@vunexa/lixa 0.1.4 → 0.1.6-alpha.10

package/dist/index.d.cts

@@ -78,6 +78,8 @@ interface ConnectedResource {
     accessToken: string;
     /** Optional refresh token for offline resource access */
     refreshToken?: string | undefined;
+    /** Unix timestamp in milliseconds when the resource access token expires */
+    expiresAt?: number | undefined;
     /** Resource scopes granted by the user */
     scopes: string[];
     /** Full raw token response from provider */
@@ -103,25 +105,29 @@ interface Session<TRaw = OAuthTokenResponse> {
      */
     id?: string;
     /**
-     * The primary access token or session token identifier.
+     * Linked identity provider accounts (AuthN) keyed by provider name.
+     * Single source of truth for all authenticated user SSO identities.
      */
-    token: string;
+    accounts?: Record<string, LinkedAccount>;
+    /**
+     * Connected third-party resource provider tokens (AuthZ) keyed by provider name.
+     * Single source of truth for all post-login third-party API permissions.
+     */
+    resources?: Record<string, ConnectedResource>;
     /** Unique unified user ID across linked accounts */
     userId?: string;
     /** Primary user email */
     email?: string;
-    /** Current active auth provider for this session turn */
+    /**
+     * Optional primary access token or custom session token identifier.
+     */
+    token?: string;
+    /** Optional current active auth provider for this session turn */
     provider?: string;
-    /** Linked SSO provider accounts keyed by provider name */
-    accounts?: Record<string, LinkedAccount>;
-    /** Connected third-party resource provider tokens keyed by provider name */
-    resources?: Record<string, ConnectedResource>;
     /**
-     * Raw session data.
-     * Contains the complete OAuth token response and any additional data
-     * your SessionStrategy adds (user info, database IDs, etc.).
+     * Optional raw session token response data from provider.
      */
-    raw: TRaw;
+    raw?: TRaw;
 }
 /**
  * Provider metadata passed to session strategy.
@@ -308,10 +314,20 @@ interface StateHandler {
      * }
      * ```
      */
+    /**
+     * Generates OAuth state parameter and associated data (camelCase).
+     */
     generateState?(provider: string): Promise<{
         state: string;
         data: StateData;
     }>;
+    /**
+     * Generates OAuth state parameter and associated data (PascalCase alias for backward compatibility).
+     */
+    GenerateState?(provider: string): Promise<{
+        state: string;
+        data: StateData;
+    }>;
     /**
      * State storage operations.
      *
@@ -337,7 +353,7 @@ interface SessionStorage {
      * Saves a session with expiration.
      *
      * @param sessionId - Unique session identifier
-     * @param session - Session data from GenerateSession()
+     * @param session - Session data from generateSession()
      * @param expiresInSeconds - TTL in seconds (typically 86400 for 24 hours)
      */
     saveSession<T extends Session>(sessionId: string, session: T, expiresInSeconds: number): Promise<void>;
@@ -364,19 +380,66 @@ interface SessionStorage {
         session: T;
     } | null>;
 }
+/**
+ * Resource storage operations interface.
+ *
+ * @remarks
+ * Manages long-lived third-party resource provider tokens (AuthZ) bound to a user account
+ * (User ID or Email), independent of short-lived user sessions.
+ *
+ * @public
+ */
+interface ResourceStorage {
+    /**
+     * Saves a connected resource token for a user.
+     *
+     * @param userId - Unique user identifier or email
+     * @param provider - Resource provider name (e.g. 'github', 'google')
+     * @param resource - Connected resource details including access & refresh tokens
+     */
+    saveResource(userId: string, provider: string, resource: ConnectedResource): Promise<void>;
+    /**
+     * Retrieves a connected resource token for a user.
+     *
+     * @param userId - Unique user identifier or email
+     * @param provider - Resource provider name
+     */
+    getResource(userId: string, provider: string): Promise<ConnectedResource | null>;
+    /**
+     * Retrieves all connected resources for a user.
+     *
+     * @param userId - Unique user identifier or email
+     */
+    getUserResources(userId: string): Promise<Record<string, ConnectedResource>>;
+    /**
+     * Deletes a connected resource token for a user.
+     *
+     * @param userId - Unique user identifier or email
+     * @param provider - Resource provider name
+     */
+    deleteResource(userId: string, provider: string): Promise<void>;
+}
+/**
+ * Resource handler configuration.
