@ultimat3/auth 30.8.0 → 31.0.0

package/src/index.ts

@@ -36,7 +36,7 @@ export type {
   VerifiedApiKey,
 } from './api-keys';
 export {
-  API_KEY_NAMESPACE,
+  API_KEY_TOUCH_MS,
   apiKeyActor,
   describeApiKey,
   directGrants,
@@ -55,19 +55,14 @@ export type {
   RegisterInput,
 } from './auth';
 export {
-  AccountSchema,
   authenticate,
-  DEFAULT_MFA_ISSUER,
   defineAuth,
   login,
   logout,
   register,
-  SessionSchema,
-  UserSchema,
-  VerificationSchema,
 } from './auth';
-export type { AuthorizationServer } from './authorization-server';
-export { AUTH_CODE_TTL_MS, authorizationServer } from './authorization-server';
+export type { AuthorizationServer, ReadRequestOptions } from './authorization-server';
+export { authorizationServer } from './authorization-server';
 export type {
   RegisterClientInput,
   RegisteredClient,
@@ -80,13 +75,8 @@ export type {
 export type { PostgresAuthServerStoreOptions } from './authorization-server-postgres';
 export { postgresAuthServerStore } from './authorization-server-postgres';
 export type { ReadRequestResult } from './authorization-server-request';
-export { AUTH_SERVER_METADATA_WELL_KNOWN } from './authorization-server-routes';
 export { AUTH_SERVER_TABLES, SQL_AUTH_SERVER_TABLES } from './authorization-server-schema';
-export type {
-  AuthServerStore,
-  DeviceDecision,
-  RefreshRotation,
-} from './authorization-server-store';
+export type { AuthServerStore } from './authorization-server-store';
 export { memoryAuthServerStore } from './authorization-server-store';
 export type {
   AuthCodeRecord,
@@ -94,11 +84,9 @@ export type {
   AuthorizationRequest,
   AuthServerClient,
   AuthServerGrant,
-  AuthTokenKind,
   AuthTokenRecord,
   ClientAuthMethod,
   DeviceCodeRecord,
-  DeviceStatus,
   ResolvedGrant,
 } from './authorization-server-types';
 export { DEVICE_GRANT } from './authorization-server-types';
@@ -119,21 +107,14 @@ export { normaliseEmail } from './email';
 export type { AuthErrorCode, AuthThrowCode } from './errors';
 export {
   AUTH_BORROWED_ERROR_CODES,
-  AUTH_ERROR_CODES,
-  AUTH_ERROR_TITLES,
   AuthError,
   accountLocked,
   apiKeyInvalid,
   authForbidden,
-  authLimiterNotShared,
-  authLimiterPolicyMismatch,
   authUnauthenticated,
   authUniqueViolation,
   authWriteFailed,
   kdfOverloaded,
-  mfaRequiredUnenforceable,
-  mfaSecretInvalid,
-  mfaSecretUnsealed,
   passwordWeak,
   sessionExpired,
   sessionUnknown,
@@ -143,11 +124,27 @@ export type { DeviceReading } from './grant-device';
 export { currentActor, requireActor } from './guards';
 export type { IdTokenClaims, VerifyIdTokenInput } from './id-token';
 export {
-  decodeIdToken,
   ID_TOKEN_CLOCK_SKEW_MS,
-  idTokenEmailVerified,
   verifyIdToken,
 } from './id-token';
+export type {
+  IdentityBeginInput,
+  IdentityCompleteInput,
+  IdentityProvider,
+  IdentityRedirect,
+  IdentitySignInOptions,
+  ResolveIdentityGrants,
+  VerifiedIdentity,
+} from './identity-provider';
+export { signInWithIdentity } from './identity-provider';
+export type { OidcIdentityProviderConfig } from './identity-provider-oidc';
+export { oidcIdentityProvider } from './identity-provider-oidc';
+export type {
+  IdentityProviderRoutes,
+  IdentityProviderRoutesOptions,
+} from './identity-provider-routes';
+export { identityProviderRoutes } from './identity-provider-routes';
+export { OAUTH_ROUTE_STATUS } from './identity-provider-status';
 export type {
   IdTokenKeys,
   JwksClientOptions,
@@ -163,26 +160,17 @@ export {
 } from './jwks';
 export type {
   JwtBearerCaller,
-  JwtBearerCheck,
   JwtBearerResolverOptions,
 } from './jwt-bearer-resolver';
 export { jwtBearerResolver } from './jwt-bearer-resolver';
 export type { KdfGate, KdfLimits } from './kdf-gate';
-export {
-  boundedKdfGate,
-  configureKdfGate,
-  kdfGate,
-} from './kdf-gate';
-export type { AuthLimiterFactory, TotpReplayFactory } from './limiter-install';
