@aura-stack/next 0.2.1 → 0.3.0

package/dist/{index-CbFxTFu9.d.ts → index-BbJId8e2.d.ts}

@@ -553,7 +553,7 @@ type MaybePromise<TValue$1> = TValue$1 | Promise<TValue$1>;
 * Hint: This type has no effect and is only used so that TypeScript displays
 * the final type in the preview instead of the utility types used.
 */
-type Prettify$3<TObject> = { [TKey in keyof TObject]: TObject[TKey] } & {};
+type Prettify$2<TObject> = { [TKey in keyof TObject]: TObject[TKey] } & {};
 /**
 * Marks specific keys as optional.
 */
@@ -641,11 +641,11 @@ type OutputWithReadonly<TEntries$1 extends ObjectEntries | ObjectEntriesAsync, T
 /**
 * Infer object input type.
 */
-type InferObjectInput<TEntries$1 extends ObjectEntries | ObjectEntriesAsync> = Prettify$3<InputWithQuestionMarks<TEntries$1, InferEntriesInput<TEntries$1>>>;
+type InferObjectInput<TEntries$1 extends ObjectEntries | ObjectEntriesAsync> = Prettify$2<InputWithQuestionMarks<TEntries$1, InferEntriesInput<TEntries$1>>>;
 /**
 * Infer object output type.
 */
-type InferObjectOutput<TEntries$1 extends ObjectEntries | ObjectEntriesAsync> = Prettify$3<OutputWithReadonly<TEntries$1, OutputWithQuestionMarks<TEntries$1, InferEntriesOutput<TEntries$1>>>>;
+type InferObjectOutput<TEntries$1 extends ObjectEntries | ObjectEntriesAsync> = Prettify$2<OutputWithReadonly<TEntries$1, OutputWithQuestionMarks<TEntries$1, InferEntriesOutput<TEntries$1>>>>;
 /**
 * Infer object issue type.
 */
@@ -7624,7 +7624,7 @@ type MakeReadonly<T> = T extends Map<infer K, infer V> ? ReadonlyMap<K, V> : T e
 type SomeObject = Record<PropertyKey, any>;
 type Identity$1<T> = T;
 type Flatten<T> = Identity$1<{ [k in keyof T]: T[k] }>;
-type Prettify$2<T> = { [K in keyof T]: T[K] } & {};
+type Prettify$1<T> = { [K in keyof T]: T[K] } & {};
 type Extend<A extends SomeObject, B extends SomeObject> = Flatten<keyof A & keyof B extends never ? A & B : { [K in keyof A as K extends keyof B ? never : K]: A[K] } & { [K in keyof B]: B[K] }>;
 type TupleItems = ReadonlyArray<SomeType>;
 type AnyFunc = (...args: any[]) => any;
@@ -8110,8 +8110,8 @@ type OptionalInSchema = {
     optin: "optional";
   };
 };
-type $InferObjectOutput<T extends $ZodLooseShape, Extra extends Record<string, unknown>> = string extends keyof T ? IsAny<T[keyof T]> extends true ? Record<string, unknown> : Record<string, output<T[keyof T]>> : keyof (T & Extra) extends never ? Record<string, never> : Prettify$2<{ -readonly [k in keyof T as T[k] extends OptionalOutSchema ? never : k]: T[k]["_zod"]["output"] } & { -readonly [k in keyof T as T[k] extends OptionalOutSchema ? k : never]?: T[k]["_zod"]["output"] } & Extra>;
-type $InferObjectInput<T extends $ZodLooseShape, Extra extends Record<string, unknown>> = string extends keyof T ? IsAny<T[keyof T]> extends true ? Record<string, unknown> : Record<string, input<T[keyof T]>> : keyof (T & Extra) extends never ? Record<string, never> : Prettify$2<{ -readonly [k in keyof T as T[k] extends OptionalInSchema ? never : k]: T[k]["_zod"]["input"] } & { -readonly [k in keyof T as T[k] extends OptionalInSchema ? k : never]?: T[k]["_zod"]["input"] } & Extra>;
+type $InferObjectOutput<T extends $ZodLooseShape, Extra extends Record<string, unknown>> = string extends keyof T ? IsAny<T[keyof T]> extends true ? Record<string, unknown> : Record<string, output<T[keyof T]>> : keyof (T & Extra) extends never ? Record<string, never> : Prettify$1<{ -readonly [k in keyof T as T[k] extends OptionalOutSchema ? never : k]: T[k]["_zod"]["output"] } & { -readonly [k in keyof T as T[k] extends OptionalOutSchema ? k : never]?: T[k]["_zod"]["output"] } & Extra>;
+type $InferObjectInput<T extends $ZodLooseShape, Extra extends Record<string, unknown>> = string extends keyof T ? IsAny<T[keyof T]> extends true ? Record<string, unknown> : Record<string, input<T[keyof T]>> : keyof (T & Extra) extends never ? Record<string, never> : Prettify$1<{ -readonly [k in keyof T as T[k] extends OptionalInSchema ? never : k]: T[k]["_zod"]["input"] } & { -readonly [k in keyof T as T[k] extends OptionalInSchema ? k : never]?: T[k]["_zod"]["input"] } & Extra>;
 type $ZodObjectConfig = {
   out: Record<string, unknown>;
   in: Record<string, unknown>;
@@ -8994,7 +8994,7 @@ type SchemaKind<T> = [T] extends [$ZodType] ? "zod" : [T] extends [ObjectSchema<
  * const getPostsComments:RoutePattern = "/posts/:postId/comments/:commentId"
  */
 type RoutePattern = `/${string}`;
-type Prettify$1<Obj extends object> = { [Key in keyof Obj]: Obj[Key] } & {};
+type Prettify<Obj extends object> = { [Key in keyof Obj]: Obj[Key] } & {};
 type GetParam<Route extends string> = Route extends `:${infer Param}` ? { [K in Param]: string } : {};
 /**
  * Extracts route parameters from a given route pattern through colon-prefixed segments.
@@ -9011,7 +9011,7 @@ type GetParam<Route extends string> = Route extends `:${infer Param}` ? { [K in
  * // Expected: {}
  * type NoParams = Params<"/about">;
  */
-type GetRouteParams<Route extends RoutePattern> = Route extends `/${infer Path}/${infer Str}` ? Prettify$1<GetParam<Path> & GetRouteParams<`/${Str}`>> : Route extends `/${infer Path}` ? GetParam<Path> : {};
+type GetRouteParams<Route extends RoutePattern> = Route extends `/${infer Path}/${infer Str}` ? Prettify<GetParam<Path> & GetRouteParams<`/${Str}`>> : Route extends `/${infer Path}` ? GetParam<Path> : {};
 /**
  * Available schemas validation for an endpoint. It can include body and searchParams schemas.
  */
@@ -9692,8 +9692,7 @@ interface DecodeJWTOptions {
   decrypt?: DecryptOptions;
 }
 //#endregion
-//#region ../core/dist/index-DIcbmH1M.d.ts
-//#endregion
+//#region ../core/dist/index-vaLptcEI.d.ts
 //#region src/jose.d.ts
 /**
  * Creates the JOSE instance used for signing and verifying tokens. It derives keys
@@ -9717,14 +9716,16 @@ declare const createJoseInstance: <DefaultUser extends User = User>(secret?: JWT
   encodeJWT: (payload: TypedJWTPayload<Partial<DefaultUser>>, options?: EncodeJWTOptions) => Promise<string>;
   decodeJWT: (token: string, options?: DecodeJWTOptions) => Promise<TypedJWTPayload<DefaultUser>>;
 }; //#endregion
-//#region src/shared/identity.d.ts
-declare const UserIdentity: ZodObject<{
+//#region src/identity/arktype.d.ts
+type SchemaTypes = ZodObject<any> | ObjectSchema<any, undefined> | Type<{}> | TObject;
+//#endregion
+//#region src/identity/zod.d.ts
+declare const identitySchema: ZodObject<{
   sub: ZodString;
   name: ZodOptional<ZodNullable<ZodString>>;
   image: ZodOptional<ZodNullable<ZodString>>;
   email: ZodOptional<ZodNullable<ZodEmail>>;
 }, $strip>;
-type SchemaTypes = ZodObject<any> | ObjectSchema<any, undefined> | Type<{}> | TObject;
 //#endregion
 //#region src/api/createApi.d.ts
 declare const createAuthAPI: <DefaultUser extends User = User, SignUpSchema extends SchemaTypes = ZodObject<any>>(ctx: GlobalContext) => {
@@ -9808,6 +9809,93 @@ declare const createAuthAPI: <DefaultUser extends User = User, SignUpSchema exte
    * })
    */
   updateSession: (options: UpdateSessionAPIOptions<DefaultUser>) => Promise<UpdateSessionAPIReturn<DefaultUser>>;
+  /**
+   * Retrieves the access token for a specific OAuth provider on the server-side.
