@jskit-ai/auth-provider-oidc-core 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,32 @@
-# Temporary Holding Version
+# @jskit-ai/auth-provider-oidc-core
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Sign people in to a JSKIT app through an OpenID Connect issuer instead of
+app-local passwords: an accounts hub (`@jskit-ai/oidc-issuer-core`) or any
+issuer such as Google Workspace or Okta. The app keeps its own `users` rows and
+session; the issuer only proves who the person is.
+
+```sh
+npm uninstall @jskit-ai/auth-provider-local-core
+npm install @jskit-ai/auth-provider-oidc-core @jskit-ai/auth-web
+npm run db:migrate
+```
+
+| Name | Meaning |
+|---|---|
+| `AUTH_OIDC_ISSUER` | The issuer's address. |
+| `AUTH_OIDC_REGISTRATION_TOKEN` | For an accounts hub: the hub's registration token. The app registers itself. |
+| `AUTH_OIDC_CLIENT_ID`, `AUTH_OIDC_CLIENT_SECRET` | For other issuers, instead of the token. |
+| `AUTH_OIDC_SESSION_SECRET` | At least 32 characters; required in production. |
+| `APP_PUBLIC_URL` | The address people use; required in production behind a proxy. |
+
+Without `AUTH_OIDC_ISSUER` the app still starts and the login page explains
+what is missing. Inside a frame, such as an editor's preview, sign-in opens a
+pop-up window. A production address waits for the hub owner's approval on the
+hub's Apps page.
+
+`npx jskit-oidc-sign-in export-local-accounts` and `adopt-oidc` move existing
+JSKIT local accounts to a hub, keeping ids and passwords. Run them only on the
+app owner's explicit request.
+
+Follow the `auth/oidc-sign-in` pattern and the guide "Sign in through an OIDC
+issuer" in the JSKIT guide (`packages/agent-docs/site/guide/app-setup/`).

package/bin/jskit-oidc-sign-in.js

@@ -0,0 +1,76 @@
+#!/usr/bin/env node
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { parseArgs } from "node:util";
+import createKnex from "knex";
+import { adoptOidcAccounts, exportLocalAccounts } from "../src/server/lib/localAccounts.js";
+
+const USAGE = `Usage (run in the app's folder, with its database Env):
+  jskit-oidc-sign-in export-local-accounts --out <file>
+  jskit-oidc-sign-in adopt-oidc --issuer <url> --in <file> [--apply]
+
+export-local-accounts writes this app's local accounts for an accounts hub to import.
+adopt-oidc moves the users rows listed in that file to the hub; it only reports
+counts unless --apply is given.`;
+
+async function appKnex() {
+  try {
+    process.loadEnvFile?.(".env");
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw error;
+  }
+  const knexfile = await import(pathToFileURL(path.resolve("knexfile.js")).href);
+  return createKnex(knexfile.default);
+}
+
+function sameAddress(left, right) {
+  return String(left || "").replace(/\/+$/u, "") === String(right || "").replace(/\/+$/u, "");
+}
+
+async function main(argv) {
+  const [command, ...rest] = argv;
+  const { values } = parseArgs({
+    args: rest,
+    options: {
+      out: { type: "string" },
+      in: { type: "string" },
+      issuer: { type: "string" },
+      apply: { type: "boolean", default: false }
+    }
+  });
+  if (command === "export-local-accounts" && values.out) {
+    const knex = await appKnex();
+    try {
+      const { exported } = await exportLocalAccounts({ knex, out: path.resolve(values.out) });
+      console.log(`Exported ${exported} accounts to ${values.out}. It contains password hashes: delete it after the import.`);
+    } finally {
+      await knex.destroy();
+    }
+    return 0;
+  }
+  if (command === "adopt-oidc" && values.issuer && values.in) {
+    const configured = process.env.AUTH_OIDC_ISSUER;
+    if (configured && !sameAddress(configured, values.issuer)) {
+      throw new Error(`--issuer does not match AUTH_OIDC_ISSUER (${configured}).`);
+    }
+    const knex = await appKnex();
+    try {
+      const counts = await adoptOidcAccounts({ knex, file: path.resolve(values.in), apply: values.apply });
+      const verb = values.apply ? "Adopted" : "Would adopt";
+      console.log(`${verb} ${counts.adopt} accounts, ${counts.alreadyAdopted} already adopted, ` +
+        `${counts.notFound} not found, ${counts.conflicts} conflicts.`);
+    } finally {
+      await knex.destroy();
+    }
+    return 0;
+  }
+  console.error(USAGE);
+  return 2;
+}
+
+main(process.argv.slice(2)).then((code) => {
+  process.exitCode = code;
+}, (error) => {
+  console.error(error?.message || error);
+  process.exitCode = 1;
+});

