@spfn/auth 0.3.0-beta.6 → 0.3.0-beta.8

package/dist/{authenticate-98lBIMxP.d.ts → machine-principals-Bd5hp76H.d.ts}

@@ -169,6 +169,72 @@ declare const PhoneSchema: _sinclair_typebox.TString;
  */
 declare const DeviceNameSchema: _sinclair_typebox.TString;
 declare const PlatformSchema: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>;
+/**
+ * Key material as a device sends it, bounded.
+ *
+ * The bounds exist for the one route that takes this material from a caller who
+ * has not authenticated and cannot: `POST /_auth/device/start` persists what it
+ * is given, and a correctly fingerprinted megabyte of base64 would sit in
+ * `device_authorizations` until something swept it — and nothing sweeps it.
+ *
+ * The numbers are what real key material measures, with room to spare. The
+ * package's own generators produce SPKI DER in base64: 124 characters for
+ * ES256 (P-256), 392 for RS256 (RSA-2048). An RSA-4096 key would be 736, an
+ * RSA-8192 key about 1400, and the same 4096-bit key PEM-armoured about 800 —
+ * so 2048 admits every shape of key anyone could reasonably present, while a
+ * megabyte is refused three orders of magnitude before it reaches a row.
+ *
+ * `keyId` is a UUID (36) everywhere this package generates one; 64 leaves room
+ * for a client that prefixes or namespaces its own. `fingerprint` is SHA-256
+ * hex, exactly 64, and nothing else can ever verify against the public key —
+ * 128 is the length a longer digest would need, and no more.
+ */
+declare const PublicKeySchema: _sinclair_typebox.TString;
+declare const KeyIdSchema: _sinclair_typebox.TString;
+declare const FingerprintSchema: _sinclair_typebox.TString;
+/**
+ * The code a person reads off the waiting device and types on their own.
+ *
+ * Loose on purpose: 8 characters plus an optional dash is what is shown, but the
+ * server folds whitespace, dashes and lower case away before looking anything up,
+ * so refusing those spellings here would refuse a code that is on screen. The
+ * bounds exist to stop an unbounded string reaching the database, not to spell
+ * out the format — `USER_CODE_ALPHABET` is the only thing that can match a row.
+ */
+declare const UserCodeSchema: _sinclair_typebox.TString;
+/**
+ * What `POST /_auth/device/poll` answers with.
+ *
+ * A union, because the two answers are different kinds of thing rather than one
+ * shape with optional fields: pending says "ask again in this long", approved is
+ * a completed login carrying exactly what `/_auth/login` returns. `status` is the
+ * discriminant, so a generated client narrows on it instead of testing which
+ * fields happen to be present.
+ *
+ * The mobile contract has no union type, so it exports this as one object with
+ * `status` required and every branch field optional — see
+ * `deviceAuthorization.pollStatusRule` in the bundle. `intervalMillis` is an
+ * integer for the same reason: that grammar carries no floating-point scalar,
+ * and a count of milliseconds never needed one.
+ *
+ * That integer is a promise two things keep, because nothing validates a response
+ * against this schema on the way out. `configureDeviceAuth` refuses an interval
+ * that is not a whole number of milliseconds, so the only value this branch can
+ * carry is one; and `contract-export.test.ts` reads this schema to check the
+ * exported declaration, so writing `Type.Number` here fails the suite instead of
+ * publishing an integer the server does not send.