+// `installKdfGate` / `resetKdfGate` are `@ultimat3/auth/adapter`'s: a boot widens the gate.
+export { boundedKdfGate, kdfGate } from './kdf-gate';
 // `installedAuthLimiter` is deliberately absent: `defineAuth` is the one reader, and a second
 // caller building limiters out of band would be a second answer to where failures are counted.
-export {
-  configureAuthLimiters,
-  configureTotpReplay,
-  purgeAuthLimits,
-  resetAuthLimiters,
-  resetTotpReplay,
-} from './limiter-install';
+// The installers and their factory types are `@ultimat3/auth/adapter`'s, and only its: the boot
+// calls them with what `apps/<app>/runtime.ts` named.
+export { purgeAuthLimits } from './limiter-install';
 export type { HandleDirectory } from './login-identity';
 export { normaliseHandle } from './login-identity';
 export { type MemoryAuthAdapter, memoryAuthAdapter } from './memory-adapter';
@@ -272,10 +260,9 @@ export { discoverOAuthProvider, discoveryUrl } from './oauth-discovery';
 // from that module, below.
 export type { OAuthExchangeFailure } from './oauth-errors';
 export {
+  oauthDenied,
   oauthExchangeFailed,
   oauthProviderUnknown,
-  oauthStateInvalid,
-  oauthTokenInvalid,
   restartAt,
 } from './oauth-errors';
 export type {
@@ -295,8 +282,6 @@ export type {
 export {
   completeOAuthLogin,
   emailVerifiedNotStored,
-  oauthAccountNotLinked,
-  oauthLinkingDisabled,
   signInWithOAuth,
 } from './oauth-login';
 export {
@@ -310,30 +295,26 @@ export type { OAuthProfile, OAuthProfileOptions } from './oauth-profile';
 export { oauthProfile } from './oauth-profile';
 export {
   hasOAuthProvider,
-  oauthProviderDuplicate,
   oauthProviderIds,
   providerFor,
   registerOAuthProvider,
 } from './oauth-registry';
 export type { AuthRouteDescriptor, OAuthLoginOptions, OAuthLoginRoutes } from './oauth-route';
-export { OAUTH_ROUTE_STATUS, oauthDenied, oauthLogin } from './oauth-route';
+export { oauthLogin } from './oauth-route';
 // Passkeys (WebAuthn): sign-in and digest-bound step-up. The browser half is `@ultimat3/auth/client`.
 export type {
   PasskeyPolicy,
   PasskeyPolicyInput,
   PasskeyRelyingParty,
 } from './passkey-config';
-export { DEFAULT_PASSKEY_CHALLENGE_TTL_MS } from './passkey-config';
 export { verifyPasskeyEvidence } from './passkey-evidence';
 export type { PasskeyLogin } from './passkey-login';
 export { passkeyLogin } from './passkey-login';
 export type { PasskeyStepUp, PasskeyStepUpOptions } from './passkey-step-up';
 export { passkeyStepUp } from './passkey-step-up';
 export type {
-  PasskeyAssertionResponse,
   PasskeyCreationOptions,
   PasskeyCredentialDescriptor,
-  PasskeyRegistrationResponse,
   PasskeyRequestOptions,
 } from './passkey-wire';
 export type {
@@ -345,7 +326,6 @@ export type {
 } from './password';
 export {
   checkPasswordStrength,
-  DEFAULT_PASSWORD_PARAMS,
   DEFAULT_PASSWORD_POLICY,
   hashPassword,
   needsRehash,
@@ -398,13 +378,16 @@ export {
   revokeSessionsCreatedBefore,
   revokeUserSessions,
 } from './revocation';
+export type { SamlIdpMetadata } from './saml-metadata';
+export { parseSamlMetadata } from './saml-metadata';
+export type { SamlIdentityProviderConfig } from './saml-provider';
+export { samlIdentityProvider } from './saml-provider';
 export type {
   CookieJar,
   CreateSessionInput,
   IssuedSession,
   RequestLike,
   SessionCookieOptions,
-  SessionDevice,
   SessionExpiry,
   SessionPolicy,
   SessionRuntime,
@@ -414,7 +397,6 @@ export {
   createSession,
   DEFAULT_SESSION_POLICY,
   idleSlideMs,
-  listDevices,
   readSessionCookie,
   remainingMaxAgeSeconds,
   revokeOtherSessions,
@@ -432,7 +414,7 @@ export type {
   AuthSubjectTarget,
   AuthSubjectTargetOptions,
 } from './subject-target';
-export { AUTH_SUBJECT_COLUMNS, authSubjectTarget } from './subject-target';
+export { authSubjectTarget } from './subject-target';
 
