@aura-stack/next 0.1.0 → 0.2.0

package/dist/{index-eKek4f4_.d.ts → index-CbFxTFu9.d.ts}

@@ -1,5 +1,35 @@
 import * as _$buffer from "buffer";
 
+//#region ../../node_modules/.pnpm/typebox@1.1.38/node_modules/typebox/build/type/types/schema.d.mts
+interface TSchema {}
+//#endregion
+//#region ../../node_modules/.pnpm/typebox@1.1.38/node_modules/typebox/build/type/types/_optional.d.mts
+type TOptional<Type extends TSchema = TSchema> = (Type & {
+  '~optional': true;
+});
+//#endregion
+//#region ../../node_modules/.pnpm/typebox@1.1.38/node_modules/typebox/build/type/types/object.d.mts
+/** Represents an Object type. */
+interface TObject<Properties extends TProperties = TProperties> extends TSchema {
+  '~kind': 'Object';
+  type: 'object';
+  properties: Properties;
+  required: TRequiredArray<Properties>;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/typebox@1.1.38/node_modules/typebox/build/type/engine/helpers/union.d.mts
+type TUnionToIntersect<U> = (U extends unknown ? (arg: U) => 0 : never) extends ((arg: infer I) => 0) ? I : never;
+type TUnionLast<U> = TUnionToIntersect<U extends unknown ? (x: U) => 0 : never> extends ((x: infer L) => 0) ? L : never;
+type TUnionToTuple<U, Result extends unknown[] = [], R = TUnionLast<U>> = [U] extends [never] ? Result : TUnionToTuple<Exclude<U, R>, [Extract<U, R>, ...Result]>;
+//#endregion
+//#region ../../node_modules/.pnpm/typebox@1.1.38/node_modules/typebox/build/type/types/properties.d.mts
+/** Represents a Record<PropertyKey, TSchema> structure. */
+interface TProperties extends TSchema {
+  [key: PropertyKey]: TSchema;
+}
+/** Creates a RequiredArray derived from the given TProperties value. */
+type TRequiredArray<Properties extends TProperties, RequiredProperties extends TProperties = { [Key in keyof Properties as Properties[Key] extends TOptional<Properties[Key]> ? never : Key]: Properties[Key] }, RequiredKeys extends string[] = TUnionToTuple<Extract<keyof RequiredProperties, string>>, Result extends string[] | undefined = (RequiredKeys extends [] ? undefined : RequiredKeys)> = Result;
+//#endregion
 //#region ../../node_modules/.pnpm/valibot@1.4.0_typescript@5.9.3/node_modules/valibot/dist/index.d.mts
 //#endregion
 //#region src/methods/fallback/fallback.d.ts
@@ -523,7 +553,7 @@ type MaybePromise<TValue$1> = TValue$1 | Promise<TValue$1>;
 * Hint: This type has no effect and is only used so that TypeScript displays
 * the final type in the preview instead of the utility types used.
 */
-type Prettify$2<TObject> = { [TKey in keyof TObject]: TObject[TKey] } & {};
+type Prettify$3<TObject> = { [TKey in keyof TObject]: TObject[TKey] } & {};
 /**
 * Marks specific keys as optional.
 */
@@ -611,11 +641,11 @@ type OutputWithReadonly<TEntries$1 extends ObjectEntries | ObjectEntriesAsync, T
 /**
 * Infer object input type.
 */
-type InferObjectInput<TEntries$1 extends ObjectEntries | ObjectEntriesAsync> = Prettify$2<InputWithQuestionMarks<TEntries$1, InferEntriesInput<TEntries$1>>>;
+type InferObjectInput<TEntries$1 extends ObjectEntries | ObjectEntriesAsync> = Prettify$3<InputWithQuestionMarks<TEntries$1, InferEntriesInput<TEntries$1>>>;
 /**
 * Infer object output type.
 */
-type InferObjectOutput<TEntries$1 extends ObjectEntries | ObjectEntriesAsync> = Prettify$2<OutputWithReadonly<TEntries$1, OutputWithQuestionMarks<TEntries$1, InferEntriesOutput<TEntries$1>>>>;
+type InferObjectOutput<TEntries$1 extends ObjectEntries | ObjectEntriesAsync> = Prettify$3<OutputWithReadonly<TEntries$1, OutputWithQuestionMarks<TEntries$1, InferEntriesOutput<TEntries$1>>>>;
 /**
 * Infer object issue type.
 */
@@ -1215,15 +1245,6 @@ declare function readonly<TInput$1>(): ReadonlyAction<TInput$1>; //#endregion
 * Array action type.
