@symbiote-native/auth-session 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 A. Prokopenko
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,158 @@
-# Temporary Holding Version
+# @symbiote-native/auth-session
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Add "Sign in with ..." through your identity provider's web page: the app opens a browser tab, the
+user signs in, the provider redirects back with a code, and you exchange it for a token. One API
+for every [SymbioteNative](../../README.md) adapter (React, Vue, Svelte, Solid and Angular).
+
+It ports [`expo-auth-session`](https://github.com/expo/expo/tree/main/packages/expo-auth-session),
+a PKCE-based OAuth2/OpenID Connect flow over a browser tab, with its hooks in each framework's own
+idiom.
+
+Unlike every other package in this catalog, `expo-auth-session` ships **no native code at all** -
+it is a pure-JS flow built entirely on other Expo JS APIs. So instead of wrapping
+`expo-auth-session` directly, this package hand-ports its logic and depends on the packages that
+already cover its building blocks: [`@symbiote-native/web-browser`](../web-browser) (the
+authorization tab), [`@symbiote-native/crypto`](../crypto) (PKCE), and
+[`@symbiote-native/application`](../application) (the default native redirect scheme). No
+`expo-modules-core` dependency, no `native-link.json` - same shape as
+[`@symbiote-native/standard-web-crypto`](../standard-web-crypto).
+
+## Install
+
+**New app:**
+
+```bash
+npx @symbiote-native/cli new my-app --auth-session
+```
+
+**Existing SymbioteNative app:**
+
+```bash
+npx @symbiote-native/cli add --auth-session
+```
+
+Either way: installs `@symbiote-native/auth-session`, which pulls in
+`@symbiote-native/web-browser`/`@symbiote-native/crypto`/`@symbiote-native/application` as regular
+dependencies. If those three aren't already installed as standalone packages in your app, their
+own native autolinking wiring still applies - see
+[`@symbiote-native/web-browser`'s README](../web-browser/README.md) for the one-time app steps.
+
+<details>
+<summary>Manual install (no CLI)</summary>
+
+```bash
+npm install @symbiote-native/auth-session
+```
+
+</details>
+
+### Register a URL scheme for the redirect
+
+The provider redirects back through a custom URL scheme (for example `myapp://`), so the app has to
+own one: register it in your iOS and Android projects and rebuild. Without a scheme the sign-in
+still completes, but the result cannot reach your app and the user has to close the browser tab by
+hand, which reads as a cancelled event. Allow-list the same redirect URI at your provider.
+
+## Notes
+
+- **Never put secret keys in app code.** A client secret in a mobile app is not secret; keep it on
+  your server. PKCE exists so a public client needs none.
+- **Filter auth redirects out of your own link handlers.** An auth redirect is one more deep link;
+  put a recognizable marker in your own `redirectUri` so your `Linking` handler or router can
+  ignore it.
+
+## What's not ported
+
+- **The Expo Go / `auth.expo.io` proxy flow** (`SessionUrlProvider`, the legacy
+  `AuthSession.getRedirectUrl`/`getDefaultReturnUrl`) - built entirely on `expo-constants`'
+  app-manifest concept (`Constants.expoConfig`, `ExecutionEnvironment`), which doesn't exist in
+  this bare, Metro-only, non-Expo-CLI project. `@symbiote-native/constants` ports only the native
+  fields of `expo-constants` and never the manifest, so it does not bring this flow back.
+- **`makeRedirectUri`'s manifest-scheme auto-detection.** Upstream's version calls
+  `expo-linking`'s `createURL`/`resolveScheme`, which read a scheme out of the same app manifest.
+  This port's `makeRedirectUri` never reads a manifest: pass `native` for a production build, or
+  `scheme` otherwise - it throws if neither is given, rather than guessing.
+- **Upstream's `Request<T, B>` base class is renamed `TokenRequest`'s internal `BaseRequest`** to
