@aura-stack/next 0.2.0 → 0.2.2

package/dist/client.cjs

@@ -1 +1 @@
-"use client";Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require(`./context.cjs`);let t=require(`@aura-stack/react`);exports.AuthProvider=e.AuthProvider,Object.defineProperty(exports,`createAuthClient`,{enumerable:!0,get:function(){return t.createAuthClient}}),Object.defineProperty(exports,`useAuthActions`,{enumerable:!0,get:function(){return t.useAuthActions}}),Object.defineProperty(exports,`useSession`,{enumerable:!0,get:function(){return t.useSession}}),Object.defineProperty(exports,`useSignIn`,{enumerable:!0,get:function(){return t.useSignIn}}),Object.defineProperty(exports,`useSignInCredentials`,{enumerable:!0,get:function(){return t.useSignInCredentials}}),Object.defineProperty(exports,`useSignOut`,{enumerable:!0,get:function(){return t.useSignOut}}),Object.defineProperty(exports,`useSignUp`,{enumerable:!0,get:function(){return t.useSignUp}}),Object.defineProperty(exports,`useUpdateSession`,{enumerable:!0,get:function(){return t.useUpdateSession}});
+"use client";Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require(`./context.cjs`);let t=require(`@aura-stack/react`);exports.AuthProvider=e.AuthProvider,Object.defineProperty(exports,`createAuthClient`,{enumerable:!0,get:function(){return t.createAuthClient}}),Object.defineProperty(exports,`useAuthActions`,{enumerable:!0,get:function(){return t.useAuthActions}}),Object.defineProperty(exports,`useProviderTokens`,{enumerable:!0,get:function(){return t.useProviderTokens}}),Object.defineProperty(exports,`useSession`,{enumerable:!0,get:function(){return t.useSession}}),Object.defineProperty(exports,`useSignIn`,{enumerable:!0,get:function(){return t.useSignIn}}),Object.defineProperty(exports,`useSignInCredentials`,{enumerable:!0,get:function(){return t.useSignInCredentials}}),Object.defineProperty(exports,`useSignOut`,{enumerable:!0,get:function(){return t.useSignOut}}),Object.defineProperty(exports,`useSignUp`,{enumerable:!0,get:function(){return t.useSignUp}}),Object.defineProperty(exports,`useUpdateSession`,{enumerable:!0,get:function(){return t.useUpdateSession}});

package/dist/client.d.ts

@@ -1,3 +1,3 @@
 import { AuthProvider } from "./context.js";
-import { AuthClientOptions, AuthProviderProps, createAuthClient, useAuthActions, useSession, useSignIn, useSignInCredentials, useSignOut, useSignUp, useUpdateSession } from "@aura-stack/react";
-export { type AuthClientOptions, AuthProvider, type AuthProviderProps, createAuthClient, useAuthActions, useSession, useSignIn, useSignInCredentials, useSignOut, useSignUp, useUpdateSession };
+import { AuthClientOptions, AuthProviderProps, createAuthClient, useAuthActions, useProviderTokens, useSession, useSignIn, useSignInCredentials, useSignOut, useSignUp, useUpdateSession } from "@aura-stack/react";
+export { type AuthClientOptions, AuthProvider, type AuthProviderProps, createAuthClient, useAuthActions, useProviderTokens, useSession, useSignIn, useSignInCredentials, useSignOut, useSignUp, useUpdateSession };

package/dist/client.js

@@ -1 +1 @@
-"use client";import{AuthProvider as e}from"./context.js";import{createAuthClient as t,useAuthActions as n,useSession as r,useSignIn as i,useSignInCredentials as a,useSignOut as o,useSignUp as s,useUpdateSession as c}from"@aura-stack/react";export{e as AuthProvider,t as createAuthClient,n as useAuthActions,r as useSession,i as useSignIn,a as useSignInCredentials,o as useSignOut,s as useSignUp,c as useUpdateSession};
+"use client";import{AuthProvider as e}from"./context.js";import{createAuthClient as t,useAuthActions as n,useProviderTokens as r,useSession as i,useSignIn as a,useSignInCredentials as o,useSignOut as s,useSignUp as c,useUpdateSession as l}from"@aura-stack/react";export{e as AuthProvider,t as createAuthClient,n as useAuthActions,r as useProviderTokens,i as useSession,a as useSignIn,o as useSignInCredentials,s as useSignOut,c as useSignUp,l as useUpdateSession};

