@aura-stack/next 0.2.2 → 0.3.0

package/dist/{index-DylhyiBS.d.ts → index-BbJId8e2.d.ts}

@@ -553,7 +553,7 @@ type MaybePromise<TValue$1> = TValue$1 | Promise<TValue$1>;
 * Hint: This type has no effect and is only used so that TypeScript displays
 * the final type in the preview instead of the utility types used.
 */
-type Prettify$3<TObject> = { [TKey in keyof TObject]: TObject[TKey] } & {};
+type Prettify$2<TObject> = { [TKey in keyof TObject]: TObject[TKey] } & {};
 /**
 * Marks specific keys as optional.
 */
@@ -641,11 +641,11 @@ type OutputWithReadonly<TEntries$1 extends ObjectEntries | ObjectEntriesAsync, T
 /**
 * Infer object input type.
 */
-type InferObjectInput<TEntries$1 extends ObjectEntries | ObjectEntriesAsync> = Prettify$3<InputWithQuestionMarks<TEntries$1, InferEntriesInput<TEntries$1>>>;
+type InferObjectInput<TEntries$1 extends ObjectEntries | ObjectEntriesAsync> = Prettify$2<InputWithQuestionMarks<TEntries$1, InferEntriesInput<TEntries$1>>>;
 /**
 * Infer object output type.
 */
-type InferObjectOutput<TEntries$1 extends ObjectEntries | ObjectEntriesAsync> = Prettify$3<OutputWithReadonly<TEntries$1, OutputWithQuestionMarks<TEntries$1, InferEntriesOutput<TEntries$1>>>>;
+type InferObjectOutput<TEntries$1 extends ObjectEntries | ObjectEntriesAsync> = Prettify$2<OutputWithReadonly<TEntries$1, OutputWithQuestionMarks<TEntries$1, InferEntriesOutput<TEntries$1>>>>;
 /**
 * Infer object issue type.
 */
@@ -7624,7 +7624,7 @@ type MakeReadonly<T> = T extends Map<infer K, infer V> ? ReadonlyMap<K, V> : T e
 type SomeObject = Record<PropertyKey, any>;
 type Identity$1<T> = T;
 type Flatten<T> = Identity$1<{ [k in keyof T]: T[k] }>;
-type Prettify$2<T> = { [K in keyof T]: T[K] } & {};
+type Prettify$1<T> = { [K in keyof T]: T[K] } & {};
 type Extend<A extends SomeObject, B extends SomeObject> = Flatten<keyof A & keyof B extends never ? A & B : { [K in keyof A as K extends keyof B ? never : K]: A[K] } & { [K in keyof B]: B[K] }>;
 type TupleItems = ReadonlyArray<SomeType>;
 type AnyFunc = (...args: any[]) => any;
@@ -8110,8 +8110,8 @@ type OptionalInSchema = {
     optin: "optional";
   };
 };
-type $InferObjectOutput<T extends $ZodLooseShape, Extra extends Record<string, unknown>> = string extends keyof T ? IsAny<T[keyof T]> extends true ? Record<string, unknown> : Record<string, output<T[keyof T]>> : keyof (T & Extra) extends never ? Record<string, never> : Prettify$2<{ -readonly [k in keyof T as T[k] extends OptionalOutSchema ? never : k]: T[k]["_zod"]["output"] } & { -readonly [k in keyof T as T[k] extends OptionalOutSchema ? k : never]?: T[k]["_zod"]["output"] } & Extra>;
-type $InferObjectInput<T extends $ZodLooseShape, Extra extends Record<string, unknown>> = string extends keyof T ? IsAny<T[keyof T]> extends true ? Record<string, unknown> : Record<string, input<T[keyof T]>> : keyof (T & Extra) extends never ? Record<string, never> : Prettify$2<{ -readonly [k in keyof T as T[k] extends OptionalInSchema ? never : k]: T[k]["_zod"]["input"] } & { -readonly [k in keyof T as T[k] extends OptionalInSchema ? k : never]?: T[k]["_zod"]["input"] } & Extra>;
+type $InferObjectOutput<T extends $ZodLooseShape, Extra extends Record<string, unknown>> = string extends keyof T ? IsAny<T[keyof T]> extends true ? Record<string, unknown> : Record<string, output<T[keyof T]>> : keyof (T & Extra) extends never ? Record<string, never> : Prettify$1<{ -readonly [k in keyof T as T[k] extends OptionalOutSchema ? never : k]: T[k]["_zod"]["output"] } & { -readonly [k in keyof T as T[k] extends OptionalOutSchema ? k : never]?: T[k]["_zod"]["output"] } & Extra>;
+type $InferObjectInput<T extends $ZodLooseShape, Extra extends Record<string, unknown>> = string extends keyof T ? IsAny<T[keyof T]> extends true ? Record<string, unknown> : Record<string, input<T[keyof T]>> : keyof (T & Extra) extends never ? Record<string, never> : Prettify$1<{ -readonly [k in keyof T as T[k] extends OptionalInSchema ? never : k]: T[k]["_zod"]["input"] } & { -readonly [k in keyof T as T[k] extends OptionalInSchema ? k : never]?: T[k]["_zod"]["input"] } & Extra>;
 type $ZodObjectConfig = {
   out: Record<string, unknown>;
   in: Record<string, unknown>;
@@ -8994,7 +8994,7 @@ type SchemaKind<T> = [T] extends [$ZodType] ? "zod" : [T] extends [ObjectSchema<
  * const getPostsComments:RoutePattern = "/posts/:postId/comments/:commentId"
  */
 type RoutePattern = `/${string}`;
-type Prettify$1<Obj extends object> = { [Key in keyof Obj]: Obj[Key] } & {};
+type Prettify<Obj extends object> = { [Key in keyof Obj]: Obj[Key] } & {};
 type GetParam<Route extends string> = Route extends `:${infer Param}` ? { [K in Param]: string } : {};
 /**
  * Extracts route parameters from a given route pattern through colon-prefixed segments.
@@ -9011,7 +9011,7 @@ type GetParam<Route extends string> = Route extends `:${infer Param}` ? { [K in
  * // Expected: {}
  * type NoParams = Params<"/about">;
  */
-type GetRouteParams<Route extends RoutePattern> = Route extends `/${infer Path}/${infer Str}` ? Prettify$1<GetParam<Path> & GetRouteParams<`/${Str}`>> : Route extends `/${infer Path}` ? GetParam<Path> : {};
+type GetRouteParams<Route extends RoutePattern> = Route extends `/${infer Path}/${infer Str}` ? Prettify<GetParam<Path> & GetRouteParams<`/${Str}`>> : Route extends `/${infer Path}` ? GetParam<Path> : {};
 /**
  * Available schemas validation for an endpoint. It can include body and searchParams schemas.
