@exvio/os-backend-core 0.4.0

package/src/ai/types.ts

@@ -0,0 +1,282 @@
+export type AIProviderName = string
+export type AIOperation = 'text' | 'content' | 'chat' | 'stream' | 'object' | 'embed'
+
+export type JSONPrimitive = string | number | boolean | null
+export type JSONValue = JSONPrimitive | { readonly [key: string]: JSONValue } | readonly JSONValue[]
+export type JSONSchema = Readonly<Record<string, unknown>>
+
+export interface AIModelRef {
+  readonly provider: AIProviderName
+  readonly model: string
+}
+
+/** Short alias used by pricing and application adapters. */
+export type AIModel = AIModelRef
+
+export interface AIProviderConfig {
+  readonly apiKey?: string
+  /** Complete request endpoint. Prefer this name in new configuration. */
+  readonly endpoint?: string
+  /** @deprecated Legacy consumer field; interpreted as a complete endpoint. */
+  readonly baseUrl?: string
+  readonly settings?: Readonly<Record<string, unknown>>
+}
+
+export interface AIConfig {
+  readonly providers: Readonly<Record<AIProviderName, AIProviderConfig>>
+  readonly lanes: Readonly<Record<string, AIModelRef>>
+}
+
+export interface AIUsage {
+  readonly inputTokens: number
+  readonly outputTokens: number
+  readonly totalTokens: number
+  readonly cachedInputTokens?: number
+  readonly cacheMissInputTokens?: number
+  readonly reasoningTokens?: number
+}
+
+export type AIFinishReason =
+  | 'stop'
+  | 'length'
+  | 'tool_calls'
+  | 'content_filter'
+  | 'error'
+  | 'other'
+
+export interface AIResult<T> {
+  readonly output: T
+  /** Actual provider used, not a model-prefix inference. */
+  readonly provider: AIProviderName
+  /** Actual model used by the provider. */
+  readonly model: string
+  readonly usage: AIUsage | null
+  readonly finishReason: AIFinishReason
+  readonly providerFinishReason?: string
+  readonly requestId?: string
+}
+
+export type AIContentPart =
+  | { readonly type: 'text'; readonly text: string }
+  | { readonly type: 'image'; readonly mimeType: string; readonly data: string }
+  | { readonly type: 'file'; readonly mimeType: string; readonly data: string; readonly fileName?: string }
+
+export interface AIToolCall {
+  readonly id: string
+  readonly name: string
+  readonly arguments: Readonly<Record<string, unknown>>
+}
+
+export interface AIToolDefinition {
+  readonly name: string
+  readonly description: string
+  readonly parameters: JSONSchema
+}
+
+export type AIToolChoice = 'auto' | 'required' | 'none' | { readonly name: string }
+
+export type AIMessage =
+  | { readonly role: 'system'; readonly content: string }
+  | { readonly role: 'user'; readonly content: string | readonly AIContentPart[] }
+  | { readonly role: 'assistant'; readonly content: string; readonly toolCalls?: readonly AIToolCall[] }
+  | {
+      readonly role: 'tool'
+      readonly toolCallId: string
+      readonly toolName?: string
+      readonly content: string
+    }
+
+export interface AIChatOutput {
+  readonly text: string
+  readonly toolCalls: readonly AIToolCall[]
+}
+
+export interface AIEmbeddingOutput {
+  readonly embeddings: readonly (readonly number[])[]
+}
+
+export interface AIObjectSchema<T> {
+  readonly name?: string
+  readonly description?: string
+  readonly jsonSchema: JSONSchema
+  validate(value: unknown): T
+}
+
+export interface AIProviderRequestBase {
+  readonly model: string
+  readonly signal: AbortSignal
+  readonly timeoutMs: number
+  readonly systemInstruction?: string
+  readonly maxOutputTokens?: number
+  readonly temperature?: number
+  readonly topP?: number
+  readonly stopSequences?: readonly string[]
+  readonly responseFormat?: 'text' | 'json'
+  readonly disableThinking?: boolean
+}
+
+export interface AIProviderTextRequest extends AIProviderRequestBase {
+  readonly prompt: string
+}
+
+export interface AIProviderContentRequest extends AIProviderRequestBase {
+  readonly content: readonly AIContentPart[]
+}
+
+export interface AIProviderChatRequest extends AIProviderRequestBase {
+  readonly messages: readonly AIMessage[]
+  readonly tools?: readonly AIToolDefinition[]
+  readonly toolChoice?: AIToolChoice
+}
+
+export interface AIProviderObjectRequest<T = unknown> extends AIProviderRequestBase {
+  readonly prompt: string
+  readonly schema: AIObjectSchema<T>
+}
+
+export interface AIProviderEmbedRequest extends Pick<AIProviderRequestBase, 'model' | 'signal' | 'timeoutMs'> {
+  readonly input: readonly string[]
+  readonly dimensions?: number
+}
+
+export type AIStreamEvent =
+  | { readonly type: 'text-delta'; readonly delta: string }
+  | { readonly type: 'tool-call'; readonly toolCall: AIToolCall }
+  | { readonly type: 'finish'; readonly result: AIResult<AIChatOutput> }
+
+export interface AIProviderCapabilities {
+  readonly text: boolean
+  readonly content: boolean
+  readonly chat: boolean
+  readonly streaming: boolean
+  readonly object: boolean
+  readonly embedding: boolean
+  readonly tools: boolean
+}
+
+/**
+ * Provider boundary. Config and credentials are supplied only to the factory;
+ * request/result objects never contain secrets.