+ */
+declare const DeviceAuthPollResponseSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TObject<{
+    status: _sinclair_typebox.TLiteral<"pending">;
+    intervalMillis: _sinclair_typebox.TInteger;
+}>, _sinclair_typebox.TObject<{
+    status: _sinclair_typebox.TLiteral<"approved">;
+    userId: _sinclair_typebox.TString;
+    publicId: _sinclair_typebox.TString;
+    email: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+    phone: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+    passwordChangeRequired: _sinclair_typebox.TBoolean;
+}>]>;
 declare const PasswordSchema: _sinclair_typebox.TString;
 declare const TargetTypeSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"email">, _sinclair_typebox.TLiteral<"phone">]>;
 type VerificationTargetType = Static<typeof TargetTypeSchema>;
@@ -301,6 +367,133 @@ interface CompleteSignupParams {
  */
 declare function completeSignupService(params: CompleteSignupParams): Promise<RegisterResult>;
 
+/**
+ * @spfn/auth - Device Auth Service
+ *
+ * Device-code login: a device with no key on file yet shows a short code, the
+ * account owner types that code on a device that is already signed in, and the
+ * waiting device's key is registered on approval.
+ *
+ * There is no token to hand over. Every request in this system is signed by the
+ * calling device's own key, so "logging a device in" means one thing — getting
+ * its public key into `user_public_keys` under the right account. That is what
+ * the poll does, and it is why the poll returns exactly what `loginService`
+ * returns: from the client's side the two ways in are indistinguishable.
+ *
+ * | state ↓ op → | info | approve | deny | poll |
+ * | --- | --- | --- | --- | --- |
+ * | pending | device details | → approved | → denied | pending |
+ * | approved | AlreadyHandled | AlreadyHandled | AlreadyHandled | key registered, → consumed |
+ * | denied | AlreadyHandled | AlreadyHandled | AlreadyHandled | Denied |
+ * | consumed | NotFound | NotFound | NotFound | NotFound |
+ * | expired | Expired | Expired | Expired | Expired |
+ * | unknown | NotFound | NotFound | NotFound | NotFound |
+ *
+ * A global revocation — revoke-all, a password change, a deletion request —
+ * refuses the account's live records too, as `denied`, so they land in that row
+ * of the table. See `denyAllActiveByUserId`; the three callers are the three
+ * places that revoke every key at once.
+ */
+
+interface StartDeviceAuthParams {
+    publicKey: string;
+    keyId: string;
+    fingerprint: string;
+    algorithm?: KeyAlgorithmType;
+    /** Device label shown to the approver. Display only — nothing is authorized by it. */
+    deviceName?: string;
+    platform?: KeyPlatformType;
+}
+interface StartDeviceAuthResult {
+    /** Returned once. The waiting device polls with it; the server stores only its hash. */
+    deviceCode: string;
+    /** `XXXX-XXXX`, for the waiting device's screen and nowhere else. */
+    userCode: string;
+    expiresAtMillis: number;
+    /** Milliseconds the waiting device should wait between polls. */
+    intervalMillis: number;
+}
+interface DeviceAuthInfoParams {
+    userCode: string;
+}
+/** What the approver is shown about the device asking to be let in. */
+interface DeviceAuthInfoResult {
+    deviceName?: string;
+    /** One of `KEY_PLATFORM`, which is what the route accepts and the column stores. */
+    platform?: KeyPlatformType;
+    /** First bytes of the pending key's fingerprint, as the device list truncates it. */
+    fingerprintPrefix: string;
+    requestedAtMillis: number;
+    expiresAtMillis: number;
+}
+interface ApproveDeviceAuthParams {
+    userCode: string;
+    /** The approver, read from their session. Never from a request body. */
+    userId: number;
+}
+interface DenyDeviceAuthParams {
+    userCode: string;
+}
+interface PollDeviceAuthParams {
+    deviceCode: string;
+}
+/** Nobody has answered yet. Not an error — the waiting device waits. */
+interface DeviceAuthPendingResult {
+    status: 'pending';
+    intervalMillis: number;
+}
+/** Approved and spent: the key is registered and this is the login it produced. */
+type DeviceAuthApprovedResult = {
+    status: 'approved';
+} & LoginResult;
+type PollDeviceAuthResult = DeviceAuthPendingResult | DeviceAuthApprovedResult;
+/**
+ * Park a new device's key and hand back the codes it needs.
