShapeToObject<S extends ObjectEntries> = Merge<InferOutput<ObjectSchema<S, undefined>>, User>;
+type ArktypeShapeToObject<S extends Type> = S extends Type<infer Shape> ? Wrap<Merge<Shape, User>> : never;
+type TypeboxShapeToObject<S extends TProperties> = S extends TProperties ? Wrap<Merge<Static<TObject<S>>, User>> : never;
+type EditableShapeArkType<T extends Type> = T extends Type<infer Shape> ? Type<{ [K in keyof Shape]: any }> : never;
 /** Merges type `B` over `A`, replacing overlapping keys with `B`. */
 type Merge<A, B> = Omit<A, keyof B> & B;
 /**
  * Infers the runtime object type from a Zod `shape` and intersects it with {@link User}
  * so identity fields always include the base user contract.
  */
-type ShapeToObject<S extends ZodRawShape = ZodRawShape> = Merge<{ [K in keyof S]: z.infer<S[K]> }, User>;
+type ZodShapeToObject<S extends ZodRawShape = ZodRawShape> = Merge<__Infer<ZodObject<S>>, User>;
+type FromShapeToObject<S> = S extends ZodRawShape ? ZodShapeToObject<S> : S extends ObjectEntries ? ValibotShapeToObject<S> : S extends Type ? ArktypeShapeToObject<S> : S extends TProperties ? TypeboxShapeToObject<S> : never;
 /** Recursively makes every property required. */
 type DeepRequired<T> = { [K in keyof T]-?: T[K] extends object ? DeepRequired<T[K]> : T[K] };
 /** Recursively makes every property optional. */
 type DeepPartial<T> = { [P in keyof T]?: T[P] extends object ? DeepPartial<T[P]> : T[P] };
-/** Resolves the user identity type from an {@link AuthInstance} config, or falls back to {@link User}. */
-type InferAuthIdentity<Config> = Config extends AuthInstance<infer Identity> ? Prettify$1<Identity> : User;
-/** Shorthand for a Zod object’s `.shape` property. */
-type InferShape<T extends ZodObject> = T["shape"];
-/** Runtime user object type inferred from a Zod identity schema. */
-type InferIdentity<T extends ZodObject> = ShapeToObject<InferShape<T>>;
+/** Wraps a type in an object with the same keys. */
+type Wrap<T> = T extends any ? { [K in keyof T]: T[K] } : never;
+/**
+ * Infers the user type from an {@link AuthInstance} config, or falls back to {@link User}.
+ * @example
+ * const auth = createAuth({
+ *   oauth: [],
+ *   identity: UserIdentity.extend({
+ *     role: z.string().nullable().optional(),
+ *     username: z.string().optional(),
+ *   })
+ * })
+ *
+ * type User = InferUser<typeof auth>
+ */
+type InferUser<Config extends AuthInstance> = Config extends AuthInstance<infer Identity> ? Prettify$1<Identity> : User;
+/**
+ * Infers the session type from an {@link AuthInstance} config.
+ * @example
+ * const auth = createAuth({
+ *   oauth: [],
+ *   identity: UserIdentity.extend({
+ *     role: z.string().nullable().optional(),
+ *     username: z.string().optional(),
+ *   })
+ * })
+ *
+ * type Session = InferSession<typeof auth>
+ */
+type InferSession<Config extends AuthInstance> = Prettify$1<Session<Wrap<InferUser<Config>>>>;
+/**
+ * Shorthand for a Zod object’s `.shape` property.
+ */
+type InferZodShape<T extends ZodObject> = T["shape"];
+/**
+ * Infers the user type from a Zod identity schema, or falls back to {@link User}.
+ * @example
+ * const schema = z.object({
+ *   sub: z.string(),
+ *   role: z.string().nullable().optional(),
+ *   username: z.string().optional(),
+ * })
+ *
+ * type User = UserFrom<typeof schema>
+ */
+type UserFrom<T extends ZodObject> = Prettify$1<ZodShapeToObject<InferZodShape<T>>>;
+/**
+ * Infers the session type from a Zod identity schema.
