@holo-js/auth-workos 0.1.4 → 0.1.6

package/dist/index.d.ts

@@ -1,17 +1,40 @@
-import { AuthUserLike, AuthEstablishedSession, authRuntimeInternals } from '@holo-js/auth';
-import { AuthWorkosProviderConfig } from '@holo-js/config';
+import { AuthResult, AuthLogoutResult, AuthFieldErrors, AuthenticatedAuthUser, AuthEstablishedSession, authRuntimeInternals } from '@holo-js/auth';
+import { NormalizedAuthWorkosProviderConfig } from '@holo-js/config';
 
+type WorkosJsonValue = string | number | boolean | null | readonly WorkosJsonValue[] | {
+    readonly [key: string]: WorkosJsonValue;
+};
 interface WorkosIdentityProfile {
     readonly id: string;
-    readonly email?: string;
-    readonly emailVerified?: boolean;
+    readonly email: string;
+    readonly name: string;
+    readonly emailVerified: boolean;
     readonly firstName?: string;
     readonly lastName?: string;
-    readonly name?: string;
-    readonly avatar?: string;
+    readonly profilePictureUrl?: string;
+    readonly externalId?: string;
     readonly organizationId?: string;
-    readonly raw?: unknown;
+    readonly metadata: Readonly<Record<string, WorkosJsonValue>>;
+    readonly createdAt?: string;
+    readonly updatedAt?: string;
+    readonly raw: Readonly<Record<string, WorkosJsonValue>>;
 }
+type WorkosUserAttributeValue = string | number | boolean | Date | null | undefined | readonly WorkosUserAttributeValue[] | {
+    readonly [key: string]: WorkosUserAttributeValue;
+};
+type WorkosUserAttributes = Readonly<Record<string, WorkosUserAttributeValue>>;
+type WorkosDefaultUserAttributes = {
+    readonly email: string;
+    readonly name: string;
+};
+type WorkosUserMapper<TUserAttributes extends WorkosUserAttributes = WorkosDefaultUserAttributes> = (workosUser: WorkosIdentityProfile) => TUserAttributes;
+type WorkosCompleteAuthOptions<TUserAttributes extends WorkosUserAttributes = WorkosDefaultUserAttributes> = {
+    readonly provider?: string;
+    readonly user?: WorkosUserMapper<TUserAttributes>;
+};
+type WorkosSyncIdentityOptions<TUserAttributes extends WorkosUserAttributes = WorkosDefaultUserAttributes> = {
+    readonly user?: WorkosUserMapper<TUserAttributes>;
+};
 interface WorkosVerifiedSession {
     readonly sessionId: string;
     readonly identity: WorkosIdentityProfile;
@@ -19,21 +42,45 @@ interface WorkosVerifiedSession {
     readonly expiresAt?: Date;
     readonly raw?: unknown;
 }
+interface WorkosLogoutSession {
+    readonly provider: string;
+    readonly sessionId: string;
+}
+type WorkosAuthenticatedUser<TUserAttributes extends WorkosUserAttributes = WorkosDefaultUserAttributes> = AuthenticatedAuthUser & Omit<TUserAttributes, 'can' | 'id'> & {
+    readonly id: string | number;
+};
+type WorkosHostedAuthFailureFields = AuthFieldErrors<'_root'>;
+interface WorkosCompleteAuthData<TUserAttributes extends WorkosUserAttributes = WorkosDefaultUserAttributes> {
+    readonly provider: string;
+    readonly guard: string;
+    readonly authProvider: string;
+    readonly status: WorkosSyncStatus;
+    readonly user: WorkosAuthenticatedUser<TUserAttributes>;
+    readonly identity: HostedIdentityRecord;
+    readonly session: WorkosVerifiedSession;
+    readonly authSession?: AuthEstablishedSession;
+}
+type WorkosCompleteAuthResult<TUserAttributes extends WorkosUserAttributes = WorkosDefaultUserAttributes> = AuthResult<WorkosCompleteAuthData<TUserAttributes>, string, WorkosHostedAuthFailureFields>;
+type WorkosLogoutErrorCode = 'workos_logout_failed' | 'workos_session_missing';
+interface WorkosLogoutData {
+    readonly url: string;
+    readonly local: AuthLogoutResult;
+}
+type WorkosLogoutResult = AuthResult<WorkosLogoutData, WorkosLogoutErrorCode, WorkosHostedAuthFailureFields>;
 interface WorkosVerifyRequestContext {
     readonly provider: string;
     readonly request: Request;
-    readonly config: AuthWorkosProviderConfig;
+    readonly config: NormalizedAuthWorkosProviderConfig;
 }
 interface WorkosVerifySessionContext {
     readonly provider: string;
     readonly token: string;
-    readonly config: AuthWorkosProviderConfig;
+    readonly config: NormalizedAuthWorkosProviderConfig;
 }
 interface WorkosProviderRuntime {
     verifyRequest?(context: WorkosVerifyRequestContext): Promise<WorkosVerifiedSession | null>;
     verifySession?(context: WorkosVerifySessionContext): Promise<WorkosVerifiedSession | null>;
 }
-type RuntimeAuthProviderAdapter = ReturnType<typeof authRuntimeInternals.getRuntimeBindings>['providers'][string];
 interface HostedIdentityRecord {
     readonly provider: string;
     readonly providerUserId: string;
@@ -52,12 +99,12 @@ interface HostedIdentityStore {
     save(record: HostedIdentityRecord): Promise<void>;
 }
 type WorkosSyncStatus = 'created' | 'updated' | 'linked' | 'relinked';
-interface WorkosAuthenticationResult {
+interface WorkosAuthenticationResult<TUserAttributes extends WorkosUserAttributes = WorkosDefaultUserAttributes> {
     readonly provider: string;
     readonly guard: string;
     readonly authProvider: string;
     readonly status: WorkosSyncStatus;
-    readonly user: AuthUserLike;
+    readonly user: WorkosAuthenticatedUser<TUserAttributes>;
     readonly identity: HostedIdentityRecord;
     readonly session: WorkosVerifiedSession;
     readonly authSession?: AuthEstablishedSession;
@@ -71,9 +118,20 @@ interface ConfigureWorkosAuthRuntimeOptions {
     readonly identityStore?: HostedIdentityStore;
 }
 interface WorkosAuthFacade {
+    loginWithWorkos(request: Request, options?: {
+        readonly provider?: string;
+    }): Promise<Response>;
+    registerWithWorkos(request: Request, options?: {
+        readonly provider?: string;
+    }): Promise<Response>;
+    logoutWithWorkos(request: Request, options?: {
+        readonly provider?: string;
+        readonly returnTo?: string;
+    }): Promise<WorkosLogoutResult>;
+    completeWorkosAuth<TUserAttributes extends WorkosUserAttributes = WorkosDefaultUserAttributes>(request: Request, options?: WorkosCompleteAuthOptions<TUserAttributes>): Promise<WorkosCompleteAuthResult<TUserAttributes>>;
     verifyRequest(request: Request, provider?: string): Promise<WorkosVerifiedSession | null>;
     verifySession(token: string, provider?: string): Promise<WorkosVerifiedSession | null>;
-    syncIdentity(session: WorkosVerifiedSession, provider?: string): Promise<WorkosAuthenticationResult>;
+    syncIdentity<TUserAttributes extends WorkosUserAttributes = WorkosDefaultUserAttributes>(session: WorkosVerifiedSession, provider?: string, options?: WorkosSyncIdentityOptions<TUserAttributes>): Promise<WorkosAuthenticationResult<TUserAttributes>>;
     authenticate(request: Request, provider?: string): Promise<WorkosAuthenticationResult | null>;
 }
 declare class WorkosAuthConflictError extends Error {
@@ -88,35 +146,73 @@ declare class WorkosAuthConflictError extends Error {
