@ultimat3/auth 1.0.0

package/src/errors.ts

@@ -0,0 +1,229 @@
+// Single responsibility: this package's stable X_ codes and the factories that build them.
+// Auth is the one layer where a precise error message is itself a vulnerability, so the
+// factories here are deliberately coarse — `rate-limit.ts` owns the single login failure
+// every credential path must throw, and nothing else describes *why* a credential failed.
+
+import { registerErrorCodes, UltimateError } from '@ultimat3/core';
+
+/** Codes this package declares and owns. `X_UNAUTHENTICATED` is auth's; http only borrows it. */
+export const AUTH_OWNED_ERROR_CODES = [
+  'X_UNAUTHENTICATED',
+  'X_SESSION_EXPIRED',
+  'X_MFA_REQUIRED',
+  'X_OAUTH_STATE_INVALID',
+  'X_OAUTH_EXCHANGE_FAILED',
+  'X_OAUTH_TOKEN_INVALID',
+  'X_PASSWORD_WEAK',
+  'X_ACCOUNT_LOCKED',
+  'X_API_KEY_INVALID',
+  'X_AUTH_WRITE_FAILED',
+] as const;
+
+/**
+ * Codes another package owns that auth only throws: `X_FORBIDDEN` is `@ultimat3/policy`'s and
+ * `X_NOT_IMPLEMENTED` is `@ultimat3/core`'s. No titles here on purpose — a second copy of a title
+ * is a title that drifts, and registering one of these would be `X_ERROR_CODE_DUPLICATE`.
+ */
+export const AUTH_BORROWED_ERROR_CODES = ['X_FORBIDDEN', 'X_NOT_IMPLEMENTED'] as const;
+
+/** Every code auth can throw: the ones it owns plus the ones it borrows. */
+export const AUTH_ERROR_CODES = [...AUTH_OWNED_ERROR_CODES, ...AUTH_BORROWED_ERROR_CODES] as const;
+
+export type AuthOwnedErrorCode = (typeof AUTH_OWNED_ERROR_CODES)[number];
+export type AuthErrorCode = (typeof AUTH_ERROR_CODES)[number];
+
+export const AUTH_ERROR_TITLES: Readonly<Record<AuthOwnedErrorCode, string>> = {
+  X_UNAUTHENTICATED: 'no authenticated actor for this request',
+  X_SESSION_EXPIRED: 'session passed its idle or absolute expiry',
+  X_MFA_REQUIRED: 'a second factor is required before this session is usable',
+  X_OAUTH_STATE_INVALID: 'oauth state, nonce or pkce verifier did not match',
+  X_OAUTH_EXCHANGE_FAILED: 'the oauth provider refused the exchange or returned no usable identity',
+  X_OAUTH_TOKEN_INVALID: 'id token failed its issuer, audience or expiry check',
+  X_PASSWORD_WEAK: 'password does not meet the configured policy',
+  X_ACCOUNT_LOCKED: 'too many failed attempts; this key is locked out',
+  X_API_KEY_INVALID: 'api key is unknown, revoked, expired or wrong',
+  X_AUTH_WRITE_FAILED: 'an adapter write returned no row, so it cannot be confirmed',
+};
+
+// Registered unconditionally, in one call: a second package claiming a code auth owns has to fail
+// loudly as X_ERROR_CODE_DUPLICATE at import. A presence guard would turn that collision into
+// whichever package loaded first deciding what the code means.