 export {
   AUTH_TABLE_NAMES,
@@ -442,8 +424,6 @@ export {
   randomToken,
   sha256Hex,
 } from './tokens';
-export type { VerificationPurposeDef } from './verification-purposes';
-export { verificationPurposeNames } from './verification-purposes';
 export type {
   ConsumeVerificationInput,
   DefineVerificationPurposeInput,

package/src/jwks.ts

@@ -10,11 +10,11 @@ import type { Clock, Scheduler } from '@ultimat3/core';
 import {
   generationFence,
   isFixShellSafe,
+  liveClock,
   logger,
   renderFixShellArg,
   renderThrowable,
   singleFlight,
-  systemClock,
 } from '@ultimat3/core';
 import { outboundResponse } from '@ultimat3/core/outbound';
 import { decodeJwtSegment, isRecord } from './json';
@@ -134,7 +134,7 @@ const KID_LESS = '\u0000';
  * key already held answering for `JWKS_STALE_IF_ERROR_MS`.
  */
 export function jwksClient(options: JwksClientOptions): JwksKeySource {
-  const clock = options.clock ?? systemClock;
+  const clock = options.clock ?? liveClock;
   const ttlMs = options.ttlMs ?? DEFAULT_JWKS_TTL_MS;
   assertFiniteAuthCount(
     'jwks.ttlMs',

package/src/kdf-gate.ts

@@ -1,12 +1,13 @@
 // Single responsibility: bounding how many argon2 hashes this process runs at once.
 //
 // WHY it is not covered by the limiters that already exist: `rate-limit.ts`'s `ipKey(ip)` and
-// `@ultimat3/http`'s `auth` bucket are both keyed by SOURCE, so an attacker rotating an IPv6 /64
-// mints a fresh key per attempt and is never throttled by either; and both cap ATTEMPTS, while
-// what argon2id costs is MEMORY — 19 MiB per hash at the OWASP floor. The only remaining backstop
-// was `http.maxInflight` (1000), i.e. roughly 19 GB of arenas queued on one box.
+// `@ultimat3/http`'s `auth` bucket are keyed by SOURCE NETWORK (an IPv6 /64 is one key), so a
+// botnet of many networks still mints a fresh key per attempt; and both cap ATTEMPTS, while what
+// argon2id costs is MEMORY — 19 MiB per hash at the OWASP floor. The only remaining backstop was
+// `http.maxInflight` (1000), i.e. roughly 19 GB of arenas queued on one box.
 
 import { flightGate } from '@ultimat3/core';
+import { adapterSlot } from '@ultimat3/core/adapter';
 import { kdfOverloaded } from './errors';
 import { assertFiniteAuthCount } from './policy-numbers';
 
@@ -71,22 +72,31 @@ export function boundedKdfGate(limits: KdfLimits = DEFAULT_KDF_LIMITS): KdfGate
   });
 }
 
-let gate = boundedKdfGate();
+/** Core's one slot shape (`adapter-slot.ts`): installs stack, each release removes its own frame. */
+const gates = /* @__PURE__ */ adapterSlot<KdfGate | undefined>(() => undefined);
+/** The shipped width, built once on first use: a module import must not build a gate it may not use. */
+let shipped: KdfGate | undefined;
 
 /** The process-wide gate every `hashPassword`/`verifyPassword` passes through. */
-export const kdfGate = (): KdfGate => gate;
+export const kdfGate = (): KdfGate => {
+  const installed = gates.current();
+  if (installed !== undefined) return installed;
+  shipped ??= boundedKdfGate();
+  return shipped;
+};
 
