@udibo/oauth2 0.1.0

package/esm/identity/external/flow.js

@@ -0,0 +1,158 @@
+/**
+ * The provider-agnostic two-step flow for external (social) sign-in:
+ * {@link ExternalAuthFlow.start} builds the redirect and hands back a
+ * serializable transient; {@link ExternalAuthFlow.finish} verifies the
+ * callback and returns the normalized profile.
+ *
+ * @module
+ */
+import { timingSafeEqualString } from "../../utils/crypto.js";
+import { generateCodeVerifier, generateState } from "../../utils/pkce.js";
+import { ExternalAuthError } from "./errors.js";
+/** Default {@link ExternalAuthFlowOptions.maxTransientAgeMs}: 10 minutes. */
+export const DEFAULT_MAX_TRANSIENT_AGE_MS = 10 * 60 * 1000;
+/**
+ * Drives one external provider through the authorization-code redirect dance
+ * without the library storing anything: {@link start} returns the redirect URL
+ * plus a JSON-serializable {@link ExternalAuthTransient} for the caller to keep
+ * (sealed cookie or session), and {@link finish} takes the callback params and
+ * that transient back and returns the verified {@link ExternalProfile}.
+ *
+ * The flow itself performs no network I/O — inject `fetch` on the provider to
+ * stub the network in tests. Create one flow per configured provider.
+ *
+ * @example
+ * ```ts
+ * const flow = new ExternalAuthFlow({
+ *   provider: googleProvider({ clientId, clientSecret }),
+ * });
+ *
+ * // GET /auth/social/google — redirect to Google, transient into a cookie.
+ * const { url, transient } = await flow.start({
+ *   redirectUri: "https://app.example.com/auth/social/google/callback",
+ * });
+ *
+ * // GET /auth/social/google/callback — verify and normalize.
+ * const profile = await flow.finish({
+ *   params: new URL(request.url).searchParams,
+ *   transient,
+ * });
+ * // App code decides: look up (profile.provider, profile.subject), create
+ * // or link a user, then start your own session.
+ * ```
+ */
+export class ExternalAuthFlow {
+    /** The connector this flow drives. */
+    provider;
+    #maxTransientAgeMs;
+    /** Creates a flow for one configured provider. */
+    constructor(options) {
+        this.provider = options.provider;
+        this.#maxTransientAgeMs = options.maxTransientAgeMs ??
+            DEFAULT_MAX_TRANSIENT_AGE_MS;
+    }
+    /**
+     * Begins a sign-in attempt: generates the per-attempt `state` (plus a PKCE
+     * verifier and OIDC nonce when the provider uses them), builds the
+     * provider's authorization URL, and returns both. Persist the transient
+     * (e.g. sealed cookie) and redirect the browser to `url`.
+     *
+     * @throws {ExternalAuthError} `configuration` when the provider cannot
+     *   resolve its endpoints (e.g. OIDC discovery failed).
+     */
+    async start(input) {
+        const state = generateState();
+        const codeVerifier = this.provider.usesPkce
+            ? generateCodeVerifier()
+            : undefined;
+        const nonce = this.provider.usesNonce ? generateState() : undefined;
+        const scopes = input.scopes ?? this.provider.defaultScopes;
+        const url = await this.provider.buildAuthorizationUrl({
+            redirectUri: input.redirectUri,
+            state,
+            codeVerifier,
+            nonce,
+            scopes,
+            prompt: input.prompt,
+        });
+        return {
+            url,
+            transient: {
+                state,
+                codeVerifier,
+                nonce,
+                provider: this.provider.id,
+                redirectUri: input.redirectUri,
+                createdAt: Date.now(),
+            },
+        };
+    }
+    /**
+     * Completes a sign-in attempt from the provider callback: enforces the max
+     * transient age, surfaces provider `error` callback params, verifies
+     * `state` with a timing-safe compare, exchanges the code, and (for OIDC
+     * providers) validates the id_token nonce — then returns the normalized
+     * profile.
+     *
+     * @throws {ExternalAuthError} with a code describing the failure — see
+     *   {@link ExternalAuthErrorCode} for how app code should respond to each.
+     */
+    async finish(input) {
+        const { transient } = input;
+        const providerId = this.provider.id;
+        if (transient.provider !== providerId) {
+            throw new ExternalAuthError(providerId, "configuration", `callback was given a transient started for provider ` +
+                `"${transient.provider}" — the app routed the callback to the ` +
+                `wrong flow. Route each provider's callback to the flow built ` +
+                `with that provider.`);
+        }
+        if (Date.now() - transient.createdAt > this.#maxTransientAgeMs) {
+            throw new ExternalAuthError(providerId, "transient_expired", `sign-in attempt expired (older than ${this.#maxTransientAgeMs}ms). ` +
+                `Ask the user to start signing in again.`);
+        }
+        const params = toSearchParams(input.params);
+        const state = params.get("state");
+        if (!state) {
+            throw new ExternalAuthError(providerId, "invalid_callback", `callback is missing the "state" parameter — the URL is not a ` +
+                `provider callback, or the provider dropped the state.`);
+        }
+        if (!timingSafeEqualString(state, transient.state)) {
+            throw new ExternalAuthError(providerId, "state_mismatch", `callback "state" does not match this sign-in attempt — possible ` +
+                `CSRF, or a stale/mixed-up attempt. Ask the user to start again.`);
+        }
+        const providerError = params.get("error");
+        if (providerError) {
+            const description = params.get("error_description");
+            throw new ExternalAuthError(providerId, "provider_error", `provider returned an error on the callback: "${providerError}"` +
+                (description ? ` (${description})` : "") +
+                `. "access_denied" means the user cancelled; ` +
+                `"redirect_uri_mismatch" means the redirectUri is not registered ` +
+                `with the provider exactly as sent.`);
+        }
+        const code = params.get("code");
+        if (!code) {
+            throw new ExternalAuthError(providerId, "invalid_callback", `callback is missing the "code" parameter.`);
+        }
+        return await this.provider.fetchProfile({
+            code,
+            redirectUri: transient.redirectUri,
+            codeVerifier: transient.codeVerifier,
+            nonce: transient.nonce,
+        });
+    }
+}
+function toSearchParams(input) {
+    if (input instanceof URLSearchParams)
+        return input;
+    if (input instanceof URL)
+        return input.searchParams;
+    try {
+        return new URL(input).searchParams;
+    }
+    catch {
+        const queryStart = input.indexOf("?");
+        const query = queryStart === -1 ? input : input.slice(queryStart + 1);
+        const hashStart = query.indexOf("#");
+        return new URLSearchParams(hashStart === -1 ? query : query.slice(0, hashStart));
+    }
+}