+   * It implements CSRF Protection by default, for server-side calls it only verifies and validates the CSRF Token,
+   * it also provides Double-Submit Cookie protection by requiring the `session_token` cookie to be included in
+   * the request headers.
+   *
+   * @params oauth - The OAuth provider for which to retrieve the access token (e.g., "github", "gitlab", "bitbucket").
+   * @params options - Options for the API call, including headers and request object.
+   * @example
+   * const { success, tokens } = await api.getProviderTokens("github", {
+   *    headers: getHeaders()
+   * })
+   *
+   * const { accessToken, refreshToken } = tokens
+   */
+  getProviderTokens: (oauth: LiteralUnion<BuiltInOAuthProvider>, options?: GetProviderTokensAPIOptions) => Promise<GetProviderTokensAPIReturn>;
+  /**
+   * Retrieves the access token for a specific OAuth provider on the server-side.
+   * It implements CSRF Protection by default, for server-side calls it only verifies and validates the CSRF Token,
+   * it also provides Double-Submit Cookie protection by requiring the `session_token` cookie to be included in
+   * the request headers.
+   *
+   * > **NOTE**: This method is based on `getProviderTokens` and it's recommended for simple use cases where only the
+   * access token is needed. For more advanced scenarios, consider using `getProviderTokens` directly.
+   *
+   * @params oauth - The OAuth provider for which to retrieve the access token (e.g., "github", "gitlab", "bitbucket").
+   * @params options - Options for the API call, including headers and request object.
+   * @example
+   * const { success, accessToken } = await api.getAccessToken("github", {
+   *    headers: getHeaders()
+   * })
+   */
+  getAccessToken: (oauth: LiteralUnion<BuiltInOAuthProvider>, options?: AccessTokenAPIOptions) => Promise<AccessTokenAPIReturn>;
+  /**
+   * Refreshes the user profile data from the OAuth provider on the server-side. It makes a request to the
+   * `userInfo` endpoint of the specified OAuth provider.
+   *
+   * @param oauth - The OAuth provider for which to refresh the user profile data (e.g., "github", "gitlab", "bitbucket").
+   * @param options - Options for the API call, including headers and request object.
+   * @example
+   * const { success, session } = await api.refreshUserInfo("github", {
+   *    headers: getHeaders()
+   * })
+   */
+  refreshUserInfo: (oauth: LiteralUnion<BuiltInOAuthProvider>, options?: RefreshUserInfoAPIOptions) => Promise<RefreshUserInfoAPIReturn<DefaultUser>>;
+  /**
+   * Revokes the access token for a specific OAuth provider on the server-side. It makes a request to the
+   * `revokeToken` endpoint of the specified OAuth provider.
+   *
+   * @param oauth - The OAuth provider for which to revoke the access token (e.g., "github", "gitlab", "bitbucket").
+   * @param options - Options for the API call, including headers and request object.
+   * @example
+   * const { success, headers } = await api.revokeToken("github", {
+   *    headers: getHeaders()
+   * })
+   * // Use the returned headers to update the response headers in your server-side logic
+   * return new Response(null, { status: 200, headers })
+   */
+  revokeToken: (oauth: LiteralUnion<BuiltInOAuthProvider>, options?: RevokeTokenAPIOptions) => Promise<RevokeTokenAPIReturn>;
+  /**
+   * Disconnects the OAuth provider for the current session on the server-side. It removes the association
+   * between the user's session and the specified OAuth provider.
+   * @params oauth - The OAuth provider to disconnect (e.g., "github", "gitlab", "bitbucket").
+   * @params options - Options for the API call, including headers and request object.
+   * @example
+   * const { success, headers } = await api.disconnectProvider("github", {
+   *    headers: getHeaders()
+   * })
+   * // Use the returned headers to update the response headers in your server-side logic
+   * return new Response(null, { status: 200, headers })
+   */
+  disconnectProvider: (oauth: LiteralUnion<BuiltInOAuthProvider>, options?: DisconnectProviderAPIOptions) => Promise<DisconnectProviderAPIReturn>;
+  /**
+   * Checks if the current session is connected to a specific OAuth provider on the server-side. It verifies
+   * the presence of a valid access token for the specified provider in the session.
+   *
+   * @param oauth - The OAuth provider to check for connection (e.g., "github", "gitlab", "bitbucket").
+   * @param options - Options for the API call, including headers and request object.
+   * @example
+   * const { success, connected } = await api.isProviderConnected("github", {
+   *    headers: getHeaders()
+   * })
+   * if (connected) {
+   *    // The session is connected to the GitHub provider
+   * }
+   */
+  isProviderConnected: (oauth: LiteralUnion<BuiltInOAuthProvider>, options?: ProviderConnectedAPIOptions) => Promise<ProviderConnectedAPIReturn>;
   /**
    * Signs out the current session on the server-side. It implements CSRF Protection by default, for
    * server-side calls it only verifies and validates the CSRF Token, it also provides Double-Submit
@@ -9833,6 +9921,484 @@ declare const createAuthAPI: <DefaultUser extends User = User, SignUpSchema exte
  * Each message includes facility, severity, msgId, and default message.
  */
 //#endregion
+//#region src/@types/entities.d.ts
+type UserStatus = "active" | "suspended" | "pending_verification" | "deleted";
+/**
+ * @todo: add "passkey" and "saml" to AccountType when we implement those providers
+ */
+type AccountType$1 = "oauth" | "credentials";
+type AccountStatus = "active" | "unlinked" | "suspended";
+type SessionStatus = "active" | "expired" | "revoked";
+/**
+ * Tracks MFA progress within a session.
+ *   - "none": MFA not required for this user or session
+ *   - "pending": primary auth passed, MFA challenge not yet completed
+ *   - "completed": MFA challenge passed
+ *   - "skipped": trusted device, MFA step-up bypassed
+ */
+type MFAState = "none" | "pending" | "completed" | "skipped";
+type MFAMethod = "totp" | "webauthn_passkey" | "webauthn_security_key" | "sms" | "email" | "recovery_code";
+type DeviceType = "desktop" | "mobile" | "tablet" | "tv" | "bot" | "unknown";
+type RevokeReason = "user_logout" | "admin_action" | "password_changed" | "email_changed" | "all_sessions_revoked" | "mfa_disabled" | "account_suspended" | "max_sessions_exceeded";
+interface UserEntity {
+  id: string;
+  name: string | null;
+  email: string | null;
+  image: string | null;
+  emailVerifiedAt: Date | null;
+  status: UserStatus;
+  mfaEnabled: boolean;
+  mfaPreferredMethod: MFAMethod | null;
+  createdAt: Date;
+  updatedAt: Date;
+  /**
+   * Used to store the extra user attributes and extended by the `identity.schema`
+   * configuration.