         readonly message: string;
     });
 }
+
+type RuntimeAuthProviderAdapter = ReturnType<typeof authRuntimeInternals.getRuntimeBindings>['providers'][string];
+type WorkosRequestHeaders = Headers | ReadonlyArray<readonly [string, string]> | Record<string, string | readonly string[] | undefined> | {
+    readonly get?: (name: string) => string | null | undefined;
+    readonly forEach?: (callback: (value: string, key: string) => void) => void;
+    readonly entries?: () => Iterable<readonly [string, string]>;
+};
+type WorkosRequestLike = {
+    readonly method?: string;
+    readonly path?: string;
+    readonly url?: string | URL;
+    readonly headers?: WorkosRequestHeaders;
+    readonly request?: Request;
+    readonly req?: Request | {
+        readonly method?: string;
+        readonly url?: string;
+        readonly headers?: WorkosRequestHeaders;
+    };
+    readonly node?: {
+        readonly req?: {
+            readonly method?: string;
+            readonly url?: string;
+            readonly headers?: WorkosRequestHeaders;
+        };
+    };
+    readonly web?: {
+        readonly request?: Request;
+    };
+};
+type WorkosRequestInput = Request | WorkosRequestLike;
 declare function getBindings(): WorkosAuthBindings;
 declare function resolveConfiguredProviderName(provider?: string): string;
 declare function getConfiguredProviderConfig(provider?: string): {
     readonly name: string;
-    readonly clientId?: string;
-    readonly apiKey?: string;
-    readonly cookiePassword?: string;
-    readonly redirectUri?: string;
-    readonly sessionCookie: string;
-    readonly guard?: string;
-    readonly mapToProvider?: string;
-};
+} & NormalizedAuthWorkosProviderConfig;
 declare function resolveGuardAndProvider(provider?: string): {
     readonly guard: string;
     readonly authProvider: string;
     readonly adapter: RuntimeAuthProviderAdapter;
 };
-declare function resolveDisplayName(profile: WorkosIdentityProfile): string | undefined;
+declare function resolveDisplayName(profile: WorkosIdentityProfile): string;
 declare function resolveEmailForCreation(profile: WorkosIdentityProfile): string;
 declare function normalizeHostedProfile(profile: WorkosIdentityProfile): Readonly<Record<string, unknown>>;
 declare function getSessionTokenFromRequest(request: Request, sessionCookie: string): string | null;
 declare function verifySession(token: string, provider?: string): Promise<WorkosVerifiedSession | null>;
-declare function verifyRequest(request: Request, provider?: string): Promise<WorkosVerifiedSession | null>;
-declare function syncIdentity(session: WorkosVerifiedSession, provider?: string): Promise<WorkosAuthenticationResult>;
-declare function authenticate(request: Request, provider?: string): Promise<WorkosAuthenticationResult | null>;
+declare function verifyRequest(input: WorkosRequestInput, provider?: string): Promise<WorkosVerifiedSession | null>;
+declare function syncIdentity<TUserAttributes extends WorkosUserAttributes = WorkosDefaultUserAttributes>(session: WorkosVerifiedSession, provider?: string, options?: WorkosSyncIdentityOptions<TUserAttributes>): Promise<WorkosAuthenticationResult<TUserAttributes>>;
+declare function authenticate(input: WorkosRequestInput, provider?: string): Promise<WorkosAuthenticationResult | null>;
+declare function loginWithWorkos(input: WorkosRequestInput, options?: {
+    readonly provider?: string;
+}): Promise<Response>;
+declare function registerWithWorkos(input: WorkosRequestInput, options?: {
+    readonly provider?: string;
+}): Promise<Response>;
+declare function logoutWithWorkos(input: WorkosRequestInput, options?: {
+    readonly provider?: string;
+    readonly returnTo?: string;
+}): Promise<WorkosLogoutResult>;
+declare function completeWorkosAuth<TUserAttributes extends WorkosUserAttributes = WorkosDefaultUserAttributes>(input: WorkosRequestInput, options?: WorkosCompleteAuthOptions<TUserAttributes>): Promise<WorkosCompleteAuthResult<TUserAttributes>>;
 declare function configureWorkosAuthRuntime(bindings?: ConfigureWorkosAuthRuntimeOptions): void;
 declare function resetWorkosAuthRuntime(): void;
 declare const workosAuth: Readonly<{
     authenticate: typeof authenticate;
+    completeWorkosAuth: typeof completeWorkosAuth;
+    loginWithWorkos: typeof loginWithWorkos;
+    logoutWithWorkos: typeof logoutWithWorkos;
+    registerWithWorkos: typeof registerWithWorkos;
     syncIdentity: typeof syncIdentity;
     verifyRequest: typeof verifyRequest;
     verifySession: typeof verifySession;
@@ -132,4 +228,4 @@ declare const workosAuthInternals: {
     resolveGuardAndProvider: typeof resolveGuardAndProvider;
 };
 
-export { type ConfigureWorkosAuthRuntimeOptions, type HostedIdentityRecord, type HostedIdentityStore, type WorkosAuthBindings, WorkosAuthConflictError, type WorkosAuthFacade, type WorkosAuthenticationResult, type WorkosIdentityProfile, type WorkosProviderRuntime, type WorkosSyncStatus, type WorkosVerifiedSession, type WorkosVerifyRequestContext, type WorkosVerifySessionContext, authenticate, configureWorkosAuthRuntime, resetWorkosAuthRuntime, syncIdentity, verifyRequest, verifySession, workosAuth, workosAuthInternals };
+export { type ConfigureWorkosAuthRuntimeOptions, type HostedIdentityRecord, type HostedIdentityStore, type WorkosAuthBindings, WorkosAuthConflictError, type WorkosAuthFacade, type WorkosAuthenticatedUser, type WorkosAuthenticationResult, type WorkosCompleteAuthData, type WorkosCompleteAuthOptions, type WorkosCompleteAuthResult, type WorkosDefaultUserAttributes, type WorkosHostedAuthFailureFields, type WorkosIdentityProfile, type WorkosJsonValue, type WorkosLogoutData, type WorkosLogoutErrorCode, type WorkosLogoutResult, type WorkosLogoutSession, type WorkosProviderRuntime, type WorkosSyncIdentityOptions, type WorkosSyncStatus, type WorkosUserAttributeValue, type WorkosUserAttributes, type WorkosVerifiedSession, type WorkosVerifyRequestContext, type WorkosVerifySessionContext, authenticate, completeWorkosAuth, configureWorkosAuthRuntime, loginWithWorkos, logoutWithWorkos, registerWithWorkos, resetWorkosAuthRuntime, syncIdentity, verifyRequest, verifySession, workosAuth, workosAuthInternals };

package/dist/index.mjs

@@ -1,7 +1,9 @@
 // src/index.ts
-import { createPublicKey, verify as verifySignature } from "crypto";
-import { authRuntimeInternals } from "@holo-js/auth";
-import { parseCookieHeader } from "@holo-js/session";
+import { createPublicKey, randomBytes, verify as verifySignature } from "crypto";
+import { authRuntimeInternals, getAuthRuntime } from "@holo-js/auth";
+import { cookie, parseCookieHeader } from "@holo-js/session";
+
+// src/contracts.ts
 var WorkosAuthConflictError = class extends Error {
   code = "workos_identity_conflict";
   provider;
@@ -15,15 +17,127 @@ var WorkosAuthConflictError = class extends Error {
