@udibo/oauth2 0.1.0

package/esm/models/scope.js

@@ -0,0 +1,125 @@
+import { InvalidScopeError } from "../errors.js";
+/** NQCHAR as defined in RFC 6749. */
+export const NQCHAR = /[\x21\x23-\x5b\x5d-\x7e]/;
+/** Regex for validating a scope string. */
+export const SCOPE = new RegExp(`^(?:(?:${NQCHAR.source}+)(?: ${NQCHAR.source}+)*)?$`);
+/** Regex for extracting scope tokens. */
+export const SCOPE_TOKEN = new RegExp(`${NQCHAR.source}+`, "g");
+/**
+ * Base class for OAuth2 scope implementations.
+ *
+ * Provides the contract that the authorization server, grants, and adapters
+ * rely on. Users who want a custom scope type (e.g. one that enforces a
+ * fixed vocabulary, or one that encodes hierarchical scopes) can extend
+ * this class; the framework only requires a constructor that accepts an
+ * optional scope string and the instance methods declared here.
+ *
+ * The default implementation is {@link BasicScope}; it stores a set of
+ * space-delimited NQCHAR tokens per RFC 6749 Section 3.3.
+ */
+export class AbstractScope {
+}
+/** A basic implementation of OAuth2 scope. */
+export class BasicScope extends AbstractScope {
+    stringCache;
+    tokens;
+    /**
+     * Parses a space-delimited scope string into its tokens.
+     *
+     * @throws {InvalidScopeError} If `scope` contains characters outside the
+     * RFC 6749 NQCHAR set.
+     */
+    constructor(scope) {
+        super();
+        if (scope && !SCOPE.test(scope)) {
+            throw new InvalidScopeError("invalid scope");
+        }
+        this.tokens = scope ? new Set(scope.match(SCOPE_TOKEN)) : new Set();
+    }
+    /** Creates a new scope from a scope. */
+    static from(scope) {
+        if (typeof scope === "string")
+            return new BasicScope(scope);
+        const result = new BasicScope();
+        result.add(scope);
+        return result;
+    }
+    /** Creates a new scope with all scope tokens from both scopes. */
+    static union(a, b) {
+        return BasicScope.from(a).add(b);
+    }
+    /** Creates a new scope with all scope tokens that are present in both scopes. */
+    static intersection(a, b) {
+        const result = new BasicScope();
+        const scopeA = typeof a === "string" ? new BasicScope(a) : a;
+        const scopeB = typeof b === "string" ? new BasicScope(b) : b;
+        for (const token of scopeA) {
+            if (scopeB.tokens.has(token))
+                result.tokens.add(token);
+        }
+        return result;
+    }
+    /** Deletes all scope tokens from this scope. */
+    clear() {
+        this.tokens = new Set();
+        delete this.stringCache;
+        return this;
+    }
+    /** Adds all scope tokens in the passed in scope to this scope. */
+    add(scope) {
+        const other = typeof scope === "string" ? new BasicScope(scope) : scope;
+        for (const token of other) {
+            this.tokens.add(token);
+        }
+        delete this.stringCache;
+        return this;
+    }
+    /** Removes all scope tokens in the passed in scope from this scope. */
+    remove(scope) {
+        const other = typeof scope === "string" ? new BasicScope(scope) : scope;
+        for (const token of other) {
+            this.tokens.delete(token);
+        }
+        delete this.stringCache;
+        return this;
+    }
+    /** Checks that this scope has all scope tokens in the passed in scope. */
+    has(scope) {
+        const other = typeof scope === "string" ? new BasicScope(scope) : scope;
+        for (const token of other) {
+            if (!this.tokens.has(token))
+                return false;
+        }
+        return true;
+    }
+    /** Checks that this scope is equal to the passed in scope. */
+    equals(scope) {
+        const other = typeof scope === "string" ? new BasicScope(scope) : scope;
+        if (this.tokens.size !== other.size)
+            return false;
+        for (const token of other) {
+            if (!this.tokens.has(token))
+                return false;
+        }
+        return true;
+    }
+    /** Returns the number of scope tokens. */
+    get size() {
+        return this.tokens.size;
+    }
+    /** Converts the scope to a string representation. */
+    toString() {
+        if (typeof this.stringCache !== "string") {
+            this.stringCache = [...this].join(" ");
+        }
+        return this.stringCache;
+    }
+    /** Converts the scope to a JSON representation. */
+    toJSON() {
+        return this.toString();
+    }
+    /** Iterates the scope's tokens in insertion order. */
+    *[Symbol.iterator]() {
+        yield* this.tokens.values();
+    }
+}