+ *
+ * The caller is unauthenticated by definition — this is what a device does before
+ * it has any way to prove anything — so nothing here is attributed to an account.
+ * The record gains an owner only when someone approves it.
+ */
+declare function startDeviceAuthService(params: StartDeviceAuthParams): Promise<StartDeviceAuthResult>;
+/**
+ * What the approver sees before deciding.
+ *
+ * This is the whole defence against being talked into approving someone else's
+ * device: the answer names the device that is waiting, so the person holding the
+ * phone can see that it is not theirs. An approval screen that showed only the
+ * code would be asking them to confirm a number they were just told.
+ */
+declare function getDeviceAuthInfoService(params: DeviceAuthInfoParams): Promise<DeviceAuthInfoResult>;
+/**
+ * Bind the record to the approving account.
+ *
+ * The key is not registered here. The waiting device may never come back, and a
+ * key registered for a device that stopped listening is a signing credential
+ * nobody asked for — so approval records the decision and the poll acts on it.
+ *
+ * Answers with the same device description `info` returns, so a client that let
+ * a user approve without looking first can still show them what they just let
+ * in — which is the moment someone talked into approving an attacker's device
+ * has to notice and revoke it.
+ */
+declare function approveDeviceAuthService(params: ApproveDeviceAuthParams): Promise<DeviceAuthInfoResult>;
+/**
+ * Refuse the record, so the waiting device is told no instead of timing out.
+ *
+ * Denying binds no user: the point of refusing is that the account owner wants
+ * nothing to do with the request.
+ */
+declare function denyDeviceAuthService(params: DenyDeviceAuthParams): Promise<void>;
+/**
+ * The waiting device asking whether anyone has answered.
+ *
+ * Approved is the one branch with a side effect, and it is a one-shot: the record
+ * is spent by a conditional update that names `approved`, so of two polls that
+ * arrive together exactly one registers the key. The loser matches nothing and is
+ * answered as if the code were unknown — which by then it is.
+ */
+declare function pollDeviceAuthService(params: PollDeviceAuthParams): Promise<PollDeviceAuthResult>;
+
 /**
  * @spfn/auth - Key Service
  *
@@ -353,7 +546,8 @@ interface RevokeAllKeysResult {
 interface KeySummary {
     keyId: string;
     deviceName?: string;
-    platform?: string;
+    /** One of `KEY_PLATFORM`, which is what the routes accept and the column stores. */
+    platform?: KeyPlatformType;
     algorithm: KeyAlgorithmType;
     /** First bytes of the fingerprint — enough to tell two entries apart. */
     fingerprintPrefix: string;
@@ -427,6 +621,16 @@ declare function listKeysService(params: ListKeysParams): Promise<KeySummary[]>;
  * does not also end the session making the request. Passing
  * `includeCurrent: true` is the full sign-out, which until now was reachable
  * only as a side effect of changing a password.
+ *
+ * Live device authorizations are refused as well, in both modes. A device
+ * waiting on an approved code has no key yet, so it is never the caller's own
+ * device and never the one being spared — but its next poll would register a
+ * brand-new active key, which would undo the revocation seconds after it ran.
+ * That is the whole point of the call: the user has decided nothing else is to
+ * stay signed in.
+ *
+ * `revokedCount` counts keys only, since that is the number the caller's screen
+ * means by "devices signed out"; a code nobody had collected was never a session.