+ * @example
+ * const schema = z.object({
+ *   sub: z.string(),
+ *   role: z.string().nullable().optional(),
+ *   username: z.string().optional(),
+ * })
+ *
+ * type Session = SessionFrom<typeof schema>
+ */
+type SessionFrom<T extends ZodObject> = Wrap<Session<Wrap<UserFrom<T>>>>;
 /**
  * HTTP `Response` with `json()` typed to resolve to `Body` (defaults to `unknown`).
  */
@@ -1764,7 +2050,7 @@ type AuthResponse<Body = unknown> = Prettify$1<Omit<Response, "json"> & {
 }>;
 //#endregion
 //#region src/createAuth.d.ts
-declare const createAuthInstance: <Identity extends EditableShape<UserShape>>(authConfig: AuthConfig<Identity>) => {
+declare const createAuthInstance: <Identity extends Identities>(authConfig: AuthConfig<Identity>) => {
   handlers: _$_aura_stack_router0.Router<[_$_aura_stack_router0.RouteEndpoint<"GET", "/signIn/:oauth", {
     schemas?: {
       params: _$zod.ZodObject<{
@@ -1784,6 +2070,8 @@ declare const createAuthInstance: <Identity extends EditableShape<UserShape>>(au
           notion: "notion";
           dropbox: "dropbox";
           atlassian: "atlassian";
+          clickUp: "clickUp";
+          dribbble: "dribbble";
         }>;
       }, _$zod_v4_core0.$strip>;
       searchParams: _$zod.ZodObject<{
@@ -1791,7 +2079,62 @@ declare const createAuthInstance: <Identity extends EditableShape<UserShape>>(au
         redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
       }, _$zod_v4_core0.$strip>;
     } | undefined;
-  }>, _$_aura_stack_router0.RouteEndpoint<"POST", "/signIn/credentials", {
+    use?: _$_aura_stack_router0.MiddlewareFunction<"/signIn/:oauth", {
+      params: _$zod.ZodObject<{
+        oauth: _$zod.ZodEnum<{
+          [x: string & Record<never, never>]: string & Record<never, never>;
+          github: "github";
+          bitbucket: "bitbucket";
+          figma: "figma";
+          discord: "discord";
+          gitlab: "gitlab";
+          spotify: "spotify";
+          x: "x";
+          strava: "strava";
+          mailchimp: "mailchimp";
+          pinterest: "pinterest";
+          twitch: "twitch";
+          notion: "notion";
+          dropbox: "dropbox";
+          atlassian: "atlassian";
+          clickUp: "clickUp";
+          dribbble: "dribbble";
+        }>;
+      }, _$zod_v4_core0.$strip>;
+      searchParams: _$zod.ZodObject<{
+        redirect: _$zod.ZodDefault<_$zod.ZodOptional<_$zod.ZodCodec<_$zod.ZodString, _$zod.ZodBoolean>>>;
+        redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
+      }, _$zod_v4_core0.$strip>;
+    }>[] | undefined;
+  }, (ctx: {
+    params: {
+      oauth: "github" | "bitbucket" | "figma" | "discord" | "gitlab" | "spotify" | "x" | "strava" | "mailchimp" | "pinterest" | "twitch" | "notion" | "dropbox" | "atlassian" | "clickUp" | "dribbble" | (string & Record<never, never>);
+    };
+    body: undefined;
+    searchParams: {
+      redirect: boolean;
+      redirectTo?: string | undefined;
+    };
+    headers: _$_aura_stack_router0.HeadersBuilder;
+    request: Request;
+    url: URL;
+    method: "GET";
+    route: "/signIn/:oauth";
+    context: _$_aura_stack_router0.GlobalContext;
+    json: <T>(data: T, init?: ResponseInit) => _$_aura_stack_router0.JsonResponse<T>;
+  }) => Promise<Prettify$1<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: true;
+      redirect: boolean;
+      signInURL: string;