+  avoid shadowing the global `Request` type used by `fetch`.
+
+## Not ported (test scope)
+
+Upstream ships tests for `AuthRequest`, `Base64`, `Errors`, `QueryParams`, and `TokenRequest` - all
+five are ported (`src/core/*.test.ts`). `AuthSession-test.*.ts` and `SessionUrlProvider-test.ts`
+are **not** ported: both test only the dropped manifest/proxy flow above. `auth-session.test.ts`
+here instead covers this port's own trimmed `makeRedirectUri` contract.
+
+## Hooks
+
+Every hook upstream ships is ported to every adapter, the load, prompt and code-exchange logic is
+shared in `core/` and each adapter supplies only its lifecycle:
+
+| Upstream | React | Vue / Solid / Svelte | Angular |
+|---|---|---|---|
+| `useAutoDiscovery` | `useAutoDiscovery(issuer)` | same name, getter or ref arguments | `injectAutoDiscovery` |
+| `useLoadedAuthRequest` | `useLoadedAuthRequest(config, discovery, RequestClass)` | same name | `injectLoadedAuthRequest` |
+| `useAuthRequestResult` | `useAuthRequestResult(request, discovery, options?)` | same name | `injectAuthRequestResult` |
+| `useAuthRequest` | `useAuthRequest(config, discovery)` | same name | `injectAuthRequest` |
+| Google `useAuthRequest` / `useIdTokenAuthRequest` | `useGoogleAuthRequest` / `useGoogleIdTokenAuthRequest` | same names | `injectGoogleAuthRequest` / `injectGoogleIdTokenAuthRequest` |
+| Facebook `useAuthRequest` | `useFacebookAuthRequest` | same name | `injectFacebookAuthRequest` |
+
+Each returns `[request, result, promptAsync]`, as boxes in the adapter's own shape (a `ShallowRef`
+in Vue, an accessor in Solid, `{ current }` in Svelte, a `Signal` in Angular; React returns the
+values). Arguments are getters in Solid, Svelte and Angular, refs or getters in Vue.
+
+Provider hooks are flat exports with the provider in the name, since there is no `providers/*`
+subpath. The Google hook exchanges the code for a token on its own when the code flow is used, the
+id token is then in `result.params.id_token`. Off web, `useGoogleIdTokenAuthRequest` follows the
+default code flow, as upstream does.
+
+## Shape
+
+```
+src/core/         AuthRequest, TokenRequest family, Discovery, Errors, PKCE, Base64, QueryParams,
+                  Fetch, AuthSession (dismiss/makeRedirectUri/loadAsync), providers/{google,facebook},
+                  the hook controllers and `createAuthRequestHooks`
+src/{react,vue,solid,svelte,angular}/   each adapter's hook bindings
+```
+
+## Use it
+
+```ts
+import { AuthRequest, exchangeCodeAsync, makeRedirectUri } from '@symbiote-native/auth-session';
+
+const discovery = {
+  authorizationEndpoint: 'https://example.com/oauth/authorize',
+  tokenEndpoint: 'https://example.com/oauth/token',
+};
+
+const request = new AuthRequest({
+  clientId: 'my-client-id',
+  redirectUri: makeRedirectUri({ scheme: 'myapp' }),
+  scopes: ['openid', 'profile'],
+});
+
+const result = await request.promptAsync(discovery);
+if (result.type === 'success') {
+  const token = await exchangeCodeAsync(
+    { clientId: 'my-client-id', code: result.params.code, redirectUri: request.redirectUri },
+    discovery,
+  );
+}
+```
+
+## Common questions
+
+- **Which redirect URI do I register?** Print `makeRedirectUri({ scheme })`: `my-scheme://redirect`
+  in a development build. Register exactly that string with the provider.
+- **`request` is `null`.** `useAuthRequest` loads it asynchronously; disable the button until it is set.
+- **PKCE?** On by default; pass `request.codeVerifier` as `extraParams` when exchanging the code.
+- **Redirect lost on iOS.** Check the scheme is registered in the native project.
+
+Sources: [Expo docs: AuthSession](https://docs.expo.dev/versions/latest/sdk/auth-session/),
+[Expo guide: authentication](https://docs.expo.dev/guides/authentication/),
+[expo/expo#10514](https://github.com/expo/expo/issues/10514).
+
+## Test it
+
+```bash
+pnpm vitest run packages/auth-session
+```