     this.email = options.email;
   }
 };
-var workosBindings;
+
+// src/index.ts
+var WORKOS_RUNTIME_STATE_KEY = "__holoJsAuthWorkosRuntime";
 var WORKOS_API_BASE_URL = "https://api.workos.com";
+var WORKOS_AUTHORIZE_URL = `${WORKOS_API_BASE_URL}/user_management/authorize`;
+var WORKOS_AUTHENTICATE_URL = `${WORKOS_API_BASE_URL}/user_management/authenticate`;
+var WORKOS_LOGOUT_URL = `${WORKOS_API_BASE_URL}/user_management/sessions/logout`;
+var WORKOS_STATE_COOKIE_MAX_AGE_SECONDS = 300;
 var workosDefaultProviderRuntimeCache = /* @__PURE__ */ new Map();
 var workosJwksCache = /* @__PURE__ */ new Map();
 var AUTH_PROVIDER_MARKER = /* @__PURE__ */ Symbol.for("holo-js.auth.provider");
+function getRuntimeState() {
+  const runtimeGlobal = globalThis;
+  if (!runtimeGlobal[WORKOS_RUNTIME_STATE_KEY]) {
+    Object.defineProperty(runtimeGlobal, WORKOS_RUNTIME_STATE_KEY, {
+      value: {},
+      enumerable: false,
+      configurable: true,
+      writable: true
+    });
+  }
+  return runtimeGlobal[WORKOS_RUNTIME_STATE_KEY];
+}
 function throwUnconfigured() {
   throw new Error("[@holo-js/auth-workos] WorkOS auth runtime is not configured yet.");
 }
+function isPlainHeaderRecord(value) {
+  return Boolean(value) && typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype;
+}
+function appendKnownHeaders(headers, input) {
+  for (const name of ["authorization", "cookie", "host", "x-forwarded-host", "x-forwarded-proto"]) {
+    const value = input.get?.(name);
+    if (typeof value === "string" && value) {
+      headers.set(name, value);
+    }
+  }
+}
+function hasHeaderForEach(input) {
+  return !Array.isArray(input) && "forEach" in input && typeof input.forEach === "function";
+}
+function hasHeaderEntries(input) {
+  return !Array.isArray(input) && "entries" in input && typeof input.entries === "function";
+}
+function hasHeaderGet(input) {
+  return !Array.isArray(input) && "get" in input && typeof input.get === "function";
+}
+function normalizeRequestHeaders(input) {
+  const headers = new Headers();
+  if (!input) {
+    return headers;
+  }
+  if (input instanceof Headers || Array.isArray(input)) {
+    new Headers(input).forEach((value, name) => headers.append(name, value));
+    return headers;
+  }
+  if (hasHeaderForEach(input)) {
+    input.forEach((value, name) => headers.append(name, value));
+    return headers;
+  }
+  if (hasHeaderEntries(input)) {
+    for (const [name, value] of input.entries()) {
+      headers.append(name, value);
+    }
+    return headers;
+  }
+  if (hasHeaderGet(input)) {
+    appendKnownHeaders(headers, input);
+    return headers;
+  }
+  if (isPlainHeaderRecord(input)) {
+    for (const [name, value] of Object.entries(input)) {
+      if (typeof value === "string") {
+        headers.append(name, value);
+        continue;
+      }
+      if (Array.isArray(value)) {
+        const separator = name.toLowerCase() === "cookie" ? "; " : ",";
+        const joined = value.filter((entry) => typeof entry === "string").join(separator);
+        if (joined) {
+          headers.append(name, joined);
+        }
+      }
+    }
+  }
+  return headers;
+}
+function getRequestFromLikeInput(input) {
+  return input.request ?? input.web?.request ?? (input.req instanceof Request ? input.req : void 0);
+}
+function getRequestLikeHeaders(input) {
+  return input.headers ?? (typeof input.req === "object" && !(input.req instanceof Request) ? input.req.headers : void 0) ?? input.node?.req?.headers;
+}
+function getRequestLikeMethod(input) {
+  return input.method ?? (typeof input.req === "object" && !(input.req instanceof Request) ? input.req.method : void 0) ?? input.node?.req?.method ?? "GET";
+}
+function getRequestLikeUrl(input, headers) {
+  const url = (typeof input.url === "string" ? input.url : input.url?.toString()) ?? (typeof input.req === "object" && !(input.req instanceof Request) ? input.req.url : void 0) ?? input.node?.req?.url ?? input.path ?? "/";
+  try {
+    return new URL(url).toString();
+  } catch {
+    const protocol = headers.get("x-forwarded-proto") ?? "http";
+    const host = headers.get("x-forwarded-host") ?? headers.get("host") ?? "localhost";
+    return new URL(url, `${protocol}://${host}`).toString();
+  }
+}
+function normalizeWorkosRequest(input) {
+  if (input instanceof Request) {
+    return input;
+  }
+  const request = getRequestFromLikeInput(input);
+  if (request) {
+    return request;
+  }
+  const headers = normalizeRequestHeaders(getRequestLikeHeaders(input));
+  return new Request(getRequestLikeUrl(input, headers), {
+    method: getRequestLikeMethod(input),
+    headers
+  });
+}
 function getBindings() {
+  const workosBindings = getRuntimeState().bindings;
   if (!workosBindings?.identityStore) {
     throwUnconfigured();
   }
@@ -51,6 +165,14 @@ function parseJwt(token) {
     signingInput: Buffer.from(`${segments[0]}.${segments[1]}`, "utf8")
   };
 }
+function getJwtStringClaim(token, claim) {
+  try {
+    const value = parseJwt(token).payload[claim];
+    return typeof value === "string" && value.trim() ? value : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function verifyJwtSignatureWithJwk(token, jwk) {
   const algorithm = typeof token.header.alg === "string" ? token.header.alg : "";
   const key = createPublicKey({ key: jwk, format: "jwk" });
@@ -113,29 +235,66 @@ async function verifyWorkosSessionToken(token, config) {
     throw new Error("[@holo-js/auth-workos] WorkOS token signature verification failed.");
   }
   const exp = typeof parsed.payload.exp === "number" ? parsed.payload.exp : void 0;
-  if (typeof exp === "number" && exp * 1e3 <= Date.now()) {
+  if (typeof exp !== "number") {
+    throw new Error("[@holo-js/auth-workos] WorkOS token did not include an expiration.");
+  }
+  if (exp * 1e3 <= Date.now()) {
     throw new Error("[@holo-js/auth-workos] WorkOS token has expired.");
   }
+  if (typeof parsed.payload.sub !== "string" || !parsed.payload.sub.trim()) {
+    throw new Error("[@holo-js/auth-workos] WorkOS token did not include a subject.");
+  }
+  if ((typeof parsed.payload.sid !== "string" || !parsed.payload.sid.trim()) && (typeof parsed.payload.session_id !== "string" || !parsed.payload.session_id.trim())) {
+    throw new Error("[@holo-js/auth-workos] WorkOS token did not include a session id.");
+  }
+  const audience = parsed.payload.aud;
+  const audiences = Array.isArray(audience) ? audience.filter((value) => typeof value === "string") : typeof audience === "string" ? [audience] : [];
+  if (!audiences.includes(clientId)) {
+    throw new Error(`[@holo-js/auth-workos] WorkOS token audience is not valid for client "${clientId}".`);
+  }
   const nbf = typeof parsed.payload.nbf === "number" ? parsed.payload.nbf : void 0;
   if (typeof nbf === "number" && nbf * 1e3 > Date.now()) {
     throw new Error("[@holo-js/auth-workos] WorkOS token is not valid yet.");