+ */
+export interface AIProvider {
+  readonly name: AIProviderName
+  readonly capabilities: AIProviderCapabilities
+  generateText(request: AIProviderTextRequest): Promise<AIResult<string>>
+  generateContent(request: AIProviderContentRequest): Promise<AIResult<string>>
+  generateChat(request: AIProviderChatRequest): Promise<AIResult<AIChatOutput>>
+  streamChat(request: AIProviderChatRequest): AsyncIterable<AIStreamEvent>
+  /** Provider returns decoded JSON; the runtime owns the single schema validation pass. */
+  generateObject?(request: AIProviderObjectRequest<unknown>): Promise<AIResult<unknown>>
+  embed?(request: AIProviderEmbedRequest): Promise<AIResult<AIEmbeddingOutput>>
+}
+
+export interface AIProviderFactoryContext {
+  readonly name: AIProviderName
+  readonly config: AIProviderConfig
+  readonly fetch: typeof globalThis.fetch
+}
+
+export interface AIProviderFactory {
+  (context: AIProviderFactoryContext): AIProvider | Promise<AIProvider>
+  /** Official endpoint accepted without a custom endpoint policy. */
+  readonly defaultEndpoint?: string
+}
+
+export type AIConfigLoader = (tenantId: number) => unknown | Promise<unknown>
+
+export interface AIConfigSource {
+  loadConfig: AIConfigLoader
+}
+
+export interface AIRetryOptions {
+  /** Total attempts including the first. Runtime clamps this to a safe bound. */
+  readonly maxAttempts?: number
+  readonly baseDelayMs?: number
+  readonly maxDelayMs?: number
+}
+
+export interface AIRequestOptions {
+  readonly tenantId?: number
+  readonly lane?: string
+  /** Explicit provider + model pair. Prefix inference is intentionally unsupported. */
+  readonly model?: AIModelRef
+  readonly signal?: AbortSignal
+  readonly timeoutMs?: number
+  readonly systemInstruction?: string
+  readonly maxOutputTokens?: number
+  readonly temperature?: number
+  readonly topP?: number
+  readonly stopSequences?: readonly string[]
+  readonly responseFormat?: 'text' | 'json'
+  readonly disableThinking?: boolean
+  readonly retry?: AIRetryOptions
+  /** Secret-free scalar dimensions copied to invocation telemetry. */
+  readonly metadata?: Readonly<Record<string, string | number | boolean>>
+}
+
+export interface AIChatRequestOptions extends AIRequestOptions {
+  readonly tools?: readonly AIToolDefinition[]
+  readonly toolChoice?: AIToolChoice
+}
+
+export interface AIEmbedRequestOptions extends Pick<
+  AIRequestOptions,
+  'tenantId' | 'lane' | 'model' | 'signal' | 'timeoutMs' | 'retry'
+> {
+  readonly dimensions?: number
+}
+
+export interface AITelemetryEvent {
+  readonly operation: AIOperation
+  readonly tenantId: number
+  readonly provider: AIProviderName
+  readonly model: string
+  readonly durationMs: number
+  readonly attempts: number
+  readonly success: boolean
+  readonly usage: AIUsage | null
+  readonly finishReason?: AIFinishReason
+  readonly errorCode?: string
+  readonly metadata?: Readonly<Record<string, string | number | boolean>>
+}
+
+export type AITelemetrySink = (event: AITelemetryEvent) => void | Promise<void>
+
+export interface AIClient {
+  generateText(prompt: string, options?: AIRequestOptions): Promise<AIResult<string>>
+  generateContent(content: readonly AIContentPart[], options?: AIRequestOptions): Promise<AIResult<string>>
+  generateChat(messages: readonly AIMessage[], options?: AIChatRequestOptions): Promise<AIResult<AIChatOutput>>
+  streamChat(messages: readonly AIMessage[], options?: AIChatRequestOptions): AsyncIterable<AIStreamEvent>
+  generateObject<T>(
+    prompt: string,
+    schema: AIObjectSchema<T>,
+    options?: AIRequestOptions,
+  ): Promise<AIResult<T>>
+  embed(input: string | readonly string[], options?: AIEmbedRequestOptions): Promise<AIResult<AIEmbeddingOutput>>
