@djangocfg/api 2.1.599 → 2.1.600

package/dist/auth.d.cts

@@ -40,6 +40,70 @@ type CfgUserUpdateRequest = {
      */
     timezone?: string;
 };
+/**
+ * * `oauth_disabled` - oauth_disabled
+ * * `github_oauth_disabled` - github_oauth_disabled
+ * * `origin_not_allowed` - origin_not_allowed
+ * * `missing_redirect_uri` - missing_redirect_uri
+ * * `invalid_state` - invalid_state
+ * * `oauth_exchange_failed` - oauth_exchange_failed
+ * * `invalid_id_token` - invalid_id_token
+ * * `email_missing` - email_missing
+ * * `email_not_verified` - email_not_verified
+ * * `hosted_domain_not_allowed` - hosted_domain_not_allowed
+ * * `account_inactive` - account_inactive
+ * * `link_not_allowed` - link_not_allowed
+ * * `rate_limited` - rate_limited
+ * * `provider_unavailable` - provider_unavailable
+ * * `server_error` - server_error
+ * * `not_found` - not_found
+ */
+declare enum OAuthErrorCodeEnum {
+    OAUTH_DISABLED = "oauth_disabled",
+    GITHUB_OAUTH_DISABLED = "github_oauth_disabled",
+    ORIGIN_NOT_ALLOWED = "origin_not_allowed",
+    MISSING_REDIRECT_URI = "missing_redirect_uri",
+    INVALID_STATE = "invalid_state",
+    OAUTH_EXCHANGE_FAILED = "oauth_exchange_failed",
+    INVALID_ID_TOKEN = "invalid_id_token",
+    EMAIL_MISSING = "email_missing",
+    EMAIL_NOT_VERIFIED = "email_not_verified",
+    HOSTED_DOMAIN_NOT_ALLOWED = "hosted_domain_not_allowed",
+    ACCOUNT_INACTIVE = "account_inactive",
+    LINK_NOT_ALLOWED = "link_not_allowed",
+    RATE_LIMITED = "rate_limited",
+    PROVIDER_UNAVAILABLE = "provider_unavailable",
+    SERVER_ERROR = "server_error",
+    NOT_FOUND = "not_found"
+}
+/**
+ * * `github` - GitHub
+ * * `google` - Google
+ */
+declare enum OAuthProviderEnum {
+    GITHUB = "github",
+    GOOGLE = "google"
+}
+/**
+ * One enabled sign-in provider.
+ */
+type OAuthProviderInfo = {
+    /**
+     * Provider id
+     *
+     * * `github` - GitHub
+     * * `google` - Google
+     */
+    id: OAuthProviderEnum;
+    /**
+     * Display name
+     */
+    name: string;
+    /**
+     * Icon key
+     */
+    icon: string;
+};
 /**
  * Response with JWT tokens after OAuth authentication.
  *
@@ -834,30 +898,94 @@ declare const useAutoAuth: (options?: UseAutoAuthOptions) => {
     isAllowedPath: boolean;
 };
 
+/** A provider the server can offer. Derived from the generated enum, so a new backend provider is a type error until it gets an adapter. */
+type OAuthProviderId = `${OAuthProviderEnum}`;
+/** Every `error` value the OAuth endpoints can return (closed set from the OpenAPI schema). */
+type OAuthErrorCode = `${OAuthErrorCodeEnum}`;
+/** Failures the browser detects itself, before or instead of a server answer. */
+type OAuthClientErrorCode = 'cancelled' | 'unknown_provider';
+type OAuthFailureCode = OAuthErrorCode | OAuthClientErrorCode;
+interface OAuthFailure {
+    /** Set when the cause is one the UI can explain; absent for transport faults. */
+    code?: OAuthFailureCode;
+    /** English text for callers without a translator: server prose, else a generic sentence. */
+    message: string;
+}
+/**
+ * Read `{error, error_description}` off a thrown API error.
+ *
+ * The transport keeps the parsed body on `response`; `formatAuthError` alone
+ * would surface the machine code (`invalid_state`) as if it were prose.
+ */
+declare const readOAuthFailure: (err: unknown, fallback: string) => OAuthFailure;
+
 /**
  * The user payload as the OAuth endpoint declares it.