package/dist/context.cjs

@@ -1 +1 @@
-"use client";Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require(`@aura-stack/react/context`),t=require(`next/navigation`),n=require(`react/jsx-runtime`);const r=({client:r,children:i,initialSession:a,redirect:o})=>{let s=(0,t.useRouter)();return(0,n.jsx)(e.AuthProvider,{client:r,initialSession:a,redirect:o??(e=>s.push(e)),children:i})};exports.AuthProvider=r;
+"use client";Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require(`@aura-stack/react/context`),t=require(`next/navigation.js`),n=require(`react/jsx-runtime`);const r=({client:r,children:i,initialSession:a,redirect:o})=>{let s=(0,t.useRouter)();return(0,n.jsx)(e.AuthProvider,{client:r,initialSession:a,redirect:o??(e=>s.push(e)),children:i})};exports.AuthProvider=r;

package/dist/context.js

@@ -1 +1 @@
-"use client";import{AuthProvider as e}from"@aura-stack/react/context";import{useRouter as t}from"next/navigation";import{jsx as n}from"react/jsx-runtime";const r=({client:r,children:i,initialSession:a,redirect:o})=>{let s=t();return n(e,{client:r,initialSession:a,redirect:o??(e=>s.push(e)),children:i})};export{r as AuthProvider};
+"use client";import{AuthProvider as e}from"@aura-stack/react/context";import{useRouter as t}from"next/navigation.js";import{jsx as n}from"react/jsx-runtime";const r=({client:r,children:i,initialSession:a,redirect:o})=>{let s=t();return n(e,{client:r,initialSession:a,redirect:o??(e=>s.push(e)),children:i})};export{r as AuthProvider};

package/dist/identity/arktype.cjs

@@ -0,0 +1 @@
+var e=require(`@aura-stack/react/identity/arktype`);Object.keys(e).forEach(function(t){t!==`default`&&!Object.prototype.hasOwnProperty.call(exports,t)&&Object.defineProperty(exports,t,{enumerable:!0,get:function(){return e[t]}})});

package/dist/identity/arktype.d.ts

@@ -0,0 +1 @@
+export * from "@aura-stack/react/identity/arktype";

package/dist/identity/arktype.js

@@ -0,0 +1 @@
+export*from"@aura-stack/react/identity/arktype";export{};

package/dist/identity/index.cjs

@@ -0,0 +1 @@
+var e=require(`@aura-stack/react/identity/index`);Object.keys(e).forEach(function(t){t!==`default`&&!Object.prototype.hasOwnProperty.call(exports,t)&&Object.defineProperty(exports,t,{enumerable:!0,get:function(){return e[t]}})});

package/dist/identity/index.d.ts

@@ -0,0 +1 @@
+export * from "@aura-stack/react/identity/index";

package/dist/identity/index.js

@@ -0,0 +1 @@
+export*from"@aura-stack/react/identity/index";export{};

package/dist/identity/typebox.cjs

@@ -0,0 +1 @@
+var e=require(`@aura-stack/react/identity/typebox`);Object.keys(e).forEach(function(t){t!==`default`&&!Object.prototype.hasOwnProperty.call(exports,t)&&Object.defineProperty(exports,t,{enumerable:!0,get:function(){return e[t]}})});

package/dist/identity/typebox.d.ts

@@ -0,0 +1 @@
+export * from "@aura-stack/react/identity/typebox";

package/dist/identity/typebox.js

@@ -0,0 +1 @@
+export*from"@aura-stack/react/identity/typebox";export{};

package/dist/identity/valibot.cjs

@@ -0,0 +1 @@
+var e=require(`@aura-stack/react/identity/valibot`);Object.keys(e).forEach(function(t){t!==`default`&&!Object.prototype.hasOwnProperty.call(exports,t)&&Object.defineProperty(exports,t,{enumerable:!0,get:function(){return e[t]}})});

package/dist/identity/valibot.d.ts

@@ -0,0 +1 @@
+export * from "@aura-stack/react/identity/valibot";

package/dist/identity/valibot.js

@@ -0,0 +1 @@
+export*from"@aura-stack/react/identity/valibot";export{};

package/dist/identity/zod.cjs

@@ -0,0 +1 @@
+var e=require(`@aura-stack/react/identity/zod`);Object.keys(e).forEach(function(t){t!==`default`&&!Object.prototype.hasOwnProperty.call(exports,t)&&Object.defineProperty(exports,t,{enumerable:!0,get:function(){return e[t]}})});