+   */
+  attributes: Record<string, unknown> | null;
+}
+interface AccountEntity {
+  id: string;
+  userId: string;
+  provider: string;
+  providerUserId: string;
+  type: AccountType$1;
+  status: AccountStatus;
+  createdAt: Date;
+  updatedAt: Date;
+}
+interface OAuthAccountEntity {
+  accountId: string;
+  accessToken: string;
+  refreshToken: string | null;
+  idToken: string | null;
+  tokenType: string | null;
+  scopes: string | null;
+  issuer: string | null;
+  accessTokenExpiresAt: Date | null;
+  refreshTokenExpiresAt: Date | null;
+  updatedAt: Date;
+}
+interface CredentialAccountEntity {
+  accountId: string;
+  passwordHash: string;
+  updatedAt: Date;
+}
+interface SessionEntity {
+  id: string;
+  userId: string;
+  deviceId: string | null;
+  authenticatedWith: string;
+  status: SessionStatus;
+  mfaState: MFAState;
+  tokenHash: string;
+  expiresAt: Date;
+  metadata: Record<string, unknown> | null;
+  lastActivityAt: Date;
+  revokedAt: Date | null;
+  createdAt: Date;
+  updatedAt: Date;
+}
+type SessionWithUserEntity = SessionEntity & {
+  user: UserEntity;
+};
+/**
+ * Tracks physical devices across sessions.
+ */
+interface DeviceEntity {
+  id: string;
+  userId: string;
+  /**
+   * User-assigned label for the device, e.g. "Work MacBook" or "iPhone 14 Pro".
+   */
+  name: string | null;
+  type: DeviceType;
+  /**
+   * Platform name and version, e.g. "macOS 14.1" or "Android 14".
+   */
+  platform: string | null;
+  /**
+   * Browser name and version, e.g. "Chrome 120" or "Safari 17".
+   */
+  browser: string | null;
+  /**
+   * User-Agent string captured at first sign-in from this device.
+   * @see https://developer.mozilla.org/es/docs/Web/HTTP/Reference/Headers/User-Agent
+   */
+  userAgent: string | null;
+  fingerprint: string | null;
+  lastIp: string | null;
+  trusted: boolean;
+  firstSeenAt: Date;
+  lastSeenAt: Date;
+  metadata: Record<string, unknown> | null;
+}
+interface MFACredentialEntity {
+  id: string;
+  userId: string;
+  type: MFAMethod;
+  credentialData: Record<string, unknown>;
+  isPrimary: boolean;
+  verifiedAt: Date | null;
+  createdAt: Date;
+  metadata: Record<string, unknown> | null;
+}
+/**
+ * Stores the OAuth transaction state during an OAuth or OIDC authorization flow.
+ */
+interface OAuthTransactionEntity {
+  id: string;
+  provider: string;
+  state: string;
+  nonce: string | null;
+  codeVerifier: string | null;
+  redirectURI: string;
+  redirectTo: string | null;
+  userAgent: string | null;
+  fingerprint: string | null;
+  deviceId: string | null;
+  createdAt: Date;
+  expiresAt: Date;
+  metadata: Record<string, unknown> | null;
+} //#endregion
+//#region src/@types/adapter.d.ts
+interface UsersAdapter {
+  /**
+   * User management methods
+   */
+  createUser(input: Partial<Omit<UserEntity, "createdAt" | "updatedAt">>): Promise<UserEntity>;
+  getUserById(id: string): Promise<UserEntity | null>;
+  getUserByEmail(email: string): Promise<UserEntity | null>;
+  updateUser(id: string, input: Partial<Omit<UserEntity, "createdAt" | "updatedAt">>): Promise<UserEntity>;
+  /**
+   * Soft delete: sets status = "deleted", row is preserved.
+   * Hard delete: removes the row and all owned rows (Accounts, Sessions,
+   * Devices, MfaCredentials). Strategy is set in AdapterConfig, not here.
+   *
+   * Delete an user based on the selected strategy.
+   *   - `"soft"`: The user is marked as deleted, but the row is preserved in the database.
+   *   - `"hard"`: The user and all associated data (Accounts, Sessions, Devices, MfaCredentials) are permanently removed from the database.
+   */
+  deleteUser(id: string): Promise<void>;
+}
+interface AccountsAdapter {
+  /**
+   * Account management methods
+   */
+  createAccount(input: Partial<Omit<AccountEntity, "createdAt" | "updatedAt">>): Promise<AccountEntity>;
+  getAccountById(id: string): Promise<AccountEntity | null>;
+  getAccountByProvider(provider: string, providerUserId: string): Promise<AccountEntity | null>;
+  getAccountsByUserId(userId: string): Promise<AccountEntity[]>;
+  updateAccountStatus(id: string, status: AccountEntity["status"]): Promise<AccountEntity>;
+  unlinkAccount(id: string): Promise<void>;
+}
+interface OAuthAccountsAdapter {
+  /**
+   * OAuthAccount management methods
+   */
+  createOAuthAccount(input: Partial<Omit<OAuthAccountEntity, "createdAt" | "updatedAt">>): Promise<OAuthAccountEntity>;
+  getOAuthAccount(accountId: string): Promise<OAuthAccountEntity | null>;
+  updateOAuthTokens(accountId: string, input: Partial<Omit<OAuthAccountEntity, "createdAt" | "updatedAt">>): Promise<OAuthAccountEntity>;
+}
+interface CredentialAccountsAdapter {
+  /**
+   * CredentialAccounts management methods.
+   */
+  createCredentialAccount(input: Partial<Omit<CredentialAccountEntity, "updatedAt">>): Promise<CredentialAccountEntity>;
+  getCredentialAccount(accountId: string): Promise<CredentialAccountEntity | null>;
+  updatePasswordHash(accountId: string, passwordHash: string): Promise<CredentialAccountEntity>;
+}
+interface SessionsAdapter {
+  /**
+   * Session management methods.
+   */
+  createSession(input: Omit<SessionEntity, "createdAt" | "updatedAt" | "lastActivityAt" | "revokedAt">): Promise<SessionEntity>;
+  getSessionByToken(token: string): Promise<SessionWithUserEntity | null>;
+  getSessionById(id: string): Promise<SessionEntity | null>;
+  listSessions(filter: Pick<SessionEntity, "userId" | "status" | "deviceId">): Promise<SessionEntity[]>;
+  updateSession(id: string, input: Partial<Omit<SessionEntity, "createdAt" | "updatedAt" | "revokedAt">>): Promise<SessionEntity>;
+  touchSession(id: string, lastActivityAt: Date): Promise<void>;
+  revokeSession(id: string, reason: RevokeReason): Promise<void>;
+  revokeAllSessions(userId: string, reason: RevokeReason, exceptSessionId?: string): Promise<number>;
+}
+interface DevicesAdapter {
+  /**
+   * Device management methods.
+   */
+  createDevice(input: Omit<DeviceEntity, "id" | "createdAt" | "updatedAt">): Promise<DeviceEntity>;
+  getDeviceById(id: string): Promise<DeviceEntity | null>;
+  getDeviceByFingerprint(userId: string, fingerprint: string): Promise<DeviceEntity | null>;
+  getDevicesByUserId(userId: string): Promise<DeviceEntity[]>;
+  updateDevice(id: string, input: Partial<Omit<DeviceEntity, "createdAt" | "updatedAt">>): Promise<DeviceEntity>;
+  trustDevice(id: string, trusted: boolean): Promise<DeviceEntity>;
+  deleteDevice(id: string): Promise<void>;
+}
+interface MFACredentialsAdapter {
+  /**
+   * MFACredentials management methods.
