@codelitdev/oauth-server-kit 0.1.0-alpha.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 CodeLit
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,98 @@
+# @codelitdev/oauth-server-kit
+
+A lean Better Auth authentication library for CodeLit products. It provides
+hosted login/consent pages, neutral session and OAuth identities, Express
+bearer middleware, and MCP OAuth discovery.
+
+The library authenticates people and OAuth clients. Each product continues to
+own its users-to-actor mapping, organizations, teams, memberships, roles,
+permissions, API keys, and credential precedence.
+
+## Install
+
+The package is currently released through npm's `alpha` channel:
+
+```sh
+pnpm add @codelitdev/oauth-server-kit@alpha
+```
+
+It has a pre-1.0 public API. Pin an explicit version for production consumers
+and upgrade deliberately.
+
+## Supported surfaces
+
+- Web apps use product-local Better Auth sessions.
+- Mobile apps use Authorization Code with S256 PKCE and a statically
+  registered public client.
+- REST APIs use OAuth bearer tokens through neutral `req.auth`.
+- MCP servers use the same bearer verification plus RFC 9728 discovery and a
+  standard `WWW-Authenticate` challenge.
+
+Every product deploys its own Better Auth issuer, user store, sessions, OAuth
+clients, signing keys, and provider configuration. The package is not a shared
+CodeLit SSO service.
+
+## Entry points
+
+```ts
+import {
+    verifyOAuthAccessToken,
+    type AuthenticatedIdentity,
+} from "@codelitdev/oauth-server-kit";
+
+import {
+    createOAuthProviderOptions,
+    resolveBetterAuthSession,
+} from "@codelitdev/oauth-server-kit/better-auth";
+
+import {
+    createOAuthBearerMiddleware,
+    createOAuthPagesRouter,
+} from "@codelitdev/oauth-server-kit/express";
+
+import { createMcpOAuthDiscoveryRoutes } from "@codelitdev/oauth-server-kit/mcp";
+```
+
+The root entry point does not load Express, a database library, or product
+modules. Better Auth persistence and schema ownership remain in the consuming
+application.
+
+## Secure defaults
+
+- OAuth Dynamic Client Registration is disabled unless explicitly enabled.
+- Unauthenticated DCR requires a separate explicit opt-in.
+- Issuer and audience/resource are verified for every bearer token.
+- Invalid explicit bearer tokens fail closed.
+- Ordinary-login redirects are restricted to configured origins.
+- Hosted pages reject framing and clear configured stale host-only cookies at
+  both `/login` and `/oauth/login`.
+- Product claims such as `team_id`, roles, or permissions are not returned as
+  trusted package identity fields.
+
+See [docs/integration.md](docs/integration.md) for full web, mobile, REST, and
+MCP setup, and [docs/architecture.md](docs/architecture.md) for the normative
+product requirements and public contract.
+
+## Development gates
+
+```bash
+pnpm check-types
+pnpm test
+pnpm test:coverage
+pnpm build
+```
+
+The coverage release gate is 90% statements, lines, and functions and 80%
+branches. The suite includes a real Better Auth OAuth Provider flow with a
+public client, S256 PKCE, refresh, JWKS verification, and MCP discovery.
+
+## Releasing an alpha
+
+After updating the package version, run:
+
+```sh
+npm run release:alpha -- --otp=<npm-otp>
+```
+
+The command validates formatting, linting, types, tests, coverage, and the
+build before publishing to npm with the `alpha` dist-tag.