package/build/angular/index.d.ts

@@ -0,0 +1,2 @@
+export * from '../core';
+export { injectAuthRequest, injectAuthRequestResult, injectAutoDiscovery, injectFacebookAuthRequest, injectGoogleAuthRequest, injectGoogleIdTokenAuthRequest, injectLoadedAuthRequest, } from './use-auth-request';

package/build/angular/index.js

@@ -0,0 +1,3 @@
+// The hooks are the `inject*` twins below, the rest is the shared core with nothing to wrap
+export * from '../core/index.js';
+export { injectAuthRequest, injectAuthRequestResult, injectAutoDiscovery, injectFacebookAuthRequest, injectGoogleAuthRequest, injectGoogleIdTokenAuthRequest, injectLoadedAuthRequest, } from './use-auth-request.js';

package/build/angular/use-auth-request.d.ts

@@ -0,0 +1,7 @@
+import type { Signal } from '@angular/core';
+export declare const injectAuthRequest: (config: () => import(".").IAuthRequestConfig, discovery: () => import(".").IDiscoveryDocument | null) => readonly [Signal<import(".").AuthRequest | null>, Signal<import(".").IAuthSessionResult | null>, import(".").IPromptMethod], injectAuthRequestResult: (request: () => import(".").AuthRequest | null, discovery: () => import(".").IDiscoveryDocument | null, customOptions?: (() => import("@symbiote-native/web-browser").IWebBrowserOpenOptions & {
+    preferEphemeralSession?: boolean;
+    preferUniversalLinks?: boolean;
+} & {
+    url?: string;
+}) | undefined) => readonly [Signal<import(".").IAuthSessionResult | null>, import(".").IPromptMethod], injectAutoDiscovery: (issuerOrDiscovery: () => import(".").IIssuerOrDiscovery) => Signal<import(".").IDiscoveryDocument | null>, injectFacebookAuthRequest: (config?: (() => Partial<import(".").IFacebookAuthRequestConfig>) | undefined, redirectUriOptions?: (() => Partial<import(".").IAuthSessionRedirectUriOptions>) | undefined) => readonly [Signal<import(".").FacebookAuthRequest | null>, Signal<import(".").IAuthSessionResult | null>, import(".").IPromptMethod], injectGoogleAuthRequest: (config?: (() => Partial<import(".").IGoogleAuthRequestConfig>) | undefined, redirectUriOptions?: (() => Partial<import(".").IAuthSessionRedirectUriOptions>) | undefined) => readonly [Signal<import(".").GoogleAuthRequest | null>, Signal<import(".").IAuthSessionResult | null>, import(".").IPromptMethod], injectGoogleIdTokenAuthRequest: (config: () => Partial<import(".").IGoogleAuthRequestConfig>, redirectUriOptions?: (() => Partial<import(".").IAuthSessionRedirectUriOptions>) | undefined) => readonly [Signal<import(".").GoogleAuthRequest | null>, Signal<import(".").IAuthSessionResult | null>, import(".").IPromptMethod], injectLoadedAuthRequest: (config: () => import(".").IAuthRequestConfig, discovery: () => import(".").IDiscoveryDocument | null, RequestClass: import(".").IAuthRequestClass<import(".").AuthRequest>) => Signal<import(".").AuthRequest | null>;