  */
 declare function revokeAllKeysService(params: RevokeAllKeysParams): Promise<RevokeAllKeysResult>;
 
@@ -945,6 +1149,46 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
             platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
         }>;
     }, LoginResult>;
+    startDeviceAuth: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            publicKey: _sinclair_typebox.TString;
+            keyId: _sinclair_typebox.TString;
+            fingerprint: _sinclair_typebox.TString;
+            algorithm: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
+        }>;
+    }, {}, StartDeviceAuthResult>;
+    pollDeviceAuth: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            deviceCode: _sinclair_typebox.TString;
+        }>;
+    }, {}, {
+        status: "pending";
+        intervalMillis: number;
+    } | {
+        email?: string | undefined;
+        phone?: string | undefined;
+        status: "approved";
+        userId: string;
+        publicId: string;
+        passwordChangeRequired: boolean;
+    }>;
+    getDeviceAuthInfo: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            userCode: _sinclair_typebox.TString;
+        }>;
+    }, {}, DeviceAuthInfoResult>;
+    approveDeviceAuth: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            userCode: _sinclair_typebox.TString;
+        }>;
+    }, {}, DeviceAuthInfoResult>;
+    denyDeviceAuth: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            userCode: _sinclair_typebox.TString;
+        }>;
+    }, {}, void>;
     logout: _spfn_core_route.RouteDef<{}, {}, void>;
     rotateKey: _spfn_core_route.RouteDef<{}, {
         body: _sinclair_typebox.TObject<{
@@ -1424,6 +1668,11 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
  * downstream permission/tenant code consumes one principal shape and never
  * branches on how it was authenticated.
  *
+ * An app adds its own scheme with `registerAuthProfile` at boot. The dispatch
+ * it joins is the one below, unchanged: a name nobody registered is still
+ * refused, and profile credentials mixed with an Authorization header are
+ * still refused before either path runs.
+ *
  * The clientProofV1 verifier reuses the phase-1 admission pieces (header
  * shape, canonical body, proof-input assembly, ECDSA verification) with two
  * production substitutions: the key directory is `user_public_keys` via
@@ -1444,8 +1693,13 @@ interface AuthContext {
     keyId: string;
     role: string | null;
     locale: string;
-    /** How the principal was authenticated. Informational — downstream code never branches on it. */
-    scheme: 'bearer' | 'clientProofV1' | 'oneTimeToken';
+    /**
+     * How the principal was authenticated. Informational — downstream code
+     * never branches on it. The union stays open for the profiles an app
+     * registers itself: the built-in names keep their autocomplete, and a
+     * registered profile names its own scheme without editing this file.
+     */
+    scheme: 'bearer' | 'clientProofV1' | 'oneTimeToken' | (string & {});
 }
 /** A profile's verifier: admits the request and returns the principal, or throws. */
 interface AuthProfileVerifier {
@@ -1492,6 +1746,49 @@ type AuthProfileOutcome = {
  * handed to the generic error handler is classified by its class name instead.
  */
 declare function runAuthProfile(c: Context): Promise<AuthProfileOutcome>;
+/**
+ * Registers an app's own verifier under a profile name.
+ *
+ * Call it at boot, before the first request: the registry is a module-global
+ * read on every dispatch, so a profile registered later is simply a profile
+ * the requests before it did not have. There is no freeze and no
+ * unregistration — an auth surface that can be rearranged at runtime is a
+ * surface an app bug can rearrange.
+ *
+ * A duplicate name throws rather than replacing the verifier that holds it,
+ * `clientProofV1` included. A silent override is how a second import order, or
+ * a copied profile name, quietly swaps the code that decides who is admitted.
+ *
+ * The verifier must expose a callable `verify` — a value that cannot admit
+ * anyone is refused at boot rather than becoming a registry entry the dispatch
+ * reads as "no profile header", which is anonymous passage under
+ * `optionalAuth` for a request that presented profile credentials.
+ *
+ * The verifier returns the same `AuthContext` the Bearer path sets and refuses
+ * by throwing. A resolve that carries no `userId` is refused as a throw too —
+ * "no user" is a refusal, never a principal. A throw is not caught here:
+ * `runAuthProfile` answers the internal clientProofV1 contract refusal and
+ * nothing else, so a verifier's own error reaches the app's generic error
+ * handler exactly as the Bearer path's `UnauthorizedError` does — and never
+ * becomes anonymous passage, not even under `optionalAuth`.