package/esm/identity/external/github.d.ts

@@ -0,0 +1,42 @@
+/**
+ * GitHub connector: plain OAuth2 (GitHub is not an OIDC provider), with the
+ * profile assembled from the REST API's `/user` and `/user/emails` endpoints.
+ *
+ * @module
+ */
+import type { ExternalProvider } from "./provider.js";
+/** Options for {@link githubProvider}. */
+export interface GithubProviderOptions {
+    /** Client ID of the GitHub OAuth App (or GitHub App). */
+    clientId: string;
+    /** The matching client secret. */
+    clientSecret: string;
+    /** Scopes requested by default. Defaults to `["read:user", "user:email"]`. */
+    scopes?: string[];
+    /** Fetch implementation for all provider traffic. Defaults to `globalThis.fetch`. */
+    fetch?: typeof fetch;
+}
+/**
+ * Creates a GitHub connector with id `"github"`.
+ *
+ * GitHub speaks plain OAuth2 (no discovery, no id_token, no PKCE for OAuth
+ * Apps), so the connector uses GitHub's fixed endpoints and builds the
+ * profile from `GET /user` plus `GET /user/emails`: the primary email is used
+ * (falling back to the first verified, then the first listed), and
+ * `emailVerified` reflects GitHub's flag for whichever email was chosen. When
+ * `/user/emails` is unavailable (e.g. the `user:email` scope was not granted),
+ * the public profile email is used with `emailVerified: false`. The `/user`
+ * payload (plus an `emails` array when fetched) is available on
+ * {@link ExternalProfile.raw}.
+ *
+ * @example
+ * ```ts
+ * const flow = new ExternalAuthFlow({
+ *   provider: githubProvider({
+ *     clientId: Deno.env.get("GITHUB_CLIENT_ID")!,
+ *     clientSecret: Deno.env.get("GITHUB_CLIENT_SECRET")!,
+ *   }),
+ * });
+ * ```
+ */
+export declare function githubProvider(options: GithubProviderOptions): ExternalProvider;