+}
+
+export type AIMissingTenantPolicy = 'throw' | 'use-default'
+
+export interface AIEndpointPolicyInput {
+  readonly tenantId: number
+  readonly provider: AIProviderName
+  readonly endpoint: URL
+  readonly defaultEndpoint?: URL
+}
+
+export interface AIClientOptions {
+  readonly configSource: AIConfigSource | AIConfigLoader
+  readonly providers: ReadonlyMap<AIProviderName, AIProviderFactory> | Iterable<readonly [AIProviderName, AIProviderFactory]>
+  readonly tenantResolver?: () => number | null | undefined
+  readonly missingTenantPolicy?: AIMissingTenantPolicy
+  readonly defaultTenantId?: number
+  readonly defaultTimeoutMs?: number
+  readonly retry?: AIRetryOptions
+  readonly telemetry?: AITelemetrySink
+  /** Required for a configured endpoint that differs from provider default. */
+  readonly validateEndpoint?: (input: AIEndpointPolicyInput) => boolean | Promise<boolean>
+  /** HTTP providers use this transport; SDK-backed providers may reject a custom implementation. */
+  readonly fetch?: typeof globalThis.fetch
+  readonly now?: () => number
+  readonly random?: () => number
+}

package/src/auth/browser-exchange.ts

@@ -0,0 +1,316 @@
+import { AuthError } from './errors.ts'
+import { createSecureAuthToken } from './session.ts'
+import type { OneTimeAuthStore } from './types.ts'
+
+const BROWSER_TRANSACTION_PATTERN = /^obtx_v1_[A-Za-z0-9_-]{43}$/
+const BROWSER_EXCHANGE_CODE_PATTERN = /^oex_v1_[A-Za-z0-9_-]{43}$/
+const PROVIDER_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/
+const KEY_PREFIX_PATTERN = /^[A-Za-z0-9:_-]{1,96}$/
+const DEFAULT_TTL_SECONDS = 60
+const MAX_SERIALIZED_BYTES = 2_048
+const MAX_SESSION_GENERATION = 2_147_483_647
+const encoder = new TextEncoder()
+
+interface StoredOAuthBrowserExchange extends OAuthBrowserExchangePayload {
+  readonly v: 1
+}
+
+export interface OAuthBrowserExchangePayload {
+  readonly tenantId: number
+  readonly browserTransaction: string
+  readonly provider: string
+  readonly userId: number
+  /** Optional user revocation epoch captured before provider authentication. */
+  readonly sessionGeneration?: number
+  readonly issuedAt: number
+  readonly expiresAt: number
+}
+
+export interface OAuthBrowserExchangeIssueInput {
+  readonly tenantId: number
+  readonly browserTransaction: string
+  readonly provider: string
+  readonly userId: number
+  readonly sessionGeneration?: number
+}
+
+export interface OAuthBrowserExchangeConsumeInput {
+  readonly code: string
+  readonly tenantId: number
+  readonly browserTransaction?: string
+}
+
+export interface OAuthBrowserExchangeManager {
+  issue(input: OAuthBrowserExchangeIssueInput): Promise<string>
+  consume(input: OAuthBrowserExchangeConsumeInput): Promise<OAuthBrowserExchangePayload>
+}
+
+export interface CreateOAuthBrowserExchangeManagerOptions {
+  readonly store: OneTimeAuthStore
+  readonly ttlSeconds?: number
+  readonly keyPrefix?: string
+  /** Millisecond clock, primarily for deterministic contract tests. */
+  readonly now?: () => number
+  /** Must return an `oex_v1_` token with 32 bytes of entropy in production. */
+  readonly generateCode?: () => string
+}
+
+function invalidInput(): never {
+  throw new AuthError({ code: 'invalid_input', status: 400 })
+}
+
+function invalidExchange(status = 400): never {
+  throw new AuthError({ code: 'invalid_browser_exchange', status })
+}
+
+function assertTenantId(value: unknown): asserts value is number {
+  if (typeof value !== 'number' || !Number.isSafeInteger(value) || value <= 0) invalidInput()
+}
+
+function assertUserId(value: unknown): asserts value is number {
+  if (typeof value !== 'number' || !Number.isSafeInteger(value) || value <= 0) invalidInput()