+    }>;
+  }> | Prettify$1<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: false;
+      redirect: false;
+      signInURL: null;
+    }>;
+  }>>>, _$_aura_stack_router0.RouteEndpoint<"POST", `/${string}`, {
     schemas?: {
       body: _$zod.ZodObject<{
         username: _$zod.ZodString;
@@ -1801,7 +2144,42 @@ declare const createAuthInstance: <Identity extends EditableShape<UserShape>>(au
         redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
       }, _$zod_v4_core0.$strip>;
     } | undefined;
-  }>, _$_aura_stack_router0.RouteEndpoint<"GET", "/callback/:oauth", {
+    use?: _$_aura_stack_router0.MiddlewareFunction<`/${string}`, {
+      body: _$zod.ZodObject<{
+        username: _$zod.ZodString;
+        password: _$zod.ZodString;
+      }, _$zod_v4_core0.$strip>;
+      searchParams: _$zod.ZodObject<{
+        redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
+      }, _$zod_v4_core0.$strip>;
+    }>[] | undefined;
+  }, (ctx: {
+    params: {};
+    body: {
+      username: string;
+      password: string;
+    };
+    searchParams: {
+      redirectTo?: string | undefined;
+    };
+    headers: _$_aura_stack_router0.HeadersBuilder;
+    request: Request;
+    url: URL;
+    method: "POST";
+    route: `/${string}`;
+    context: _$_aura_stack_router0.GlobalContext;
+    json: <T>(data: T, init?: ResponseInit) => _$_aura_stack_router0.JsonResponse<T>;
+  }) => Promise<Prettify$1<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: true;
+      redirectURL: string;
+    }>;
+  }> | Prettify$1<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: false;
+      redirectURL: null;
+    }>;
+  }>>>, _$_aura_stack_router0.RouteEndpoint<"GET", "/callback/:oauth", {
     schemas?: {
       params: _$zod.ZodObject<{
         oauth: _$zod.ZodEnum<{
@@ -1820,6 +2198,8 @@ declare const createAuthInstance: <Identity extends EditableShape<UserShape>>(au
           notion: "notion";
           dropbox: "dropbox";
           atlassian: "atlassian";
+          clickUp: "clickUp";
+          dribbble: "dribbble";
         }>;
       }, _$zod_v4_core0.$strip>;
       searchParams: _$zod.ZodObject<{
@@ -1827,30 +2207,167 @@ declare const createAuthInstance: <Identity extends EditableShape<UserShape>>(au
         state: _$zod.ZodString;
       }, _$zod_v4_core0.$strip>;
     } | undefined;
-  }>, _$_aura_stack_router0.RouteEndpoint<"GET", "/session", {
+    use?: _$_aura_stack_router0.MiddlewareFunction<"/callback/:oauth", {
+      params: _$zod.ZodObject<{
+        oauth: _$zod.ZodEnum<{
+          [x: string & Record<never, never>]: string & Record<never, never>;
+          github: "github";
+          bitbucket: "bitbucket";
+          figma: "figma";
+          discord: "discord";
+          gitlab: "gitlab";
+          spotify: "spotify";
+          x: "x";
+          strava: "strava";
+          mailchimp: "mailchimp";
+          pinterest: "pinterest";
+          twitch: "twitch";
+          notion: "notion";
+          dropbox: "dropbox";
+          atlassian: "atlassian";
+          clickUp: "clickUp";
+          dribbble: "dribbble";
+        }>;
+      }, _$zod_v4_core0.$strip>;
+      searchParams: _$zod.ZodObject<{
+        code: _$zod.ZodString;
+        state: _$zod.ZodString;
+      }, _$zod_v4_core0.$strip>;
+    }>[] | undefined;
+  }, (ctx: {
+    params: {