package/dist/identity/zod.d.ts

@@ -0,0 +1 @@
+export * from "@aura-stack/react/identity/zod";

package/dist/identity/zod.js

@@ -0,0 +1 @@
+export*from"@aura-stack/react/identity/zod";export{};

package/dist/{index-CbFxTFu9.d.ts → index-DylhyiBS.d.ts}

@@ -9692,7 +9692,7 @@ interface DecodeJWTOptions {
   decrypt?: DecryptOptions;
 }
 //#endregion
-//#region ../core/dist/index-DIcbmH1M.d.ts
+//#region ../core/dist/index-tmedkhtX.d.ts
 //#endregion
 //#region src/jose.d.ts
 /**
@@ -9717,8 +9717,8 @@ declare const createJoseInstance: <DefaultUser extends User = User>(secret?: JWT
   encodeJWT: (payload: TypedJWTPayload<Partial<DefaultUser>>, options?: EncodeJWTOptions) => Promise<string>;
   decodeJWT: (token: string, options?: DecodeJWTOptions) => Promise<TypedJWTPayload<DefaultUser>>;
 }; //#endregion
-//#region src/shared/identity.d.ts
-declare const UserIdentity: ZodObject<{
+//#region src/identity/zod.d.ts
+declare const identitySchema$3: ZodObject<{
   sub: ZodString;
   name: ZodOptional<ZodNullable<ZodString>>;
   image: ZodOptional<ZodNullable<ZodString>>;
@@ -9808,6 +9808,7 @@ declare const createAuthAPI: <DefaultUser extends User = User, SignUpSchema exte
    * })
    */
   updateSession: (options: UpdateSessionAPIOptions<DefaultUser>) => Promise<UpdateSessionAPIReturn<DefaultUser>>;
+  getProviderTokens: (oauth: LiteralUnion<BuiltInOAuthProvider>, options?: GetProviderTokensAPIOptions) => Promise<GetProviderTokensAPIReturn>;
   /**
    * Signs out the current session on the server-side. It implements CSRF Protection by default, for
    * server-side calls it only verifies and validates the CSRF Token, it also provides Double-Submit
@@ -9833,6 +9834,190 @@ declare const createAuthAPI: <DefaultUser extends User = User, SignUpSchema exte
  * Each message includes facility, severity, msgId, and default message.
  */
 //#endregion
+//#region src/@types/session.d.ts
+/** Application user type, inferred from the configured identity schema (defaults to the built-in user shape). */
+type User = output<typeof identitySchema$3>;
+/**
+ * Session data returned by the session endpoint.
+ */
+interface Session<DefaultUser extends User = User> {
+  user: DefaultUser;
+  expires: string;
+}
+interface CryptoSecret {
+  sign: CryptoKey | CryptoKeyPair | JWK | JsonWebKey | AsymmetricKeyPair;
+  encrypt: CryptoKey | CryptoKeyPair | JWK | JsonWebKey | AsymmetricKeyPair;
+}
+interface AsymmetricKeyPair {
+  publicKey: CryptoKey | JWK;
+  privateKey: CryptoKey | JWK;
+}
+/**
+ * A symmetric secret or asymmetric key pair used for JWT operations.
+ *
+ * - string / Uint8Array: used as-is for HMAC (signed) or AES (encrypted)
+ * - CryptoKey: Web Crypto API key, for environments that support it
+ * - CryptoKeyPair: asymmetric signing/encryption (RS256, ES256, EdDSA, RSA-OAEP, etc.)
+ */
+type SecretKey = string | Uint8Array | CryptoKey | CryptoKeyPair | CryptoSecret | JWK | AsymmetricKeyPair;
+/**
+ * @todo: add key rotation support for "SecretKey | CryptoKeyPair | [SecretKey | CryptoKeyPair, ...(SecretKey | CryptoKeyPair)[]]"
+ */
+type JWTKey = SecretKey;
+/**
+ * - "signed"    → standard JWS (e.g. HS256, RS256, ES256).
+ * - "encrypted" → JWE only. (e.g. A256GCM with RSA-OAEP key wrapping).
+ * - "sealed"    → JWS nested inside JWE (signed then encrypted).
+ */
+/**
+ * Signing algorithms for "signed" and "sealed" modes.
+ * Symmetric: HS256 | HS384 | HS512
+ * Asymmetric: RS256 | RS384 | RS512 | ES256 | ES384 | ES512 | EdDSA | PS256
+ */
+type JWTSigningAlgorithm = "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "EdDSA" | "PS256";
+/**
+ * Key-wrapping algorithms for "encrypted" and "sealed" modes.
+ * Symmetric: A128KW | A192KW | A256KW | dir (direct)
+ * ECDH:      ECDH-ES | ECDH-ES+A128KW | ECDH-ES+A256KW
