chore(router): upgrade aura-stack/router

packages/core/CHANGELOG.md

@@ -8,6 +8,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+### Changed
+
+- Upgraded `@aura-stack/router` to `v0.11.4`, adding response schema validation and adopting the built-in `handle()` function for processing incoming requests. This release also updates unsupported HTTP method handling to return a standardized `404 Not Found` response instead of `405 Method Not Allowed`. [#274](https://github.com/aura-stack-ts/auth/pull/274)
+
 ---
 
 ## [0.9.2] - 2026-08-30

packages/core/deno.json

@@ -41,7 +41,7 @@
   },
   "imports": {
     "@/": "./src/",
-    "@aura-stack/router": "npm:@aura-stack/router@^0.9.0",
+    "@aura-stack/router": "npm:@aura-stack/router@^0.11.4",
     "zod": "npm:zod@4.3.5",
     "arktype": "npm:arktype@2.2.0",
     "valibot": "npm:valibot@1.4.0",

packages/core/package.json

@@ -65,7 +65,7 @@
   "dependencies": {
     "@aura-stack/jose": "workspace:*",
     "@aura-stack/rate-limiter": "workspace:*",
-    "@aura-stack/router": "^0.9.0",
+    "@aura-stack/router": "^0.11.4",
     "arktype": "^2.2.0",
     "typebox": "^1.1.38",
     "valibot": "catalog:valibot",

packages/core/src/@types/config.ts

@@ -428,7 +428,7 @@ export interface CredentialsConfig<Identity extends Identities> {
 }
 
 export type Handlers = {
-    [method in "GET" | "POST" | "PATCH" | "DELETE" | "ALL"]: (request: Request) => Response | Promise<Response>
+    [method in "GET" | "POST" | "PATCH" | "DELETE" | "ALL" | "handle"]: (request: Request) => Response | Promise<Response>
 }
 
 /**

packages/core/src/@types/index.ts

@@ -3,7 +3,7 @@
  */
 import type { Prettify } from "@/@types/utility.ts"
 import type { ClientOptions } from "@aura-stack/router"
-import type { createAuthInstance } from "@/createAuth.ts"
+import type { createAuthInstance } from "@/router/router.ts"
 
 export type * from "@/@types/config.ts"
 export type * from "@/@types/oauth.ts"
@@ -15,7 +15,7 @@ export type * from "@/identity/index.ts"
 export type * from "@/@types/entities.ts"
 export type * from "@/@types/adapter.ts"
 
-export type { Awaitable } from "@aura-stack/router/types"
+export type { Awaitable, RequestHeaders } from "@aura-stack/router/types"
 export type { TypedJWTPayload } from "@aura-stack/jose"
 
 export type { IdentityShape as ZodIdentitySchema, IsZod } from "@/identity/zod.ts"

packages/core/src/@types/internal.ts

@@ -30,7 +30,7 @@ import type {
     StatelessStrategyConfig,
     User,
 } from "@/@types/session.ts"
-import type { OAuthAccessTokenResponse, OIDCAccessTokenResponseSchema } from "@/schemas.ts"
+import type { OAuthAccessTokenResponse, OIDCAccessTokenResponseSchema } from "@/shared/schemas/general.ts"
 import type { JWTPayload } from "@/jose.ts"
 import type { TypedJWTPayload } from "@aura-stack/jose"
 import type { createCookieManager } from "@/session/cookie-manager.ts"

packages/core/src/actions/callback/callback.ts

@@ -1,23 +1,11 @@
-import { z } from "zod/v4"
 import { createEndpoint, createEndpointConfig } from "@aura-stack/router"
-import { SearchParamsCallbackSchema } from "@/schemas.ts"
+import { SearchParamsCallbackSchema, OAuthProviderListSchema } from "@/shared/schemas/actions.ts"
 import type { OAuthProviderRecord } from "@/@types/internal.ts"
 