 /**
- * The ONE install point, the same shape as `configureCursorSigning` in `@ultimat3/core`: a box
- * with more memory may widen the ceiling, and a test needs a narrow one. Not a `defineAuth` key,
- * because this is a property of the MACHINE, not of the app's auth policy — the same app config
- * runs on a 512 MiB PaaS dyno and a 64 GiB node.
+ * The ONE install point — on `@ultimat3/auth/adapter`, never the barrel (31.0.0): a box with more
+ * memory may widen the ceiling, and a test needs a narrow one. Not a `defineAuth` key, because
+ * this is a property of the MACHINE, not of the app's auth policy — the same app config runs on a
+ * 512 MiB PaaS dyno and a 64 GiB node. Screened before the frame is pushed; answers the release
+ * that removes THIS install and no other, in any order.
  */
-export function configureKdfGate(limits: KdfLimits): void {
-  gate = boundedKdfGate(limits);
+export function installKdfGate(limits: KdfLimits): () => void {
+  return gates.install(boundedKdfGate(limits));
 }
 
-/** Back to the shipped defaults. Tests that call `configureKdfGate` must call this in cleanup. */
+/** Back to the shipped defaults, whatever is stacked. A test seam, on `./adapter` beside the installer. */
 export function resetKdfGate(): void {
-  gate = boundedKdfGate();
+  gates.reset();
 }

package/src/limiter-install.ts

@@ -15,6 +15,7 @@
 // make every app that tunes its own numbers fail at boot with `X_AUTH_LIMITER_POLICY_MISMATCH`.
 // The factory is called WITH the resolved policy, so the two halves cannot disagree.
 
+import { adapterSlot } from '@ultimat3/core/adapter';
 import type { TotpReplayGuard } from './mfa';
 import type { AuthLimiter, AuthRateLimitPolicy } from './rate-limit';
 
@@ -25,7 +26,8 @@ import type { AuthLimiter, AuthRateLimitPolicy } from './rate-limit';
  */
 export type AuthLimiterFactory = (policy: AuthRateLimitPolicy) => AuthLimiter;
 
-let factory: AuthLimiterFactory | undefined;
+/** Core's one slot shape: installs stack, each release removes its own, in any order. */
+const factory = /* @__PURE__ */ adapterSlot<AuthLimiterFactory | undefined>(() => undefined);
 /**
  * The limiters a purge can still reach, ONE per distinct window.
  *
@@ -42,21 +44,27 @@ let factory: AuthLimiterFactory | undefined;
 let built = new Map<number, AuthLimiter>();
 
 /**
- * The ONE install point, the same shape as `configureKdfGate` beside it: a host that owns the
- * database connection says where failed attempts are counted, and every `defineAuth` in the
- * process picks it up without the app declaring anything.
+ * The ONE install point: a host that owns the database connection says where failed attempts are
+ * counted, and every `defineAuth` in the process picks it up without the app declaring anything.
+ * On `@ultimat3/auth/adapter` only — the boot calls it with what `apps/<app>/runtime.ts` named.
  *
  * A second install replaces the first and forgets what the first built — a limiter over a pool
- * the previous boot has closed is not something a purge should still be sweeping through.
+ * the previous boot has closed is not something a purge should still be sweeping through. Answers
+ * the release that removes THIS install and no other, in any order, once (core's `adapterSlot`);
+ * the limiters built so far are forgotten with it.
  */
-export function configureAuthLimiters(next: AuthLimiterFactory): void {
-  factory = next;
+export function installAuthLimiters(next: AuthLimiterFactory): () => void {
+  const release = factory.install(next);
   built = new Map();
+  return () => {
+    release();
+    built = new Map();
+  };
 }
 
 /** Back to `memoryAuthLimiter`, the per-process default. A host that installs one calls this on stop. */
 export function resetAuthLimiters(): void {
-  factory = undefined;
+  factory.reset();
   built = new Map();
 }
 
@@ -67,8 +75,9 @@ export function resetAuthLimiters(): void {
  * back to the in-memory limiter.
  */
 export function installedAuthLimiter(policy: AuthRateLimitPolicy): AuthLimiter | undefined {
-  if (factory === undefined) return undefined;
-  const limiter = factory(policy);
+  const current = factory.current();
+  if (current === undefined) return undefined;
+  const limiter = current(policy);
   if (!built.has(policy.windowMs)) built.set(policy.windowMs, limiter);
   return limiter;
 }
@@ -116,20 +125,21 @@ export async function purgeAuthLimits(): Promise<number> {
 /** Build the guard an `Auth` keeps its spent TOTP steps in. Called once per `defineAuth`. */
 export type TotpReplayFactory = () => TotpReplayGuard;
 