+   */
+  createMfaCredential(input: Omit<MFACredentialEntity, "id" | "verifiedAt" | "updatedAt">): Promise<MFACredentialEntity>;
+  getMfaCredentialById(id: string): Promise<MFACredentialEntity | null>;
+  getMfaCredentialsByUserId(userId: string): Promise<MFACredentialEntity[]>;
+  getMfaCredentialsByType(userId: string, type: MFAMethod): Promise<MFACredentialEntity[]>;
+  verifyMfaCredential(id: string): Promise<MFACredentialEntity>;
+  updateMfaCredential(id: string, input: Omit<MFACredentialEntity, "id" | "verifiedAt" | "updatedAt">): Promise<MFACredentialEntity>;
+  deleteMfaCredential(id: string): Promise<void>;
+}
+interface OAuthTransactionsAdapter {
+  /**
+   * OAuthTransaction management methods.
+   */
+  createOAuthTransaction(input: OAuthTransactionEntity): Promise<OAuthTransactionEntity>;
+  getOAuthTransactionByState(state: string): Promise<OAuthTransactionEntity | null>;
+  consumeOAuthTransaction(state: string): Promise<OAuthTransactionEntity | null>;
+  deleteExpiredOAuthTransactions(): Promise<number>;
+}
+/**
+ * The database adapter interface. Each provider package must implement this.
+ */
+interface DatabaseAdapter extends UsersAdapter, AccountsAdapter, OAuthAccountsAdapter, CredentialAccountsAdapter, SessionsAdapter, DevicesAdapter, MFACredentialsAdapter, OAuthTransactionsAdapter {} //#endregion
+//#region src/session/cookie-manager.d.ts
+//#endregion
+//#region src/@types/session.d.ts
+/** Application user type, inferred from the configured identity schema (defaults to the built-in user shape). */
+type User = output<typeof identitySchema>;
+/**
+ * Session data returned by the session endpoint.
+ */
+interface Session<DefaultUser extends User = User> {
+  user: DefaultUser;
+  expires: string;
+}
+interface CryptoSecret {
+  sign: CryptoKey | CryptoKeyPair | JWK | JsonWebKey | AsymmetricKeyPair;
+  encrypt: CryptoKey | CryptoKeyPair | JWK | JsonWebKey | AsymmetricKeyPair;
+}
+interface AsymmetricKeyPair {
+  publicKey: CryptoKey | JWK;
+  privateKey: CryptoKey | JWK;
+}
+/**
+ * A symmetric secret or asymmetric key pair used for JWT operations.
+ *
+ * - string / Uint8Array: used as-is for HMAC (signed) or AES (encrypted)
+ * - CryptoKey: Web Crypto API key, for environments that support it
+ * - CryptoKeyPair: asymmetric signing/encryption (RS256, ES256, EdDSA, RSA-OAEP, etc.)
+ */
+type SecretKey = string | Uint8Array | CryptoKey | CryptoKeyPair | CryptoSecret | JWK | AsymmetricKeyPair;
+/**
+ * @todo: add key rotation support for "SecretKey | CryptoKeyPair | [SecretKey | CryptoKeyPair, ...(SecretKey | CryptoKeyPair)[]]"
+ */
+type JWTKey = SecretKey;
+/**
+ * - "signed"    → standard JWS (e.g. HS256, RS256, ES256).
+ * - "encrypted" → JWE only. (e.g. A256GCM with RSA-OAEP key wrapping).
+ * - "sealed"    → JWS nested inside JWE (signed then encrypted).
+ */
+/**
+ * Signing algorithms for "signed" and "sealed" modes.
+ * Symmetric: HS256 | HS384 | HS512
+ * Asymmetric: RS256 | RS384 | RS512 | ES256 | ES384 | ES512 | EdDSA | PS256
+ */
+type JWTSigningAlgorithm = "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "EdDSA" | "PS256";
+/**
+ * Key-wrapping algorithms for "encrypted" and "sealed" modes.
+ * Symmetric: A128KW | A192KW | A256KW | dir (direct)
+ * ECDH:      ECDH-ES | ECDH-ES+A128KW | ECDH-ES+A256KW
+ * RSA:       RSA-OAEP | RSA-OAEP-256
+ */
+type JWTKeyAlgorithm = "A128KW" | "A192KW" | "A256KW" | "dir" | "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A256KW" | "RSA-OAEP" | "RSA-OAEP-256";
+/** Content-encryption algorithms for JWE. */
+type JWTEncryptionAlgorithm = "A128CBC-HS256" | "A192CBC-HS384" | "A256CBC-HS512" | "A128GCM" | "A192GCM" | "A256GCM";
+/** Signed JWT mode configuration. */
+type JWTSignedMode = {
+  mode: "signed";
+  signingAlgorithm?: JWTSigningAlgorithm;
+};
+/** Encrypted JWT mode configuration. */
+type JWTEncryptedMode = {
+  mode: "encrypted";
+  keyAlgorithm?: JWTKeyAlgorithm;
+  encryptionAlgorithm?: JWTEncryptionAlgorithm;
+};
+/** Signed and Encrypted JWT mode configuration. */
+type JWTSealedMode = {
+  mode?: "sealed";
+  signingAlgorithm?: JWTSigningAlgorithm;
+  keyAlgorithm?: JWTKeyAlgorithm;
+  encryptionAlgorithm?: JWTEncryptionAlgorithm;
+};
+/** Discriminated union of JWT wire format: signed JWS, encrypted JWE, or nested sealed (JWS in JWE). */
+type JWTConfigBase = JWTSignedMode | JWTEncryptedMode | JWTSealedMode;
+type ExpirationStrategy = "fixed" | "rolling" | "absolute" | "sliding";
+/**
+ * How session/JWT lifetime is enforced relative to `iat`, absolute caps, and sliding windows.
+ * @deprecated Use `ExpirationStrategy` instead. This will be removed in a future release.
+ */
+type JWTExpirationStrategy = ExpirationStrategy;
+type JWTConfig = Prettify<{
+  /**
+   * Token lifetime.
+   * @deprecated Use `session.maxAge` instead. This will be removed in a future release.
+   */
+  maxAge?: number;
+  /**
+   * JWT `iss` (issuer) claim. Set this to your app's canonical URL.
+   * @example "https://auth.example.com"
+   */
+  issuer?: string;
+  /**
+   * JWT `aud` claim. Single value or array for multi-audience tokens.
+   * @example ["https://api.example.com", "https://app.example.com"]
+   */
+  audience?: string | string[];
+  /**
+   * Maximum absolute session duration in seconds.
+   * Required for "absolute" and "sliding" strategies.
+   * Enforced via jose's maxTokenAge against the iat claim.
+   * @deprecated Use `session.maxDuration` instead. This will be removed in a future release.
+   */
+  maxExpiration?: number;
+  /**
+   * Policy for renewing or capping token lifetime (pairs with `maxExpiration` where applicable).
+   * @deprecated Use `session.expirationStrategy` instead. This will be removed in a future release.
+   */
+  expirationStrategy?: JWTExpirationStrategy;
+} & JWTConfigBase>;
+interface SessionStatefulConfig {
+  /**
+   * The session deletion strategy when a user is deleted. Defaults to "soft" (mark as deleted, keep for audit).
+   * - "soft": The user is marked as deleted, but the row is preserved in the database.
+   * - "hard": The user and all associated data (Accounts, Sessions, Devices, MfaCredentials) are permanently removed from the database.
+   */
+  deleteStrategy?: "soft" | "hard";
+  /**
+   * The maximum number of concurrent sessions allowed per user. If exceeded, the oldest session(s) will be revoked.
+   * If not set, there is no limit on concurrent sessions.
+   */
+  maxSessions?: number;
+  /**
+   * Defines the minimum interval (in seconds) between session "touches" (updates to lastActivityAt) to reduce database writes.
+   */
+  touchInterval?: number;
+}
+interface SessionConfigBase {
+  /**
+   * Session time to live (TTL) in seconds. Determines how long a session is valid before it expires.
+   * If not set, the default is 15 days (60 * 60 * 24 * 15).
+   * @default 1296000 (15 days)
+   */
+  maxAge?: number;
+  /**
+   * Maximum absolute session duration in seconds.
+   * Required for "absolute" and "sliding" strategies.
