covara 0.10.5 → 0.11.1

package/README.md

@@ -76,7 +76,8 @@ function TodoList() {
 - **OIDC Provider** - Built-in OpenID Connect server with PKCE, token revocation (RFC 7009) and introspection (RFC 7662)
 - **OIDC Hardening** - Component-wise redirect-URI validation, PKCE-required public clients (plain rejected), federated id_token verification, endpoint rate limiting, KV-backed stores by default
 - **Dynamic Client Registration & Consent Revocation** - Opt-in `POST /register`, plus `POST /consent/revoke` and consent TTL
-- **Federated Login** - Google, Microsoft, Okta, Auth0, Keycloak, custom
+- **Federated Login** - Google, Microsoft, Okta, Auth0, Keycloak, custom (OIDC); plus `backends.passport` to use any Passport.js OAuth2 strategy (GitHub, Discord, …) as an upstream under your own OIDC provider
+- **Social Login** - Drop in any Passport.js OAuth2 strategy (GitHub, Discord, Google, …) via `fromPassport`; runs on Node *and* Workers, with one-call `loginWithSocial` / `signInWith` on the client
 - **JWT Auth** - JWT bearer adapter on the server, `JWTClient` + `useJWTAuth` hook on the client with pluggable token storage (localStorage, memory, AsyncStorage)
 - **Session Auth** - Auth.js, Passport.js, and session adapters with session rotation on login
 - **Multi-Factor Auth** - Opt-in TOTP MFA with backup codes

package/dist/auth/index.d.ts

@@ -16,6 +16,12 @@ export { validatePasswordStrength, enforcePasswordStrength, builtInPasswordDenyl
 export { createAuthAdapter, createSessionStore, type AuthMode, type AuthConfig, type AuthConfigUser, type SessionStoreConfig, } from "./config.js";
 export { AuthJsAdapter, createAuthJsAdapter } from "./adapters/authjs.js";
 export { PassportAdapter, createPassportAdapter, fromPassportUser } from "./adapters/passport.js";
+export { fromPassport, installFetchTransport, runStrategy, normalizePassportProfile, } from "./passport-bridge.js";
+export type { SocialProvider, SocialAccount, NormalizedProfile, FromPassportOptions, PassportStrategyLike, PassportRequest, PassportOutcome, } from "./passport-bridge.js";
+export { createSocialRouter, createKvSocialStateStore, } from "./social.js";
+export type { SocialAuthOptions, SocialStateStore } from "./social.js";
+export { cookieSession, jwtSession, fromAuthAdapter } from "./session.js";
+export type { SessionStrategy, SessionUser, IssuedSession, CookieSessionOptions, JwtSessionOptions, } from "./session.js";
 export { JWTAdapter, createJWTAdapter } from "./adapters/jwt.js";
 export type { JWTConfig, JWTAdapterOptions, JWTPayload, JWTUser } from "./adapters/jwt.js";
 export { OIDCAdapter, createOIDCAdapter, oidcProviders } from "./adapters/oidc.js";

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,QAAQ,CAAC;AACvB,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,KAAK,WAAW,GACjB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,aAAa,EACb,KAAK,oBAAoB,EACzB,KAAK,aAAa,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,EACxB,8BAA8B,EAC9B,UAAU,EACV,WAAW,EACX,SAAS,EACT,aAAa,EACb,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,iBAAiB,GACvB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,mBAAmB,EACnB,aAAa,EACb,mBAAmB,EACnB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,QAAQ,EACb,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,kBAAkB,GACxB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC9D,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACxF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChF,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,WAAW,EACX,QAAQ,GACT,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,QAAQ,CAAC;AACvB,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,KAAK,WAAW,GACjB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,aAAa,EACb,KAAK,oBAAoB,EACzB,KAAK,aAAa,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,EACxB,8BAA8B,EAC9B,UAAU,EACV,WAAW,EACX,SAAS,EACT,aAAa,EACb,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,iBAAiB,GACvB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,mBAAmB,EACnB,aAAa,EACb,mBAAmB,EACnB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,QAAQ,EACb,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,kBAAkB,GACxB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,WAAW,EACX,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACvE,YAAY,EACV,eAAe,EACf,WAAW,EACX,aAAa,EACb,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC9D,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACxF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChF,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,WAAW,EACX,QAAQ,GACT,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,UAAU,CAAC"}

package/dist/auth/index.js

@@ -16,6 +16,9 @@ export { validatePasswordStrength, enforcePasswordStrength, builtInPasswordDenyl
 export { createAuthAdapter, createSessionStore, } from "./config.js";
 export { AuthJsAdapter, createAuthJsAdapter } from "./adapters/authjs.js";
 export { PassportAdapter, createPassportAdapter, fromPassportUser } from "./adapters/passport.js";
+export { fromPassport, installFetchTransport, runStrategy, normalizePassportProfile, } from "./passport-bridge.js";
+export { createSocialRouter, createKvSocialStateStore, } from "./social.js";
+export { cookieSession, jwtSession, fromAuthAdapter } from "./session.js";
 export { JWTAdapter, createJWTAdapter } from "./adapters/jwt.js";
 export { OIDCAdapter, createOIDCAdapter, oidcProviders } from "./adapters/oidc.js";
 export { KVSessionStore, createKVSessionStore, RedisSessionStore, createRedisSessionStore, DrizzleSessionStore, createDrizzleSessionStore, } from "./stores/index.js";