package/esm/models/token.d.ts

@@ -0,0 +1,135 @@
+import type { AbstractScope, BasicScope } from "./scope.js";
+import type { ClientInterface } from "./client.js";
+import type { AuthenticationContext } from "./authentication.js";
+/**
+ * Token model representing an access token.
+ *
+ * Returned by the token services and the resource server, and part of the
+ * public `TokenServiceInterface` / `TokenReaderInterface` surface that
+ * consumers implement. The generic parameters allow customizing the client,
+ * user, and scope types.
+ */
+export interface Token<Client extends ClientInterface, User, Scope extends AbstractScope = BasicScope> {
+    /** The access token string. */
+    accessToken: string;
+    /** When the access token expires. */
+    accessTokenExpiresAt?: Date;
+    /** The client this token was issued to. */
+    client: Client;
+    /** The user this token was issued for (if applicable). */
+    user?: User;
+    /** The scope granted to this token. */
+    scope?: Scope | null;
+    /**
+     * The verified claims this token carried, when the reader that produced it
+     * had them — a validated JWT's payload, or an introspection response. The
+     * resource server builds its `Authorization` from these; a DB-backed token
+     * service may leave them unset, which yields an authorization with scope
+     * only.
+     */
+    claims?: Record<string, unknown>;
+    /** The authorization code used to generate this token, for replay detection per RFC 6819. */
+    code?: string;
+    /**
+     * OIDC nonce carried transiently from the authorization code so the token
+     * endpoint can echo it in the id_token. Not persisted by token stores.
+     */
+    nonce?: string;
+    /**
+     * Immutable event inherited from the code or refresh ancestor. Token stores
+     * must persist and restore it; never reconstruct it from the current session.
+     * Machine credentials omit it.
+     */
+    authenticationContext?: AuthenticationContext;
+}
+/** Token with refresh token capability. */
+export interface RefreshToken<Client extends ClientInterface, User, Scope extends AbstractScope = BasicScope> extends Token<Client, User, Scope> {
+    /** The refresh token string. */
+    refreshToken: string;
+    /** When the refresh token expires. */
+    refreshTokenExpiresAt?: Date;
+    /**
+     * The rotation family this refresh token belongs to: assigned at first
+     * issuance and inherited by every rotation, so replay of a rotated-out
+     * member can revoke the whole family (reuse detection).
+     */
+    familyId?: string;
+    /**
+     * When the rotation family was first issued: set alongside
+     * {@linkcode RefreshToken.familyId} at first issuance and carried unchanged
+     * through every rotation. It anchors the absolute cap
+     * ({@linkcode TokenServiceInterface.refreshTokenFamilyExpiresAt}), so a token
+     * service that persists refresh tokens **must** persist and restore it —
+     * dropping it on the round trip disables the cap.
+     *
+     * A record without an anchor (one stored before the cap existed) rotates
+     * once uncapped; that rotation is issued with a fresh anchor, so the family
+     * is capped from then on.
+     */
+    familyCreatedAt?: Date;
+}
+/**
+ * Standard OAuth2 token response.
+ *
+ * Returned by the token endpoint as defined in RFC 6749 Section 5.1.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.1
+ */
+export interface TokenResponse {
+    /** Always "Bearer" for OAuth2 Bearer tokens. */
+    token_type: "Bearer";
+    /** The access token issued by the authorization server. */
+    access_token: string;
+    /** Token lifetime in seconds. */
+    expires_in?: number;
+    /** Refresh token for obtaining new access tokens. */
+    refresh_token?: string;
+    /** Space-delimited list of granted scopes. */
+    scope?: string;
+    /** OIDC ID Token, present when the `openid` scope was granted to a user. */
+    id_token?: string;
+}
+/**
+ * Token introspection response as defined in RFC 7662.
+ *
+ * Used by resource servers to query the authorization server
+ * about the state of an access token. Authorization servers MAY
+ * include additional extension fields; the index signature exposes
+ * them to mapping functions like
+ * {@linkcode IntrospectionTokenReaderOptions.getClient}.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc7662#section-2.2
+ */
+export interface IntrospectionResponse {
+    /** Whether the token is currently active. */
+    active: boolean;
+    /** Space-delimited list of scopes associated with the token. */
+    scope?: string;
+    /** Client identifier for the OAuth2 client that requested the token. */
+    client_id?: string;
+    /** Human-readable identifier for the resource owner. */
+    username?: string;
+    /** Type of the token (e.g., "Bearer"). */
+    token_type?: string;
+    /** Token expiration time (Unix timestamp). */
+    exp?: number;
+    /** Token issue time (Unix timestamp). */
+    iat?: number;
+    /** Token not-before time (Unix timestamp). */
+    nbf?: number;
+    /**
+     * Subject identifier — the resource owner. Absent for a machine token
+     * issued without a user (client credentials): its `client_id` identifies
+     * the caller, and the missing `sub` marks that no resource owner is behind
+     * the token.
+     */
+    sub?: string;
+    /** Audience(s) the token is intended for. */
+    aud?: string | string[];
+    /** Issuer of the token. */
+    iss?: string;
+    /** Unique token identifier. */
+    jti?: string;
+    /** Extension fields. RFC 7662 allows servers to add their own claims. */
+    [extension: string]: unknown;
+}

