@aura-stack/auth 0.7.2 → 0.8.0

package/dist/{index-1ADcIVGC.d.ts → index-DIcbmH1M.d.ts}

@@ -1,17 +1,22 @@
 import * as _$_aura_stack_router0 from "@aura-stack/router";
-import { ClientOptions, GlobalContext } from "@aura-stack/router";
-import { ZodObject, ZodRawShape, ZodTypeAny, infer as __Infer, z } from "zod/v4";
+import { ClientOptions, GlobalContext, InferSchema } from "@aura-stack/router";
+import { RateLimiterConfig } from "@aura-stack/rate-limiter";
+import { ZodObject, ZodOptional, ZodRawShape, ZodTypeAny, infer as __Infer, z } from "zod/v4";
+import * as _$arktype from "arktype";
 import { Type } from "arktype";
 import { TObject, TProperties, TSchema, Type as Type$1 } from "typebox";
+import { SerializeOptions } from "@aura-stack/router/cookie";
 import { JWK, JWTPayload } from "@aura-stack/jose/jose";
 import { DecodeJWTOptions, EncodeJWTOptions, JWEHeaderParameters, JWTDecryptOptions, JWTHeaderParameters, JWTVerifyOptions, TypedJWTPayload, TypedJWTPayload as TypedJWTPayload$1 } from "@aura-stack/jose";
-import { SerializeOptions } from "@aura-stack/router/cookie";
 import * as valibot from "valibot";
 import { AnySchema, BaseSchema, InferOutput, ObjectEntries, ObjectSchema } from "valibot";
+import * as _$zod from "zod";
+import { ZodObject as ZodObject$1, infer as infer$1 } from "zod";
 import * as _$arktype_internal_variants_object_ts0 from "arktype/internal/variants/object.ts";
 import * as _$zod_v4_core0 from "zod/v4/core";
-import { infer as infer$1 } from "zod/v4/core";
-import * as _$zod from "zod";
+import { infer as infer$2 } from "zod/v4/core";
+import { GetRouteParams } from "@aura-stack/router/types";
+import { InferRules, RateLimiterRule } from "@aura-stack/rate-limiter/types";
 
 //#region src/schemas.d.ts
 /**
@@ -33,6 +38,18 @@ declare const OAuthAuthorizationErrorResponse: z.ZodObject<{
   error_uri: z.ZodOptional<z.ZodString>;
   state: z.ZodString;
 }, z.core.$strip>;
+/**
+ * Schema for OAuth Access Token Response
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.1
+ * @see https://datatracker.ietf.org/doc/html/rfc7636#section-4
+ */
+declare const OAuthAccessTokenResponse: z.ZodObject<{
+  access_token: z.ZodString;
+  token_type: z.ZodOptional<z.ZodString>;
+  expires_in: z.ZodOptional<z.ZodNumber>;
+  refresh_token: z.ZodOptional<z.ZodString>;
+  scope: z.ZodUnion<readonly [z.ZodUnion<[z.ZodOptional<z.ZodString>, z.ZodNull]>, z.ZodOptional<z.ZodArray<z.ZodString>>]>;
+}, z.core.$strip>;
 /**
  * Schema for OAuth Access Token Error Response
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
@@ -53,6 +70,14 @@ declare const OAuthEnvSchema: z.ZodObject<{
   clientId: z.ZodString;
   clientSecret: z.ZodString;
 }, z.core.$strip>;
+declare const OIDCAccessTokenResponseSchema: z.ZodObject<{
+  access_token: z.ZodString;
+  token_type: z.ZodOptional<z.ZodString>;
+  expires_in: z.ZodOptional<z.ZodNumber>;
+  refresh_token: z.ZodOptional<z.ZodString>;
+  scope: z.ZodUnion<readonly [z.ZodUnion<[z.ZodOptional<z.ZodString>, z.ZodNull]>, z.ZodOptional<z.ZodArray<z.ZodString>>]>;
+  id_token: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
 //#endregion
 //#region src/jose.d.ts
 /**
@@ -78,8 +103,45 @@ declare const createJoseInstance: <DefaultUser extends User = User>(secret?: JWT
   decodeJWT: (token: string, options?: DecodeJWTOptions) => Promise<TypedJWTPayload<DefaultUser>>;
 };
 //#endregion
+//#region src/shared/identity.d.ts
+declare const UserIdentity: z.ZodObject<{
+  sub: z.ZodString;
+  name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  image: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  email: z.ZodOptional<z.ZodNullable<z.ZodEmail>>;
+}, z.core.$strip>;
+declare const UserIdentityValibot: valibot.ObjectSchema<{
+  readonly sub: valibot.StringSchema<undefined>;
+  readonly name: valibot.OptionalSchema<valibot.NullableSchema<valibot.StringSchema<undefined>, undefined>, undefined>;
+  readonly image: valibot.OptionalSchema<valibot.NullableSchema<valibot.StringSchema<undefined>, undefined>, undefined>;
+  readonly email: valibot.OptionalSchema<valibot.NullableSchema<valibot.SchemaWithPipe<readonly [valibot.StringSchema<undefined>, valibot.EmailAction<string, undefined>]>, undefined>, undefined>;
+}, undefined>;
+declare const UserIdentityArkType: _$arktype_internal_variants_object_ts0.ObjectType<{
+  sub: string;
+  name?: string | null | undefined;
+  image?: string | null | undefined;
+  email?: string | null | undefined;
+}, {}>;
+declare const UserIdentityTypeBox: Type$1.TObject<{
+  sub: Type$1.TString;
+  name: Type$1.TOptional<Type$1.TUnion<[Type$1.TString, Type$1.TNull]>>;
+  image: Type$1.TOptional<Type$1.TUnion<[Type$1.TString, Type$1.TNull]>>;
+  email: Type$1.TOptional<Type$1.TUnion<[Type$1.TString, Type$1.TNull]>>;
+}>;
+type UserShape = typeof UserIdentity.shape;
+type UserShapeValibot = typeof UserIdentityValibot.entries;
+type UserShapeArkType = typeof UserIdentityArkType;
+type UserShapeTypeBox = typeof UserIdentityTypeBox.properties;
+type IsArkType<T extends Identities> = T extends EditableShapeArkType<UserShapeArkType> ? true : false;
+type IsZod<T extends Identities> = T extends EditableShape<UserShape> ? true : false;
+type IsValibot<T extends Identities> = T extends EditableShapeValibot<UserShapeValibot> ? true : false;
+type SchemaTypes = ZodObject<any> | valibot.ObjectSchema<any, undefined> | Type<{}> | Type$1.TObject;
+type Identities = EditableShape<UserShape> | EditableShapeValibot<UserShapeValibot> | EditableShapeArkType<UserShapeArkType> | EditableShapeTypebox<UserShapeTypeBox> | EditableUser;
+type ReturnShapeType<T> = T extends EditableShape<UserShape> ? z.ZodObject<T> : T extends EditableShapeValibot<UserShapeValibot> ? valibot.ObjectSchema<T, undefined> : T extends EditableShapeArkType<UserShapeArkType> ? T : T extends EditableShapeTypebox<UserShapeTypeBox> ? Type$1.TObject<T> : T extends EditableUser ? z.ZodObject<T> : never;
+declare const createIdentity: <S extends Identities>(shape: S) => ReturnShapeType<S>;
+//#endregion
 //#region src/api/createApi.d.ts
-declare const createAuthAPI: <DefaultUser extends User = User>(ctx: GlobalContext) => {
+declare const createAuthAPI: <DefaultUser extends User = User, SignUpSchema extends SchemaTypes = ZodObject$1<any>>(ctx: GlobalContext) => {
   /**
    * Retrieves the current session data from the server-side.
    *
@@ -119,6 +181,26 @@ declare const createAuthAPI: <DefaultUser extends User = User>(ctx: GlobalContex
    * })
    */
   signInCredentials: (options: SignInCredentialsAPIOptions) => Promise<SignInCredentialsAPIReturn>;
+  /**
+   * Signs up a new user on the server-side. It requires a `payload` with the necessary information for
+   * user creation and a callback function configured in `signUp.onCreateUser` to handle the actual user
+   * creation logic.
+   *
+   * @params options - Options for the API call, including the sign-up payload, headers, and redirect behavior.
+   * @return The object returned by the API call {@link SignUpAPIReturn}
+   * @example
+   * const response = await api.signUp({
+   *   payload: {
+   *     name: "John",
+   *     lastName: "Doe",
+   *     email: "john.doe@example.com",
+   *     password: "1234567890"
+   *   },
+   *   redirectTo: "/dashboard",
+   *   request: await getRequest()
+   * })
+   */
+  signUp: <Payload extends Record<string, any> = Wrap<RemoveIndexSignature<InferSchema<SignUpSchema, _$_aura_stack_router0.SchemaKind<SignUpSchema>>>>>(options: SignUpAPIOptions<Payload>) => Promise<SignUpAPIReturn>;
   /**
    * Updates the current session on the server-side. It allows partial updates to the session object, such as
    * modifying user fields or extending the session expiry. It implements CSRF Protection by default, for
@@ -160,43 +242,6 @@ declare const createAuthAPI: <DefaultUser extends User = User>(ctx: GlobalContex
   signOut: (options: SignOutAPIOptions) => Promise<SignOutAPIReturn>;
 };
 //#endregion
-//#region src/shared/identity.d.ts
-declare const UserIdentity: z.ZodObject<{
-  sub: z.ZodString;
-  name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-  image: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-  email: z.ZodOptional<z.ZodNullable<z.ZodEmail>>;
-}, z.core.$strip>;
-declare const UserIdentityValibot: valibot.ObjectSchema<{
-  readonly sub: valibot.StringSchema<undefined>;
-  readonly name: valibot.OptionalSchema<valibot.NullableSchema<valibot.StringSchema<undefined>, undefined>, undefined>;
-  readonly image: valibot.OptionalSchema<valibot.NullableSchema<valibot.StringSchema<undefined>, undefined>, undefined>;
-  readonly email: valibot.OptionalSchema<valibot.NullableSchema<valibot.SchemaWithPipe<readonly [valibot.StringSchema<undefined>, valibot.EmailAction<string, undefined>]>, undefined>, undefined>;
-}, undefined>;
-declare const UserIdentityArkType: _$arktype_internal_variants_object_ts0.ObjectType<{
-  sub: string;
-  name?: string | null | undefined;
-  image?: string | null | undefined;
-  email?: string | null | undefined;
-}, {}>;
-declare const UserIdentityTypeBox: Type$1.TObject<{
-  sub: Type$1.TString;
-  name: Type$1.TOptional<Type$1.TUnion<[Type$1.TString, Type$1.TNull]>>;
-  image: Type$1.TOptional<Type$1.TUnion<[Type$1.TString, Type$1.TNull]>>;
-  email: Type$1.TOptional<Type$1.TUnion<[Type$1.TString, Type$1.TNull]>>;
-}>;
-type UserShape = typeof UserIdentity.shape;
-type UserShapeValibot = typeof UserIdentityValibot.entries;
-type UserShapeArkType = typeof UserIdentityArkType;
-type UserShapeTypeBox = typeof UserIdentityTypeBox.properties;
-type IsArkType<T extends Identities> = T extends EditableShapeArkType<UserShapeArkType> ? true : false;
-type IsZod<T extends Identities> = T extends EditableShape<UserShape> ? true : false;
-type IsValibot<T extends Identities> = T extends EditableShapeValibot<UserShapeValibot> ? true : false;
-type SchemaTypes = ZodObject<any> | valibot.ObjectSchema<any, undefined> | Type<{}> | Type$1.TObject;
-type Identities = EditableShape<UserShape> | EditableShapeValibot<UserShapeValibot> | EditableShapeArkType<UserShapeArkType> | EditableShapeTypebox<UserShapeTypeBox> | EditableUser;
-type ReturnShapeType<T> = T extends EditableShape<UserShape> ? z.ZodObject<T> : T extends EditableShapeValibot<UserShapeValibot> ? valibot.ObjectSchema<T, undefined> : T extends EditableShapeArkType<UserShapeArkType> ? T : T extends EditableShapeTypebox<UserShapeTypeBox> ? Type$1.TObject<T> : T extends EditableUser ? z.ZodObject<T> : never;
-declare const createIdentity: <S extends Identities>(shape: S) => ReturnShapeType<S>;
-//#endregion
 //#region src/shared/logger.d.ts
 /**
  * Log message definitions organized by category.