package/migrations/auth_oidc_initial.cjs

@@ -0,0 +1,58 @@
+const CLIENTS_TABLE = "auth_oidc_clients";
+const SESSIONS_TABLE = "auth_oidc_sessions";
+const LOGOUT_TOKENS_TABLE = "auth_oidc_logout_tokens";
+
+exports.up = async function up(knex) {
+  if (!(await knex.schema.hasTable(CLIENTS_TABLE))) {
+    await knex.schema.createTable(CLIENTS_TABLE, (table) => {
+      table.increments("id").primary();
+      table.string("issuer", 255).notNullable();
+      table.string("origin", 255).notNullable();
+      table.string("client_id", 255).notNullable();
+      table.text("client_secret").nullable();
+      table.text("registration_access_token").nullable();
+      table.string("registration_client_uri", 1024).nullable();
+      table.timestamp("created_at").notNullable();
+      table.timestamp("updated_at").notNullable();
+      table.unique(["issuer", "origin"], "uq_auth_oidc_clients_issuer_origin");
+    });
+  }
+
+  if (!(await knex.schema.hasTable(SESSIONS_TABLE))) {
+    await knex.schema.createTable(SESSIONS_TABLE, (table) => {
+      table.string("id", 80).primary();
+      table.string("token_hash", 128).notNullable();
+      table.string("issuer", 255).notNullable();
+      table.string("client_id", 255).nullable();
+      table.string("sub", 255).notNullable();
+      table.string("sid", 255).nullable();
+      table.string("email", 320).notNullable();
+      table.string("display_name", 160).notNullable();
+      table.text("id_token").nullable();
+      table.string("purpose", 32).notNullable();
+      table.timestamp("expires_at").notNullable();
+      table.timestamp("revoked_at").nullable();
+      table.timestamp("created_at").notNullable();
+      table.timestamp("updated_at").notNullable();
+      table.unique(["token_hash"], "uq_auth_oidc_sessions_token_hash");
+      table.index(["issuer", "sub"], "idx_auth_oidc_sessions_subject");
+      table.index(["issuer", "sid"], "idx_auth_oidc_sessions_sid");
+      table.index(["expires_at"], "idx_auth_oidc_sessions_expires");
+    });
+  }
+
+  if (!(await knex.schema.hasTable(LOGOUT_TOKENS_TABLE))) {
+    await knex.schema.createTable(LOGOUT_TOKENS_TABLE, (table) => {
+      table.string("issuer", 255).notNullable();
+      table.string("jti", 255).notNullable();
+      table.timestamp("expires_at").notNullable();
+      table.primary(["issuer", "jti"]);
+    });
+  }
+};
+
+exports.down = async function down(knex) {
+  await knex.schema.dropTableIfExists(LOGOUT_TOKENS_TABLE);
+  await knex.schema.dropTableIfExists(SESSIONS_TABLE);
+  await knex.schema.dropTableIfExists(CLIENTS_TABLE);
+};