+}
+
+function assertProvider(value: unknown): asserts value is string {
+  if (typeof value !== 'string' || !PROVIDER_PATTERN.test(value)) invalidInput()
+}
+
+function assertBrowserTransaction(value: unknown): asserts value is string {
+  if (typeof value !== 'string' || !BROWSER_TRANSACTION_PATTERN.test(value)) invalidInput()
+}
+
+function assertIssueInput(input: OAuthBrowserExchangeIssueInput): void {
+  if (!input || typeof input !== 'object' || Array.isArray(input)) invalidInput()
+  assertTenantId(input.tenantId)
+  assertBrowserTransaction(input.browserTransaction)
+  assertProvider(input.provider)
+  assertUserId(input.userId)
+  if (
+    input.sessionGeneration !== undefined
+    && (
+      !Number.isSafeInteger(input.sessionGeneration)
+      || input.sessionGeneration < 0
+      || input.sessionGeneration > MAX_SESSION_GENERATION
+    )
+  ) invalidInput()
+}
+
+function assertConsumeEnvelope(input: OAuthBrowserExchangeConsumeInput): void {
+  if (!input || typeof input !== 'object' || Array.isArray(input)) invalidExchange()
+  if (typeof input.code !== 'string' || !BROWSER_EXCHANGE_CODE_PATTERN.test(input.code)) {
+    invalidExchange()
+  }
+  // A malformed tenant is still caller input, while a valid but different
+  // tenant is a consumed transaction mismatch checked after the atomic take.
+  assertTenantId(input.tenantId)
+}
+
+function base64Url(bytes: Uint8Array): string {
+  let binary = ''
+  for (const byte of bytes) binary += String.fromCharCode(byte)
+  return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/u, '')
+}
+
+async function storageKey(code: string, keyPrefix: string): Promise<string> {
+  const digest = await crypto.subtle.digest('SHA-256', encoder.encode(code))
+  return `${keyPrefix}${base64Url(new Uint8Array(digest))}`
+}
+
+function parseStoredPayload(serialized: string, expectedTtlMs: number): StoredOAuthBrowserExchange {
+  if (encoder.encode(serialized).byteLength > MAX_SERIALIZED_BYTES) invalidExchange()
+
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(serialized)
+  } catch {
+    invalidExchange()
+  }
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) invalidExchange()
+
+  const value = parsed as Record<string, unknown>
+  const allowedKeys = new Set([
+    'v',
+    'tenantId',
+    'browserTransaction',
+    'provider',
+    'userId',
+    'sessionGeneration',
+    'issuedAt',
+    'expiresAt',
+  ])
+  if (Object.keys(value).some(key => !allowedKeys.has(key))) invalidExchange()
+
+  try {
+    if (value.v !== 1) invalidInput()
+    assertTenantId(value.tenantId)
+    assertBrowserTransaction(value.browserTransaction)
+    assertProvider(value.provider)
+    assertUserId(value.userId)
+    if (
+      value.sessionGeneration !== undefined
+      && (
+        typeof value.sessionGeneration !== 'number'
+        || !Number.isSafeInteger(value.sessionGeneration)
+        || value.sessionGeneration < 0
+        || value.sessionGeneration > MAX_SESSION_GENERATION
+      )
+    ) invalidInput()
+    if (
+      typeof value.issuedAt !== 'number'
+      || !Number.isSafeInteger(value.issuedAt)
+      || value.issuedAt < 0
+      || typeof value.expiresAt !== 'number'
+      || !Number.isSafeInteger(value.expiresAt)
+      || value.expiresAt <= value.issuedAt
+      || value.expiresAt - value.issuedAt !== expectedTtlMs
+    ) invalidInput()
+  } catch {
+    invalidExchange()
+  }
+
+  return value as unknown as StoredOAuthBrowserExchange
+}
+
+/**
+ * Issue and atomically consume a short browser hand-off code after an OAuth
+ * provider callback. The store key contains only SHA-256(code); the adapter's
+ * `take` implementation must be one atomic GETDEL or one Lua command.