  */
@@ -9692,8 +9692,7 @@ interface DecodeJWTOptions {
   decrypt?: DecryptOptions;
 }
 //#endregion
-//#region ../core/dist/index-tmedkhtX.d.ts
-//#endregion
+//#region ../core/dist/index-vaLptcEI.d.ts
 //#region src/jose.d.ts
 /**
  * Creates the JOSE instance used for signing and verifying tokens. It derives keys
@@ -9717,14 +9716,16 @@ declare const createJoseInstance: <DefaultUser extends User = User>(secret?: JWT
   encodeJWT: (payload: TypedJWTPayload<Partial<DefaultUser>>, options?: EncodeJWTOptions) => Promise<string>;
   decodeJWT: (token: string, options?: DecodeJWTOptions) => Promise<TypedJWTPayload<DefaultUser>>;
 }; //#endregion
+//#region src/identity/arktype.d.ts
+type SchemaTypes = ZodObject<any> | ObjectSchema<any, undefined> | Type<{}> | TObject;
+//#endregion
 //#region src/identity/zod.d.ts
-declare const identitySchema$3: ZodObject<{
+declare const identitySchema: ZodObject<{
   sub: ZodString;
   name: ZodOptional<ZodNullable<ZodString>>;
   image: ZodOptional<ZodNullable<ZodString>>;
   email: ZodOptional<ZodNullable<ZodEmail>>;
 }, $strip>;
-type SchemaTypes = ZodObject<any> | ObjectSchema<any, undefined> | Type<{}> | TObject;
 //#endregion
 //#region src/api/createApi.d.ts
 declare const createAuthAPI: <DefaultUser extends User = User, SignUpSchema extends SchemaTypes = ZodObject<any>>(ctx: GlobalContext) => {
@@ -9808,7 +9809,93 @@ declare const createAuthAPI: <DefaultUser extends User = User, SignUpSchema exte
    * })
    */
   updateSession: (options: UpdateSessionAPIOptions<DefaultUser>) => Promise<UpdateSessionAPIReturn<DefaultUser>>;
+  /**
+   * Retrieves the access token for a specific OAuth provider on the server-side.
+   * It implements CSRF Protection by default, for server-side calls it only verifies and validates the CSRF Token,
+   * it also provides Double-Submit Cookie protection by requiring the `session_token` cookie to be included in
+   * the request headers.
+   *
+   * @params oauth - The OAuth provider for which to retrieve the access token (e.g., "github", "gitlab", "bitbucket").
+   * @params options - Options for the API call, including headers and request object.
+   * @example
+   * const { success, tokens } = await api.getProviderTokens("github", {
+   *    headers: getHeaders()
+   * })
+   *
+   * const { accessToken, refreshToken } = tokens
+   */
   getProviderTokens: (oauth: LiteralUnion<BuiltInOAuthProvider>, options?: GetProviderTokensAPIOptions) => Promise<GetProviderTokensAPIReturn>;
+  /**
+   * Retrieves the access token for a specific OAuth provider on the server-side.
+   * It implements CSRF Protection by default, for server-side calls it only verifies and validates the CSRF Token,
+   * it also provides Double-Submit Cookie protection by requiring the `session_token` cookie to be included in
+   * the request headers.
+   *
+   * > **NOTE**: This method is based on `getProviderTokens` and it's recommended for simple use cases where only the
+   * access token is needed. For more advanced scenarios, consider using `getProviderTokens` directly.
+   *
+   * @params oauth - The OAuth provider for which to retrieve the access token (e.g., "github", "gitlab", "bitbucket").
+   * @params options - Options for the API call, including headers and request object.
+   * @example
+   * const { success, accessToken } = await api.getAccessToken("github", {
+   *    headers: getHeaders()
+   * })
+   */
+  getAccessToken: (oauth: LiteralUnion<BuiltInOAuthProvider>, options?: AccessTokenAPIOptions) => Promise<AccessTokenAPIReturn>;
+  /**
+   * Refreshes the user profile data from the OAuth provider on the server-side. It makes a request to the
+   * `userInfo` endpoint of the specified OAuth provider.
+   *
+   * @param oauth - The OAuth provider for which to refresh the user profile data (e.g., "github", "gitlab", "bitbucket").
+   * @param options - Options for the API call, including headers and request object.
+   * @example
+   * const { success, session } = await api.refreshUserInfo("github", {
+   *    headers: getHeaders()
+   * })
+   */
+  refreshUserInfo: (oauth: LiteralUnion<BuiltInOAuthProvider>, options?: RefreshUserInfoAPIOptions) => Promise<RefreshUserInfoAPIReturn<DefaultUser>>;
+  /**
+   * Revokes the access token for a specific OAuth provider on the server-side. It makes a request to the
+   * `revokeToken` endpoint of the specified OAuth provider.
+   *
+   * @param oauth - The OAuth provider for which to revoke the access token (e.g., "github", "gitlab", "bitbucket").
+   * @param options - Options for the API call, including headers and request object.
+   * @example
+   * const { success, headers } = await api.revokeToken("github", {
+   *    headers: getHeaders()
+   * })
+   * // Use the returned headers to update the response headers in your server-side logic
+   * return new Response(null, { status: 200, headers })
+   */
+  revokeToken: (oauth: LiteralUnion<BuiltInOAuthProvider>, options?: RevokeTokenAPIOptions) => Promise<RevokeTokenAPIReturn>;
+  /**
+   * Disconnects the OAuth provider for the current session on the server-side. It removes the association
+   * between the user's session and the specified OAuth provider.
+   * @params oauth - The OAuth provider to disconnect (e.g., "github", "gitlab", "bitbucket").
+   * @params options - Options for the API call, including headers and request object.
+   * @example
+   * const { success, headers } = await api.disconnectProvider("github", {
+   *    headers: getHeaders()
+   * })
+   * // Use the returned headers to update the response headers in your server-side logic
+   * return new Response(null, { status: 200, headers })
+   */
+  disconnectProvider: (oauth: LiteralUnion<BuiltInOAuthProvider>, options?: DisconnectProviderAPIOptions) => Promise<DisconnectProviderAPIReturn>;
+  /**
+   * Checks if the current session is connected to a specific OAuth provider on the server-side. It verifies
+   * the presence of a valid access token for the specified provider in the session.