package/esm/identity/external/github.js

@@ -0,0 +1,164 @@
+/**
+ * GitHub connector: plain OAuth2 (GitHub is not an OIDC provider), with the
+ * profile assembled from the REST API's `/user` and `/user/emails` endpoints.
+ *
+ * @module
+ */
+import { describeError } from "./_shared.js";
+import { runTokenExchange } from "./_token-exchange.js";
+import { ExternalAuthError } from "./errors.js";
+const GITHUB_AUTHORIZE_URL = "https://github.com/login/oauth/authorize";
+const GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token";
+const GITHUB_USER_URL = "https://api.github.com/user";
+const GITHUB_EMAILS_URL = "https://api.github.com/user/emails";
+/**
+ * Creates a GitHub connector with id `"github"`.
+ *
+ * GitHub speaks plain OAuth2 (no discovery, no id_token, no PKCE for OAuth
+ * Apps), so the connector uses GitHub's fixed endpoints and builds the
+ * profile from `GET /user` plus `GET /user/emails`: the primary email is used
+ * (falling back to the first verified, then the first listed), and
+ * `emailVerified` reflects GitHub's flag for whichever email was chosen. When
+ * `/user/emails` is unavailable (e.g. the `user:email` scope was not granted),
+ * the public profile email is used with `emailVerified: false`. The `/user`
+ * payload (plus an `emails` array when fetched) is available on
+ * {@link ExternalProfile.raw}.
+ *
+ * @example
+ * ```ts
+ * const flow = new ExternalAuthFlow({
+ *   provider: githubProvider({
+ *     clientId: Deno.env.get("GITHUB_CLIENT_ID")!,
+ *     clientSecret: Deno.env.get("GITHUB_CLIENT_SECRET")!,
+ *   }),
+ * });
+ * ```
+ */
+export function githubProvider(options) {
+    const id = "github";
+    const fetchImpl = (input, init) => (options.fetch ?? globalThis.fetch)(input, init);
+    async function exchangeCode(input) {
+        const { value } = await runTokenExchange({
+            provider: id,
+            displayName: "GitHub",
+            endpoint: GITHUB_TOKEN_URL,
+            body: new URLSearchParams({
+                client_id: options.clientId,
+                client_secret: options.clientSecret,
+                code: input.code,
+                redirect_uri: input.redirectUri,
+            }),
+            requiredField: "access_token",
+            fetch: fetchImpl,
+            httpErrorHint: `Check that clientId/clientSecret match the GitHub ` +
+                `OAuth App and try again.`,
+            tokenErrorHint: githubTokenErrorHint,
+        });
+        return value;
+    }
+    async function getJson(url, accessToken) {
+        let res;
+        try {
+            res = await fetchImpl(url, {
+                headers: {
+                    Authorization: `Bearer ${accessToken}`,
+                    Accept: "application/vnd.github+json",
+                },
+            });
+        }
+        catch (error) {
+            throw new ExternalAuthError(id, "provider_error", `could not reach ${url} (${describeError(error)}). Try again.`, { cause: error });
+        }
+        if (!res.ok) {
+            await res.body?.cancel();
+            return null;
+        }
+        try {
+            return await res.json();
+        }
+        catch (error) {
+            throw new ExternalAuthError(id, "provider_error", `${url} returned a response that was not valid JSON ` +
+                `(${describeError(error)}).`, { cause: error });
+        }
+    }
+    return {
+        id,
+        displayName: "GitHub",
+        defaultScopes: options.scopes ?? ["read:user", "user:email"],
+        usesPkce: false,
+        usesNonce: false,
+        buildAuthorizationUrl(input) {
+            const url = new URL(GITHUB_AUTHORIZE_URL);
+            url.searchParams.set("client_id", options.clientId);
+            url.searchParams.set("redirect_uri", input.redirectUri);
+            url.searchParams.set("scope", input.scopes.join(" "));
+            url.searchParams.set("state", input.state);
+            if (input.prompt)
+                url.searchParams.set("prompt", input.prompt);
+            return Promise.resolve(url.toString());
+        },
+        async fetchProfile(input) {
+            const accessToken = await exchangeCode(input);
+            const [user, emailsRaw] = await Promise.all([
+                getJson(GITHUB_USER_URL, accessToken),
+                getJson(GITHUB_EMAILS_URL, accessToken),
+            ]);
+            if (!user || user.id === undefined || user.id === null) {
+                throw new ExternalAuthError(id, "provider_error", `could not load the user profile from ${GITHUB_USER_URL}. The ` +
+                    `access token was issued but lacks profile access — ensure the ` +
+                    `"read:user" scope is requested.`);
+            }
+            const emails = parseGithubEmails(emailsRaw);
+            const chosen = emails?.find((entry) => entry.primary) ??
+                emails?.find((entry) => entry.verified) ?? emails?.[0];
+            const publicEmail = typeof user.email === "string"
+                ? user.email
+                : undefined;
+            return {
+                provider: id,
+                subject: String(user.id),
+                email: chosen?.email ?? publicEmail,
+                emailVerified: chosen?.verified === true,
+                name: typeof user.name === "string" ? user.name : undefined,
+                picture: typeof user.avatar_url === "string"
+                    ? user.avatar_url
+                    : undefined,
+                raw: Array.isArray(emailsRaw) ? { ...user, emails: emailsRaw } : user,
+            };
+        },
+    };
+}
+function parseGithubEmails(raw) {
+    if (!Array.isArray(raw))
+        return null;
+    const entries = [];
+    for (const entry of raw) {
+        if (typeof entry !== "object" || entry === null)
+            continue;
+        const { email, primary, verified } = entry;
+        if (typeof email !== "string" || email.length === 0)
+            continue;
+        entries.push({
+            email,
+            primary: primary === true,
+            verified: verified === true,
+        });
+    }
+    return entries;
+}
+function githubTokenErrorHint(error) {
+    if (error === "incorrect_client_credentials") {
+        return `Check clientId/clientSecret against the GitHub OAuth App ` +
+            `settings.`;
+    }
+    if (error === "redirect_uri_mismatch") {
+        return `The redirectUri must exactly match the "Authorization callback ` +
+            `URL" configured on the GitHub OAuth App.`;
+    }
+    if (error === "bad_verification_code") {
+        return `The code expired or was already used — ask the user to start ` +
+            `signing in again.`;
+    }
+    return `See https://docs.github.com/apps/oauth-apps for the error's ` +
+        `meaning.`;
+}