package/esm/models/token.js

@@ -0,0 +1 @@
+export {};

package/esm/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

package/esm/react/callback.d.ts

@@ -0,0 +1,52 @@
+/**
+ * `<OAuth2Callback>` — mount on the SPA's callback route when the app runs a
+ * `DirectClient`. Calls `client.handleAuthorizationCallback` with the current
+ * URL, then navigates to the captured `returnTo`.
+ *
+ * Not for a `BffClient` app — the BFF owns `/auth/callback` there, and this
+ * component renders its `fallback` with a clear error rather than pretend
+ * otherwise.
+ *
+ * Idempotent against React 18 strict-mode double-mounts because the
+ * client itself dedupes by `code` — the second invocation returns the
+ * first call's promise.
+ *
+ * @module
+ */
+import { type ReactNode } from "react";
+import { type OAuth2Error } from "../client/mod.js";
+/** Props for {@link OAuth2Callback}. */
+export interface OAuth2CallbackProps {
+    /**
+     * Optional navigation hook. Receives the captured `returnTo` (or
+     * `"/"` if the original request didn't carry one). Use this to
+     * delegate to your router (`react-router`, `tanstack-router`,
+     * `wouter`, …). Defaults to
+     * `history.replaceState(null, "", returnTo)` so the auth params drop
+     * out of the URL bar without a full page navigation.
+     */
+    onNavigate?: (returnTo: string) => void;
+    /**
+     * Renders during the in-flight code exchange. Defaults to `null`.
+     */
+    pending?: ReactNode;
+    /**
+     * Renders if the callback fails. Defaults to a plain `<pre>` with the
+     * message.
+     *
+     * The error is always a real {@link OAuth2Error}, so `extensions` is safe to
+     * read: a failure the authorization server did not describe — a bookmarked
+     * callback route with no `code`, an undecodable `id_token` — arrives wrapped
+     * as `server_error` with the original error as its `cause`.
+     */
+    fallback?: (error: OAuth2Error) => ReactNode;
+}
+/**
+ * Mount on the callback route. Exchanges the code, then navigates to
+ * `returnTo`.
+ *
+ * @param props Optional navigation hook plus pending / error renderers.
+ * @returns The pending node while the exchange is in flight, the fallback on
+ * failure, and nothing once it has navigated.
+ */
+export declare function OAuth2Callback(props: OAuth2CallbackProps): ReactNode;