package/build/angular/use-auth-request.js

@@ -0,0 +1,11 @@
+// Angular twins of `expo-auth-session`'s auth request hooks, `injectX` shape, call them in an
+// injection context: getter or signal arguments, signal results
+import { createEventValueHook, createResourceHook, } from '@symbiote-native/angular';
+import { GETTER_ARGS, createAuthRequestHooks } from '../core/index.js';
+export const { useAuthRequest: injectAuthRequest, useAuthRequestResult: injectAuthRequestResult, useAutoDiscovery: injectAutoDiscovery, useFacebookAuthRequest: injectFacebookAuthRequest, useGoogleAuthRequest: injectGoogleAuthRequest, useGoogleIdTokenAuthRequest: injectGoogleIdTokenAuthRequest, useLoadedAuthRequest: injectLoadedAuthRequest, } = createAuthRequestHooks({
+    createResourceHook,
+    createEventValueHook,
+    readResource: box => box(),
+    readValue: box => box(),
+    ...GETTER_ARGS,
+});

package/build/core/auth-request-controllers.d.ts

@@ -0,0 +1,44 @@
+import type { IEventValueSource } from '@symbiote-native/engine';
+import type { IAuthDiscoveryDocument, IAuthRequestConfig, IAuthRequestPromptOptions } from './auth-request.types';
+import type { IAuthSessionResult } from './auth-session.types';
+import type { IDiscoveryDocument, IIssuerOrDiscovery } from './discovery';
+export declare const AUTH_CELL_CHANGE = "change";
+export type IAuthCell<T> = IEventValueSource<T, typeof AUTH_CELL_CHANGE> & {
+    getSnapshot: () => T;
+};
+type IWritableAuthCell<T> = IAuthCell<T> & {
+    set: (value: T) => void;
+};
+export declare function createAuthCell<T>(initial: T): IWritableAuthCell<T>;
+/** What a request has to offer for a hook to load it and prompt with it */
+export type ILoadableRequest = {
+    url: string | null;
+    codeVerifier?: string;
+    makeAuthUrlAsync: (discovery: IAuthDiscoveryDocument) => Promise<string>;
+    promptAsync: (discovery: IAuthDiscoveryDocument, options?: IAuthRequestPromptOptions) => Promise<IAuthSessionResult>;
+};
+export type IAuthRequestClass<TRequest extends ILoadableRequest> = new (config: IAuthRequestConfig) => TRequest;
+type ICellResourceController<TArgs extends unknown[], TValue> = {
+    resolve: (...args: TArgs) => IAuthCell<TValue>;
+    flushDispose: () => void;
+    dispose: () => void;
+};
+export declare function createAutoDiscoveryController(): ICellResourceController<[
+    IIssuerOrDiscovery
+], IDiscoveryDocument | null>;
+export declare function createLoadedRequestController<TRequest extends ILoadableRequest = ILoadableRequest>(): {
+    resolve: (config: IAuthRequestConfig, discovery: IDiscoveryDocument | null, RequestClass: IAuthRequestClass<TRequest>) => IAuthCell<TRequest | null>;
+    flushDispose: () => void;
+    dispose: () => void;
+};
+export type IPromptMethod = (options?: IAuthRequestPromptOptions) => Promise<IAuthSessionResult>;
+export type IRequestResultHolder = {
+    result: IAuthCell<IAuthSessionResult | null>;
+    promptAsync: IPromptMethod;
+};
+export declare function createRequestResultController(): {
+    resolve: (request: ILoadableRequest | null, discovery: IDiscoveryDocument | null, customOptions?: IAuthRequestPromptOptions) => IRequestResultHolder;
+    flushDispose: () => void;
+    dispose: () => void;
+};
+export {};