package/esm/identity/external/google.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Google sign-in preset over the generic {@link oidcProvider} connector.
+ *
+ * @module
+ */
+import type { DiscoveryCache } from "../../client/discovery-cache.js";
+import type { AzpPolicy } from "./_shared.js";
+import type { ExternalProvider } from "./provider.js";
+/** Options for {@link googleProvider}. */
+export interface GoogleProviderOptions {
+    /** OAuth client ID from the Google Cloud console ("Web application" type). */
+    clientId: string;
+    /** The matching OAuth client secret. */
+    clientSecret: string;
+    /** Scopes requested by default. Defaults to `["openid", "email", "profile"]`. */
+    scopes?: string[];
+    /**
+     * How the id_token's `azp` claim is checked. Defaults to `"conditional"`.
+     * Google's cross-client identity is the case for `"ignore"`: a token minted
+     * for another client of the same project reports that client in `azp` while
+     * `aud` is this one. See {@link AzpPolicy}.
+     */
+    azp?: AzpPolicy;
+    /** Fetch implementation for all provider traffic. Defaults to `globalThis.fetch`. */
+    fetch?: typeof fetch;
+    /**
+     * Cache Google's discovery document is read from and written to, shared with
+     * any other connector given the same instance. Supply one when the connector
+     * is rebuilt per request. See {@link OidcProviderOptions.discoveryCache}.
+     */
+    discoveryCache?: DiscoveryCache;
+}
+/**
+ * Creates a Google connector: the generic OIDC connector pinned to issuer
+ * `https://accounts.google.com` with id `"google"`.
+ *
+ * Claim mapping follows the OIDC normalization: `emailVerified` is `true`
+ * only when Google asserts `email_verified: true`, and Google-specific claims
+ * such as `hd` (the Workspace domain) stay available on
+ * {@link ExternalProfile.raw}.
+ *
+ * @example
+ * ```ts
+ * const flow = new ExternalAuthFlow({
+ *   provider: googleProvider({
+ *     clientId: Deno.env.get("GOOGLE_CLIENT_ID")!,
+ *     clientSecret: Deno.env.get("GOOGLE_CLIENT_SECRET")!,
+ *   }),
+ * });
+ * ```
+ */
+export declare function googleProvider(options: GoogleProviderOptions): ExternalProvider;