package/esm/react/callback.js

@@ -0,0 +1,71 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+// deno-lint-ignore-file no-window -- browser-only; `window` used only after isBrowser() guards
+/**
+ * `<OAuth2Callback>` — mount on the SPA's callback route when the app runs a
+ * `DirectClient`. Calls `client.handleAuthorizationCallback` with the current
+ * URL, then navigates to the captured `returnTo`.
+ *
+ * Not for a `BffClient` app — the BFF owns `/auth/callback` there, and this
+ * component renders its `fallback` with a clear error rather than pretend
+ * otherwise.
+ *
+ * Idempotent against React 18 strict-mode double-mounts because the
+ * client itself dedupes by `code` — the second invocation returns the
+ * first call's promise.
+ *
+ * @module
+ */
+import { useEffect, useRef, useState } from "react";
+import { DirectClient } from "../client/mod.js";
+import { ServerError, toOAuth2Error } from "../errors.js";
+import { useOAuth2 } from "./use-oauth2.js";
+const isBrowser = () => typeof window !== "undefined";
+const defaultNavigate = (returnTo) => {
+    if (!isBrowser())
+        return;
+    window.history.replaceState(null, "", returnTo);
+};
+const defaultFallback = (error) => (_jsx("pre", { style: { color: "red" }, children: error.message }));
+/**
+ * Mount on the callback route. Exchanges the code, then navigates to
+ * `returnTo`.
+ *
+ * @param props Optional navigation hook plus pending / error renderers.
+ * @returns The pending node while the exchange is in flight, the fallback on
+ * failure, and nothing once it has navigated.
+ */
+export function OAuth2Callback(props) {
+    const { onNavigate = defaultNavigate, pending = null, fallback = defaultFallback, } = props;
+    const { client } = useOAuth2();
+    const [error, setError] = useState(null);
+    // Ref so the exchange effect depends only on `client`; a non-memoized
+    // `onNavigate` must not re-run it after `code` is stripped from the URL.
+    const onNavigateRef = useRef(onNavigate);
+    onNavigateRef.current = onNavigate;
+    useEffect(() => {
+        if (!isBrowser())
+            return;
+        if (!(client instanceof DirectClient)) {
+            setError(new ServerError("<OAuth2Callback> needs the provider's client to be a " +
+                `DirectClient, but it is a ${client.constructor.name}. Behind a ` +
+                "BffClient the BFF owns the callback route."));
+            return;
+        }
+        let cancelled = false;
+        client.handleAuthorizationCallback(window.location.href).then((result) => {
+            if (cancelled)
+                return;
+            onNavigateRef.current(result.returnTo ?? "/");
+        }, (err) => {
+            if (cancelled)
+                return;
+            setError(toOAuth2Error(err));
+        });
+        return () => {
+            cancelled = true;
+        };
+    }, [client]);
+    if (error)
+        return fallback(error);
+    return pending;
+}