package/dist/better-auth.d.mts

@@ -0,0 +1,40 @@
+import { OAuthOptions } from '@better-auth/oauth-provider';
+import { A as AuthenticationResult } from './types-DJxCmhYu.mjs';
+import '@better-auth/oauth-provider/resource-client';
+
+type BetterAuthSession = {
+    user: {
+        id: string;
+        email: string;
+        name?: string | null;
+    };
+    session: {
+        id: string;
+        expiresAt: Date;
+    };
+};
+interface BetterAuthSessionApi {
+    api: {
+        getSession(input: {
+            headers: Headers;
+        }): Promise<BetterAuthSession | null>;
+    };
+}
+interface ResolveBetterAuthSessionOptions {
+    auth: BetterAuthSessionApi;
+    issuer: string;
+}
+declare function resolveBetterAuthSession(options: ResolveBetterAuthSessionOptions, headers: Headers): Promise<AuthenticationResult>;
+interface CreateOAuthProviderOptionsInput {
+    loginPage: string;
+    consentPage: string;
+    scopes: readonly string[];
+    validAudiences: readonly string[];
+    allowDynamicClientRegistration?: boolean;
+    allowUnauthenticatedDynamicClientRegistration?: boolean;
+    clientRegistrationDefaultScopes?: readonly string[];
+    clientRegistrationAllowedScopes?: readonly string[];
+}
+declare function createOAuthProviderOptions(input: CreateOAuthProviderOptionsInput): OAuthOptions<string[]>;
+
+export { type BetterAuthSession, type BetterAuthSessionApi, type CreateOAuthProviderOptionsInput, type ResolveBetterAuthSessionOptions, createOAuthProviderOptions, resolveBetterAuthSession };

package/dist/better-auth.d.ts

@@ -0,0 +1,40 @@
+import { OAuthOptions } from '@better-auth/oauth-provider';
+import { A as AuthenticationResult } from './types-DJxCmhYu.js';
+import '@better-auth/oauth-provider/resource-client';
+
+type BetterAuthSession = {
+    user: {
+        id: string;
+        email: string;
+        name?: string | null;
+    };
+    session: {
+        id: string;
+        expiresAt: Date;
+    };
+};
+interface BetterAuthSessionApi {
+    api: {
+        getSession(input: {
+            headers: Headers;
+        }): Promise<BetterAuthSession | null>;
+    };
+}
+interface ResolveBetterAuthSessionOptions {
+    auth: BetterAuthSessionApi;
+    issuer: string;
+}
+declare function resolveBetterAuthSession(options: ResolveBetterAuthSessionOptions, headers: Headers): Promise<AuthenticationResult>;
+interface CreateOAuthProviderOptionsInput {
+    loginPage: string;
+    consentPage: string;
+    scopes: readonly string[];
+    validAudiences: readonly string[];
+    allowDynamicClientRegistration?: boolean;
+    allowUnauthenticatedDynamicClientRegistration?: boolean;
+    clientRegistrationDefaultScopes?: readonly string[];
+    clientRegistrationAllowedScopes?: readonly string[];
+}
+declare function createOAuthProviderOptions(input: CreateOAuthProviderOptionsInput): OAuthOptions<string[]>;
+
+export { type BetterAuthSession, type BetterAuthSessionApi, type CreateOAuthProviderOptionsInput, type ResolveBetterAuthSessionOptions, createOAuthProviderOptions, resolveBetterAuthSession };