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,QAAQ,CAAC;AACvB,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,iBAAiB,GAElB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,aAAa,GAGd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,EACxB,8BAA8B,EAC9B,UAAU,EACV,WAAW,EACX,SAAS,EACT,aAAa,GAGd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,GAEhB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,mBAAmB,EACnB,gBAAgB,GAIjB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,mBAAmB,EACnB,qBAAqB,GAEtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,mBAAmB,EACnB,aAAa,EACb,mBAAmB,GAQpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,kBAAkB,GAKnB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAE9D,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAShF,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,QAAQ,CAAC;AACvB,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,iBAAiB,GAElB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,aAAa,GAGd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,EACxB,8BAA8B,EAC9B,UAAU,EACV,WAAW,EACX,SAAS,EACT,aAAa,GAGd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,GAEhB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,mBAAmB,EACnB,gBAAgB,GAIjB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,mBAAmB,EACnB,qBAAqB,GAEtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,mBAAmB,EACnB,aAAa,EACb,mBAAmB,GAQpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GAGxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,kBAAkB,GAKnB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,WAAW,EACX,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAU3B,OAAO,EACL,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAQvE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAE9D,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAShF,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,UAAU,CAAC"}

package/dist/auth/passport-bridge.d.ts

@@ -0,0 +1,74 @@
+export interface PassportStrategyLike {
+    name?: string;
+    authenticate(req: PassportRequest, options?: Record<string, unknown>): void;
+    _oauth2?: OAuthLikeClient;
+}
+interface OAuthLikeClient {
+    _request?: OAuthRequestFn;
+    _customHeaders?: Record<string, string>;
+    _accessTokenName?: string;
+    __covaraFetchTransport?: boolean;
+}
+type OAuthRequestFn = (method: string, url: string, headers: Record<string, string> | null, postBody: string | Buffer | null, accessToken: string | null, callback: (error: unknown, result?: string, response?: {
+    statusCode: number;
+    headers?: Record<string, string>;
+}) => void) => void;
+export interface PassportRequest {
+    query: Record<string, unknown>;
+    body?: Record<string, unknown>;
+    headers: Record<string, string>;
+    session: Record<string, unknown>;
+    url: string;
+    method: string;
+    connection: Record<string, unknown>;
+}
+export type PassportOutcome = {
+    kind: "redirect";
+    url: string;
+    status?: number;
+} | {
+    kind: "success";
+    user: unknown;
+    info?: unknown;
+} | {
+    kind: "fail";
+    challenge?: unknown;
+    status?: number;
+} | {
+    kind: "error";
+    error: Error;
+} | {
+    kind: "pass";
+};
+export interface NormalizedProfile {
+    id?: string;
+    email?: string | null;
+    name?: string | null;
+    image?: string | null;
+    username?: string | null;
+    raw: unknown;
+}
+export interface SocialAccount {
+    provider: string;
+    providerAccountId: string;
+    raw: unknown;
+    profile: NormalizedProfile;
+    info?: unknown;
+}
+export interface SocialProvider {
+    name: string;
+    scope?: string | string[];
+    authenticate(req: PassportRequest): Promise<PassportOutcome>;
+    toAccount(user: unknown, info?: unknown): SocialAccount;
+}
+export interface FromPassportOptions {
+    name?: string;
+    scope?: string | string[];
+    mapProfile?: (raw: unknown) => NormalizedProfile;
+}
+export declare const installFetchTransport: (strategy: PassportStrategyLike) => void;
+export declare const runStrategy: (strategy: PassportStrategyLike, req: PassportRequest, options?: Record<string, unknown>) => Promise<PassportOutcome>;
+export declare const normalizePassportProfile: (raw: unknown) => NormalizedProfile;
+export declare const fromPassport: (strategy: PassportStrategyLike, options?: FromPassportOptions) => SocialProvider;
+export {};
+//# sourceMappingURL=passport-bridge.d.ts.map