 const callbackConfig = (oauth: OAuthProviderRecord) => {
-    // @ts-ignore
     return createEndpointConfig({
-        /**
-         * @todo Add support to any schema (zod, arktype and valibot)
-         */
         schemas: {
-            // @ts-ignore
-            params: z.object({
-                oauth: z.enum(
-                    Object.keys(oauth) as (keyof OAuthProviderRecord)[],
-                    "The OAuth provider is not supported or invalid."
-                ),
-            }),
-            // @ts-ignore
+            params: OAuthProviderListSchema(oauth),
             searchParams: SearchParamsCallbackSchema,
         },
     })

packages/core/src/actions/csrfToken/csrfToken.ts

@@ -1,19 +1,31 @@
-import { createEndpoint } from "@aura-stack/router"
+import { createEndpoint, createEndpointConfig } from "@aura-stack/router"
 import { createCSRF } from "@/shared/crypto.ts"
 import { secureApiHeaders } from "@/shared/headers.ts"
 import { setCookie, getOptionalCookie } from "@/cookie.ts"
+import { CSRFTokenActionResponseSchema } from "@/shared/schemas/actions.ts"
 
-export const csrfTokenAction = createEndpoint("GET", "/csrfToken", async (ctx) => {
-    const {
-        request,
-        context: { jose, cookies, logger },
-    } = ctx
-    const token = getOptionalCookie(request, cookies.csrfToken.name)
-    logger?.log("CSRF_TOKEN_REQUESTED", { structuredData: { has_token: Boolean(token) } })
-    const csrfToken = await createCSRF(jose, token)
-    logger?.log("CSRF_TOKEN_ISSUED", { structuredData: { issued: Boolean(csrfToken) } })
-
-    const headers = new Headers(secureApiHeaders)
-    headers.append("Set-Cookie", setCookie(cookies.csrfToken.name, csrfToken, cookies.csrfToken.attributes))
-    return Response.json({ csrfToken }, { headers })
+const config = createEndpointConfig({
+    schemas: {
+        response: CSRFTokenActionResponseSchema,
+    },
 })
+
+export const csrfTokenAction = createEndpoint(
+    "GET",
+    "/csrfToken",
+    async (ctx) => {
+        const {
+            request,
+            context: { jose, cookies, logger },
+        } = ctx
+        const token = getOptionalCookie(request, cookies.csrfToken.name)
+        logger?.log("CSRF_TOKEN_REQUESTED", { structuredData: { has_token: Boolean(token) } })
+        const csrfToken = await createCSRF(jose, token)
+        logger?.log("CSRF_TOKEN_ISSUED", { structuredData: { issued: Boolean(csrfToken) } })
+
+        const headers = new Headers(secureApiHeaders)
+        headers.append("Set-Cookie", setCookie(cookies.csrfToken.name, csrfToken, cookies.csrfToken.attributes))
+        return ctx.json({ csrfToken }, { headers })
+    },
+    config
+)

packages/core/src/actions/providers/connected.ts

@@ -1,17 +1,13 @@
-import { z } from "zod/v4"
-import { isProviderConnected } from "@/api/isProviderConnected.ts"
 import { createEndpoint, createEndpointConfig } from "@aura-stack/router"
+import { isProviderConnected } from "@/api/isProviderConnected.ts"
+import { IsProviderConnectedActionResponseSchema, OAuthProviderListSchema } from "@/shared/schemas/actions.ts"
 import type { OAuthProviderRecord } from "@/@types/internal.ts"
 
 const connectedConfig = (oauth: OAuthProviderRecord) => {
     return createEndpointConfig({
         schemas: {
-            params: z.object({
-                oauth: z.enum(
-                    Object.keys(oauth) as (keyof OAuthProviderRecord)[],
-                    "The OAuth provider is not supported or invalid."
-                ),
-            }),
+            params: OAuthProviderListSchema(oauth),
+            response: IsProviderConnectedActionResponseSchema,
         },
     })
 }