 */
 //#endregion
-//#region ../../node_modules/.pnpm/typebox@1.1.38/node_modules/typebox/build/type/types/schema.d.mts
-interface TSchema {}
-//#endregion
-//#region ../../node_modules/.pnpm/typebox@1.1.38/node_modules/typebox/build/type/types/properties.d.mts
-/** Represents a Record<PropertyKey, TSchema> structure. */
-interface TProperties extends TSchema {
-  [key: PropertyKey]: TSchema;
-}
-//#endregion
 //#region ../../node_modules/.pnpm/@ark+util@0.56.0/node_modules/@ark/util/out/functions.d.ts
 type Fn<args extends readonly any[] = readonly any[], returns = unknown> = (...args: args) => returns;
 type Thunk<ret = unknown> = () => ret;
@@ -7603,7 +7624,7 @@ type MakeReadonly<T> = T extends Map<infer K, infer V> ? ReadonlyMap<K, V> : T e
 type SomeObject = Record<PropertyKey, any>;
 type Identity$1<T> = T;
 type Flatten<T> = Identity$1<{ [k in keyof T]: T[k] }>;
-type Prettify$1<T> = { [K in keyof T]: T[K] } & {};
+type Prettify$2<T> = { [K in keyof T]: T[K] } & {};
 type Extend<A extends SomeObject, B extends SomeObject> = Flatten<keyof A & keyof B extends never ? A & B : { [K in keyof A as K extends keyof B ? never : K]: A[K] } & { [K in keyof B]: B[K] }>;
 type TupleItems = ReadonlyArray<SomeType>;
 type AnyFunc = (...args: any[]) => any;
@@ -8089,8 +8110,8 @@ type OptionalInSchema = {
     optin: "optional";
   };
 };
-type $InferObjectOutput<T extends $ZodLooseShape, Extra extends Record<string, unknown>> = string extends keyof T ? IsAny<T[keyof T]> extends true ? Record<string, unknown> : Record<string, output<T[keyof T]>> : keyof (T & Extra) extends never ? Record<string, never> : Prettify$1<{ -readonly [k in keyof T as T[k] extends OptionalOutSchema ? never : k]: T[k]["_zod"]["output"] } & { -readonly [k in keyof T as T[k] extends OptionalOutSchema ? k : never]?: T[k]["_zod"]["output"] } & Extra>;
-type $InferObjectInput<T extends $ZodLooseShape, Extra extends Record<string, unknown>> = string extends keyof T ? IsAny<T[keyof T]> extends true ? Record<string, unknown> : Record<string, input<T[keyof T]>> : keyof (T & Extra) extends never ? Record<string, never> : Prettify$1<{ -readonly [k in keyof T as T[k] extends OptionalInSchema ? never : k]: T[k]["_zod"]["input"] } & { -readonly [k in keyof T as T[k] extends OptionalInSchema ? k : never]?: T[k]["_zod"]["input"] } & Extra>;
+type $InferObjectOutput<T extends $ZodLooseShape, Extra extends Record<string, unknown>> = string extends keyof T ? IsAny<T[keyof T]> extends true ? Record<string, unknown> : Record<string, output<T[keyof T]>> : keyof (T & Extra) extends never ? Record<string, never> : Prettify$2<{ -readonly [k in keyof T as T[k] extends OptionalOutSchema ? never : k]: T[k]["_zod"]["output"] } & { -readonly [k in keyof T as T[k] extends OptionalOutSchema ? k : never]?: T[k]["_zod"]["output"] } & Extra>;
+type $InferObjectInput<T extends $ZodLooseShape, Extra extends Record<string, unknown>> = string extends keyof T ? IsAny<T[keyof T]> extends true ? Record<string, unknown> : Record<string, input<T[keyof T]>> : keyof (T & Extra) extends never ? Record<string, never> : Prettify$2<{ -readonly [k in keyof T as T[k] extends OptionalInSchema ? never : k]: T[k]["_zod"]["input"] } & { -readonly [k in keyof T as T[k] extends OptionalInSchema ? k : never]?: T[k]["_zod"]["input"] } & Extra>;
 type $ZodObjectConfig = {
   out: Record<string, unknown>;
   in: Record<string, unknown>;
@@ -8948,7 +8969,52 @@ interface $RefinementCtx<T = unknown> extends ParsePayload<T> {
   addIssue(arg: string | $ZodSuperRefineIssue): void;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@aura-stack+router@0.7.2_ar_46e9fd9f26e06a8bd2d707503ee82b43/node_modules/@aura-stack/router/dist/index-gwkwO9nx.d.ts
+//#region ../../node_modules/.pnpm/@aura-stack+router@0.9.0_ar_a3f421822035902904aea7e26fcc38b6/node_modules/@aura-stack/router/dist/types-DZPXsPNl.d.ts
+//#endregion
+//#region src/@types/schemas.d.ts
+/**
+ * Utility type to infer the output type of a Valibot ObjectSchema. This utility is used instead
+ * of `InferOutput` directly to avoid performance issues caused by deeply nested conditional types.
+ *
+ * Note: relies on Valibot's internal `~types` field. Verify compatibility on every Valibot major/minor bump.
+ */
+type InferValibotSchema<S extends ObjectSchema<any, undefined>> = NonNullable<S["~types"]>["output"];
+/**
+ * Infer the schema kind (Zod, Valibot, TypeBox, Arktype) based on the provided schema type.
+ */
+type SchemaKind<T> = [T] extends [$ZodType] ? "zod" : [T] extends [ObjectSchema<any, undefined>] ? "valibot" : [T] extends [TObject] ? "typebox" : [T] extends [Type<any>] ? "arktype" : "unknown"; //#endregion
+//#region src/error.d.ts
+/**
+ * The HTTP status codes used in AuraStack Router.
+ */
+/**
+ * Route pattern must start with a slash and can contain parameters prefixed with a colon.
+ * @example
+ * const getUser:RoutePattern = "/users/:userId"
+ * const getPostsComments:RoutePattern = "/posts/:postId/comments/:commentId"
+ */
+type RoutePattern = `/${string}`;
+type Prettify$1<Obj extends object> = { [Key in keyof Obj]: Obj[Key] } & {};
+type GetParam<Route extends string> = Route extends `:${infer Param}` ? { [K in Param]: string } : {};
+/**
+ * Extracts route parameters from a given route pattern through colon-prefixed segments.
+ * Returns an object type where keys are parameter names and values are strings.
+ * If no parameters are found, returns an empty object type.