package/dist/auth/passport-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passport-bridge.d.ts","sourceRoot":"","sources":["../../src/auth/passport-bridge.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAE5E,OAAO,CAAC,EAAE,eAAe,CAAC;CAC3B;AAED,UAAU,eAAe;IACvB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,KAAK,cAAc,GAAG,CACpB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,EACtC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAChC,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,QAAQ,EAAE,CACR,KAAK,EAAE,OAAO,EACd,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,KAChE,IAAI,KACN,IAAI,CAAC;AAEV,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAErB,MAAM,WAAW,iBAAiB;IAChC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,GAAG,EAAE,OAAO,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IAGjB,iBAAiB,EAAE,MAAM,CAAC;IAK1B,GAAG,EAAE,OAAO,CAAC;IACb,OAAO,EAAE,iBAAiB,CAAC;IAC3B,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7D,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,aAAa,CAAC;CACzD;AAED,MAAM,WAAW,mBAAmB;IAGlC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE1B,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,iBAAiB,CAAC;CAClD;AAGD,eAAO,MAAM,qBAAqB,GAAI,UAAU,oBAAoB,KAAG,IAwDtE,CAAC;AAGF,eAAO,MAAM,WAAW,GACtB,UAAU,oBAAoB,EAC9B,KAAK,eAAe,EACpB,UAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,KACpC,OAAO,CAAC,eAAe,CAyBtB,CAAC;AAOL,eAAO,MAAM,wBAAwB,GAAI,KAAK,OAAO,KAAG,iBAoCvD,CAAC;AAGF,eAAO,MAAM,YAAY,GACvB,UAAU,oBAAoB,EAC9B,UAAS,mBAAwB,KAChC,cA6BF,CAAC"}

package/dist/auth/passport-bridge.js

@@ -0,0 +1,147 @@
+// Run arbitrary Passport.js strategies inside Covara — on Node *and* Workers.
+//
+// Passport strategies do not actually need Express: `Strategy.authenticate(req)`
+// only reads `req.query` / `req.headers` / `req.session` / `req.body` and signals
+// its result through `this.success / fail / redirect / error / pass` — methods that
+// Passport core injects, not Express. We inject them ourselves and synthesize a
+// minimal `req` from a Web request.
+//
+// The only Workers blocker is that OAuth2 strategies do their HTTP through the old
+// `node-oauth` package (`node:https`). All of node-oauth's requests funnel through
+// one method, `oauth2._request(...)`, so we swap that for `fetch` — after which the
+// entire `passport-oauth2` family does token exchange + profile fetch over `fetch`,
+// i.e. runtime-agnostic. No dependency on `passport` is added; users bring their own
+// strategy packages (`passport-github2`, `passport-discord`, ...).
+// Swap node-oauth's single HTTP seam for `fetch`. Idempotent per client.
+export const installFetchTransport = (strategy) => {
+    const oauth2 = strategy._oauth2;
+    if (!oauth2 || oauth2.__covaraFetchTransport)
+        return;
+    oauth2.__covaraFetchTransport = true;
+    const request = function (method, url, headers, postBody, accessToken, callback) {
+        const realHeaders = {
+            ...(this._customHeaders ?? {}),
+            ...(headers ?? {}),
+        };
+        // fetch manages these; node-oauth would set them on the raw request.
+        delete realHeaders.Host;
+        delete realHeaders.host;
+        delete realHeaders["Content-Length"];
+        delete realHeaders["Content-length"];
+        if (!realHeaders["User-Agent"])
+            realHeaders["User-Agent"] = "covara";
+        let finalUrl = url;
+        if (accessToken && !("Authorization" in realHeaders)) {
+            const u = new URL(url);
+            u.searchParams.set(this._accessTokenName ?? "access_token", accessToken);
+            finalUrl = u.toString();
+        }
+        const init = { method, headers: realHeaders };
+        if (method !== "GET" && method !== "HEAD" && postBody != null) {
+            init.body = typeof postBody === "string" ? postBody : postBody.toString();
+        }
+        fetch(finalUrl, init)