+ *
+ * @example
+ * ```typescript
+ * registerAuthProfile('serviceTokenV1', {
+ *     verify: async (c) =>
+ *     {
+ *         const user = await authenticateServiceToken(c.req.header('x-acme-service-token'));
+ *         if (user === null)
+ *         {
+ *             throw new UnauthorizedError({ message: 'Invalid service token' });
+ *         }
+ *
+ *         return { user, userId: String(user.id), keyId: 'service', role: null, locale: 'en', scheme: 'serviceTokenV1' };
+ *     },
+ * });
+ * ```
+ */
+declare function registerAuthProfile(profileId: string, verifier: AuthProfileVerifier): void;
 
 declare module 'hono' {
     interface ContextVariableMap {
@@ -1558,4 +1855,97 @@ declare const authenticate: _spfn_core_route.NamedMiddleware<"auth">;
  */
 declare const optionalAuth: _spfn_core_route.NamedMiddleware<"optionalAuth">;
 
-export { type SendVerificationCodeParams as $, type AuthInitOptions as A, type OAuthCodeExchangeOptions as B, type ConfirmSignupLinkResult as C, DeviceNameSchema as D, EmailSchema as E, type OAuthNativeParams as F, type OAuthStartParams as G, type OAuthTokens as H, type IssueOneTimeTokenResult as I, PasswordSchema as J, type KeySummary as K, type LoginResult as L, PhoneSchema as M, type NativeVerifyOptions as N, type OAuthStartResult as O, type PermissionConfig as P, PlatformSchema as Q, type RoleConfig as R, type SendVerificationCodeResult as S, type RegisterParams as T, type UserProfile as U, VERIFICATION_PURPOSES as V, type RegisterPublicKeyParams as W, type RequestSignupLinkParams as X, type RevokeAllKeysParams as Y, type RevokeKeyParams as Z, type RotateKeyParams as _, type RegisterResult as a, TargetTypeSchema as a0, type UnlinkNotification as a1, UnlinkNotifyRejection as a2, type UnlinkNotifyRequest as a3, type UnlinkNotifyResult as a4, VerificationPurposeSchema as a5, type VerifyCodeParams as a6, type VerifyCodeResult as a7, authenticate as a8, buildOAuthErrorUrl as a9, rotateKeyService as aA, runAuthProfile as aB, selectAuthProfile as aC, sendVerificationCodeService as aD, verifyCodeService as aE, verifyOneTimeTokenService as aF, changePasswordService as aa, completeSignupService as ab, confirmSignupLinkService as ac, getEnabledOAuthProviders as ad, getGoogleAccessToken as ae, getOAuthProvider as af, getRegisteredProviders as ag, isOAuthProviderEnabled as ah, isSafeReturnPath as ai, issueOneTimeTokenService as aj, listKeysService as ak, loginService as al, logoutService as am, oauthCallbackService as an, oauthNativeService as ao, oauthStartService as ap, oauthUnlinkNotifyService as aq, optionalAuth as ar, registerOAuthProvider as as, registerPublicKeyService as at, registerService as au, requestSignupLinkService as av, requireEnabledProvider as aw, resolveAuthenticatedUser as ax, revokeAllKeysService as ay, revokeKeyService as az, type RequestSignupLinkResult as b, type RotateKeyResult as c, type RevokeAllKeysResult as d, type OAuthNativeResult as e, type ProfileInfo as f, type AuthSession as g, PERMISSION_CATEGORIES as h, type PermissionCategory as i, VERIFICATION_TARGET_TYPES as j, type VerificationPurpose as k, type VerificationTargetType as l, mainAuthRouter as m, type OAuthProvider as n, type AuthContext as o, type AuthProfileOutcome as p, type AuthProfileVerifier as q, type ChangePasswordParams as r, type CompleteSignupParams as s, type ConfirmSignupLinkParams as t, KEY_FINGERPRINT_PREFIX_LENGTH as u, type LoginParams as v, type LogoutParams as w, type NormalizedIdentity as x, type OAuthCallbackParams as y, type OAuthCallbackResult as z };
+/** What a verified machine request acts as. Not a user, by construction. */
+interface MachinePrincipal {
+    /** e.g. 'account' | 'service' | registrant-defined */
+    subjectType: string;
+    subjectId: string;
+    scopes: string[];
+    /** verifier-defined extras (claims, token id for audit, …) */
+    claims?: Record<string, unknown>;
+    /** which registered verifier admitted it */
+    scheme: string;
+}
+interface MachineVerifierRegistration {
+    /** unique id; becomes MachinePrincipal.scheme */
+    id: string;
+    /** exactly one discriminator */
+    match: {
+        tokenPrefix: string;
+    } | {
+        kidPrefix: string;
+    };
+    verify(token: string, c: Context): Promise<MachinePrincipal>;
+}
+declare module 'hono' {
+    interface ContextVariableMap {
+        machinePrincipal: MachinePrincipal;
+    }
+}
+/** Read the verified machine principal a handler runs under. */
+declare function getMachinePrincipal(c: Context): MachinePrincipal | null;
+/**
+ * Registers a verifier for one machine credential namespace. Call it at boot.