@@ -503,6 +548,36 @@ declare const logMessages: {
     readonly msgId: "CREDENTIALS_SIGN_IN_FAILED";
     readonly message: "An error occurred during credentials sign-in";
   };
+  readonly SIGN_UP_SUCCESS: {
+    readonly facility: 4;
+    readonly severity: "info";
+    readonly msgId: "SIGN_UP_SUCCESS";
+    readonly message: "User successfully signed up and authenticated";
+  };
+  readonly SESSION_NOT_FOUND: {
+    readonly facility: 4;
+    readonly severity: "error";
+    readonly msgId: "SESSION_NOT_FOUND";
+    readonly message: "Session token was not found in the request cookies";
+  };
+  readonly OAUTH_INVALID_CONTENT_TYPE: {
+    readonly facility: 10;
+    readonly severity: "error";
+    readonly msgId: "OAUTH_INVALID_CONTENT_TYPE";
+    readonly message: "OAuth endpoint returned an invalid Content-Type header";
+  };
+  readonly SIGN_IN_PROVIDER_TYPE_DETECTED: {
+    readonly facility: 4;
+    readonly severity: "info";
+    readonly msgId: "SIGN_IN_PROVIDER_TYPE_DETECTED";
+    readonly message: "Detected OAuth provider type (OIDC or standard)";
+  };
+  readonly OIDC_PROVIDER_RESOLVED: {
+    readonly facility: 4;
+    readonly severity: "info";
+    readonly msgId: "OIDC_PROVIDER_RESOLVED";
+    readonly message: "OIDC provider configuration resolved successfully";
+  };
 };
 declare const createLogEntry: <T extends keyof typeof logMessages>(key: T, overrides?: Partial<SyslogOptions>) => SyslogOptions;
 declare const createSyslogMessage: (options: SyslogOptions) => string;
@@ -1153,6 +1228,661 @@ interface DribbbleProfile extends DribbbleDefault {
  */
 declare const dribbble: <DefaultUser extends User = User>(options?: Partial<OAuthProviderCredentials<DribbbleProfile, DefaultUser>>) => OAuthProviderCredentials<DribbbleProfile, DefaultUser>;
 //#endregion
+//#region src/oauth/hubspot.d.ts
+interface HubSportSignedAccessToken {
+  appId: number;
+  appInstallId: number;
+  audience: string;
+  expiresAt: string;
+  hubId: number;
+  hublet: string;
+  installingUserId: number;
+  isPrivateDistribution: boolean;
+  isServiceAccount: boolean;
+  isUserLevel: boolean;
+  newSignature: string;
+  scopeToScopeGroupPks: string;
+  scopes: string;
+  signature: string;
+  trialScopeToScopeGroupPks: string;
+  trialScopes: string;
+  userId: number;
+}
+/**
+ * @see [HubSpot - Retrieve OAuth token metadata](https://developers.hubspot.com/docs/api-reference/legacy/authentication/oauth-tokens/v1/get-oauth-token-metadata)
+ */
+interface HubSpotProfile {
+  /**
+   * The ID of the application associated with the access token.
+   */
+  app_id: number;
+  /**
+   * The time in seconds until the access token expires.
+   */
+  expires_in: number;
+  /**
+   * The ID of the HubSpot account associated with the access token.
+   */
+  hub_id: number;
+  /**
+   * An array of strings indicating the scopes
+   */
+  scopes: string[];
+  /**
+   * The access token string used to make API calls.
+   */
+  token: string;
+  /**
+   * The type of token, typically indicating the authentication scheme.
+   * @default `bearer`
+   */
+  token_type: string;
+  /**
+   * The ID of the hubspot user for whom the access token was created.
+   */
+  user_id: number;
+  /**
+   * The domain of the HubSpot account associated with the access token.
+   */
+  hub_domain: string;
+  /**
+   * Indicates whether the token is for a privately distributed application. If false, it is marketplace distributed.
+   */
+  is_private_distribution: boolean;
+  signed_access_token: HubSportSignedAccessToken;
+  /**
+   * The email address of the hubspot user for whom the access token was created.
+   */
+  user: string;
+}
+/**
+ * HubSpot OAuth provider
+ * Profile Type {@link HubSpotProfile}
+ *
+ * @see [HubSpot - Working with OAuth](https://developers.hubspot.com/docs/apps/legacy-apps/authentication/oauth-quickstart-guide#getting-oauth-tokens)
+ * @see [HubSpot - Scopes](https://developers.hubspot.com/docs/apps/legacy-apps/authentication/scopes)
+ * @see [HubSpot - Retrieve OAuth token metadata](https://developers.hubspot.com/docs/api-reference/legacy/authentication/oauth-tokens/v1/get-oauth-token-metadata)
+ */
+declare const hubspot: <DefaultUser extends User = User>(options?: OAuthProviderConfig<HubSpotProfile, DefaultUser>) => OAuthProviderConfig<HubSpotProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/google.d.ts
+/**
+ * @see [Google - ID Token (Claims)](https://developers.google.com/identity/openid-connect/reference#id_token_claims)
+ */
+interface GoogleProfile {
+  /**
+   * The issuer identifier for the issuer of the response.
+   * Typically `https://accounts.google.com` or `accounts.google.com`
+   */
+  iss: string;
+  /**
+   * The subject identifier for the user. This is a unique and immutable
+   * identifier for the user.
+   */
+  sub: string;
+  /**
+   * The audience for which the ID token is intended.
+   */
+  aud: string;
+  /**
+   * The time of the ID token was issued.
+   */
+  iat: number;
+  /**
+   * Expiration time on or after which the ID token must not be accepted.
+   */
+  exp: string;
+  /**
+   * The client Identifier for the authorized presenter, obtained from
+   * the Google Cloud Console.
+   */
+  azp?: string;
+  /**
+   * The value of the `nonce` supplied by the client.
+   */
+  nonce?: string;
+  /**
+   * The time user authentication took placea JSON number representing
+   * the number of seconds.
+   */
+  auth_time?: number;
+  /**
+   * Access token hash. Provides validation that the Access Token is tied
+   * to the identity token.
+   */
+  at_hash?: string;
+  /**
+   * The domain associated with the Google Workspace or Cloud organization of the user.
+   */
+  hd?: string;
+  /**
+   * The user's email address.
+   * > Note: Provided only if you included the `email` scope in your request.
+   *
+   * > Warning: Don't use email address as an identifier because a Google
+   * Account can have multiple email addresses at different points in time.
+   * Always use the `sub` field as the identifier for the user.
+   */
+  email: string;
+  /**
+   * `True` if the user's email address has been verified.
+   */
+  email_verified?: boolean;
+  /**
+   * The user's full name.
+   * > Note: Provided only if you included the `profile` scope in your request.
+   */
+  name: string;
+  /**
+   * The URL of the user's profile picture.
+   * > Note: Provided only if you included the `profile` scope in your request.
+   */
+  picture: string;
+  /**
+   * The user's give name(s) or first name(s).
+   */
+  given_name?: string;
+  /**
+   * The user's family name(s) or last name(s).
+   */
+  family_name?: string;
+}
+/**
+ * Google OpenID Connect Provider
+ *
+ * @see [Google - Using OAuth 2.0 to Access Google APIs](https://developers.google.com/identity/protocols/oauth2)
+ * @see [Google - OpenID Connect](https://developers.google.com/identity/openid-connect/openid-connect)
+ * @see [Google - OpenID Connect API Reference](https://developers.google.com/identity/openid-connect/reference)
+ * @see [Google - Client Credentials](https://console.cloud.google.com/auth/clients)
+ */
+declare const google: <DefaultUser extends User = User>(options?: Partial<OpenIDProvider<GoogleProfile, DefaultUser>>) => OpenIDProvider<GoogleProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/huggingface.d.ts
+interface HuggingFaceResourceGroup {
+  sub: string;
+  name: string;
+  role: "admin" | "write" | "contributor" | "read" | "no_access";
+}
+interface HuggingFaceOrg {
+  sub: string;
+  name: string;
+  picture: string;
+  preferred_username: string;
+  plan?: "team" | "enterprise" | "plus" | "academia";
+  canPay?: boolean;
+  billingMode?: "prepaid" | "postpaid";
+  roleInOrg?: "admin" | "write" | "contributor" | "read" | "no_access";
+  pendingSSO?: boolean;
+  missingMFA?: boolean;
+  securityRestrictions?: ("mfa" | "token-policy" | "token-revoked" | "sso" | "ip")[];
+  resourceGroups?: HuggingFaceResourceGroup;
+}
+/**
+ * @see [Hugging Face - Open API Metadata](https://huggingface.co/.well-known/openapi.json)
+ */
+interface HuggingFaceProfile {
+  sub: string;
+  isPro: boolean;
+  orgs: HuggingFaceOrg[];
+  name?: string;
+  preferred_username?: string;
+  picture?: string;
+  profile?: string;
+  website?: string;
+  email?: string;
+  email_verified?: boolean;
+  canPay?: boolean;
+  billingMode?: "prepaid" | "postpaid";
+}
+/**
+ * Hugging Face OpenID Connect Provider
+ *
+ * @see [Hugging Face - Sign in with Hugging Face](https://huggingface.co/docs/hub/en/oauth)
+ * @see [Hugging Face - Create an OAuth App](https://huggingface.co/settings/applications/new)
+ * @see [Hugging Face - OpenID Metadata](https://huggingface.co/.well-known/openid-configuration)
+ */
+declare const huggingface: <DefaultUser extends User = User>(options?: Partial<OpenIDProvider<HuggingFaceProfile, DefaultUser>>) => OpenIDProvider<HuggingFaceProfile, DefaultUser>;
+//#endregion
+//#region src/oauth/authentik.d.ts
+interface AuthentikProfile {
+  iss: string;
+  sub: string;
+  aud: string;
+  exp: number;
+  iat: number;
+  auth_time: number;
+  acr: string;
+  c_hash: string;
+  nonce: string;
+  at_hash: string;
+  email: string;
+  email_verified: boolean;
+  name: string;
+  given_name: string;
+  family_name: string;
+  preferred_username: string;
+  nickname: string;
+}
+/**
+ * Authentik OpenID Connect Provider
+ *
+ * @see [Authentik - OAuth 2.0 Provider](https://docs.goauthentik.io/add-secure-apps/providers/oauth2/)
+ * @see [Authentik - Create an OAuth2 Provider](https://docs.goauthentik.io/add-secure-apps/providers/oauth2/create-oauth2-provider/)
+ */
+declare const authentik: <DefaultUser extends User = User>(options?: Partial<OpenIDProvider<AuthentikProfile, DefaultUser>>) => OpenIDProvider<AuthentikProfile, DefaultUser>;
+//#endregion
+//#region src/@types/session.d.ts
+/** Application user type, inferred from the configured identity schema (defaults to the built-in user shape). */
+type User = infer$2<typeof UserIdentity>;
+/**
+ * Session data returned by the session endpoint.
+ */
+interface Session<DefaultUser extends User = User> {
+  user: DefaultUser;
+  expires: string;
+}
+interface CryptoSecret {
+  sign: CryptoKey | CryptoKeyPair | JWK | JsonWebKey | AsymmetricKeyPair;
+  encrypt: CryptoKey | CryptoKeyPair | JWK | JsonWebKey | AsymmetricKeyPair;
+}
+interface AsymmetricKeyPairFromEnv {
+  publicKey: string;
+  privateKey: string;
+}
+interface AsymmetricKeyPair {
+  publicKey: CryptoKey | JWK;
+  privateKey: CryptoKey | JWK;
+}
+/**
+ * A symmetric secret or asymmetric key pair used for JWT operations.
+ *
+ * - string / Uint8Array: used as-is for HMAC (signed) or AES (encrypted)
+ * - CryptoKey: Web Crypto API key, for environments that support it
+ * - CryptoKeyPair: asymmetric signing/encryption (RS256, ES256, EdDSA, RSA-OAEP, etc.)