   }
   return parsed.payload;
 }
+function toWorkosJsonValue(value) {
+  if (value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => toWorkosJsonValue(item)).filter((item) => typeof item !== "undefined");
+  }
+  if (value && typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype) {
+    return Object.freeze(Object.fromEntries(
+      Object.entries(value).map(([key, item]) => [key, toWorkosJsonValue(item)]).filter((entry) => typeof entry[1] !== "undefined")
+    ));
+  }
+  return void 0;
+}
+function toWorkosJsonObject(value) {
+  const normalized = toWorkosJsonValue(value);
+  return normalized && typeof normalized === "object" && !Array.isArray(normalized) ? normalized : Object.freeze({});
+}
 function normalizeWorkosUserProfile(user) {
   const firstName = typeof user.firstName === "string" ? user.firstName : typeof user.first_name === "string" ? user.first_name : void 0;
   const lastName = typeof user.lastName === "string" ? user.lastName : typeof user.last_name === "string" ? user.last_name : void 0;
-  const name = typeof user.name === "string" ? user.name : [firstName, lastName].filter(Boolean).join(" ").trim() || void 0;
+  const name = typeof user.name === "string" ? user.name : [firstName, lastName].filter(Boolean).join(" ").trim();
+  const email = typeof user.email === "string" ? user.email.trim() : "";
   return Object.freeze({
     id: String(user.id ?? ""),
-    email: typeof user.email === "string" ? user.email : void 0,
+    email,
     emailVerified: user.emailVerified === true || user.email_verified === true,
     firstName,
     lastName,
-    name,
-    avatar: typeof user.profilePictureUrl === "string" ? user.profilePictureUrl : typeof user.profile_picture_url === "string" ? user.profile_picture_url : void 0,
+    name: name || email || String(user.id ?? ""),
+    profilePictureUrl: typeof user.profilePictureUrl === "string" ? user.profilePictureUrl : typeof user.profile_picture_url === "string" ? user.profile_picture_url : void 0,
+    externalId: typeof user.externalId === "string" ? user.externalId : typeof user.external_id === "string" ? user.external_id : void 0,
     organizationId: typeof user.organizationId === "string" ? user.organizationId : typeof user.organization_id === "string" ? user.organization_id : void 0,
-    raw: user
+    metadata: toWorkosJsonObject(user.metadata),
+    createdAt: typeof user.createdAt === "string" ? user.createdAt : typeof user.created_at === "string" ? user.created_at : void 0,
+    updatedAt: typeof user.updatedAt === "string" ? user.updatedAt : typeof user.updated_at === "string" ? user.updated_at : void 0,
+    raw: toWorkosJsonObject(user)
   });
 }
 async function fetchWorkosUserProfile(userId, config) {
@@ -193,7 +352,11 @@ function resolveConfiguredProviderName(provider) {
   if (provider?.trim()) {
     return provider.trim();
   }
-  const configuredProviders = Object.keys(bindings.config.workos);
+  const configuredDefaultProvider = typeof bindings.config.workos.provider === "string" ? bindings.config.workos.provider.trim() : "";
+  if (configuredDefaultProvider) {
+    return configuredDefaultProvider;
+  }
+  const configuredProviders = Object.entries(bindings.config.workos).flatMap(([name, value]) => name !== "provider" && name !== "identityStore" && isNormalizedWorkosProviderConfig(value) ? [name] : []);
   if (configuredProviders.length === 0) {
     return "default";
   }
@@ -205,18 +368,20 @@ function resolveConfiguredProviderName(provider) {
   }
   throw new Error("[@holo-js/auth-workos] WorkOS provider name is required when multiple auth.workos entries exist.");
 }
+function isNormalizedWorkosProviderConfig(value) {
+  return value !== null && typeof value === "object" && "sessionCookie" in value && typeof value.sessionCookie === "string";
+}
 function getConfiguredProviderConfig(provider) {
   const providerName = resolveConfiguredProviderName(provider);
   const authBindings = authRuntimeInternals.getRuntimeBindings();
   const configured = authBindings.config.workos[providerName];
-  if (!configured) {
+  if (!isNormalizedWorkosProviderConfig(configured)) {
     throw new Error(`[@holo-js/auth-workos] WorkOS provider "${providerName}" is not configured in auth.workos.`);
   }
   return {
     name: providerName,
     clientId: configured.clientId,
     apiKey: configured.apiKey,
-    cookiePassword: configured.cookiePassword,
     redirectUri: configured.redirectUri,
     sessionCookie: configured.sessionCookie,
     guard: configured.guard,
@@ -227,6 +392,98 @@ function getProviderRuntime(provider) {
   const providerName = resolveConfiguredProviderName(provider);
   return getBindings().providers[providerName] ?? createDefaultProviderRuntime(providerName, getConfiguredProviderConfig(providerName));
 }
+function requireWorkosClientConfig(config) {
+  const clientId = config.clientId?.trim();
+  const apiKey = config.apiKey?.trim();
+  const redirectUri = config.redirectUri?.trim();
+  if (!clientId) {
+    throw new Error("[@holo-js/auth-workos] WorkOS AuthKit requires clientId to be configured.");
+  }
+  if (!apiKey) {
+    throw new Error("[@holo-js/auth-workos] WorkOS AuthKit requires apiKey to be configured.");
+  }
+  if (!redirectUri) {
+    throw new Error("[@holo-js/auth-workos] WorkOS AuthKit requires redirectUri to be configured.");
+  }
+  return { clientId, apiKey, redirectUri };
+}
+function getWorkosStateCookieName(providerName) {
+  return `holo_workos_${providerName}_state`;
+}
+function createWorkosState() {
+  return randomBytes(32).toString("base64url");
+}
+function createStateCookie(providerName, state, request) {
+  return cookie(getWorkosStateCookieName(providerName), state, {
+    httpOnly: true,
+    maxAge: WORKOS_STATE_COOKIE_MAX_AGE_SECONDS,
+    sameSite: "lax",
+    secure: new URL(request.url).protocol === "https:"
+  });
+}
+function clearStateCookie(providerName, request) {
+  return cookie(getWorkosStateCookieName(providerName), "", {
+    expires: /* @__PURE__ */ new Date(0),
+    httpOnly: true,
+    sameSite: "lax",
+    secure: new URL(request.url).protocol === "https:"
+  });
+}
+function getWorkosStateFromRequest(request, providerName) {
+  const cookies = parseCookieHeader(request.headers.get("cookie"));
+  return cookies[getWorkosStateCookieName(providerName)]?.trim() || void 0;
+}
+function createAuthorizationUrl(config, screenHint, state) {
+  const { clientId, redirectUri } = requireWorkosClientConfig(config);
+  const url = new URL(WORKOS_AUTHORIZE_URL);
+  url.searchParams.set("provider", "authkit");
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", clientId);
+  url.searchParams.set("redirect_uri", redirectUri);
+  url.searchParams.set("screen_hint", screenHint);
+  url.searchParams.set("state", state);
+  return url.toString();
+}
+function createWorkosRedirect(request, config, screenHint) {