+   *
+   * @param oauth - The OAuth provider to check for connection (e.g., "github", "gitlab", "bitbucket").
+   * @param options - Options for the API call, including headers and request object.
+   * @example
+   * const { success, connected } = await api.isProviderConnected("github", {
+   *    headers: getHeaders()
+   * })
+   * if (connected) {
+   *    // The session is connected to the GitHub provider
+   * }
+   */
+  isProviderConnected: (oauth: LiteralUnion<BuiltInOAuthProvider>, options?: ProviderConnectedAPIOptions) => Promise<ProviderConnectedAPIReturn>;
   /**
    * Signs out the current session on the server-side. It implements CSRF Protection by default, for
    * server-side calls it only verifies and validates the CSRF Token, it also provides Double-Submit
@@ -9834,9 +9921,248 @@ declare const createAuthAPI: <DefaultUser extends User = User, SignUpSchema exte
  * Each message includes facility, severity, msgId, and default message.
  */
 //#endregion
+//#region src/@types/entities.d.ts
+type UserStatus = "active" | "suspended" | "pending_verification" | "deleted";
+/**
+ * @todo: add "passkey" and "saml" to AccountType when we implement those providers
+ */
+type AccountType$1 = "oauth" | "credentials";
+type AccountStatus = "active" | "unlinked" | "suspended";
+type SessionStatus = "active" | "expired" | "revoked";
+/**
+ * Tracks MFA progress within a session.
+ *   - "none": MFA not required for this user or session
+ *   - "pending": primary auth passed, MFA challenge not yet completed
+ *   - "completed": MFA challenge passed
+ *   - "skipped": trusted device, MFA step-up bypassed
+ */
+type MFAState = "none" | "pending" | "completed" | "skipped";
+type MFAMethod = "totp" | "webauthn_passkey" | "webauthn_security_key" | "sms" | "email" | "recovery_code";
+type DeviceType = "desktop" | "mobile" | "tablet" | "tv" | "bot" | "unknown";
+type RevokeReason = "user_logout" | "admin_action" | "password_changed" | "email_changed" | "all_sessions_revoked" | "mfa_disabled" | "account_suspended" | "max_sessions_exceeded";
+interface UserEntity {
+  id: string;
+  name: string | null;
+  email: string | null;
+  image: string | null;
+  emailVerifiedAt: Date | null;
+  status: UserStatus;
+  mfaEnabled: boolean;
+  mfaPreferredMethod: MFAMethod | null;
+  createdAt: Date;
+  updatedAt: Date;
+  /**
+   * Used to store the extra user attributes and extended by the `identity.schema`
+   * configuration.
+   */
+  attributes: Record<string, unknown> | null;
+}
+interface AccountEntity {
+  id: string;
+  userId: string;
+  provider: string;
+  providerUserId: string;
+  type: AccountType$1;
+  status: AccountStatus;
+  createdAt: Date;
+  updatedAt: Date;
+}
+interface OAuthAccountEntity {
+  accountId: string;
+  accessToken: string;
+  refreshToken: string | null;
+  idToken: string | null;
+  tokenType: string | null;
+  scopes: string | null;
+  issuer: string | null;
+  accessTokenExpiresAt: Date | null;
+  refreshTokenExpiresAt: Date | null;
+  updatedAt: Date;
+}
+interface CredentialAccountEntity {
+  accountId: string;
+  passwordHash: string;
+  updatedAt: Date;
+}
+interface SessionEntity {
+  id: string;
+  userId: string;
+  deviceId: string | null;
+  authenticatedWith: string;
+  status: SessionStatus;
+  mfaState: MFAState;
+  tokenHash: string;
+  expiresAt: Date;
+  metadata: Record<string, unknown> | null;
+  lastActivityAt: Date;
+  revokedAt: Date | null;
+  createdAt: Date;
+  updatedAt: Date;
+}
+type SessionWithUserEntity = SessionEntity & {
+  user: UserEntity;
+};
+/**
+ * Tracks physical devices across sessions.
+ */
+interface DeviceEntity {
+  id: string;
+  userId: string;
+  /**
+   * User-assigned label for the device, e.g. "Work MacBook" or "iPhone 14 Pro".
+   */
+  name: string | null;
+  type: DeviceType;
+  /**
+   * Platform name and version, e.g. "macOS 14.1" or "Android 14".
+   */
+  platform: string | null;
+  /**
+   * Browser name and version, e.g. "Chrome 120" or "Safari 17".
+   */
+  browser: string | null;
+  /**
+   * User-Agent string captured at first sign-in from this device.
+   * @see https://developer.mozilla.org/es/docs/Web/HTTP/Reference/Headers/User-Agent
+   */
+  userAgent: string | null;
+  fingerprint: string | null;
+  lastIp: string | null;
+  trusted: boolean;
+  firstSeenAt: Date;
+  lastSeenAt: Date;
+  metadata: Record<string, unknown> | null;
+}
+interface MFACredentialEntity {
+  id: string;
+  userId: string;
+  type: MFAMethod;
+  credentialData: Record<string, unknown>;
+  isPrimary: boolean;
+  verifiedAt: Date | null;
+  createdAt: Date;
+  metadata: Record<string, unknown> | null;
+}
+/**
+ * Stores the OAuth transaction state during an OAuth or OIDC authorization flow.
+ */
+interface OAuthTransactionEntity {
+  id: string;
+  provider: string;
+  state: string;
+  nonce: string | null;
+  codeVerifier: string | null;
+  redirectURI: string;
+  redirectTo: string | null;
+  userAgent: string | null;
+  fingerprint: string | null;
+  deviceId: string | null;
+  createdAt: Date;
+  expiresAt: Date;
+  metadata: Record<string, unknown> | null;
+} //#endregion
+//#region src/@types/adapter.d.ts
+interface UsersAdapter {
+  /**
+   * User management methods
+   */
+  createUser(input: Partial<Omit<UserEntity, "createdAt" | "updatedAt">>): Promise<UserEntity>;
+  getUserById(id: string): Promise<UserEntity | null>;
+  getUserByEmail(email: string): Promise<UserEntity | null>;
+  updateUser(id: string, input: Partial<Omit<UserEntity, "createdAt" | "updatedAt">>): Promise<UserEntity>;
+  /**
+   * Soft delete: sets status = "deleted", row is preserved.
+   * Hard delete: removes the row and all owned rows (Accounts, Sessions,
+   * Devices, MfaCredentials). Strategy is set in AdapterConfig, not here.