+   * Enforced via jose's maxTokenAge against the iat claim.
+   */
+  maxDuration?: number;
+  /**
+   * The session expiration strategy. Determines how the session's lifetime is calculated and enforced.
+   * - "fixed": The session expires after a fixed duration from the time of creation.
+   * - "rolling": The session expiration is extended on each request, up to the maximum age.
+   * - "absolute": The session has a hard expiration time, regardless of activity.
+   * - "sliding": The session expiration is extended on each request, but cannot exceed the maximum expiration time.
+   *
+   * @default "absolute"
+   */
+  expirationStrategy?: ExpirationStrategy;
+  /**
+   * The sliding threshold percentage p for the `"sliding"` expiration strategy. Determines when the
+   * session expiration is extended based on the remaining time.
+   * @default 0.5 (50%)
+   */
+  slidingThreshold?: number;
+}
+/**
+ * Stateless JWT strategy.
+ * No database required. Tokens are self-contained and cannot be revoked
+ * before they expire — keep `jwt.maxAge` short or enable refresh tokens.
+ *
+ * @example
+ * {
+ *   strategy: "jwt",
+ *   jwt: { mode: "sealed", issuer: "https://auth.example.com" },
+ * }
+ */
+interface StatelessStrategyConfig extends SessionConfigBase {
+  strategy?: "jwt";
+  jwt?: JWTConfig;
+}
+/**
+ * Stateful database strategy.
+ * Database required. Every request hits the DB to validate the session.
+ *
+ * @example
+ * {
+ *   strategy: "database",
+ *   adapter: prismaAdapter({ client: prismaClient }),
+ *   database: { deleteStrategy: "soft", maxSessions: 5 },
+ * }
+ */
+interface StatefulStrategyConfig extends SessionConfigBase {
+  strategy: "database";
+  adapter: DatabaseAdapter;
+  database?: SessionStatefulConfig;
+  /**
+   * @deprecated Use `database` instead. This will be removed in a future release.
+   */
+  session?: SessionStatefulConfig;
+}
+/**
+ * The session strategy. Determines which fields below are required.
+ *
+ * - "jwt": stateless. No database needed. JWTs are self-contained.
+ * - "database": stateful. Every request hits the DB to validate the session.
+ * - "hybrid": JWT transport + DB revocation. Best of both for most apps.
+ *
+ * @default "jwt"
+ */
+type SessionConfig = StatelessStrategyConfig | StatefulStrategyConfig;
+/** Result of reading a stateless (JWT) session from a request: session payload and outgoing header mutations. */
+interface OAuthTokenPayload {
+  /**
+   * The raw access token string issued by the OAuth provider.
+   */
+  accessToken: string;
+  /**
+   * The expiration time of the access token, in seconds since the epoch (Unix time).
+   * @deprecated
+   */
+  expiresAt: number;
+  accessTokenExpiresAt?: number;
+  /**
+   * The raw refresh token string issued by the OAuth provider, if applicable.
+   */
+  refreshToken?: string;
+  /**
+   * The expiration time of the refresh token, in seconds since the epoch (Unix time).
+   */
+  refreshTokenExpiresAt?: number;
+  /**
+   * The raw ID token string issued by the OIDC provider. Only supported by OIDC-compliant providers.
+   */
+  idToken?: string;
+  /**
+   * The type of token issued by the OAuth provider. Typically "Bearer" for OAuth 2.0.
+   */
+  tokenType: "Bearer";
+  /**
+   * The scopes granted to the access token, as an array of strings. These define the permissions the token has.
+   */
+  scopes: string[];
+  /**
+   * The issuer of the token, typically the OAuth provider's URL. This is used to validate the token's authenticity.
+   */
+  issuer?: string;
+  /**
+   * The time at which the token was issued, in seconds since the epoch (Unix time).
+   */
+  issuedAt: number;
+}
+//#endregion
 //#region src/oauth/github.d.ts
 /**
  * @see [Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user)
@@ -10372,6 +10938,7 @@ interface AtlassianProfile {
   created_at: string;
 }
 /**
+ * @see [Atlassian - Authorizing OAuth Apps](https://developer.atlassian.com/cloud/jira/platform/oauth-2-3lo-apps/)
  * @see [Atlassian - OAuth Apps](https://developer.atlassian.com/cloud/jira/platform/oauth-2-3lo-apps/)
  * @see [Atlassian - My Apps](https://developer.atlassian.com/console/myapps/)
  * @see [Atlassian - Retrieve Authenticated User](https://developer.atlassian.com/cloud/jira/software/oauth-2-3lo-apps/#how-do-i-retrieve-the-public-profile-of-the-authenticated-user-)
@@ -10680,132 +11247,6 @@ interface AuthentikProfile {
  * @see [Authentik - OAuth 2.0 Provider](https://docs.goauthentik.io/add-secure-apps/providers/oauth2/)
  * @see [Authentik - Create an OAuth2 Provider](https://docs.goauthentik.io/add-secure-apps/providers/oauth2/create-oauth2-provider/)
  */
-//#endregion
-//#region src/@types/session.d.ts
-/** Application user type, inferred from the configured identity schema (defaults to the built-in user shape). */
-type User = output<typeof UserIdentity>;
-/**
- * Session data returned by the session endpoint.
- */
-interface Session<DefaultUser extends User = User> {
-  user: DefaultUser;
-  expires: string;
-}
-interface CryptoSecret {
-  sign: CryptoKey | CryptoKeyPair | JWK | JsonWebKey | AsymmetricKeyPair;
-  encrypt: CryptoKey | CryptoKeyPair | JWK | JsonWebKey | AsymmetricKeyPair;
-}
-interface AsymmetricKeyPair {
-  publicKey: CryptoKey | JWK;
-  privateKey: CryptoKey | JWK;
-}
-/**
- * A symmetric secret or asymmetric key pair used for JWT operations.
- *
- * - string / Uint8Array: used as-is for HMAC (signed) or AES (encrypted)
- * - CryptoKey: Web Crypto API key, for environments that support it
- * - CryptoKeyPair: asymmetric signing/encryption (RS256, ES256, EdDSA, RSA-OAEP, etc.)
- */
-type SecretKey = string | Uint8Array | CryptoKey | CryptoKeyPair | CryptoSecret | JWK | AsymmetricKeyPair;
-/**
- * @todo: add key rotation support for "SecretKey | CryptoKeyPair | [SecretKey | CryptoKeyPair, ...(SecretKey | CryptoKeyPair)[]]"
- */
-type JWTKey = SecretKey;
-/**
- * - "signed"    → standard JWS (e.g. HS256, RS256, ES256).
- * - "encrypted" → JWE only. (e.g. A256GCM with RSA-OAEP key wrapping).
- * - "sealed"    → JWS nested inside JWE (signed then encrypted).
- */
-/**
- * Signing algorithms for "signed" and "sealed" modes.
- * Symmetric: HS256 | HS384 | HS512
- * Asymmetric: RS256 | RS384 | RS512 | ES256 | ES384 | ES512 | EdDSA | PS256
- */
-type JWTSigningAlgorithm = "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "EdDSA" | "PS256";
-/**
- * Key-wrapping algorithms for "encrypted" and "sealed" modes.