  *
  * Derived from the generated response rather than restated, so a schema change
- * reaches callers through `make gen` instead of drifting silently. Today the
- * backend types it as a free-form object; when it names a real user model, this
- * narrows on its own.
+ * reaches callers through `make generate` instead of drifting silently.
  */
 type OAuthUser = NonNullable<OAuthTokenResponse['user']>;
-interface UseGithubAuthOptions {
+/** Provider ids this client can run, in the order the adapters are declared. */
+declare const OAUTH_PROVIDER_IDS: OAuthProviderId[];
+declare const isOAuthProviderId: (value: unknown) => value is OAuthProviderId;
+/** Forget the stored state: the attempt is over without an exchange (Cancel, a provider error). */
+declare const clearOAuthAttempt: () => void;
+interface UseOAuthLoginOptions {
     sourceUrl?: string;
-    /**
-     * The OAuth endpoint's OpenAPI schema types `user` as a free-form object, so
-     * this is what the server actually promises — not a `User`. Narrow it at the
-     * call site; typing it tighter here would be an assertion, not a fact.
-     */
-    onSuccess?: (user: OAuthUser, isNewUser: boolean) => void;
-    onError?: (error: string) => void;
-    /** Callback when 2FA is required */
+    /** The endpoint types `user` as a free-form object; narrow it at the call site. */
+    onSuccess?: (user: OAuthUser, isNewUser: boolean, provider: OAuthProviderId) => void;
+    /** `message` is server prose or an English fallback; `code` lets the caller choose its own copy. */
+    onError?: (message: string, code?: OAuthFailureCode) => void;
+    /** Called when 2FA is required instead of a session. */
     onRequires2FA?: (sessionId: string, shouldPrompt2FA: boolean) => void;
     redirectUrl?: string;
-    /** Skip automatic redirect after success (caller handles navigation) */
+    /** Skip the automatic redirect after success (the caller navigates). */
     skipRedirect?: boolean;
 }
+interface UseOAuthLoginReturn {
+    /** True from the click until the page leaves (start) or the exchange settles (complete). */
+    isLoading: boolean;
+    /** The provider whose flow is in flight; disable the other buttons, show progress on this one. */
+    loadingProvider: OAuthProviderId | null;
+    error: string | null;
+    errorCode: OAuthFailureCode | null;
+    /** Redirects the tab to the provider. Resolves only if it failed to start. */
+    start: (provider: OAuthProviderId) => Promise<void>;
+    /** Exchanges the `code` the provider returned. The stored `state` must match; there is no unchecked path. */
+    complete: (provider: OAuthProviderId, code: string, state: string) => Promise<void>;
+}
+/**
+ * Sign in with a third-party provider: one hook for every provider.
+ *
+ * Flow, full page in the same tab so the saved return URL survives:
+ * `start(provider)` stores the server's `state`, then navigates to the provider.
+ * The provider returns to `/auth?provider=<id>&code&state`; `complete(...)`
+ * verifies that `state` against the stored one (login CSRF defence), exchanges
+ * the code and writes the session.
+ */
+declare const useOAuthLogin: (options?: UseOAuthLoginOptions) => UseOAuthLoginReturn;
+
+interface UseOAuthProvidersReturn {
+    /** Providers the server has configured, in the server's display order. Empty until ready and on failure. */
+    providers: OAuthProviderInfo[];
+    /** False only while the first request is in flight and nothing is cached. */
+    isReady: boolean;
+}
+/**
+ * The sign-in providers the server offers (`GET /cfg/accounts/oauth/providers/`).
+ *
+ * Fetched once per page session and kept in `sessionStorage`, so a reload or
+ * "Try again" after a failed callback shows the buttons at once; the server
+ * answer always wins. A failure yields the cached list, else `[]`, with
+ * `isReady: true`: the email form never waits on, or breaks because of, this
+ * list. Ids this client has no adapter for (a newer backend) are dropped.