+ *
+ * @example
+ * // Expected: { userId: string }
+ * type UserParams = Params<"/users/:userId">;
+ *
+ * // Expected: { postId: string; commentId: string }
+ * type PostCommentParams = Params<"/posts/:postId/comments/:commentId">;
+ *
+ * // Expected: {}
+ * type NoParams = Params<"/about">;
+ */
+type GetRouteParams<Route extends RoutePattern> = Route extends `/${infer Path}/${infer Str}` ? Prettify$1<GetParam<Path> & GetRouteParams<`/${Str}`>> : Route extends `/${infer Path}` ? GetParam<Path> : {};
+/**
+ * Available schemas validation for an endpoint. It can include body and searchParams schemas.
+ */
 /**
  * Global context type that can be extended when creating the router. It allows passing
  * additional data to all route handlers and middlewares. For a type-inference use module
@@ -8956,9 +9022,13 @@ interface $RefinementCtx<T = unknown> extends ParsePayload<T> {
  */
 interface GlobalContext {}
 /**
- * Configuration for an endpoint, including optional schemas for request validation and middlewares.
+ * Base context available at the earliest hook stage (`onRequest`), before route matching.
  */
 //#endregion
+//#region ../../node_modules/.pnpm/@aura-stack+router@0.9.0_ar_a3f421822035902904aea7e26fcc38b6/node_modules/@aura-stack/router/dist/index-DhwKT9vu.d.ts
+//#region src/@types/client.d.ts
+type InferSchema<T, Kind = SchemaKind<T>> = Kind extends "zod" ? output<T> : Kind extends "valibot" ? InferValibotSchema<T & ObjectSchema<any, undefined>> : Kind extends "typebox" ? {} : [T] extends [Type<infer U>] ? U : T;
+//#endregion
 //#region ../../node_modules/.pnpm/zod@4.3.5/node_modules/zod/v4/classic/errors.d.cts
 /** An Error-like class used to store Zod validation issues.  */
 interface ZodError<T = unknown> extends $ZodError<T> {
@@ -9622,7 +9692,7 @@ interface DecodeJWTOptions {
   decrypt?: DecryptOptions;
 }
 //#endregion
-//#region ../core/dist/index-1ADcIVGC.d.ts
+//#region ../core/dist/index-DIcbmH1M.d.ts
 //#endregion
 //#region src/jose.d.ts
 /**
@@ -9647,8 +9717,17 @@ declare const createJoseInstance: <DefaultUser extends User = User>(secret?: JWT
   encodeJWT: (payload: TypedJWTPayload<Partial<DefaultUser>>, options?: EncodeJWTOptions) => Promise<string>;
   decodeJWT: (token: string, options?: DecodeJWTOptions) => Promise<TypedJWTPayload<DefaultUser>>;
 }; //#endregion
+//#region src/shared/identity.d.ts
+declare const UserIdentity: ZodObject<{
+  sub: ZodString;
+  name: ZodOptional<ZodNullable<ZodString>>;
+  image: ZodOptional<ZodNullable<ZodString>>;
+  email: ZodOptional<ZodNullable<ZodEmail>>;
+}, $strip>;
+type SchemaTypes = ZodObject<any> | ObjectSchema<any, undefined> | Type<{}> | TObject;
+//#endregion
 //#region src/api/createApi.d.ts
-declare const createAuthAPI: <DefaultUser extends User = User>(ctx: GlobalContext) => {
+declare const createAuthAPI: <DefaultUser extends User = User, SignUpSchema extends SchemaTypes = ZodObject<any>>(ctx: GlobalContext) => {
   /**
    * Retrieves the current session data from the server-side.
    *
@@ -9688,6 +9767,26 @@ declare const createAuthAPI: <DefaultUser extends User = User>(ctx: GlobalContex
    * })
    */
   signInCredentials: (options: SignInCredentialsAPIOptions) => Promise<SignInCredentialsAPIReturn>;
+  /**
+   * Signs up a new user on the server-side. It requires a `payload` with the necessary information for
+   * user creation and a callback function configured in `signUp.onCreateUser` to handle the actual user
+   * creation logic.
+   *
+   * @params options - Options for the API call, including the sign-up payload, headers, and redirect behavior.
+   * @return The object returned by the API call {@link SignUpAPIReturn}
+   * @example
+   * const response = await api.signUp({
+   *   payload: {
+   *     name: "John",
+   *     lastName: "Doe",
+   *     email: "john.doe@example.com",
+   *     password: "1234567890"
+   *   },
+   *   redirectTo: "/dashboard",
+   *   request: await getRequest()
+   * })
+   */
+  signUp: <Payload extends Record<string, any> = Wrap<RemoveIndexSignature<InferSchema<SignUpSchema, SchemaKind<SignUpSchema>>>>>(options: SignUpAPIOptions<Payload>) => Promise<SignUpAPIReturn>;
   /**
    * Updates the current session on the server-side. It allows partial updates to the session object, such as
    * modifying user fields or extending the session expiry. It implements CSRF Protection by default, for
@@ -9728,13 +9827,11 @@ declare const createAuthAPI: <DefaultUser extends User = User>(ctx: GlobalContex
    */
   signOut: (options: SignOutAPIOptions) => Promise<SignOutAPIReturn>;
 }; //#endregion
-//#region src/shared/identity.d.ts
-declare const UserIdentity: ZodObject<{
-  sub: ZodString;
-  name: ZodOptional<ZodNullable<ZodString>>;
-  image: ZodOptional<ZodNullable<ZodString>>;
-  email: ZodOptional<ZodNullable<ZodEmail>>;
-}, $strip>;
+//#region src/shared/logger.d.ts
+/**
+ * Log message definitions organized by category.