+ * RSA:       RSA-OAEP | RSA-OAEP-256
+ */
+type JWTKeyAlgorithm = "A128KW" | "A192KW" | "A256KW" | "dir" | "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A256KW" | "RSA-OAEP" | "RSA-OAEP-256";
+/** Content-encryption algorithms for JWE. */
+type JWTEncryptionAlgorithm = "A128CBC-HS256" | "A192CBC-HS384" | "A256CBC-HS512" | "A128GCM" | "A192GCM" | "A256GCM";
+/** Signed JWT mode configuration. */
+type JWTSignedMode = {
+  mode: "signed";
+  signingAlgorithm?: JWTSigningAlgorithm;
+};
+/** Encrypted JWT mode configuration. */
+type JWTEncryptedMode = {
+  mode: "encrypted";
+  keyAlgorithm?: JWTKeyAlgorithm;
+  encryptionAlgorithm?: JWTEncryptionAlgorithm;
+};
+/** Signed and Encrypted JWT mode configuration. */
+type JWTSealedMode = {
+  mode?: "sealed";
+  signingAlgorithm?: JWTSigningAlgorithm;
+  keyAlgorithm?: JWTKeyAlgorithm;
+  encryptionAlgorithm?: JWTEncryptionAlgorithm;
+};
+/** Discriminated union of JWT wire format: signed JWS, encrypted JWE, or nested sealed (JWS in JWE). */
+type JWTConfigBase = JWTSignedMode | JWTEncryptedMode | JWTSealedMode;
+/** How session/JWT lifetime is enforced relative to `iat`, absolute caps, and sliding windows. */
+type JWTExpirationStrategy = "fixed" | "rolling" | "absolute" | "sliding";
+type JWTConfig = Prettify<{
+  /**
+   * Token lifetime.
+   */
+  maxAge?: number;
+  /**
+   * JWT `iss` (issuer) claim. Set this to your app's canonical URL.
+   * @example "https://auth.example.com"
+   */
+  issuer?: string;
+  /**
+   * JWT `aud` claim. Single value or array for multi-audience tokens.
+   * @example ["https://api.example.com", "https://app.example.com"]
+   */
+  audience?: string | string[];
+  /**
+   * Maximum absolute session duration in seconds.
+   * Required for "absolute" and "sliding" strategies.
+   * Enforced via jose's maxTokenAge against the iat claim.
+   */
+  maxExpiration?: number;
+  /**
+   * Policy for renewing or capping token lifetime (pairs with `maxExpiration` where applicable).
+   */
+  expirationStrategy?: JWTExpirationStrategy;
+} & JWTConfigBase>;
+/**
+ * Stateless JWT strategy.
+ * No database required. Tokens are self-contained and cannot be revoked
+ * before they expire — keep `jwt.maxAge` short or enable refresh tokens.
+ *
+ * @example
+ * {
+ *   strategy: "jwt",
+ *   jwt: { mode: "sealed", maxAge: "15m", issuer: "https://auth.example.com" },
+ *   refreshToken: { enabled: true, maxAge: "7d" },
+ * }
+ */
+type StatelessStrategyConfig = {
+  strategy?: "jwt";
+  jwt?: JWTConfig;
+};
+/**
+ * The session strategy. Determines which fields below are required.
+ *
+ * - "jwt": stateless. No database needed. JWTs are self-contained.
+ * - "database": stateful. Every request hits the DB to validate the session.
+ * - "hybrid": JWT transport + DB revocation. Best of both for most apps.
+ *
+ * @default "jwt"
+ */
+type SessionConfig = StatelessStrategyConfig;
+/** Result of reading a stateless (JWT) session from a request: session payload and outgoing header mutations. */
+interface OAuthTokenPayload {
+  /**
+   * The raw access token string issued by the OAuth provider.
+   */
+  accessToken: string;
+  /**
+   * The expiration time of the access token, in seconds since the epoch (Unix time).
+   */
+  expiresAt: number;
+  /**
+   * The raw refresh token string issued by the OAuth provider, if applicable.
+   */
+  refreshToken?: string;
+  /**
+   * The expiration time of the refresh token, in seconds since the epoch (Unix time).
+   */
+  refreshTokenExpiresAt?: number;
+  /**
+   * The raw ID token string issued by the OIDC provider. Only supported by OIDC-compliant providers.
+   */
+  idToken?: string;
+  /**
+   * The type of token issued by the OAuth provider. Typically "Bearer" for OAuth 2.0.
