@estifanos-sh/convex-auth 0.0.1-preview.0

package/dist/providers/apple.js

@@ -0,0 +1,57 @@
+import { createArcticOAuthClient, createOAuthProvider } from "../server/oauth/factory.js";
+import { defaultOAuthRedirectUri } from "./redirect.js";
+import { Apple } from "arctic";
+
+//#region src/providers/apple.ts
+/**
+* Apple OAuth provider.
+*
+* ```ts
+* import { apple } from "@estifanos-sh/convex-auth/providers/apple";
+*
+* apple({
+*   clientId: env.AUTH_APPLE_ID!,
+*   teamId: env.AUTH_APPLE_TEAM_ID!,
+*   keyId: env.AUTH_APPLE_KEY_ID!,
+*   privateKey: env.AUTH_APPLE_PRIVATE_KEY!,
+* })
+* ```
+*
+* @module
+*/
+const DEFAULT_SCOPES = ["name", "email"];
+/**
+* Create an Apple OAuth provider.
+*
+* @param config - Apple Sign In client settings and signing key material.
+* @returns A configured Apple OAuth provider for `defineAuth`.
+* @throws {Error} When no callback URL can be derived and `redirectUri` is omitted.
+*
+* @example
+* ```ts
+* import { apple } from "@estifanos-sh/convex-auth/providers/apple";
+*
+* apple({
+*   clientId: env.AUTH_APPLE_ID!,
+*   teamId: env.AUTH_APPLE_TEAM_ID!,
+*   keyId: env.AUTH_APPLE_KEY_ID!,
+*   privateKey: env.AUTH_APPLE_PRIVATE_KEY!,
+* })
+* ```
+*/
+function apple(config) {
+	const privateKey = typeof config.privateKey === "string" ? config.privateKey : new TextDecoder().decode(config.privateKey);
+	const scopes = config.scopes ?? DEFAULT_SCOPES;
+	const createProvider = (redirectUri) => new Apple(config.clientId, config.teamId, config.keyId, new TextEncoder().encode(privateKey), config.redirectUri ?? defaultOAuthRedirectUri("apple", redirectUri));
+	return createOAuthProvider({
+		id: "apple",
+		provider: createArcticOAuthClient(createProvider, { pkce: "never" }),
+		scopes,
+		accountLinking: config.accountLinking,
+		updateProfileOnLogin: config.updateProfileOnLogin
+	});
+}
+
+//#endregion
+export { apple };
+//# sourceMappingURL=apple.js.map

package/dist/providers/connection.d.ts

@@ -0,0 +1,30 @@
+import { ConnectionProviderConfig } from "../server/types.js";
+
+//#region src/providers/connection.d.ts
+/**
+ * Create the group Connection provider.
+ *
+ * @param options - Optional Connection provider settings.
+ * @param options.redirectURI - Override the callback URI used for provider
+ *   initiated sign-in flows.
+ * @returns A provider that enables the `auth.connection.*` admin facade and
+ * registers the runtime Connection routes.
+ *
+ * @example
+ * ```ts
+ * import { connection } from "@estifanos-sh/convex-auth/providers";
+ *
+ * connection()
+ * ```
+ *
+ * @example
+ * ```ts
+ * connection({ redirectURI: "https://app.example.com/auth/connection/callback" })
+ * ```
+ */
+declare function connection(options?: {
+  redirectURI?: string;
+}): ConnectionProviderConfig;
+//#endregion
+export { connection };
+//# sourceMappingURL=connection.d.ts.map

package/dist/providers/connection.js

@@ -0,0 +1,33 @@
+//#region src/providers/connection.ts
+/**
+* Create the group Connection provider.
+*
+* @param options - Optional Connection provider settings.
+* @param options.redirectURI - Override the callback URI used for provider
+*   initiated sign-in flows.
+* @returns A provider that enables the `auth.connection.*` admin facade and
+* registers the runtime Connection routes.
+*
+* @example
+* ```ts
+* import { connection } from "@estifanos-sh/convex-auth/providers";
+*
+* connection()
+* ```
+*
+* @example
+* ```ts
+* connection({ redirectURI: "https://app.example.com/auth/connection/callback" })
+* ```
+*/
+function connection(options) {
+	return {
+		id: "connection",
+		type: "connection",
+		redirectURI: options?.redirectURI
+	};
+}
+
+//#endregion
+export { connection };
+//# sourceMappingURL=connection.js.map