packages/core/src/actions/providers/disconnect.ts

@@ -1,17 +1,13 @@
-import { z } from "zod/v4"
-import { disconnectProvider } from "@/api/disconnectProvider.ts"
 import { createEndpoint, createEndpointConfig } from "@aura-stack/router"
+import { disconnectProvider } from "@/api/disconnectProvider.ts"
+import { DisconnectProviderActionResponseSchema, OAuthProviderListSchema } from "@/shared/schemas/actions.ts"
 import type { OAuthProviderRecord } from "@/@types/internal.ts"
 
 const disconnectConfig = (oauth: OAuthProviderRecord) => {
     return createEndpointConfig({
         schemas: {
-            params: z.object({
-                oauth: z.enum(
-                    Object.keys(oauth) as (keyof OAuthProviderRecord)[],
-                    "The OAuth provider is not supported or invalid."
-                ),
-            }),
+            params: OAuthProviderListSchema(oauth),
+            response: DisconnectProviderActionResponseSchema,
         },
     })
 }

packages/core/src/actions/providers/tokens/revoke.ts

@@ -1,17 +1,13 @@
-import { z } from "zod/v4"
-import { revokeToken } from "@/api/revokeToken.ts"
 import { createEndpoint, createEndpointConfig } from "@aura-stack/router"
+import { revokeToken } from "@/api/revokeToken.ts"
+import { OAuthProviderListSchema, RevokeTokenActionResponseSchema } from "@/shared/schemas/actions.ts"
 import type { OAuthProviderRecord } from "@/@types/internal.ts"
 
 const revokeConfig = (oauth: OAuthProviderRecord) => {
     return createEndpointConfig({
         schemas: {
-            params: z.object({
-                oauth: z.enum(
-                    Object.keys(oauth) as (keyof OAuthProviderRecord)[],
-                    "The OAuth provider is not supported or invalid."
-                ),
-            }),
+            params: OAuthProviderListSchema(oauth),
+            response: RevokeTokenActionResponseSchema,
         },
     })
 }

packages/core/src/actions/providers/tokens/tokens.ts

@@ -1,17 +1,13 @@
-import z from "zod/v4"
-import { getProviderTokens } from "@/api/getProviderTokens.ts"
 import { createEndpoint, createEndpointConfig } from "@aura-stack/router"
+import { getProviderTokens } from "@/api/getProviderTokens.ts"
+import { GetProviderTokensActionResponseSchema, OAuthProviderListSchema } from "@/shared/schemas/actions.ts"
 import type { OAuthProviderRecord } from "@/@types/internal.ts"
 
 const tokensConfig = (oauth: OAuthProviderRecord) => {
     return createEndpointConfig({
         schemas: {
-            params: z.object({
-                oauth: z.enum(
-                    Object.keys(oauth) as (keyof OAuthProviderRecord)[],
-                    "The OAuth provider is not supported or invalid."
-                ),
-            }),
+            params: OAuthProviderListSchema(oauth),
+            response: GetProviderTokensActionResponseSchema,
         },
     })
 }

packages/core/src/actions/providers/user/refresh.ts

@@ -1,17 +1,13 @@
-import { z } from "zod/v4"
-import { refreshUserInfo } from "@/api/refreshUserInfo.ts"
 import { createEndpoint, createEndpointConfig } from "@aura-stack/router"
+import { refreshUserInfo } from "@/api/refreshUserInfo.ts"
+import { OAuthProviderListSchema, RefreshUserInfoActionResponseSchema } from "@/shared/schemas/actions.ts"
 import type { OAuthProviderRecord } from "@/@types/internal.ts"
 
 export const refreshConfig = (oauth: OAuthProviderRecord) => {
     return createEndpointConfig({
         schemas: {
-            params: z.object({
-                oauth: z.enum(
-                    Object.keys(oauth) as (keyof OAuthProviderRecord)[],
-                    "The OAuth provider is not supported or invalid."
-                ),
-            }),
+            params: OAuthProviderListSchema(oauth),
+            response: RefreshUserInfoActionResponseSchema,
         },
     })
 }