+ */
+type SecretKey = string | Uint8Array | CryptoKey | CryptoKeyPair | CryptoSecret | JWK | AsymmetricKeyPair;
+/**
+ * @todo: add key rotation support for "SecretKey | CryptoKeyPair | [SecretKey | CryptoKeyPair, ...(SecretKey | CryptoKeyPair)[]]"
+ */
+type JWTKey = SecretKey;
+/**
+ * - "signed"    → standard JWS (e.g. HS256, RS256, ES256).
+ * - "encrypted" → JWE only. (e.g. A256GCM with RSA-OAEP key wrapping).
+ * - "sealed"    → JWS nested inside JWE (signed then encrypted).
+ */
+type JWTMode = "signed" | "encrypted" | "sealed";
+/**
+ * Signing algorithms for "signed" and "sealed" modes.
+ * Symmetric: HS256 | HS384 | HS512
+ * Asymmetric: RS256 | RS384 | RS512 | ES256 | ES384 | ES512 | EdDSA | PS256
+ */
+type JWTSigningAlgorithm = "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "EdDSA" | "PS256";
+/**
+ * Key-wrapping algorithms for "encrypted" and "sealed" modes.
+ * Symmetric: A128KW | A192KW | A256KW | dir (direct)
+ * ECDH:      ECDH-ES | ECDH-ES+A128KW | ECDH-ES+A256KW
+ * RSA:       RSA-OAEP | RSA-OAEP-256
+ */
+type JWTKeyAlgorithm = "A128KW" | "A192KW" | "A256KW" | "dir" | "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A256KW" | "RSA-OAEP" | "RSA-OAEP-256";
+/** Content-encryption algorithms for JWE. */
+type JWTEncryptionAlgorithm = "A128CBC-HS256" | "A192CBC-HS384" | "A256CBC-HS512" | "A128GCM" | "A192GCM" | "A256GCM";
+/** Signed JWT mode configuration. */
+type JWTSignedMode = {
+  mode: "signed";
+  signingAlgorithm?: JWTSigningAlgorithm;
+};
+/** Encrypted JWT mode configuration. */
+type JWTEncryptedMode = {
+  mode: "encrypted";
+  keyAlgorithm?: JWTKeyAlgorithm;
+  encryptionAlgorithm?: JWTEncryptionAlgorithm;
+};
+/** Signed and Encrypted JWT mode configuration. */
+type JWTSealedMode = {
+  mode?: "sealed";
+  signingAlgorithm?: JWTSigningAlgorithm;
+  keyAlgorithm?: JWTKeyAlgorithm;
+  encryptionAlgorithm?: JWTEncryptionAlgorithm;
+};
+/** Discriminated union of JWT wire format: signed JWS, encrypted JWE, or nested sealed (JWS in JWE). */
+type JWTConfigBase = JWTSignedMode | JWTEncryptedMode | JWTSealedMode;
+/** How session/JWT lifetime is enforced relative to `iat`, absolute caps, and sliding windows. */
+type JWTExpirationStrategy = "fixed" | "rolling" | "absolute" | "sliding";
+type JWTConfig = Prettify<{
+  /**
+   * Token lifetime.
+   */
+  maxAge?: number;
+  /**
+   * JWT `iss` (issuer) claim. Set this to your app's canonical URL.
+   * @example "https://auth.example.com"
+   */
+  issuer?: string;
+  /**
+   * JWT `aud` claim. Single value or array for multi-audience tokens.
+   * @example ["https://api.example.com", "https://app.example.com"]
+   */
+  audience?: string | string[];
+  /**
+   * Maximum absolute session duration in seconds.
+   * Required for "absolute" and "sliding" strategies.
+   * Enforced via jose's maxTokenAge against the iat claim.
+   */
+  maxExpiration?: number;
+  /**
+   * Policy for renewing or capping token lifetime (pairs with `maxExpiration` where applicable).
+   */
+  expirationStrategy?: JWTExpirationStrategy;
+} & JWTConfigBase>;
+/**
+ * Stateless JWT strategy.
+ * No database required. Tokens are self-contained and cannot be revoked
+ * before they expire — keep `jwt.maxAge` short or enable refresh tokens.
+ *
+ * @example
+ * {
+ *   strategy: "jwt",
+ *   jwt: { mode: "sealed", maxAge: "15m", issuer: "https://auth.example.com" },
+ *   refreshToken: { enabled: true, maxAge: "7d" },
+ * }
+ */
+type StatelessStrategyConfig = {
+  strategy?: "jwt";
+  jwt?: JWTConfig;
+};
+/**
+ * The session strategy. Determines which fields below are required.
+ *
+ * - "jwt": stateless. No database needed. JWTs are self-contained.
+ * - "database": stateful. Every request hits the DB to validate the session.
+ * - "hybrid": JWT transport + DB revocation. Best of both for most apps.
+ *
+ * @default "jwt"
+ */
+type SessionConfig = StatelessStrategyConfig;
+/** Result of reading a stateless (JWT) session from a request: session payload and outgoing header mutations. */
+interface GetStatelessSessionReturn<DefaultUser extends User = User> {
+  session: Session<DefaultUser> | null;
+  headers: Headers;
+}
+/**
+ * Abstraction layer for session management.
+ */
+interface SessionStrategy<DefaultUser extends User = User> {
+  /**
+   * Read and validate the session from an incoming request.
+   * Returns null if absent, invalid, or expired. Never throws on auth failure.
+   */
+  getSession(request: Headers): Promise<GetStatelessSessionReturn<DefaultUser>>;
+  /**
+   * Create a session after successful authentication.
+   * Signs the JWT / writes the DB row / sets cookies.
+   */
+  createSession(session: User): Promise<string>;
+  /**
+   * Attempt to refresh using the refresh token cookie.
+   * Returns null session + cookie-clearing response on any failure.
+   */
+  refreshSession(headers: Headers, session: DeepPartial<Session<DefaultUser>>, skipCSRFCheck?: boolean): Promise<{
+    session: Session<DefaultUser> | null;
+    headers: Headers;
+  }>;
+  /**
+   * Revoke a session by ID.
+   * JWT strategy: best-effort (clears cookies, no server state).
+   * Database / hybrid: marks row inactive.
+   */
+  revokeSession(sessionId: string): Promise<void>;
+  /**
+   * Destroy the session attached to this request (logout).
+   * Returns a response that clears cookies.
+   */
+  destroySession(request: Headers, skipCSRFCheck?: boolean): Promise<Headers>;
+}
+/** Inputs for constructing a session strategy implementation for a given identity schema. */
+interface CreateSessionStrategyOptions<Identity extends Identities> {
+  config?: SessionConfig;
+  jose: JoseInstance<FromShapeToObject<Identity> & User>;
+  cookies: () => CookieStoreConfig;
+  logger?: InternalLogger;
+  identity: SchemaRegistryContext;
+}
+/** Options specialized for the JWT-backed session strategy. */
+interface JWTStrategyOptions<DefaultUser extends User = User> {
+  config?: StatelessStrategyConfig;
+  jose: JoseInstance<DefaultUser>;
+  logger?: InternalLogger;
+  cookies: () => CookieStoreConfig;
+  identity: SchemaRegistryContext;
+}
+/** Minimal token issue/verify surface used by session code paths. */
+type JWTManager<DefaultUser extends User = User> = {
+  createToken(user: TypedJWTPayload<Partial<DefaultUser>>): Promise<string>;
+  verifyToken(token: string): Promise<TypedJWTPayload<DefaultUser>>;
+};
+//#endregion
+//#region src/@types/oidc.d.ts
+/**
+ * @link https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
+ */
+interface OpenIDMetadata {
+  /**
+   * URL using the https scheme with no query or fragment component that the
+   * OP asserts as its Issuer Identifier.
+   */
+  issuer: string;
+  /**
+   * URL of the OP's OAuth 2.0 Authorization Endpoint
+   */
+  authorization_endpoint: string;
+  /**
+   * URL of the OP's OAuth 2.0 Token Endpoint
+   */
+  token_endpoint: string;
+  /**
+   * URL of the OP's UserInfo Endpoint.
+   */
+  userinfo_endpoint: string;
+  /**
+   * URL of the OP's JSON Web Key Set [JWK] document. This contains the signing keys
+   * used by the OP to sign tokens issued, which may be used by the RP to validate
+   * signatures.
+   */
+  jwks_uri: string;
+  /**
+   * URL of the OP's Dynamic Client Registration Endpoint. This is REQUIRED unless
+   * the OP does not support dynamic client registration, in which case it MUST NOT
+   * be included.
+   */
+  registration_endpoint?: string;
+  /**
+   * JSON arry containing a list of the OP's supported Subject Identifier types.
+   * Valid types include pairwise and public.
+   */
+  scopes_supported?: string[];
+  /**
+   * Json array containing a list of the OP's supported response types. Valid response
+   * types include code, id_token, and token. The OP MUST support the code response type.
+   */
+  response_types_supported?: string[];
+  /**
+   * JSON array containing a list of the OP's supported response modes. Valid response
+   * modes include query, fragment, and form_post. If omitted, the default is that the
+   * OP supports only the query response mode.
+   */
+  response_modes_supported?: string[];
+  /**
+   * JSON array containing a list of the OP's supported grant types. Valid grant types
+   * include authorization_code, implicit, refresh_token, and client_credentials.
+   * If omitted, the default is that the OP supports only the authorization_code
+   * grant type.
+   */
+  grant_types_supported?: string[];
+  /**
+   * JSON array containing a list of the OP's supported ACR values. If omitted, the
+   * default is that the OP does not support any ACR values.
+   */
+  acr_values_supported?: string[];
+  /**
+   * JSON array containing a list of the OP's supported Subject Identifier types.
+   * Valid types include pairwise and public.
+   */
+  subject_types_supported: string[];
+  /**
+   * JSON array containing a list of the OP's supported ID Token signing algorithms.
+   * The only algorithm that MUST be supported is RS256. The OP SHOULD support
+   * additional algorithms, such as ES256.
+   */
+  id_token_signing_alg_values_supported: string[];
+  /**
+   * JSON array containing a list of the OP's supported ID Token encryption algorithms.
+   * The OP MUST support the RSA1_5 algorithm. The OP SHOULD support additional
+   * algorithms, such as A128KW and A256KW.
+   */
+  id_token_encryption_alg_values_supported?: string[];
+  /**
+   * JSON array containing a list of the OP's supported ID Token encryption encodings.
+   * The OP MUST support the A128CBC-HS256 encoding. The OP SHOULD support additional
+   * encodings, such as A256CBC-HS512 and A128GCM.
+   */
+  id_token_encryption_enc_values_supported?: string[];
+  /**
+   * JSON array containing a list of the OP's supported UserInfo signing algorithms.
+   * The OP SHOULD support RS256 or ES256, or both. The OP SHOULD support none, one,
+   * or more additional signing algorithms.
+   */
+  userinfo_signing_alg_values_supported?: string[];
+  /**
+   * JSON array containing a list of the OP's supported UserInfo encryption algorithms.
+   * The OP SHOULD support the RSA1_5 algorithm. The OP SHOULD support additional
+   * algorithms, such as A128KW and A256KW.
+   */
+  userinfo_encryption_alg_values_supported?: string[];
+  /**
+   * JSON array containing a list of the OP's supported UserInfo encryption encodings.
+   * The OP SHOULD support the A128CBC-HS256 encoding. The OP SHOULD support additional
+   * encodings, such as A256CBC-HS512 and A128GCM.
+   */
+  userinfo_encryption_enc_values_supported?: string[];
+  /**
+   * JSON array containing a list of the OP's supported Request Object signing algorithms.
+   * The OP SHOULD support RS256 or ES256, or both. The OP SHOULD support none, one, or
+   * more additional signing algorithms.
+   */
+  request_object_signing_alg_values_supported?: string[];
+  /**
+   * JSON array containing a list of the OP's supported Request Object encryption algorithms.
+   * The OP SHOULD support the RSA1_5 algorithm. The OP SHOULD support additional algorithms,
+   * such as A128KW and A256KW.