+   */
+  tokenType: "Bearer";
+  /**
+   * The scopes granted to the access token, as an array of strings. These define the permissions the token has.
+   */
+  scopes: string[];
+  /**
+   * The issuer of the token, typically the OAuth provider's URL. This is used to validate the token's authenticity.
+   */
+  issuer?: string;
+  /**
+   * The time at which the token was issued, in seconds since the epoch (Unix time).
+   */
+  issuedAt: number;
+} //#endregion
+//#region src/validator/registry.d.ts
+type OpenIDProvider<Profile extends object = Record<string, any>, DefaultUser = User, Issuer extends string = string> = {
+  id: string;
+  name: string;
+  /**
+   * URL to concatenating the string /.well-known/openid-configuration to the Issuer.
+   */
+  issuer: Issuer;
+  clientId?: string;
+  clientSecret?: string;
+  /**
+   * Refresh window in seconds before the access token expires to attempt a refresh.
+   * Defaults to 300 seconds.
+   */
+  refreshWindow?: number;
+  /**
+   * Override the default OIDC scope (`openid profile email`).
+   */
+  scope?: string;
+  profile?: (profile: Profile) => DefaultUser | Promise<DefaultUser>;
+} & GetRouteParams<`/${Issuer}`>; //#endregion
 //#region src/oauth/github.d.ts
 /**
  * @see [Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user)
@@ -10681,146 +10866,6 @@ interface AuthentikProfile {
  * @see [Authentik - Create an OAuth2 Provider](https://docs.goauthentik.io/add-secure-apps/providers/oauth2/create-oauth2-provider/)
  */
 //#endregion
-//#region src/@types/session.d.ts
-/** Application user type, inferred from the configured identity schema (defaults to the built-in user shape). */
-type User = output<typeof UserIdentity>;
-/**
- * Session data returned by the session endpoint.
- */
-interface Session<DefaultUser extends User = User> {
-  user: DefaultUser;
-  expires: string;
-}
-interface CryptoSecret {
-  sign: CryptoKey | CryptoKeyPair | JWK | JsonWebKey | AsymmetricKeyPair;
-  encrypt: CryptoKey | CryptoKeyPair | JWK | JsonWebKey | AsymmetricKeyPair;
-}
-interface AsymmetricKeyPair {
-  publicKey: CryptoKey | JWK;
-  privateKey: CryptoKey | JWK;
-}
-/**
- * A symmetric secret or asymmetric key pair used for JWT operations.
- *
- * - string / Uint8Array: used as-is for HMAC (signed) or AES (encrypted)
- * - CryptoKey: Web Crypto API key, for environments that support it
- * - CryptoKeyPair: asymmetric signing/encryption (RS256, ES256, EdDSA, RSA-OAEP, etc.)
- */
-type SecretKey = string | Uint8Array | CryptoKey | CryptoKeyPair | CryptoSecret | JWK | AsymmetricKeyPair;
-/**
- * @todo: add key rotation support for "SecretKey | CryptoKeyPair | [SecretKey | CryptoKeyPair, ...(SecretKey | CryptoKeyPair)[]]"
- */
-type JWTKey = SecretKey;
-/**
- * - "signed"    → standard JWS (e.g. HS256, RS256, ES256).
- * - "encrypted" → JWE only. (e.g. A256GCM with RSA-OAEP key wrapping).
- * - "sealed"    → JWS nested inside JWE (signed then encrypted).
- */
-/**
- * Signing algorithms for "signed" and "sealed" modes.
- * Symmetric: HS256 | HS384 | HS512
- * Asymmetric: RS256 | RS384 | RS512 | ES256 | ES384 | ES512 | EdDSA | PS256
- */
-type JWTSigningAlgorithm = "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "EdDSA" | "PS256";
-/**
- * Key-wrapping algorithms for "encrypted" and "sealed" modes.
- * Symmetric: A128KW | A192KW | A256KW | dir (direct)
- * ECDH:      ECDH-ES | ECDH-ES+A128KW | ECDH-ES+A256KW
- * RSA:       RSA-OAEP | RSA-OAEP-256
- */
-type JWTKeyAlgorithm = "A128KW" | "A192KW" | "A256KW" | "dir" | "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A256KW" | "RSA-OAEP" | "RSA-OAEP-256";
-/** Content-encryption algorithms for JWE. */
-type JWTEncryptionAlgorithm = "A128CBC-HS256" | "A192CBC-HS384" | "A256CBC-HS512" | "A128GCM" | "A192GCM" | "A256GCM";
