@absolutejs/auth 0.4.0 → 0.5.1

package/dist/index.js

@@ -1,2 +1,2027 @@
 // @bun
-import{OAuth2RequestError as oN,ArcticFetchError as sN}from"arctic";import{Elysia as aN}from"elysia";import{generateState as RN,generateCodeVerifier as bN}from"arctic";import{Elysia as kN}from"elysia";import{AmazonCognito as l,AniList as u,Apple as c,Atlassian as d,Auth0 as t,Authentik as o,Bitbucket as s,Box as a,Coinbase as i,Discord as e,Dribbble as r,Dropbox as NN,Facebook as EN,Figma as IN,Intuit as SN,GitHub as UN,GitLab as mN,Google as MN,Kakao as TN,KeyCloak as wN,Lichess as xN,Line as DN,Linear as ON,LinkedIn as $N,MicrosoftEntraId as AN,MyAnimeList as LN,Notion as HN,Okta as CN,Osu as JN,Patreon as QN,Reddit as XN,Roblox as YN,Salesforce as jN,Shikimori as FN,Slack as WN,Spotify as ZN,Strava as qN,Tiltify as BN,Tumblr as nN,Twitch as GN,Twitter as VN,VK as KN,WorkOS as gN,Yahoo as pN,Yandex as zN,Zoom as PN,FortyTwo as fN}from"arctic";var Z={AmazonCognito:l,AniList:u,Apple:c,Atlassian:d,Auth0:t,Authentik:o,Bitbucket:s,Box:a,Coinbase:i,Discord:e,Dribbble:r,Dropbox:NN,Facebook:EN,Figma:IN,FortyTwo:fN,GitHub:UN,GitLab:mN,Google:MN,Intuit:SN,Kakao:TN,KeyCloak:wN,Lichess:xN,Line:DN,Linear:ON,LinkedIn:$N,MicrosoftEntraId:AN,MyAnimeList:LN,Notion:HN,Okta:CN,Osu:JN,Patreon:QN,Reddit:XN,Roblox:YN,Salesforce:jN,Shikimori:FN,Slack:WN,Spotify:ZN,Strava:qN,Tiltify:BN,Tumblr:nN,Twitch:GN,Twitter:VN,VK:KN,WorkOS:gN,Yahoo:pN,Yandex:zN,Zoom:PN},K=Object.keys(Z).reduce((N,m)=>{return N[m.toLowerCase()]=m,N},{});var B=(N)=>("refreshAccessToken"in N)&&typeof N.refreshAccessToken==="function",g=(N)=>("revokeAccessToken"in N)&&typeof N.revokeAccessToken==="function",Y=(N)=>Object.keys(Z).map((m)=>m.toLowerCase()).includes(N.toLowerCase()),p=(N)=>!0,z=(N)=>N!==null&&N!==void 0&&N.trim()!=="";var P=86400000;var q=1800;var f=({clientProviders:N,authorizeRoute:m="authorize",onAuthorize:I})=>new kN().get(`/${m}/:provider`,({error:E,redirect:S,cookie:{state:U,code_verifier:x,auth_provider:M,redirect_url:T},params:{provider:D},headers:A})=>{if(D===void 0)return E("Bad Request","Provider is required");if(!Y(D))return E("Bad Request","Invalid provider");try{let O=D.toLowerCase(),{providerInstance:X,scopes:L,searchParams:$}=N[O],w=A.referer??"/";T.set({httpOnly:!0,maxAge:q,path:"/",sameSite:"lax",secure:!0,value:w}),M.set({httpOnly:!0,maxAge:q,path:"/",sameSite:"lax",secure:!0,value:D});let H=RN();U.set({httpOnly:!0,maxAge:q,path:"/",sameSite:"lax",secure:!0,value:H});let C=X.createAuthorizationURL.toString().includes("codeVerifier"),J=C?bN():void 0;C&&x.set({httpOnly:!0,maxAge:q,path:"/",sameSite:"lax",secure:!0,value:J??""});let Q=C?X.createAuthorizationURL(H,J,L):X.createAuthorizationURL(H,L);return $.forEach(([j,W])=>{Q.searchParams.set(j,W)}),I?.(),S(Q.toString())}catch(O){if(O instanceof Error)return E("Internal Server Error",`${O.message} - ${O.stack??""}`);return E("Internal Server Error",`Unknown error: ${O}`)}});import{decodeIdToken as vN}from"arctic";import{Elysia as hN}from"elysia";import{Elysia as yN}from"elysia";var F=()=>{let N={};return new yN({name:"sessionStore"}).state({session:N})};async function R(N,m){let I=_N[N];if(!I)throw new Error(`Unknown provider: ${N}`);let E=I.endpoint,S=I.method??"GET",U={};if(I.headers)Object.assign(U,I.headers);if(I.authIn==="header")U.Authorization=`Bearer ${m}`;else{let T=I.tokenParam??"access_token",D=E.includes("?")?"