+            .then(async (res) => {
+            const text = await res.text();
+            const ok = (res.status >= 200 && res.status <= 299) ||
+                res.status === 301 ||
+                res.status === 302;
+            const responseHeaders = {};
+            res.headers.forEach((value, key) => {
+                responseHeaders[key] = value;
+            });
+            const response = { statusCode: res.status, headers: responseHeaders };
+            if (ok)
+                callback(null, text, response);
+            else
+                callback({ statusCode: res.status, data: text }, undefined, response);
+        })
+            .catch((e) => callback(e instanceof Error ? e : new Error(String(e))));
+    };
+    oauth2._request = request;
+};
+// Drive a strategy's authenticate() once, capturing its delegate outcome.
+export const runStrategy = (strategy, req, options = {}) => new Promise((resolve) => {
+    let settled = false;
+    const done = (outcome) => {
+        if (settled)
+            return;
+        settled = true;
+        resolve(outcome);
+    };
+    const inst = Object.create(strategy);
+    inst.success = (user, info) => done({ kind: "success", user, info });
+    inst.fail = (challenge, status) => done({ kind: "fail", challenge, status });
+    inst.redirect = (url, status) => done({ kind: "redirect", url, status });
+    inst.error = (error) => done({ kind: "error", error });
+    inst.pass = () => done({ kind: "pass" });
+    try {
+        inst.authenticate(req, options);
+    }
+    catch (e) {
+        done({ kind: "error", error: e instanceof Error ? e : new Error(String(e)) });
+    }
+});
+const asString = (value) => value == null ? undefined : String(value);
+// Normalize a standard passport `Profile` (id/displayName/emails/photos/...) and
+// the looser raw-object shapes commonly returned by OAuth providers.
+export const normalizePassportProfile = (raw) => {
+    if (!raw || typeof raw !== "object")
+        return { raw };
+    const p = raw;
+    const emails = p.emails;
+    const photos = p.photos;
+    const nameObj = p.name;
+    const email = emails?.[0]?.value ?? p.email ?? null;
+    const image = photos?.[0]?.value ??
+        p.avatar_url ??
+        p.picture ??
+        null;
+    const composedName = p.displayName ??
+        (typeof p.name === "string" ? p.name : undefined) ??
+        (nameObj?.givenName
+            ? `${nameObj.givenName} ${nameObj.familyName ?? ""}`.trim()
+            : undefined) ??
+        null;
+    return {
+        id: asString(p.id) ?? asString(p.sub) ?? asString(p.user_id),
+        email,
+        image,
+        name: composedName,
+        username: p.username ??
+            p.login ??
+            null,
+        raw,
+    };
+};
+// Adapt an instantiated Passport strategy into a Covara social provider.
+export const fromPassport = (strategy, options = {}) => {
+    installFetchTransport(strategy);
+    const name = options.name ?? strategy.name;
+    if (!name || name === "oauth2") {
+        throw new Error("fromPassport: could not infer a provider name — pass `{ name }` " +
+            "(the strategy's default name is the generic 'oauth2').");
+    }
+    const mapProfile = options.mapProfile ?? normalizePassportProfile;
+    return {
+        name,
+        scope: options.scope,
+        async authenticate(req) {
+            const opts = {};
+            if (options.scope)
+                opts.scope = options.scope;
+            return runStrategy(strategy, req, opts);
+        },
+        toAccount(user, info) {
+            const profile = mapProfile(user);
+            return {
+                provider: name,
+                providerAccountId: profile.id ?? "",
+                raw: user,
+                profile,
+                info,
+            };
+        },
+    };
+};
+//# sourceMappingURL=passport-bridge.js.map