package/esm/identity/external/google.js

@@ -0,0 +1,38 @@
+/**
+ * Google sign-in preset over the generic {@link oidcProvider} connector.
+ *
+ * @module
+ */
+import { oidcProvider } from "./oidc.js";
+/**
+ * Creates a Google connector: the generic OIDC connector pinned to issuer
+ * `https://accounts.google.com` with id `"google"`.
+ *
+ * Claim mapping follows the OIDC normalization: `emailVerified` is `true`
+ * only when Google asserts `email_verified: true`, and Google-specific claims
+ * such as `hd` (the Workspace domain) stay available on
+ * {@link ExternalProfile.raw}.
+ *
+ * @example
+ * ```ts
+ * const flow = new ExternalAuthFlow({
+ *   provider: googleProvider({
+ *     clientId: Deno.env.get("GOOGLE_CLIENT_ID")!,
+ *     clientSecret: Deno.env.get("GOOGLE_CLIENT_SECRET")!,
+ *   }),
+ * });
+ * ```
+ */
+export function googleProvider(options) {
+    return oidcProvider({
+        id: "google",
+        displayName: "Google",
+        issuer: "https://accounts.google.com",
+        clientId: options.clientId,
+        clientSecret: options.clientSecret,
+        scopes: options.scopes,
+        azp: options.azp,
+        fetch: options.fetch,
+        discoveryCache: options.discoveryCache,
+    });
+}

package/esm/identity/external/mod.d.ts

@@ -0,0 +1,63 @@
+/**
+ * External-provider (social login) connectors: a storage-free flow that turns
+ * "Sign in with Google/GitHub/any OIDC provider" into a verified, normalized
+ * {@link ExternalProfile}.
+ *
+ * The library's job ends at the profile. It stores nothing — the only state
+ * is the JSON-serializable {@link ExternalAuthTransient} the caller keeps in a
+ * cookie or session between {@link ExternalAuthFlow.start} and
+ * {@link ExternalAuthFlow.finish} — and it takes no position on what the app
+ * does with the profile (create a user, link an account, reject): key
+ * identities by `(provider, subject)` in your own storage.
+ *
+ * - {@link ExternalAuthFlow} — the two-step redirect flow (start → finish)
+ *   with CSRF state, PKCE, nonce, and transient-expiry handling built in.
+ * - {@link oidcProvider} — generic OpenID Connect connector via discovery.
+ * - {@link oauth2Provider} — generic plain-OAuth2 connector (no discovery / no
+ *   id_token) for providers {@link oidcProvider} cannot cover.
+ * - {@link googleProvider} / {@link githubProvider} / {@link discordProvider} /
+ *   {@link appleProvider} — presets for the most common providers.
+ * - {@link ExternalProvider} — the small interface to implement for any
+ *   provider the built-ins don't cover.
+ * - {@link ExternalAuthError} — diagnosable failures; every message names the
+ *   provider, what failed, and the likely fix.
+ * - {@link MemoryDiscoveryCache} — hand one to every OIDC connector a server
+ *   rebuilds per request so they share a discovery fetch instead of each
+ *   making their own.
+ *
+ * @example
+ * ```ts
+ * import {
+ *   ExternalAuthFlow,
+ *   googleProvider,
+ * } from "@udibo/oauth2/identity/external";
+ *
+ * const google = new ExternalAuthFlow({
+ *   provider: googleProvider({ clientId, clientSecret }),
+ * });
+ *
+ * // Route 1: redirect the user out.
+ * const { url, transient } = await google.start({ redirectUri });
+ * // …persist `transient` in a sealed cookie, redirect to `url`.
+ *
+ * // Route 2: the callback.
+ * const profile = await google.finish({ params: callbackUrl, transient });
+ * // …app code: find-or-create the user for (profile.provider,
+ * // profile.subject) and start a session.
+ * ```
+ *
+ * @module
+ */
+import "../../_dnt.polyfills.js";
+export { ExternalAuthError, type ExternalAuthErrorCode, isExternalAuthError, } from "./errors.js";
+export type { ExternalAuthorizationUrlInput, ExternalAuthTransient, ExternalProfile, ExternalProfileInput, ExternalProvider, } from "./provider.js";
+export { DEFAULT_MAX_TRANSIENT_AGE_MS, type ExternalAuthFinishInput, ExternalAuthFlow, type ExternalAuthFlowOptions, type ExternalAuthStartInput, type ExternalAuthStartResult, } from "./flow.js";
+export { oidcProvider, type OidcProviderOptions } from "./oidc.js";
+export type { AzpPolicy } from "./_shared.js";
+export { DEFAULT_DISCOVERY_CACHE_MAX_ENTRIES, DEFAULT_DISCOVERY_TTL_MS, type DiscoveryCache, type DiscoveryCacheEntry, MemoryDiscoveryCache, type MemoryDiscoveryCacheOptions, } from "../../client/discovery-cache.js";
+export { googleProvider, type GoogleProviderOptions } from "./google.js";
+export { githubProvider, type GithubProviderOptions } from "./github.js";
+export { type OAuth2ProfileMapper, type OAuth2ProfileMapping, oauth2Provider, type OAuth2ProviderOptions, type OAuth2TokenResult, } from "./oauth2.js";
+export { discordProvider, type DiscordProviderOptions } from "./discord.js";
+export { appleProvider, type AppleProviderOptions } from "./apple.js";
+export { APPLE_AUDIENCE, APPLE_CLIENT_SECRET_MAX_TTL_SECONDS, type AppleClientSecretFactory, type AppleClientSecretOptions, createAppleClientSecretFactory, DEFAULT_APPLE_CLIENT_SECRET_TTL_SECONDS, generateAppleClientSecret, } from "./apple-client-secret.js";