+ *
+ * @public
+ */
+interface ResourceHandler {
+    resourceStorage?: ResourceStorage;
+}
 /**
  * Session handler for OAuth authentication.
  *
  * @remarks
  * The SessionHandler manages session generation and storage after successful OAuth authentication.
  *
- * - GenerateSession: Optional. Customizes how OAuth tokens are converted into session data.
+ * - generateSession: Optional. Customizes how OAuth tokens are converted into session data.
  *   If not provided, uses default implementation (access token as session token).
  *
- * - storage: Optional. Provides custom session storage (save/get/delete operations).
+ * - sessionStorage: Optional. Provides custom session storage (save/get/delete operations).
  *   If not provided, uses in-memory cache (not suitable for production).
  *
- * For production, implement both GenerateSession (for user creation/lookup) and storage
+ * For production, implement both generateSession (for user creation/lookup) and sessionStorage
  * (for persistent session storage with Redis, database, etc.).
  *
  * @example
@@ -385,7 +448,7 @@ interface SessionStorage {
  * import { SessionHandler, Session, OAuthTokenResponse, ProviderMetadata, extractUserInfo } from '@vunexa/lixa';
  *
  * const sessionHandler: SessionHandler = {
- *   GenerateSession: async (tokenData, providerMetadata) => {
+ *   generateSession: async (tokenData, providerMetadata) => {
  *     // Extract user info and create/retrieve user
  *     const { userInfo } = await extractUserInfo(tokenData, providerMetadata);
  *     const user = await db.users.upsert({
@@ -404,7 +467,7 @@ interface SessionStorage {
  *     };
  *   },
  *
- *   storage: {
+ *   sessionStorage: {
  *     saveSession: async (sessionId, session, expiresInSeconds) => {
  *       const expiresAt = new Date(Date.now() + expiresInSeconds * 1000);
  *       await db.sessions.create({
@@ -430,78 +493,21 @@ interface SessionStorage {
  * };
  * ```
  *
- * @example
- * Minimal implementation (uses defaults):
- * ```typescript
- * const sessionHandler: SessionHandler = {
- *   storage: {
- *     saveSession: async (sessionId, session, expiresInSeconds) => {
- *       await redis.setex(sessionId, expiresInSeconds, JSON.stringify(session));
- *     },
- *     getSession: async (sessionId) => {
- *       const data = await redis.get(sessionId);
- *       return data ? JSON.parse(data) : null;
- *     },
- *     deleteSession: async (sessionId) => {
- *       await redis.del(sessionId);
- *     }
- *   }
- * };
- * ```
- *
  * @public
  */
 interface SessionHandler {
     /**
-     * Generates session data from OAuth token data.
+     * Generates session data from OAuth token data (camelCase).
      *
      * @param tokenData - The token data received from the OAuth provider's token endpoint
      * @param providerMetadata - Provider metadata including name and endpoints
      * @returns A Promise that resolves to session data
-     *
-     * @remarks
-     * This method is responsible for creating session data from OAuth tokens.
-     * It is called after successfully exchanging the authorization code for tokens.
-     *
-     * Token Data:
-     * - access_token: OAuth access token
-     * - refresh_token: OAuth refresh token (optional)
-     * - expires_in: Token expiration time in seconds
-     * - token_type: Token type (usually "Bearer")
-     * - id_token: OpenID Connect ID token (for OIDC providers)
-     * - scope: Granted scopes
-     *
-     * Provider Metadata:
-     * - name: The provider name (e.g., 'google', 'github')
-     * - endpoints: Provider endpoints (authorization, token, userInfo)
-     *
-     * Your implementation should:
-     * 1. Extract user info (using extractUserInfo or decode ID token)
-     * 2. Create or lookup users in your database
-     * 3. Build and return session data with any custom fields
-     *
-     * Note: This method should NOT store the session. Storage is handled by the storage object.
-     *
-     * If not provided, defaults to using the access token as the session token.
-     *
-     * @example
-     * ```typescript
-     * GenerateSession: async (tokenData, providerMetadata) => {
-     *   const { userInfo } = await extractUserInfo(tokenData, providerMetadata);
-     *   const user = await db.users.upsert({ email: userInfo.email });
-     *
-     *   return {
-     *     token: tokenData.access_token,
-     *     raw: {
-     *       ...tokenData,
-     *       userId: user.id,
-     *       provider: providerMetadata.name
-     *     }
-     *   };
-     * }
-     * ```
      */
     generateSession?<T extends Session>(tokenData: OAuthTokenResponse, providerMetadata: ProviderMetadata): Promise<T>;
+    /**
+     * Generates session data from OAuth token data (PascalCase alias for backward compatibility).