package/esm/react/components/class-names.d.ts

@@ -0,0 +1,91 @@
+/**
+ * The styling seam shared by the prebuilt auth forms
+ * (`@udibo/oauth2/react/components`): a React context carrying the per-slot
+ * class map ({@link AuthFormClassNames}), so the elements inside a form read
+ * their classes from the tree rather than from a `classNames` prop threaded
+ * through every wrapper.
+ *
+ * Wrap a subtree in {@link AuthFormClassNamesProvider} to theme every form
+ * under it at once, and read the map in effect from your own components with
+ * {@link useAuthFormClassNames}.
+ *
+ * @module
+ */
+import { type ReactNode } from "react";
+import type { AuthFormClassNames } from "./types.js";
+/**
+ * Resolves the per-slot class map for this position in the tree: the nearest
+ * {@link AuthFormClassNamesProvider}'s map with `overrides` applied slot by
+ * slot. An absent or `undefined` slot in `overrides` keeps the inherited value,
+ * and with no provider above the map is empty (every slot `undefined`), so the
+ * hook is safe to call anywhere. This is the only place the precedence rule is
+ * implemented.
+ *
+ * The result is cached on the slot values, so passing a fresh `overrides`
+ * literal every render returns the identical map.
+ *
+ * Call it with no argument from a component rendered **inside** a form to read
+ * the theme in effect; call it with a component's own `classNames` prop to
+ * resolve the map that component should both render with and publish.
+ *
+ * @param overrides Per-slot classes that win over the inherited map.
+ * @returns The resolved map, keyed by {@link AuthFormClassNames} slot.
+ *
+ * @example Theme a custom field to match the form around it
+ * ```tsx
+ * function TenantField(props: { fieldProps: AuthFieldProps }) {
+ *   const classNames = useAuthFormClassNames();
+ *   return (
+ *     <div className={classNames.field}>
+ *       <label className={classNames.label} htmlFor={props.fieldProps.id}>
+ *         Tenant
+ *       </label>
+ *       <input {...props.fieldProps} className={classNames.input} />
+ *     </div>
+ *   );
+ * }
+ * ```
+ */
+export declare function useAuthFormClassNames(overrides?: AuthFormClassNames): Readonly<AuthFormClassNames>;
+/**
+ * Publishes an already-resolved map verbatim, without merging. A form and
+ * `AuthFormShell` resolve once through {@link useAuthFormClassNames} and
+ * publish through this, so the precedence rule keeps exactly one
+ * implementation. App code wants {@link AuthFormClassNamesProvider}.
+ */
+export declare function AuthFormClassNamesScope(props: {
+    classNames: Readonly<AuthFormClassNames>;
+    children?: ReactNode;
+}): ReactNode;
+/** Props for {@link AuthFormClassNamesProvider}. */
+export interface AuthFormClassNamesProviderProps {
+    /** Per-slot classes to publish to `children`. See {@link AuthFormClassNames}. */
+    classNames: AuthFormClassNames;
+    /** The subtree the map applies to. */
+    children?: ReactNode;
+}
+/**
+ * Publishes a per-slot class map to every prebuilt auth form in `children`, so
+ * an app themes its whole auth surface once instead of repeating the same
+ * `classNames` on each form. Providers nest: an inner provider — or a form's
+ * own `classNames` prop — overrides the inherited map slot by slot, leaving the
+ * slots it does not name intact.
+ *
+ * It themes the auth **forms**; `UserMenu` is deliberately outside its reach
+ * and takes its classes from its own `className` / `classNames` props.
+ *
+ * An inline `classNames` literal is fine here — the published map is cached on
+ * the slot values rather than on the object's identity, so re-rendering with an
+ * equal literal hands the forms below the identical map.
+ *
+ * @example
+ * ```tsx
+ * <AuthFormClassNamesProvider
+ *   classNames={{ input: "input", submit: "btn btn-primary" }}
+ * >
+ *   <SignInForm onSubmit={signIn} />
+ *   <SignUpForm onSubmit={signUp} />
+ * </AuthFormClassNamesProvider>
+ * ```
+ */
+export declare function AuthFormClassNamesProvider(props: AuthFormClassNamesProviderProps): ReactNode;