+  const state = createWorkosState();
+  return new Response(null, {
+    status: 302,
+    headers: {
+      location: createAuthorizationUrl(config, screenHint, state),
+      "set-cookie": createStateCookie(config.name, state, request)
+    }
+  });
+}
+function createLogoutUrl(sessionId, request, returnTo) {
+  const url = new URL(WORKOS_LOGOUT_URL);
+  url.searchParams.set("session_id", sessionId);
+  if (returnTo?.trim()) {
+    url.searchParams.set("return_to", createWorkosReturnUrl(returnTo, request));
+  }
+  return url.toString();
+}
+function createWorkosReturnUrl(returnTo, request) {
+  const requestUrl = new URL(request.url);
+  let target;
+  try {
+    target = new URL(returnTo, requestUrl.origin);
+  } catch {
+    return requestUrl.origin;
+  }
+  if (target.origin !== requestUrl.origin) {
+    return requestUrl.origin;
+  }
+  return target.toString();
+}
+function createWorkosErrorResponse(error, code) {
+  return Response.json({
+    ok: false,
+    code,
+    message: getErrorMessage(error)
+  }, {
+    status: error instanceof WorkosAuthConflictError ? 409 : 422
+  });
+}
 function resolveGuardAndProvider(provider) {
   const authBindings = authRuntimeInternals.getRuntimeBindings();
   const providerConfig = getConfiguredProviderConfig(provider);
@@ -265,6 +522,46 @@ function requireUserRecord(user, message) {
   }
   return user;
 }
+function requireSerializedUser(user, message) {
+  if (typeof user.id === "string" || typeof user.id === "number") {
+    return user;
+  }
+  throw new Error(message);
+}
+function createWorkosSessionPayload(authenticated, session) {
+  const user = requireSerializedUser(
+    authenticated.user,
+    "[@holo-js/auth-workos] WorkOS-authenticated local users must expose a serializable id."
+  );
+  return Object.freeze({
+    guard: authenticated.guard,
+    provider: authenticated.authProvider,
+    userId: user.id,
+    user,
+    workos: Object.freeze({
+      provider: authenticated.provider,
+      sessionId: session.sessionId
+    })
+  });
+}
+function getWorkosLogoutSession(payload, providerName) {
+  if (!payload || typeof payload !== "object" || !("workos" in payload)) {
+    return null;
+  }
+  const workos = payload.workos;
+  if (!workos || typeof workos !== "object") {
+    return null;
+  }
+  const provider = workos.provider;
+  const sessionId = workos.sessionId;
+  if (provider !== providerName || typeof sessionId !== "string" || !sessionId.trim()) {
+    return null;
+  }
+  return Object.freeze({
+    provider,
+    sessionId
+  });
+}
 function serializeLocalUser(adapter, user, providerName) {
   const id = adapter.getId(user);
   const serialized = adapter.serialize ? adapter.serialize(user) : { ...user };
@@ -277,22 +574,63 @@ function serializeLocalUser(adapter, user, providerName) {
     enumerable: false,
     configurable: true
   });
+  Object.defineProperty(result, "can", {
+    value: () => false,
+    enumerable: false,
+    configurable: true
+  });
   return Object.freeze(result);
 }
 function resolveDisplayName(profile) {
-  if (profile.name?.trim()) {
+  if (typeof profile.name === "string" && profile.name.trim()) {
+    return profile.name.trim();
+  }
+  const fullName = [profile.firstName?.trim(), profile.lastName?.trim()].filter(Boolean).join(" ").trim();
+  return fullName || profile.email || profile.id;
+}
+function resolveDisplayNameForUpdate(profile) {
+  if (typeof profile.name === "string" && profile.name.trim()) {
     return profile.name.trim();
   }
   const fullName = [profile.firstName?.trim(), profile.lastName?.trim()].filter(Boolean).join(" ").trim();
   return fullName || void 0;
 }
 function resolveEmailForCreation(profile) {
-  const normalized = profile.email?.trim();
+  const normalized = typeof profile.email === "string" ? profile.email.trim() : "";
   if (normalized) {
     return normalized;
   }
   return `${profile.id}@workos.hosted.local`;
 }
+function toAdapterInput(input) {
+  return Object.freeze(Object.fromEntries(
+    Object.entries(input).filter((entry) => typeof entry[1] !== "undefined")
+  ));
+}
+function withRequiredUserFields(input, profile) {
+  return Object.freeze({
+    ...input,
+    email: typeof input.email === "undefined" ? resolveEmailForCreation(profile) : input.email,
+    name: typeof input.name === "undefined" ? resolveDisplayName(profile) : input.name
+  });
+}
+function resolveCreateUserInput(profile, mapper) {
+  return toAdapterInput(withRequiredUserFields({
+    password: null,
+    avatar: profile.profilePictureUrl ?? null,
+    email_verified_at: profile.emailVerified ? /* @__PURE__ */ new Date() : null,
+    ...mapper?.(profile) ?? {}
+  }, profile));
+}
+function resolveUpdateUserInput(profile, mapper) {
+  return toAdapterInput({
+    email: typeof profile.email === "string" ? profile.email.trim() || void 0 : void 0,
+    name: resolveDisplayNameForUpdate(profile),
+    avatar: profile.profilePictureUrl,
+    email_verified_at: profile.emailVerified ? /* @__PURE__ */ new Date() : void 0,
+    ...mapper?.(profile) ?? {}
+  });
+}
 function normalizeHostedProfile(profile) {
   return Object.freeze({
     id: profile.id,
@@ -301,7 +639,7 @@ function normalizeHostedProfile(profile) {
     firstName: profile.firstName,
     lastName: profile.lastName,
     name: resolveDisplayName(profile),
-    avatar: profile.avatar,
+    profilePictureUrl: profile.profilePictureUrl,
     organizationId: profile.organizationId,
     raw: profile.raw
   });
@@ -314,21 +652,20 @@ async function findUserByEmail(adapter, email) {
   return user ? requireUserRecord(user, "[@holo-js/auth-workos] Auth provider lookups must return object users.") : null;
 }
 async function updateLocalUser(adapter, user, input) {
-  const nextInput = {
-    name: input.name,
-    email: input.email,
-    avatar: typeof input.avatar === "undefined" ? void 0 : input.avatar,
-    email_verified_at: input.emailVerified === true ? /* @__PURE__ */ new Date() : void 0
-  };
   const current = user;
-  const changed = typeof nextInput.name !== "undefined" && nextInput.name !== current.name || typeof nextInput.email !== "undefined" && nextInput.email !== current.email || typeof nextInput.avatar !== "undefined" && nextInput.avatar !== (current.avatar ?? void 0) || input.emailVerified === true && !current.email_verified_at;
+  const changed = Object.entries(input).some(([key, value]) => {
+    if (key === "email_verified_at") {
+      return value instanceof Date && !current.email_verified_at;
+    }
+    return !Object.is(value, user[key]);
+  });
   if (!changed) {
     return { user, changed: false };
   }
   if (adapter.update) {
     return {
       user: requireUserRecord(
-        await adapter.update(user, nextInput),
+        await adapter.update(user, input),
         "[@holo-js/auth-workos] Auth provider updates must return object users."