package/esm/identity/external/mod.js

@@ -0,0 +1,61 @@
+/**
+ * External-provider (social login) connectors: a storage-free flow that turns
+ * "Sign in with Google/GitHub/any OIDC provider" into a verified, normalized
+ * {@link ExternalProfile}.
+ *
+ * The library's job ends at the profile. It stores nothing — the only state
+ * is the JSON-serializable {@link ExternalAuthTransient} the caller keeps in a
+ * cookie or session between {@link ExternalAuthFlow.start} and
+ * {@link ExternalAuthFlow.finish} — and it takes no position on what the app
+ * does with the profile (create a user, link an account, reject): key
+ * identities by `(provider, subject)` in your own storage.
+ *
+ * - {@link ExternalAuthFlow} — the two-step redirect flow (start → finish)
+ *   with CSRF state, PKCE, nonce, and transient-expiry handling built in.
+ * - {@link oidcProvider} — generic OpenID Connect connector via discovery.
+ * - {@link oauth2Provider} — generic plain-OAuth2 connector (no discovery / no
+ *   id_token) for providers {@link oidcProvider} cannot cover.
+ * - {@link googleProvider} / {@link githubProvider} / {@link discordProvider} /
+ *   {@link appleProvider} — presets for the most common providers.
+ * - {@link ExternalProvider} — the small interface to implement for any
+ *   provider the built-ins don't cover.
+ * - {@link ExternalAuthError} — diagnosable failures; every message names the
+ *   provider, what failed, and the likely fix.
+ * - {@link MemoryDiscoveryCache} — hand one to every OIDC connector a server
+ *   rebuilds per request so they share a discovery fetch instead of each
+ *   making their own.
+ *
+ * @example
+ * ```ts
+ * import {
+ *   ExternalAuthFlow,
+ *   googleProvider,
+ * } from "@udibo/oauth2/identity/external";
+ *
+ * const google = new ExternalAuthFlow({
+ *   provider: googleProvider({ clientId, clientSecret }),
+ * });
+ *
+ * // Route 1: redirect the user out.
+ * const { url, transient } = await google.start({ redirectUri });
+ * // …persist `transient` in a sealed cookie, redirect to `url`.
+ *
+ * // Route 2: the callback.
+ * const profile = await google.finish({ params: callbackUrl, transient });
+ * // …app code: find-or-create the user for (profile.provider,
+ * // profile.subject) and start a session.
+ * ```
+ *
+ * @module
+ */
+import "../../_dnt.polyfills.js";
+export { ExternalAuthError, isExternalAuthError, } from "./errors.js";
+export { DEFAULT_MAX_TRANSIENT_AGE_MS, ExternalAuthFlow, } from "./flow.js";
+export { oidcProvider } from "./oidc.js";
+export { DEFAULT_DISCOVERY_CACHE_MAX_ENTRIES, DEFAULT_DISCOVERY_TTL_MS, MemoryDiscoveryCache, } from "../../client/discovery-cache.js";
+export { googleProvider } from "./google.js";
+export { githubProvider } from "./github.js";
+export { oauth2Provider, } from "./oauth2.js";
+export { discordProvider } from "./discord.js";
+export { appleProvider } from "./apple.js";
+export { APPLE_AUDIENCE, APPLE_CLIENT_SECRET_MAX_TTL_SECONDS, createAppleClientSecretFactory, DEFAULT_APPLE_CLIENT_SECRET_TTL_SECONDS, generateAppleClientSecret, } from "./apple-client-secret.js";