package/dist/providers/credentials.d.ts

@@ -0,0 +1,78 @@
+import { Hashed } from "../shared/brand.js";
+import { SignInFlowResult } from "../shared/results.js";
+import { SessionIssuance } from "../server/session/lifecycle.js";
+import { AuthProfile } from "../server/payloads.js";
+import { AuthProviderConfig, ConvexCredentialsConfig, GenericActionCtxWithAuthConfig } from "../server/types.js";
+import { GenericId, Value } from "convex/values";
+import { GenericDataModel } from "convex/server";
+
+//#region src/providers/credentials.d.ts
+type CredentialsProvisioning = {
+  /** Stable provider-owned identifier and optional credential secret. */account: {
+    id: string;
+    secret?: string;
+  }; /** User profile established by the provider's verified ceremony. */
+  profile: AuthProfile; /** Verified profile fields that may safely match an existing user. */
+  match?: Array<"email" | "phone">;
+};
+type CredentialsAuthorizeResult = {
+  userId: GenericId<"User">;
+  sessionId?: GenericId<"Session">;
+  /**
+   * TOTP step-up hint. `false` skips the verified-TOTP lookup;
+   * `true`/`undefined` falls back to it.
+   */
+  hasTotp?: boolean;
+  /**
+   * Pre-issued session from a combined verify+issue mutation. When set,
+   * the framework skips the second `callSignIn` mutation and finalizes
+   * the issuance directly on the action side.
+   */
+  issuance?: SessionIssuance;
+} | {
+  /** Provision or retrieve the provider account before issuing a session. */provision: CredentialsProvisioning; /** TOTP step-up hint for the resulting user. */
+  hasTotp?: boolean;
+} | Exclude<SignInFlowResult<null>, {
+  kind: "signedIn";
+}> | null;
+/** Configuration for the {@link credentials} provider. */
+interface CredentialsConfig<DataModel extends GenericDataModel = GenericDataModel> {
+  /** Stable provider identifier used in `signIn("<id>")`. */
+  id?: string;
+  /**
+   * Validate the submitted credentials and return the authenticated user or
+   * verified identity to provision.
+   * Return `null` to reject the sign-in attempt.
+   */
+  authorize: (credentials: Partial<Record<string, Value | undefined>>, ctx: GenericActionCtxWithAuthConfig<DataModel>) => Promise<CredentialsAuthorizeResult>;
+  /** Optional hashing helpers for password-style credential verification. */
+  crypto?: {
+    hashSecret: (secret: string) => Promise<Hashed<"Password">>;
+    verifySecret: (secret: string, hash: Hashed<"Password">) => Promise<boolean>;
+  };
+  /** Additional providers to register alongside this credentials provider. */
+  extraProviders?: (AuthProviderConfig | undefined)[];
+}
+/**
+ * Create a credentials provider for custom sign-in logic.
+ *
+ * @typeParam DataModel - The Convex data model used by the auth context.
+ * @param config - Custom authorization and hashing hooks.
+ * @returns A configured credentials provider for `defineAuth`.
+ *
+ * @example
+ * ```ts
+ * import { credentials } from "@estifanos-sh/convex-auth/providers";
+ *
+ * credentials({
+ *   authorize: async (params, ctx) => {
+ *     const user = await lookupUser(params.email, params.password, ctx);
+ *     return user ? { userId: user._id } : null;
+ *   },
+ * })
+ * ```
+ */
+declare function credentials<DataModel extends GenericDataModel = GenericDataModel>(config: CredentialsConfig<DataModel>): ConvexCredentialsConfig<DataModel>;
+//#endregion
+export { CredentialsAuthorizeResult, CredentialsConfig, CredentialsProvisioning, credentials };
+//# sourceMappingURL=credentials.d.ts.map

package/dist/providers/credentials.js

@@ -0,0 +1,31 @@
+//#region src/providers/credentials.ts
+/**
+* Create a credentials provider for custom sign-in logic.
+*
+* @typeParam DataModel - The Convex data model used by the auth context.
+* @param config - Custom authorization and hashing hooks.
+* @returns A configured credentials provider for `defineAuth`.
+*
+* @example
+* ```ts
+* import { credentials } from "@estifanos-sh/convex-auth/providers";
+*
+* credentials({
+*   authorize: async (params, ctx) => {
+*     const user = await lookupUser(params.email, params.password, ctx);
+*     return user ? { userId: user._id } : null;
+*   },
+* })
+* ```
+*/
+function credentials(config) {
+	return {
+		...config,
+		id: config.id ?? "credentials",
+		type: "credentials"
+	};
+}
+
+//#endregion
+export { credentials };
+//# sourceMappingURL=credentials.js.map