package/build/core/auth-request-controllers.js

@@ -0,0 +1,122 @@
+// Framework-agnostic halves of `useAutoDiscovery`, `useLoadedAuthRequest` and
+// `useAuthRequestResult`. Each controller binds to an adapter's `createResourceHook`, and the value
+// it hands back is a cell the adapter follows with its `createEventValueHook`
+import { createResourceController } from '@symbiote-native/engine';
+import { resolveDiscoveryAsync } from './discovery.js';
+import { createPromptString } from './prompt-string.js';
+export const AUTH_CELL_CHANGE = 'change';
+export function createAuthCell(initial) {
+    let value = initial;
+    const listeners = new Set();
+    return {
+        getSnapshot: () => value,
+        set(next) {
+            value = next;
+            for (const listener of [...listeners])
+                listener(next);
+        },
+        addListener(_event, listener) {
+            listeners.add(listener);
+            return { remove: () => void listeners.delete(listener) };
+        },
+    };
+}
+export function createAutoDiscoveryController() {
+    const controller = createResourceController(issuerOrDiscovery => {
+        const cell = createAuthCell(null);
+        let isAllowed = true;
+        void resolveDiscoveryAsync(issuerOrDiscovery).then(discovery => {
+            if (isAllowed)
+                cell.set(discovery);
+        });
+        return {
+            cell,
+            stop: () => {
+                isAllowed = false;
+            },
+        };
+    }, resource => resource.stop());
+    return {
+        resolve: issuerOrDiscovery => controller.resolve(issuerOrDiscovery).cell,
+        flushDispose: controller.flushDispose,
+        dispose: controller.dispose,
+    };
+}
+// Everything upstream lists as the effect's dependencies, folded to primitives
+function loadedRequestKey(config, discovery) {
+    return JSON.stringify([
+        discovery?.authorizationEndpoint,
+        config.clientId,
+        config.redirectUri,
+        config.responseType,
+        config.clientSecret,
+        config.codeChallenge,
+        config.state,
+        config.usePKCE,
+        config.scopes?.join(' '),
+        createPromptString(config.prompt),
+        JSON.stringify(config.extraParams ?? {}),
+    ]);
+}
+export function createLoadedRequestController() {
+    // The request that finished loading last, shown while a changed config reloads
+    let lastLoaded = null;
+    let RequestClassInUse = null;
+    const controller = createResourceController(({ config, discovery }) => {
+        const cell = createAuthCell(lastLoaded);
+        let isMounted = true;
+        if (discovery && RequestClassInUse) {
+            const request = new RequestClassInUse(config);
+            void request.makeAuthUrlAsync(discovery).then(() => {
+                if (!isMounted)
+                    return;
+                lastLoaded = request;
+                cell.set(request);
+            });
+        }
+        return {
+            cell,
+            stop: () => {
+                isMounted = false;
+            },
+        };
+    }, resource => resource.stop(), (a, b) => a.key === b.key);
+    return {
+        resolve(config, discovery, RequestClass) {
+            RequestClassInUse = RequestClass;
+            return controller.resolve({
+                key: loadedRequestKey(config, discovery),
+                config,
+                discovery,
+            }).cell;
+        },
+        flushDispose: controller.flushDispose,
+        dispose: controller.dispose,
+    };
+}
+export function createRequestResultController() {
+    const result = createAuthCell(null);
+    let latest = { request: null, discovery: null, customOptions: {} };
+    // Reads the latest inputs when called, so one stable function serves every render
+    const promptAsync = async (options = {}) => {
+        const { request, discovery, customOptions } = latest;
+        if (!discovery || !request) {
+            throw new Error('Cannot prompt to authenticate until the request has finished loading.');
+        }
+        const prompted = await request.promptAsync(discovery, {
+            ...customOptions,
+            ...options,
+        });
+        result.set(prompted);
+        return prompted;
+    };
+    const holder = { result, promptAsync };
+    return {
+        resolve(request, discovery, customOptions = {}) {
+            latest = { request, discovery, customOptions };
+            return holder;
+        },
+        flushDispose: () => undefined,
+        dispose: () => undefined,
+    };
+}