package/dist/auth/passport-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passport-bridge.js","sourceRoot":"","sources":["../../src/auth/passport-bridge.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,iFAAiF;AACjF,kFAAkF;AAClF,oFAAoF;AACpF,gFAAgF;AAChF,oCAAoC;AACpC,EAAE;AACF,mFAAmF;AACnF,mFAAmF;AACnF,oFAAoF;AACpF,oFAAoF;AACpF,qFAAqF;AACrF,mEAAmE;AAsFnE,yEAAyE;AACzE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAA8B,EAAQ,EAAE;IAC5E,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC;IAChC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,sBAAsB;QAAE,OAAO;IACrD,MAAM,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAErC,MAAM,OAAO,GAAmB,UAE9B,MAAM,EACN,GAAG,EACH,OAAO,EACP,QAAQ,EACR,WAAW,EACX,QAAQ;QAER,MAAM,WAAW,GAA2B;YAC1C,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;YAC9B,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;SACnB,CAAC;QACF,qEAAqE;QACrE,OAAO,WAAW,CAAC,IAAI,CAAC;QACxB,OAAO,WAAW,CAAC,IAAI,CAAC;QACxB,OAAO,WAAW,CAAC,gBAAgB,CAAC,CAAC;QACrC,OAAO,WAAW,CAAC,gBAAgB,CAAC,CAAC;QACrC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC;YAAE,WAAW,CAAC,YAAY,CAAC,GAAG,QAAQ,CAAC;QAErE,IAAI,QAAQ,GAAG,GAAG,CAAC;QACnB,IAAI,WAAW,IAAI,CAAC,CAAC,eAAe,IAAI,WAAW,CAAC,EAAE,CAAC;YACrD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,cAAc,EAAE,WAAW,CAAC,CAAC;YACzE,QAAQ,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC1B,CAAC;QAED,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;QAC3D,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YAC9D,IAAI,CAAC,IAAI,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC5E,CAAC;QAED,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC;aAClB,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAClB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,EAAE,GACN,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC;gBACxC,GAAG,CAAC,MAAM,KAAK,GAAG;gBAClB,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;YACrB,MAAM,eAAe,GAA2B,EAAE,CAAC;YACnD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBACjC,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC/B,CAAC,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;YACtE,IAAI,EAAE;gBAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;;gBAClC,QAAQ,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC7E,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC;IAEF,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC;AAC5B,CAAC,CAAC;AAEF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,QAA8B,EAC9B,GAAoB,EACpB,UAAmC,EAAE,EACX,EAAE,CAC5B,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACtB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,IAAI,GAAG,CAAC,OAAwB,EAAQ,EAAE;QAC9C,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,OAAO,CAAC,OAAO,CAAC,CAAC;IACnB,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAMlC,CAAC;IACF,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC,IAAI,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,QAAQ,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAsB,EAAE,CACtD,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE5C,iFAAiF;AACjF,qEAAqE;AACrE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAY,EAAqB,EAAE;IAC1E,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IACpD,MAAM,CAAC,GAAG,GAA8B,CAAC;IAEzC,MAAM,MAAM,GAAG,CAAC,CAAC,MAA+C,CAAC;IACjE,MAAM,MAAM,GAAG,CAAC,CAAC,MAA+C,CAAC;IACjE,MAAM,OAAO,GAAG,CAAC,CAAC,IAEL,CAAC;IAEd,MAAM,KAAK,GACT,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAK,CAAC,CAAC,KAA4B,IAAI,IAAI,CAAC;IAChE,MAAM,KAAK,GACT,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK;QACjB,CAAC,CAAC,UAAiC;QACnC,CAAC,CAAC,OAA8B;QACjC,IAAI,CAAC;IACP,MAAM,YAAY,GACf,CAAC,CAAC,WAAkC;QACrC,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,IAAe,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,CAAC,OAAO,EAAE,SAAS;YACjB,CAAC,CAAC,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;YAC3D,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,CAAC;IAEP,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5D,KAAK;QACL,KAAK;QACL,IAAI,EAAE,YAAY;QAClB,QAAQ,EACL,CAAC,CAAC,QAA+B;YACjC,CAAC,CAAC,KAA4B;YAC/B,IAAI;QACN,GAAG;KACJ,CAAC;AACJ,CAAC,CAAC;AAEF,yEAAyE;AACzE,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,QAA8B,EAC9B,UAA+B,EAAE,EACjB,EAAE;IAClB,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC;IAC3C,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,kEAAkE;YAChE,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,wBAAwB,CAAC;IAClE,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK,CAAC,YAAY,CAAC,GAAG;YACpB,MAAM,IAAI,GAA4B,EAAE,CAAC;YACzC,IAAI,OAAO,CAAC,KAAK;gBAAE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YAC9C,OAAO,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC;QACD,SAAS,CAAC,IAAI,EAAE,IAAI;YAClB,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YACjC,OAAO;gBACL,QAAQ,EAAE,IAAI;gBACd,iBAAiB,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE;gBACnC,GAAG,EAAE,IAAI;gBACT,OAAO;gBACP,IAAI;aACL,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/auth/routes.d.ts