+ * Each message includes facility, severity, msgId, and default message.
+ */
 //#endregion
 //#region src/oauth/github.d.ts
 /**
@@ -10345,119 +10442,245 @@ interface DribbbleProfile extends DribbbleDefault {
  * @see [Dribbble - User](https://developer.dribbble.com/v2/user/)
  */
 //#endregion
-//#region src/oauth/index.d.ts
-declare const builtInOAuthProviders: {
-  readonly github: <DefaultUser extends User = {
-    sub: string;
-    name?: string | null | undefined;
-    image?: string | null | undefined;
-    email?: string | null | undefined;
-  }>(options?: Partial<OAuthProviderCredentials<GitHubProfile, DefaultUser>>) => OAuthProviderCredentials<GitHubProfile, DefaultUser>;
-  readonly bitbucket: <DefaultUser extends User = {
-    sub: string;
-    name?: string | null | undefined;
-    image?: string | null | undefined;
-    email?: string | null | undefined;
-  }>(options?: Partial<OAuthProviderCredentials<BitbucketProfile, DefaultUser>>) => OAuthProviderCredentials<BitbucketProfile, DefaultUser>;
-  readonly figma: <DefaultUser extends User = {
-    sub: string;
-    name?: string | null | undefined;
-    image?: string | null | undefined;
-    email?: string | null | undefined;
-  }>(options?: Partial<OAuthProviderCredentials<FigmaProfile, DefaultUser>>) => OAuthProviderCredentials<FigmaProfile, DefaultUser>;
-  readonly discord: <DefaultUser extends User = {
-    sub: string;
-    name?: string | null | undefined;
-    image?: string | null | undefined;
-    email?: string | null | undefined;
-  }>(options?: Partial<OAuthProviderCredentials<DiscordProfile, DefaultUser>>) => OAuthProviderCredentials<DiscordProfile, DefaultUser>;
-  readonly gitlab: <DefaultUser extends User = {
-    sub: string;
-    name?: string | null | undefined;
-    image?: string | null | undefined;
-    email?: string | null | undefined;
-  }>(options?: Partial<OAuthProviderCredentials<GitLabProfile, DefaultUser>>) => OAuthProviderCredentials<GitLabProfile, DefaultUser>;
-  readonly spotify: <DefaultUser extends User = {
-    sub: string;
-    name?: string | null | undefined;
-    image?: string | null | undefined;
-    email?: string | null | undefined;
-  }>(options?: Partial<OAuthProviderCredentials<SpotifyProfile, DefaultUser>>) => OAuthProviderCredentials<SpotifyProfile, DefaultUser>;
-  readonly x: <DefaultUser extends User = {
-    sub: string;
-    name?: string | null | undefined;
-    image?: string | null | undefined;
-    email?: string | null | undefined;
-  }>(options?: Partial<OAuthProviderCredentials<XProfile, DefaultUser>>) => OAuthProviderCredentials<XProfile, DefaultUser>;
-  readonly strava: <DefaultUser extends User = {
-    sub: string;
-    name?: string | null | undefined;
-    image?: string | null | undefined;
-    email?: string | null | undefined;
-  }>(options?: Partial<OAuthProviderCredentials<StravaProfile, DefaultUser>>) => OAuthProviderCredentials<StravaProfile, DefaultUser>;
-  readonly mailchimp: <DefaultUser extends User = {
-    sub: string;
-    name?: string | null | undefined;
-    image?: string | null | undefined;
-    email?: string | null | undefined;
-  }>(options?: Partial<OAuthProviderCredentials<MailchimpProfile, DefaultUser>>) => OAuthProviderCredentials<MailchimpProfile, DefaultUser>;
-  readonly pinterest: <DefaultUser extends User = {
-    sub: string;
-    name?: string | null | undefined;
-    image?: string | null | undefined;
-    email?: string | null | undefined;
-  }>(options?: Partial<OAuthProviderCredentials<PinterestProfile, DefaultUser>>) => OAuthProviderCredentials<PinterestProfile, DefaultUser>;
-  readonly twitch: <DefaultUser extends User = {
-    sub: string;
-    name?: string | null | undefined;
-    image?: string | null | undefined;
-    email?: string | null | undefined;
-  }>(options?: Partial<OAuthProviderCredentials<TwitchProfile, DefaultUser>>) => OAuthProviderCredentials<TwitchProfile, DefaultUser>;
-  readonly notion: <DefaultUser extends User = {
-    sub: string;
-    name?: string | null | undefined;
-    image?: string | null | undefined;
-    email?: string | null | undefined;
-  }>(options?: Partial<OAuthProviderCredentials<NotionProfile, DefaultUser>>) => OAuthProviderCredentials<NotionProfile, DefaultUser>;
-  readonly dropbox: <DefaultUser extends User = {
-    sub: string;
-    name?: string | null | undefined;
-    image?: string | null | undefined;
-    email?: string | null | undefined;
-  }>(options?: Partial<OAuthProviderCredentials<DropboxProfile, DefaultUser>>) => OAuthProviderCredentials<DropboxProfile, DefaultUser>;
-  readonly atlassian: <DefaultUser extends User = {
-    sub: string;
-    name?: string | null | undefined;
-    image?: string | null | undefined;
-    email?: string | null | undefined;
-  }>(options?: Partial<OAuthProviderCredentials<AtlassianProfile, DefaultUser>>) => OAuthProviderCredentials<AtlassianProfile, DefaultUser>;
-  readonly clickUp: <DefaultUser extends User = {
-    sub: string;
-    name?: string | null | undefined;
-    image?: string | null | undefined;
-    email?: string | null | undefined;