&":"?";E=`${E}${D}${T}=${encodeURIComponent(m)}`}let x={method:S,headers:U};if(S==="POST"&&I.body)U["Content-Type"]="application/json",x.body=JSON.stringify(I.body);let M=await fetch(E,x);if(!M.ok){let T=await M.text();throw new Error(`Failed to fetch ${N} profile: ${M.status} ${T}`)}return M.json()}var _N={facebook:{endpoint:"https://graph.facebook.com/me?fields=id,name,picture,email",method:"GET",authIn:"query",tokenParam:"access_token"},anilist:{endpoint:"https://graphql.anilist.co",method:"POST",authIn:"header",headers:{"Content-Type":"application/json",Accept:"application/json"},body:{query:"query { Viewer { id name } }"}},atlassian:{endpoint:"https://api.atlassian.com/me",method:"GET",authIn:"header"},battlenet:{endpoint:"https://oauth.battle.net/userinfo",method:"GET",authIn:"header"},bitbucket:{endpoint:"https://api.bitbucket.org/2.0/user",method:"GET",authIn:"header"},box:{endpoint:"https://api.box.com/2.0/users/me",method:"GET",authIn:"header"},bungie:{endpoint:"https://www.bungie.net/Platform/User/GetCurrentBungieNetUser",method:"GET",authIn:"header",headers:{"X-API-Key":"<YOUR_API_KEY>"}},coinbase:{endpoint:"https://api.coinbase.com/v2/user",method:"GET",authIn:"header"},discord:{endpoint:"https://discord.com/api/users/@me",method:"GET",authIn:"header"},donationAlerts:{endpoint:"https://www.donationalerts.com/api/v1/user",method:"GET",authIn:"header"},dribbble:{endpoint:"https://api.dribbble.com/v2/user",method:"GET",authIn:"header"},dropbox:{endpoint:"https://api.dropboxapi.com/2/users/get_current_account",method:"GET",authIn:"header"},epicGames:{endpoint:"https://api.epicgames.dev/epic/oauth/v2/userInfo",method:"GET",authIn:"header"},etsy:{endpoint:"https://openapi.etsy.com/v3/application/users/me",method:"GET",authIn:"header"},figma:{endpoint:"https://api.figma.com/v1/me",method:"GET",authIn:"header"},gitea:{endpoint:"https://<YOUR_GITEA_DOMAIN>/api/v1/user",method:"GET",authIn:"header"},github:{endpoint:"https://api.github.com/user",method:"GET",authIn:"header"},gitlab:{endpoint:"https://gitlab.com/api/v4/user",method:"GET",authIn:"header"},intuit:{endpoint:"https://oauth.platform.intuit.com/oauth2/v1/userinfo",method:"GET",authIn:"header"},kakao:{endpoint:"https://kapi.kakao.com/v2/user/me",method:"GET",authIn:"header"},kick:{endpoint:"https://api.kick.com/v1/user",method:"GET",authIn:"header"},lichess:{endpoint:"https://lichess.org/api/account",method:"GET",authIn:"header"},line:{endpoint:"https://api.line.me/v2/profile",method:"GET",authIn:"header"},linear:{endpoint:"https://api.linear.app/graphql",method:"POST",authIn:"header",headers:{"Content-Type":"application/json",Accept:"application/json"},body:{query:"query { viewer { id name } }"}},mastodon:{endpoint:"https://<YOUR_INSTANCE>/api/v1/accounts/verify_credentials",method:"GET",authIn:"header"},mercadoLibre:{endpoint:"https://api.mercadolibre.com/users/me",method:"GET",authIn:"header"},mercadoPago:{endpoint:"https://api.mercadopago.com/v1/users/me",method:"GET",authIn:"header"},myAnimeList:{endpoint:"https://api.myanimelist.net/v2/users/@me",method:"GET",authIn:"header"},naver:{endpoint:"https://openapi.naver.com/v1/nid/me",method:"GET",authIn:"header"},notion:{endpoint:"https://api.notion.com/v1/users/me",method:"GET",authIn:"header"},osu:{endpoint:"https://osu.ppy.sh/api/v2/me",method:"GET",authIn:"header"},patreon:{endpoint:"https://www.patreon.com/api/oauth2/v2/identity",method:"GET",authIn:"header"},polar:{endpoint:"https://www.polaraccesslink.com/v3/users/<USER_ID>