+     */
+    GenerateSession?<T extends Session>(tokenData: OAuthTokenResponse, providerMetadata: ProviderMetadata): Promise<T>;
     /**
      * Session storage operations.
      *
@@ -512,13 +518,6 @@ interface SessionHandler {
      * If not provided, uses in-memory cache (not suitable for production).
      */
     sessionStorage?: SessionStorage;
-    /**
-     * Optional method to generate session data from OAuth tokens.
-     *
-     * @remarks
-     * If not provided, uses default implementation from LocalSessionHandler.
-     */
-    generateSession?<T extends Session>(tokenData: OAuthTokenResponse, providerMetadata: ProviderMetadata): Promise<T>;
 }
 
 /**
@@ -706,6 +705,12 @@ type ProviderConfig = {
     redirectUri: string;
     /** Array of OAuth scopes to request */
     scopes: string[];
+    /**
+     * Set to true to allow non-identity (resource) scopes during primary authentication flow.
+     * By default (false), Lixa restricts primary AuthN scopes to identity scopes to maintain
+     * clean AuthN vs AuthZ separation.
+     */
+    allowNonAuthScopes?: boolean;
     /** Additional provider-specific configuration parameters */
     extraConfig?: Record<string, string>;
 } & ({
@@ -857,12 +862,42 @@ interface LixaConfig<TProviders extends Record<string, ProviderConfig> = Record<
      * @see {@link SessionHandler}
      */
     sessionHandler?: SessionHandler;
+    /**
+     * Optional custom resource handler.
+     * Handles storage and management of long-lived third-party resource provider tokens (AuthZ)
+     * bound directly to user accounts (User ID or Email), independent of transient session IDs.
+     *
+     * @see {@link ResourceHandler}
+     */
+    resourceHandler?: ResourceHandler;
     /**
      * Enable debug logging.
      * When enabled, outputs structured logs for initialization, auth flow, and errors.
      * Format: [Lixa] [timestamp] [level] [context] message
      */
     debug?: boolean;
+    /**
+     * Optional custom structured logger implementation.
+     * If provided, all Lixa logs will be routed through this logger.
+     */
+    logger?: LixaLogger;
+}
+/**
+ * Log level for Lixa structured logging.
+ * @public
+ */
+type LogLevel = "INFO" | "WARN" | "ERROR" | "DEBUG";
+/**
+ * Log context for Lixa structured logging.
+ * @public
+ */
+type LogContext = "Init" | "Auth" | "Token" | "Session" | "State" | "AccountLinking" | "Resource";
+/**
+ * Custom logger interface for Lixa.
+ * @public
+ */
+interface LixaLogger {
+    log(level: LogLevel, context: LogContext, message: string, data?: Record<string, unknown>): void;
 }
 /**
  * Helper type to create a configuration with only registered providers.
@@ -936,11 +971,15 @@ type ConfiguredProviderKey<T extends LixaConfig<Record<string, ProviderConfig>>>
 declare class Lixa<TConfig extends LixaConfig<Record<string, ProviderConfig>> = LixaConfig> {
     private static DEFAULT_PROVIDERS;
     private static CONFIGURED_PROVIDERS;
-    private static LOCAL_STATE_HANDLER;
-    private static LOCAL_SESSION_HANDLER;
+    private localStateHandler;
+    private localSessionHandler;
+    private localResourceHandler;
+    private userResourceStore;
+    private refreshMutexes;
     private config;
     private stateHandler;
     private sessionHandler;
+    private resourceHandler;
     private debug;
     /**
      * Creates a new Lixa instance with the provided configuration.
@@ -961,7 +1000,7 @@ declare class Lixa<TConfig extends LixaConfig<Record<string, ProviderConfig>> =
      *
      * @param name - The provider name
      * @param config - The provider configuration
-     * @throws Error when required fields are missing or invalid
+     * @throws InvalidProviderConfigError when required fields are missing or invalid
      */
     private validateProviderConfig;
     /**
@@ -969,20 +1008,16 @@ declare class Lixa<TConfig extends LixaConfig<Record<string, ProviderConfig>> =
      *
      * @param name - The provider name
      * @param provider - The provider implementation
-     * @throws Error when required properties are missing
+     * @throws InvalidProviderConfigError when required properties are missing
      */
     private validateProviderImplementation;
     /**
-     * Structured debug logging with standardized format.