-  }>(options?: Partial<OAuthProviderCredentials<ClickUpProfile, DefaultUser>>) => OAuthProviderCredentials<ClickUpProfile, DefaultUser>;
-  readonly dribbble: <DefaultUser extends User = {
-    sub: string;
-    name?: string | null | undefined;
-    image?: string | null | undefined;
-    email?: string | null | undefined;
-  }>(options?: Partial<OAuthProviderCredentials<DribbbleProfile, DefaultUser>>) => OAuthProviderCredentials<DribbbleProfile, DefaultUser>;
-};
+//#region src/oauth/hubspot.d.ts
+interface HubSportSignedAccessToken {
+  appId: number;
+  appInstallId: number;
+  audience: string;
+  expiresAt: string;
+  hubId: number;
+  hublet: string;
+  installingUserId: number;
+  isPrivateDistribution: boolean;
+  isServiceAccount: boolean;
+  isUserLevel: boolean;
+  newSignature: string;
+  scopeToScopeGroupPks: string;
+  scopes: string;
+  signature: string;
+  trialScopeToScopeGroupPks: string;
+  trialScopes: string;
+  userId: number;
+}
+/**
+ * @see [HubSpot - Retrieve OAuth token metadata](https://developers.hubspot.com/docs/api-reference/legacy/authentication/oauth-tokens/v1/get-oauth-token-metadata)
+ */
+interface HubSpotProfile {
+  /**
+   * The ID of the application associated with the access token.
+   */
+  app_id: number;
+  /**
+   * The time in seconds until the access token expires.
+   */
+  expires_in: number;
+  /**
+   * The ID of the HubSpot account associated with the access token.
+   */
+  hub_id: number;
+  /**
+   * An array of strings indicating the scopes
+   */
+  scopes: string[];
+  /**
+   * The access token string used to make API calls.
+   */
+  token: string;
+  /**
+   * The type of token, typically indicating the authentication scheme.
+   * @default `bearer`
+   */
+  token_type: string;
+  /**
+   * The ID of the hubspot user for whom the access token was created.
+   */
+  user_id: number;
+  /**
+   * The domain of the HubSpot account associated with the access token.
+   */
+  hub_domain: string;
+  /**
+   * Indicates whether the token is for a privately distributed application. If false, it is marketplace distributed.
+   */
+  is_private_distribution: boolean;
+  signed_access_token: HubSportSignedAccessToken;
+  /**
+   * The email address of the hubspot user for whom the access token was created.
+   */
+  user: string;
+}
 /**
- * Constructs OAuth provider configurations from an array of provider names or configurations.
- * It loads the client ID and client secret from environment variables if only the provider name is provided.
+ * HubSpot OAuth provider
+ * Profile Type {@link HubSpotProfile}
  *
- * @param oauth - Array of OAuth provider configurations or provider names to be defined from environment variables
- * @returns A record of OAuth provider configurations
- * @example
- * // Using built-in provider with env variables
- * createBuiltInOAuthProviders(["github"])
+ * @see [HubSpot - Working with OAuth](https://developers.hubspot.com/docs/apps/legacy-apps/authentication/oauth-quickstart-guide#getting-oauth-tokens)
+ * @see [HubSpot - Scopes](https://developers.hubspot.com/docs/apps/legacy-apps/authentication/scopes)
+ * @see [HubSpot - Retrieve OAuth token metadata](https://developers.hubspot.com/docs/api-reference/legacy/authentication/oauth-tokens/v1/get-oauth-token-metadata)
+ */
+//#endregion
+//#region src/oauth/google.d.ts
+/**
+ * @see [Google - ID Token (Claims)](https://developers.google.com/identity/openid-connect/reference#id_token_claims)
+ */
+interface GoogleProfile {
+  /**
+   * The issuer identifier for the issuer of the response.
+   * Typically `https://accounts.google.com` or `accounts.google.com`
+   */
+  iss: string;
+  /**
+   * The subject identifier for the user. This is a unique and immutable
+   * identifier for the user.
+   */
+  sub: string;
+  /**
+   * The audience for which the ID token is intended.
+   */
+  aud: string;
+  /**
+   * The time of the ID token was issued.
+   */
+  iat: number;
+  /**
+   * Expiration time on or after which the ID token must not be accepted.
+   */
+  exp: string;
+  /**
+   * The client Identifier for the authorized presenter, obtained from
+   * the Google Cloud Console.
+   */
+  azp?: string;
+  /**
+   * The value of the `nonce` supplied by the client.
+   */
+  nonce?: string;
+  /**
+   * The time user authentication took placea JSON number representing
+   * the number of seconds.
+   */
+  auth_time?: number;
+  /**
+   * Access token hash. Provides validation that the Access Token is tied
+   * to the identity token.
+   */
+  at_hash?: string;
+  /**
+   * The domain associated with the Google Workspace or Cloud organization of the user.
+   */
+  hd?: string;
+  /**
+   * The user's email address.
+   * > Note: Provided only if you included the `email` scope in your request.
+   *
+   * > Warning: Don't use email address as an identifier because a Google
+   * Account can have multiple email addresses at different points in time.
+   * Always use the `sub` field as the identifier for the user.
+   */
+  email: string;
+  /**
+   * `True` if the user's email address has been verified.
+   */
+  email_verified?: boolean;
+  /**
+   * The user's full name.