-/** Signed JWT mode configuration. */
-type JWTSignedMode = {
-  mode: "signed";
-  signingAlgorithm?: JWTSigningAlgorithm;
-};
-/** Encrypted JWT mode configuration. */
-type JWTEncryptedMode = {
-  mode: "encrypted";
-  keyAlgorithm?: JWTKeyAlgorithm;
-  encryptionAlgorithm?: JWTEncryptionAlgorithm;
-};
-/** Signed and Encrypted JWT mode configuration. */
-type JWTSealedMode = {
-  mode?: "sealed";
-  signingAlgorithm?: JWTSigningAlgorithm;
-  keyAlgorithm?: JWTKeyAlgorithm;
-  encryptionAlgorithm?: JWTEncryptionAlgorithm;
-};
-/** Discriminated union of JWT wire format: signed JWS, encrypted JWE, or nested sealed (JWS in JWE). */
-type JWTConfigBase = JWTSignedMode | JWTEncryptedMode | JWTSealedMode;
-/** How session/JWT lifetime is enforced relative to `iat`, absolute caps, and sliding windows. */
-type JWTExpirationStrategy = "fixed" | "rolling" | "absolute" | "sliding";
-type JWTConfig = Prettify<{
-  /**
-   * Token lifetime.
-   */
-  maxAge?: number;
-  /**
-   * JWT `iss` (issuer) claim. Set this to your app's canonical URL.
-   * @example "https://auth.example.com"
-   */
-  issuer?: string;
-  /**
-   * JWT `aud` claim. Single value or array for multi-audience tokens.
-   * @example ["https://api.example.com", "https://app.example.com"]
-   */
-  audience?: string | string[];
-  /**
-   * Maximum absolute session duration in seconds.
-   * Required for "absolute" and "sliding" strategies.
-   * Enforced via jose's maxTokenAge against the iat claim.
-   */
-  maxExpiration?: number;
-  /**
-   * Policy for renewing or capping token lifetime (pairs with `maxExpiration` where applicable).
-   */
-  expirationStrategy?: JWTExpirationStrategy;
-} & JWTConfigBase>;
-/**
- * Stateless JWT strategy.
- * No database required. Tokens are self-contained and cannot be revoked
- * before they expire — keep `jwt.maxAge` short or enable refresh tokens.
- *
- * @example
- * {
- *   strategy: "jwt",
- *   jwt: { mode: "sealed", maxAge: "15m", issuer: "https://auth.example.com" },
- *   refreshToken: { enabled: true, maxAge: "7d" },
- * }
- */
-type StatelessStrategyConfig = {
-  strategy?: "jwt";
-  jwt?: JWTConfig;
-};
-/**
- * The session strategy. Determines which fields below are required.
- *
- * - "jwt": stateless. No database needed. JWTs are self-contained.
- * - "database": stateful. Every request hits the DB to validate the session.
- * - "hybrid": JWT transport + DB revocation. Best of both for most apps.
- *
- * @default "jwt"
- */
-type SessionConfig = StatelessStrategyConfig;
-/** Result of reading a stateless (JWT) session from a request: session payload and outgoing header mutations. */
-type OpenIDProvider<Profile extends object = Record<string, any>, DefaultUser = User, Issuer extends string = string> = {
-  id: string;
-  name: string;
-  /**
-   * URL to concatenating the string /.well-known/openid-configuration to the Issuer.
-   */
-  issuer: Issuer;
-  clientId?: string;
-  clientSecret?: string;
-  /**
-   * Override the default OIDC scope (`openid profile email`).
-   */
-  scope?: string;
-  profile?: (profile: Profile) => DefaultUser | Promise<DefaultUser>;
-} & GetRouteParams<`/${Issuer}`>; //#endregion
 //#region src/oauth/index.d.ts
 declare const builtInOAuthProviders: {
   readonly github: <DefaultUser extends User = {
@@ -11011,6 +11056,20 @@ interface OAuthProviderConfig<Profile extends object = Record<string, any>, Defa
     url: string;
     request: (context: AccessTokenContext) => Profile | Promise<Profile>;
   };
+  /**
+   * Refresh token configuration for the OAuth provider. This option allows refreshing access tokens
+   * when they expire.
+   */
+  refreshToken?: string | {
+    url: string;
+    headers?: Record<string, string>;