package/package.json

@@ -1,6 +1,96 @@
 {
   "name": "@jskit-ai/auth-provider-oidc-core",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "type": "module",
+  "scripts": {
+    "test": "node --test --test-concurrency=1"
+  },
+  "exports": {
+    "./server/providers/AuthOidcProvider": "./src/server/providers/AuthOidcProvider.js",
+    "./server/lib/index": "./src/server/lib/index.js",
+    "./shared": "./src/shared/index.js"
+  },
+  "bin": {
+    "jskit-oidc-sign-in": "./bin/jskit-oidc-sign-in.js"
+  },
+  "dependencies": {
+    "jose": "6.2.12",
+    "knex": "^3.1.0",
+    "openid-client": "6.8.8"
+  },
+  "devDependencies": {
+    "@jskit-ai/auth-provider-local-core": "0.1.146",
+    "@jskit-ai/auth-web": "0.1.246",
+    "oidc-provider": "9.12.2"
+  },
+  "description": "Sign in through any OpenID Connect issuer: self-registration or a static client, app-owned sessions, and back-channel logout.",
+  "jskit": {
+    "kind": "runtime",
+    "capabilities": {
+      "provides": [
+        "auth.service"
+      ],
+      "requires": [
+        "auth.extensions",
+        "runtime.app-root",
+        "runtime.database",
+        "runtime.env",
+        "runtime.fastify",
+        "runtime.logger"
+      ]
+    },
+    "runtime": {
+      "server": {
+        "providers": [
+          {
+            "entrypoint": "src/server/providers/AuthOidcProvider.js",
+            "export": "AuthOidcProvider"
+          }
+        ]
+      }
+    },
+    "metadata": {
+      "jskit": {
+        "tableOwnership": {
+          "tables": [
+            {
+              "tableName": "auth_oidc_clients"
+            },
+            {
+              "tableName": "auth_oidc_sessions"
+            },
+            {
+              "tableName": "auth_oidc_logout_tokens"
+            }
+          ]
+        }
+      },
+      "apiSummary": {
+        "surfaces": [
+          {
+            "subpath": "./server/providers/AuthOidcProvider",
+            "summary": "Provides the OpenID Connect sign-in service and its back-channel and everywhere-logout routes."
+          },
+          {
+            "subpath": "./server/lib/index",
+            "summary": "Exports the OIDC auth service factory, configuration reader, and the local-account export and adopt commands."
+          },
+          {
+            "subpath": "./shared",
+            "summary": "Exports the provider id, redirect path and route paths apps and issuers register."
+          }
+        ],
+        "capability": "auth.service"
+      }
+    },
+    "migrations": {
+      "directories": [
+        "migrations"
+      ]
+    }
+  },
+  "peerDependencies": {
+    "@jskit-ai/auth-core": "0.1.243",
+    "@jskit-ai/kernel": "0.1.245"
+  }
+}