+   * > Note: Provided only if you included the `profile` scope in your request.
+   */
+  name: string;
+  /**
+   * The URL of the user's profile picture.
+   * > Note: Provided only if you included the `profile` scope in your request.
+   */
+  picture: string;
+  /**
+   * The user's give name(s) or first name(s).
+   */
+  given_name?: string;
+  /**
+   * The user's family name(s) or last name(s).
+   */
+  family_name?: string;
+}
+/**
+ * Google OpenID Connect Provider
  *
- * // Using built-in provider with explicit credentials via factory
- * createBuiltInOAuthProviders([github({ clientId: "...", clientSecret: "..." })])
+ * @see [Google - Using OAuth 2.0 to Access Google APIs](https://developers.google.com/identity/protocols/oauth2)
+ * @see [Google - OpenID Connect](https://developers.google.com/identity/openid-connect/openid-connect)
+ * @see [Google - OpenID Connect API Reference](https://developers.google.com/identity/openid-connect/reference)
+ * @see [Google - Client Credentials](https://console.cloud.google.com/auth/clients)
  */
-type BuiltInOAuthProvider = keyof typeof builtInOAuthProviders; //#endregion
+//#endregion
+//#region src/oauth/huggingface.d.ts
+interface HuggingFaceResourceGroup {
+  sub: string;
+  name: string;
+  role: "admin" | "write" | "contributor" | "read" | "no_access";
+}
+interface HuggingFaceOrg {
+  sub: string;
+  name: string;
+  picture: string;
+  preferred_username: string;
+  plan?: "team" | "enterprise" | "plus" | "academia";
+  canPay?: boolean;
+  billingMode?: "prepaid" | "postpaid";
+  roleInOrg?: "admin" | "write" | "contributor" | "read" | "no_access";
+  pendingSSO?: boolean;
+  missingMFA?: boolean;
+  securityRestrictions?: ("mfa" | "token-policy" | "token-revoked" | "sso" | "ip")[];
+  resourceGroups?: HuggingFaceResourceGroup;
+}
+/**
+ * @see [Hugging Face - Open API Metadata](https://huggingface.co/.well-known/openapi.json)
+ */
+interface HuggingFaceProfile {
+  sub: string;
+  isPro: boolean;
+  orgs: HuggingFaceOrg[];
+  name?: string;
+  preferred_username?: string;
+  picture?: string;
+  profile?: string;
+  website?: string;
+  email?: string;
+  email_verified?: boolean;
+  canPay?: boolean;
+  billingMode?: "prepaid" | "postpaid";
+}
+/**
+ * Hugging Face OpenID Connect Provider
+ *
+ * @see [Hugging Face - Sign in with Hugging Face](https://huggingface.co/docs/hub/en/oauth)
+ * @see [Hugging Face - Create an OAuth App](https://huggingface.co/settings/applications/new)
+ * @see [Hugging Face - OpenID Metadata](https://huggingface.co/.well-known/openid-configuration)
+ */
+//#endregion
+//#region src/oauth/authentik.d.ts
+interface AuthentikProfile {
+  iss: string;
+  sub: string;
+  aud: string;
+  exp: number;
+  iat: number;
+  auth_time: number;
+  acr: string;
+  c_hash: string;
+  nonce: string;
+  at_hash: string;
+  email: string;
+  email_verified: boolean;
+  name: string;
+  given_name: string;
+  family_name: string;
+  preferred_username: string;
+  nickname: string;
+}
+/**
+ * Authentik OpenID Connect Provider
+ *
+ * @see [Authentik - OAuth 2.0 Provider](https://docs.goauthentik.io/add-secure-apps/providers/oauth2/)
+ * @see [Authentik - Create an OAuth2 Provider](https://docs.goauthentik.io/add-secure-apps/providers/oauth2/create-oauth2-provider/)
+ */
+//#endregion
 //#region src/@types/session.d.ts
 /** Application user type, inferred from the configured identity schema (defaults to the built-in user shape). */
 type User = output<typeof UserIdentity>;
@@ -10583,8 +10806,177 @@ type StatelessStrategyConfig = {
  */
 type SessionConfig = StatelessStrategyConfig;
 /** Result of reading a stateless (JWT) session from a request: session payload and outgoing header mutations. */
-//#endregion
+type OpenIDProvider<Profile extends object = Record<string, any>, DefaultUser = User, Issuer extends string = string> = {
+  id: string;
+  name: string;
+  /**
+   * URL to concatenating the string /.well-known/openid-configuration to the Issuer.
+   */
+  issuer: Issuer;
+  clientId?: string;
+  clientSecret?: string;
+  /**
+   * Override the default OIDC scope (`openid profile email`).