+registerErrorCodes(
+  Object.fromEntries(Object.entries(AUTH_ERROR_TITLES).map(([code, title]) => [code, { title }])),
+);
+
+/** Every code an `AuthError` may carry — the owned ones and the two borrowed ones alike. */
+export type AuthThrowCode = AuthErrorCode;
+
+export class AuthError extends UltimateError {
+  override readonly name = 'AuthError';
+
+  constructor(init: {
+    code: AuthThrowCode;
+    cause: string;
+    fix: string;
+    meta?: Readonly<Record<string, unknown>> | undefined;
+  }) {
+    super({
+      code: init.code,
+      cause: init.cause,
+      fix: init.fix,
+      docs: `https://ultimate.dev/errors/${init.code}`,
+      meta: init.meta,
+    });
+  }
+}
+
+export const unauthenticated = (surface: string): AuthError =>
+  new AuthError({
+    code: 'X_UNAUTHENTICATED',
+    cause: `${surface} needs an actor but ctx.actor is anonymous`,
+    fix: 'x auth whoami --json   # confirm the request carries the __Host-x_session cookie',
+  });
+
+export const forbidden = (surface: string, reason: string): AuthError =>
+  new AuthError({
+    code: 'X_FORBIDDEN',
+    cause: `${surface} denied: ${reason}`,
+    fix: 'x policy explain --json   # shows which grant the actor is missing',
+  });
+
+/** `kind` names which clock ran out — the two expiries are evaluated independently. */
+export const sessionExpired = (kind: 'absolute' | 'idle', sessionId: string): AuthError =>
+  new AuthError({
+    code: 'X_SESSION_EXPIRED',
+    cause: `session ${sessionId} passed its ${kind} expiry`,
+    fix: `sign in again, or raise session.${kind}TtlMs in defineAuth({ session })`,
+  });
+
+export const sessionUnknown = (): AuthError =>
+  new AuthError({
+    code: 'X_UNAUTHENTICATED',
+    cause: 'the session cookie does not match any live session',
+    fix: 'x auth sessions list --json   # then sign in again to mint a fresh session',
+  });
+
+export const mfaRequired = (userId: string): AuthError =>
+  new AuthError({
+    code: 'X_MFA_REQUIRED',
+    cause: `user ${userId} has TOTP enrolled and this session has not satisfied it`,
+    fix: 'POST /auth/mfa/verify { code } with the 6-digit code, then retry',
+  });
+
+export const oauthStateInvalid = (provider: string, part: string): AuthError =>
+  new AuthError({
+    code: 'X_OAUTH_STATE_INVALID',
+    cause: `${provider} callback rejected: ${part}`,
+    fix: `restart the flow at GET /auth/oauth/${provider} — a callback URL is single-use`,
+  });
+
+export interface OAuthExchangeFailure {
+  readonly provider: string;
+  /** Which leg of the server-to-server conversation failed. */
+  readonly stage: 'token' | 'userinfo';
+  readonly detail: string;
+  readonly status?: number | undefined;
+  readonly fix: string;
+}
+
+/**
+ * Deliberately specific, unlike every credential error above it. This one describes a
+ * conversation between two servers — naming the stage, the provider and its own status
+ * discloses nothing about any user, and is the difference between a fixable misconfiguration
+ * and a shrug.
+ */
+export const oauthExchangeFailed = (failure: OAuthExchangeFailure): AuthError =>
+  new AuthError({
+    code: 'X_OAUTH_EXCHANGE_FAILED',
+    cause:
+      `${failure.provider} ${failure.stage} request failed` +
+      `${failure.status === undefined ? '' : ` with HTTP ${failure.status}`}: ${failure.detail}`,
+    fix: failure.fix,
+    meta: {
+      provider: failure.provider,
+      stage: failure.stage,
+      ...(failure.status === undefined ? {} : { status: failure.status }),
+    },
+  });
+
+/**
+ * The address is proven to the provider, and an account that never proved it already holds it.
+ * Naming that is not account enumeration — this caller just demonstrated they own the address —
+ * and staying silent would leave them with a login that fails forever and no way out.
+ *
+ * The address itself rides in `meta`, never in `cause`: a log pipeline can redact a field by
+ * key, and cannot redact an address that was already interpolated into a sentence.
+ */
+export const oauthAccountNotLinked = (provider: string, email: string): AuthError =>
+  new AuthError({
+    code: 'X_UNAUTHENTICATED',
+    cause: `an account holds this ${provider} address but never verified it, so ${provider} may not claim it`,
+    fix: `sign in with that account's password and confirm the email-verify link, then retry ${provider}`,
+    meta: { provider, email },
+  });
+
+/**
+ * `CreateUserInput` carries no `emailVerifiedAt`, so a provider-verified address takes a second
+ * write. Falling back to the unstamped row would mint a session for a user every later login
+ * reads as unverified — the exact state `resolveUser` refuses to link a provider to — so the
+ * flow fails closed on an adapter that loses the stamp instead of half-succeeding.