package/patterns/oidc-sign-in/PATTERN.md

@@ -0,0 +1,87 @@
+---
+id: auth/oidc-sign-in
+title: Sign in through an OIDC issuer
+summary: Let people sign in with the accounts they already have in an accounts hub or another OpenID Connect issuer, instead of app-local passwords.
+keywords: auth, authentication, oidc, openid connect, single sign-on, sso, accounts hub, master login, issuer, back-channel logout, dynamic client registration
+requires: @jskit-ai/auth-provider-oidc-core, @jskit-ai/auth-web
+---
+
+# Sign in through an OIDC issuer
+
+## Use when
+
+Several apps should share one set of accounts: people sign in once at an
+accounts hub (see `auth/accounts-hub`) or at an organisation's OpenID Connect
+issuer, and every app signs them in from there. The app keeps its own `users`
+rows and its own session; the issuer only proves who the person is.
+
+## Do not use when
+
+The app needs its own passwords (use `auth-provider-local-core`), or the product
+has deliberately chosen Supabase (`auth/supabase-auth`). Install exactly one
+`auth.service` provider.
+
+## Product decisions
+
+- Which issuer. A hub gives each app a registration token; other issuers
+  (Google Workspace, Okta) give a fixed client id and secret instead.
+- The button label people see.
+- The production address, and who approves the app in the hub.
+- Whether existing local accounts move to the hub (one-time commands below) or
+  the app starts fresh.
+
+## Invariants
+
+- One client per app address. With a registration token the app registers
+  itself the first time it is used from a new address (or at start when
+  `APP_PUBLIC_URL` is set) and stores the client in `auth_oidc_clients`.
+- The redirect URI is auth-web's login route, `AUTH_OIDC_REDIRECT_PATH`
+  (`/auth/login`). Where to go afterwards travels in a sealed, ten-minute,
+  single-use attempt cookie, never in the redirect URI.
+- Every sign-in uses PKCE, `state`, `nonce` and the RFC 9207 `iss` check; ID
+  tokens must name this issuer and this client.
+- The app session is the app's own cookie (30 days), backed by
+  `auth_oidc_sessions`. Signing out of the app does not sign out of the issuer
+  unless the person asks for it.
+- Secrets stay in Env, never in source.
+
+## Framework APIs
+
+- `@jskit-ai/auth-provider-oidc-core` provides `auth.service`, its migration and
+  the `jskit-oidc-sign-in` command.
+- `@jskit-ai/auth-provider-oidc-core/shared` exports `AUTH_OIDC_PROVIDER_ID`,
+  `AUTH_OIDC_REDIRECT_PATH`, `AUTH_OIDC_LOGOUT_PATH` and
+  `AUTH_OIDC_BACKCHANNEL_LOGOUT_PATH`.
+- auth-web's login page shows the one button. Inside a frame (an editor
+  Preview) it opens the issuer in a pop-up window and reloads signed in.
+
+## Example files
+
+`example/package.json` declares the provider and the login surface.
+`example/.env.example` names every Env value without credentials.
+
+## Variation points
+
+- Static client (`AUTH_OIDC_CLIENT_ID`/`AUTH_OIDC_CLIENT_SECRET`) instead of
+  the registration token; never both.
+- `AUTH_OIDC_LABEL` for the button.
+- A sign-out-everywhere link: `/api/auth/oidc/logout?everywhere=1` also ends the
+  issuer session through its end-session endpoint.
+
+## Verification
+
+- Missing `AUTH_OIDC_ISSUER` shows "Sign-in is not set up yet" instead of a
+  crash.
+- Sign in unframed and inside the Preview frame; refresh stays signed in.
+- A production address the hub has not approved yet reaches the hub's waiting
+  page; a blocked one reads "Your accounts hub has blocked this app's address."
+- Disabling the account in the hub ends the app session (back-channel logout).
+- Preview identity (`tools/preview-identity`) still signs in as an existing
+  `users` row.
+
+## Avoid
+
+- keeping the local provider installed alongside this one
+- putting the return path or any secret in the redirect URI
+- sharing one registered client between addresses
+- running the account move commands without the person's explicit yes

package/patterns/oidc-sign-in/example/.env.example

@@ -0,0 +1,13 @@
+# The accounts hub (or any OpenID Connect issuer). Discovery is used.
+AUTH_OIDC_ISSUER=https://accounts.example.com/oidc
+# Preferred: the app registers itself, once per address, with this token.
+AUTH_OIDC_REGISTRATION_TOKEN=replace-me
+# Instead of the token, for issuers without self-registration:
+# AUTH_OIDC_CLIENT_ID=replace-me
+# AUTH_OIDC_CLIENT_SECRET=replace-me
+# Optional button label.
+# AUTH_OIDC_LABEL=Continue with your account
+# Required in production, at least 32 characters. Generated in development.
+# AUTH_OIDC_SESSION_SECRET=replace-me
+# The address people use. Registers at start; required behind a non-loopback proxy.
+APP_PUBLIC_URL=http://localhost:5173

package/patterns/oidc-sign-in/example/package.json

@@ -0,0 +1,8 @@
+{
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "@jskit-ai/auth-provider-oidc-core": "0.1.0",
+    "@jskit-ai/auth-web": "0.1.246"
+  }
+}