       ),
       changed: true
@@ -338,8 +675,8 @@ async function updateLocalUser(adapter, user, input) {
     "[@holo-js/auth-workos] Auth provider adapters must implement update() to persist profile changes."
   );
 }
-async function ensureNoUnexpectedEmailCollision(adapter, authProvider, profile, currentUserId) {
-  const email = profile.email?.trim();
+async function ensureNoUnexpectedEmailCollision(adapter, providerName, profile, currentUserId) {
+  const email = typeof profile.email === "string" ? profile.email.trim() : "";
   if (!email) {
     return;
   }
@@ -353,28 +690,13 @@ async function ensureNoUnexpectedEmailCollision(adapter, authProvider, profile,
     "[@holo-js/auth-workos] Matched local users must expose a serializable id."
   ) !== currentUserId) {
     throw new WorkosAuthConflictError({
-      provider: "workos",
+      provider: providerName,
       workosUserId: profile.id,
       email,
       message: `[@holo-js/auth-workos] WorkOS email "${email}" collides with a different local user.`
     });
   }
 }
-async function assertUserLinkAvailable(providerName, authProvider, adapter, user, workosUserId) {
-  const existing = await getBindings().identityStore.findByUserId(
-    providerName,
-    authProvider,
-    requireUserId(adapter, user, "[@holo-js/auth-workos] Linked users must expose a serializable id.")
-  );
-  if (existing && existing.providerUserId !== workosUserId) {
-    throw new WorkosAuthConflictError({
-      provider: providerName,
-      workosUserId,
-      email: existing.email,
-      message: `[@holo-js/auth-workos] Local user is already linked to WorkOS identity "${existing.providerUserId}".`
-    });
-  }
-}
 function isEmailVerificationRequired() {
   return authRuntimeInternals.getRuntimeBindings().config.emailVerification.required === true;
 }
@@ -426,9 +748,16 @@ async function reuseExistingHoloSession(request, authenticated) {
   if (!payload || payload.guard !== authenticated.guard || payload.provider !== authenticated.authProvider || String(payload.userId) !== String(authenticated.user.id)) {
     return null;
   }
+  const source = payload;
+  if (source.workos && typeof source.workos === "object") {
+    if (typeof source.workos.provider !== "string" || source.workos.provider !== authenticated.provider) {
+      return null;
+    }
+  }
   bindings.context.setCachedUser(authenticated.guard, authenticated.user);
   return Object.freeze({
     guard: authenticated.guard,
+    provider: source.workos && typeof source.workos === "object" ? "workos" : payload.provider,
     user: authenticated.user,
     sessionId,
     cookies: Object.freeze([])
@@ -446,7 +775,8 @@ async function verifySession(token, provider) {
     config: providerConfig
   });
 }
-async function verifyRequest(request, provider) {
+async function verifyRequest(input, provider) {
+  const request = normalizeWorkosRequest(input);
   const providerConfig = getConfiguredProviderConfig(provider);
   const runtime = getProviderRuntime(providerConfig.name);
   if (runtime.verifyRequest) {
@@ -462,13 +792,72 @@ async function verifyRequest(request, provider) {
   }
   return verifySession(token, providerConfig.name);
 }
-async function syncIdentity(session, provider) {
+function getStringField(input, ...names) {
+  for (const name of names) {
+    const value = input[name];
+    const normalized = typeof value === "string" ? value.trim() : "";
+    if (normalized) {
+      return normalized;
+    }
+  }
+  return void 0;
+}
+function getRecordField(input, name) {
+  const value = input[name];
+  return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function getRequestIpAddress(request) {
+  return request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || request.headers.get("x-real-ip")?.trim() || void 0;
+}
+async function authenticateWorkosCode(request, code, config) {
+  const { clientId, apiKey } = requireWorkosClientConfig(config);
+  const body = {
+    grant_type: "authorization_code",
+    client_id: clientId,
+    client_secret: apiKey,
+    code,
+    ip_address: getRequestIpAddress(request),
+    user_agent: request.headers.get("user-agent")?.trim() || void 0
+  };
+  const response = await fetch(WORKOS_AUTHENTICATE_URL, {
+    method: "POST",
+    headers: {
+      accept: "application/json",
+      authorization: `Bearer ${apiKey}`,
+      "content-type": "application/json"
+    },
+    body: JSON.stringify(body)
+  });
+  const payload = await response.json();
+  if (!response.ok) {
+    const message = getStringField(payload, "message", "error_description", "error") ?? `WorkOS callback authentication failed with status ${response.status}.`;
+    throw new Error(message);
+  }
+  const user = getRecordField(payload, "user");
+  if (!user) {
+    throw new Error("[@holo-js/auth-workos] WorkOS callback did not return a user.");
+  }
+  const accessToken = getStringField(payload, "accessToken", "access_token");
+  const session = getRecordField(payload, "session");
+  const sessionId = getStringField(session ?? {}, "id") ?? getStringField(payload, "sessionId", "session_id") ?? (accessToken ? getJwtStringClaim(accessToken, "sid") : void 0) ?? accessToken ?? code;
+  return Object.freeze({
+    sessionId,
+    identity: normalizeWorkosUserProfile({
+      ...user,
+      organizationId: getStringField(payload, "organizationId", "organization_id") ?? user.organizationId ?? user.organization_id
+    }),
+    accessToken,
+    raw: toWorkosJsonObject(payload)
+  });
+}
+async function syncIdentity(session, provider, options = {}) {
   const providerConfig = getConfiguredProviderConfig(provider);