-let replayFactory: TotpReplayFactory | undefined;
+const replayFactory = /* @__PURE__ */ adapterSlot<TotpReplayFactory | undefined>(() => undefined);
 
 /**
  * The host's install point for where spent steps are kept, for the limiter's reason: `defineAuth`
  * is the app's call and the app does not know which database this process opened. Until a boot
- * filled this, one code signed in once per replica. A second install replaces the first.
+ * filled this, one code signed in once per replica. A second install stacks over the first; its
+ * release removes THIS install and no other, in any order, once (core's `adapterSlot`).
  */
-export function configureTotpReplay(next: TotpReplayFactory): void {
-  replayFactory = next;
+export function installTotpReplay(next: TotpReplayFactory): () => void {
+  return replayFactory.install(next);
 }
 
 /** Back to `memoryTotpReplayGuard`, the per-process default. A host that installs one calls this on stop. */
 export function resetTotpReplay(): void {
-  replayFactory = undefined;
+  replayFactory.reset();
 }
 
 /**
@@ -137,5 +147,5 @@ export function resetTotpReplay(): void {
  * reason. `undefined` means no host installed one, and the caller falls back to memory.
  */
 export function installedTotpReplay(): TotpReplayGuard | undefined {
-  return replayFactory?.();
+  return replayFactory.current()?.();
 }

package/src/memory-adapter.ts

@@ -2,7 +2,7 @@
 // database exists and the one every test in this package runs against — the same interface
 // Postgres and Better Auth implement, so a flow that works here works there or the seam is wrong.
 
-import { type Clock, systemClock, timingSafeEqual } from '@ultimat3/core';
+import { type Clock, liveClock, timingSafeEqual } from '@ultimat3/core';
 import type {
   AuthAccount,
   AuthAdapter,
@@ -68,9 +68,9 @@ export class MemoryAuthAdapter implements AuthAdapter {
   /**
    * The clock every instant this adapter stamps comes from — one argument, because a stamp is a
    * fact about WHEN a call happened and a test that cannot move it can only assert a range.
-   * Defaults to `systemClock`, so `memoryAuthAdapter()` is what it always was.
+   * Defaults to the `clock` port (`liveClock`, read per call), so `installClock` reaches it.
    */
-  constructor(clock: Clock = systemClock) {
+  constructor(clock: Clock = liveClock) {
     this.#clock = clock;
   }
 
@@ -98,7 +98,7 @@ export class MemoryAuthAdapter implements AuthAdapter {
    * address, and the second was unreachable forever, since `findUserByEmail` returns the first.
    *
    * Over the STORED string, exactly as Postgres compares it. No case folding: that is the
-   * divergence `adapter-parity.test.ts`'s first case pins, and `normaliseEmail` above the seam is
+   * divergence `authAdapterConformance`'s first case pins, and `normaliseEmail` above the seam is
    * what makes two spellings one address.
    */
   async createUser(input: CreateUserInput): Promise<AuthUser> {
@@ -370,6 +370,6 @@ export class MemoryAuthAdapter implements AuthAdapter {
  * The one way to build the in-memory adapter — the twin of `postgresAuthAdapter()`. The class is a
  * type in the barrel only (`X_FACTORY_NAME_SPELLING`), so `new` is never a second spelling.
  */
-export function memoryAuthAdapter(clock: Clock = systemClock): MemoryAuthAdapter {
+export function memoryAuthAdapter(clock: Clock = liveClock): MemoryAuthAdapter {
   return new MemoryAuthAdapter(clock);
 }

package/src/mfa.ts

@@ -241,7 +241,7 @@ const newestStep = (steps: ReadonlySet<number>): number => {
 
 /**
  * One process' table: the default when no host installed a guard, so a code is single-use per
- * replica. A framework boot installs `postgresTotpReplayGuard` instead (`configureTotpReplay`).
+ * replica. A framework boot installs `postgresTotpReplayGuard` instead (`installTotpReplay`).
  * Steps older than the drift window are dropped — nothing outside it can be replayed anyway.
  *
  * Bounded, because the subject map only ever grew: pruning happened inside one subject's `Set`