",method:"GET",authIn:"header"},reddit:{endpoint:"https://oauth.reddit.com/api/v1/me",method:"GET",authIn:"header"},roblox:{endpoint:"https://apis.roblox.com/oauth/v1/userinfo",method:"GET",authIn:"header"},shikimori:{endpoint:"https://shikimori.one/api/users/whoami",method:"GET",authIn:"header"},slack:{endpoint:"https://slack.com/api/users.identity",method:"GET",authIn:"query",tokenParam:"token"},spotify:{endpoint:"https://api.spotify.com/v1/me",method:"GET",authIn:"header"},startGg:{endpoint:"https://api.start.gg/gql/alpha",method:"POST",authIn:"header",headers:{"Content-Type":"application/json",Accept:"application/json"},body:{query:"query { currentUser { id slug email player { gamerTag } } }"}},strava:{endpoint:"https://www.strava.com/api/v3/athlete",method:"GET",authIn:"header"},synology:{endpoint:"https://<YOUR_DOMAIN>/webman/sso/SSOUserInfo.cgi",method:"GET",authIn:"header"},tiktok:{endpoint:"https://open.douyin.com/oauth/userinfo",method:"GET",authIn:"query",tokenParam:"access_token"},tiltify:{endpoint:"https://tiltify.com/api/v3/me",method:"GET",authIn:"header"},tumblr:{endpoint:"https://api.tumblr.com/v2/user/info",method:"GET",authIn:"header"},twitch:{endpoint:"https://api.twitch.tv/helix/users",method:"GET",authIn:"header"},twitter:{endpoint:"https://api.twitter.com/2/users/me",method:"GET",authIn:"header"},vk:{endpoint:"https://api.vk.com/method/users.get",method:"GET",authIn:"query",tokenParam:"access_token"},zoom:{endpoint:"https://api.zoom.us/v2/users/me",method:"GET",authIn:"header"}};var b=({clientProviders:N,callbackRoute:m="authorize/callback",onCallback:I})=>new hN().use(F()).get(`/${m}`,async({error:E,redirect:S,store:{session:U},cookie:{state:x,code_verifier:M,redirect_url:T,user_session_id:D,auth_provider:A},query:{code:O,state:X}})=>{if(!z(O)||x.value===void 0)return E("Bad Request","Invalid callback request");if(X!==x.value)return E("Bad Request","Invalid state mismatch");if(A.value===void 0)return E("Unauthorized","No auth provider found");if(!Y(A.value))return E("Unauthorized","Invalid provider");let L=A.value.toLowerCase(),{providerInstance:$}=N[L];try{x.remove();let w=$.validateAuthorizationCode.toString().includes("codeVerifier"),H=M.value;if(w&&H===void 0)return E("Bad Request","Code verifier not found and is required");let C=H??"",J=await(w?$.validateAuthorizationCode(O,C):$.validateAuthorizationCode(O));if(w)M.remove();let Q,j=A.value;try{Q=Object.fromEntries(Object.entries(vN(J.idToken())).map(([G,V])=>[G,typeof V==="string"?V:void 0]))}catch(n){Q=await R(j,J.accessToken())}await I?.({authProvider:j,userProfile:Q,session:U,user_session_id:D});let W=T.value??"/";return S(W)}catch(w){if(w instanceof Error)return E("Internal Server Error",`${w.message} - ${w.stack??""}`);return E("Internal Server Error",`Failed to validate authorization code: Unknown error: ${w}`)}});import{Elysia as lN}from"elysia";var k=({logoutRoute:N="logout",onLogout:m})=>new lN().post(`/${N}`,async({error:I,cookie:{user_session_id:E,auth_provider:S}})=>{if(S.value===void 0)return I("Unauthorized","No auth provider found");try{return m?.(),E.remove(),S.remove(),new Response("Succesfuly Logged Out",{status:204})}catch(U){if(U instanceof Error)return I("Internal Server Error",`Failed to logout: ${U.message}`);return I("Internal Server Error",`Failed to logout: Unknown error: ${U}`)}});import{Elysia as uN}from"elysia";var y=()=>new uN().use(F()).derive(({store:{session:N},cookie:{user_session_id:m},error:I})=>({protectRoute:async(E,S)=>{if(m.value===void 0)return S?.