- * Symmetric: A128KW | A192KW | A256KW | dir (direct)
- * ECDH:      ECDH-ES | ECDH-ES+A128KW | ECDH-ES+A256KW
- * RSA:       RSA-OAEP | RSA-OAEP-256
- */
-type JWTKeyAlgorithm = "A128KW" | "A192KW" | "A256KW" | "dir" | "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A256KW" | "RSA-OAEP" | "RSA-OAEP-256";
-/** Content-encryption algorithms for JWE. */
-type JWTEncryptionAlgorithm = "A128CBC-HS256" | "A192CBC-HS384" | "A256CBC-HS512" | "A128GCM" | "A192GCM" | "A256GCM";
-/** Signed JWT mode configuration. */
-type JWTSignedMode = {
-  mode: "signed";
-  signingAlgorithm?: JWTSigningAlgorithm;
-};
-/** Encrypted JWT mode configuration. */
-type JWTEncryptedMode = {
-  mode: "encrypted";
-  keyAlgorithm?: JWTKeyAlgorithm;
-  encryptionAlgorithm?: JWTEncryptionAlgorithm;
-};
-/** Signed and Encrypted JWT mode configuration. */
-type JWTSealedMode = {
-  mode?: "sealed";
-  signingAlgorithm?: JWTSigningAlgorithm;
-  keyAlgorithm?: JWTKeyAlgorithm;
-  encryptionAlgorithm?: JWTEncryptionAlgorithm;
-};
-/** Discriminated union of JWT wire format: signed JWS, encrypted JWE, or nested sealed (JWS in JWE). */
-type JWTConfigBase = JWTSignedMode | JWTEncryptedMode | JWTSealedMode;
-/** How session/JWT lifetime is enforced relative to `iat`, absolute caps, and sliding windows. */
-type JWTExpirationStrategy = "fixed" | "rolling" | "absolute" | "sliding";
-type JWTConfig = Prettify<{
-  /**
-   * Token lifetime.
-   */
-  maxAge?: number;
-  /**
-   * JWT `iss` (issuer) claim. Set this to your app's canonical URL.
-   * @example "https://auth.example.com"
-   */
-  issuer?: string;
-  /**
-   * JWT `aud` claim. Single value or array for multi-audience tokens.
-   * @example ["https://api.example.com", "https://app.example.com"]
-   */
-  audience?: string | string[];
-  /**
-   * Maximum absolute session duration in seconds.
-   * Required for "absolute" and "sliding" strategies.
-   * Enforced via jose's maxTokenAge against the iat claim.
-   */
-  maxExpiration?: number;
-  /**
-   * Policy for renewing or capping token lifetime (pairs with `maxExpiration` where applicable).
-   */
-  expirationStrategy?: JWTExpirationStrategy;
-} & JWTConfigBase>;
-/**
- * Stateless JWT strategy.
- * No database required. Tokens are self-contained and cannot be revoked
- * before they expire — keep `jwt.maxAge` short or enable refresh tokens.
- *
- * @example
- * {
- *   strategy: "jwt",
- *   jwt: { mode: "sealed", maxAge: "15m", issuer: "https://auth.example.com" },
- *   refreshToken: { enabled: true, maxAge: "7d" },
- * }
- */
-type StatelessStrategyConfig = {
-  strategy?: "jwt";
-  jwt?: JWTConfig;
-};
-/**
- * The session strategy. Determines which fields below are required.
- *
- * - "jwt": stateless. No database needed. JWTs are self-contained.
- * - "database": stateful. Every request hits the DB to validate the session.
- * - "hybrid": JWT transport + DB revocation. Best of both for most apps.
- *
- * @default "jwt"
- */
-type SessionConfig = StatelessStrategyConfig;
-/** Result of reading a stateless (JWT) session from a request: session payload and outgoing header mutations. */
 type OpenIDProvider<Profile extends object = Record<string, any>, DefaultUser = User, Issuer extends string = string> = {
   id: string;
   name: string;
@@ -10815,12 +11256,26 @@ type OpenIDProvider<Profile extends object = Record<string, any>, DefaultUser =
   issuer: Issuer;
   clientId?: string;
   clientSecret?: string;
+  /**
+   * Refresh window in seconds before the access token expires to attempt a refresh.
+   * Defaults to 300 seconds.
+   */
+  refreshWindow?: number;
+  /**
+   * Revoke the access token configuration for the OAuth provider. It revokes the access token but not
+   * invalidate the session when there are multiple access token configured for the session.
+   */
+  revokeToken?: string | {
+    url: string;
+    headers?: Record<string, string>;
+    params?: Record<RevokeTokenParams, RevokeTokenTokenHint>;
+  };
   /**
    * Override the default OIDC scope (`openid profile email`).
    */
   scope?: string;
   profile?: (profile: Profile) => DefaultUser | Promise<DefaultUser>;
-} & GetRouteParams<`/${Issuer}`>; //#endregion
+} & Partial<GetRouteParams<`/${Issuer}`>>; //#endregion
 //#region src/oauth/index.d.ts
 declare const builtInOAuthProviders: {
   readonly github: <DefaultUser extends User = {
@@ -10979,8 +11434,11 @@ type AccessTokenContext = {
 };
 /** Known query parameter names supported when building an OAuth authorization URL. */
 type AuthorizeParams = LiteralUnion<"clientId" | "prompt" | "scope" | "responseMode" | "audience" | "loginHint" | "nonce" | "display">;
+/** Known query parameter names supported when revoking an OAuth token. */
+type RevokeTokenParams = LiteralUnion<"tokenHint">;
+type RevokeTokenTokenHint = LiteralUnion<"access_token" | "refresh_token">;
 /** OAuth 2.0 `response_type` values used in authorization requests. */
-type ResponseType = LiteralUnion<"code" | "token" | "refresh_token" | "id_token">;
+type ResponseType$1 = LiteralUnion<"code" | "token" | "refresh_token" | "id_token">;
 /**
  * Configuration for an OAuth provider without credentials.
  * Use this type when defining provider metadata and endpoints.
@@ -10996,7 +11454,7 @@ interface OAuthProviderConfig<Profile extends object = Record<string, any>, Defa
   authorize: string | {
     url: string;
     params?: Partial<Record<AuthorizeParams, string> & {
-      responseType: ResponseType;
+      responseType: ResponseType$1;
     }>;
   };
   accessToken: string | {
@@ -11011,6 +11469,32 @@ interface OAuthProviderConfig<Profile extends object = Record<string, any>, Defa
     url: string;
     request: (context: AccessTokenContext) => Profile | Promise<Profile>;
   };
+  /**
+   * Refresh token configuration for the OAuth provider. This option allows refreshing access tokens
+   * when they expire.
+   */
+  refreshToken?: string | {
+    url: string;
+    headers?: Record<string, string>;
+    params?: Record<string, string>;
+    authorization?: {
+      type: "basic" | "credentials";
+    };
+  };
+  /**
+   * Revoke the access token configuration for the OAuth provider. It revokes the access token but not
+   * invalidate the session when there are multiple access token configured for the session.
+   */
+  revokeToken?: string | {
+    url: string;
+    headers?: Record<string, string>;
+    params?: Record<RevokeTokenParams, RevokeTokenTokenHint>;
+  };
+  /**
+   * Refresh window in seconds before the access token expires to attempt a refresh.
+   * Defaults to 300 seconds.
+   */
+  refreshWindow?: number;
   /**
    * @deprecated
    * use `authorize.params.scope` instead of `scope`
@@ -11020,7 +11504,7 @@ interface OAuthProviderConfig<Profile extends object = Record<string, any>, Defa
    * @deprecated
    * use `authorize.params.responseType` instead of `responseType`
    */
-  responseType?: ResponseType;
+  responseType?: ResponseType$1;
   profile?: (profile: Profile) => DefaultUser | Promise<DefaultUser>;
 }
 /**
@@ -11041,16 +11525,15 @@ interface OAuthProviderCredentials<Profile extends object = Record<string, any>,
 type AuthAPI<DefaultUser extends User = User, SignUpSchema extends SchemaTypes = ZodObject<any>> = ReturnType<typeof createAuthAPI<DefaultUser, SignUpSchema>>;
 /** JWT and crypto helpers bound to the configured identity schema (sign, verify, claims). */
 type JoseInstance<DefaultUser extends User = User> = ReturnType<typeof createJoseInstance<DefaultUser>>;
-/** Normalized internal logger with resolved level and structured log function. */
 /** Payload sent to the credentials sign-in endpoint (username/password flow). */
 interface CredentialsPayload {
   username: string;
   password: string;
 }
 /**
- * Context provided to the credentials provider's authorize function.