+ */
+export function createOAuthBrowserExchangeManager(
+  options: CreateOAuthBrowserExchangeManagerOptions,
+): OAuthBrowserExchangeManager {
+  if (
+    !options
+    || typeof options !== 'object'
+    || !options.store
+    || typeof options.store.put !== 'function'
+    || typeof options.store.take !== 'function'
+  ) invalidInput()
+
+  const ttlSeconds = options.ttlSeconds ?? DEFAULT_TTL_SECONDS
+  const keyPrefix = options.keyPrefix ?? 'auth:oauth-browser-exchange:v1:'
+  const now = options.now ?? Date.now
+  const generateCode = options.generateCode ?? (() => `oex_v1_${createSecureAuthToken()}`)
+  if (
+    !Number.isSafeInteger(ttlSeconds)
+    || ttlSeconds < 30
+    || ttlSeconds > 300
+    || typeof keyPrefix !== 'string'
+    || !KEY_PREFIX_PATTERN.test(keyPrefix)
+    || typeof now !== 'function'
+    || typeof generateCode !== 'function'
+  ) invalidInput()
+
+  // Capture the methods, not just the object. Mutating a caller-owned adapter
+  // after construction cannot replace atomic take with a weaker operation.
+  const put = options.store.put.bind(options.store)
+  const take = options.store.take.bind(options.store)
+  const snapshot = Object.freeze({
+    put,
+    take,
+    ttlSeconds,
+    keyPrefix,
+    now,
+    generateCode,
+  })
+
+  return Object.freeze({
+    async issue(input: OAuthBrowserExchangeIssueInput): Promise<string> {
+      assertIssueInput(input)
+      let code: string
+      let issuedAt: number
+      try {
+        code = snapshot.generateCode()
+        issuedAt = snapshot.now()
+      } catch {
+        throw new AuthError({ code: 'invalid_browser_exchange', status: 500 })
+      }
+      const expiresAt = issuedAt + snapshot.ttlSeconds * 1_000
+      if (
+        typeof code !== 'string'
+        || !BROWSER_EXCHANGE_CODE_PATTERN.test(code)
+        || !Number.isSafeInteger(issuedAt)
+        || issuedAt < 0
+        || !Number.isSafeInteger(expiresAt)
+      ) invalidExchange(500)
+
+      const payload: StoredOAuthBrowserExchange = {
+        v: 1,
+        tenantId: input.tenantId,
+        browserTransaction: input.browserTransaction,
+        provider: input.provider,
+        userId: input.userId,
+        ...(input.sessionGeneration === undefined
+          ? {}
+          : { sessionGeneration: input.sessionGeneration }),
+        issuedAt,
+        expiresAt,
+      }
+      try {
+        await snapshot.put(
+          await storageKey(code, snapshot.keyPrefix),
+          JSON.stringify(payload),
+          snapshot.ttlSeconds,
+        )
+      } catch {
+        throw new AuthError({
+          code: 'auth_store_unavailable',
+          status: 503,
+          retryable: true,
+        })
+      }
+      return code
+    },
+
+    async consume(input: OAuthBrowserExchangeConsumeInput): Promise<OAuthBrowserExchangePayload> {
+      assertConsumeEnvelope(input)
+      let serialized: string | null
+      try {
+        // Take happens before browser/tenant comparison so a stolen or
+        // mis-bound code is burned and cannot be retried by another browser.