+      oauth: "github" | "bitbucket" | "figma" | "discord" | "gitlab" | "spotify" | "x" | "strava" | "mailchimp" | "pinterest" | "twitch" | "notion" | "dropbox" | "atlassian" | "clickUp" | "dribbble" | (string & Record<never, never>);
+    };
+    body: undefined;
+    searchParams: {
+      code: string;
+      state: string;
+    };
+    headers: _$_aura_stack_router0.HeadersBuilder;
+    request: Request;
+    url: URL;
+    method: "GET";
+    route: "/callback/:oauth";
+    context: _$_aura_stack_router0.GlobalContext;
+    json: <T>(data: T, init?: ResponseInit) => _$_aura_stack_router0.JsonResponse<T>;
+  }) => Promise<Response>>, _$_aura_stack_router0.RouteEndpoint<"GET", "/session", {
     schemas?: _$_aura_stack_router0.EndpointSchemas | undefined;
-  }>, _$_aura_stack_router0.RouteEndpoint<"POST", "/signOut", {
+    use?: _$_aura_stack_router0.MiddlewareFunction<"/session", _$_aura_stack_router0.EndpointSchemas>[] | undefined;
+  }, (ctx: {
+    params: {};
+    body: undefined;
+    searchParams: URLSearchParams;
+    headers: _$_aura_stack_router0.HeadersBuilder;
+    request: Request;
+    url: URL;
+    method: "GET";
+    route: "/session";
+    context: _$_aura_stack_router0.GlobalContext;
+    json: <T>(data: T, init?: ResponseInit) => _$_aura_stack_router0.JsonResponse<T>;
+  }) => Promise<Prettify$1<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: true;
+      session: Session<{
+        sub: string;
+        name?: string | null | undefined;
+        image?: string | null | undefined;
+        email?: string | null | undefined;
+      }>;
+    }>;
+  }> | Prettify$1<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: false;
+      session: null;
+    }>;
+  }>>>, _$_aura_stack_router0.RouteEndpoint<"POST", `/${string}`, {
     schemas?: {
       searchParams: _$zod.ZodObject<{
         token_type_hint: _$zod.ZodLiteral<"session_token">;
         redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
       }, _$zod_v4_core0.$strip>;
     } | undefined;
-  }>, _$_aura_stack_router0.RouteEndpoint<"GET", "/csrfToken", {
+    use?: _$_aura_stack_router0.MiddlewareFunction<`/${string}`, {
+      searchParams: _$zod.ZodObject<{
+        token_type_hint: _$zod.ZodLiteral<"session_token">;
+        redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
+      }, _$zod_v4_core0.$strip>;
+    }>[] | undefined;
+  }, (ctx: {
+    params: {};
+    body: undefined;
+    searchParams: {
+      token_type_hint: "session_token";
+      redirectTo?: string | undefined;
+    };
+    headers: _$_aura_stack_router0.HeadersBuilder;
+    request: Request;
+    url: URL;
+    method: "POST";
+    route: `/${string}`;
+    context: _$_aura_stack_router0.GlobalContext;
+    json: <T>(data: T, init?: ResponseInit) => _$_aura_stack_router0.JsonResponse<T>;
+  }) => Promise<Prettify$1<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: true;
+      redirect: boolean;
+      redirectURL: string;
+    }>;
+  }> | Prettify$1<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: false;
+      redirect: boolean;
+      redirectURL: null;
+    }>;
+  }>>>, _$_aura_stack_router0.RouteEndpoint<"GET", "/csrfToken", {
     schemas?: _$_aura_stack_router0.EndpointSchemas | undefined;
-  }>, _$_aura_stack_router0.RouteEndpoint<"PATCH", "/session", {
+    use?: _$_aura_stack_router0.MiddlewareFunction<"/csrfToken", _$_aura_stack_router0.EndpointSchemas>[] | undefined;