+   */
+  request_object_encryption_alg_values_supported?: string[];
+  /**
+   * JSON array containing a list of the OP's supported Request Object encryption encodings.
+   * The OP SHOULD support the A128CBC-HS256 encoding. The OP SHOULD support additional
+   * encodings, such as A256CBC-HS512 and A128GCM.
+   */
+  request_object_encryption_enc_values_supported?: string[];
+  /**
+   * JSON array containing a list of the OP's supported Token Endpoint authentication methods.
+   * Valid methods include client_secret_post, client_secret_basic, client_secret_jwt, and
+   * private_key_jwt. The OP MUST support client_secret_basic and client_secret_post.
+   */
+  token_endpoint_auth_methods_supported?: string[];
+  /**
+   * JSON array containing a list of the OP's supported Token Endpoint authentication signing
+   * algorithms. The OP MUST support RS256. The OP SHOULD support additional algorithms, such
+   * as ES256.
+   */
+  token_endpoint_auth_signing_alg_values_supported?: string[];
+  /**
+   * JSON array containing a list of the OP's supported display parameter values. Valid values
+   * include page, popup, touch, and wap. If omitted, the default is that the OP supports only
+   * the page display parameter value.
+   */
+  display_values_supported?: string[];
+  /**
+   * JSON array containing a list of the OP's supported claim types. Valid types include normal
+   * and aggregated. If omitted, the default is that the OP supports only the normal claim type.
+   */
+  claim_types_supported?: string[];
+  /**
+   * JSON array containing a list of the OP's supported claims. These are the claims that the
+   * OP may be able to supply values for. Note that the individual claims supported by the OP
+   * need not be listed here, and that this element is intended primarily to provide a mechanism
+   * for listing those claims that are typically returned by the OP's UserInfo Endpoint.
+   */
+  claims_supported?: string[];
+  /**
+   * URL of a page containing human-readable information that developers might want or need to
+   * know when using the OP. In particular, if the OP does not support dynamic client registration,
+   * then information on how to register clients needs to be provided in this documentation.
+   */
+  service_documentation?: string;
+  /**
+   * Languages and scripts supported for values in Claims
+   */
+  claims_locales_supported?: string[];
+  /**
+   * Languages and scripts supported for the user interface, represented as a JSON array of
+   * BCP47 [RFC5646] language tag values. If omitted, the default is that the OP supports
+   * only the en-US locale.
+   */
+  ui_locales_supported?: string[];
+  /**
+   * Boolean value specifying whether the OP supports use of the claims parameter, with true
+   * indicating support. If omitted, the default is that the OP does not support use of the
+   * claims parameter.
+   */
+  claims_parameter_supported?: boolean;
+  /**
+   * Boolean value specifying whether the OP supports use of the request parameter, with true
+   * indicating support. If omitted, the default is that the OP does not support use of the
+   * request parameter.
+   */
+  request_parameter_supported?: boolean;
+  /**
+   * Boolean value specifying whether the OP supports use of the request_uri parameter, with
+   * true indicating support. If omitted, the default is that the OP does not support use of
+   * the request_uri parameter.
+   */
+  request_uri_parameter_supported?: boolean;
+  /**
+   * Boolean value specifying whether the OP requires any request_uri values used to be
+   * pre-registered using the request_uris registration parameter, with true indicating
+   * that any such request_uri values need to be pre-registered. If omitted, the default
+   * is that the OP does not require pre-registration of request_uri values.
+   */
+  require_request_uri_registration?: boolean;
+  /**
+   * URL that the OpenID Provider provides to the person registering the Client to read
+   * about the OP's requirements on how the client can use the request_uri parameter. The
+   * registration process SHOULD display this URL to the person registering the Client if
+   * the OP requires pre-registration of request_uri values.
+   */
+  op_policy_uri?: string;
+  /**
+   * URL that the OpenID Provider provides to the person registering the Client to read
+   * about the OP's terms of service. The registration process SHOULD display this URL to
+   * the person registering the Client if the OP provides such a URL.
+   */
+  op_tos_uri?: string;
+}
+type OpenIDProvider<Profile extends object = Record<string, any>, DefaultUser = User, Issuer extends string = string> = {
+  id: string;
+  name: string;
+  /**
+   * URL to concatenating the string /.well-known/openid-configuration to the Issuer.
+   */
+  issuer: Issuer;
+  clientId?: string;
+  clientSecret?: string;
+  /**
+   * Override the default OIDC scope (`openid profile email`).
+   */
+  scope?: string;
+  profile?: (profile: Profile) => DefaultUser | Promise<DefaultUser>;
+} & GetRouteParams<`/${Issuer}`>;
+//#endregion
 //#region src/oauth/index.d.ts
 declare const builtInOAuthProviders: {
   readonly github: <DefaultUser extends User = {
@@ -1238,20 +1968,46 @@ declare const builtInOAuthProviders: {
     name?: string | null | undefined;
     image?: string | null | undefined;
     email?: string | null | undefined;
-  }>(options?: Partial<OAuthProviderCredentials<AtlassianProfile, DefaultUser>>) => OAuthProviderCredentials<AtlassianProfile, DefaultUser>;
-  readonly clickUp: <DefaultUser extends User = {
+  }>(options?: Partial<OAuthProviderCredentials<AtlassianProfile, DefaultUser>>) => OAuthProviderCredentials<AtlassianProfile, DefaultUser>;
+  readonly clickUp: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<ClickUpProfile, DefaultUser>>) => OAuthProviderCredentials<ClickUpProfile, DefaultUser>;
+  readonly dribbble: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<DribbbleProfile, DefaultUser>>) => OAuthProviderCredentials<DribbbleProfile, DefaultUser>;
+  readonly hubspot: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: OAuthProviderConfig<HubSpotProfile, DefaultUser>) => OAuthProviderConfig<HubSpotProfile, DefaultUser>;
+  readonly google: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OpenIDProvider<GoogleProfile, DefaultUser>>) => OpenIDProvider<GoogleProfile, DefaultUser>;
+  readonly huggingface: <DefaultUser extends User = {
     sub: string;
     name?: string | null | undefined;
     image?: string | null | undefined;
     email?: string | null | undefined;
-  }>(options?: Partial<OAuthProviderCredentials<ClickUpProfile, DefaultUser>>) => OAuthProviderCredentials<ClickUpProfile, DefaultUser>;
-  readonly dribbble: <DefaultUser extends User = {
+  }>(options?: Partial<OpenIDProvider<HuggingFaceProfile, DefaultUser>>) => OpenIDProvider<HuggingFaceProfile, DefaultUser>;
+  readonly authentik: <DefaultUser extends User = {
     sub: string;
     name?: string | null | undefined;
     image?: string | null | undefined;
     email?: string | null | undefined;
-  }>(options?: Partial<OAuthProviderCredentials<DribbbleProfile, DefaultUser>>) => OAuthProviderCredentials<DribbbleProfile, DefaultUser>;
+  }>(options?: Partial<OpenIDProvider<AuthentikProfile, DefaultUser>>) => OpenIDProvider<AuthentikProfile, DefaultUser>;
 };
+declare const setDynamicParams: <const T extends string, P extends Record<string, unknown>>(template: T, params: P) => string;
+declare const defineOpenIDProviderConfig: (config: OpenIDProvider) => RuntimeOAuthProvider;
 /**
  * Constructs OAuth provider configurations from an array of provider names or configurations.
  * It loads the client ID and client secret from environment variables if only the provider name is provided.
@@ -1265,200 +2021,50 @@ declare const builtInOAuthProviders: {
  * // Using built-in provider with explicit credentials via factory
  * createBuiltInOAuthProviders([github({ clientId: "...", clientSecret: "..." })])
  */
-declare const createBuiltInOAuthProviders: (oauth?: (BuiltInOAuthProvider | OAuthProviderCredentials<any>)[]) => Record<LiteralUnion<BuiltInOAuthProvider>, OAuthProviderCredentials<any>>;
+declare const createBuiltInOAuthProviders: (oauth?: (BuiltInOAuthProvider | RuntimeOAuthProvider<any> | OpenIDProvider)[]) => Record<LiteralUnion<BuiltInOAuthProvider>, RuntimeOAuthProvider<any>>;
 type BuiltInOAuthProvider = keyof typeof builtInOAuthProviders;
 //#endregion
-//#region src/@types/session.d.ts
-/** Application user type, inferred from the configured identity schema (defaults to the built-in user shape). */
-type User = infer$1<typeof UserIdentity>;
-/**
- * Session data returned by the session endpoint.
- */
-interface Session<DefaultUser extends User = User> {
-  user: DefaultUser;
-  expires: string;
-}
-interface CryptoSecret {
-  sign: CryptoKey | CryptoKeyPair | JWK | JsonWebKey | AsymmetricKeyPair;
-  encrypt: CryptoKey | CryptoKeyPair | JWK | JsonWebKey | AsymmetricKeyPair;
-}
-interface AsymmetricKeyPairFromEnv {
-  publicKey: string;
-  privateKey: string;
-}
-interface AsymmetricKeyPair {
-  publicKey: CryptoKey | JWK;
-  privateKey: CryptoKey | JWK;
-}
-/**
- * A symmetric secret or asymmetric key pair used for JWT operations.
- *
- * - string / Uint8Array: used as-is for HMAC (signed) or AES (encrypted)
- * - CryptoKey: Web Crypto API key, for environments that support it
- * - CryptoKeyPair: asymmetric signing/encryption (RS256, ES256, EdDSA, RSA-OAEP, etc.)
- */
-type SecretKey = string | Uint8Array | CryptoKey | CryptoKeyPair | CryptoSecret | JWK | AsymmetricKeyPair;
-/**
- * @todo: add key rotation support for "SecretKey | CryptoKeyPair | [SecretKey | CryptoKeyPair, ...(SecretKey | CryptoKeyPair)[]]"
- */
-type JWTKey = SecretKey;
-/**
- * - "signed"    → standard JWS (e.g. HS256, RS256, ES256).
- * - "encrypted" → JWE only. (e.g. A256GCM with RSA-OAEP key wrapping).
- * - "sealed"    → JWS nested inside JWE (signed then encrypted).
- */
-type JWTMode = "signed" | "encrypted" | "sealed";
-/**
- * Signing algorithms for "signed" and "sealed" modes.
- * Symmetric: HS256 | HS384 | HS512
- * Asymmetric: RS256 | RS384 | RS512 | ES256 | ES384 | ES512 | EdDSA | PS256
- */
-type JWTSigningAlgorithm = "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "EdDSA" | "PS256";
-/**
- * Key-wrapping algorithms for "encrypted" and "sealed" modes.
- * Symmetric: A128KW | A192KW | A256KW | dir (direct)
- * ECDH:      ECDH-ES | ECDH-ES+A128KW | ECDH-ES+A256KW
- * RSA:       RSA-OAEP | RSA-OAEP-256
- */
-type JWTKeyAlgorithm = "A128KW" | "A192KW" | "A256KW" | "dir" | "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A256KW" | "RSA-OAEP" | "RSA-OAEP-256";
-/** Content-encryption algorithms for JWE. */
-type JWTEncryptionAlgorithm = "A128CBC-HS256" | "A192CBC-HS384" | "A256CBC-HS512" | "A128GCM" | "A192GCM" | "A256GCM";
-/** Signed JWT mode configuration. */
-type JWTSignedMode = {
-  mode: "signed";
-  signingAlgorithm?: JWTSigningAlgorithm;
-};
-/** Encrypted JWT mode configuration. */
-type JWTEncryptedMode = {
-  mode: "encrypted";
-  keyAlgorithm?: JWTKeyAlgorithm;
-  encryptionAlgorithm?: JWTEncryptionAlgorithm;
+//#region src/@types/oauth.d.ts
+type OAuthAccessTokenResponseType = infer$1<typeof OAuthAccessTokenResponse>;
+type OIDCAccessTokenResponseType = infer$1<typeof OIDCAccessTokenResponseSchema>;
+type OIDCProviderContext = {
+  issuer: string;
+  jwks_uri?: string;
 };
-/** Signed and Encrypted JWT mode configuration. */
-type JWTSealedMode = {
-  mode?: "sealed";
-  signingAlgorithm?: JWTSigningAlgorithm;
-  keyAlgorithm?: JWTKeyAlgorithm;
-  encryptionAlgorithm?: JWTEncryptionAlgorithm;
+type RuntimeOAuthProvider<Profile extends object = Record<string, any>, DefaultUser extends User = User> = OAuthProviderCredentials<Profile, DefaultUser> & {
+  oidc?: OIDCProviderContext;
 };
-/** Discriminated union of JWT wire format: signed JWS, encrypted JWE, or nested sealed (JWS in JWE). */
-type JWTConfigBase = JWTSignedMode | JWTEncryptedMode | JWTSealedMode;
-/** How session/JWT lifetime is enforced relative to `iat`, absolute caps, and sliding windows. */
-type JWTExpirationStrategy = "fixed" | "rolling" | "absolute" | "sliding";
-type JWTConfig = Prettify<{
-  /**
-   * Token lifetime.