+ *
+ * Refused at registration: a duplicate `id`, a `match` that does not name
+ * exactly one non-empty discriminator, a verifier without a callable `verify`,
+ * and — the point of the check — a discriminator that shadows or is shadowed by
+ * an already-registered one of the same kind. Two verifiers a token could match
+ * would make admission depend on registration order; that is a boot-time bug,
+ * not something the dispatch should resolve on every request.
+ *
+ * @example
+ * ```typescript
+ * registerMachineVerifier({
+ *     id: 'runtimeJwsV1',
+ *     match: { kidPrefix: 'machine:runtime:' },
+ *     verify: async (token) =>
+ *     {
+ *         const { payload } = await jwtVerify(token, RUNTIME_JWKS);
+ *
+ *         return {
+ *             subjectType: 'account',
+ *             subjectId: String(payload.sub),
+ *             scopes: String(payload.scope ?? '').split(' ').filter(Boolean),
+ *             scheme: 'runtimeJwsV1',
+ *         };
+ *     },
+ * });
+ * ```
+ */
+declare function registerMachineVerifier(reg: MachineVerifierRegistration): void;
+/**
+ * Admits a machine credential, or refuses. Sets `machinePrincipal`; `auth`
+ * stays unset, so `getAuth(c)` is as empty here as on an anonymous request.
+ *
+ * Auto-skips the global 'auth' middleware, like `opsTokenAuth`.
+ *
+ * @example
+ * ```typescript
+ * export const ingest = route.post('/v1/ingest')
+ *   .use([machineAuth, requireMachineScope('events:write')])
+ *   .handler(async (c) => {
+ *     const { subjectType, subjectId } = getMachinePrincipal(c.raw)!;
+ *     // ...
+ *   });
+ * ```
+ */
+declare const machineAuth: _spfn_core_route.NamedMiddleware<"machineAuth">;
+/**
+ * Require the verified machine principal to carry every named scope.
+ *
+ * Fails closed: no principal in the context is a 401, not a pass — a route that
+ * mounted this without `machineAuth` refuses rather than running unauthenticated,
+ * exactly as `requireOpsScope` does. Scopes match exactly; there is no wildcard,
+ * because what a scope string means belongs to the verifier that issued it.