package/dist/providers/custom.d.ts

@@ -0,0 +1,96 @@
+import { OAuthMaterializedConfig, OAuthProfile, OAuthTokens } from "../server/types.js";
+
+//#region src/providers/custom.d.ts
+type ScopeSeparator = " " | ",";
+type PkceMode = "required" | "optional" | "never";
+type TokenAuthMethod = "basic" | "body" | "none";
+/** Configuration for the custom provider authorization URL. */
+interface CustomOAuthAuthorizationConfig {
+  /** Authorization endpoint URL. */
+  url: string;
+  /** PKCE requirement for this provider's authorization flow. */
+  pkce?: PkceMode;
+  /** Query parameter name used for the client ID. */
+  clientIdParam?: string;
+  /** Query parameter name used for scopes. */
+  scopeParam?: string;
+  /** Separator used when joining multiple scopes. */
+  scopeSeparator?: ScopeSeparator;
+  /** Additional query parameters appended to the authorization URL. */
+  extraParams?: Record<string, string>;
+}
+/** Configuration for the custom provider token exchange request. */
+interface CustomOAuthTokenConfig {
+  /** Token endpoint URL. */
+  url: string;
+  /** How client credentials are sent to the token endpoint. */
+  authMethod?: TokenAuthMethod;
+  /** Form field name used for the client ID. */
+  clientIdParam?: string;
+  /** Form field name used for the client secret. */
+  clientSecretParam?: string;
+  /** Form field name used for the PKCE code verifier. */
+  codeVerifierParam?: string;
+  /** Form field name used for scopes. */
+  scopeParam?: string;
+  /** Separator used when joining multiple scopes. */
+  scopeSeparator?: ScopeSeparator;
+  /** Whether to include the redirect URI in token requests. */
+  includeRedirectUri?: boolean;
+  /** Whether to include configured scopes in token requests. */
+  includeScopes?: boolean;
+  /** Additional form parameters appended to token requests. */
+  extraParams?: Record<string, string>;
+}
+/** Configuration for the {@link custom} provider. */
+interface CustomOAuthConfig {
+  /** Stable provider identifier used in `signIn("<id>")`. */
+  id: string;
+  /** OAuth client identifier. */
+  clientId: string;
+  /** Optional OAuth client secret. */
+  clientSecret?: string | null;
+  /** Optional callback URL override. Defaults to the auth site URL plus `/callback/<id>`. */
+  redirectUri?: string;
+  /** Optional default scopes requested during sign-in. */
+  scopes?: string[];
+  /** Account-linking strategy for existing users with matching email addresses. */
+  accountLinking?: "verifiedEmail" | "none";
+  /** On returning sign-in, refresh `User.name`/`image`/`email` from the new profile. Defaults to `true`. */
+  updateProfileOnLogin?: boolean;
+  /** Whether the provider requires nonce generation and validation. */
+  nonce?: boolean;
+  /** Authorization endpoint configuration. */
+  authorization: CustomOAuthAuthorizationConfig;
+  /** Token exchange endpoint configuration. */
+  token: CustomOAuthTokenConfig;
+  /** Optional profile loader that converts OAuth tokens into a normalized profile. */
+  profile?: (tokens: OAuthTokens) => Promise<OAuthProfile>;
+  /** Optional token validation hook for provider-specific checks. */
+  validateTokens?: (tokens: OAuthTokens, ctx: {
+    nonce?: string;
+  }) => Promise<void>;
+}
+/**
+ * Create a custom OAuth provider.
+ *
+ * @param config - OAuth endpoints, credentials, and profile callbacks.
+ * @returns A configured OAuth provider for `defineAuth`.
+ *
+ * @example
+ * ```ts
+ * import { custom } from "@estifanos-sh/convex-auth/providers";
+ *
+ * custom({
+ *   id: "workos",
+ *   clientId: env.WORKOS_CLIENT_ID!,
+ *   clientSecret: env.WORKOS_CLIENT_SECRET!,
+ *   authorization: { url: "https://api.workos.com/connection/authorize" },
+ *   token: { url: "https://api.workos.com/connection/token", authMethod: "basic" },
+ * })
+ * ```
+ */
+declare function custom(config: CustomOAuthConfig): OAuthMaterializedConfig;
+//#endregion
+export { CustomOAuthAuthorizationConfig, CustomOAuthConfig, CustomOAuthTokenConfig, custom };
+//# sourceMappingURL=custom.d.ts.map