+ */
+export const emailVerifiedNotStored = (provider: string, userId: string): AuthError =>
+  new AuthError({
+    code: 'X_NOT_IMPLEMENTED',
+    cause: `the adapter returned no row for new user ${userId}, so the ${provider}-verified address was never stamped verified`,
+    fix: 'return the updated row from AuthAdapter.updateUser — MemoryAdapter.updateUser is the reference implementation',
+    meta: { provider, userId },
+  });
+
+/** The token arrived, and is not one this handshake can trust: wrong `iss`, `aud`, or expired. */
+export const oauthTokenInvalid = (provider: string, reason: string, fix: string): AuthError =>
+  new AuthError({
+    code: 'X_OAUTH_TOKEN_INVALID',
+    cause: `${provider} id token rejected: ${reason}`,
+    fix,
+    meta: { provider },
+  });
+
+export const passwordWeak = (reasons: readonly string[]): AuthError =>
+  new AuthError({
+    code: 'X_PASSWORD_WEAK',
+    cause: `password rejected: ${reasons.join('; ')}`,
+    fix: 'choose a longer, uncommon password — or relax defineAuth({ password: { minLength } })',
+  });
+
+export const accountLocked = (key: string, retryAfterSeconds: number): AuthError =>
+  new AuthError({
+    code: 'X_ACCOUNT_LOCKED',
+    cause: `${key} is locked out for another ${retryAfterSeconds}s after repeated failures`,
+    fix: `wait ${retryAfterSeconds}s, or run: x auth unlock ${key}`,
+  });
+
+/** One shape for every api-key rejection: unknown, revoked, expired and wrong all look alike. */
+export const apiKeyInvalid = (): AuthError =>
+  new AuthError({
+    code: 'X_API_KEY_INVALID',
+    cause: 'the presented api key is unknown, revoked, expired or does not match its hash',
+    fix: 'x auth keys list --json   # then: x auth keys issue --scopes "<scope>"',
+  });
+
+/**
+ * A write whose `returning *` came back empty wrote nothing the caller may trust. Synthesising a
+ * row from `{}` is what would let `register()` hand back a user with no id and no email — a
+ * registration that reads as successful and authenticates nobody — so the adapter fails closed.
+ */
+export const authWriteFailed = (operation: string, table: string): AuthError =>
+  new AuthError({
+    code: 'X_AUTH_WRITE_FAILED',
+    cause: `${operation} returned no row from ${table}, so the write cannot be confirmed`,
+    fix: `x db migrate   # then: x db query "select 1 from ${table} limit 1" --json`,
+    meta: { operation, table },
+  });
+
+/** For a custom `AuthAdapter` that implements part of the seam. Nothing shipped throws it. */
+export const authNotImplemented = (feature: string, fix: string): AuthError =>
+  new AuthError({
+    code: 'X_NOT_IMPLEMENTED',
+    cause: `${feature} is not implemented by the built-in driver`,
+    fix,
+  });

package/src/guards.ts

@@ -0,0 +1,43 @@
+// Single responsibility: the assertions the http pipeline's auth stage runs. They read the
+// ambient actor from core's context and assert on it — they never evaluate a policy, never
+// load a row and never look at a session. `@ultimat3/policy` is the only authz evaluator;
+// duplicating even a little of it here would be the second authz system the framework forbids.
+
+import type { Actor } from '@ultimat3/core';
+import { hasRole, hasScope, isAnonymous, useContext } from '@ultimat3/core';
+import { forbidden, unauthenticated } from './errors';
+
+const DEFAULT_SURFACE = 'this request';
+
+/** Throws `X_UNAUTHENTICATED` when the ambient actor is anonymous. */
+export function requireActor(surface: string = DEFAULT_SURFACE): Actor {
+  const { actor } = useContext();
+  if (isAnonymous(actor)) throw unauthenticated(surface);
+  return actor;
+}
+
+/**
+ * A coarse role gate for routes that are role-shaped rather than permission-shaped (an admin
+ * area). Anything finer belongs in a policy — `can('post:publish')`, evaluated by policy.