+   *
+   * Delete an user based on the selected strategy.
+   *   - `"soft"`: The user is marked as deleted, but the row is preserved in the database.
+   *   - `"hard"`: The user and all associated data (Accounts, Sessions, Devices, MfaCredentials) are permanently removed from the database.
+   */
+  deleteUser(id: string): Promise<void>;
+}
+interface AccountsAdapter {
+  /**
+   * Account management methods
+   */
+  createAccount(input: Partial<Omit<AccountEntity, "createdAt" | "updatedAt">>): Promise<AccountEntity>;
+  getAccountById(id: string): Promise<AccountEntity | null>;
+  getAccountByProvider(provider: string, providerUserId: string): Promise<AccountEntity | null>;
+  getAccountsByUserId(userId: string): Promise<AccountEntity[]>;
+  updateAccountStatus(id: string, status: AccountEntity["status"]): Promise<AccountEntity>;
+  unlinkAccount(id: string): Promise<void>;
+}
+interface OAuthAccountsAdapter {
+  /**
+   * OAuthAccount management methods
+   */
+  createOAuthAccount(input: Partial<Omit<OAuthAccountEntity, "createdAt" | "updatedAt">>): Promise<OAuthAccountEntity>;
+  getOAuthAccount(accountId: string): Promise<OAuthAccountEntity | null>;
+  updateOAuthTokens(accountId: string, input: Partial<Omit<OAuthAccountEntity, "createdAt" | "updatedAt">>): Promise<OAuthAccountEntity>;
+}
+interface CredentialAccountsAdapter {
+  /**
+   * CredentialAccounts management methods.
+   */
+  createCredentialAccount(input: Partial<Omit<CredentialAccountEntity, "updatedAt">>): Promise<CredentialAccountEntity>;
+  getCredentialAccount(accountId: string): Promise<CredentialAccountEntity | null>;
+  updatePasswordHash(accountId: string, passwordHash: string): Promise<CredentialAccountEntity>;
+}
+interface SessionsAdapter {
+  /**
+   * Session management methods.
+   */
+  createSession(input: Omit<SessionEntity, "createdAt" | "updatedAt" | "lastActivityAt" | "revokedAt">): Promise<SessionEntity>;
+  getSessionByToken(token: string): Promise<SessionWithUserEntity | null>;
+  getSessionById(id: string): Promise<SessionEntity | null>;
+  listSessions(filter: Pick<SessionEntity, "userId" | "status" | "deviceId">): Promise<SessionEntity[]>;
+  updateSession(id: string, input: Partial<Omit<SessionEntity, "createdAt" | "updatedAt" | "revokedAt">>): Promise<SessionEntity>;
+  touchSession(id: string, lastActivityAt: Date): Promise<void>;
+  revokeSession(id: string, reason: RevokeReason): Promise<void>;
+  revokeAllSessions(userId: string, reason: RevokeReason, exceptSessionId?: string): Promise<number>;
+}
+interface DevicesAdapter {
+  /**
+   * Device management methods.
+   */
+  createDevice(input: Omit<DeviceEntity, "id" | "createdAt" | "updatedAt">): Promise<DeviceEntity>;
+  getDeviceById(id: string): Promise<DeviceEntity | null>;
+  getDeviceByFingerprint(userId: string, fingerprint: string): Promise<DeviceEntity | null>;
+  getDevicesByUserId(userId: string): Promise<DeviceEntity[]>;
+  updateDevice(id: string, input: Partial<Omit<DeviceEntity, "createdAt" | "updatedAt">>): Promise<DeviceEntity>;
+  trustDevice(id: string, trusted: boolean): Promise<DeviceEntity>;
+  deleteDevice(id: string): Promise<void>;
+}
+interface MFACredentialsAdapter {
+  /**
+   * MFACredentials management methods.
+   */
+  createMfaCredential(input: Omit<MFACredentialEntity, "id" | "verifiedAt" | "updatedAt">): Promise<MFACredentialEntity>;
+  getMfaCredentialById(id: string): Promise<MFACredentialEntity | null>;
+  getMfaCredentialsByUserId(userId: string): Promise<MFACredentialEntity[]>;
+  getMfaCredentialsByType(userId: string, type: MFAMethod): Promise<MFACredentialEntity[]>;
+  verifyMfaCredential(id: string): Promise<MFACredentialEntity>;
+  updateMfaCredential(id: string, input: Omit<MFACredentialEntity, "id" | "verifiedAt" | "updatedAt">): Promise<MFACredentialEntity>;
+  deleteMfaCredential(id: string): Promise<void>;
+}
+interface OAuthTransactionsAdapter {
+  /**
+   * OAuthTransaction management methods.
+   */
+  createOAuthTransaction(input: OAuthTransactionEntity): Promise<OAuthTransactionEntity>;
+  getOAuthTransactionByState(state: string): Promise<OAuthTransactionEntity | null>;
+  consumeOAuthTransaction(state: string): Promise<OAuthTransactionEntity | null>;
+  deleteExpiredOAuthTransactions(): Promise<number>;
+}
+/**
+ * The database adapter interface. Each provider package must implement this.
+ */
+interface DatabaseAdapter extends UsersAdapter, AccountsAdapter, OAuthAccountsAdapter, CredentialAccountsAdapter, SessionsAdapter, DevicesAdapter, MFACredentialsAdapter, OAuthTransactionsAdapter {} //#endregion
+//#region src/session/cookie-manager.d.ts
+//#endregion
 //#region src/@types/session.d.ts
 /** Application user type, inferred from the configured identity schema (defaults to the built-in user shape). */
-type User = output<typeof identitySchema$3>;
+type User = output<typeof identitySchema>;
 /**
  * Session data returned by the session endpoint.
  */
@@ -9904,11 +10230,16 @@ type JWTSealedMode = {
 };
 /** Discriminated union of JWT wire format: signed JWS, encrypted JWE, or nested sealed (JWS in JWE). */
 type JWTConfigBase = JWTSignedMode | JWTEncryptedMode | JWTSealedMode;
-/** How session/JWT lifetime is enforced relative to `iat`, absolute caps, and sliding windows. */
-type JWTExpirationStrategy = "fixed" | "rolling" | "absolute" | "sliding";
+type ExpirationStrategy = "fixed" | "rolling" | "absolute" | "sliding";
+/**
+ * How session/JWT lifetime is enforced relative to `iat`, absolute caps, and sliding windows.