@@ -6,6 +6,8 @@ import { type CsrfOptions } from "./csrf.js";
 import { VerificationTokenStore } from "./verification.js";
 import { type TotpOptions } from "./totp.js";
 import { type PasswordPolicyOptions } from "./password-policy.js";
+import { type SocialAuthOptions } from "./social.js";
+import { type SessionStrategy } from "./session.js";
 export interface AuthUser {
     id: string;
     email?: string | null;
@@ -13,7 +15,8 @@ export interface AuthUser {
     image?: string | null;
 }
 export interface UseAuthOptions {
-    adapter: AuthAdapter;
+    session?: SessionStrategy;
+    adapter?: AuthAdapter;
     cookieName?: string;
     cookieOptions?: {
         httpOnly?: boolean;
@@ -71,6 +74,7 @@ export interface UseAuthOptions {
     passwordPolicy?: PasswordPolicyOptions;
     mfa?: MfaOptions;
     magicLink?: MagicLinkAuthOptions;
+    social?: SocialAuthOptions;
 }
 export interface MfaEnrollment {
     secret: string;

package/dist/auth/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/auth/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAGlE,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEtC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAG/C,OAAO,EAAiB,KAAK,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAwC,KAAK,WAAW,EAAE,MAAM,QAAQ,CAAC;AAChF,OAAO,EACL,sBAAsB,EAGvB,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EAML,KAAK,WAAW,EACjB,MAAM,QAAQ,CAAC;AAEhB,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,mBAAmB,CAAC;AAc3B,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE;QACd,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;QACrC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,KAAK,CAAC,EAAE;QACN,mBAAmB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;KACpF,CAAC;IACF,MAAM,CAAC,EAAE;QACP,UAAU,EAAE,CAAC,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5F,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9D,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KACrE,CAAC;IACF,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/D,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,EAAE,CAAC,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,IAAI,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC;IAC7B,QAAQ,CAAC,EAAE,OAAO,GAAG,oBAAoB,CAAC;IAC1C,YAAY,CAAC,EAAE;QACb,KAAK,EAAE,sBAAsB,CAAC;QAC9B,SAAS,EAAE,CAAC,MAAM,EAAE;YAClB,UAAU,EAAE,MAAM,CAAC;YACnB,KAAK,EAAE,MAAM,CAAC;YACd,SAAS,EAAE,IAAI,CAAC;YAChB,CAAC,EAAE,OAAO,CAAC;SACZ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3B,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,CAAC;IACF,aAAa,CAAC,EAAE;QACd,KAAK,EAAE,sBAAsB,CAAC;QAC9B,SAAS,EAAE,CAAC,MAAM,EAAE;YAClB,UAAU,EAAE,MAAM,CAAC;YACnB,KAAK,EAAE,MAAM,CAAC;YACd,SAAS,EAAE,IAAI,CAAC;YAChB,CAAC,EAAE,OAAO,CAAC;SACZ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3B,aAAa,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAClF,eAAe,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC,CAAC;QACzE,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;IACF,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,QAAQ,GAAG;QAAE,GAAG,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC/F,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACjE,cAAc,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF,oBAAoB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7E;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,sBAAsB,CAAC;IAC9B,QAAQ,EAAE,CAAC,MAAM,EAAE;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,IAAI,CAAC;QAChB,CAAC,EAAE,OAAO,CAAC;KACZ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,eAAe,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,IAAI,CAAC;IACb,UAAU,EAAE,iBAAiB,CAAC;CAC/B;AAiCD,eAAO,MAAM,OAAO,GAAI,SAAS,cAAc,KAAG,gBAyfjD,CAAC;AAEF,eAAO,MAAM,gBAAgB,YA3fI,cAAc,KAAG,gBA2fX,CAAC"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/auth/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAElE,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEtC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAG/C,OAAO,EAAiB,KAAK,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAwC,KAAK,WAAW,EAAE,MAAM,QAAQ,CAAC;AAChF,OAAO,EACL,sBAAsB,EAGvB,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EAML,KAAK,WAAW,EACjB,MAAM,QAAQ,CAAC;AAEhB,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAsB,KAAK,iBAAiB,EAAE,MAAM,UAAU,CAAC;AACtE,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,WAAW,CAAC;AAclE,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAI7B,OAAO,CAAC,EAAE,eAAe,CAAC;IAG1B,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE;QACd,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;QACrC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,KAAK,CAAC,EAAE;QACN,mBAAmB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;KACpF,CAAC;IACF,MAAM,CAAC,EAAE;QACP,UAAU,EAAE,CAAC,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5F,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9D,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KACrE,CAAC;IACF,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/D,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,EAAE,CAAC,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,IAAI,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC;IAC7B,QAAQ,CAAC,EAAE,OAAO,GAAG,oBAAoB,CAAC;IAC1C,YAAY,CAAC,EAAE;QACb,KAAK,EAAE,sBAAsB,CAAC;QAC9B,SAAS,EAAE,CAAC,MAAM,EAAE;YAClB,UAAU,EAAE,MAAM,CAAC;YACnB,KAAK,EAAE,MAAM,CAAC;YACd,SAAS,EAAE,IAAI,CAAC;YAChB,CAAC,EAAE,OAAO,CAAC;SACZ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3B,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,CAAC;IACF,aAAa,CAAC,EAAE;QACd,KAAK,EAAE,sBAAsB,CAAC;QAC9B,SAAS,EAAE,CAAC,MAAM,EAAE;YAClB,UAAU,EAAE,MAAM,CAAC;YACnB,KAAK,EAAE,MAAM,CAAC;YACd,SAAS,EAAE,IAAI,CAAC;YAChB,CAAC,EAAE,OAAO,CAAC;SACZ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3B,aAAa,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAClF,eAAe,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC,CAAC;QACzE,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;IACF,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,SAAS,CAAC,EAAE,oBAAoB,CAAC;IAIjC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,QAAQ,GAAG;QAAE,GAAG,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC/F,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACjE,cAAc,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF,oBAAoB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7E;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,sBAAsB,CAAC;IAC9B,QAAQ,EAAE,CAAC,MAAM,EAAE;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,IAAI,CAAC;QAChB,CAAC,EAAE,OAAO,CAAC;KACZ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,eAAe,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,IAAI,CAAC;IACb,UAAU,EAAE,iBAAiB,CAAC;CAC/B;AAiCD,eAAO,MAAM,OAAO,GAAI,SAAS,cAAc,KAAG,gBA6fjD,CAAC;AAEF,eAAO,MAAM,gBAAgB,YA/fI,cAAc,KAAG,gBA+fX,CAAC"}