package/dist/better-auth.js

@@ -0,0 +1,138 @@
+'use strict';
+
+var __defProp = Object.defineProperty;
+var __getOwnPropSymbols = Object.getOwnPropertySymbols;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __propIsEnum = Object.prototype.propertyIsEnumerable;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp.call(b, prop))
+      __defNormalProp(a, prop, b[prop]);
+  if (__getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(b)) {
+      if (__propIsEnum.call(b, prop))
+        __defNormalProp(a, prop, b[prop]);
+    }
+  return a;
+};
+
+// src/better-auth.ts
+function normalizeIssuer(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch (e) {
+    throw new Error("issuer must be an absolute URL");
+  }
+  if (!["http:", "https:"].includes(url.protocol)) {
+    throw new Error("issuer must use http or https");
+  }
+  if (process.env.NODE_ENV === "production" && url.protocol !== "https:") {
+    throw new Error("issuer must use https in production");
+  }
+  return url.toString().replace(/\/$/, "");
+}
+async function resolveBetterAuthSession(options, headers) {
+  var _a;
+  const issuer = normalizeIssuer(options.issuer);
+  try {
+    const session = await options.auth.api.getSession({ headers });
+    if (!((_a = session == null ? void 0 : session.user) == null ? void 0 : _a.id) || !session.user.email) {
+      return { status: "missing" };
+    }
+    return {
+      status: "authenticated",
+      identity: {
+        method: "session",
+        issuer,
+        subject: session.user.id,
+        email: session.user.email,
+        name: session.user.name,
+        scopes: []
+      }
+    };
+  } catch (cause) {
+    return { status: "unavailable", cause };
+  }
+}
+function uniqueRequired(values, field) {
+  const result = [
+    ...new Set(values.map((value) => value.trim()).filter(Boolean))
+  ];
+  if (result.length === 0) {
+    throw new Error(`${field} must contain at least one value`);
+  }
+  return result;
+}
+function assertPageLocation(value, field) {
+  if (value.startsWith("/") && !value.startsWith("//")) {
+    if (/\s/.test(value)) {
+      throw new Error(
+        `${field} must be an absolute URL or absolute path`
+      );
+    }
+    return;
+  }
+  let url;
+  try {
+    url = new URL(value);
+  } catch (e) {
+    throw new Error(`${field} must be an absolute URL or absolute path`);
+  }
+  if (!["http:", "https:"].includes(url.protocol)) {
+    throw new Error(`${field} must use http or https`);
+  }
+  if (process.env.NODE_ENV === "production" && url.protocol !== "https:") {
+    throw new Error(`${field} must use https in production`);
+  }
+}
+function assertScopeSubset(values, scopes, field) {
+  if (!values) return void 0;
+  const normalized = [
+    ...new Set(values.map((value) => value.trim()).filter(Boolean))
+  ];
+  const invalid = normalized.filter((scope) => !scopes.includes(scope));
+  if (invalid.length > 0) {
+    throw new Error(
+      `${field} contains unsupported scopes: ${invalid.join(", ")}`
+    );
+  }
+  return normalized;
+}
+function createOAuthProviderOptions(input) {
+  var _a, _b;
+  assertPageLocation(input.loginPage, "loginPage");
+  assertPageLocation(input.consentPage, "consentPage");
+  const scopes = uniqueRequired(input.scopes, "scopes");
+  const validAudiences = uniqueRequired(
+    input.validAudiences,
+    "validAudiences"
+  );
+  if (input.allowUnauthenticatedDynamicClientRegistration && !input.allowDynamicClientRegistration) {
+    throw new Error(
+      "unauthenticated dynamic client registration requires dynamic client registration"
+    );
+  }
+  const clientRegistrationDefaultScopes = assertScopeSubset(
+    input.clientRegistrationDefaultScopes,
+    scopes,
+    "clientRegistrationDefaultScopes"
+  );
+  const clientRegistrationAllowedScopes = assertScopeSubset(
+    input.clientRegistrationAllowedScopes,
+    scopes,
+    "clientRegistrationAllowedScopes"
+  );
+  return __spreadValues(__spreadValues({
+    loginPage: input.loginPage,
+    consentPage: input.consentPage,
+    scopes,
+    validAudiences,
+    allowDynamicClientRegistration: (_a = input.allowDynamicClientRegistration) != null ? _a : false,
+    allowUnauthenticatedClientRegistration: (_b = input.allowUnauthenticatedDynamicClientRegistration) != null ? _b : false
+  }, clientRegistrationDefaultScopes ? { clientRegistrationDefaultScopes } : {}), clientRegistrationAllowedScopes ? { clientRegistrationAllowedScopes } : {});
+}
+
+exports.createOAuthProviderOptions = createOAuthProviderOptions;
+exports.resolveBetterAuthSession = resolveBetterAuthSession;