+ */
+declare const useOAuthProviders: () => UseOAuthProvidersReturn;
+
+/** @deprecated Use `UseOAuthLoginOptions`. */
+type UseGithubAuthOptions = UseOAuthLoginOptions;
+/** @deprecated Use `UseOAuthLoginReturn`. */
 interface UseGithubAuthReturn {
     isLoading: boolean;
     error: string | null;
@@ -865,23 +993,8 @@ interface UseGithubAuthReturn {
     handleGithubCallback: (code: string, state: string) => Promise<void>;
 }
 /**
- * Hook for GitHub OAuth authentication flow.
- *
- * Usage:
- * 1. Call startGithubAuth() to redirect user to GitHub
- * 2. After GitHub redirects back, call handleGithubCallback(code, state)
- *
- * @example
- * ```tsx
- * const { isLoading, error, startGithubAuth } = useGithubAuth({
- *   onSuccess: (user) => router.push('/dashboard'),
- *   onError: (error) => console.error(error),
- * });
- *
- * <Button onClick={startGithubAuth} disabled={isLoading}>
- *   Continue with GitHub
- * </Button>
- * ```
+ * @deprecated Use `useOAuthLogin` (`start('github')`, `complete('github', code, state)`).
+ * Kept for one minor release; behaviour is `useOAuthLogin` with the provider fixed.
  */
 declare const useGithubAuth: (options?: UseGithubAuthOptions) => UseGithubAuthReturn;
 
@@ -1416,4 +1529,4 @@ declare const Analytics: {
     setUser(userId: string | null): void;
 };
 
-export { AUTH_CONSTANTS, AUTH_ERROR_KEYS, type AccountsContextValue, AccountsProvider, Analytics, AnalyticsCategory, type AnalyticsCategoryType, AnalyticsEvent, type AnalyticsEventType, type AnalyticsSink, type AuthConfig, AuthContext, type AuthContextType, type AuthErrorCopy, type AuthErrorKey, type AuthFormAutoSubmit, type AuthFormReturn, type AuthFormState, type AuthFormStateHandlers, type AuthFormSubmitHandlers, type AuthFormValidation, AuthProvider, type AuthProviderProps, type AuthStep, type DeleteAccountResult, type GuardInput, type OTPRequestConsent, type OTPRequestResult, type PasswordLoginOptions, type PasswordLoginResult, type PatchedCfgUserUpdateRequest, type ProfileCacheOptions, type SessionSnapshot, type SessionStatus, type TwoFactorChallenge, type TwoFactorDevice, type TwoFactorSetupData, type UseAuthFormOptions, type UseAuthFormStateReturn, type UseAutoAuthOptions, type UseDeleteAccountReturn, type UseGithubAuthOptions, type UseGithubAuthReturn, type UseTimezoneReturn, type UseTwoFactorOptions, type UseTwoFactorReturn, type UseTwoFactorSetupOptions, type UseTwoFactorSetupReturn, type UseTwoFactorStatusReturn, type UseTwoFactorVerifyOptions, type UseTwoFactorVerifyReturn, type UserProfile, type WebmailLink, authLogger, beginTwoFactorChallenge, clearProfileCache, consumeSavedRedirect, decodeBase64, encodeBase64, endTwoFactorChallenge, formatAuthError, getCacheMetadata, getCachedProfile, hasValidCache, isAllowedAuthPath, isForbidden, logAuthFailure, logger, normalizePath, peekSavedRedirect, resolveAuthError, resolveGuardIsAuthenticated, resolveGuardIsLoading, setAnalyticsSink, setCachedProfile, shouldRedirectToAuth, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useQueryParams, useSession, useSessionStorage, useTimezone, useTwoFactor, useTwoFactorChallenge, useTwoFactorSetup, useTwoFactorStatus, useTwoFactorVerify, validateEmail, validateIdentifier };