package/src/server/lib/backchannelLogout.js

@@ -0,0 +1,64 @@
+import { createRemoteJWKSet, customFetch, jwtVerify } from "jose";
+
+const BACKCHANNEL_LOGOUT_EVENT = "http://schemas.openid.net/event/backchannel-logout";
+const MAX_TOKEN_AGE_SECONDS = 10 * 60;
+
+class BackchannelLogoutError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "BackchannelLogoutError";
+  }
+}
+
+/**
+ * OpenID Connect Back-Channel Logout 1.0 for this app: the issuer posts a
+ * signed logout_token and the matching app sessions end.
+ */
+function createBackchannelLogout({ config, store, issuer, fetchImpl = null, now = Date.now }) {
+  let keySet = null;
+
+  async function keys() {
+    if (keySet) return keySet;
+    const metadata = await issuer.serverMetadata();
+    if (!metadata.jwks_uri) throw new BackchannelLogoutError("The issuer publishes no signing keys.");
+    keySet = createRemoteJWKSet(new URL(metadata.jwks_uri), fetchImpl ? { [customFetch]: fetchImpl } : {});
+    return keySet;
+  }
+
+  async function handle(logoutToken) {
+    const token = String(logoutToken || "").trim();
+    if (!token) throw new BackchannelLogoutError("logout_token is required.");
+    const audience = await issuer.audiences();
+    if (!audience.length) throw new BackchannelLogoutError("This app has no client at the issuer.");
+    let payload;
+    try {
+      ({ payload } = await jwtVerify(token, await keys(), {
+        issuer: config.issuer,
+        audience,
+        maxTokenAge: MAX_TOKEN_AGE_SECONDS,
+        requiredClaims: ["iat", "jti"],
+        currentDate: new Date(now())
+      }));
+    } catch {
+      throw new BackchannelLogoutError("logout_token is not valid.");
+    }
+    const event = payload.events?.[BACKCHANNEL_LOGOUT_EVENT];
+    if (!event || typeof event !== "object") {
+      throw new BackchannelLogoutError("logout_token has no back-channel logout event.");
+    }
+    if (Object.hasOwn(payload, "nonce")) throw new BackchannelLogoutError("logout_token must not carry a nonce.");
+    const sub = typeof payload.sub === "string" ? payload.sub : "";
+    const sid = typeof payload.sid === "string" ? payload.sid : "";
+    if (!sub && !sid) throw new BackchannelLogoutError("logout_token names no subject or session.");
+    const expiresAt = new Date((Number(payload.iat) + MAX_TOKEN_AGE_SECONDS) * 1000);
+    if (!(await store.rememberLogoutToken(config.issuer, String(payload.jti), expiresAt))) {
+      throw new BackchannelLogoutError("logout_token was already used.");
+    }
+    const ended = await store.revokeIssuerSessions(config.issuer, { sub, sid });
+    return { ended: Number(ended) || 0 };
+  }
+
+  return Object.freeze({ handle });
+}
+
+export { BACKCHANNEL_LOGOUT_EVENT, BackchannelLogoutError, createBackchannelLogout };