+ *
+ * @example
+ * ```ts
+ * export const ingest = route.post('/v1/ingest')
+ *     .use([machineAuth, requireMachineScope('events:write')])
+ *     .handler(async () => { ... });
+ * ```
+ */
+declare const requireMachineScope: _spfn_core_route.NamedMiddlewareFactory<"machineScope", string[]>;
+
+export { type OAuthNativeParams as $, type AuthInitOptions as A, DeviceAuthPollResponseSchema as B, type ConfirmSignupLinkResult as C, type DeviceAuthInfoResult as D, DeviceNameSchema as E, EmailSchema as F, FingerprintSchema as G, KEY_FINGERPRINT_PREFIX_LENGTH as H, type IssueOneTimeTokenResult as I, KeyIdSchema as J, type KeySummary as K, type LoginResult as L, type LoginParams as M, type LogoutParams as N, type OAuthStartResult as O, type PermissionConfig as P, type MachinePrincipal as Q, type RoleConfig as R, type SendVerificationCodeResult as S, type MachineVerifierRegistration as T, type UserProfile as U, VERIFICATION_PURPOSES as V, type NativeVerifyOptions as W, type NormalizedIdentity as X, type OAuthCallbackParams as Y, type OAuthCallbackResult as Z, type OAuthCodeExchangeOptions as _, type RegisterResult as a, runAuthProfile as a$, type OAuthStartParams as a0, type OAuthTokens as a1, PasswordSchema as a2, PhoneSchema as a3, PlatformSchema as a4, type PollDeviceAuthParams as a5, type PollDeviceAuthResult as a6, PublicKeySchema as a7, type RegisterParams as a8, type RegisterPublicKeyParams as a9, getOAuthProvider as aA, getRegisteredProviders as aB, isOAuthProviderEnabled as aC, isSafeReturnPath as aD, issueOneTimeTokenService as aE, listKeysService as aF, loginService as aG, logoutService as aH, machineAuth as aI, oauthCallbackService as aJ, oauthNativeService as aK, oauthStartService as aL, oauthUnlinkNotifyService as aM, optionalAuth as aN, pollDeviceAuthService as aO, registerAuthProfile as aP, registerMachineVerifier as aQ, registerOAuthProvider as aR, registerPublicKeyService as aS, registerService as aT, requestSignupLinkService as aU, requireEnabledProvider as aV, requireMachineScope as aW, resolveAuthenticatedUser as aX, revokeAllKeysService as aY, revokeKeyService as aZ, rotateKeyService as a_, type RequestSignupLinkParams as aa, type RevokeAllKeysParams as ab, type RevokeKeyParams as ac, type RotateKeyParams as ad, type SendVerificationCodeParams as ae, type StartDeviceAuthParams as af, TargetTypeSchema as ag, type UnlinkNotification as ah, UnlinkNotifyRejection as ai, type UnlinkNotifyRequest as aj, type UnlinkNotifyResult as ak, UserCodeSchema as al, VerificationPurposeSchema as am, type VerifyCodeParams as an, type VerifyCodeResult as ao, approveDeviceAuthService as ap, authenticate as aq, buildOAuthErrorUrl as ar, changePasswordService as as, completeSignupService as at, confirmSignupLinkService as au, denyDeviceAuthService as av, getDeviceAuthInfoService as aw, getEnabledOAuthProviders as ax, getGoogleAccessToken as ay, getMachinePrincipal as az, type RequestSignupLinkResult as b, selectAuthProfile as b0, sendVerificationCodeService as b1, startDeviceAuthService as b2, verifyCodeService as b3, verifyOneTimeTokenService as b4, type StartDeviceAuthResult as c, type RotateKeyResult as d, type RevokeAllKeysResult as e, type OAuthNativeResult as f, type ProfileInfo as g, type AuthSession as h, PERMISSION_CATEGORIES as i, type PermissionCategory as j, VERIFICATION_TARGET_TYPES as k, type VerificationPurpose as l, mainAuthRouter as m, type VerificationTargetType as n, type OAuthProvider as o, type AuthContext as p, type ApproveDeviceAuthParams as q, type AuthProfileOutcome as r, type AuthProfileVerifier as s, type ChangePasswordParams as t, type CompleteSignupParams as u, type ConfirmSignupLinkParams as v, type DenyDeviceAuthParams as w, type DeviceAuthApprovedResult as x, type DeviceAuthInfoParams as y, type DeviceAuthPendingResult as z };