+export { AUTH_CONSTANTS, AUTH_ERROR_KEYS, type AccountsContextValue, AccountsProvider, Analytics, AnalyticsCategory, type AnalyticsCategoryType, AnalyticsEvent, type AnalyticsEventType, type AnalyticsSink, type AuthConfig, AuthContext, type AuthContextType, type AuthErrorCopy, type AuthErrorKey, type AuthFormAutoSubmit, type AuthFormReturn, type AuthFormState, type AuthFormStateHandlers, type AuthFormSubmitHandlers, type AuthFormValidation, AuthProvider, type AuthProviderProps, type AuthStep, type DeleteAccountResult, type GuardInput, OAUTH_PROVIDER_IDS, type OAuthClientErrorCode, type OAuthErrorCode, type OAuthFailure, type OAuthFailureCode, type OAuthProviderId, type OAuthUser, type OTPRequestConsent, type OTPRequestResult, type PasswordLoginOptions, type PasswordLoginResult, type PatchedCfgUserUpdateRequest, type ProfileCacheOptions, type SessionSnapshot, type SessionStatus, type TwoFactorChallenge, type TwoFactorDevice, type TwoFactorSetupData, type UseAuthFormOptions, type UseAuthFormStateReturn, type UseAutoAuthOptions, type UseDeleteAccountReturn, type UseGithubAuthOptions, type UseGithubAuthReturn, type UseOAuthLoginOptions, type UseOAuthLoginReturn, type UseOAuthProvidersReturn, type UseTimezoneReturn, type UseTwoFactorOptions, type UseTwoFactorReturn, type UseTwoFactorSetupOptions, type UseTwoFactorSetupReturn, type UseTwoFactorStatusReturn, type UseTwoFactorVerifyOptions, type UseTwoFactorVerifyReturn, type UserProfile, type WebmailLink, authLogger, beginTwoFactorChallenge, clearOAuthAttempt, clearProfileCache, consumeSavedRedirect, decodeBase64, encodeBase64, endTwoFactorChallenge, formatAuthError, getCacheMetadata, getCachedProfile, hasValidCache, isAllowedAuthPath, isForbidden, isOAuthProviderId, logAuthFailure, logger, normalizePath, peekSavedRedirect, readOAuthFailure, resolveAuthError, resolveGuardIsAuthenticated, resolveGuardIsLoading, setAnalyticsSink, setCachedProfile, shouldRedirectToAuth, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useOAuthLogin, useOAuthProviders, useQueryParams, useSession, useSessionStorage, useTimezone, useTwoFactor, useTwoFactorChallenge, useTwoFactorSetup, useTwoFactorStatus, useTwoFactorVerify, validateEmail, validateIdentifier };

package/dist/auth.d.ts

@@ -40,6 +40,70 @@ type CfgUserUpdateRequest = {
      */
     timezone?: string;
 };
+/**
+ * * `oauth_disabled` - oauth_disabled
+ * * `github_oauth_disabled` - github_oauth_disabled
+ * * `origin_not_allowed` - origin_not_allowed
+ * * `missing_redirect_uri` - missing_redirect_uri
+ * * `invalid_state` - invalid_state
+ * * `oauth_exchange_failed` - oauth_exchange_failed
+ * * `invalid_id_token` - invalid_id_token
+ * * `email_missing` - email_missing
+ * * `email_not_verified` - email_not_verified
+ * * `hosted_domain_not_allowed` - hosted_domain_not_allowed
+ * * `account_inactive` - account_inactive
+ * * `link_not_allowed` - link_not_allowed
+ * * `rate_limited` - rate_limited
+ * * `provider_unavailable` - provider_unavailable
+ * * `server_error` - server_error
+ * * `not_found` - not_found
+ */
+declare enum OAuthErrorCodeEnum {
+    OAUTH_DISABLED = "oauth_disabled",
+    GITHUB_OAUTH_DISABLED = "github_oauth_disabled",
+    ORIGIN_NOT_ALLOWED = "origin_not_allowed",
+    MISSING_REDIRECT_URI = "missing_redirect_uri",
+    INVALID_STATE = "invalid_state",
+    OAUTH_EXCHANGE_FAILED = "oauth_exchange_failed",
+    INVALID_ID_TOKEN = "invalid_id_token",
+    EMAIL_MISSING = "email_missing",
+    EMAIL_NOT_VERIFIED = "email_not_verified",
+    HOSTED_DOMAIN_NOT_ALLOWED = "hosted_domain_not_allowed",
+    ACCOUNT_INACTIVE = "account_inactive",
+    LINK_NOT_ALLOWED = "link_not_allowed",
+    RATE_LIMITED = "rate_limited",
+    PROVIDER_UNAVAILABLE = "provider_unavailable",
+    SERVER_ERROR = "server_error",
+    NOT_FOUND = "not_found"
+}
+/**
+ * * `github` - GitHub
+ * * `google` - Google
+ */
+declare enum OAuthProviderEnum {
+    GITHUB = "github",
+    GOOGLE = "google"
+}
+/**
+ * One enabled sign-in provider.