+     * Structured logging with standardized format and custom logger support.
      *
-     * @param level - Log level (INFO, WARN, ERROR)
-     * @param context - Context of the log (Init, Auth, Token, Session, State)
+     * @param level - Log level (INFO, WARN, ERROR, DEBUG)
+     * @param context - Context of the log (Init, Auth, Token, Session, State, AccountLinking, Resource)
      * @param message - Log message
      * @param data - Optional data to log
-     *
-     * @remarks
-     * Format: [Lixa] [timestamp] [level] [context] message
-     * Only logs when debug mode is enabled.
      */
     private log;
     /**
@@ -1181,7 +1216,7 @@ declare class Lixa<TConfig extends LixaConfig<Record<string, ProviderConfig>> =
      */
     getAuthUrl(provider: ConfiguredProviderKey<TConfig> | string, state?: string): Promise<string>;
     /**
-     * Restricts primary authentication scopes strictly to AuthN identity scopes.
+     * Restricts primary authentication scopes strictly to AuthN identity scopes unless allowNonAuthScopes is true.
      */
     private resolveAuthNScopes;
     /**
@@ -1247,11 +1282,9 @@ declare class Lixa<TConfig extends LixaConfig<Record<string, ProviderConfig>> =
         prompt?: string;
         extraConfig?: Record<string, string>;
     }): Promise<string>;
+    private getUserKeyFromSession;
     /**
-     * Handles the OAuth callback for a connected resource provider and stores resource tokens on the session.
-     *
-     * @param params - Object containing sessionId, provider, code, state, and requested scopes
-     * @returns Updated Session containing stored resource tokens under session.resources[provider]
+     * Handles the OAuth callback for a connected resource provider and stores resource tokens bound to user account.
      */
     handleResourceCallback(params: {
         sessionId: string;
@@ -1261,20 +1294,58 @@ declare class Lixa<TConfig extends LixaConfig<Record<string, ProviderConfig>> =
         scopes?: string[];
     }): Promise<Session>;
     /**
-     * Retrieves a connected resource provider token for an active session.
+     * Retrieves a connected resource for a specific User ID / Email directly (independent of session IDs).
+     * Automatically refreshes expired access tokens if a refresh token is present.
+     *
+     * @param userIdOrEmail - User identifier or email
+     * @param provider - Resource provider identifier (e.g. 'github', 'google')
+     */
+    getUserResource(userIdOrEmail: string, provider: string): Promise<ConnectedResource | null>;
+    /**
+     * Retrieves all connected resources for a specific User ID / Email.
+     */
+    getUserResources(userIdOrEmail: string): Promise<Record<string, ConnectedResource>>;
+    /**
+     * Retrieves a connected resource provider token for an active session, auto-refreshing expired tokens if possible.
      *
      * @param sessionId - Active session ID
-     * @param provider - Provider identifier (e.g. 'github')
+     * @param provider - Provider identifier (e.g. 'github', 'google')
      */
     getConnectedResource(sessionId: string, provider: string): Promise<ConnectedResource | null>;
     /**
-     * Disconnects a resource provider from an active session.
+     * Refreshes a user's resource access token using its refresh token.
+     * Deduplicates concurrent refresh requests via an in-flight promise mutex.
      *
-     * @param sessionId - Active session ID
-     * @param provider - Provider identifier to disconnect
+     * @param userIdOrEmail - User identifier or email
+     * @param provider - Provider identifier (e.g. 'google', 'github')
+     */
+    refreshUserResourceToken(userIdOrEmail: string, provider: string, existingResource?: ConnectedResource): Promise<ConnectedResource>;
+    /**
+     * Internal execution of refresh token exchange.
+     */
+    private executeRefreshUserResourceToken;
+    /**
+     * Refreshes a connected resource access token for an active session.
+     */
+    refreshResourceToken(sessionId: string, provider: string): Promise<ConnectedResource>;
+    /**
+     * Disconnects a resource provider for a specific User ID / Email.
+     */
+    disconnectUserResource(userIdOrEmail: string, provider: string): Promise<boolean>;
+    /**
+     * Disconnects a resource provider from an active session and user account.
      */
     disconnectResource(sessionId: string, provider: string): Promise<boolean>;
+    /**
+     * Retrieves active session details from session storage.
+     */
     fetchSessionInfo(sessionId: string): Promise<Session | null>;
+    /**
+     * Deletes a session from session storage (e.g. on logout).