+ */
+export function requireRole(role: string, surface: string = DEFAULT_SURFACE): Actor {
+  const actor = requireActor(surface);
+  if (!hasRole(actor, role)) throw forbidden(surface, `actor lacks role "${role}"`);
+  return actor;
+}
+
+/**
+ * The api-key path: an agent's scopes are exactly its key's scopes, so a scope check is a
+ * credential check, not an authorization decision.
+ */
+export function requireScope(scope: string, surface: string = DEFAULT_SURFACE): Actor {
+  const actor = requireActor(surface);
+  if (!hasScope(actor, scope)) throw forbidden(surface, `actor lacks scope "${scope}"`);
+  return actor;
+}
+
+/** Non-throwing form for a route that renders differently when signed out. */
+export function currentActor(): Actor | null {
+  const { actor } = useContext();
+  return isAnonymous(actor) ? null : actor;
+}

package/src/id-token-fixture.ts

@@ -0,0 +1,16 @@
+// Single responsibility: the one way this package's tests mint an id token. Three OAuth test
+// files each needs a base64url-encoded JWT, and three private copies of the encoder is three
+// chances for one to drift from what `decodeIdToken` actually parses. Not part of the public
+// API — `index.ts` deliberately does not re-export it.
+
+import { base64Url } from './tokens';
+
+/** `base64Url` takes bytes because every real secret is bytes; a JWT segment is text. */
+export const base64UrlText = (value: string): string => base64Url(new TextEncoder().encode(value));
+
+/**
+ * Header, payload, and a signature that is not one. Signatures are never checked here — the
+ * token is only ever read straight off the token endpoint — so a fixture needs no signer.
+ */
+export const unsignedJwt = (claims: Readonly<Record<string, unknown>>): string =>
+  `${base64UrlText('{"alg":"RS256"}')}.${base64UrlText(JSON.stringify(claims))}.signature`;

package/src/id-token.ts

@@ -0,0 +1,161 @@
+// Single responsibility: turning a provider's id token into claims this handshake is allowed to
+// believe. Signature verification is deliberately absent: this token is read only where it was
+// fetched over TLS directly from the provider's token endpoint, which is the one case OIDC Core
+// 3.1.3.7 exempts — a token that reaches the browser instead must never be parsed here.
+
+import type { Clock } from '@ultimat3/core';
+import { oauthStateInvalid, oauthTokenInvalid } from './errors';
+import { OAUTH_PROVIDERS, type OAuthProvider, type OAuthProviderId } from './oauth';
+import { timingSafeEqual } from './tokens';
+
+/** The subset of OIDC claims this package acts on. Provider-specific extras are ignored. */
+export interface IdTokenClaims {
+  readonly iss: string;
+  readonly aud: string | readonly string[];
+  readonly sub: string;
+  readonly exp: number;
+  readonly iat?: number | undefined;
+  readonly nonce?: string | undefined;
+  readonly email?: string | undefined;
+  /** Google sends a boolean, Apple a `"true"` string. Both mean the same thing. */
+  readonly email_verified?: boolean | string | undefined;
+  readonly name?: string | undefined;
+}
+
+/** Two servers rarely agree on the second. Anything wider hides a genuinely expired token. */
+export const ID_TOKEN_CLOCK_SKEW_MS = 60_000;
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  typeof value === 'object' && value !== null && !Array.isArray(value);
+
+const stringOrUndefined = (value: unknown): string | undefined =>
+  typeof value === 'string' ? value : undefined;
+
+function decodeSegment(provider: string, segment: string, fix: string): Record<string, unknown> {
+  const padded = segment
+    .replace(/-/g, '+')
+    .replace(/_/g, '/')
+    .padEnd(Math.ceil(segment.length / 4) * 4, '=');
+  let parsed: unknown;
+  try {
+    const binary = atob(padded);
+    const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+    parsed = JSON.parse(new TextDecoder().decode(bytes));
+  } catch {
+    throw oauthTokenInvalid(provider, 'the payload segment is not base64url-encoded JSON', fix);
+  }
+  if (!isRecord(parsed)) throw oauthTokenInvalid(provider, 'the payload is not an object', fix);
+  return parsed;
+}
+
+/**
+ * Structure only — no issuer, audience, expiry or nonce check. `verifyIdToken` is the entry
+ * point every flow uses; this one exists because the two halves are worth reading apart.