+    params?: Record<string, string>;
+  };
+  /**
+   * Refresh window in seconds before the access token expires to attempt a refresh.
+   * Defaults to 300 seconds.
+   */
+  refreshWindow?: number;
   /**
    * @deprecated
    * use `authorize.params.scope` instead of `scope`
@@ -11085,19 +11144,19 @@ type Prettify<T> = { [K in keyof T]: T[K] };
  * Useful for autocomplete on known keys while still allowing custom values.
  */
 type LiteralUnion<T extends U, U = string> = T | (U & Record<never, never>);
+/** Merges type `B` over `A`, replacing overlapping keys with `B`. */
+type Merge<A, B> = Omit<A, keyof B> & B;
 /**
  * Transforms a Zod raw shape so nested `ZodObject` fields become editable (same structure, for config authoring).
  */
-type ValibotShapeToObject<S extends ObjectEntries> = Merge<InferOutput<ObjectSchema<S, undefined>>, User>;
-type ArktypeShapeToObject<S extends Type> = S extends Type<infer Shape> ? Wrap<Merge<Shape, User>> : never;
-type TypeboxShapeToObject<S> = Wrap<Merge<S, User>>;
-/** Merges type `B` over `A`, replacing overlapping keys with `B`. */
-type Merge<A, B> = Omit<A, keyof B> & B;
 /**
  * Infers the runtime object type from a Zod `shape` and intersects it with {@link User}
  * so identity fields always include the base user contract.
  */
 type ZodShapeToObject<S extends ZodRawShape = ZodRawShape> = Merge<output<ZodObject<S>>, User>;
+type ValibotShapeToObject<S extends ObjectEntries> = Merge<InferOutput<ObjectSchema<S, undefined>>, User>;
+type ArktypeShapeToObject<S extends Type> = S extends Type<infer Shape> ? Wrap<Merge<Shape, User>> : never;
+type TypeboxShapeToObject<S> = Wrap<Merge<S, User>>;
 type FromShapeToObject<S> = S extends ZodRawShape ? ZodShapeToObject<S> : S extends ObjectEntries ? ValibotShapeToObject<S> : S extends Type ? ArktypeShapeToObject<S> : S extends TProperties ? TypeboxShapeToObject<S> : S extends User ? S : never;
 /** Recursively makes every property optional. */
 type DeepPartial<T> = { [P in keyof T]?: T[P] extends object ? DeepPartial<T[P]> : T[P] };
@@ -11384,5 +11443,14 @@ type SignUpReturnData = /** redirect: true & redirectTo: string */{
 };
 /** Programmatic sign-up result with redirect metadata and `toResponse()`. */
 type SignUpAPIReturn = AuthActionAPIReturn<SignUpReturnData>;
+interface GetProviderTokensAPIOptions extends Pick<APIOptionsWithRequest, "headers" | "request">, APIOptionsWithSkipCSRFCheck {}
+type GetProviderTokensData = {
+  success: true;
+  tokens: OAuthTokenPayload;
+} | {
+  success: false;
+  tokens: null;
+};
+type GetProviderTokensAPIReturn = AuthActionAPIReturn<GetProviderTokensData>;
 //#endregion
-export { UpdateSessionAPIOptions as _, GetSessionAPIReturn as a, EncodeJWTOptions as b, Session as c, SignInCredentialsAPIOptions as d, SignInCredentialsAPIReturn as f, SignUpAPIReturn as g, SignUpAPIOptions as h, GetSessionAPIOptions as i, SignInAPIOptions as l, SignOutAPIReturn as m, BuiltInOAuthProvider as n, LiteralUnion as o, SignOutAPIOptions as p, FromShapeToObject as r, Prettify as s, AuthInstance as t, SignInAPIReturn as u, UpdateSessionAPIReturn as v, TypedJWTPayload as x, DecodeJWTOptions as y };
+export { DecodeJWTOptions as C, Wrap as S, TypedJWTPayload as T, SignOutAPIReturn as _, GetProviderTokensAPIReturn as a, UpdateSessionAPIOptions as b, LiteralUnion as c, Session as d, SignInAPIOptions as f, SignOutAPIOptions as g, SignInCredentialsAPIReturn as h, GetProviderTokensAPIOptions as i, Prettify as l, SignInCredentialsAPIOptions as m, BuiltInOAuthProvider as n, GetSessionAPIOptions as o, SignInAPIReturn as p, FromShapeToObject as r, GetSessionAPIReturn as s, AuthInstance as t, RemoveIndexSignature as u, SignUpAPIOptions as v, EncodeJWTOptions as w, UpdateSessionAPIReturn as x, SignUpAPIReturn as y };