+  }, (ctx: {
+    params: {};
+    body: undefined;
+    searchParams: URLSearchParams;
+    headers: _$_aura_stack_router0.HeadersBuilder;
+    request: Request;
+    url: URL;
+    method: "GET";
+    route: "/csrfToken";
+    context: _$_aura_stack_router0.GlobalContext;
+    json: <T>(data: T, init?: ResponseInit) => _$_aura_stack_router0.JsonResponse<T>;
+  }) => Promise<Response>>, _$_aura_stack_router0.RouteEndpoint<"PATCH", `/${string}`, {
     schemas?: {
-      body: _$zod.ZodObject<{
-        user: _$zod.ZodOptional<_$zod.ZodObject<{
-          sub: _$zod.ZodOptional<_$zod.ZodString>;
-          name: _$zod.ZodOptional<_$zod.ZodOptional<_$zod.ZodNullable<_$zod.ZodString>>>;
-          image: _$zod.ZodOptional<_$zod.ZodOptional<_$zod.ZodNullable<_$zod.ZodString>>>;
-          email: _$zod.ZodOptional<_$zod.ZodOptional<_$zod.ZodNullable<_$zod.ZodEmail>>>;
-        }, _$zod_v4_core0.$strip>> | undefined;
-        expires: _$zod.ZodOptional<_$zod.ZodCoercedDate<unknown>>;
-      }, _$zod_v4_core0.$strip>;
+      body: any;
     } | undefined;
-  }>]>;
+    use?: _$_aura_stack_router0.MiddlewareFunction<`/${string}`, {
+      body: any;
+    }>[] | undefined;
+  }, (ctx: {
+    params: {};
+    body: any;
+    searchParams: URLSearchParams;
+    headers: _$_aura_stack_router0.HeadersBuilder;
+    request: Request;
+    url: URL;
+    method: "PATCH";
+    route: `/${string}`;
+    context: _$_aura_stack_router0.GlobalContext;
+    json: <T>(data: T, init?: ResponseInit) => _$_aura_stack_router0.JsonResponse<T>;
+  }) => Promise<Prettify$1<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: true;
+      session: Session<{
+        sub: string;
+        name?: string | null | undefined;
+        image?: string | null | undefined;
+        email?: string | null | undefined;
+      }>;
+      redirectURL: string;
+    }>;
+  }> | Prettify$1<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: false;
+      session: null;
+      redirectURL: null;
+    }>;
+  }>>>]>;
   jose: any;
   api: {
     getSession: (options: GetSessionAPIOptions) => Promise<GetSessionAPIReturn<{
@@ -1898,7 +2415,7 @@ declare const createAuthInstance: <Identity extends EditableShape<UserShape>>(au
  *   }]
  * })
  */
-declare const createAuth: <Identity extends EditableShape<UserShape>>(config: AuthConfig<Identity>) => AuthInstance<ShapeToObject<Identity>>;
+declare const createAuth: <Identity extends Identities = EditableShape<UserShape>>(config: AuthConfig<Identity>) => AuthInstance<FromShapeToObject<Identity>>;
 //#endregion
 //#region src/@types/errors.d.ts
 /** Map of field or logical keys to API validation error payloads (code + message). */
@@ -2276,4 +2793,4 @@ type AuthClientOptions = Prettify$1<Omit<ClientOptions, "baseURL"> & {
   baseURL?: string;
 }>;
 //#endregion