+ */
+type OAuthProviderInfo = {
+    /**
+     * Provider id
+     *
+     * * `github` - GitHub
+     * * `google` - Google
+     */
+    id: OAuthProviderEnum;
+    /**
+     * Display name
+     */
+    name: string;
+    /**
+     * Icon key
+     */
+    icon: string;
+};
 /**
  * Response with JWT tokens after OAuth authentication.
  *
@@ -834,30 +898,94 @@ declare const useAutoAuth: (options?: UseAutoAuthOptions) => {
     isAllowedPath: boolean;
 };
 
+/** A provider the server can offer. Derived from the generated enum, so a new backend provider is a type error until it gets an adapter. */
+type OAuthProviderId = `${OAuthProviderEnum}`;
+/** Every `error` value the OAuth endpoints can return (closed set from the OpenAPI schema). */
+type OAuthErrorCode = `${OAuthErrorCodeEnum}`;
+/** Failures the browser detects itself, before or instead of a server answer. */
+type OAuthClientErrorCode = 'cancelled' | 'unknown_provider';
+type OAuthFailureCode = OAuthErrorCode | OAuthClientErrorCode;
+interface OAuthFailure {
+    /** Set when the cause is one the UI can explain; absent for transport faults. */
+    code?: OAuthFailureCode;
+    /** English text for callers without a translator: server prose, else a generic sentence. */
+    message: string;
+}
+/**
+ * Read `{error, error_description}` off a thrown API error.
+ *
+ * The transport keeps the parsed body on `response`; `formatAuthError` alone
+ * would surface the machine code (`invalid_state`) as if it were prose.
+ */
+declare const readOAuthFailure: (err: unknown, fallback: string) => OAuthFailure;
+
 /**
  * The user payload as the OAuth endpoint declares it.
  *
  * Derived from the generated response rather than restated, so a schema change
- * reaches callers through `make gen` instead of drifting silently. Today the
- * backend types it as a free-form object; when it names a real user model, this
- * narrows on its own.
+ * reaches callers through `make generate` instead of drifting silently.
  */
 type OAuthUser = NonNullable<OAuthTokenResponse['user']>;
-interface UseGithubAuthOptions {
+/** Provider ids this client can run, in the order the adapters are declared. */
+declare const OAUTH_PROVIDER_IDS: OAuthProviderId[];
+declare const isOAuthProviderId: (value: unknown) => value is OAuthProviderId;
+/** Forget the stored state: the attempt is over without an exchange (Cancel, a provider error). */
+declare const clearOAuthAttempt: () => void;
+interface UseOAuthLoginOptions {
     sourceUrl?: string;
-    /**
-     * The OAuth endpoint's OpenAPI schema types `user` as a free-form object, so
-     * this is what the server actually promises — not a `User`. Narrow it at the
-     * call site; typing it tighter here would be an assertion, not a fact.
-     */
-    onSuccess?: (user: OAuthUser, isNewUser: boolean) => void;
-    onError?: (error: string) => void;
-    /** Callback when 2FA is required */
+    /** The endpoint types `user` as a free-form object; narrow it at the call site. */
+    onSuccess?: (user: OAuthUser, isNewUser: boolean, provider: OAuthProviderId) => void;
+    /** `message` is server prose or an English fallback; `code` lets the caller choose its own copy. */
+    onError?: (message: string, code?: OAuthFailureCode) => void;
+    /** Called when 2FA is required instead of a session. */
     onRequires2FA?: (sessionId: string, shouldPrompt2FA: boolean) => void;
     redirectUrl?: string;
-    /** Skip automatic redirect after success (caller handles navigation) */
+    /** Skip the automatic redirect after success (the caller navigates). */
     skipRedirect?: boolean;
 }
+interface UseOAuthLoginReturn {
+    /** True from the click until the page leaves (start) or the exchange settles (complete). */
+    isLoading: boolean;
+    /** The provider whose flow is in flight; disable the other buttons, show progress on this one. */
+    loadingProvider: OAuthProviderId | null;
+    error: string | null;
+    errorCode: OAuthFailureCode | null;
+    /** Redirects the tab to the provider. Resolves only if it failed to start. */
+    start: (provider: OAuthProviderId) => Promise<void>;
+    /** Exchanges the `code` the provider returned. The stored `state` must match; there is no unchecked path. */
+    complete: (provider: OAuthProviderId, code: string, state: string) => Promise<void>;
+}
+/**
+ * Sign in with a third-party provider: one hook for every provider.