+   */
+  scope?: string;
+  profile?: (profile: Profile) => DefaultUser | Promise<DefaultUser>;
+} & GetRouteParams<`/${Issuer}`>; //#endregion
+//#region src/oauth/index.d.ts
+declare const builtInOAuthProviders: {
+  readonly github: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<GitHubProfile, DefaultUser>>) => OAuthProviderCredentials<GitHubProfile, DefaultUser>;
+  readonly bitbucket: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<BitbucketProfile, DefaultUser>>) => OAuthProviderCredentials<BitbucketProfile, DefaultUser>;
+  readonly figma: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<FigmaProfile, DefaultUser>>) => OAuthProviderCredentials<FigmaProfile, DefaultUser>;
+  readonly discord: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<DiscordProfile, DefaultUser>>) => OAuthProviderCredentials<DiscordProfile, DefaultUser>;
+  readonly gitlab: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<GitLabProfile, DefaultUser>>) => OAuthProviderCredentials<GitLabProfile, DefaultUser>;
+  readonly spotify: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<SpotifyProfile, DefaultUser>>) => OAuthProviderCredentials<SpotifyProfile, DefaultUser>;
+  readonly x: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<XProfile, DefaultUser>>) => OAuthProviderCredentials<XProfile, DefaultUser>;
+  readonly strava: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<StravaProfile, DefaultUser>>) => OAuthProviderCredentials<StravaProfile, DefaultUser>;
+  readonly mailchimp: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<MailchimpProfile, DefaultUser>>) => OAuthProviderCredentials<MailchimpProfile, DefaultUser>;
+  readonly pinterest: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<PinterestProfile, DefaultUser>>) => OAuthProviderCredentials<PinterestProfile, DefaultUser>;
+  readonly twitch: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<TwitchProfile, DefaultUser>>) => OAuthProviderCredentials<TwitchProfile, DefaultUser>;
+  readonly notion: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<NotionProfile, DefaultUser>>) => OAuthProviderCredentials<NotionProfile, DefaultUser>;
+  readonly dropbox: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<DropboxProfile, DefaultUser>>) => OAuthProviderCredentials<DropboxProfile, DefaultUser>;
+  readonly atlassian: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<AtlassianProfile, DefaultUser>>) => OAuthProviderCredentials<AtlassianProfile, DefaultUser>;
+  readonly clickUp: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<ClickUpProfile, DefaultUser>>) => OAuthProviderCredentials<ClickUpProfile, DefaultUser>;
+  readonly dribbble: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OAuthProviderCredentials<DribbbleProfile, DefaultUser>>) => OAuthProviderCredentials<DribbbleProfile, DefaultUser>;
+  readonly hubspot: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: OAuthProviderConfig<HubSpotProfile, DefaultUser>) => OAuthProviderConfig<HubSpotProfile, DefaultUser>;
+  readonly google: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OpenIDProvider<GoogleProfile, DefaultUser>>) => OpenIDProvider<GoogleProfile, DefaultUser>;
+  readonly huggingface: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OpenIDProvider<HuggingFaceProfile, DefaultUser>>) => OpenIDProvider<HuggingFaceProfile, DefaultUser>;
+  readonly authentik: <DefaultUser extends User = {
+    sub: string;
+    name?: string | null | undefined;
+    image?: string | null | undefined;
+    email?: string | null | undefined;
+  }>(options?: Partial<OpenIDProvider<AuthentikProfile, DefaultUser>>) => OpenIDProvider<AuthentikProfile, DefaultUser>;
+};
+type BuiltInOAuthProvider = keyof typeof builtInOAuthProviders; //#endregion
 //#region src/@types/oauth.d.ts
+type AccessTokenContext = {
+  /**
+   * Access token string returned by the OAuth provider's token endpoint. The token
+   * must be used to exchange for user information from the provider's userinfo endpoint.
+   */
+  accessToken: string;
+  /**
+   * The access token type returned by the OAuth provider's token endpoint, typically "Bearer".
+   */
+  tokenType?: string | undefined;
+  /**
+   * The number of seconds until the access token expires, as returned by the OAuth provider's
+   * token endpoint.
+   */
+  expiresIn?: number | undefined;
+  /**
+   * Optional refresh token returned by the OAuth provider's token endpoint, which can be
+   * used to obtain a new access token when the current one expires.
+   */
+  refreshToken?: string | undefined;
+  /**
+   * The scopes granted by the user for the access token, as returned by the OAuth provider's
+   * token endpoint.
+   */
+  scope?: string | string[] | null | undefined;
+  /**
+   * The userinfo endpoint URL of the OAuth provider. This is required to fetch user
+   * information using the access token.
+   */
+  userInfoURL: string;
+};
 /** Known query parameter names supported when building an OAuth authorization URL. */
 type AuthorizeParams = LiteralUnion<"clientId" | "prompt" | "scope" | "responseMode" | "audience" | "loginHint" | "nonce" | "display">;
 /** OAuth 2.0 `response_type` values used in authorization requests. */
@@ -10615,6 +11007,9 @@ interface OAuthProviderConfig<Profile extends object = Record<string, any>, Defa
     url: string;
     headers?: Record<string, string>;
     method?: string;
+  } | {
+    url: string;
+    request: (context: AccessTokenContext) => Profile | Promise<Profile>;
   };
   /**
    * @deprecated
@@ -10643,7 +11038,7 @@ interface OAuthProviderCredentials<Profile extends object = Record<string, any>,
  * Programmatic auth API returned with the auth instance: `getSession`, `signIn`, `signInCredentials`, `signOut`, `updateSession`.
  * Each method returns a result object plus `headers` and `toResponse()` for HTTP responses.
  */
-type AuthAPI<DefaultUser extends User = User> = ReturnType<typeof createAuthAPI<DefaultUser>>;
+type AuthAPI<DefaultUser extends User = User, SignUpSchema extends SchemaTypes = ZodObject<any>> = ReturnType<typeof createAuthAPI<DefaultUser, SignUpSchema>>;
 /** JWT and crypto helpers bound to the configured identity schema (sign, verify, claims). */
 type JoseInstance<DefaultUser extends User = User> = ReturnType<typeof createJoseInstance<DefaultUser>>;
 /** Normalized internal logger with resolved level and structured log function. */
@@ -10659,11 +11054,11 @@ interface CredentialsPayload {
 /**
  * Public auth instance: programmatic {@link AuthAPI}, {@link JoseInstance}, and HTTP {@link AuthClient} handlers.