package/dist/index.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require(`next/navigation`),t=require(`@aura-stack/react/server`),n=require(`next/headers`),r=require(`@aura-stack/react/cookies`);const i=async e=>{let t=await(0,n.cookies)(),i=e.getSetCookie();for(let e of i){let{name:n,value:i,...a}=(0,r.parseSetCookie)(e);t.set(n,i??``,a)}},a=({api:e})=>async t=>{try{let r=await e.getSession({...t,headers:await(0,n.headers)()});return r.success?r.session:null}catch{return console.error(`[error:server] getSession - Failed to retrieve session`),null}},o=({api:t})=>async(r,i)=>{let a=await t.signIn(r,{headers:await(0,n.headers)(),...i,redirect:!!i?.redirect});return i?.redirect===!1?a:a.success&&a.signInURL?(0,e.redirect)(a.signInURL):a},s=({api:t})=>async r=>{let a=await t.signInCredentials({headers:await(0,n.headers)(),...r,redirect:!!r.redirect});return await i(a.headers),a.success&&a.redirectURL?(0,e.redirect)(a.redirectURL):a},c=({api:t})=>async r=>{let a=await t.updateSession({headers:await(0,n.headers)(),...r,redirect:!!r.redirect,session:r.session});return await i(a.headers),a.success&&a.redirectURL?(0,e.redirect)(a.redirectURL):a},l=({api:t})=>async r=>{let a=await t.signOut({headers:await(0,n.headers)(),...r,redirect:!!r?.redirect});return await i(a.headers),a.success&&a.redirectURL?(0,e.redirect)(a.redirectURL):a},u=e=>({getSession:a(e),signIn:o(e),signInCredentials:s(e),updateSession:c(e),signOut:l(e)}),d=e=>{let n=(0,t.createAuth)(e);return{core:n,api:u(n),handlers:n.handlers}};exports.createAuth=d;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require(`next/navigation.js`),t=require(`@aura-stack/react/server`),n=require(`next/headers.js`),r=require(`@aura-stack/react/cookies`);const i=async e=>{let t=await(0,n.cookies)(),i=e.getSetCookie();for(let e of i){let{name:n,value:i,...a}=(0,r.parseSetCookie)(e);t.set(n,i??``,a)}},a=({api:e})=>async t=>{try{let r=await e.getSession({...t,headers:await(0,n.headers)()});return r.success?r.session:null}catch{return console.error(`[error:server] getSession - Failed to retrieve session`),null}},o=({api:t})=>async(r,i)=>{let a=await t.signIn(r,{headers:await(0,n.headers)(),...i,redirect:!!i?.redirect});return i?.redirect===!1?a:a.success&&a.signInURL?(0,e.redirect)(a.signInURL):a},s=({api:t})=>async r=>{let a=await t.signInCredentials({headers:await(0,n.headers)(),...r,redirect:!!r.redirect});return await i(a.headers),a.success&&a.redirectURL?(0,e.redirect)(a.redirectURL):a},c=({api:t})=>async r=>{let a=await t.updateSession({headers:await(0,n.headers)(),...r,redirect:!!r.redirect,session:r.session});return await i(a.headers),a.success&&a.redirectURL?(0,e.redirect)(a.redirectURL):a},l=({api:e})=>async(t,r)=>await e.getProviderTokens(t,{headers:await(0,n.headers)(),...r}),u=({api:t})=>async r=>{let a=await t.signOut({headers:await(0,n.headers)(),...r,redirect:!!r?.redirect});return await i(a.headers),a.success&&a.redirectURL?(0,e.redirect)(a.redirectURL):a},d=e=>({getSession:a(e),signIn:o(e),signInCredentials:s(e),updateSession:c(e),getProviderTokens:l(e),signOut:u(e)}),f=e=>{let n=(0,t.createAuth)(e);return{core:n,api:d(n),handlers:n.handlers}};exports.createAuth=f;