+ */
+export function decodeIdToken(provider: OAuthProviderId, idToken: string): IdTokenClaims {
+  const fix = `check that ${OAUTH_PROVIDERS[provider].clientIdEnv} names an app whose id token is a JWT`;
+  const segments = idToken.split('.');
+  if (segments.length !== 3 || segments[1] === undefined || segments[1] === '') {
+    throw oauthTokenInvalid(provider, 'the token is not a three-segment JWT', fix);
+  }
+  const payload = decodeSegment(provider, segments[1], fix);
+  const iss = stringOrUndefined(payload['iss']);
+  const sub = stringOrUndefined(payload['sub']);
+  const aud = payload['aud'];
+  const exp = payload['exp'];
+  if (iss === undefined || sub === undefined) {
+    throw oauthTokenInvalid(provider, 'the payload has no iss or sub claim', fix);
+  }
+  if (typeof exp !== 'number') {
+    throw oauthTokenInvalid(provider, 'the payload has no numeric exp claim', fix);
+  }
+  // The filter can empty a non-empty array (`aud: [1, 2]`), and an empty audience addresses
+  // nobody — `verifyIdToken` would then check the client id against nothing and pass.
+  const audience = Array.isArray(aud) ? aud.filter((one) => typeof one === 'string') : aud;
+  if (typeof audience !== 'string' && !(Array.isArray(audience) && audience.length > 0)) {
+    throw oauthTokenInvalid(provider, 'the payload has no aud claim naming a string audience', fix);
+  }
+  // `exactOptionalPropertyTypes`: an absent claim must be absent, not present-and-undefined.
+  const iat = payload['iat'];
+  const verified = payload['email_verified'];
+  const nonce = stringOrUndefined(payload['nonce']);
+  const email = stringOrUndefined(payload['email']);
+  const name = stringOrUndefined(payload['name']);
+  return {
+    iss,
+    aud: audience,
+    sub,
+    exp,
+    ...(typeof iat === 'number' ? { iat } : {}),
+    ...(nonce === undefined ? {} : { nonce }),
+    ...(email === undefined ? {} : { email }),
+    ...(typeof verified === 'boolean' || typeof verified === 'string'
+      ? { email_verified: verified }
+      : {}),
+    ...(name === undefined ? {} : { name }),
+  };
+}
+
+/**
+ * `"true"` and `true` both count; anything else — absent, `"false"`, a number — does not. Lives
+ * here rather than at each call site because userinfo spells the same flag the same two ways, and
+ * two copies of the rule is two places for one of them to start rounding a login up to verified.
+ */
+export const isVerifiedFlag = (value: unknown): boolean => value === true || value === 'true';
+
+export function idTokenEmailVerified(claims: IdTokenClaims): boolean {
+  return isVerifiedFlag(claims.email_verified);
+}
+
+export interface VerifyIdTokenInput {
+  readonly provider: OAuthProviderId;
+  readonly idToken: string;
+  /** The client id the authorize URL was built with. The token must be addressed to it. */
+  readonly clientId: string;
+  /** `OAuthHandshake.nonce`. Checked whenever the provider was asked for one. */
+  readonly nonce: string;
+  readonly clock: Clock;
+}
+
+/**
+ * Issuer, audience, expiry and nonce, in that order. A nonce mismatch is
+ * `X_OAUTH_STATE_INVALID` rather than a token error on purpose: it is the same class of event
+ * as a forged `state` — a token minted for another browser being replayed into this one.
+ */
+export function verifyIdToken(input: VerifyIdTokenInput): IdTokenClaims {
+  // Widened on purpose: `issuers` is a literal `readonly []` for a provider that issues no id
+  // token, and `[].includes(string)` does not typecheck against `never`.