package/dist/providers/custom.js

@@ -0,0 +1,108 @@
+import { normalizeOAuthTokenResponse } from "../server/oauth/normalize.js";
+import { createOAuthProvider } from "../server/oauth/factory.js";
+import { defaultOAuthRedirectUri } from "./redirect.js";
+import { sha256 } from "@oslojs/crypto/sha2";
+import { encodeBase64urlNoPadding } from "@oslojs/encoding";
+
+//#region src/providers/custom.ts
+/**
+* Custom OAuth provider.
+*
+* Use this as an escape hatch for OAuth providers that do not have a first-
+* party wrapper yet.
+*
+* @module
+*/
+function joinScopes(scopes, separator = " ") {
+	return scopes.join(separator);
+}
+function createCodeChallenge(codeVerifier) {
+	return encodeBase64urlNoPadding(sha256(new TextEncoder().encode(codeVerifier)));
+}
+function createRuntimeClient(config) {
+	const authorization = config.authorization;
+	const token = config.token;
+	const pkce = authorization.pkce ?? "required";
+	const scopes = [...config.scopes ?? []];
+	const getRedirectUri = (redirectUri) => config.redirectUri ?? defaultOAuthRedirectUri(config.id, redirectUri);
+	return {
+		pkce,
+		createAuthorizationURL({ state, codeVerifier, scopes: requestedScopes, nonce, redirectUri: runtimeRedirectUri }) {
+			const redirectUri = getRedirectUri(runtimeRedirectUri);
+			const url = new URL(authorization.url);
+			const nextScopes = requestedScopes.length > 0 ? requestedScopes : scopes;
+			url.searchParams.set("response_type", "code");
+			url.searchParams.set(authorization.clientIdParam ?? "client_id", config.clientId);
+			url.searchParams.set("redirect_uri", redirectUri);
+			url.searchParams.set("state", state);
+			if (nextScopes.length > 0) url.searchParams.set(authorization.scopeParam ?? "scope", joinScopes(nextScopes, authorization.scopeSeparator));
+			if (codeVerifier !== void 0 && pkce !== "never") {
+				url.searchParams.set("code_challenge_method", "S256");
+				url.searchParams.set("code_challenge", createCodeChallenge(codeVerifier));
+			}
+			if (nonce !== void 0) url.searchParams.set("nonce", nonce);
+			for (const [key, value] of Object.entries(authorization.extraParams ?? {})) url.searchParams.set(key, value);
+			return url;
+		},
+		async validateAuthorizationCode({ code, codeVerifier, redirectUri: runtimeRedirectUri }) {
+			const redirectUri = getRedirectUri(runtimeRedirectUri);
+			const body = new URLSearchParams();
+			body.set("grant_type", "authorization_code");
+			body.set("code", code);
+			if (token.includeRedirectUri ?? true) body.set("redirect_uri", redirectUri);
+			if (pkce !== "never" && codeVerifier !== void 0) body.set(token.codeVerifierParam ?? "code_verifier", codeVerifier);
+			if (token.includeScopes === true && scopes.length > 0) body.set(token.scopeParam ?? "scope", joinScopes(scopes, token.scopeSeparator ?? authorization.scopeSeparator));
+			if (token.authMethod !== "basic") body.set(token.clientIdParam ?? "client_id", config.clientId);
+			if (token.authMethod !== "basic" && token.authMethod !== "none" && config.clientSecret) body.set(token.clientSecretParam ?? "client_secret", config.clientSecret);
+			for (const [key, value] of Object.entries(token.extraParams ?? {})) body.set(key, value);
+			const headers = new Headers({ "Content-Type": "application/x-www-form-urlencoded" });
+			if (token.authMethod === "basic") {
+				if (!config.clientSecret) throw new Error(`OAuth provider "${config.id}" requires clientSecret for token.authMethod="basic".`);
+				const credentials = btoa(`${config.clientId}:${config.clientSecret}`);
+				headers.set("Authorization", `Basic ${credentials}`);
+			}
+			const response = await fetch(token.url, {
+				method: "POST",
+				headers,
+				body
+			});
+			if (!response.ok) throw new Error(`OAuth token exchange failed: ${response.status}`);
+			return normalizeOAuthTokenResponse(await response.json());
+		}
+	};
+}
+/**
+* Create a custom OAuth provider.
+*
+* @param config - OAuth endpoints, credentials, and profile callbacks.
+* @returns A configured OAuth provider for `defineAuth`.
+*
+* @example
+* ```ts
+* import { custom } from "@estifanos-sh/convex-auth/providers";
+*
+* custom({
+*   id: "workos",
+*   clientId: env.WORKOS_CLIENT_ID!,
+*   clientSecret: env.WORKOS_CLIENT_SECRET!,
+*   authorization: { url: "https://api.workos.com/connection/authorize" },
+*   token: { url: "https://api.workos.com/connection/token", authMethod: "basic" },
+* })
+* ```
+*/
+function custom(config) {
+	return createOAuthProvider({
+		id: config.id,
+		provider: createRuntimeClient(config),
+		scopes: config.scopes ?? [],
+		profile: config.profile,
+		nonce: config.nonce,
+		validateTokens: config.validateTokens,
+		accountLinking: config.accountLinking,
+		updateProfileOnLogin: config.updateProfileOnLogin
+	});
+}
+
+//#endregion
+export { custom };
+//# sourceMappingURL=custom.js.map