-   */
-  maxAge?: number;
-  /**
-   * JWT `iss` (issuer) claim. Set this to your app's canonical URL.
-   * @example "https://auth.example.com"
-   */
-  issuer?: string;
-  /**
-   * JWT `aud` claim. Single value or array for multi-audience tokens.
-   * @example ["https://api.example.com", "https://app.example.com"]
-   */
-  audience?: string | string[];
+type AccessTokenContext = {
   /**
-   * Maximum absolute session duration in seconds.
-   * Required for "absolute" and "sliding" strategies.
-   * Enforced via jose's maxTokenAge against the iat claim.
-   */
-  maxExpiration?: number;
-  /**
-   * Policy for renewing or capping token lifetime (pairs with `maxExpiration` where applicable).
+   * Access token string returned by the OAuth provider's token endpoint. The token
+   * must be used to exchange for user information from the provider's userinfo endpoint.
    */
-  expirationStrategy?: JWTExpirationStrategy;
-} & JWTConfigBase>;
-/**
- * Stateless JWT strategy.
- * No database required. Tokens are self-contained and cannot be revoked
- * before they expire — keep `jwt.maxAge` short or enable refresh tokens.
- *
- * @example
- * {
- *   strategy: "jwt",
- *   jwt: { mode: "sealed", maxAge: "15m", issuer: "https://auth.example.com" },
- *   refreshToken: { enabled: true, maxAge: "7d" },
- * }
- */
-type StatelessStrategyConfig = {
-  strategy?: "jwt";
-  jwt?: JWTConfig;
-};
-/**
- * The session strategy. Determines which fields below are required.
- *
- * - "jwt": stateless. No database needed. JWTs are self-contained.
- * - "database": stateful. Every request hits the DB to validate the session.
- * - "hybrid": JWT transport + DB revocation. Best of both for most apps.
- *
- * @default "jwt"
- */
-type SessionConfig = StatelessStrategyConfig;
-/** Result of reading a stateless (JWT) session from a request: session payload and outgoing header mutations. */
-interface GetStatelessSessionReturn<DefaultUser extends User = User> {
-  session: Session<DefaultUser> | null;
-  headers: Headers;
-}
-/**
- * Abstraction layer for session management.
- */
-interface SessionStrategy<DefaultUser extends User = User> {
+  accessToken: string;
   /**
-   * Read and validate the session from an incoming request.
-   * Returns null if absent, invalid, or expired. Never throws on auth failure.
+   * The access token type returned by the OAuth provider's token endpoint, typically "Bearer".
    */
-  getSession(request: Headers): Promise<GetStatelessSessionReturn<DefaultUser>>;
+  tokenType?: string | undefined;
   /**
-   * Create a session after successful authentication.
-   * Signs the JWT / writes the DB row / sets cookies.
+   * The number of seconds until the access token expires, as returned by the OAuth provider's
+   * token endpoint.
    */
-  createSession(session: User): Promise<string>;
+  expiresIn?: number | undefined;
   /**
-   * Attempt to refresh using the refresh token cookie.
-   * Returns null session + cookie-clearing response on any failure.
+   * Optional refresh token returned by the OAuth provider's token endpoint, which can be
+   * used to obtain a new access token when the current one expires.
    */
-  refreshSession(headers: Headers, session: DeepPartial<Session<DefaultUser>>, skipCSRFCheck?: boolean): Promise<{
-    session: Session<DefaultUser> | null;
-    headers: Headers;
-  }>;
+  refreshToken?: string | undefined;
   /**
-   * Revoke a session by ID.
-   * JWT strategy: best-effort (clears cookies, no server state).
-   * Database / hybrid: marks row inactive.
+   * The scopes granted by the user for the access token, as returned by the OAuth provider's
+   * token endpoint.
    */
-  revokeSession(sessionId: string): Promise<void>;
+  scope?: string | string[] | null | undefined;
   /**
-   * Destroy the session attached to this request (logout).
-   * Returns a response that clears cookies.
+   * The userinfo endpoint URL of the OAuth provider. This is required to fetch user
+   * information using the access token.
    */
-  destroySession(request: Headers, skipCSRFCheck?: boolean): Promise<Headers>;
-}
-/** Inputs for constructing a session strategy implementation for a given identity schema. */
-interface CreateSessionStrategyOptions<Identity extends Identities> {
-  config?: SessionConfig;
-  jose: JoseInstance<FromShapeToObject<Identity> & User>;
-  cookies: () => CookieStoreConfig;
-  logger?: InternalLogger;
-  identity: SchemaRegistryContext;
-}
-/** Options specialized for the JWT-backed session strategy. */
-interface JWTStrategyOptions<DefaultUser extends User = User> {
-  config?: StatelessStrategyConfig;
-  jose: JoseInstance<DefaultUser>;
-  logger?: InternalLogger;
-  cookies: () => CookieStoreConfig;
-  identity: SchemaRegistryContext;
-}
-/** Minimal token issue/verify surface used by session code paths. */
-type JWTManager<DefaultUser extends User = User> = {
-  createToken(user: TypedJWTPayload<Partial<DefaultUser>>): Promise<string>;
-  verifyToken(token: string): Promise<TypedJWTPayload<DefaultUser>>;
+  userInfoURL: string;
 };
-//#endregion
-//#region src/@types/oauth.d.ts
 /** Known query parameter names supported when building an OAuth authorization URL. */
 type AuthorizeParams = LiteralUnion<"clientId" | "prompt" | "scope" | "responseMode" | "audience" | "loginHint" | "nonce" | "display">;
 /** OAuth 2.0 `response_type` values used in authorization requests. */
@@ -1489,6 +2095,9 @@ interface OAuthProviderConfig<Profile extends object = Record<string, any>, Defa
     url: string;
     headers?: Record<string, string>;
     method?: string;
+  } | {
+    url: string;
+    request: (context: AccessTokenContext) => Profile | Promise<Profile>;
   };
   /**
    * @deprecated
@@ -1518,14 +2127,17 @@ type OAuthProvider<Profile extends object = Record<string, any>, DefaultUser ext
  * Lookup table of configured OAuth providers keyed by built-in id or custom id.
  * Values are full credential configs used at runtime for authorize/token/userinfo.
  */
-type OAuthProviderRecord<DefaultUser extends User = User> = Record<LiteralUnion<BuiltInOAuthProvider>, OAuthProviderCredentials<any, DefaultUser>>;
+type OAuthProviderRecord<DefaultUser extends User = User> = Record<LiteralUnion<BuiltInOAuthProvider>, RuntimeOAuthProvider<any, DefaultUser>>;
+type CustomUserInfoFunction = Extract<OAuthProviderConfig["userInfo"], {
+  request: (context: AccessTokenContext) => any;
+}>;
 //#endregion
 //#region src/@types/config.d.ts
 /**
  * Main configuration interface for Aura Auth.
  * This is the user-facing configuration object passed to `createAuth()`.
  */
-type AuthConfig<Identity extends Identities> = {
+type AuthConfig<Identity extends Identities, SignUpSchema extends SchemaTypes = ZodObject$1<any>> = {
   /**
    * OAuth providers available in the authentication and authorization flows. It provides a type-inference
    * for the OAuth providers that are supported by Aura Stack Auth; alternatively, you can provide a custom
@@ -1556,7 +2168,7 @@ type AuthConfig<Identity extends Identities> = {
    * ]
    * ```
    */
-  oauth: (BuiltInOAuthProvider | OAuthProviderCredentials<any, FromShapeToObject<Identity>>)[];
+  oauth: (BuiltInOAuthProvider | OAuthProviderCredentials<any, FromShapeToObject<Identity>> | OpenIDProvider<any, FromShapeToObject<Identity>>)[];
   /**
    * Cookie options defines the configuration for cookies used in Aura Auth.
    * It includes a prefix for cookie names and flag options to determine
@@ -1667,6 +2279,15 @@ type AuthConfig<Identity extends Identities> = {
    * Credentials provider for username/password or similar authentication.
    */
   credentials?: CredentialsProvider<Identity>;
+  /**
+   * Configuration for the signUp process, including the schema for validation
+   * and required callback for user creation.
+   */
+  signUp?: SignUpConfig<Identity, SignUpSchema>;
+  /**
+   * Rate limiter configuration to protect authentication endpoints from DoS/DDoS attacks.
+   */
+  rateLimiter?: RateLimiterConfig$1;
 } & TrustedProxyHeadersConfig;
 type TrustedProxyHeadersConfig = {
   /**
@@ -1783,7 +2404,7 @@ type CookieStrategyAttributes = StandardCookie | SecureCookie | HostCookie;
  * - `redirectURI`: OAuth callback URI
  * - `redirectTo`: Post-authentication redirect path
  */
-type CookieName = "sessionToken" | "csrfToken" | "state" | "codeVerifier" | "redirectTo" | "redirectURI";
+type CookieName = "sessionToken" | "csrfToken" | "state" | "codeVerifier" | "redirectTo" | "redirectURI" | "nonce";
 /** Resolved cookie names and serialization attributes for each logical auth cookie. */
 type CookieStoreConfig = Record<CookieName, {
   name: string;
@@ -1838,7 +2459,7 @@ interface Logger {
  * Programmatic auth API returned with the auth instance: `getSession`, `signIn`, `signInCredentials`, `signOut`, `updateSession`.
  * Each method returns a result object plus `headers` and `toResponse()` for HTTP responses.
  */
-type AuthAPI<DefaultUser extends User = User> = ReturnType<typeof createAuthAPI<DefaultUser>>;
+type AuthAPI<DefaultUser extends User = User, SignUpSchema extends SchemaTypes = ZodObject$1<any>> = ReturnType<typeof createAuthAPI<DefaultUser, SignUpSchema>>;
 /** JWT and crypto helpers bound to the configured identity schema (sign, verify, claims). */
 type JoseInstance<DefaultUser extends User = User> = ReturnType<typeof createJoseInstance<DefaultUser>>;
 /** Normalized internal logger with resolved level and structured log function. */
@@ -1895,7 +2516,7 @@ interface CredentialsProvider<Identity extends Identities> {
  * Runtime context passed into auth actions and API handlers: OAuth map, cookies, JWT, session strategy, trusted origins, etc.
  * This is the fully resolved configuration surface after `createAuth` initializes defaults.
  */
-interface RouterGlobalContext<DefaultUser extends User = User> {
+interface RouterGlobalContext<DefaultUser extends User = User, SignUpSchema extends SchemaTypes = ZodObject$1<any>> {
   oauth: OAuthProviderRecord;
   credentials?: CredentialsProvider<any>;
   cookies: CookieStoreConfig;
@@ -1908,6 +2529,9 @@ interface RouterGlobalContext<DefaultUser extends User = User> {
   logger?: InternalLogger;
   sessionStrategy: SessionStrategy<DefaultUser>;
   identity: SchemaRegistryContext;
+  signUp?: SignUpConfig<DefaultUser, SignUpSchema>;
+  jwtManager: JWTManager<DefaultUser>;
+  rateLimiters: InferRules<Required<RateLimiterConfig$1>>;
 }
 interface SchemaRegistryContext {
   schemaRegistry: ReturnType<typeof createSchemaRegistry>;
@@ -1922,11 +2546,11 @@ type AuthRuntimeConfig<DefaultUser extends User = User> = RouterGlobalContext<De
 /**
  * Public auth instance: programmatic {@link AuthAPI}, {@link JoseInstance}, and HTTP {@link AuthClient} handlers.