package/build/core/auth-request-hooks.d.ts

@@ -0,0 +1,67 @@
+import { AuthRequest } from './auth-request';
+import type { IAuthCell, IAuthRequestClass, IPromptMethod } from './auth-request-controllers';
+import { AUTH_CELL_CHANGE } from './auth-request-controllers';
+import type { IAuthRequestConfig, IAuthRequestPromptOptions } from './auth-request.types';
+import type { IAuthSessionRedirectUriOptions, IAuthSessionResult } from './auth-session.types';
+import type { IDiscoveryDocument, IIssuerOrDiscovery } from './discovery';
+import type { FacebookAuthRequest, IFacebookAuthRequestConfig } from './providers/facebook';
+import type { GoogleAuthRequest, IGoogleAuthRequestConfig } from './providers/google';
+/** A type-level function, how an adapter says "its box of `T`" */
+export interface IHkt {
+    readonly input: unknown;
+    readonly output: unknown;
+}
+export type IApply<F extends IHkt, T> = (F & {
+    readonly input: T;
+})['output'];
+/** A plain getter, the argument shape of Solid, Svelte and Angular */
+export interface IGetterKind extends IHkt {
+    readonly output: () => this['input'];
+}
+type IBoxed<T> = {
+    readonly current: T;
+};
+/** A `{ current }` box, Svelte's result shape */
+export interface IBoxedKind extends IHkt {
+    readonly output: IBoxed<this['input']>;
+}
+/** The argument half of a kit for adapters whose arguments are plain getters */
+export declare const GETTER_ARGS: {
+    toGetter: <T>(arg: () => T) => (() => T);
+    constant: <T>(value: T) => (() => T);
+};
+type IDiscoveryValue = IDiscoveryDocument | null;
+type IResultValue = IAuthSessionResult | null;
+export type IAuthResourceController<TArgs extends unknown[], TResource> = {
+    resolve: (...args: TArgs) => TResource;
+    flushDispose: () => void;
+    dispose: () => void;
+};
+/** The adapter's own primitives the hooks are built from */
+export type IAuthHooksKit<FResource extends IHkt, FValue extends IHkt, FArg extends IHkt> = {
+    createResourceHook: <TArgs extends unknown[], TResource>(createController: () => IAuthResourceController<TArgs, TResource>) => (getArgs: () => TArgs) => IApply<FResource, TResource>;
+    readResource: <T>(box: IApply<FResource, T>) => T;
+    createEventValueHook: <TValue>(event: typeof AUTH_CELL_CHANGE, getValue: (source: IAuthCell<TValue>) => TValue) => (getSource: () => IAuthCell<TValue>) => IApply<FValue, TValue>;
+    readValue: <T>(box: IApply<FValue, T>) => T;
+    /** Turns whatever the adapter accepts as an argument into a getter */
+    toGetter: <T>(arg: IApply<FArg, T>) => () => T;
+    /** Wraps a fixed value in the adapter's argument shape */
+    constant: <T>(value: T) => IApply<FArg, T>;
+};
+type IUseAuthRequestBoxes<FValue extends IHkt, TRequest extends AuthRequest> = readonly [
+    IApply<FValue, TRequest | null>,
+    IApply<FValue, IResultValue>,
+    IPromptMethod
+];
+type IAnyKit = IAuthHooksKit<IHkt, IHkt, IHkt>;
+export type IAuthRequestHooks<FValue extends IHkt, FArg extends IHkt> = {
+    useAutoDiscovery: (issuerOrDiscovery: IApply<FArg, IIssuerOrDiscovery>) => IApply<FValue, IDiscoveryValue>;
+    useLoadedAuthRequest: (config: IApply<FArg, IAuthRequestConfig>, discovery: IApply<FArg, IDiscoveryValue>, RequestClass: IAuthRequestClass<AuthRequest>) => IApply<FValue, AuthRequest | null>;
+    useAuthRequestResult: (request: IApply<FArg, AuthRequest | null>, discovery: IApply<FArg, IDiscoveryValue>, customOptions?: IApply<FArg, IAuthRequestPromptOptions>) => readonly [IApply<FValue, IResultValue>, IPromptMethod];
+    useAuthRequest: (config: IApply<FArg, IAuthRequestConfig>, discovery: IApply<FArg, IDiscoveryValue>) => IUseAuthRequestBoxes<FValue, AuthRequest>;
+    useGoogleAuthRequest: (config?: IApply<FArg, Partial<IGoogleAuthRequestConfig>>, redirectUriOptions?: IApply<FArg, Partial<IAuthSessionRedirectUriOptions>>) => IUseAuthRequestBoxes<FValue, GoogleAuthRequest>;
+    useGoogleIdTokenAuthRequest: (config: IApply<FArg, Partial<IGoogleAuthRequestConfig>>, redirectUriOptions?: IApply<FArg, Partial<IAuthSessionRedirectUriOptions>>) => IUseAuthRequestBoxes<FValue, GoogleAuthRequest>;
+    useFacebookAuthRequest: (config?: IApply<FArg, Partial<IFacebookAuthRequestConfig>>, redirectUriOptions?: IApply<FArg, Partial<IAuthSessionRedirectUriOptions>>) => IUseAuthRequestBoxes<FValue, FacebookAuthRequest>;
+};
+export declare function createAuthRequestHooks<FResource extends IHkt, FValue extends IHkt, FArg extends IHkt>(kit: IAuthHooksKit<FResource, FValue, FArg>): IAuthRequestHooks<FValue, FArg>;
+export type { IAnyKit as IAuthHooksAnyKit };