package/dist/providers/device.d.ts

@@ -0,0 +1,33 @@
+import { DeviceProviderConfig } from "../server/types.js";
+
+//#region src/providers/device.d.ts
+/** Configuration for the {@link device} provider. */
+interface DeviceConfig {
+  /** Character set used to generate the short user code. */
+  charset?: string;
+  /** Number of characters in the generated user code. */
+  userCodeLength?: number;
+  /** Device code lifetime in seconds. */
+  expiresIn?: number;
+  /** Polling interval in seconds suggested to the device client. */
+  interval?: number;
+  /** Verification page URL shown to the user on the device. */
+  verificationUri?: string;
+}
+/**
+ * Create a device authorization provider.
+ *
+ * @param config - Optional device flow code and polling settings.
+ * @returns A configured device flow provider for `defineAuth`.
+ *
+ * @example
+ * ```ts
+ * import { device } from "@estifanos-sh/convex-auth/providers";
+ *
+ * device({ verificationUri: "https://example.com/device" })
+ * ```
+ */
+declare function device(config?: DeviceConfig): DeviceProviderConfig;
+//#endregion
+export { DeviceConfig, device };
+//# sourceMappingURL=device.d.ts.map

package/dist/providers/device.js

@@ -0,0 +1,30 @@
+//#region src/providers/device.ts
+const DEFAULT_CHARSET = "BCDFGHJKLMNPQRSTVWXZ";
+/**
+* Create a device authorization provider.
+*
+* @param config - Optional device flow code and polling settings.
+* @returns A configured device flow provider for `defineAuth`.
+*
+* @example
+* ```ts
+* import { device } from "@estifanos-sh/convex-auth/providers";
+*
+* device({ verificationUri: "https://example.com/device" })
+* ```
+*/
+function device(config = {}) {
+	return {
+		id: "device",
+		type: "device",
+		charset: config.charset ?? DEFAULT_CHARSET,
+		userCodeLength: config.userCodeLength ?? 8,
+		expiresIn: config.expiresIn ?? 900,
+		interval: config.interval ?? 5,
+		verificationUri: config.verificationUri
+	};
+}
+
+//#endregion
+export { device };
+//# sourceMappingURL=device.js.map

package/dist/providers/email.d.ts

@@ -0,0 +1,45 @@
+import { EmailConfig } from "../server/types.js";
+import { AnyDataModel, GenericActionCtx } from "convex/server";
+
+//#region src/providers/email.d.ts
+/** Configuration for the {@link email} provider. */
+interface EmailProviderConfig {
+  /** Sender address used for outgoing verification emails. */
+  from: string;
+  /** Delivery callback that actually sends the rendered verification email. */
+  send: (ctx: GenericActionCtx<AnyDataModel>, opts: {
+    from: string;
+    to: string;
+    subject: string;
+    html: string;
+  }) => Promise<void>;
+  /** Optional custom token generator for OTP or magic-link flows. */
+  generateVerificationToken?: () => Promise<string>;
+  /** Stable provider identifier used in `signIn("<id>")`. */
+  id?: string;
+  /** Verification token lifetime in seconds. */
+  maxAge?: number;
+}
+/**
+ * Create an email magic link or OTP provider.
+ *
+ * @param config - Sender identity and delivery hooks for verification emails.
+ * @returns A configured email provider for `defineAuth`.
+ * @throws {Error} When `from` is empty.
+ *
+ * @example
+ * ```ts
+ * import { email } from "@estifanos-sh/convex-auth/providers";
+ *
+ * email({
+ *   from: "My App <noreply@example.com>",
+ *   send: async (_ctx, message) => {
+ *     await resend.emails.send(message);
+ *   },
+ * })
+ * ```
+ */
+declare function email(config: EmailProviderConfig): EmailConfig;
+//#endregion
+export { EmailProviderConfig, email };
+//# sourceMappingURL=email.d.ts.map