   const providerName = providerConfig.name;
   const profile = session.identity;
   const { guard, authProvider, adapter } = resolveGuardAndProvider(providerName);
   const verificationRequired = isEmailVerificationRequired();
-  const verifiedEmail = profile.emailVerified === true && profile.email?.trim() ? profile.email.trim() : void 0;
+  const profileEmail = typeof profile.email === "string" ? profile.email.trim() : "";
+  const verifiedEmail = profile.emailVerified === true && profileEmail ? profileEmail : void 0;
   if (verificationRequired && !verifiedEmail) {
     throw new Error(`[@holo-js/auth-workos] WorkOS identity "${profile.id}" must provide a verified email address.`);
   }
@@ -478,25 +867,20 @@ async function syncIdentity(session, provider) {
     const existingLinkedUser = await adapter.findById(existingIdentity.userId);
     let linkedUser = existingLinkedUser ? requireUserRecord(existingLinkedUser, "[@holo-js/auth-workos] Auth provider lookups must return object users.") : null;
     if (!linkedUser) {
-      linkedUser = verifiedEmail ? await findUserByEmail(adapter, verifiedEmail) : null;
-      if (linkedUser) {
-        await assertUserLinkAvailable(providerName, authProvider, adapter, linkedUser, profile.id);
+      const emailMatchedUser = verifiedEmail ? await findUserByEmail(adapter, verifiedEmail) : null;
+      if (emailMatchedUser) {
+        throw new WorkosAuthConflictError({
+          provider: providerName,
+          workosUserId: profile.id,
+          email: verifiedEmail,
+          message: `[@holo-js/auth-workos] WorkOS email "${verifiedEmail}" matches an existing local user and must be linked explicitly.`
+        });
       }
-      if (!linkedUser) {
-        linkedUser = requireUserRecord(await adapter.create({
-          name: resolveDisplayName(profile),
-          email: resolveEmailForCreation(profile),
-          password: null,
-          avatar: profile.avatar ?? null,
-          email_verified_at: profile.emailVerified === true ? /* @__PURE__ */ new Date() : null
-        }), "[@holo-js/auth-workos] Auth provider create() must return an object user.");
-      }
-      const relinked = await updateLocalUser(adapter, linkedUser, {
-        name: resolveDisplayName(profile),
-        email: profile.email?.trim(),
-        avatar: profile.avatar,
-        emailVerified: profile.emailVerified === true
-      });
+      linkedUser = requireUserRecord(
+        await adapter.create(resolveCreateUserInput(profile, options.user)),
+        "[@holo-js/auth-workos] Auth provider create() must return an object user."
+      );
+      const relinked = await updateLocalUser(adapter, linkedUser, resolveUpdateUserInput(profile, options.user));
       const relinkedUser = relinked.user;
       const identity3 = createIdentityRecord({
         provider: providerName,
@@ -523,7 +907,7 @@ async function syncIdentity(session, provider) {
     }
     await ensureNoUnexpectedEmailCollision(
       adapter,
-      authProvider,
+      providerName,
       profile,
       requireUserId(
         adapter,
@@ -531,12 +915,7 @@ async function syncIdentity(session, provider) {
         "[@holo-js/auth-workos] Linked local users must expose a serializable id."
       )
     );
-    const updated = await updateLocalUser(adapter, linkedUser, {
-      name: resolveDisplayName(profile),
-      email: profile.email?.trim(),
-      avatar: profile.avatar,
-      emailVerified: profile.emailVerified === true
-    });
+    const updated = await updateLocalUser(adapter, linkedUser, resolveUpdateUserInput(profile, options.user));
     const identity2 = createIdentityRecord({
       provider: providerName,
       guard,
@@ -562,42 +941,17 @@ async function syncIdentity(session, provider) {
   }
   let localUser = verifiedEmail ? await findUserByEmail(adapter, verifiedEmail) : null;
   if (localUser) {
-    await assertUserLinkAvailable(providerName, authProvider, adapter, localUser, profile.id);
-    const linked = await updateLocalUser(adapter, localUser, {
-      name: resolveDisplayName(profile),
-      email: profile.email?.trim(),
-      avatar: profile.avatar,
-      emailVerified: profile.emailVerified === true
-    });
-    const identity2 = createIdentityRecord({
-      provider: providerName,
-      guard,
-      authProvider,
-      userId: requireUserId(
-        adapter,
-        linked.user,
-        "[@holo-js/auth-workos] Linked local users must expose a serializable id."
-      ),
-      profile
-    });
-    await identityStore.save(identity2);
-    return Object.freeze({
+    throw new WorkosAuthConflictError({
       provider: providerName,
-      guard,
-      authProvider,
-      status: "linked",
-      user: serializeLocalUser(adapter, linked.user, authProvider),
-      identity: identity2,
-      session
+      workosUserId: profile.id,
+      email: verifiedEmail,
+      message: `[@holo-js/auth-workos] WorkOS email "${verifiedEmail}" matches an existing local user and must be linked explicitly.`
     });
   }
-  localUser = requireUserRecord(await adapter.create({
-    name: resolveDisplayName(profile),
-    email: resolveEmailForCreation(profile),
-    password: null,
-    avatar: profile.avatar ?? null,
-    email_verified_at: profile.emailVerified === true ? /* @__PURE__ */ new Date() : null
-  }), "[@holo-js/auth-workos] Auth provider create() must return an object user.");
+  localUser = requireUserRecord(
+    await adapter.create(resolveCreateUserInput(profile, options.user)),
+    "[@holo-js/auth-workos] Auth provider create() must return an object user."