+     *
+     * @param sessionId - Active session identifier
+     */
+    deleteSession(sessionId: string): Promise<void>;
     private exchangeCodeForToken;
     private findProviderByType;
 }
@@ -1360,4 +1431,236 @@ declare function extractUserInfo(tokenData: OAuthTokenResponse, providerMetadata
     userInfo: UserInfo;
 }>;
 
-export { type AccountLinkingConfig, type AccountLinkingMode, AccountLinkingStrategy, type ConnectedResource, type IProvider, Lixa, type LixaConfig, type OAuthTokenResponse, type ProviderConfig, type ProviderMetadata, type SafeLixaConfig, type Session, type SessionHandler, type SessionStorage, type StateData, type StateHandler, type StateStorage, type UserInfo, decodeIdToken, determineProviderFromIssuer, extractUserInfo, fetchUserInfo };
+/**
+ * Base error class for all Lixa authentication and authorization errors.
+ *
+ * @public
+ */
+declare class LixaError extends Error {
+    /**
+     * Standard error code string.
+     */
+    readonly code: string;
+    /**
+     * Additional error context data.
+     */
+    readonly details: Record<string, unknown> | undefined;
+    constructor(message: string, code?: string, details?: Record<string, unknown>);
+}
+/**
+ * Thrown when an OAuth state parameter is invalid, missing, or has expired.
+ *
+ * @public
+ */
+declare class InvalidStateError extends LixaError {
+    constructor(message?: string, details?: Record<string, unknown>);
+}
+/**
+ * Thrown when attempting to use a provider that is not configured in the Lixa instance.
+ *
+ * @public
+ */
+declare class ProviderNotConfiguredError extends LixaError {
+    constructor(provider: string, details?: Record<string, unknown>);
+}
+/**
+ * Thrown when a provider configuration is invalid or missing required credentials.
+ *
+ * @public
+ */
+declare class InvalidProviderConfigError extends LixaError {
+    constructor(message: string, details?: Record<string, unknown>);
+}
+/**
+ * Thrown when OAuth callback parameters (e.g. authorization code or state) are missing or malformed.
+ *
+ * @public
+ */
+declare class InvalidOAuthCallbackError extends LixaError {
+    constructor(message: string, details?: Record<string, unknown>);
+}
+/**
+ * Thrown when exchanging an authorization code for OAuth tokens fails at the provider endpoint.
+ *
+ * @public
+ */
+declare class TokenExchangeError extends LixaError {
+    readonly status: number | undefined;
+    constructor(message: string, status?: number, details?: Record<string, unknown>);
+}
+/**
+ * Thrown when a user session is not found or has expired.
+ *
+ * @public
+ */
+declare class SessionNotFoundError extends LixaError {
+    constructor(message?: string, details?: Record<string, unknown>);
+}
+/**
+ * Thrown when account linking fails, e.g. when unverified email linking is rejected.
+ *
+ * @public
+ */
+declare class EmailNotVerifiedError extends LixaError {
+    constructor(email?: string, details?: Record<string, unknown>);
+}
+/**
+ * Thrown when unlinking an account violates security constraints (e.g. unlinking the only login provider).
+ *
+ * @public
+ */
+declare class AccountUnlinkError extends LixaError {
+    constructor(message: string, details?: Record<string, unknown>);
+}
+/**
+ * Thrown when a refresh token is missing or token refresh fails for a connected resource.
+ *
+ * @public
+ */
+declare class RefreshTokenError extends LixaError {
+    constructor(message: string, details?: Record<string, unknown>);
+}
+
+/**
+ * Sensible default cookie configuration options.
+ * Follows RFC 6265bis and OAuth 2.0 security best practices.
+ *
+ * @public
+ */
+interface CookieOptions {
+    /**
+     * Cookie name.
+     * @default 'lixa_session'
+     */
+    name?: string | undefined;
+    /**
+     * Cookie path.
+     * @default '/'
+     */
+    path?: string | undefined;
+    /**
+     * Maximum age of the cookie in seconds.
+     */
+    maxAge?: number | undefined;
+    /**
+     * Prevents client-side scripts from accessing the cookie (XSS protection).
+     * @default true
+     */
+    httpOnly?: boolean | undefined;
+    /**
+     * Ensures the cookie is only transmitted over secure HTTPS connections.
+     * @default false in development, true in production
+     */
+    secure?: boolean | undefined;
+    /**
+     * Controls whether the cookie is sent with cross-site requests (CSRF protection).
+     * @default 'lax'
+     */
+    sameSite?: "lax" | "strict" | "none" | undefined;
+    /**
+     * Cookie domain.