+ * @deprecated Use `ExpirationStrategy` instead. This will be removed in a future release.
+ */
+type JWTExpirationStrategy = ExpirationStrategy;
 type JWTConfig = Prettify<{
   /**
    * Token lifetime.
+   * @deprecated Use `session.maxAge` instead. This will be removed in a future release.
    */
   maxAge?: number;
   /**
@@ -9925,13 +10256,62 @@ type JWTConfig = Prettify<{
    * Maximum absolute session duration in seconds.
    * Required for "absolute" and "sliding" strategies.
    * Enforced via jose's maxTokenAge against the iat claim.
+   * @deprecated Use `session.maxDuration` instead. This will be removed in a future release.
    */
   maxExpiration?: number;
   /**
    * Policy for renewing or capping token lifetime (pairs with `maxExpiration` where applicable).
+   * @deprecated Use `session.expirationStrategy` instead. This will be removed in a future release.
    */
   expirationStrategy?: JWTExpirationStrategy;
 } & JWTConfigBase>;
+interface SessionStatefulConfig {
+  /**
+   * The session deletion strategy when a user is deleted. Defaults to "soft" (mark as deleted, keep for audit).
+   * - "soft": The user is marked as deleted, but the row is preserved in the database.
+   * - "hard": The user and all associated data (Accounts, Sessions, Devices, MfaCredentials) are permanently removed from the database.
+   */
+  deleteStrategy?: "soft" | "hard";
+  /**
+   * The maximum number of concurrent sessions allowed per user. If exceeded, the oldest session(s) will be revoked.
+   * If not set, there is no limit on concurrent sessions.
+   */
+  maxSessions?: number;
+  /**
+   * Defines the minimum interval (in seconds) between session "touches" (updates to lastActivityAt) to reduce database writes.
+   */
+  touchInterval?: number;
+}
+interface SessionConfigBase {
+  /**
+   * Session time to live (TTL) in seconds. Determines how long a session is valid before it expires.
+   * If not set, the default is 15 days (60 * 60 * 24 * 15).
+   * @default 1296000 (15 days)
+   */
+  maxAge?: number;
+  /**
+   * Maximum absolute session duration in seconds.
+   * Required for "absolute" and "sliding" strategies.
+   * Enforced via jose's maxTokenAge against the iat claim.
+   */
+  maxDuration?: number;
+  /**
+   * The session expiration strategy. Determines how the session's lifetime is calculated and enforced.
+   * - "fixed": The session expires after a fixed duration from the time of creation.
+   * - "rolling": The session expiration is extended on each request, up to the maximum age.
+   * - "absolute": The session has a hard expiration time, regardless of activity.
+   * - "sliding": The session expiration is extended on each request, but cannot exceed the maximum expiration time.
+   *
+   * @default "absolute"
+   */
+  expirationStrategy?: ExpirationStrategy;
+  /**
+   * The sliding threshold percentage p for the `"sliding"` expiration strategy. Determines when the
+   * session expiration is extended based on the remaining time.
+   * @default 0.5 (50%)
+   */
+  slidingThreshold?: number;
+}
 /**
  * Stateless JWT strategy.
  * No database required. Tokens are self-contained and cannot be revoked
@@ -9940,14 +10320,33 @@ type JWTConfig = Prettify<{
  * @example
  * {
  *   strategy: "jwt",
- *   jwt: { mode: "sealed", maxAge: "15m", issuer: "https://auth.example.com" },
- *   refreshToken: { enabled: true, maxAge: "7d" },
+ *   jwt: { mode: "sealed", issuer: "https://auth.example.com" },
  * }
  */
-type StatelessStrategyConfig = {
+interface StatelessStrategyConfig extends SessionConfigBase {
   strategy?: "jwt";
   jwt?: JWTConfig;
-};
+}
+/**
+ * Stateful database strategy.
+ * Database required. Every request hits the DB to validate the session.
+ *
+ * @example
+ * {
+ *   strategy: "database",
+ *   adapter: prismaAdapter({ client: prismaClient }),
+ *   database: { deleteStrategy: "soft", maxSessions: 5 },
+ * }
+ */
+interface StatefulStrategyConfig extends SessionConfigBase {
+  strategy: "database";
+  adapter: DatabaseAdapter;
+  database?: SessionStatefulConfig;
+  /**
+   * @deprecated Use `database` instead. This will be removed in a future release.
+   */
+  session?: SessionStatefulConfig;
+}
 /**
  * The session strategy. Determines which fields below are required.
  *
@@ -9957,7 +10356,7 @@ type StatelessStrategyConfig = {
  *
  * @default "jwt"
  */
-type SessionConfig = StatelessStrategyConfig;
+type SessionConfig = StatelessStrategyConfig | StatefulStrategyConfig;
 /** Result of reading a stateless (JWT) session from a request: session payload and outgoing header mutations. */
 interface OAuthTokenPayload {
   /**
@@ -9966,8 +10365,10 @@ interface OAuthTokenPayload {
   accessToken: string;
   /**
    * The expiration time of the access token, in seconds since the epoch (Unix time).
+   * @deprecated
    */
   expiresAt: number;
+  accessTokenExpiresAt?: number;
   /**
    * The raw refresh token string issued by the OAuth provider, if applicable.
    */
@@ -9996,28 +10397,8 @@ interface OAuthTokenPayload {
    * The time at which the token was issued, in seconds since the epoch (Unix time).
    */
   issuedAt: number;
-} //#endregion
-//#region src/validator/registry.d.ts
-type OpenIDProvider<Profile extends object = Record<string, any>, DefaultUser = User, Issuer extends string = string> = {
-  id: string;
-  name: string;
-  /**
-   * URL to concatenating the string /.well-known/openid-configuration to the Issuer.
-   */
-  issuer: Issuer;
-  clientId?: string;
-  clientSecret?: string;
-  /**
-   * Refresh window in seconds before the access token expires to attempt a refresh.
-   * Defaults to 300 seconds.
-   */
-  refreshWindow?: number;
-  /**
-   * Override the default OIDC scope (`openid profile email`).
