refactor(plugin-auth): list auth-manager.ts's published names in index.ts

index.ts re-exported auth-manager.ts with export *, so any module-level
helper exported there for a module split out of it would be published.
It now names the 14 exports auth-manager.ts already has, in declaration
order, and a new export there is published only by adding it to the
list. The published declarations and both entry points' export lists
are unchanged.

The cut 5 module header said index.ts re-exports auth-manager.ts whole.
That sentence is reworded to say why its four declarations moved with
the bodies; it is a comment, and no token of the file changes.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LSXBc2GCBwiAL7vV4kWkyr

Author: claude

packages/plugins/plugin-auth/src/auth-manager-email-sms-delivery.ts

@@ -43,10 +43,11 @@
  * manager holds.
  *
  * The four module-level declarations move with the bodies rather than being
- * imported back: `index.ts` re-exports `auth-manager.ts` whole, so exporting
- * them from there would add them to the published surface, and a value import
- * of that file from here would be a cycle. Nothing re-exports this module, so
- * the published surface does not move.
+ * imported back, because only these bodies read them. (`index.ts` lists the
+ * names it publishes from `auth-manager.ts` one by one, so a helper exported
+ * there in place for a module split out of it stays off the published
+ * surface.) Nothing re-exports this module, so the published surface does not
+ * move.
  */
 
 import type { StandardErrorCode } from '@objectstack/spec/api';

packages/plugins/plugin-auth/src/index.ts

@@ -13,7 +13,26 @@ export * from './auth-plugin.js';
 // mounts ObjectQL without AuthPlugin (an app's or a plugin's test kit).
 // AuthPlugin registers the same manifest from the same builder.
 export * from './identity-objects-plugin.js';
-export * from './auth-manager.js';
+// [#25224] auth-manager.ts's published names, listed by name so that a
+// module-level helper it exports for the modules split out of it is not
+// published with them. A new export of auth-manager.ts is published only by
+// adding it here.
+export {
+  DEFAULT_AUTH_BASE_PATH,
+  readMcpServerEnabledEnv,
+  resolveOidcProviderEnabled,
+  resolveDcrEnabled,
+  resolveScimEnabled,
+  assertScimAdminCoherence,
+  isOAuthEligibleBaseUrl,
+  type InvitationPlacementServiceLike,
+  readInvitationPlacementIntent,
+  type AuthManagerOptions,
+  ipMatchesRange,
+  normalizeAuthEmailLocale,
+  authEmailLocaleFromRequest,
+  AuthManager,
+} from './auth-manager.js';
 export * from './ensure-default-organization.js';
 // [ADR-0131 D3 / D10 fate 3] The Default Organization's boot invariant, for the
 // v18 organization-ownership ceremony (`os migrate organization-ownership