- * It includes the credentials sent by the user and hashing utilities.
+ * Interface for the credentials provider.
  */
+type Handlers = { [method in "GET" | "POST" | "PATCH" | "DELETE" | "ALL"]: (request: Request) => Response | Promise<Response> };
 /**
  * Public auth instance: programmatic {@link AuthAPI}, {@link JoseInstance}, and HTTP {@link AuthClient} handlers.
  */
@@ -11066,38 +11549,29 @@ interface AuthInstance<DefaultUser extends User = User, SignUpSchema extends Sch
   /**
    * HTTP handlers for mounting on a router or server.
    */
-  handlers: {
-    GET: (request: Request) => Response | Promise<Response>;
-    POST: (request: Request) => Response | Promise<Response>;
-    PATCH: (request: Request) => Response | Promise<Response>;
-    ALL: (request: Request) => Response | Promise<Response>;
-  };
+  handlers: Handlers;
 }
-/**
- * Extended context used inside the library with both secure and standard cookie materializations.
- */
+/** Minimal token issue/verify surface used by session code paths. */
 //#endregion
 //#region src/@types/utility.d.ts
-/** Expands intersection types into a single flat object type for readable editor hints. */
-type Prettify<T> = { [K in keyof T]: T[K] };
 /**
  * A string that must be one of the literals in `T`, or any other string (`U`).
  * Useful for autocomplete on known keys while still allowing custom values.
  */
 type LiteralUnion<T extends U, U = string> = T | (U & Record<never, never>);
+/** Merges type `B` over `A`, replacing overlapping keys with `B`. */
+type Merge<A, B> = Omit<A, keyof B> & B;
 /**
  * Transforms a Zod raw shape so nested `ZodObject` fields become editable (same structure, for config authoring).
  */
-type ValibotShapeToObject<S extends ObjectEntries> = Merge<InferOutput<ObjectSchema<S, undefined>>, User>;
-type ArktypeShapeToObject<S extends Type> = S extends Type<infer Shape> ? Wrap<Merge<Shape, User>> : never;
-type TypeboxShapeToObject<S> = Wrap<Merge<S, User>>;
-/** Merges type `B` over `A`, replacing overlapping keys with `B`. */
-type Merge<A, B> = Omit<A, keyof B> & B;
 /**
  * Infers the runtime object type from a Zod `shape` and intersects it with {@link User}
  * so identity fields always include the base user contract.
  */
 type ZodShapeToObject<S extends ZodRawShape = ZodRawShape> = Merge<output<ZodObject<S>>, User>;
+type ValibotShapeToObject<S extends ObjectEntries> = Merge<InferOutput<ObjectSchema<S, undefined>>, User>;
+type ArktypeShapeToObject<S extends Type> = S extends Type<infer Shape> ? Wrap<Merge<Shape, User>> : never;
+type TypeboxShapeToObject<S> = Wrap<Merge<S, User>>;
 type FromShapeToObject<S> = S extends ZodRawShape ? ZodShapeToObject<S> : S extends ObjectEntries ? ValibotShapeToObject<S> : S extends Type ? ArktypeShapeToObject<S> : S extends TProperties ? TypeboxShapeToObject<S> : S extends User ? S : never;
 /** Recursively makes every property optional. */
 type DeepPartial<T> = { [P in keyof T]?: T[P] extends object ? DeepPartial<T[P]> : T[P] };
@@ -11157,10 +11631,6 @@ type AuthActionAPIReturn<Body extends object, ErrorCodes = any> = (Extract<Body,
     success: true;
   }>>;
 });
-/**
- * Utility to merge the internal router global context (`ctx`) with per-function options.
- * Used by implementation-level API functions in `src/api/*`.
- */
 interface APIOptionsWithRedirectTo {
   /**
    * Optional redirect strategy for server/programmatic API functions.
@@ -11198,7 +11668,7 @@ interface APIOptionsWithRedirectTo {
    */
   redirectTo?: string;
 }
-interface APIOptionsWithRequest extends APIOptionsWithRedirectTo {
+interface APIOptionsWithRequest {
   /**
    * Optional `Request` object, useful for constructing the incoming URL on the server side.
    * This option is required when the `redirectTo` option is defined, to ensure the `redirectTo`
@@ -11220,8 +11690,26 @@ interface APIOptionsWithSkipCSRFCheck {
    * The CSRF token is still required and validated to preserve request integrity.
    * Use this only for trusted server-side flows.
    * @default `false`
+   * @deprecated Use `doubleSubmitToken` to provide the CSRF token explicitly instead of skipping the check.
    */
   skipCSRFCheck?: boolean;
+  /**
+   * Optional token used to perform Double-Submit Cookie validation.
+   *
+   * By default, server-side API functions skip the Double-Submit Cookie validation
+   * because they execute in a trusted server environment where the CSRF token is
+   * not directly available. Providing this value enables the same Double-Submit
+   * Cookie validation performed by the HTTP endpoints.
+   *
+   * Other CSRF protections remain enabled regardless of whether this option is
+   * provided.
+   *
+   * @example
+   * api.signOut({
+   *   doubleSubmitToken: "csrf-token-value",
+   * })
+   */
+  doubleSubmitToken?: string;
 }
 /** Options to get the current session. */
 interface GetSessionAPIOptions {
@@ -11239,25 +11727,36 @@ type GetSessionAPIReturn<DefaultUser extends User = User> = AuthActionAPIReturn<
 /**
  * Client-side options for `createAuthClient().signIn(...)`.
  */
+type SignInReturnData = /** redirect: true & redirectTo: string */{
+  success: true;
+  redirect: true;
+  signInURL: string;
+} /** redirect: false & redirectTo: string */ | {
+  success: true;
+  redirect: false;
+  signInURL: string;
+} /** redirect: false & redirectTo: null | undefined (not set) */ | {
+  success: false;
+  redirect: false;
+  signInURL: null;
+};
+/**
+ * Client-side `signIn` return type.
+ *
+ * - Redirect mode (`redirect: true`): returns `void` because navigation is handled by the client.
+ * - Manual mode (`redirect: false`): returns `signInURL` for caller-controlled navigation.
+ */
 /**
  * Server/programmatic options for `signIn` API.
  */
-interface SignInAPIOptions extends APIOptionsWithRedirectTo, APIOptionsWithRequest {}
+interface SignInAPIOptions extends APIOptionsWithRequest, APIOptionsWithRedirectTo {}
 /**
  * Server/programmatic `signIn` result.
  *
  * Includes `signInURL` and response metadata to support both framework-managed redirects
  * and custom response handling through `toResponse()`.
  */
-type SignInAPIReturn = AuthActionAPIReturn<{
-  success: true;
-  redirect: boolean;
-  signInURL: string;
-} | {
-  success: false;
-  redirect: false;
-  signInURL: null;
-}>;
+type SignInAPIReturn = AuthActionAPIReturn<SignInReturnData>;
 type SignInCredentialsReturnData = /** redirect: true & redirectTo: string */{
   success: true;
   redirect: true;
@@ -11280,7 +11779,7 @@ type SignInCredentialsReturnData = /** redirect: true & redirectTo: string */{
 };
 /** Client-side credentials sign-in return type (redirect mode or manual redirect data). */
 /** Server/programmatic credentials sign-in options. */
-interface SignInCredentialsAPIOptions extends APIOptionsWithRedirectTo, APIOptionsWithRequest, APIOptionsWithSkipCSRFCheck {
+interface SignInCredentialsAPIOptions extends APIOptionsWithRequest, APIOptionsWithRedirectTo, APIOptionsWithSkipCSRFCheck {
   /**
    * Credentials payload validated by the configured `credentials.authorize` function.