packages/core/src/actions/session/updateSession.ts

@@ -1,5 +1,5 @@
 import { createEndpoint, createEndpointConfig } from "@aura-stack/router"
-import { RedirectOptionsSchema } from "@/schemas.ts"
+import { RedirectOptionsSchema } from "@/shared/schemas/general.ts"
 import { updateSession } from "@/api/updateSession.ts"
 import { getFullSchema } from "@/validator/registry.ts"
 import type { Identities } from "@/identity/index.ts"

packages/core/src/actions/signIn/signIn.ts

@@ -1,19 +1,14 @@
-import { z } from "zod/v4"
-import { signIn } from "@/api/signIn.ts"
-import { RedirectOptionsSchema } from "@/schemas.ts"
 import { createEndpoint, createEndpointConfig } from "@aura-stack/router"
+import { signIn } from "@/api/signIn.ts"
+import { OAuthProviderListSchema, SignInActionResponseSchemas, RedirectOptionsSchema } from "@/shared/schemas/actions.ts"
 import type { OAuthProviderRecord } from "@/@types/internal.ts"
 
 const signInConfig = (oauth: OAuthProviderRecord) => {
-    return createEndpointConfig("/signIn/:oauth", {
+    return createEndpointConfig({
         schemas: {
-            params: z.object({
-                oauth: z.enum(
-                    Object.keys(oauth) as (keyof OAuthProviderRecord)[],
-                    "The OAuth provider is not supported or invalid."
-                ),
-            }),
+            params: OAuthProviderListSchema(oauth),
             searchParams: RedirectOptionsSchema,
+            response: SignInActionResponseSchemas,
         },
     })
 }

packages/core/src/actions/signIn/signInCredentials.ts

@@ -1,11 +1,13 @@
 import { createEndpoint, createEndpointConfig } from "@aura-stack/router"
 import { signInCredentials } from "@/api/signInCredentials.ts"
-import { RedirectOptionsSchema, CredentialsPayloadSchema } from "@/schemas.ts"
+import { CredentialsPayloadSchema } from "@/shared/schemas/general.ts"
+import { SignInCredentialsActionResponseSchema, RedirectOptionsSchema } from "@/shared/schemas/actions.ts"
 
 const config = createEndpointConfig({
     schemas: {
         body: CredentialsPayloadSchema,
         searchParams: RedirectOptionsSchema,
+        response: SignInCredentialsActionResponseSchema,
     },
 })
 

packages/core/src/actions/signOut/signOut.ts

@@ -1,13 +1,11 @@
-import { z } from "zod/v4"
 import { createEndpoint, createEndpointConfig } from "@aura-stack/router"
 import { signOut } from "@/api/signOut.ts"
-import { RedirectOptionsSchema } from "@/schemas.ts"
+import { SignOutActionResponseSchema, SignOutSearchParamsSchema } from "@/shared/schemas/actions.ts"
 
 const config = createEndpointConfig({
     schemas: {
-        searchParams: RedirectOptionsSchema.extend({
-            token_type_hint: z.literal("session_token"),
-        }),
+        searchParams: SignOutSearchParamsSchema,
+        response: SignOutActionResponseSchema,
     },
 })
 

packages/core/src/actions/signUp/signUp.ts

@@ -1,6 +1,7 @@
-import { signUp } from "@/api/signUp.ts"
 import { createEndpoint, createEndpointConfig } from "@aura-stack/router"
-import { RedirectOptionsSchema } from "@/schemas.ts"
+import { signUp } from "@/api/signUp.ts"
+import { RedirectOptionsSchema } from "@/shared/schemas/general.ts"
+import { SignUpActionResponseSchema } from "@/shared/schemas/actions.ts"
 import type { SignUpConfig } from "@/@types/config.ts"
 import type { Identities, SchemaTypes } from "@/identity/index.ts"
 
@@ -11,6 +12,7 @@ const signUpConfig = <Identity extends Identities, SignUpSchema extends SchemaTy
         schemas: {
             body: config?.schema,
             searchParams: RedirectOptionsSchema,
+            response: SignUpActionResponseSchema,
         },
     })
 }