package/src/server/lib/config.js

@@ -0,0 +1,116 @@
+import { randomBytes } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { assertDevAuthPolicy, resolveDevAuthPolicyFromEnv } from "@jskit-ai/auth-core/server/devAuth";
+import { AUTH_OIDC_DEFAULT_LABEL } from "../../shared/index.js";
+
+const DEFAULT_STORE_DIR = ".jskit/auth";
+const SESSION_SECRET_FILE = "oidc-session.secret";
+
+function text(value) {
+  return String(value ?? "").trim();
+}
+
+function isLoopbackHostname(hostname) {
+  const normalized = String(hostname || "").toLowerCase().replace(/^\[|\]$/gu, "");
+  return normalized === "localhost" || normalized.endsWith(".localhost") ||
+    normalized === "::1" || /^127(?:\.\d{1,3}){3}$/u.test(normalized);
+}
+
+function parseAddress(value, name) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error(`${name} must be a full address such as https://accounts.example.com.`);
+  }
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopbackHostname(url.hostname))) {
+    throw new Error(`${name} must use https (plain http is allowed only on this computer).`);
+  }
+  if (url.username || url.password || url.search || url.hash) {
+    throw new Error(`${name} must be an address without a query or credentials.`);
+  }
+  return url;
+}
+
+// The name an accounts hub shows on its Apps page: the app's package name.
+function resolveAppName(appRoot) {
+  try {
+    const name = String(JSON.parse(fs.readFileSync(path.join(appRoot, "package.json"), "utf8")).name || "");
+    const words = name.replace(/^@[^/]+\//u, "").replace(/[-_.]+/gu, " ").trim();
+    return words ? `${words[0].toUpperCase()}${words.slice(1)}`.slice(0, 80) : "App";
+  } catch {
+    return "App";
+  }
+}
+
+function resolveSessionSecret(env, { appRoot, isProduction }) {
+  const explicit = text(env.AUTH_OIDC_SESSION_SECRET);
+  if (explicit) {
+    if (explicit.length < 32) throw new Error("AUTH_OIDC_SESSION_SECRET must be at least 32 characters.");
+    return explicit;
+  }
+  if (isProduction) throw new Error("AUTH_OIDC_SESSION_SECRET is required in production.");
+  const storeDir = path.resolve(appRoot, text(env.AUTH_OIDC_STORE_DIR) || DEFAULT_STORE_DIR);
+  const secretPath = path.join(storeDir, SESSION_SECRET_FILE);
+  try {
+    const existing = fs.readFileSync(secretPath, "utf8").trim();
+    if (existing) return existing;
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw error;
+  }
+  fs.mkdirSync(storeDir, { recursive: true, mode: 0o700 });
+  const generated = randomBytes(32).toString("base64url");
+  fs.writeFileSync(secretPath, `${generated}\n`, { mode: 0o600 });
+  return generated;
+}
+
+/**
+ * Reads the OIDC sign-in Env. Malformed values stop the app with one sentence.
+ * A missing issuer or client is not fatal: the app runs and sign-in explains
+ * what to set (`setupProblem`), so a project can be prepared before its
+ * accounts hub exists.
+ */
+function resolveOidcConfig({ env = {}, appRoot = process.cwd() } = {}) {
+  const isProduction = text(env.NODE_ENV) === "production";
+  const issuerValue = text(env.AUTH_OIDC_ISSUER);
+  const registrationToken = text(env.AUTH_OIDC_REGISTRATION_TOKEN);
+  const clientId = text(env.AUTH_OIDC_CLIENT_ID);
+  const clientSecret = text(env.AUTH_OIDC_CLIENT_SECRET);
+  const publicUrlValue = text(env.APP_PUBLIC_URL);
+
+  if (registrationToken && clientId) {
+    throw new Error("Set AUTH_OIDC_REGISTRATION_TOKEN or AUTH_OIDC_CLIENT_ID, not both.");
+  }
+  if (clientSecret && !clientId) {
+    throw new Error("AUTH_OIDC_CLIENT_SECRET needs AUTH_OIDC_CLIENT_ID.");
+  }
+  if (clientId && !clientSecret) {
+    throw new Error("AUTH_OIDC_CLIENT_ID needs AUTH_OIDC_CLIENT_SECRET.");
+  }
+  const issuer = issuerValue ? parseAddress(issuerValue, "AUTH_OIDC_ISSUER").href.replace(/\/$/u, "") : "";
+  const appPublicOrigin = publicUrlValue ? parseAddress(publicUrlValue, "APP_PUBLIC_URL").origin : "";
+  const devAuth = resolveDevAuthPolicyFromEnv(env);
+  assertDevAuthPolicy(devAuth);
+
+  let setupProblem = "";
+  if (!issuer) setupProblem = "Sign-in is not set up yet: AUTH_OIDC_ISSUER is missing.";
+  else if (!registrationToken && !clientId) {
+    setupProblem = "Sign-in is not set up yet: set AUTH_OIDC_REGISTRATION_TOKEN, or AUTH_OIDC_CLIENT_ID and AUTH_OIDC_CLIENT_SECRET.";
+  }
+
+  return Object.freeze({
+    isProduction,
+    issuer,
+    registrationToken,
+    staticClient: clientId ? Object.freeze({ clientId, clientSecret }) : null,
+    label: text(env.AUTH_OIDC_LABEL) || AUTH_OIDC_DEFAULT_LABEL,
+    appName: resolveAppName(appRoot),
+    appPublicOrigin,
+    sessionSecret: resolveSessionSecret(env, { appRoot, isProduction }),
+    devAuth,
+    setupProblem
+  });
+}
+
+export { isLoopbackHostname, resolveOidcConfig };

package/src/server/lib/index.js

@@ -0,0 +1,6 @@
+export { createBackchannelLogout } from "./backchannelLogout.js";
+export { resolveOidcConfig } from "./config.js";
+export { createIssuerClient, registrationMetadata } from "./issuer.js";
+export { adoptOidcAccounts, exportLocalAccounts } from "./localAccounts.js";
+export { createOidcAuthService } from "./service.js";
+export { createOidcStore } from "./store.js";