    * @example
@@ -11316,7 +11815,7 @@ type SignOutReturnData = /** redirect: true & redirectTo: string */{
 };
 /** Client-side sign-out return type (redirect mode or manual redirect data). */
 /** Server/programmatic options for `signOut` API. */
-interface SignOutAPIOptions extends RequiredKeys<APIOptionsWithRequest, "headers">, APIOptionsWithSkipCSRFCheck {}
+interface SignOutAPIOptions extends RequiredKeys<APIOptionsWithRequest, "headers">, APIOptionsWithRedirectTo, APIOptionsWithSkipCSRFCheck {}
 /** Programmatic sign-out result with redirect metadata and `toResponse()`. */
 type SignOutAPIReturn = AuthActionAPIReturn<SignOutReturnData>;
 /** Client-side `updateSession` options: partial session payload plus optional redirect behavior. */
@@ -11343,7 +11842,7 @@ type UpdateSessionReturnData<DefaultUser extends User = User> = /** redirect: tr
 };
 /** Client-side `updateSession` return type. */
 /** Server/programmatic options for `updateSession` API. */
-interface UpdateSessionAPIOptions<DefaultUser extends User = User> extends RequiredKeys<APIOptionsWithRequest, "headers">, APIOptionsWithSkipCSRFCheck {
+interface UpdateSessionAPIOptions<DefaultUser extends User = User> extends RequiredKeys<APIOptionsWithRequest, "headers">, APIOptionsWithRedirectTo, APIOptionsWithSkipCSRFCheck {
   /**
    * Partial session payload used to update the current session.
    * @see Session
@@ -11359,7 +11858,7 @@ interface UpdateSessionAPIOptions<DefaultUser extends User = User> extends Requi
 }
 /** Programmatic session update result with redirect metadata and `toResponse()`. */
 type UpdateSessionAPIReturn<DefaultUser extends User = User> = AuthActionAPIReturn<UpdateSessionReturnData<DefaultUser>>;
-interface SignUpAPIOptions<Payload extends Record<string, any> = Record<string, any>> extends APIOptionsWithRedirectTo, APIOptionsWithRequest, APIOptionsWithSkipCSRFCheck {
+interface SignUpAPIOptions<Payload extends Record<string, any> = Record<string, any>> extends APIOptionsWithRequest, APIOptionsWithRedirectTo, APIOptionsWithSkipCSRFCheck {
   payload: Payload;
 }
 type SignUpReturnData = /** redirect: true & redirectTo: string */{
@@ -11384,5 +11883,95 @@ type SignUpReturnData = /** redirect: true & redirectTo: string */{
 };
 /** Programmatic sign-up result with redirect metadata and `toResponse()`. */
 type SignUpAPIReturn = AuthActionAPIReturn<SignUpReturnData>;
+/**
+ * Client-side `signUp` options: payload plus optional redirect behavior.
+ */
+/**
+ * Programmatic options for `getProviderTokens` API.
+ */
+interface GetProviderTokensAPIOptions extends Pick<APIOptionsWithRequest, "headers" | "request"> {}
+type GetProviderTokensData = {
+  success: true;
+  tokens: OAuthTokenPayload;
+} | {
+  success: false;
+  tokens: null;
+};
+/**
+ * Programmatic result for `getProviderTokens` API with response metadata and `toResponse()`.
+ */
+type GetProviderTokensAPIReturn = AuthActionAPIReturn<GetProviderTokensData>;
+/**
+ * Client-side `getProviderTokens` return type.
+ */
+/**
+ * Programmatic options for `getAccessToken` API.
+ */
+type AccessTokenAPIOptions = GetProviderTokensAPIOptions;
+type AccessTokenData = {
+  success: true;
+  accessToken: string;
+} | {
+  success: false;
+  accessToken: null;
+};
+/**
+ * Programmatic result for `getAccessToken` API with response metadata and `toResponse()`.
+ */
+type AccessTokenAPIReturn = AuthActionAPIReturn<AccessTokenData>;
+/**
+ * Programmatic options for `refreshUserInfo` API.
+ */
+interface RefreshUserInfoAPIOptions extends APIOptionsWithRequest, APIOptionsWithSkipCSRFCheck {}
+type RefreshUserInfoData<DefaultUser extends User = User> = {
+  success: true;
+  session: Session<DefaultUser>;
+} | {
+  success: false;
+  session: null;
+};
+/**
+ * Programmatic result for `refreshUserInfo` API with response metadata and `toResponse()`.
+ */
+type RefreshUserInfoAPIReturn<DefaultUser extends User = User> = AuthActionAPIReturn<RefreshUserInfoData<DefaultUser>>;
+/**
+ * Programmatic options for `revokeToken` API.
+ */
+interface RevokeTokenAPIOptions extends APIOptionsWithRequest, APIOptionsWithSkipCSRFCheck {}
+type RevokeTokenData = {
+  success: true;
+} | {
+  success: false;
+};
+/**
+ * Programmatic result for `revokeToken` API with response metadata and `toResponse()`.
+ */
+type RevokeTokenAPIReturn = AuthActionAPIReturn<RevokeTokenData>;
+/**
+ * Programmatic options for `disconnectProvider` API.
+ */
+interface DisconnectProviderAPIOptions extends APIOptionsWithRequest, APIOptionsWithSkipCSRFCheck {}
+type DisconnectProviderData = {
+  success: true;
+} | {
+  success: false;
+};
+/**
+ * Programmatic result for `disconnectProvider` API with response metadata and `toResponse()`.
+ */
+type DisconnectProviderAPIReturn = AuthActionAPIReturn<DisconnectProviderData>;
+type ProviderConnectedAPIOptions = APIOptionsWithRequest;
+type ProviderConnectedData = {
+  success: true;
+  connected: boolean;
+} | {
+  success: false;
+  connected: false;
+};
+type ProviderConnectedAPIReturn = AuthActionAPIReturn<ProviderConnectedData>; //#endregion
+//#region src/@types/index.d.ts
+/**
+ * JWT payload structure that includes a mandatory `token` field used to verify CSRF Tokens
+ */
 //#endregion
-export { UpdateSessionAPIOptions as _, GetSessionAPIReturn as a, EncodeJWTOptions as b, Session as c, SignInCredentialsAPIOptions as d, SignInCredentialsAPIReturn as f, SignUpAPIReturn as g, SignUpAPIOptions as h, GetSessionAPIOptions as i, SignInAPIOptions as l, SignOutAPIReturn as m, BuiltInOAuthProvider as n, LiteralUnion as o, SignOutAPIOptions as p, FromShapeToObject as r, Prettify as s, AuthInstance as t, SignInAPIReturn as u, UpdateSessionAPIReturn as v, TypedJWTPayload as x, DecodeJWTOptions as y };
+export { SignUpAPIReturn as A, SignInAPIOptions as C, SignOutAPIOptions as D, SignInCredentialsAPIReturn as E, EncodeJWTOptions as F, TypedJWTPayload as I, UpdateSessionAPIReturn as M, Wrap as N, SignOutAPIReturn as O, DecodeJWTOptions as P, Session as S, SignInCredentialsAPIOptions as T, RefreshUserInfoAPIOptions as _, DeepPartial as a, RevokeTokenAPIOptions as b, FromShapeToObject as c, GetSessionAPIOptions as d, GetSessionAPIReturn as f, ProviderConnectedAPIReturn as g, ProviderConnectedAPIOptions as h, BuiltInOAuthProvider as i, UpdateSessionAPIOptions as j, SignUpAPIOptions as k, GetProviderTokensAPIOptions as l, LiteralUnion as m, AccessTokenAPIReturn as n, DisconnectProviderAPIOptions as o, Handlers as p, AuthInstance as r, DisconnectProviderAPIReturn as s, AccessTokenAPIOptions as t, GetProviderTokensAPIReturn as u, RefreshUserInfoAPIReturn as v, SignInAPIReturn as w, RevokeTokenAPIReturn as x, RemoveIndexSignature as y };