package/dist/auth/routes.js

@@ -1,5 +1,4 @@
 import { Hono } from "hono";
-import { setCookie, deleteCookie, getCookie } from "hono/cookie";
 import { UnauthorizedError, ValidationError, RateLimitError } from "../resource/error.js";
 import { readJsonBody, getClientIP } from "../server/request.js";
 import { isProduction } from "../server/env.js";
@@ -10,6 +9,8 @@ import { issuePasswordResetToken, verifyPasswordResetToken, hashNewPassword, } f
 import { generateTotpSecret, getTotpUri, verifyTotp, generateBackupCodes, verifyBackupCode, } from "./totp.js";
 import { issueMagicLinkToken, consumeMagicLinkToken } from "./magic-link.js";
 import { enforcePasswordStrength, } from "./password-policy.js";
+import { createSocialRouter } from "./social.js";
+import { fromAuthAdapter } from "./session.js";
 // Request metadata stored in session.data so the admin UI can show where a
 // session came from. Lives inside `data` because every session store already
 // persists that field unchanged.
@@ -44,12 +45,21 @@ const toCookieOptions = (options) => ({
     expires: options?.expires,
 });
 export const useAuth = (options) => {
-    const { adapter, cookieName = "session", cookieOptions = {}, login, signup, serializeUser = defaultSerializeUser, onLogin, onLogout, onSignup, csrf, throttle, verification, passwordReset, passwordPolicy, mfa, magicLink, } = options;
+    const { adapter, session: sessionOption, cookieName = "session", cookieOptions = {}, login, signup, serializeUser = defaultSerializeUser, onLogin, onLogout, onSignup, csrf, throttle, verification, passwordReset, passwordPolicy, mfa, magicLink, social, } = options;
     const finalCookieOptions = {
         ...defaultCookieOptions,
         secure: isProduction(),
         ...cookieOptions,
     };
+    const strategy = sessionOption ??
+        (adapter
+            ? fromAuthAdapter(adapter, {
+                name: cookieName,
+                options: toCookieOptions(finalCookieOptions),
+            })
+            : (() => {
+                throw new Error("useAuth requires a `session` strategy (cookieSession/jwtSession) or a legacy `adapter`.");
+            })());
     const router = new Hono();
     const csrfOptions = csrf
         ? typeof csrf === "object"
@@ -63,31 +73,34 @@ export const useAuth = (options) => {
     const throttle$ = throttle
         ? new LoginThrottle(typeof throttle === "object" ? throttle : {})
         : null;
-    const completeLogin = async (c, userId) => {
-        if (!adapter.createSession) {
-            throw new Error("Adapter does not support session creation");
-        }
-        const priorSessionId = getCookie(c, cookieName);
-        if (priorSessionId) {
-            await adapter.invalidateSession(priorSessionId);
+    // Mint a session/token via the configured strategy and assemble the JSON body.
+    // Returns null only if issuance fails, preserving the prior contract.
+    const issueLogin = async (c, userId) => {
+        try {
+            const issued = await strategy.issue(c, userId, sessionRequestMeta(c));
+            const body = { user: serializeUser(issued.user) };
+            if (issued.sessionId)
+                body.sessionId = issued.sessionId;
+            if (issued.accessToken) {
+                body.accessToken = issued.accessToken;
+                body.expiresIn = issued.expiresIn;
+                body.tokenType = "Bearer";
+            }
+            return { body, user: issued.user };
         }
-        const session = await adapter.createSession(userId, sessionRequestMeta(c));
-        const authResult = await adapter.validateCredentials({
-            type: "session",
-            sessionId: session.id,
-        });
-        if (!authResult.success || !authResult.user) {
+        catch {
             return null;
         }
-        setCookie(c, cookieName, session.id, toCookieOptions({
-            ...finalCookieOptions,
-            expires: session.expiresAt,
-        }));
+    };
+    const completeLogin = async (c, userId) => {
+        const issued = await issueLogin(c, userId);
+        if (!issued)
+            return null;
         if (csrfOptions) {
             issueCsrfToken(c, csrfOptions);
         }
-        await onLogin?.(authResult.user, c);
-        return { user: serializeUser(authResult.user), sessionId: session.id };
+        await onLogin?.(issued.user, c);
+        return issued.body;
     };
     const verifyMfaChallenge = async (enrollment, userId, code) => {
         if (!mfa)
@@ -107,15 +120,10 @@ export const useAuth = (options) => {
     };
     const middleware = async (c, next) => {
         try {
-            const credentials = adapter.extractCredentials(c);
-            if (!credentials) {
-                return next();
-            }
-            const result = await adapter.validateCredentials(credentials);
-            if (!result.success || !result.user) {
-                return next();
+            const result = await strategy.authenticate(c);
+            if (result.success && result.user) {
+                c.set("user", result.user);
             }
-            c.set("user", result.user);
             return next();
         }
         catch {
@@ -124,16 +132,11 @@ export const useAuth = (options) => {
     };
     router.get("/me", async (c) => {