  */
-interface AuthInstance<DefaultUser extends User = User> {
+interface AuthInstance<DefaultUser extends User = User, SignUpSchema extends SchemaTypes = ZodObject<any>> {
   /**
    * Programmatic API for authentication actions (getSession, signIn, signOut, etc.) that can be used in server-side contexts or API routes.
    */
-  api: AuthAPI<DefaultUser>;
+  api: AuthAPI<DefaultUser, SignUpSchema>;
   /**
    * JOSE helper functions for signin, encryption and verification of JWTs.
    */
@@ -10704,7 +11099,6 @@ type Merge<A, B> = Omit<A, keyof B> & B;
  */
 type ZodShapeToObject<S extends ZodRawShape = ZodRawShape> = Merge<output<ZodObject<S>>, User>;
 type FromShapeToObject<S> = S extends ZodRawShape ? ZodShapeToObject<S> : S extends ObjectEntries ? ValibotShapeToObject<S> : S extends Type ? ArktypeShapeToObject<S> : S extends TProperties ? TypeboxShapeToObject<S> : S extends User ? S : never;
-/** Recursively makes every property required. */
 /** Recursively makes every property optional. */
 type DeepPartial<T> = { [P in keyof T]?: T[P] extends object ? DeepPartial<T[P]> : T[P] };
 /** Wraps a type in an object with the same keys. */
@@ -10722,6 +11116,7 @@ type Wrap<T> = T extends any ? { [K in keyof T]: T[K] } : never;
  *
  * type User = InferUser<typeof auth>
  */
+type RemoveIndexSignature<T> = { [K in keyof T as string extends K ? never : number extends K ? never : symbol extends K ? never : K]: T[K] };
 /**
  * HTTP `Response` with `json()` typed to resolve to `Body` (defaults to `unknown`).
  */
@@ -10885,7 +11280,7 @@ type SignInCredentialsReturnData = /** redirect: true & redirectTo: string */{
 };
 /** Client-side credentials sign-in return type (redirect mode or manual redirect data). */
 /** Server/programmatic credentials sign-in options. */
-interface SignInCredentialsAPIOptions extends APIOptionsWithRedirectTo, APIOptionsWithRequest {
+interface SignInCredentialsAPIOptions extends APIOptionsWithRedirectTo, APIOptionsWithRequest, APIOptionsWithSkipCSRFCheck {
   /**
    * Credentials payload validated by the configured `credentials.authorize` function.
    * @example
@@ -10963,11 +11358,31 @@ interface UpdateSessionAPIOptions<DefaultUser extends User = User> extends Requi
   session: DeepPartial<Session<DefaultUser>>;
 }
 /** Programmatic session update result with redirect metadata and `toResponse()`. */
-type UpdateSessionAPIReturn<DefaultUser extends User = User> = AuthActionAPIReturn<UpdateSessionReturnData<DefaultUser>>; //#endregion
-//#region src/@types/index.d.ts
-/**
- * Standard JWT claims that are managed internally by the token system.
- * These fields are typically filtered out before returning user data.
- */
+type UpdateSessionAPIReturn<DefaultUser extends User = User> = AuthActionAPIReturn<UpdateSessionReturnData<DefaultUser>>;
+interface SignUpAPIOptions<Payload extends Record<string, any> = Record<string, any>> extends APIOptionsWithRedirectTo, APIOptionsWithRequest, APIOptionsWithSkipCSRFCheck {
+  payload: Payload;
+}
+type SignUpReturnData = /** redirect: true & redirectTo: string */{
+  success: true;
+  redirect: true;
+  redirectURL: null;
+} /** redirect: false & redirectTo: string */ | {
+  success: true;
+  redirect: false;
+  redirectURL: string;
+}
+/** redirect: false & redirectTo: null | undefined (not set) */
+/** redirect: true & redirectTo: null | undefined (not set) */
+| {
+  success: true;
+  redirect: false;
+  redirectURL: null;
+} /** Failed sign-up */ | {
+  success: false;
+  redirect: false;
+  redirectURL: null;
+};
+/** Programmatic sign-up result with redirect metadata and `toResponse()`. */
+type SignUpAPIReturn = AuthActionAPIReturn<SignUpReturnData>;
 //#endregion
-export { DecodeJWTOptions as _, GetSessionAPIReturn as a, Session as c, SignInCredentialsAPIOptions as d, SignInCredentialsAPIReturn as f, UpdateSessionAPIReturn as g, UpdateSessionAPIOptions as h, GetSessionAPIOptions as i, SignInAPIOptions as l, SignOutAPIReturn as m, BuiltInOAuthProvider as n, LiteralUnion as o, SignOutAPIOptions as p, FromShapeToObject as r, Prettify as s, AuthInstance as t, SignInAPIReturn as u, EncodeJWTOptions as v, TypedJWTPayload as y };
+export { UpdateSessionAPIOptions as _, GetSessionAPIReturn as a, EncodeJWTOptions as b, Session as c, SignInCredentialsAPIOptions as d, SignInCredentialsAPIReturn as f, SignUpAPIReturn as g, SignUpAPIOptions as h, GetSessionAPIOptions as i, SignInAPIOptions as l, SignOutAPIReturn as m, BuiltInOAuthProvider as n, LiteralUnion as o, SignOutAPIOptions as p, FromShapeToObject as r, Prettify as s, AuthInstance as t, SignInAPIReturn as u, UpdateSessionAPIReturn as v, TypedJWTPayload as x, DecodeJWTOptions as y };