+ *
+ * Flow, full page in the same tab so the saved return URL survives:
+ * `start(provider)` stores the server's `state`, then navigates to the provider.
+ * The provider returns to `/auth?provider=<id>&code&state`; `complete(...)`
+ * verifies that `state` against the stored one (login CSRF defence), exchanges
+ * the code and writes the session.
+ */
+declare const useOAuthLogin: (options?: UseOAuthLoginOptions) => UseOAuthLoginReturn;
+
+interface UseOAuthProvidersReturn {
+    /** Providers the server has configured, in the server's display order. Empty until ready and on failure. */
+    providers: OAuthProviderInfo[];
+    /** False only while the first request is in flight and nothing is cached. */
+    isReady: boolean;
+}
+/**
+ * The sign-in providers the server offers (`GET /cfg/accounts/oauth/providers/`).
+ *
+ * Fetched once per page session and kept in `sessionStorage`, so a reload or
+ * "Try again" after a failed callback shows the buttons at once; the server
+ * answer always wins. A failure yields the cached list, else `[]`, with
+ * `isReady: true`: the email form never waits on, or breaks because of, this
+ * list. Ids this client has no adapter for (a newer backend) are dropped.
+ */
+declare const useOAuthProviders: () => UseOAuthProvidersReturn;
+
+/** @deprecated Use `UseOAuthLoginOptions`. */
+type UseGithubAuthOptions = UseOAuthLoginOptions;
+/** @deprecated Use `UseOAuthLoginReturn`. */
 interface UseGithubAuthReturn {
     isLoading: boolean;
     error: string | null;
@@ -865,23 +993,8 @@ interface UseGithubAuthReturn {
     handleGithubCallback: (code: string, state: string) => Promise<void>;
 }
 /**
- * Hook for GitHub OAuth authentication flow.
- *
- * Usage:
- * 1. Call startGithubAuth() to redirect user to GitHub
- * 2. After GitHub redirects back, call handleGithubCallback(code, state)
- *
- * @example
- * ```tsx
- * const { isLoading, error, startGithubAuth } = useGithubAuth({
- *   onSuccess: (user) => router.push('/dashboard'),
- *   onError: (error) => console.error(error),
- * });
- *
- * <Button onClick={startGithubAuth} disabled={isLoading}>
- *   Continue with GitHub
- * </Button>
- * ```
+ * @deprecated Use `useOAuthLogin` (`start('github')`, `complete('github', code, state)`).
+ * Kept for one minor release; behaviour is `useOAuthLogin` with the provider fixed.