+  );
   const identity = createIdentityRecord({
     provider: providerName,
     guard,
@@ -620,7 +974,8 @@ async function syncIdentity(session, provider) {
     session
   });
 }
-async function authenticate(request, provider) {
+async function authenticate(input, provider) {
+  const request = normalizeWorkosRequest(input);
   const session = await verifyRequest(request, provider);
   if (!session) {
     return null;
@@ -628,28 +983,175 @@ async function authenticate(request, provider) {
   const authenticated = await syncIdentity(session, provider);
   const authSession = await reuseExistingHoloSession(request, authenticated) ?? await authRuntimeInternals.establishSessionForUser(authenticated.user, {
     guard: authenticated.guard,
-    provider: authenticated.authProvider
+    provider: authenticated.authProvider,
+    payload: createWorkosSessionPayload(authenticated, session)
   });
   return Object.freeze({
     ...authenticated,
     authSession
   });
 }
+function getErrorMessage(error) {
+  return error instanceof Error ? error.message : "WorkOS authentication failed.";
+}
+function createHostedAuthSuccess(data) {
+  return Object.freeze({
+    data,
+    error: null
+  });
+}
+function createHostedAuthFailure(code, message, status) {
+  return Object.freeze({
+    data: null,
+    error: Object.freeze({
+      code,
+      message,
+      status,
+      fields: Object.freeze({
+        _root: Object.freeze([message])
+      })
+    })
+  });
+}
+async function loginWithWorkos(input, options = {}) {
+  try {
+    const request = normalizeWorkosRequest(input);
+    const providerConfig = getConfiguredProviderConfig(options.provider);
+    return createWorkosRedirect(request, providerConfig, "sign-in");
+  } catch (error) {
+    return createWorkosErrorResponse(error, "workos_login_failed");
+  }
+}
+async function registerWithWorkos(input, options = {}) {
+  try {
+    const request = normalizeWorkosRequest(input);
+    const providerConfig = getConfiguredProviderConfig(options.provider);
+    return createWorkosRedirect(request, providerConfig, "sign-up");
+  } catch (error) {
+    return createWorkosErrorResponse(error, "workos_register_failed");
+  }
+}
+async function readCurrentWorkosLogoutSession(guard, providerName) {
+  const bindings = authRuntimeInternals.getRuntimeBindings();
+  const sessionId = bindings.context.getSessionId(guard);
+  if (!sessionId) {
+    return null;
+  }
+  const record = await bindings.session.read(sessionId);
+  return getWorkosLogoutSession(authRuntimeInternals.readSessionPayload(record, guard), providerName);
+}
+async function logoutWithWorkos(input, options = {}) {
+  const request = normalizeWorkosRequest(input);
+  try {
+    const providerConfig = getConfiguredProviderConfig(options.provider);
+    const providerName = providerConfig.name;
+    const { guard } = resolveGuardAndProvider(providerName);
+    const requestSessionId = getHoloSessionIdFromRequest(request);
+    if (requestSessionId) {
+      authRuntimeInternals.getRuntimeBindings().context.setSessionId(guard, requestSessionId);
+    }
+    const workosSession = await readCurrentWorkosLogoutSession(guard, providerName);
+    if (!workosSession) {
+      return createHostedAuthFailure(
+        "workos_session_missing",
+        "The current Holo session was not created by WorkOS.",
+        422
+      );
+    }
+    const local = await getAuthRuntime().guard(guard).logout();
+    return createHostedAuthSuccess(Object.freeze({
+      url: createLogoutUrl(workosSession.sessionId, request, options.returnTo),
+      local
+    }));
+  } catch {
+    return createHostedAuthFailure("workos_logout_failed", "Unable to complete WorkOS logout.", 500);
+  }
+}
+async function completeWorkosAuth(input, options = {}) {
+  try {
+    const request = normalizeWorkosRequest(input);
+    const url = new URL(request.url);
+    const callbackError = url.searchParams.get("error")?.trim();
+    if (callbackError) {
+      return createHostedAuthFailure(
+        callbackError,
+        url.searchParams.get("error_description")?.trim() || "WorkOS authentication failed.",
+        422
+      );
+    }
+    const code = url.searchParams.get("code")?.trim();
+    if (!code) {
+      return createHostedAuthFailure(
+        "workos_code_required",
+        "WorkOS callback did not include an authorization code.",
+        422
+      );
+    }
+    const providerConfig = getConfiguredProviderConfig(options.provider);
+    const callbackState = url.searchParams.get("state")?.trim();
+    const expectedState = getWorkosStateFromRequest(request, providerConfig.name);
+    if (!callbackState || !expectedState || !Object.is(callbackState, expectedState)) {
+      return createHostedAuthFailure(
+        "workos_state_mismatch",
+        "WorkOS callback state did not match the login request.",
+        422
+      );
+    }
+    const session = await authenticateWorkosCode(request, code, providerConfig);
+    const authenticated = await syncIdentity(session, providerConfig.name, {
+      user: options.user
+    });
+    const authSession = await authRuntimeInternals.establishSessionForUser(authenticated.user, {
+      guard: authenticated.guard,
+      provider: authenticated.authProvider,
+      payload: createWorkosSessionPayload(authenticated, session)
+    });
+    return createHostedAuthSuccess(Object.freeze({
+      provider: authenticated.provider,
+      guard: authenticated.guard,
+      authProvider: authenticated.authProvider,
+      status: authenticated.status,
+      user: authenticated.user,
+      identity: authenticated.identity,
+      session,
+      authSession: Object.freeze({
+        ...authSession,
+        cookies: Object.freeze([
+          ...authSession.cookies,
+          clearStateCookie(providerConfig.name, request)
+        ])
+      })
+    }));
+  } catch (error) {
+    return createHostedAuthFailure(
+      error instanceof WorkosAuthConflictError ? error.code : "workos_auth_failed",
+      getErrorMessage(error),
+      error instanceof WorkosAuthConflictError ? 409 : 422
+    );
+  }
+}
 function configureWorkosAuthRuntime(bindings) {
+  const runtimeState = getRuntimeState();
   if (!bindings) {
-    workosBindings = void 0;
+    runtimeState.bindings = void 0;
     return;
   }
-  workosBindings = Object.freeze({
-    providers: bindings.providers ?? workosBindings?.providers,
-    identityStore: bindings.identityStore ?? workosBindings?.identityStore
+  runtimeState.bindings = Object.freeze({
+    providers: bindings.providers ?? runtimeState.bindings?.providers,
+    identityStore: bindings.identityStore ?? runtimeState.bindings?.identityStore
   });
 }
 function resetWorkosAuthRuntime() {
-  workosBindings = void 0;
+  getRuntimeState().bindings = void 0;
+  workosDefaultProviderRuntimeCache.clear();
+  workosJwksCache.clear();
 }
 var workosAuth = Object.freeze({
   authenticate,
+  completeWorkosAuth,
+  loginWithWorkos,
+  logoutWithWorkos,
+  registerWithWorkos,
   syncIdentity,
   verifyRequest,
   verifySession
@@ -667,7 +1169,11 @@ var workosAuthInternals = {
 export {
   WorkosAuthConflictError,
   authenticate,
+  completeWorkosAuth,
   configureWorkosAuthRuntime,
+  loginWithWorkos,
+  logoutWithWorkos,
+  registerWithWorkos,
   resetWorkosAuthRuntime,
   syncIdentity,
   verifyRequest,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holo-js/auth-workos",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Holo-JS Framework - WorkOS auth integration contracts",
   "type": "module",
   "license": "MIT",
@@ -23,14 +23,14 @@
     "test": "vitest --run"
   },
   "dependencies": {
-    "@holo-js/auth": "workspace:*",
-    "@holo-js/config": "workspace:*",
-    "@holo-js/session": "workspace:*"
+    "@holo-js/auth": "^0.1.6",
+    "@holo-js/config": "^0.1.6",
+    "@holo-js/session": "^0.1.6"
   },
   "devDependencies": {
     "@types/node": "^22.10.2",
     "tsup": "^8.3.5",
     "typescript": "^5.7.2",
-    "vitest": "^2.1.8"
+    "vitest": "^4.1.5"
   }
 }