package/dist/better-auth.mjs

@@ -0,0 +1,120 @@
+import { __spreadValues } from './chunk-I4E63NIC.mjs';
+
+// src/better-auth.ts
+function normalizeIssuer(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch (e) {
+    throw new Error("issuer must be an absolute URL");
+  }
+  if (!["http:", "https:"].includes(url.protocol)) {
+    throw new Error("issuer must use http or https");
+  }
+  if (process.env.NODE_ENV === "production" && url.protocol !== "https:") {
+    throw new Error("issuer must use https in production");
+  }
+  return url.toString().replace(/\/$/, "");
+}
+async function resolveBetterAuthSession(options, headers) {
+  var _a;
+  const issuer = normalizeIssuer(options.issuer);
+  try {
+    const session = await options.auth.api.getSession({ headers });
+    if (!((_a = session == null ? void 0 : session.user) == null ? void 0 : _a.id) || !session.user.email) {
+      return { status: "missing" };
+    }
+    return {
+      status: "authenticated",
+      identity: {
+        method: "session",
+        issuer,
+        subject: session.user.id,
+        email: session.user.email,
+        name: session.user.name,
+        scopes: []
+      }
+    };
+  } catch (cause) {
+    return { status: "unavailable", cause };
+  }
+}
+function uniqueRequired(values, field) {
+  const result = [
+    ...new Set(values.map((value) => value.trim()).filter(Boolean))
+  ];
+  if (result.length === 0) {
+    throw new Error(`${field} must contain at least one value`);
+  }
+  return result;
+}
+function assertPageLocation(value, field) {
+  if (value.startsWith("/") && !value.startsWith("//")) {
+    if (/\s/.test(value)) {
+      throw new Error(
+        `${field} must be an absolute URL or absolute path`
+      );
+    }
+    return;
+  }
+  let url;
+  try {
+    url = new URL(value);
+  } catch (e) {
+    throw new Error(`${field} must be an absolute URL or absolute path`);
+  }
+  if (!["http:", "https:"].includes(url.protocol)) {
+    throw new Error(`${field} must use http or https`);
+  }
+  if (process.env.NODE_ENV === "production" && url.protocol !== "https:") {
+    throw new Error(`${field} must use https in production`);
+  }
+}
+function assertScopeSubset(values, scopes, field) {
+  if (!values) return void 0;
+  const normalized = [
+    ...new Set(values.map((value) => value.trim()).filter(Boolean))
+  ];
+  const invalid = normalized.filter((scope) => !scopes.includes(scope));
+  if (invalid.length > 0) {
+    throw new Error(
+      `${field} contains unsupported scopes: ${invalid.join(", ")}`
+    );
+  }
+  return normalized;
+}
+function createOAuthProviderOptions(input) {
+  var _a, _b;
+  assertPageLocation(input.loginPage, "loginPage");
+  assertPageLocation(input.consentPage, "consentPage");
+  const scopes = uniqueRequired(input.scopes, "scopes");
+  const validAudiences = uniqueRequired(
+    input.validAudiences,
+    "validAudiences"
+  );
+  if (input.allowUnauthenticatedDynamicClientRegistration && !input.allowDynamicClientRegistration) {
+    throw new Error(
+      "unauthenticated dynamic client registration requires dynamic client registration"
+    );
+  }
+  const clientRegistrationDefaultScopes = assertScopeSubset(
+    input.clientRegistrationDefaultScopes,
+    scopes,
+    "clientRegistrationDefaultScopes"
+  );
+  const clientRegistrationAllowedScopes = assertScopeSubset(
+    input.clientRegistrationAllowedScopes,
+    scopes,
+    "clientRegistrationAllowedScopes"
+  );
+  return __spreadValues(__spreadValues({
+    loginPage: input.loginPage,
+    consentPage: input.consentPage,
+    scopes,
+    validAudiences,
+    allowDynamicClientRegistration: (_a = input.allowDynamicClientRegistration) != null ? _a : false,
+    allowUnauthenticatedClientRegistration: (_b = input.allowUnauthenticatedDynamicClientRegistration) != null ? _b : false
+  }, clientRegistrationDefaultScopes ? { clientRegistrationDefaultScopes } : {}), clientRegistrationAllowedScopes ? { clientRegistrationAllowedScopes } : {});
+}
+
+export { createOAuthProviderOptions, resolveBetterAuthSession };