+     */
+    domain?: string | undefined;
+}
+/**
+ * Cookie payload containing name, value, options, and formatted header.
+ *
+ * @public
+ */
+interface CookiePayload {
+    name: string;
+    value: string;
+    options: CookieOptions;
+    /**
+     * Formatted `Set-Cookie` header value string.
+     */
+    header: string;
+}
+/**
+ * Default session cookie name.
+ * @public
+ */
+declare const DEFAULT_SESSION_COOKIE_NAME = "lixa_session";
+/**
+ * Default OAuth state cookie name.
+ * @public
+ */
+declare const DEFAULT_STATE_COOKIE_NAME = "lixa_oauth_state";
+/**
+ * Default session max age in seconds (24 hours).
+ * @public
+ */
+declare const DEFAULT_SESSION_MAX_AGE_SECONDS: number;
+/**
+ * Default OAuth state max age in seconds (5 minutes / 300 seconds).
+ * @public
+ */
+declare const DEFAULT_STATE_MAX_AGE_SECONDS: number;
+/**
+ * Checks if the runtime environment is production.
+ * @public
+ */
+declare function isProductionEnvironment(): boolean;
+/**
+ * Serializes a cookie name, value, and options into a standard `Set-Cookie` header string.
+ *
+ * @param name - Cookie name
+ * @param value - Cookie value
+ * @param options - Cookie attributes
+ * @returns Formatted `Set-Cookie` string
+ *
+ * @public
+ */
+declare function serializeCookie(name: string, value: string, options?: CookieOptions): string;
+/**
+ * Generates a session cookie payload with secure default options.
+ *
+ * @param sessionId - The session identifier string
+ * @param options - Optional overrides for cookie attributes
+ *
+ * @example
+ * ```typescript
+ * const cookie = createSessionCookie(sessionId);
+ * res.setHeader("Set-Cookie", cookie.header);
+ * // or with Express:
+ * res.cookie(cookie.name, cookie.value, cookie.options);
+ * ```
+ *
+ * @public
+ */
+declare function createSessionCookie(sessionId: string, options?: CookieOptions): CookiePayload;
+/**
+ * Generates an expired session cookie payload to clear the session on logout.
+ *
+ * @param options - Optional overrides for cookie name or attributes
+ *
+ * @example
+ * ```typescript
+ * const cookie = clearSessionCookie();
+ * res.setHeader("Set-Cookie", cookie.header);
+ * // or with Express:
+ * res.clearCookie(cookie.name, cookie.options);
+ * ```
+ *
+ * @public
+ */
+declare function clearSessionCookie(options?: CookieOptions): CookiePayload;
+/**
+ * Generates an OAuth CSRF state cookie payload for in-flight authorization flows.
+ *
+ * @param state - The random state string
+ * @param options - Optional overrides for cookie attributes
+ *
+ * @public
+ */
+declare function createStateCookie(state: string, options?: CookieOptions): CookiePayload;
+/**
+ * Generates an expired OAuth state cookie payload to clean up the state cookie after callback.
+ *
+ * @param options - Optional overrides for cookie attributes
+ *
+ * @public
+ */
+declare function clearStateCookie(options?: CookieOptions): CookiePayload;
+
+export { type AccountLinkingConfig, type AccountLinkingMode, AccountLinkingStrategy, AccountUnlinkError, type ConnectedResource, type CookieOptions, type CookiePayload, DEFAULT_SESSION_COOKIE_NAME, DEFAULT_SESSION_MAX_AGE_SECONDS, DEFAULT_STATE_COOKIE_NAME, DEFAULT_STATE_MAX_AGE_SECONDS, EmailNotVerifiedError, type IProvider, InvalidOAuthCallbackError, InvalidProviderConfigError, InvalidStateError, Lixa, type LixaConfig, LixaError, type LixaLogger, type LogContext, type LogLevel, type OAuthTokenResponse, type ProviderConfig, type ProviderMetadata, ProviderNotConfiguredError, RefreshTokenError, type ResourceHandler, type ResourceStorage, type SafeLixaConfig, type Session, type SessionHandler, SessionNotFoundError, type SessionStorage, type StateData, type StateHandler, type StateStorage, TokenExchangeError, type UserInfo, clearSessionCookie, clearStateCookie, createSessionCookie, createStateCookie, decodeIdToken, determineProviderFromIssuer, extractUserInfo, fetchUserInfo, isProductionEnvironment, serializeCookie };