-   */
-  scope?: string;
-  profile?: (profile: Profile) => DefaultUser | Promise<DefaultUser>;
-} & GetRouteParams<`/${Issuer}`>; //#endregion
+}
+//#endregion
 //#region src/oauth/github.d.ts
 /**
  * @see [Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user)
@@ -10557,6 +10938,7 @@ interface AtlassianProfile {
   created_at: string;
 }
 /**
+ * @see [Atlassian - Authorizing OAuth Apps](https://developer.atlassian.com/cloud/jira/platform/oauth-2-3lo-apps/)
  * @see [Atlassian - OAuth Apps](https://developer.atlassian.com/cloud/jira/platform/oauth-2-3lo-apps/)
  * @see [Atlassian - My Apps](https://developer.atlassian.com/console/myapps/)
  * @see [Atlassian - Retrieve Authenticated User](https://developer.atlassian.com/cloud/jira/software/oauth-2-3lo-apps/#how-do-i-retrieve-the-public-profile-of-the-authenticated-user-)
@@ -10865,7 +11247,35 @@ interface AuthentikProfile {
  * @see [Authentik - OAuth 2.0 Provider](https://docs.goauthentik.io/add-secure-apps/providers/oauth2/)
  * @see [Authentik - Create an OAuth2 Provider](https://docs.goauthentik.io/add-secure-apps/providers/oauth2/create-oauth2-provider/)
  */
-//#endregion
+type OpenIDProvider<Profile extends object = Record<string, any>, DefaultUser = User, Issuer extends string = string> = {
+  id: string;
+  name: string;
+  /**
+   * URL to concatenating the string /.well-known/openid-configuration to the Issuer.
+   */
+  issuer: Issuer;
+  clientId?: string;
+  clientSecret?: string;
+  /**
+   * Refresh window in seconds before the access token expires to attempt a refresh.
+   * Defaults to 300 seconds.
+   */
+  refreshWindow?: number;
+  /**
+   * Revoke the access token configuration for the OAuth provider. It revokes the access token but not
+   * invalidate the session when there are multiple access token configured for the session.
+   */
+  revokeToken?: string | {
+    url: string;
+    headers?: Record<string, string>;
+    params?: Record<RevokeTokenParams, RevokeTokenTokenHint>;
+  };
+  /**
+   * Override the default OIDC scope (`openid profile email`).
+   */
+  scope?: string;
+  profile?: (profile: Profile) => DefaultUser | Promise<DefaultUser>;
+} & Partial<GetRouteParams<`/${Issuer}`>>; //#endregion
 //#region src/oauth/index.d.ts
 declare const builtInOAuthProviders: {
   readonly github: <DefaultUser extends User = {
@@ -11024,8 +11434,11 @@ type AccessTokenContext = {
 };
 /** Known query parameter names supported when building an OAuth authorization URL. */
 type AuthorizeParams = LiteralUnion<"clientId" | "prompt" | "scope" | "responseMode" | "audience" | "loginHint" | "nonce" | "display">;
+/** Known query parameter names supported when revoking an OAuth token. */
+type RevokeTokenParams = LiteralUnion<"tokenHint">;
+type RevokeTokenTokenHint = LiteralUnion<"access_token" | "refresh_token">;
 /** OAuth 2.0 `response_type` values used in authorization requests. */
-type ResponseType = LiteralUnion<"code" | "token" | "refresh_token" | "id_token">;
+type ResponseType$1 = LiteralUnion<"code" | "token" | "refresh_token" | "id_token">;
 /**
  * Configuration for an OAuth provider without credentials.
  * Use this type when defining provider metadata and endpoints.
@@ -11041,7 +11454,7 @@ interface OAuthProviderConfig<Profile extends object = Record<string, any>, Defa
   authorize: string | {
     url: string;
     params?: Partial<Record<AuthorizeParams, string> & {
-      responseType: ResponseType;
+      responseType: ResponseType$1;
     }>;
   };
   accessToken: string | {
@@ -11064,6 +11477,18 @@ interface OAuthProviderConfig<Profile extends object = Record<string, any>, Defa
     url: string;
     headers?: Record<string, string>;
     params?: Record<string, string>;
+    authorization?: {
+      type: "basic" | "credentials";
+    };
+  };
+  /**
+   * Revoke the access token configuration for the OAuth provider. It revokes the access token but not
+   * invalidate the session when there are multiple access token configured for the session.
+   */
+  revokeToken?: string | {
+    url: string;
+    headers?: Record<string, string>;
+    params?: Record<RevokeTokenParams, RevokeTokenTokenHint>;
   };
   /**
    * Refresh window in seconds before the access token expires to attempt a refresh.
@@ -11079,7 +11504,7 @@ interface OAuthProviderConfig<Profile extends object = Record<string, any>, Defa
    * @deprecated
    * use `authorize.params.responseType` instead of `responseType`
    */
-  responseType?: ResponseType;
+  responseType?: ResponseType$1;
   profile?: (profile: Profile) => DefaultUser | Promise<DefaultUser>;
 }
 /**
@@ -11100,16 +11525,15 @@ interface OAuthProviderCredentials<Profile extends object = Record<string, any>,
 type AuthAPI<DefaultUser extends User = User, SignUpSchema extends SchemaTypes = ZodObject<any>> = ReturnType<typeof createAuthAPI<DefaultUser, SignUpSchema>>;
 /** JWT and crypto helpers bound to the configured identity schema (sign, verify, claims). */
 type JoseInstance<DefaultUser extends User = User> = ReturnType<typeof createJoseInstance<DefaultUser>>;
-/** Normalized internal logger with resolved level and structured log function. */
 /** Payload sent to the credentials sign-in endpoint (username/password flow). */
 interface CredentialsPayload {
   username: string;
   password: string;
 }
 /**
- * Context provided to the credentials provider's authorize function.
- * It includes the credentials sent by the user and hashing utilities.
+ * Interface for the credentials provider.
  */
+type Handlers = { [method in "GET" | "POST" | "PATCH" | "DELETE" | "ALL"]: (request: Request) => Response | Promise<Response> };
 /**
  * Public auth instance: programmatic {@link AuthAPI}, {@link JoseInstance}, and HTTP {@link AuthClient} handlers.
  */
@@ -11125,20 +11549,11 @@ interface AuthInstance<DefaultUser extends User = User, SignUpSchema extends Sch
   /**
    * HTTP handlers for mounting on a router or server.
    */
-  handlers: {
-    GET: (request: Request) => Response | Promise<Response>;
-    POST: (request: Request) => Response | Promise<Response>;
-    PATCH: (request: Request) => Response | Promise<Response>;
-    ALL: (request: Request) => Response | Promise<Response>;
-  };
+  handlers: Handlers;
 }
-/**
- * Extended context used inside the library with both secure and standard cookie materializations.