         try {
-            const credentials = adapter.extractCredentials(c);
-            if (!credentials) {
-                return c.json({ user: null });
-            }
-            const result = await adapter.validateCredentials(credentials);
+            const result = await strategy.authenticate(c);
             if (!result.success || !result.user) {
                 return c.json({ user: null });
             }
-            const serialized = serializeUser(result.user);
-            return c.json({ user: serialized, expiresAt: result.expiresAt });
+            return c.json({ user: serializeUser(result.user), expiresAt: result.expiresAt });
         }
         catch {
             return c.json({ user: null });
@@ -207,40 +210,38 @@ export const useAuth = (options) => {
                 }
             }
             const user = await signup.createUser({ email, password, name });
-            if (!adapter.createSession) {
-                throw new Error("Adapter does not support session creation");
-            }
-            const session = await adapter.createSession(user.id, sessionRequestMeta(c));
-            setCookie(c, cookieName, session.id, toCookieOptions({
-                ...finalCookieOptions,
-                expires: session.expiresAt,
-            }));
+            const issued = await issueLogin(c, user.id);
+            if (!issued) {
+                throw new UnauthorizedError("Failed to create session");
+            }
             await onSignup?.(user, c);
-            return c.json({ user: { id: user.id, email: user.email, name: user.name } });
+            // Preserve the original `user` shape; merge in any session/token artifacts.
+            const body = {
+                user: { id: user.id, email: user.email, name: user.name },
+            };
+            if (issued.body.sessionId)
+                body.sessionId = issued.body.sessionId;
+            if (issued.body.accessToken) {
+                body.accessToken = issued.body.accessToken;
+                body.expiresIn = issued.body.expiresIn;
+                body.tokenType = "Bearer";
+            }
+            return c.json(body);
         });
     }
     router.post("/logout", async (c) => {
         try {
-            const credentials = adapter.extractCredentials(c);
             let user = null;
-            if (credentials) {
-                const result = await adapter.validateCredentials(credentials);
-                if (result.success && result.user) {
-                    user = result.user;
-                }
-                const sessionToken = credentials.sessionId ?? credentials.token;
-                if (sessionToken) {
-                    await adapter.invalidateSession(sessionToken);
-                }
+            const result = await strategy.authenticate(c);
+            if (result.success && result.user) {
+                user = result.user;
             }
-            deleteCookie(c, cookieName);
-            deleteCookie(c, "connect.sid");
-            deleteCookie(c, "session");
+            await strategy.logout(c);
             await onLogout?.(user, c);
             return c.json({ success: true });
         }
         catch {
-            deleteCookie(c, cookieName);
+            await strategy.logout(c).catch(() => { });
             return c.json({ success: true });
         }
     });
@@ -308,8 +309,8 @@ export const useAuth = (options) => {
             await passwordReset.resetPassword(email, passwordHash);
             if (passwordReset.logoutEverywhere && passwordReset.findUserByEmail) {
                 const user = await passwordReset.findUserByEmail(email);
-                if (user && adapter.invalidateUserSessions) {
-                    await adapter.invalidateUserSessions(user.id);
+                if (user && strategy.invalidateUserSessions) {
+                    await strategy.invalidateUserSessions(user.id);
                 }
             }
             return c.json({ success: true });
@@ -317,12 +318,9 @@ export const useAuth = (options) => {
     }
     if (mfa) {
         const requireCurrentUser = async (c) => {
-            const credentials = adapter.extractCredentials(c);
-            if (credentials) {
-                const result = await adapter.validateCredentials(credentials);
-                if (result.success && result.user) {
-                    return result.user;
-                }
+            const result = await strategy.authenticate(c);
+            if (result.success && result.user) {
+                return result.user;
             }
             throw new UnauthorizedError("Authentication required");
         };
@@ -424,6 +422,18 @@ export const useAuth = (options) => {
             return c.json(result);
         });
     }
+    if (social) {
+        const socialRouter = createSocialRouter(social, {
+            completeLogin,
+            cookieSecure: finalCookieOptions.secure,
+            cookiePath: finalCookieOptions.path,
+        });
+        router.route(social.basePath ?? "/social", socialRouter);
+    }
+    // Strategy-owned routes (e.g. JWT `/refresh`).
+    if (strategy.getRoutes) {
+        router.route("/", strategy.getRoutes());
+    }
     return { router, middleware };
 };
 export const createAuthRoutes = useAuth;