package/build/core/auth-request-hooks.js

@@ -0,0 +1,75 @@
+// The auth request hooks written once for every adapter whose hooks take getters (Vue, Solid,
+// Svelte, Angular), React keeps its own wiring. An adapter's boxes (`ShallowRef`, `Accessor`,
+// `{ current }`, `Signal`) are type-level functions here, since one hook returns several box types
+import { AuthRequest } from './auth-request.js';
+import { AUTH_CELL_CHANGE, createAutoDiscoveryController, createLoadedRequestController, createRequestResultController, } from './auth-request-controllers.js';
+import { discovery as facebookDiscovery, FacebookAuthRequest as FacebookRequest, } from './providers/facebook.js';
+import { createGoogleExchangeController } from './providers/google-exchange-controller.js';
+import { discovery as googleDiscovery, GoogleAuthRequest as GoogleRequest, } from './providers/google.js';
+import { resolveFacebookRequestSetup, resolveGoogleRequestSetup, toGoogleIdTokenConfig, } from './providers/provider-hook-setup.js';
+/** The argument half of a kit for adapters whose arguments are plain getters */
+export const GETTER_ARGS = {
+    toGetter: (arg) => arg,
+    constant: (value) => () => value,
+};
+function readAuthCell(cell) {
+    return cell.getSnapshot();
+}
+function valueHook(kit) {
+    return kit.createEventValueHook(AUTH_CELL_CHANGE, readAuthCell);
+}
+function discoveryOf(kit, getIssuer) {
+    const cell = kit.createResourceHook(createAutoDiscoveryController)(() => [
+        getIssuer(),
+    ]);
+    return valueHook(kit)(() => kit.readResource(cell));
+}
+function loadedRequestOf(kit, getConfig, getDiscovery, RequestClass) {
+    const useCell = kit.createResourceHook(() => createLoadedRequestController());
+    const cell = useCell(() => [getConfig(), getDiscovery(), RequestClass]);
+    return valueHook(kit)(() => kit.readResource(cell));
+}
+function resultOf(kit, getRequest, getDiscovery, getOptions) {
+    const useHolder = kit.createResourceHook(createRequestResultController);
+    const holder = useHolder(() => [getRequest(), getDiscovery(), getOptions()]);
+    const result = valueHook(kit)(() => kit.readResource(holder).result);
+    return [result, options => kit.readResource(holder).promptAsync(options)];
+}
+function baseRequestOf(kit, getConfig, getDiscovery) {
+    const request = loadedRequestOf(kit, getConfig, getDiscovery, AuthRequest);
+    const [result, promptAsync] = resultOf(kit, () => kit.readValue(request), getDiscovery, () => ({}));
+    return [request, result, promptAsync];
+}
+function googleRequestOf(kit, getConfig, getRedirectUriOptions) {
+    const getSetup = () => resolveGoogleRequestSetup(getConfig(), getRedirectUriOptions());
+    const request = loadedRequestOf(kit, () => getSetup().requestConfig, () => googleDiscovery, GoogleRequest);
+    const [result, promptAsync] = resultOf(kit, () => kit.readValue(request), () => googleDiscovery, () => ({}));
+    const useExchange = kit.createResourceHook(createGoogleExchangeController);
+    const exchanged = useExchange(() => [
+        kit.readValue(result),
+        kit.readValue(request),
+        getSetup().exchange,
+    ]);
+    const fullResult = valueHook(kit)(() => kit.readResource(exchanged));
+    return [request, fullResult, promptAsync];
+}
+function facebookRequestOf(kit, getConfig, getRedirectUriOptions) {
+    const request = loadedRequestOf(kit, () => resolveFacebookRequestSetup(getConfig(), getRedirectUriOptions()), () => facebookDiscovery, FacebookRequest);
+    const [result, promptAsync] = resultOf(kit, () => kit.readValue(request), () => facebookDiscovery, () => ({}));
+    return [request, result, promptAsync];
+}
+export function createAuthRequestHooks(kit) {
+    const noOptions = kit.constant({});
+    return {
+        useAutoDiscovery: issuer => discoveryOf(kit, kit.toGetter(issuer)),
+        useLoadedAuthRequest: (config, discovery, RequestClass) => loadedRequestOf(kit, kit.toGetter(config), kit.toGetter(discovery), RequestClass),
+        useAuthRequestResult: (request, discovery, customOptions = kit.constant({})) => resultOf(kit, kit.toGetter(request), kit.toGetter(discovery), kit.toGetter(customOptions)),
+        useAuthRequest: (config, discovery) => baseRequestOf(kit, kit.toGetter(config), kit.toGetter(discovery)),
+        useGoogleAuthRequest: (config = kit.constant({}), redirect = noOptions) => googleRequestOf(kit, kit.toGetter(config), kit.toGetter(redirect)),
+        useGoogleIdTokenAuthRequest: (config, redirect = noOptions) => {
+            const getConfig = kit.toGetter(config);
+            return googleRequestOf(kit, () => toGoogleIdTokenConfig(getConfig()), kit.toGetter(redirect));
+        },
+        useFacebookAuthRequest: (config = kit.constant({}), redirect = noOptions) => facebookRequestOf(kit, kit.toGetter(config), kit.toGetter(redirect)),
+    };
+}