  */
-interface AuthInstance<DefaultUser extends User = User> {
+interface AuthInstance<DefaultUser extends User = User, SignUpSchema extends SchemaTypes = ZodObject$1<any>> {
   /**
    * Programmatic API for authentication actions (getSession, signIn, signOut, etc.) that can be used in server-side contexts or API routes.
    */
-  api: AuthAPI<DefaultUser>;
+  api: AuthAPI<DefaultUser, SignUpSchema>;
   /**
    * JOSE helper functions for signin, encryption and verification of JWTs.
    */
@@ -1944,12 +2568,32 @@ interface AuthInstance<DefaultUser extends User = User> {
 /**
  * Extended context used inside the library with both secure and standard cookie materializations.
  */
-type InternalContext<Identity extends Identities> = RouterGlobalContext<FromShapeToObject<Identity> & User> & {
+type InternalContext<Identity extends Identities, SignUpSchema extends SchemaTypes> = RouterGlobalContext<FromShapeToObject<Identity>, SignUpSchema> & {
   cookieConfig: {
     secure: CookieStoreConfig;
     standard: CookieStoreConfig;
   };
 };
+interface OnCreateUserContext<Schema extends SchemaTypes> {
+  payload: InferSchema<Schema>;
+}
+/**
+ * Configuration for the signUp process, including the schema for validation
+ * and required callback for user creation.
+ */
+interface SignUpConfig<Identity extends Identities, SignUpSchema extends SchemaTypes> {
+  /**
+   * Optional schema for validating the sign-up payload. It supports any
+   * Zod, Arktype, Valibot or Typebox schema.
+   */
+  schema?: SignUpSchema;
+  /**
+   * Callback function that is called when a new user signs up. It receives the validated
+   * sign-up payload and must handle the user creation.
+   */
+  onCreateUser: (context: OnCreateUserContext<SignUpSchema>) => Promise<FromShapeToObject<Identity> | null> | FromShapeToObject<Identity> | null;
+}
+type RateLimiterConfig$1 = Partial<RateLimiterConfig<Record<"signIn" | "signInCredentials" | "updateSession" | "signUp", RateLimiterRule>>["rules"]>;
 //#endregion
 //#region src/@types/utility.d.ts
 /** Expands intersection types into a single flat object type for readable editor hints. */
@@ -1981,6 +2625,20 @@ type Merge<A, B> = Omit<A, keyof B> & B;
  */
 type ZodShapeToObject<S extends ZodRawShape = ZodRawShape> = Merge<__Infer<ZodObject<S>>, User>;
 type FromShapeToObject<S> = S extends ZodRawShape ? ZodShapeToObject<S> : S extends ObjectEntries ? ValibotShapeToObject<S> : S extends Type ? ArktypeShapeToObject<S> : S extends TProperties ? TypeboxShapeToObject<S> : S extends User ? S : never;
+type EditableToSchema<T> = T extends EditableShape<infer S> ? ZodObject<S> : T extends EditableShapeValibot<infer S> ? ObjectSchema<S, undefined> : T extends EditableShapeTypebox<infer S> ? TObject<S> : T extends EditableShapeArkType<any> ? T : never;
+type ReturnUpdateSessionShape<T> = T extends EditableShape<infer S> ? ZodObject<{
+  user?: ZodObject<S>;
+  expires?: ZodOptional<ZodTypeAny>;
+}> : T extends EditableShapeValibot<infer S> ? ObjectSchema<{
+  user?: ObjectSchema<S, undefined>;
+  expires?: BaseSchema<any, any, any>;
+}, undefined> : T extends EditableShapeArkType<any> ? Type<{
+  user?: T;
+  expires?: Type<string>;
+}> : T extends EditableShapeTypebox<infer S> ? TObject<{
+  user?: TObject<S>;
+  expires?: TSchema;
+}> : never;
 /** Recursively makes every property required. */
 type DeepRequired<T> = { [K in keyof T]-?: T[K] extends object ? DeepRequired<T[K]> : T[K] };
 /** Recursively makes every property optional. */
@@ -2030,7 +2688,7 @@ type InferZodShape<T extends ZodObject> = T["shape"];
  *
  * type User = UserFrom<typeof schema>
  */
-type UserFrom<T extends ZodObject> = Prettify<ZodShapeToObject<InferZodShape<T>>>;
+type UserFrom<T extends SchemaTypes> = Prettify<RemoveIndexSignature<InferSchema<T>>>;
 /**
  * Infers the session type from a Zod identity schema.
  * @example
@@ -2042,7 +2700,29 @@ type UserFrom<T extends ZodObject> = Prettify<ZodShapeToObject<InferZodShape<T>>
  *
  * type Session = SessionFrom<typeof schema>
  */
-type SessionFrom<T extends ZodObject> = Wrap<Session<Wrap<UserFrom<T>>>>;
+type SessionFrom<T extends SchemaTypes> = Wrap<Session<Merge<UserFrom<T>, User>>>;
+/**
+ * Infers the sign-up data type from an {@link AuthInstance} config's `signUp.schema`. It supports
+ * Zod, Valibot and ArkType schemas.
+ *
+ * > For TypeBox its recommended to use the `Static` utility type directly to infer the schema.
+ *
+ * @example
+ * const auth = createAuth({
+ *   oauth: [],
+ *   signUp: {
+ *     schema: z.object({
+ *       username: z.string(),
+ *       nickname: z.string(),
+ *       password: z.string(),
+ *     })
+ *   }
+ * })
+ *
+ * type SignUp = InferSignUp<typeof auth>
+ */
+type InferSignUp<Config extends AuthInstance> = Config extends AuthInstance<infer _, infer SignUpSchema> ? Wrap<RemoveIndexSignature<InferSchema<SignUpSchema>>> : Record<string, any>;
+type RemoveIndexSignature<T> = { [K in keyof T as string extends K ? never : number extends K ? never : symbol extends K ? never : K]: T[K] };
 /**
  * HTTP `Response` with `json()` typed to resolve to `Body` (defaults to `unknown`).
  */
@@ -2052,10 +2732,10 @@ type AuthResponse<Body = unknown> = Prettify<Omit<Response, "json"> & {
 type RequiredKeys<Obj extends object, Keys extends keyof Obj = keyof Obj> = Wrap<{ [K in Keys]-?: Obj[K] } & Omit<Obj, Keys>>;
 //#endregion
 //#region src/createAuth.d.ts
-declare const createAuthInstance: <Identity extends Identities>(authConfig: AuthConfig<Identity>) => {
-  handlers: _$_aura_stack_router0.Router<[_$_aura_stack_router0.RouteEndpoint<"/signIn/:oauth", _$_aura_stack_router0.HTTPMethod | _$_aura_stack_router0.HTTPMethod[], {
+declare const createAuthInstance: <Identity extends Identities, SignUpSchema extends SchemaTypes>(authConfig: AuthConfig<Identity, SignUpSchema>) => {
+  handlers: _$_aura_stack_router0.Router<[_$_aura_stack_router0.RouteEndpoint<"/signIn/:oauth", "GET", {
     schemas?: {
-      params: _$zod.ZodObject<{
+      params: ZodObject$1<{
         oauth: _$zod.ZodEnum<{
           [x: string & Record<never, never>]: string & Record<never, never>;
           github: "github";
@@ -2074,15 +2754,19 @@ declare const createAuthInstance: <Identity extends Identities>(authConfig: Auth
           atlassian: "atlassian";
           clickUp: "clickUp";
           dribbble: "dribbble";
+          hubspot: "hubspot";
+          google: "google";
+          huggingface: "huggingface";
+          authentik: "authentik";
         }>;
       }, _$zod_v4_core0.$strip>;
-      searchParams: _$zod.ZodObject<{
+      searchParams: ZodObject$1<{
         redirect: _$zod.ZodDefault<_$zod.ZodOptional<_$zod.ZodCodec<_$zod.ZodString, _$zod.ZodBoolean>>>;
         redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
       }, _$zod_v4_core0.$strip>;
     } | undefined;
-  }, (ctx: _$_aura_stack_router0.RequestContext<_$_aura_stack_router0.EndpointMeta<"/signIn/:oauth", _$_aura_stack_router0.HTTPMethod | _$_aura_stack_router0.HTTPMethod[], {
-    params: _$zod.ZodObject<{
+  }, (ctx: _$_aura_stack_router0.RequestContext<_$_aura_stack_router0.EndpointMeta<"/signIn/:oauth", "GET", {
+    params: ZodObject$1<{
       oauth: _$zod.ZodEnum<{
         [x: string & Record<never, never>]: string & Record<never, never>;
         github: "github";
@@ -2101,9 +2785,13 @@ declare const createAuthInstance: <Identity extends Identities>(authConfig: Auth
         atlassian: "atlassian";
         clickUp: "clickUp";
         dribbble: "dribbble";
+        hubspot: "hubspot";
+        google: "google";
+        huggingface: "huggingface";
+        authentik: "authentik";
       }>;
     }, _$zod_v4_core0.$strip>;
-    searchParams: _$zod.ZodObject<{
+    searchParams: ZodObject$1<{
       redirect: _$zod.ZodDefault<_$zod.ZodOptional<_$zod.ZodCodec<_$zod.ZodString, _$zod.ZodBoolean>>>;
       redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
     }, _$zod_v4_core0.$strip>;
@@ -2119,23 +2807,23 @@ declare const createAuthInstance: <Identity extends Identities>(authConfig: Auth
       redirect: false;
       signInURL: null;
     }>;
-  }>>>, _$_aura_stack_router0.RouteEndpoint<`/${string}`, _$_aura_stack_router0.HTTPMethod | _$_aura_stack_router0.HTTPMethod[], {
+  }>>>, _$_aura_stack_router0.RouteEndpoint<"/signIn/credentials", "POST", {
     schemas?: {
-      body: _$zod.ZodObject<{
+      body: ZodObject$1<{
         username: _$zod.ZodString;
         password: _$zod.ZodString;
       }, _$zod_v4_core0.$strip>;
-      searchParams: _$zod.ZodObject<{
+      searchParams: ZodObject$1<{
         redirect: _$zod.ZodDefault<_$zod.ZodOptional<_$zod.ZodCodec<_$zod.ZodString, _$zod.ZodBoolean>>>;
         redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
       }, _$zod_v4_core0.$strip>;
     } | undefined;
-  }, (ctx: _$_aura_stack_router0.RequestContext<_$_aura_stack_router0.EndpointMeta<`/${string}`, _$_aura_stack_router0.HTTPMethod | _$_aura_stack_router0.HTTPMethod[], {
-    body: _$zod.ZodObject<{
+  }, (ctx: _$_aura_stack_router0.RequestContext<_$_aura_stack_router0.EndpointMeta<"/signIn/credentials", "POST", {
+    body: ZodObject$1<{
       username: _$zod.ZodString;
       password: _$zod.ZodString;
     }, _$zod_v4_core0.$strip>;
-    searchParams: _$zod.ZodObject<{
+    searchParams: ZodObject$1<{
       redirect: _$zod.ZodDefault<_$zod.ZodOptional<_$zod.ZodCodec<_$zod.ZodString, _$zod.ZodBoolean>>>;
       redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
     }, _$zod_v4_core0.$strip>;
@@ -2159,9 +2847,9 @@ declare const createAuthInstance: <Identity extends Identities>(authConfig: Auth
       redirect: false;