-export { JWTConfigBase as $, atlassian as $t, APIErrorMap as A, DiscordProfile as An, IdentityConfig as At, DeepPartial as B, UserIdentity as Bn, SyslogOptions as Bt, SignOutAPIReturn as C, XProfile as Cn, CookieName as Ct, UpdateSessionAPIReturn as D, spotify as Dn, CredentialsProvider as Dt, UpdateSessionAPIOptions as E, SpotifyProfile as En, CredentialsPayload as Et, ErrorType as F, BitbucketProfile as Fn, Logger as Ft, InferShape as G, OAuthProviderCredentials as Gt, EditableShape as H, UserShape as Hn, AuthorizeParams as Ht, OAuthError as I, bitbucket as In, RouterGlobalContext as It, Prettify$1 as J, BuiltInOAuthProvider as Jt, LiteralUnion as K, OAuthProviderRecord as Kt, TokenRevocationError as L, GitHubProfile as Ln, SecureCookie as Lt, AuthInternalErrorCode as M, discord as Mn, InternalLogger as Mt, AuthSecurityErrorCode as N, FigmaProfile as Nn, JoseInstance as Nt, UpdateSessionOptions as O, GitLabProfile as On, CredentialsProviderContext as Ot, AuthorizationError as P, figma as Pn, LogLevel as Pt, JWTConfig as Q, ExtendedProfile as Qt, createAuth as R, github as Rn, Severity as Rt, SignOutAPIOptions as S, strava as Sn, CookieConfig as St, SignOutReturn as T, SpotifyImage as Tn, CookieStrategyAttributes as Tt, InferAuthIdentity as U, createIdentity as Un, OAuthProvider as Ut, DeepRequired as V, UserIdentityType as Vn, TrustedOrigin as Vt, InferIdentity as W, OAuthProviderConfig as Wt, CreateSessionStrategyOptions as X, createBuiltInOAuthProviders as Xt, ShapeToObject as Y, builtInOAuthProviders as Yt, GetStatelessSessionReturn as Z, AtlassianProfile as Zt, SignInCredentialsAPIReturn as _, MailchimpProfile as _n, User as _t, OAuthEnv as a, dropbox as an, JWTManager as at, SignInOptions as b, SummaryClub as bn, AuthInstance as bt, APIOptionsWithRequest as c, NotionUser as cn, JWTSignedMode as ct, GetSessionAPIOptions as d, notion as dn, KeyPair as dt, AccountType as en, JWTEncryptedMode as et, GetSessionAPIReturn as f, TwitchProfile as fn, SecretKey as ft, SignInCredentialsAPIOptions as g, Login as gn, StatelessStrategyConfig as gt, SignInAPIReturn as h, pinterest as hn, SessionStrategy as ht, JWTStandardClaims as i, RootInfo as in, JWTKeyAlgorithm as it, AccessTokenError as j, Nameplate as jn, InternalContext as jt, UpdateSessionReturn as k, gitlab as kn, HostCookie as kt, APIOptionsWithSkipCSRFCheck as l, Owner as ln, JWTSigningAlgorithm as lt, SignInAPIOptions as m, PinterestProfile as mn, SessionConfig as mt, AuthClientOptions as n, FullTeam as nn, JWTExpirationStrategy as nt, TypedJWTPayload$1 as o, Bot as on, JWTMode as ot, OptionsWithRedirectTo as p, twitch as pn, Session as pt, Merge as q, ResponseType as qt, JWTPayloadWithToken as r, Name as rn, JWTKey as rt, APIOptionsWithRedirectTo as s, NotionProfile as sn, JWTSealedMode as st, AuthClient as t, DropboxProfile as tn, JWTEncryptionAlgorithm as tt, FunctionAPIContext as u, Person as un, JWTStrategyOptions as ut, SignInCredentialsOptions as v, mailchimp as vn, AuthAPI as vt, SignOutOptions as w, x as wn, CookieStoreConfig as wt, SignInReturn as x, SummaryGear as xn, AuthRuntimeConfig as xt, SignInCredentialsReturn as y, StravaProfile as yn, AuthConfig as yt, AuthResponse as z, createSyslogMessage as zn, StandardCookie as zt };
+export { LiteralUnion as $, Nameplate as $n, JWTMode as $t, APIErrorMap as A, NotionUser as An, StandardCookie as At, AuthResponse as B, mailchimp as Bn, AsymmetricKeyPair as Bt, SignOutAPIReturn as C, DropboxProfile as Cn, JoseInstance as Ct, UpdateSessionAPIReturn as D, dropbox as Dn, SchemaRegistryContext as Dt, UpdateSessionAPIOptions as E, RootInfo as En, RouterGlobalContext as Et, ErrorType as F, twitch as Fn, OAuthProvider as Ft, EditableShapeArkType as G, XProfile as Gn, JWTConfig as Gt, DeepPartial as H, SummaryClub as Hn, CreateSessionStrategyOptions as Ht, OAuthError as I, PinterestProfile as