+        serialized = await snapshot.take(await storageKey(input.code, snapshot.keyPrefix))
+      } catch {
+        throw new AuthError({
+          code: 'auth_store_unavailable',
+          status: 503,
+          retryable: true,
+        })
+      }
+      if (serialized === null) invalidExchange()
+
+      const payload = parseStoredPayload(serialized, snapshot.ttlSeconds * 1_000)
+      let currentTime: number
+      try {
+        currentTime = snapshot.now()
+      } catch {
+        throw new AuthError({ code: 'invalid_browser_exchange', status: 500 })
+      }
+      if (!Number.isSafeInteger(currentTime) || currentTime < 0 || payload.issuedAt > currentTime) {
+        invalidExchange()
+      }
+      if (payload.expiresAt <= currentTime) {
+        throw new AuthError({ code: 'browser_exchange_expired', status: 400 })
+      }
+      if (
+        payload.tenantId !== input.tenantId
+        || typeof input.browserTransaction !== 'string'
+        || !BROWSER_TRANSACTION_PATTERN.test(input.browserTransaction)
+        || payload.browserTransaction !== input.browserTransaction
+      ) {
+        throw new AuthError({ code: 'browser_exchange_mismatch', status: 400 })
+      }
+
+      return Object.freeze({
+        tenantId: payload.tenantId,
+        browserTransaction: payload.browserTransaction,
+        provider: payload.provider,
+        userId: payload.userId,
+        ...(payload.sessionGeneration === undefined
+          ? {}
+          : { sessionGeneration: payload.sessionGeneration }),
+        issuedAt: payload.issuedAt,
+        expiresAt: payload.expiresAt,
+      })
+    },
+  })
+}

package/src/auth/errors.ts

@@ -0,0 +1,57 @@
+export type AuthErrorCode =
+  | 'invalid_input'
+  | 'login_not_allowed'
+  | 'invalid_oauth_state'
+  | 'oauth_state_expired'
+  | 'oauth_state_mismatch'
+  | 'invalid_browser_exchange'
+  | 'browser_exchange_expired'
+  | 'browser_exchange_mismatch'
+  | 'invalid_passkey_challenge'
+  | 'auth_store_unavailable'
+  | 'invalid_session_token'
+  | 'invalid_session_handle'
+
+const PUBLIC_MESSAGES: Readonly<Record<AuthErrorCode, string>> = Object.freeze({
+  invalid_input: 'Authentication input is invalid',
+  login_not_allowed: 'This login method is not allowed',
+  invalid_oauth_state: 'OAuth transaction is invalid or has already been used',
+  oauth_state_expired: 'OAuth transaction has expired',
+  oauth_state_mismatch: 'OAuth transaction does not match this request',
+  invalid_browser_exchange: 'OAuth browser exchange is invalid or has already been used',
+  browser_exchange_expired: 'OAuth browser exchange has expired',
+  browser_exchange_mismatch: 'OAuth browser exchange does not match this browser',
+  invalid_passkey_challenge: 'Passkey challenge is invalid or has already been used',
+  auth_store_unavailable: 'Authentication transaction store is unavailable',
+  invalid_session_token: 'Session token format is invalid',
+  invalid_session_handle: 'Session management handle format is invalid',
+})
+
+export interface AuthErrorOptions {
+  readonly code: AuthErrorCode
+  readonly status?: number
+  readonly retryable?: boolean
+  /** Accepted so callers can classify failures, but deliberately never retained. */
+  readonly cause?: unknown
+  /** Accepted for compatibility with adapters, but deliberately never retained. */
+  readonly secrets?: readonly string[]
+}
+
+/** A stable error envelope that cannot retain a raw cause, token, or secret. */
+export class AuthError extends Error {
+  readonly code: AuthErrorCode
+  readonly status?: number
+  readonly retryable: boolean
+
+  constructor(options: AuthErrorOptions) {
+    super(PUBLIC_MESSAGES[options.code])
+    this.name = 'AuthError'
+    this.code = options.code
+    this.status = options.status
+    this.retryable = options.retryable ?? false
+  }
+}
+
+export function isAuthError(error: unknown): error is AuthError {
+  return error instanceof AuthError
+}

package/src/auth/index.ts

@@ -0,0 +1,29 @@
+export { AuthError, isAuthError } from './errors.ts'
+export type * from './errors.ts'
+export { createLoginPolicy } from './login-policy.ts'
+export type * from './login-policy.ts'
+export { createOAuthStateManager } from './oauth-state.ts'
+export type * from './oauth-state.ts'
+export { createOAuthBrowserExchangeManager } from './browser-exchange.ts'
+export type * from './browser-exchange.ts'
+export { redactAuthSecrets, redactAuthStorageKey } from './redaction.ts'
+export {
+  PASSKEY_CHALLENGE_TTL_SECONDS,
+  PASSKEY_RECENT_AUTH_MAX_AGE_MS,
+  PasskeyAuthError,
+  commitPasskeyCounter,
+  createPasskeyChallengeManager,
+  createPasskeyRateLimiter,
+  createPasskeyUserHandle,
+  recentPasskeyAuthenticationAt,
+} from './passkey.ts'
+export type * from './passkey.ts'
+export {
+  createSecureAuthToken,
+  createSessionBearerToken,
+  createSessionManagementHandle,
+  isSessionBearerToken,
+  matchesSessionManagementHandle,
+  remainingSessionTtl,
+} from './session.ts'
+export type * from './types.ts'