       redirectURL: null;
     }>;
-  }>>>, _$_aura_stack_router0.RouteEndpoint<"/callback/:oauth", _$_aura_stack_router0.HTTPMethod | _$_aura_stack_router0.HTTPMethod[], {
+  }>>>, _$_aura_stack_router0.RouteEndpoint<"/callback/:oauth", "GET", {
     schemas?: {
-      params: _$zod.ZodObject<{
+      params: ZodObject$1<{
         oauth: _$zod.ZodEnum<{
           [x: string & Record<never, never>]: string & Record<never, never>;
           github: "github";
@@ -2180,15 +2868,19 @@ declare const createAuthInstance: <Identity extends Identities>(authConfig: Auth
           atlassian: "atlassian";
           clickUp: "clickUp";
           dribbble: "dribbble";
+          hubspot: "hubspot";
+          google: "google";
+          huggingface: "huggingface";
+          authentik: "authentik";
         }>;
       }, _$zod_v4_core0.$strip>;
-      searchParams: _$zod.ZodObject<{
+      searchParams: ZodObject$1<{
         code: _$zod.ZodString;
         state: _$zod.ZodString;
       }, _$zod_v4_core0.$strip>;
     } | undefined;
-  }, (ctx: _$_aura_stack_router0.RequestContext<_$_aura_stack_router0.EndpointMeta<"/callback/:oauth", _$_aura_stack_router0.HTTPMethod | _$_aura_stack_router0.HTTPMethod[], {
-    params: _$zod.ZodObject<{
+  }, (ctx: _$_aura_stack_router0.RequestContext<_$_aura_stack_router0.EndpointMeta<"/callback/:oauth", "GET", {
+    params: ZodObject$1<{
       oauth: _$zod.ZodEnum<{
         [x: string & Record<never, never>]: string & Record<never, never>;
         github: "github";
@@ -2207,9 +2899,13 @@ declare const createAuthInstance: <Identity extends Identities>(authConfig: Auth
         atlassian: "atlassian";
         clickUp: "clickUp";
         dribbble: "dribbble";
+        hubspot: "hubspot";
+        google: "google";
+        huggingface: "huggingface";
+        authentik: "authentik";
       }>;
     }, _$zod_v4_core0.$strip>;
-    searchParams: _$zod.ZodObject<{
+    searchParams: ZodObject$1<{
       code: _$zod.ZodString;
       state: _$zod.ZodString;
     }, _$zod_v4_core0.$strip>;
@@ -2230,16 +2926,16 @@ declare const createAuthInstance: <Identity extends Identities>(authConfig: Auth
       success: false;
       session: null;
     }>;
-  }>>>, _$_aura_stack_router0.RouteEndpoint<`/${string}`, _$_aura_stack_router0.HTTPMethod | _$_aura_stack_router0.HTTPMethod[], {
+  }>>>, _$_aura_stack_router0.RouteEndpoint<"/signOut", "POST", {
     schemas?: {
-      searchParams: _$zod.ZodObject<{
+      searchParams: ZodObject$1<{
         redirect: _$zod.ZodDefault<_$zod.ZodOptional<_$zod.ZodCodec<_$zod.ZodString, _$zod.ZodBoolean>>>;
         redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
         token_type_hint: _$zod.ZodLiteral<"session_token">;
       }, _$zod_v4_core0.$strip>;
     } | undefined;
-  }, (ctx: _$_aura_stack_router0.RequestContext<_$_aura_stack_router0.EndpointMeta<`/${string}`, _$_aura_stack_router0.HTTPMethod | _$_aura_stack_router0.HTTPMethod[], {
-    searchParams: _$zod.ZodObject<{
+  }, (ctx: _$_aura_stack_router0.RequestContext<_$_aura_stack_router0.EndpointMeta<"/signOut", "POST", {
+    searchParams: ZodObject$1<{
       redirect: _$zod.ZodDefault<_$zod.ZodOptional<_$zod.ZodCodec<_$zod.ZodString, _$zod.ZodBoolean>>>;
       redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
       token_type_hint: _$zod.ZodLiteral<"session_token">;
@@ -2266,17 +2962,33 @@ declare const createAuthInstance: <Identity extends Identities>(authConfig: Auth
     }>;
   }>>>, _$_aura_stack_router0.RouteEndpoint<"/csrfToken", "GET", {
     schemas?: _$_aura_stack_router0.EndpointSchemas | undefined;
-  }, (ctx: _$_aura_stack_router0.RequestContext<_$_aura_stack_router0.EndpointMeta<"/csrfToken", "GET", _$_aura_stack_router0.EndpointSchemas>>) => Promise<Response>>, _$_aura_stack_router0.RouteEndpoint<`/${string}`, _$_aura_stack_router0.HTTPMethod | _$_aura_stack_router0.HTTPMethod[], {
+  }, (ctx: _$_aura_stack_router0.RequestContext<_$_aura_stack_router0.EndpointMeta<"/csrfToken", "GET", _$_aura_stack_router0.EndpointSchemas>>) => Promise<Response>>, _$_aura_stack_router0.RouteEndpoint<"/session", "PATCH", {
     schemas?: {
-      body: any;
-      searchParams: _$zod.ZodObject<{
+      body: _$arktype_internal_variants_object_ts0.ObjectType<{
+        user?: _$arktype_internal_variants_object_ts0.ObjectType<{
+          sub: any;
+          name?: any;
+          image?: any;
+          email?: any;
+        }, {}> | undefined;
+        expires?: _$arktype.Type<string>;
+      }, {}>;
+      searchParams: ZodObject$1<{
         redirect: _$zod.ZodDefault<_$zod.ZodOptional<_$zod.ZodCodec<_$zod.ZodString, _$zod.ZodBoolean>>>;
         redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
       }, _$zod_v4_core0.$strip>;
     } | undefined;
-  }, (ctx: _$_aura_stack_router0.RequestContext<_$_aura_stack_router0.EndpointMeta<`/${string}`, _$_aura_stack_router0.HTTPMethod | _$_aura_stack_router0.HTTPMethod[], {
-    body: any;
-    searchParams: _$zod.ZodObject<{
+  }, (ctx: _$_aura_stack_router0.RequestContext<_$_aura_stack_router0.EndpointMeta<"/session", "PATCH", {
+    body: _$arktype_internal_variants_object_ts0.ObjectType<{
+      user?: _$arktype_internal_variants_object_ts0.ObjectType<{
+        sub: any;
+        name?: any;
+        image?: any;
+        email?: any;
+      }, {}> | undefined;
+      expires?: _$arktype.Type<string>;
+    }, {}>;
+    searchParams: ZodObject$1<{
       redirect: _$zod.ZodDefault<_$zod.ZodOptional<_$zod.ZodCodec<_$zod.ZodString, _$zod.ZodBoolean>>>;
       redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
     }, _$zod_v4_core0.$strip>;
@@ -2319,28 +3031,48 @@ declare const createAuthInstance: <Identity extends Identities>(authConfig: Auth
       redirect: false;
       redirectURL: null;
     }>;
+  }>>>, _$_aura_stack_router0.RouteEndpoint<"/signUp", "POST", {
+    schemas?: {
+      body: SignUpSchema | undefined;
+      searchParams: ZodObject$1<{
+        redirect: _$zod.ZodDefault<_$zod.ZodOptional<_$zod.ZodCodec<_$zod.ZodString, _$zod.ZodBoolean>>>;
+        redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
+      }, _$zod_v4_core0.$strip>;
+    } | undefined;
+  }, (ctx: _$_aura_stack_router0.RequestContext<_$_aura_stack_router0.EndpointMeta<"/signUp", "POST", {
+    body: SignUpSchema | undefined;
+    searchParams: ZodObject$1<{
+      redirect: _$zod.ZodDefault<_$zod.ZodOptional<_$zod.ZodCodec<_$zod.ZodString, _$zod.ZodBoolean>>>;
+      redirectTo: _$zod.ZodOptional<_$zod.ZodString>;
+    }, _$zod_v4_core0.$strip>;
+  }>>) => Promise<Prettify<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: true;
+      redirect: true;
+      redirectURL: null;
+    } | {
+      success: true;
+      redirect: false;
+      redirectURL: string;
+    } | {
+      success: true;
+      redirect: false;
+      redirectURL: null;
+    }>;
+  }> | Prettify<Omit<Response, "json"> & {
+    json(): Promise<{
+      success: false;
+      redirect: false;
+      redirectURL: null;
+    }>;
   }>>>]>;
   jose: any;
   api: {
-    getSession: (options: GetSessionAPIOptions) => Promise<GetSessionAPIReturn<{
-      sub: string;
-      name?: string | null | undefined;
-      image?: string | null | undefined;
-      email?: string | null | undefined;
-    }>>;
+    getSession: (options: GetSessionAPIOptions) => Promise<GetSessionAPIReturn<FromShapeToObject<Identity>>>;
     signIn: (oauth: LiteralUnion<BuiltInOAuthProvider>, options?: SignInAPIOptions) => Promise<SignInAPIReturn>;
     signInCredentials: (options: SignInCredentialsAPIOptions) => Promise<SignInCredentialsAPIReturn>;
-    updateSession: (options: UpdateSessionAPIOptions<{
-      sub: string;
-      name?: string | null | undefined;
-      image?: string | null | undefined;
-      email?: string | null | undefined;
-    }>) => Promise<UpdateSessionAPIReturn<{
-      sub: string;
-      name?: string | null | undefined;
-      image?: string | null | undefined;
-      email?: string | null | undefined;
-    }>>;
+    signUp: <Payload extends Record<string, any> = Wrap<RemoveIndexSignature<_$_aura_stack_router0.InferSchema<SignUpSchema, _$_aura_stack_router0.SchemaKind<SignUpSchema>>>>>(options: SignUpAPIOptions<Payload>) => Promise<SignUpAPIReturn>;
+    updateSession: (options: UpdateSessionAPIOptions<FromShapeToObject<Identity>>) => Promise<UpdateSessionAPIReturn<FromShapeToObject<Identity>>>;
     signOut: (options: SignOutAPIOptions) => Promise<SignOutAPIReturn>;
   };
 };
@@ -2367,7 +3099,7 @@ declare const createAuthInstance: <Identity extends Identities>(authConfig: Auth
  *   }]
  * })
  */
-declare const createAuth: <Identity extends Identities = EditableShape<UserShape>>(config: AuthConfig<Identity>) => AuthInstance<FromShapeToObject<Identity>>;
+declare const createAuth: <Identity extends Identities = EditableShape<UserShape>, SignUpSchema extends SchemaTypes = ZodObject$1<any>>(config: AuthConfig<Identity, SignUpSchema>) => AuthInstance<FromShapeToObject<Identity>, SignUpSchema>;
 //#endregion
 //#region src/@types/errors.d.ts
 /** Map of field or logical keys to API validation error payloads (code + message). */
@@ -2622,7 +3354,7 @@ type SignInCredentialsReturn<Options extends SignInCredentialsOptions> = Options
   redirect: false;
 }> : void;
 /** Server/programmatic credentials sign-in options. */
-interface SignInCredentialsAPIOptions extends APIOptionsWithRedirectTo, APIOptionsWithRequest {
+interface SignInCredentialsAPIOptions extends APIOptionsWithRedirectTo, APIOptionsWithRequest, APIOptionsWithSkipCSRFCheck {
   /**
    * Credentials payload validated by the configured `credentials.authorize` function.