package/build/core/auth-request.d.ts

@@ -0,0 +1,29 @@
+import type { IAuthDiscoveryDocument, IAuthRequestConfig, IAuthRequestPromptOptions, Prompt } from './auth-request.types';
+import { CodeChallengeMethod, ResponseType } from './auth-request.types';
+import type { IAuthSessionResult } from './auth-session.types';
+/** Manages an authorization request, https://tools.ietf.org/html/rfc6749#section-4.1.1 */
+export declare class AuthRequest implements Omit<IAuthRequestConfig, 'state'> {
+    /** Protection against Cross-Site Request Forgery. */
+    state: string;
+    url: string | null;
+    codeVerifier?: string;
+    codeChallenge?: string;
+    readonly responseType: ResponseType | string;
+    readonly clientId: string;
+    readonly extraParams: Record<string, string>;
+    readonly usePKCE?: boolean;
+    readonly codeChallengeMethod: CodeChallengeMethod;
+    readonly redirectUri: string;
+    readonly scopes?: string[];
+    readonly clientSecret?: string;
+    readonly prompt?: Prompt | Prompt[];
+    constructor(request: IAuthRequestConfig);
+    /** Loads and returns a valid auth request config, generating PKCE fields if needed. */
+    getAuthRequestConfigAsync(): Promise<IAuthRequestConfig>;
+    /** Prompts the user to authorize, opening a browser session for the auth URL. */
+    promptAsync(discovery: IAuthDiscoveryDocument, { url, ...options }?: IAuthRequestPromptOptions): Promise<IAuthSessionResult>;
+    parseReturnUrl(url: string): IAuthSessionResult;
+    /** Builds and caches the authorization URL. */
+    makeAuthUrlAsync(discovery: IAuthDiscoveryDocument): Promise<string>;
+    private ensureCodeIsSetupAsync;
+}