+  const provider: OAuthProvider = OAUTH_PROVIDERS[input.provider];
+  const claims = decodeIdToken(input.provider, input.idToken);
+
+  if (!provider.issuers.includes(claims.iss)) {
+    throw oauthTokenInvalid(
+      provider.id,
+      `iss was "${claims.iss}", expected one of ${provider.issuers.join(', ')}`,
+      `confirm the token came from ${provider.tokenUrl} and not from a proxy that re-signs it`,
+    );
+  }
+
+  const audience = typeof claims.aud === 'string' ? [claims.aud] : claims.aud;
+  if (!audience.includes(input.clientId)) {
+    throw oauthTokenInvalid(
+      provider.id,
+      'aud does not include the client id this handshake was started with',
+      `set ${provider.clientIdEnv} to the same client id beginOAuth() was called with`,
+    );
+  }
+
+  if (claims.exp * 1000 + ID_TOKEN_CLOCK_SKEW_MS <= input.clock.now().getTime()) {
+    throw oauthTokenInvalid(
+      provider.id,
+      'the token is already expired',
+      "sync this host's clock (`timedatectl status`), then restart the flow",
+    );
+  }
+
+  if (provider.usesNonce && !timingSafeEqual(input.nonce, claims.nonce ?? '')) {
+    throw oauthStateInvalid(provider.id, 'the id token nonce did not match the stored handshake');
+  }
+
+  return claims;
+}

package/src/index.ts

@@ -0,0 +1,236 @@
+// Single responsibility: the public API of @ultimat3/auth. Explicit named exports only — this
+// list is what the http pipeline, the MCP surface and generated apps are allowed to depend on.
+
+export type {
+  AccountStore,
+  ApiKeyStore,
+  AuthAccount,
+  AuthAdapter,
+  AuthApiKeyRecord,
+  AuthSession,
+  AuthUser,
+  AuthVerification,
+  CreateUserInput,
+  SessionPatch,
+  SessionStore,
+  UserPatch,
+  UserStore,
+  VerificationStore,
+} from './adapter';
+export type { ApiKeySummary, IssueApiKeyInput, IssuedApiKey, ParsedApiKey } from './api-keys';
+export {
+  API_KEY_NAMESPACE,
+  API_KEY_PREFIX_SEGMENTS,
+  apiKeyActor,
+  apiKeyPrefix,
+  describeApiKey,
+  issueApiKey,
+  parseApiKey,
+  revokeApiKey,
+  verifyApiKey,
+} from './api-keys';
+export type {
+  Auth,
+  AuthConfigInput,
+  AuthMfaPolicy,
+  LoginInput,
+  LoginResult,
+  RegisterInput,
+} from './auth';
+export {
+  AccountSchema,
+  authenticate,
+  defineAuth,
+  login,
+  logout,
+  register,
+  SessionSchema,
+  UserSchema,
+  VerificationSchema,
+} from './auth';
+
+export { BuiltinAdapter } from './builtin-adapter';
+export type { AuthErrorCode, AuthThrowCode, OAuthExchangeFailure } from './errors';
+export {
+  AUTH_BORROWED_ERROR_CODES,
+  AUTH_ERROR_CODES,
+  AUTH_ERROR_TITLES,
+  AuthError,
+  accountLocked,
+  apiKeyInvalid,
+  authNotImplemented,
+  authWriteFailed,
+  emailVerifiedNotStored,
+  forbidden,
+  mfaRequired,
+  oauthAccountNotLinked,
+  oauthExchangeFailed,
+  oauthStateInvalid,
+  oauthTokenInvalid,
+  passwordWeak,
+  sessionExpired,
+  sessionUnknown,
+  unauthenticated,
+} from './errors';
+
+export { currentActor, requireActor, requireRole, requireScope } from './guards';
+export type { IdTokenClaims, VerifyIdTokenInput } from './id-token';
+export {
+  decodeIdToken,
+  ID_TOKEN_CLOCK_SKEW_MS,
+  idTokenEmailVerified,
+  verifyIdToken,
+} from './id-token';
+
+export { MemoryAdapter } from './memory-adapter';
+export type {
+  EnrolTotpInput,
+  RecoveryCodeSet,