    * @example
@@ -2716,6 +3448,39 @@ interface UpdateSessionAPIOptions<DefaultUser extends User = User> extends Requi
 }
 /** Programmatic session update result with redirect metadata and `toResponse()`. */
 type UpdateSessionAPIReturn<DefaultUser extends User = User> = AuthActionAPIReturn<UpdateSessionReturnData<DefaultUser>>;
+interface SignUpAPIOptions<Payload extends Record<string, any> = Record<string, any>> extends APIOptionsWithRedirectTo, APIOptionsWithRequest, APIOptionsWithSkipCSRFCheck {
+  payload: Payload;
+}
+type SignUpReturnData = /** redirect: true & redirectTo: string */{
+  success: true;
+  redirect: true;
+  redirectURL: null;
+} /** redirect: false & redirectTo: string */ | {
+  success: true;
+  redirect: false;
+  redirectURL: string;
+}
+/** redirect: false & redirectTo: null | undefined (not set) */
+/** redirect: true & redirectTo: null | undefined (not set) */
+| {
+  success: true;
+  redirect: false;
+  redirectURL: null;
+} /** Failed sign-up */ | {
+  success: false;
+  redirect: false;
+  redirectURL: null;
+};
+/** Programmatic sign-up result with redirect metadata and `toResponse()`. */
+type SignUpAPIReturn = AuthActionAPIReturn<SignUpReturnData>;
+type SignUpOptions<SignUpSchema extends Record<string, any> = Record<string, any>> = OptionsWithRedirectTo & {
+  payload: SignUpSchema;
+};
+type SignUpReturn<Options extends SignUpOptions> = Options extends {
+  redirect: false;
+} ? Extract<SignUpReturnData, {
+  redirect: false;
+}> : void;
 //#endregion
 //#region src/@types/index.d.ts
 /**
@@ -2743,4 +3508,4 @@ type AuthClientOptions = Prettify<Omit<ClientOptions, "baseURL"> & {
   baseURL?: string;
 }>;
 //#endregion
-export { FromShapeToObject as $, SpotifyProfile as $n, JWTEncryptionAlgorithm as $t, UpdateSessionOptions as A, Name as An, Logger as At, TokenRevocationError as B, twitch as Bn, OAuthProvider as Bt, SignOutAPIOptions as C, clickUp as Cn, UserShapeArkType as Cr, CredentialsProviderContext as Ct, SignOutReturnData as D, AccountType as Dn, InternalLogger as Dt, SignOutReturn as E, atlassian as En, createIdentity as Er, InternalContext as Et, AuthInternalErrorCode as F, NotionUser as Fn, StandardCookie as Ft, DeepPartial as G, mailchimp as Gn, AsymmetricKeyPair as Gt, ArktypeShapeToObject as H, pinterest as Hn, OAuthProviderCredentials as Ht, AuthSecurityErrorCode as I, Owner as In, SyslogOptions as It, EditableShapeArkType as J, SummaryGear as Jn, CryptoSecret as Jt, DeepRequired as K, StravaProfile as Kn, AsymmetricKeyPairFromEnv as Kt, AuthorizationError as L, Person as Ln, TrustedOrigin as Lt, UpdateSessionReturnData as M, dropbox as Mn, SchemaRegistryContext as Mt, APIErrorMap as N, Bot as Nn, SecureCookie as Nt, UpdateSessionAPIOptions as O, DropboxProfile as On, JoseInstance as Ot, AccessTokenError as P, NotionProfile as Pn, Severity as Pt, EditableUser as Q, SpotifyImage as Qn, JWTEncryptedMode as Qt, ErrorType as R, notion as Rn, TrustedProxyHeadersConfig as Rt, SignInReturn as S, ClickUpProfile as Sn, UserShape as Sr, CredentialsProvider as St, SignOutOptions as T, ExtendedProfile as Tn, UserShapeValibot as Tr, IdentityConfig as Tt, AuthResponse as U, Login as Un, OAuthProviderRecord as Ut, createAuth as V, PinterestProfile as Vn, OAuthProviderConfig as Vt, ConfigSchema as W, MailchimpProfile as Wn, ResponseType as Wt, EditableShapeValibot as X, XProfile as Xn, JWTConfig as Xt, EditableShapeTypebox as Y, strava as Yn, GetStatelessSessionReturn as Yt, EditableShapeZod as Z, x as Zn, JWTConfigBase as Zt, SignInCredentialsAPIReturn as _, createBuiltInOAuthProviders as _n, SchemaTypes as _r, CookieConfig as _t, OAuthEnv as a, JWTSealedMode as an, discord as ar, Prettify as at, SignInCredentialsReturnData as b, DribbbleTeams as bn, UserIdentityTypeBox as br, CookieStrategyAttributes as bt, APIOptionsWithRequest as c, JWTStrategyOptions as cn, BitbucketProfile as cr, TypeboxShapeToObject as ct, GetSessionAPIOptions as d, SessionConfig as dn, github as dr, Wrap as dt, JWTExpirationStrategy as en, spotify as er, InferSession as et, GetSessionAPIReturn as f, SessionStrategy as fn, createSyslogMessage as fr, ZodShapeToObject as ft, SignInCredentialsAPIOptions as g, builtInOAuthProviders as gn, IsZod as gr, AuthRuntimeConfig as gt, SignInAPIReturn as h, BuiltInOAuthProvider as hn, IsValibot as hr, AuthInstance as ht, JWTStandardClaims as i, JWTMode as in, Nameplate as ir, Merge as it, UpdateSessionReturn as j, RootInfo as jn, RouterGlobalContext as jt, UpdateSessionAPIReturn as k, FullTeam as kn, LogLevel as kt, APIOptionsWithSkipCSRFCheck as l, SecretKey as ln, bitbucket as lr, UserFrom as lt, SignInAPIOptions as m, User as mn, IsArkType as mr, AuthConfig as mt, AuthClientOptions as n, JWTKeyAlgorithm as nn, gitlab as nr, InferZodShape as nt, TypedJWTPayload$1 as o, JWTSignedMode as on, FigmaProfile as or, RequiredKeys as ot, OptionsWithRedirectTo as p, StatelessStrategyConfig as pn, Identities as pr, AuthAPI as pt, EditableShape as q, SummaryClub as qn, CreateSessionStrategyOptions as qt, JWTPayloadWithToken as r, JWTManager as rn, DiscordProfile as rr, LiteralUnion as rt, APIOptionsWithRedirectTo as s, JWTSigningAlgorithm as sn, figma as sr, SessionFrom as st, AuthClient as t, JWTKey as tn, GitLabProfile as tr, InferUser as tt, FunctionAPIContext as u, Session as un, GitHubProfile as ur, ValibotShapeToObject as ut, SignInCredentialsOptions as v, DribbbleDefault as vn, UserIdentity as vr, CookieName as vt, SignOutAPIReturn as w, AtlassianProfile as wn, UserShapeTypeBox as wr, HostCookie as wt, SignInOptions as x, dribbble as xn, UserIdentityValibot as xr, CredentialsPayload as xt, SignInCredentialsReturn as y, DribbbleProfile as yn, UserIdentityArkType as yr, CookieStoreConfig as yt, OAuthError as z, TwitchProfile as zn, AuthorizeParams as zt };
+export { EditableShapeArkType as $, DribbbleTeams as $n, UserIdentityTypeBox as $r, CustomUserInfoFunction as $t, SignUpOptions as A, JWTSealedMode as An, x as Ar, CredentialsPayload as At, AuthInternalErrorCode as B, AuthentikProfile as Bn, figma as Br, OnCreateUserContext as Bt, SignOutAPIOptions as C, JWTEncryptedMode as Cn, MailchimpProfile as Cr, AuthConfig as Ct, SignOutReturnData as D, JWTKeyAlgorithm as Dn, SummaryGear as Dr, CookieName as Dt, SignOutReturn as E, JWTKey as En, SummaryClub as Er, CookieConfig as Et, UpdateSessionOptions as F, Session as Fn, gitlab as Fr, InternalContext as Ft, TokenRevocationError as G, huggingface as Gn, createSyslogMessage as Gr, Severity as Gt, AuthorizationError as H, HuggingFaceOrg as Hn, bitbucket as Hr, RouterGlobalContext as Ht, UpdateSessionReturn as I, SessionConfig as In, DiscordProfile as Ir, InternalLogger as It, AuthResponse as J, HubSportSignedAccessToken as Jn, IsValibot as Jr, SyslogOptions as Jt, createAuth as K, GoogleProfile as Kn, Identities as Kr, SignUpConfig as Kt, UpdateSessionReturnData as L, SessionStrategy as Ln, Nameplate as Lr, JoseInstance as Lt, SignUpReturnData as M, JWTSigningAlgorithm as Mn, SpotifyProfile as Mr, CredentialsProviderContext as Mt, UpdateSessionAPIOptions as N, JWTStrategyOptions as Nn, spotify as Nr, HostCookie as Nt, SignUpAPIOptions as O, JWTManager as On, strava as Or, CookieStoreConfig as Ot, UpdateSessionAPIReturn as P, SecretKey as Pn, GitLabProfile as Pr, IdentityConfig as Pt, EditableShape as Q, DribbbleProfile as Qn, UserIdentityArkType as Qr, AuthorizeParams as Qt, APIErrorMap as R, StatelessStrategyConfig as Rn, discord as Rr, LogLevel as Rt, SignInReturn as S, JWTConfigBase as Sn, Login as Sr, AuthAPI as St, SignOutOptions as T, JWTExpirationStrategy as Tn, StravaProfile as Tr, AuthRuntimeConfig as Tt, ErrorType as U, HuggingFaceProfile as Un, GitHubProfile as Ur, SchemaRegistryContext as Ut, AuthSecurityErrorCode as V, authentik as Vn, BitbucketProfile as Vr, RateLimiterConfig$1 as Vt, OAuthError as W, HuggingFaceResourceGroup as Wn, github as Wr, SecureCookie as Wt, DeepPartial as X, hubspot as Xn, SchemaTypes as Xr, TrustedProxyHeadersConfig as Xt, ConfigSchema as Y, HubSpotProfile as Yn, IsZod as Yr, TrustedOrigin as Yt, DeepRequired as Z, DribbbleDefault as Zn, UserIdentity as Zr, AccessTokenContext as Zt, SignInCredentialsAPIReturn as _, AsymmetricKeyPairFromEnv as _n, notion as _r, TypeboxShapeToObject as _t, OAuthEnv as a, createIdentity as ai, OIDCAccessTokenResponseType as an, atlassian as ar, FromShapeToObject as at, SignInCredentialsReturnData as b, GetStatelessSessionReturn as bn, PinterestProfile as br, Wrap as bt, APIOptionsWithRequest as c, RuntimeOAuthProvider as cn, FullTeam as cr, InferUser as ct, GetSessionAPIOptions as d, createBuiltInOAuthProviders as dn, dropbox as dr, Merge as dt, UserIdentityValibot as ei, OAuthAccessTokenResponseType as en, dribbble as er, EditableShapeTypebox as et, GetSessionAPIReturn as f, defineOpenIDProviderConfig as fn, Bot as fr, Prettify as ft, SignInCredentialsAPIOptions as g, AsymmetricKeyPair as gn, Person as gr, SessionFrom as gt, SignInAPIReturn as h, OpenIDProvider as hn, Owner as hr, ReturnUpdateSessionShape as ht, JWTStandardClaims as i, UserShapeValibot as ii, OAuthProviderRecord as in, ExtendedProfile as ir, EditableUser as it, SignUpReturn as j, JWTSignedMode as jn, SpotifyImage as jr, CredentialsProvider as jt, SignUpAPIReturn as k, JWTMode as kn, XProfile as kr, CookieStrategyAttributes as kt, APIOptionsWithSkipCSRFCheck as l, BuiltInOAuthProvider as ln, Name as lr, InferZodShape as lt, SignInAPIOptions as m, OpenIDMetadata as mn, NotionUser as mr, RequiredKeys as mt, AuthClientOptions as n, UserShapeArkType as ni, OAuthProviderConfig as nn, clickUp as nr, EditableShapeZod as nt, TypedJWTPayload$1 as o, OIDCProviderContext as on, AccountType as or, InferSession as ot, OptionsWithRedirectTo as p, setDynamicParams as pn, NotionProfile as pr, RemoveIndexSignature as pt, ArktypeShapeToObject as q, google as qn, IsArkType as qr, StandardCookie as qt, JWTPayloadWithToken as r, UserShapeTypeBox as ri, OAuthProviderCredentials as rn, AtlassianProfile as rr, EditableToSchema as rt, APIOptionsWithRedirectTo as s, ResponseType as sn, DropboxProfile as sr, InferSignUp as st, AuthClient as t, UserShape as ti, OAuthProvider as tn, ClickUpProfile as tr, EditableShapeValibot as tt, FunctionAPIContext as u, builtInOAuthProviders as un, RootInfo as ur, LiteralUnion as ut, SignInCredentialsOptions as v, CreateSessionStrategyOptions as vn, TwitchProfile as vr, UserFrom as vt, SignOutAPIReturn as w, JWTEncryptionAlgorithm as wn, mailchimp as wr, AuthInstance as wt, SignInOptions as x, JWTConfig as xn, pinterest as xr, ZodShapeToObject as xt, SignInCredentialsReturn as y, CryptoSecret as yn, twitch as yr, ValibotShapeToObject as yt, AccessTokenError as z, User as zn, FigmaProfile as zr, Logger as zt };