  */
 declare const useGithubAuth: (options?: UseGithubAuthOptions) => UseGithubAuthReturn;
 
@@ -1416,4 +1529,4 @@ declare const Analytics: {
     setUser(userId: string | null): void;
 };
 
-export { AUTH_CONSTANTS, AUTH_ERROR_KEYS, type AccountsContextValue, AccountsProvider, Analytics, AnalyticsCategory, type AnalyticsCategoryType, AnalyticsEvent, type AnalyticsEventType, type AnalyticsSink, type AuthConfig, AuthContext, type AuthContextType, type AuthErrorCopy, type AuthErrorKey, type AuthFormAutoSubmit, type AuthFormReturn, type AuthFormState, type AuthFormStateHandlers, type AuthFormSubmitHandlers, type AuthFormValidation, AuthProvider, type AuthProviderProps, type AuthStep, type DeleteAccountResult, type GuardInput, type OTPRequestConsent, type OTPRequestResult, type PasswordLoginOptions, type PasswordLoginResult, type PatchedCfgUserUpdateRequest, type ProfileCacheOptions, type SessionSnapshot, type SessionStatus, type TwoFactorChallenge, type TwoFactorDevice, type TwoFactorSetupData, type UseAuthFormOptions, type UseAuthFormStateReturn, type UseAutoAuthOptions, type UseDeleteAccountReturn, type UseGithubAuthOptions, type UseGithubAuthReturn, type UseTimezoneReturn, type UseTwoFactorOptions, type UseTwoFactorReturn, type UseTwoFactorSetupOptions, type UseTwoFactorSetupReturn, type UseTwoFactorStatusReturn, type UseTwoFactorVerifyOptions, type UseTwoFactorVerifyReturn, type UserProfile, type WebmailLink, authLogger, beginTwoFactorChallenge, clearProfileCache, consumeSavedRedirect, decodeBase64, encodeBase64, endTwoFactorChallenge, formatAuthError, getCacheMetadata, getCachedProfile, hasValidCache, isAllowedAuthPath, isForbidden, logAuthFailure, logger, normalizePath, peekSavedRedirect, resolveAuthError, resolveGuardIsAuthenticated, resolveGuardIsLoading, setAnalyticsSink, setCachedProfile, shouldRedirectToAuth, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useQueryParams, useSession, useSessionStorage, useTimezone, useTwoFactor, useTwoFactorChallenge, useTwoFactorSetup, useTwoFactorStatus, useTwoFactorVerify, validateEmail, validateIdentifier };
+export { AUTH_CONSTANTS, AUTH_ERROR_KEYS, type AccountsContextValue, AccountsProvider, Analytics, AnalyticsCategory, type AnalyticsCategoryType, AnalyticsEvent, type AnalyticsEventType, type AnalyticsSink, type AuthConfig, AuthContext, type AuthContextType, type AuthErrorCopy, type AuthErrorKey, type AuthFormAutoSubmit, type AuthFormReturn, type AuthFormState, type AuthFormStateHandlers, type AuthFormSubmitHandlers, type AuthFormValidation, AuthProvider, type AuthProviderProps, type AuthStep, type DeleteAccountResult, type GuardInput, OAUTH_PROVIDER_IDS, type OAuthClientErrorCode, type OAuthErrorCode, type OAuthFailure, type OAuthFailureCode, type OAuthProviderId, type OAuthUser, type OTPRequestConsent, type OTPRequestResult, type PasswordLoginOptions, type PasswordLoginResult, type PatchedCfgUserUpdateRequest, type ProfileCacheOptions, type SessionSnapshot, type SessionStatus, type TwoFactorChallenge, type TwoFactorDevice, type TwoFactorSetupData, type UseAuthFormOptions, type UseAuthFormStateReturn, type UseAutoAuthOptions, type UseDeleteAccountReturn, type UseGithubAuthOptions, type UseGithubAuthReturn, type UseOAuthLoginOptions, type UseOAuthLoginReturn, type UseOAuthProvidersReturn, type UseTimezoneReturn, type UseTwoFactorOptions, type UseTwoFactorReturn, type UseTwoFactorSetupOptions, type UseTwoFactorSetupReturn, type UseTwoFactorStatusReturn, type UseTwoFactorVerifyOptions, type UseTwoFactorVerifyReturn, type UserProfile, type WebmailLink, authLogger, beginTwoFactorChallenge, clearOAuthAttempt, clearProfileCache, consumeSavedRedirect, decodeBase64, encodeBase64, endTwoFactorChallenge, formatAuthError, getCacheMetadata, getCachedProfile, hasValidCache, isAllowedAuthPath, isForbidden, isOAuthProviderId, logAuthFailure, logger, normalizePath, peekSavedRedirect, readOAuthFailure, resolveAuthError, resolveGuardIsAuthenticated, resolveGuardIsLoading, setAnalyticsSink, setCachedProfile, shouldRedirectToAuth, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useOAuthLogin, useOAuthProviders, useQueryParams, useSession, useSessionStorage, useTimezone, useTwoFactor, useTwoFactorChallenge, useTwoFactorSetup, useTwoFactorStatus, useTwoFactorVerify, validateEmail, validateIdentifier };