package/esm/react/components/class-names.js

@@ -0,0 +1,118 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+/**
+ * The styling seam shared by the prebuilt auth forms
+ * (`@udibo/oauth2/react/components`): a React context carrying the per-slot
+ * class map ({@link AuthFormClassNames}), so the elements inside a form read
+ * their classes from the tree rather than from a `classNames` prop threaded
+ * through every wrapper.
+ *
+ * Wrap a subtree in {@link AuthFormClassNamesProvider} to theme every form
+ * under it at once, and read the map in effect from your own components with
+ * {@link useAuthFormClassNames}.
+ *
+ * @module
+ */
+import { createContext, useContext, useRef } from "react";
+const EMPTY_CLASS_NAMES = Object.freeze({});
+const AuthFormClassNamesContext = createContext(EMPTY_CLASS_NAMES);
+function merge(inherited, overrides) {
+    const resolved = { ...inherited };
+    for (const [slot, value] of Object.entries(overrides)) {
+        if (value !== undefined) {
+            resolved[slot] = value;
+        }
+    }
+    return Object.freeze(resolved);
+}
+function slotKey(classNames) {
+    const slots = Object.entries(classNames)
+        .filter(([, value]) => value !== undefined)
+        .sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+    return JSON.stringify(slots);
+}
+/**
+ * Resolves the per-slot class map for this position in the tree: the nearest
+ * {@link AuthFormClassNamesProvider}'s map with `overrides` applied slot by
+ * slot. An absent or `undefined` slot in `overrides` keeps the inherited value,
+ * and with no provider above the map is empty (every slot `undefined`), so the
+ * hook is safe to call anywhere. This is the only place the precedence rule is
+ * implemented.
+ *
+ * The result is cached on the slot values, so passing a fresh `overrides`
+ * literal every render returns the identical map.
+ *
+ * Call it with no argument from a component rendered **inside** a form to read
+ * the theme in effect; call it with a component's own `classNames` prop to
+ * resolve the map that component should both render with and publish.
+ *
+ * @param overrides Per-slot classes that win over the inherited map.
+ * @returns The resolved map, keyed by {@link AuthFormClassNames} slot.
+ *
+ * @example Theme a custom field to match the form around it
+ * ```tsx
+ * function TenantField(props: { fieldProps: AuthFieldProps }) {
+ *   const classNames = useAuthFormClassNames();
+ *   return (
+ *     <div className={classNames.field}>
+ *       <label className={classNames.label} htmlFor={props.fieldProps.id}>
+ *         Tenant
+ *       </label>
+ *       <input {...props.fieldProps} className={classNames.input} />
+ *     </div>
+ *   );
+ * }
+ * ```
+ */
+export function useAuthFormClassNames(overrides) {
+    const inherited = useContext(AuthFormClassNamesContext);
+    const key = overrides ? slotKey(overrides) : "";
+    const held = useRef(null);
+    if (held.current === null || held.current.inherited !== inherited ||
+        held.current.key !== key) {
+        held.current = {
+            inherited,
+            key,
+            resolved: overrides ? merge(inherited, overrides) : inherited,
+        };
+    }
+    return held.current.resolved;
+}
+/**
+ * Publishes an already-resolved map verbatim, without merging. A form and
+ * `AuthFormShell` resolve once through {@link useAuthFormClassNames} and
+ * publish through this, so the precedence rule keeps exactly one
+ * implementation. App code wants {@link AuthFormClassNamesProvider}.
+ */
+export function AuthFormClassNamesScope(props) {
+    const { classNames, children } = props;
+    return (_jsx(AuthFormClassNamesContext.Provider, { value: classNames, children: children }));
+}
+/**
+ * Publishes a per-slot class map to every prebuilt auth form in `children`, so
+ * an app themes its whole auth surface once instead of repeating the same
+ * `classNames` on each form. Providers nest: an inner provider — or a form's
+ * own `classNames` prop — overrides the inherited map slot by slot, leaving the
+ * slots it does not name intact.
+ *
+ * It themes the auth **forms**; `UserMenu` is deliberately outside its reach
+ * and takes its classes from its own `className` / `classNames` props.
+ *
+ * An inline `classNames` literal is fine here — the published map is cached on
+ * the slot values rather than on the object's identity, so re-rendering with an
+ * equal literal hands the forms below the identical map.
+ *
+ * @example
+ * ```tsx
+ * <AuthFormClassNamesProvider
+ *   classNames={{ input: "input", submit: "btn btn-primary" }}
+ * >
+ *   <SignInForm onSubmit={signIn} />
+ *   <SignUpForm onSubmit={signUp} />
+ * </AuthFormClassNamesProvider>
+ * ```
+ */
+export function AuthFormClassNamesProvider(props) {
+    const { classNames, children } = props;
+    const resolved = useAuthFormClassNames(classNames);
+    return (_jsx(AuthFormClassNamesScope, { classNames: resolved, children: children }));
+}