package/dist/providers/email.js

@@ -0,0 +1,52 @@
+import { defaultMagicLinkEmail } from "../server/templates.js";
+
+//#region src/providers/email.ts
+/**
+* Create an email magic link or OTP provider.
+*
+* @param config - Sender identity and delivery hooks for verification emails.
+* @returns A configured email provider for `defineAuth`.
+* @throws {Error} When `from` is empty.
+*
+* @example
+* ```ts
+* import { email } from "@estifanos-sh/convex-auth/providers";
+*
+* email({
+*   from: "My App <noreply@example.com>",
+*   send: async (_ctx, message) => {
+*     await resend.emails.send(message);
+*   },
+* })
+* ```
+*/
+function email(config) {
+	const from = config.from.trim();
+	if (from.length === 0) throw new Error("Email provider requires a non-empty `from` address (for example, `\"My App <noreply@example.com>\"`).");
+	const { send } = config;
+	const { generateVerificationToken } = config;
+	return {
+		id: config.id ?? "email",
+		type: "email",
+		name: "Email",
+		from,
+		maxAge: config.maxAge ?? 3600 * 24,
+		authorize: void 0,
+		sendVerificationRequest: async ({ identifier, url }, ctx) => {
+			if (!ctx) throw new Error("Email provider requires a Convex action context.");
+			const { host } = new URL(url);
+			await send(ctx, {
+				from,
+				to: identifier,
+				subject: `Sign in to ${host}`,
+				html: defaultMagicLinkEmail(url, host)
+			});
+		},
+		generateVerificationToken,
+		options: { from }
+	};
+}
+
+//#endregion
+export { email };
+//# sourceMappingURL=email.js.map

package/dist/providers/github.d.ts

@@ -0,0 +1,56 @@
+import { OAuthMaterializedConfig } from "../server/types.js";
+
+//#region src/providers/github.d.ts
+/**
+ * GitHub OAuth provider.
+ *
+ * ```ts
+ * import { github } from "@estifanos-sh/convex-auth/providers/github";
+ *
+ * github({
+ *   clientId: env.AUTH_GITHUB_ID!,
+ *   clientSecret: env.AUTH_GITHUB_SECRET!,
+ * })
+ * ```
+ *
+ * @module
+ */
+/** Configuration for the {@link github} provider. */
+interface GitHubConfig {
+  /** OAuth app client ID from GitHub. */
+  clientId: string;
+  /** OAuth app client secret from GitHub. */
+  clientSecret: string;
+  /** Optional callback URL override. Defaults to the auth site URL plus `/callback/github`. */
+  redirectUri?: string;
+  /** Optional OAuth scopes. Defaults to `user:email`. */
+  scopes?: string[];
+  /** Account-linking strategy for existing users with matching email addresses. */
+  accountLinking?: "verifiedEmail" | "none";
+  /** On returning sign-in, refresh `User.name`/`image`/`email` from the new profile. Defaults to `true`. */
+  updateProfileOnLogin?: boolean;
+}
+/**
+ * Create a GitHub OAuth provider.
+ *
+ * GitHub is not OIDC by default, so this wrapper fetches the profile and email
+ * data for you after the OAuth code exchange.
+ *
+ * @param config - GitHub OAuth client settings.
+ * @returns A configured GitHub OAuth provider for `defineAuth`.
+ * @throws {Error} When no callback URL can be derived and `redirectUri` is omitted.
+ *
+ * @example
+ * ```ts
+ * import { github } from "@estifanos-sh/convex-auth/providers/github";
+ *
+ * github({
+ *   clientId: env.AUTH_GITHUB_ID!,
+ *   clientSecret: env.AUTH_GITHUB_SECRET!,
+ * })
+ * ```
+ */
+declare function github(config: GitHubConfig): OAuthMaterializedConfig;
+//#endregion
+export { GitHubConfig, github };
+//# sourceMappingURL=github.d.ts.map