+  TotpEnrolment,
+  TotpReplayGuard,
+  TotpVerification,
+  VerifyTotpInput,
+} from './mfa';
+export {
+  base32Decode,
+  base32Encode,
+  createTotpReplayGuard,
+  enrolTotp,
+  generateRecoveryCodes,
+  generateTotpSecret,
+  redeemRecoveryCode,
+  TOTP_DIGITS,
+  TOTP_DRIFT_STEPS,
+  TOTP_STEP_SECONDS,
+  totpCode,
+  totpStep,
+  verifyTotp,
+} from './mfa';
+export type {
+  BeginOAuthInput,
+  OAuthCallback,
+  OAuthHandshake,
+  OAuthProvider,
+  OAuthProviderId,
+  PkcePair,
+} from './oauth';
+export {
+  assertOAuthCallback,
+  beginOAuth,
+  createPkce,
+  OAUTH_PROVIDER_IDS,
+  OAUTH_PROVIDERS,
+  pkceChallenge,
+} from './oauth';
+export type { HandshakeCookieOptions, HandshakeSealOptions } from './oauth-cookie';
+export {
+  clearHandshakeCookie,
+  DEFAULT_HANDSHAKE_TTL_MS,
+  handshakeCookie,
+  handshakeCookieName,
+  handshakeSecret,
+  OAUTH_HANDSHAKE_COOKIE_PREFIX,
+  openHandshake,
+  readHandshakeCookie,
+  sealHandshake,
+} from './oauth-cookie';
+export type {
+  OAuthClientCredentials,
+  OAuthExchangeOptions,
+  OAuthFetch,
+  OAuthTokens,
+} from './oauth-exchange';
+export { exchangeOAuthCode, oauthCredentials } from './oauth-exchange';
+export type { CompleteOAuthLoginInput, OAuthSignInInput } from './oauth-login';
+export { completeOAuthLogin, signInWithOAuth } from './oauth-login';
+export type { OAuthProfile, OAuthProfileOptions } from './oauth-profile';
+export { oauthProfile } from './oauth-profile';
+export type {
+  PasswordParams,
+  PasswordPolicy,
+  PasswordVerification,
+  StrengthOptions,
+  VerifyPasswordInput,
+} from './password';
+export {
+  checkPasswordStrength,
+  DEFAULT_PASSWORD_PARAMS,
+  DEFAULT_PASSWORD_POLICY,
+  hashPassword,
+  needsRehash,
+  parseHashParams,
+  verifyPassword,
+} from './password';
+export type {
+  AuthIdentity,
+  PolicyActor,
+  PolicyActorFields,
+  ServiceIdentity,
+} from './policy-bridge';
+export {
+  actorFromApiKey,
+  actorFromService,
+  actorFromUser,
+  resolveActor,
+} from './policy-bridge';
+export type { AuthLimiter, AuthRateLimitPolicy } from './rate-limit';
+export {
+  accountKey,
+  createAuthLimiter,
+  DEFAULT_AUTH_RATE_LIMIT,
+  ipKey,
+  loginFailed,
+} from './rate-limit';
+export type {
+  CookieJar,
+  CreateSessionInput,
+  IssuedSession,
+  RequestLike,
+  SessionCookieOptions,
+  SessionDevice,
+  SessionExpiry,
+  SessionPolicy,
+  SessionRuntime,
+} from './session';
+export {
+  clearSessionCookie,
+  createSession,
+  DEFAULT_SESSION_POLICY,
+  listDevices,
+  parseSessionToken,
+  readCookie,
+  readSessionCookie,
+  revokeOtherSessions,
+  revokeSession,
+  rotateSession,
+  sessionCookie,
+  sessionExpiry,
+  verifySession,
+} from './session';
+
+export {
+  AUTH_TABLE_NAMES,
+  AUTH_TABLES,
+  X_ACCOUNTS_TABLE,
+  X_API_KEYS_TABLE,
+  X_SESSIONS_TABLE,
+  X_USERS_TABLE,
+  X_VERIFICATIONS_TABLE,
+} from './tables';
+
+export { base64Url, matchesHash, randomToken, sha256Hex, timingSafeEqual } from './tokens';
+export type {
+  ConsumeVerificationInput,
+  IssuedVerification,
+  IssueVerificationInput,
+  MailSender,
+  VerificationPurpose,
+  VerificationRuntime,
+} from './verify';
+export {
+  consumeVerification,
+  DEFAULT_VERIFICATION_TTL_MS,
+  issueVerification,
+  VERIFICATION_PURPOSES,
+  VERIFICATION_TEMPLATES,
+} from './verify';