package/esm/react/components/internal.d.ts

@@ -0,0 +1,62 @@
+import { type ReactNode, type Ref } from "react";
+import type { AuthFieldProps, AuthFormState } from "./use-auth-form.js";
+import type { AuthFormClassNames, AuthFormValues, SocialProvidersProps } from "./types.js";
+/**
+ * The single exit every default form component returns through — it owns both
+ * outcomes, so a form has one `return` and cannot leave a subtree unscoped.
+ *
+ * With no `render`, it lays out the markup the forms share: the root wrapper
+ * carrying `data-oauth2-form={name}`, then the `<form>` with its error summary
+ * and the caller's fields. Use `aboveForm` for content that belongs inside the
+ * root but outside the form (social buttons, an enrollment secret), and
+ * `succeeded` for a terminal state that replaces the form entirely. With a
+ * `render` — the form's render-prop `children` — that markup is skipped for the
+ * caller's own. Either way the already-resolved `classNames` is published to
+ * what renders, so the elements inside take their classes from the tree.
+ */
+export declare function AuthFormShell<V extends AuthFormValues>(props: {
+    name: string;
+    form: AuthFormState<V>;
+    className: string | undefined;
+    classNames: Readonly<AuthFormClassNames>;
+    render: ((state: AuthFormState<V>) => ReactNode) | undefined;
+    rootProps?: Record<`data-${string}`, string>;
+    aboveForm?: ReactNode;
+    succeeded?: ReactNode;
+    children?: ReactNode;
+    action?: string;
+    method?: "get" | "post";
+    formRef?: Ref<HTMLFormElement>;
+}): ReactNode;
+/** The actions row and its submit button, disabled while the form is in flight. */
+export declare function SubmitButton(props: {
+    isSubmitting: boolean;
+    label: string;
+    submittingLabel: string;
+}): ReactNode;
+export declare function TextField(props: {
+    fieldProps: AuthFieldProps;
+    label: string;
+    type?: string;
+    autoComplete?: string;
+    required?: boolean;
+    error?: string;
+    inputRef?: Ref<HTMLInputElement>;
+    children?: ReactNode;
+}): ReactNode;
+export declare function ErrorSummary(props: {
+    error: string | null;
+    focusTrigger?: number;
+}): ReactNode;
+/**
+ * Moves keyboard focus to the first field that came back with an error after a
+ * failed submit, so a screen-reader / keyboard user lands on the control to fix
+ * (its label + error are read via `aria-describedby`) instead of being stranded
+ * on the disabled submit button. No-ops on the initial render and when the form
+ * carries a form-level error ({@link ErrorSummary} owns that focus). Call it
+ * once, unconditionally, from a form component built on {@link useAuthForm}.
+ */
+export declare function useFocusFirstError<V extends AuthFormValues>(form: AuthFormState<V>): void;
+export declare function SocialButtons(props: SocialProvidersProps): ReactNode;
+export declare function combineClassNames(className: string | undefined, slot: string | undefined): string | undefined;
+export declare function displayName(user: Record<string, unknown>): string;