package/src/oauth-discovery.ts

@@ -30,7 +30,7 @@ export const discoveryUrl = (issuer: string): string =>
   `${bareIssuer(issuer)}/.well-known/openid-configuration`;
 
 export interface DiscoverOAuthProviderInput {
-  /** The id the URL segment carries: `/auth/oauth/<id>`. Also names the two env vars. */
+  /** The id the URL segment carries: `/auth/sso/<id>`. Also names the two env vars. */
   readonly id: string;
   readonly issuer: string;
   /** Defaults to the OIDC minimum this package needs to identify somebody. */

package/src/oauth-errors.ts

@@ -1,6 +1,6 @@
 // Single responsibility: the OAuth refusals more than one OAuth module raises, and the one phrase
-// every "start over" fix is built from. A refusal with one thrower lives beside it (`oauthDenied`
-// in `oauth-route.ts`, the linking ones in `oauth-login.ts`); the codes, titles and the single
+// every "start over" fix is built from. A refusal with one thrower lives beside it (the linking ones
+// in `oauth-login.ts`); the codes, titles and the single
 // `registerErrorCodes()` call stay in `errors.ts`, so this file adds no code and registers nothing.
 
 import { renderCauseValue, renderFixLiteral } from '@ultimat3/core';
@@ -96,3 +96,27 @@ export const oauthTokenInvalid = (provider: string, reason: string, fix: string)
     fix,
     meta: { provider },
   });
+
+/**
+ * The provider came back with `error=` and no code — almost always the user pressing Cancel.
+ * A separate code from `X_OAUTH_EXCHANGE_FAILED` on purpose: nothing was exchanged, nothing is
+ * misconfigured, and folding the single commonest non-success outcome of a login into the code
+ * that means "the client secret is wrong" makes both unreadable in a log and pages the wrong person.
+ */
+export const oauthDenied = (
+  provider: string,
+  reason: string,
+  description: string | null,
+): AuthError =>
+  new AuthError({
+    code: 'X_OAUTH_DENIED',
+    // `reason` and `description` are query parameters off the callback URL — whatever the browser
+    // was redirected with, newlines and quotes included. `renderCauseValue` renders them as JSON
+    // string literals, so a forged `error_description` cannot forge a second log line or break the
+    // sentence around it. Both are already `string` by type: this is escaping, not throw-safety.
+    cause: `${provider} declined the authorization: ${renderCauseValue(reason)}${
+      description === null ? '' : ` (${renderCauseValue(description)})`
+    }`,
+    fix: `${restartAt(provider)} and approve the ${provider} consent screen`,
+    meta: { provider, reason },
+  });

package/src/oauth-exchange.ts

@@ -6,11 +6,11 @@
 import type { Clock } from '@ultimat3/core';
 import {
   EnvMissingError,
+  liveClock,
   logger,
   renderCauseValue,
   renderFixShellArg,
   renderThrowable,
-  systemClock,
 } from '@ultimat3/core';
 import { outboundResponse } from '@ultimat3/core/outbound';
 import { type IdTokenClaims, verifyIdToken } from './id-token';
@@ -326,7 +326,7 @@ export async function exchangeOAuthCode(
 ): Promise<OAuthTokens> {
   assertOAuthCallback(handshake, callback);
   const provider = providerFor(handshake.provider);
-  const clock = options.clock ?? systemClock;
+  const clock = options.clock ?? liveClock;
 
   const body = new URLSearchParams({
     grant_type: 'authorization_code',

package/src/oauth-paths.ts

@@ -4,8 +4,11 @@
 // while no route was mounted anywhere. Deriving both the mount and the fix from here makes a fix
 // line that names a route nothing serves impossible rather than merely discouraged.
 
-/** Not configurable, on purpose: a movable base path is a `fix:` line that can go stale again. */
-export const OAUTH_BASE_PATH = '/auth/oauth';
+/**
+ * Not configurable, on purpose: a movable base path is a `fix:` line that can go stale again.
+ * `/auth/sso` since 31.0.0: every `IdentityProvider` — OIDC and SAML — signs in through it.
+ */
+export const OAUTH_BASE_PATH = '/auth/sso';
 
 /** The pattern a router mounts. `:provider` is the segment `oauthStartPath` fills in. */
 export const OAUTH_START_ROUTE_PATH = `${OAUTH_BASE_PATH}/:provider` as const;