In, OAuthProviderConfig as It, EditableShapeZod as J, SpotifyProfile as Jn, JWTEncryptionAlgorithm as Jt, EditableShapeTypebox as K, x as Kn, JWTConfigBase as Kt, TokenRevocationError as L, pinterest as Ln, OAuthProviderCredentials as Lt, AuthInternalErrorCode as M, Person as Mn, TrustedOrigin as Mt, AuthSecurityErrorCode as N, notion as Nn, TrustedProxyHeadersConfig as Nt, UpdateSessionOptions as O, Bot as On, SecureCookie as Ot, AuthorizationError as P, TwitchProfile as Pn, AuthorizeParams as Pt, InferZodShape as Q, DiscordProfile as Qn, JWTManager as Qt, createAuth as R, Login as Rn, OAuthProviderRecord as Rt, SignOutAPIOptions as S, AccountType as Sn, InternalLogger as St, SignOutReturn as T, Name as Tn, Logger as Tt, DeepRequired as U, SummaryGear as Un, CryptoSecret as Ut, ConfigSchema as V, StravaProfile as Vn, AsymmetricKeyPairFromEnv as Vt, EditableShape as W, strava as Wn, GetStatelessSessionReturn as Wt, InferSession as X, GitLabProfile as Xn, JWTKey as Xt, FromShapeToObject as Y, spotify as Yn, JWTExpirationStrategy as Yt, InferUser as Z, gitlab as Zn, JWTKeyAlgorithm as Zt, SignInCredentialsAPIReturn as _, ClickUpProfile as _n, UserShape as _r, CredentialsProvider as _t, OAuthEnv as a, Session as an, GitHubProfile as ar, ValibotShapeToObject as at, SignInOptions as b, ExtendedProfile as bn, UserShapeValibot as br, IdentityConfig as bt, APIOptionsWithRequest as c, StatelessStrategyConfig as cn, Identities as cr, AuthAPI as ct, GetSessionAPIOptions as d, builtInOAuthProviders as dn, IsZod as dr, AuthRuntimeConfig as dt, JWTSealedMode as en, discord as er, Merge as et, GetSessionAPIReturn as f, createBuiltInOAuthProviders as fn, SchemaTypes as fr, CookieConfig as ft, SignInCredentialsAPIOptions as g, dribbble as gn, UserIdentityValibot as gr, CredentialsPayload as gt, SignInAPIReturn as h, DribbbleTeams as hn, UserIdentityTypeBox as hr, CookieStrategyAttributes as ht, JWTStandardClaims as i, SecretKey as in, bitbucket as ir, UserFrom as it, AccessTokenError as j, Owner as jn, SyslogOptions as jt, UpdateSessionReturn as k, NotionProfile as kn, Severity as kt, APIOptionsWithSkipCSRFCheck as l, User as ln, IsArkType as lr, AuthConfig as lt, SignInAPIOptions as m, DribbbleProfile as mn, UserIdentityArkType as mr, CookieStoreConfig as mt, AuthClientOptions as n, JWTSigningAlgorithm as nn, figma as nr, SessionFrom as nt, TypedJWTPayload$1 as o, SessionConfig as on, github as or, Wrap as ot, OptionsWithRedirectTo as p, DribbbleDefault as pn, UserIdentity as pr, CookieName as pt, EditableShapeValibot as q, SpotifyImage as qn, JWTEncryptedMode as qt, JWTPayloadWithToken as r, JWTStrategyOptions as rn, BitbucketProfile as rr, TypeboxShapeToObject as rt, APIOptionsWithRedirectTo as s, SessionStrategy as sn, createSyslogMessage as sr, ZodShapeToObject as st, AuthClient as t, JWTSignedMode as tn, FigmaProfile as tr, Prettify$1 as tt, FunctionAPIContext as u, BuiltInOAuthProvider as un, IsValibot as ur, AuthInstance as ut, SignInCredentialsOptions as v, clickUp as vn, UserShapeArkType as vr, CredentialsProviderContext as vt, SignOutOptions as w, FullTeam as wn, LogLevel as wt, SignInReturn as x, atlassian as xn, createIdentity as xr, InternalContext as xt, SignInCredentialsReturn as y, AtlassianProfile as yn, UserShapeTypeBox as yr, HostCookie as yt, ArktypeShapeToObject as z, MailchimpProfile as zn, ResponseType as zt };