package/dist/chunk-I4E63NIC.mjs

@@ -0,0 +1,21 @@
+var __defProp = Object.defineProperty;
+var __defProps = Object.defineProperties;
+var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
+var __getOwnPropSymbols = Object.getOwnPropertySymbols;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __propIsEnum = Object.prototype.propertyIsEnumerable;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp.call(b, prop))
+      __defNormalProp(a, prop, b[prop]);
+  if (__getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(b)) {
+      if (__propIsEnum.call(b, prop))
+        __defNormalProp(a, prop, b[prop]);
+    }
+  return a;
+};
+var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
+
+export { __spreadProps, __spreadValues };

package/dist/chunk-RJ4ABQXG.mjs

@@ -0,0 +1,86 @@
+import { __spreadProps, __spreadValues } from './chunk-I4E63NIC.mjs';
+
+// src/verify-access-token.ts
+function requireAbsoluteUrl(value, field) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch (e) {
+    throw new Error(`${field} must be an absolute URL`);
+  }
+  if (!["http:", "https:"].includes(url.protocol)) {
+    throw new Error(`${field} must use http or https`);
+  }
+  if (process.env.NODE_ENV === "production" && url.protocol !== "https:") {
+    throw new Error(`${field} must use https in production`);
+  }
+  return url.toString().replace(/\/$/, "");
+}
+function normalizedUniqueStrings(values) {
+  return [...new Set(values.map((value) => value.trim()).filter(Boolean))];
+}
+function claimStrings(value) {
+  if (typeof value === "string") return [value];
+  if (!Array.isArray(value)) return [];
+  return value.filter((item) => typeof item === "string");
+}
+function optionalString(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function validateOAuthVerificationOptions(options) {
+  var _a;
+  requireAbsoluteUrl(options.issuer, "issuer");
+  if (normalizedUniqueStrings(options.audiences).length === 0) {
+    throw new Error("audiences must contain at least one value");
+  }
+  for (const value of Object.values((_a = options.resourceMetadataMappings) != null ? _a : {})) {
+    requireAbsoluteUrl(value, "resourceMetadataMappings");
+  }
+}
+async function verifyOAuthAccessToken(options, token) {
+  var _a, _b;
+  validateOAuthVerificationOptions(options);
+  const issuer = requireAbsoluteUrl(options.issuer, "issuer");
+  const audiences = normalizedUniqueStrings(options.audiences);
+  if (!token.trim()) return { status: "invalid_token" };
+  try {
+    const claims = await options.oauthResourceClient.getActions().verifyAccessToken(token, {
+      verifyOptions: { issuer, audience: audiences },
+      resourceMetadataMappings: (_a = options.resourceMetadataMappings) != null ? _a : {}
+    });
+    const subject = optionalString(claims.sub);
+    const claimIssuer = optionalString(claims.iss);
+    const clientId = (_b = optionalString(claims.azp)) != null ? _b : optionalString(claims.client_id);
+    const tokenAudiences = normalizedUniqueStrings(
+      claimStrings(claims.aud)
+    );
+    const validatedAudiences = tokenAudiences.filter(
+      (audience) => audiences.includes(audience)
+    );
+    if (!subject || (claimIssuer == null ? void 0 : claimIssuer.replace(/\/$/, "")) !== issuer || !clientId || validatedAudiences.length === 0) {
+      return { status: "invalid_token" };
+    }
+    const scopeValue = claims.scope;
+    const scopes = normalizedUniqueStrings(
+      Array.isArray(scopeValue) ? claimStrings(scopeValue) : typeof scopeValue === "string" ? scopeValue.split(/\s+/) : []
+    );
+    const email = optionalString(claims.email);
+    const name = optionalString(claims.name);
+    return {
+      status: "authenticated",
+      identity: __spreadProps(__spreadValues(__spreadValues({
+        method: "oauth",
+        issuer,
+        subject
+      }, email ? { email } : {}), name ? { name } : {}), {
+        clientId,
+        scopes,
+        audiences: validatedAudiences
+      })
+    };
+  } catch (e) {
+    return { status: "invalid_token" };
+  }
+}
+
+export { validateOAuthVerificationOptions, verifyOAuthAccessToken };