- */
+/** Minimal token issue/verify surface used by session code paths. */
 //#endregion
 //#region src/@types/utility.d.ts
-/** Expands intersection types into a single flat object type for readable editor hints. */
-type Prettify<T> = { [K in keyof T]: T[K] };
 /**
  * A string that must be one of the literals in `T`, or any other string (`U`).
  * Useful for autocomplete on known keys while still allowing custom values.
@@ -11216,10 +11631,6 @@ type AuthActionAPIReturn<Body extends object, ErrorCodes = any> = (Extract<Body,
     success: true;
   }>>;
 });
-/**
- * Utility to merge the internal router global context (`ctx`) with per-function options.
- * Used by implementation-level API functions in `src/api/*`.
- */
 interface APIOptionsWithRedirectTo {
   /**
    * Optional redirect strategy for server/programmatic API functions.
@@ -11257,7 +11668,7 @@ interface APIOptionsWithRedirectTo {
    */
   redirectTo?: string;
 }
-interface APIOptionsWithRequest extends APIOptionsWithRedirectTo {
+interface APIOptionsWithRequest {
   /**
    * Optional `Request` object, useful for constructing the incoming URL on the server side.
    * This option is required when the `redirectTo` option is defined, to ensure the `redirectTo`
@@ -11279,8 +11690,26 @@ interface APIOptionsWithSkipCSRFCheck {
    * The CSRF token is still required and validated to preserve request integrity.
    * Use this only for trusted server-side flows.
    * @default `false`
+   * @deprecated Use `doubleSubmitToken` to provide the CSRF token explicitly instead of skipping the check.
    */
   skipCSRFCheck?: boolean;
+  /**
+   * Optional token used to perform Double-Submit Cookie validation.
+   *
+   * By default, server-side API functions skip the Double-Submit Cookie validation
+   * because they execute in a trusted server environment where the CSRF token is
+   * not directly available. Providing this value enables the same Double-Submit
+   * Cookie validation performed by the HTTP endpoints.
+   *
+   * Other CSRF protections remain enabled regardless of whether this option is
+   * provided.
+   *
+   * @example
+   * api.signOut({
+   *   doubleSubmitToken: "csrf-token-value",
+   * })
+   */
+  doubleSubmitToken?: string;
 }
 /** Options to get the current session. */
 interface GetSessionAPIOptions {
@@ -11298,25 +11727,36 @@ type GetSessionAPIReturn<DefaultUser extends User = User> = AuthActionAPIReturn<
 /**
  * Client-side options for `createAuthClient().signIn(...)`.
  */
+type SignInReturnData = /** redirect: true & redirectTo: string */{
+  success: true;
+  redirect: true;
+  signInURL: string;
+} /** redirect: false & redirectTo: string */ | {
+  success: true;
+  redirect: false;
+  signInURL: string;
+} /** redirect: false & redirectTo: null | undefined (not set) */ | {
+  success: false;
+  redirect: false;
+  signInURL: null;
+};
+/**
+ * Client-side `signIn` return type.
+ *
+ * - Redirect mode (`redirect: true`): returns `void` because navigation is handled by the client.
+ * - Manual mode (`redirect: false`): returns `signInURL` for caller-controlled navigation.
+ */
 /**
  * Server/programmatic options for `signIn` API.
  */
-interface SignInAPIOptions extends APIOptionsWithRedirectTo, APIOptionsWithRequest {}
+interface SignInAPIOptions extends APIOptionsWithRequest, APIOptionsWithRedirectTo {}
 /**
  * Server/programmatic `signIn` result.
  *
  * Includes `signInURL` and response metadata to support both framework-managed redirects
  * and custom response handling through `toResponse()`.
  */
-type SignInAPIReturn = AuthActionAPIReturn<{
-  success: true;
-  redirect: boolean;
-  signInURL: string;
-} | {
-  success: false;
-  redirect: false;
-  signInURL: null;
-}>;
+type SignInAPIReturn = AuthActionAPIReturn<SignInReturnData>;
 type SignInCredentialsReturnData = /** redirect: true & redirectTo: string */{
   success: true;
   redirect: true;
@@ -11339,7 +11779,7 @@ type SignInCredentialsReturnData = /** redirect: true & redirectTo: string */{
 };
 /** Client-side credentials sign-in return type (redirect mode or manual redirect data). */
 /** Server/programmatic credentials sign-in options. */
-interface SignInCredentialsAPIOptions extends APIOptionsWithRedirectTo, APIOptionsWithRequest, APIOptionsWithSkipCSRFCheck {
+interface SignInCredentialsAPIOptions extends APIOptionsWithRequest, APIOptionsWithRedirectTo, APIOptionsWithSkipCSRFCheck {
   /**
    * Credentials payload validated by the configured `credentials.authorize` function.
    * @example
@@ -11375,7 +11815,7 @@ type SignOutReturnData = /** redirect: true & redirectTo: string */{
 };
 /** Client-side sign-out return type (redirect mode or manual redirect data). */
 /** Server/programmatic options for `signOut` API. */
-interface SignOutAPIOptions extends RequiredKeys<APIOptionsWithRequest, "headers">, APIOptionsWithSkipCSRFCheck {}
+interface SignOutAPIOptions extends RequiredKeys<APIOptionsWithRequest, "headers">, APIOptionsWithRedirectTo, APIOptionsWithSkipCSRFCheck {}
 /** Programmatic sign-out result with redirect metadata and `toResponse()`. */
 type SignOutAPIReturn = AuthActionAPIReturn<SignOutReturnData>;
 /** Client-side `updateSession` options: partial session payload plus optional redirect behavior. */
@@ -11402,7 +11842,7 @@ type UpdateSessionReturnData<DefaultUser extends User = User> = /** redirect: tr
 };
 /** Client-side `updateSession` return type. */
 /** Server/programmatic options for `updateSession` API. */
-interface UpdateSessionAPIOptions<DefaultUser extends User = User> extends RequiredKeys<APIOptionsWithRequest, "headers">, APIOptionsWithSkipCSRFCheck {
+interface UpdateSessionAPIOptions<DefaultUser extends User = User> extends RequiredKeys<APIOptionsWithRequest, "headers">, APIOptionsWithRedirectTo, APIOptionsWithSkipCSRFCheck {
   /**
    * Partial session payload used to update the current session.
    * @see Session
@@ -11418,7 +11858,7 @@ interface UpdateSessionAPIOptions<DefaultUser extends User = User> extends Requi
 }
 /** Programmatic session update result with redirect metadata and `toResponse()`. */
 type UpdateSessionAPIReturn<DefaultUser extends User = User> = AuthActionAPIReturn<UpdateSessionReturnData<DefaultUser>>;
-interface SignUpAPIOptions<Payload extends Record<string, any> = Record<string, any>> extends APIOptionsWithRedirectTo, APIOptionsWithRequest, APIOptionsWithSkipCSRFCheck {
+interface SignUpAPIOptions<Payload extends Record<string, any> = Record<string, any>> extends APIOptionsWithRequest, APIOptionsWithRedirectTo, APIOptionsWithSkipCSRFCheck {
   payload: Payload;
 }
 type SignUpReturnData = /** redirect: true & redirectTo: string */{
@@ -11443,7 +11883,13 @@ type SignUpReturnData = /** redirect: true & redirectTo: string */{
 };
 /** Programmatic sign-up result with redirect metadata and `toResponse()`. */
 type SignUpAPIReturn = AuthActionAPIReturn<SignUpReturnData>;
-interface GetProviderTokensAPIOptions extends Pick<APIOptionsWithRequest, "headers" | "request">, APIOptionsWithSkipCSRFCheck {}
+/**
+ * Client-side `signUp` options: payload plus optional redirect behavior.
+ */
+/**
+ * Programmatic options for `getProviderTokens` API.
+ */
+interface GetProviderTokensAPIOptions extends Pick<APIOptionsWithRequest, "headers" | "request"> {}
 type GetProviderTokensData = {
   success: true;
   tokens: OAuthTokenPayload;
@@ -11451,6 +11897,81 @@ type GetProviderTokensData = {
   success: false;
   tokens: null;
 };
+/**
+ * Programmatic result for `getProviderTokens` API with response metadata and `toResponse()`.
+ */
 type GetProviderTokensAPIReturn = AuthActionAPIReturn<GetProviderTokensData>;
+/**
+ * Client-side `getProviderTokens` return type.
+ */
+/**
+ * Programmatic options for `getAccessToken` API.
+ */
+type AccessTokenAPIOptions = GetProviderTokensAPIOptions;
+type AccessTokenData = {
+  success: true;
+  accessToken: string;
+} | {
+  success: false;
+  accessToken: null;
+};
+/**
+ * Programmatic result for `getAccessToken` API with response metadata and `toResponse()`.
+ */
+type AccessTokenAPIReturn = AuthActionAPIReturn<AccessTokenData>;
+/**
+ * Programmatic options for `refreshUserInfo` API.
+ */
+interface RefreshUserInfoAPIOptions extends APIOptionsWithRequest, APIOptionsWithSkipCSRFCheck {}
+type RefreshUserInfoData<DefaultUser extends User = User> = {
+  success: true;
+  session: Session<DefaultUser>;
+} | {
+  success: false;
+  session: null;
+};
+/**
+ * Programmatic result for `refreshUserInfo` API with response metadata and `toResponse()`.
+ */
+type RefreshUserInfoAPIReturn<DefaultUser extends User = User> = AuthActionAPIReturn<RefreshUserInfoData<DefaultUser>>;
+/**
+ * Programmatic options for `revokeToken` API.
+ */
+interface RevokeTokenAPIOptions extends APIOptionsWithRequest, APIOptionsWithSkipCSRFCheck {}
+type RevokeTokenData = {
+  success: true;
+} | {
+  success: false;
+};
+/**
+ * Programmatic result for `revokeToken` API with response metadata and `toResponse()`.
+ */
+type RevokeTokenAPIReturn = AuthActionAPIReturn<RevokeTokenData>;
+/**
+ * Programmatic options for `disconnectProvider` API.
+ */
+interface DisconnectProviderAPIOptions extends APIOptionsWithRequest, APIOptionsWithSkipCSRFCheck {}
+type DisconnectProviderData = {
+  success: true;
+} | {
+  success: false;
+};
+/**
+ * Programmatic result for `disconnectProvider` API with response metadata and `toResponse()`.
+ */
+type DisconnectProviderAPIReturn = AuthActionAPIReturn<DisconnectProviderData>;
+type ProviderConnectedAPIOptions = APIOptionsWithRequest;
+type ProviderConnectedData = {
+  success: true;
+  connected: boolean;
+} | {
+  success: false;
+  connected: false;
+};
+type ProviderConnectedAPIReturn = AuthActionAPIReturn<ProviderConnectedData>; //#endregion
+//#region src/@types/index.d.ts
+/**
+ * JWT payload structure that includes a mandatory `token` field used to verify CSRF Tokens
+ */
 //#endregion
-export { DecodeJWTOptions as C, Wrap as S, TypedJWTPayload as T, SignOutAPIReturn as _, GetProviderTokensAPIReturn as a, UpdateSessionAPIOptions as b, LiteralUnion as c, Session as d, SignInAPIOptions as f, SignOutAPIOptions as g, SignInCredentialsAPIReturn as h, GetProviderTokensAPIOptions as i, Prettify as l, SignInCredentialsAPIOptions as m, BuiltInOAuthProvider as n, GetSessionAPIOptions as o, SignInAPIReturn as p, FromShapeToObject as r, GetSessionAPIReturn as s, AuthInstance as t, RemoveIndexSignature as u, SignUpAPIOptions as v, EncodeJWTOptions as w, UpdateSessionAPIReturn as x, SignUpAPIReturn as y };
+export { SignUpAPIReturn as A, SignInAPIOptions as C, SignOutAPIOptions as D, SignInCredentialsAPIReturn as E, EncodeJWTOptions as F, TypedJWTPayload as I, UpdateSessionAPIReturn as M, Wrap as N, SignOutAPIReturn as O, DecodeJWTOptions as P, Session as S, SignInCredentialsAPIOptions as T, RefreshUserInfoAPIOptions as _, DeepPartial as a, RevokeTokenAPIOptions as b, FromShapeToObject as c, GetSessionAPIOptions as d, GetSessionAPIReturn as f, ProviderConnectedAPIReturn as g, ProviderConnectedAPIOptions as h, BuiltInOAuthProvider as i, UpdateSessionAPIOptions as j, SignUpAPIOptions as k, GetProviderTokensAPIOptions as l, LiteralUnion as m, AccessTokenAPIReturn as n, DisconnectProviderAPIOptions as o, Handlers as p, AuthInstance as r, DisconnectProviderAPIReturn as s, AccessTokenAPIOptions as t, GetProviderTokensAPIReturn as u, RefreshUserInfoAPIReturn as v, SignInAPIReturn as w, RevokeTokenAPIReturn as x, RemoveIndexSignature as y };