package/dist/express.d.mts

@@ -0,0 +1,36 @@
+import { RequestHandler, Router } from 'express';
+import { a as AuthenticatedIdentity } from './types-DJxCmhYu.mjs';
+import { VerifyOAuthAccessTokenOptions } from './index.mjs';
+import '@better-auth/oauth-provider/resource-client';
+
+declare global {
+    namespace Express {
+        interface Request {
+            auth?: AuthenticatedIdentity;
+        }
+    }
+}
+interface CreateOAuthBearerMiddlewareOptions extends VerifyOAuthAccessTokenOptions {
+    resourceMetadataUrl?: string;
+}
+declare function createOAuthBearerMiddleware(options: CreateOAuthBearerMiddlewareOptions): RequestHandler;
+
+type HostedLoginMethod = {
+    type: "email-otp";
+    label?: string;
+} | {
+    type: "social";
+    providerId: string;
+    label: string;
+};
+interface CreateOAuthPagesRouterOptions {
+    appName: string;
+    authBasePath: string;
+    allowedRedirectOrigins: readonly string[];
+    defaultRedirectUrl: string;
+    loginMethods: readonly HostedLoginMethod[];
+    legacyHostOnlySessionCookieNames?: readonly string[];
+}
+declare function createOAuthPagesRouter(rawOptions: CreateOAuthPagesRouterOptions): Router;
+
+export { type CreateOAuthBearerMiddlewareOptions, type CreateOAuthPagesRouterOptions, type HostedLoginMethod, createOAuthBearerMiddleware, createOAuthPagesRouter };

package/dist/express.d.ts

@@ -0,0 +1,36 @@
+import { RequestHandler, Router } from 'express';
+import { a as AuthenticatedIdentity } from './types-DJxCmhYu.js';
+import { VerifyOAuthAccessTokenOptions } from './index.js';
+import '@better-auth/oauth-provider/resource-client';
+
+declare global {
+    namespace Express {
+        interface Request {
+            auth?: AuthenticatedIdentity;
+        }
+    }
+}
+interface CreateOAuthBearerMiddlewareOptions extends VerifyOAuthAccessTokenOptions {
+    resourceMetadataUrl?: string;
+}
+declare function createOAuthBearerMiddleware(options: CreateOAuthBearerMiddlewareOptions): RequestHandler;
+
+type HostedLoginMethod = {
+    type: "email-otp";
+    label?: string;
+} | {
+    type: "social";
+    providerId: string;
+    label: string;
+};
+interface CreateOAuthPagesRouterOptions {
+    appName: string;
+    authBasePath: string;
+    allowedRedirectOrigins: readonly string[];
+    defaultRedirectUrl: string;
+    loginMethods: readonly HostedLoginMethod[];
+    legacyHostOnlySessionCookieNames?: readonly string[];
+}
+declare function createOAuthPagesRouter(rawOptions: CreateOAuthPagesRouterOptions): Router;
+
+export { type CreateOAuthBearerMiddlewareOptions, type CreateOAuthPagesRouterOptions, type HostedLoginMethod, createOAuthBearerMiddleware, createOAuthPagesRouter };