()??I("Unauthorized","No session ID found");if(N[m.value]===void 0)return S?.()??I("Unauthorized","No session found");return E()}})).as("plugin");import{Elysia as cN}from"elysia";var _=({clientProviders:N,refreshRoute:m="refresh",onRefresh:I})=>new cN().post(`/${m}`,async({error:E,cookie:{user_refresh_token:S,auth_provider:U}})=>{if(S.value===void 0)return E("Unauthorized","No refresh token found");if(U.value===void 0)return E("Unauthorized","No auth provider found");let x=U.value.toLowerCase(),{providerInstance:M}=N[x];if(!B(M))return E("Not Implemented","Provider is not refreshable");try{return await M.refreshAccessToken(S.value),I?.(),new Response("Token refreshed",{status:204})}catch(T){if(T instanceof Error)return E("Internal Server Error",`Failed to refresh token: ${T.message}`);return E("Internal Server Error",`Faile to refresh token: Unknown error: ${T}`)}});import{Elysia as dN}from"elysia";var v=({clientProviders:N,revokeRoute:m="revoke",onRevoke:I})=>new dN().post(`/${m}/access-token`,async({error:E,cookie:{user_refresh_token:S,auth_provider:U}})=>{if(S.value===void 0)return E("Unauthorized","No refresh token found");if(U.value===void 0)return E("Unauthorized","No auth provider found");let x=U.value.toLowerCase(),{providerInstance:M}=N[x];if(!g(M))return E("Not Implemented","Provider does not support revocation");try{return await M.revokeAccessToken(S.value),I?.(),new Response("Token revoked",{status:204})}catch(T){if(T instanceof Error)return E("Internal Server Error",`Failed to revoke token: ${T.message}`);return E("Internal Server Error",`Failed to revoke token: Unknown error: ${T}`)}});import{Elysia as tN}from"elysia";var h=({clientProviders:N,statusRoute:m="auth-status",onStatus:I})=>new tN().use(F()).get(`/${m}`,async({error:E,cookie:{user_session_id:S,auth_provider:U},store:{session:x}})=>{try{if(S.value===void 0)return new Response(JSON.stringify({isLoggedIn:!1,user:null}),{headers:{"Content-Type":"application/json"}});if(U.value===void 0)return new Response(JSON.stringify({isLoggedIn:!1,user:null}),{headers:{"Content-Type":"application/json"}});let M=U.value.toLowerCase(),{providerInstance:T}=N[M];if(!B(T))return E("Not Implemented","Provider is not refreshable");let D=x[S.value];if(D===void 0)return new Response(JSON.stringify({isLoggedIn:!1,user:null}),{headers:{"Content-Type":"application/json"}});let{user:A}=D;return I?.(),new Response(JSON.stringify({isLoggedIn:!0,user:A}),{headers:{"Content-Type":"application/json"}})}catch(M){if(M instanceof Error)return E("Internal Server Error",`Error: ${M.message} - ${M.stack??""}`);return E("Internal Server Error",`Unknown Error: ${M}`)}});var zE=async({user_session_id:N,session:m,getUser:I,createUser:E})=>{let S=await I();if(S=S??await E(),!p(S))throw new Error("Internal Server Error - Invalid user schema");let U=crypto.randomUUID();m[U]={expiresAt:Date.now()+P,user:S},N.set({httpOnly:!0,sameSite:"lax",secure:!0,value:U})},PE=(N)=>N;var tE=({config:N,authorizeRoute:m,callbackRoute:I,logoutRoute:E,statusRoute:S,refreshRoute:U,revokeRoute:x,onAuthorize:M,onCallback:T,onStatus:D,onRefresh:A,onLogout:O,onRevoke:X})=>{let L=Object.keys(N).reduce(($,w)=>{if(!Object.prototype.hasOwnProperty.call(N,w))return $;if(!Y(w))return console.error(`Provider ${w} is not supported`),$;let H=N[w];if(!H)return $;let C=w.toLowerCase(),J=K[C];if(!Y(J))return console.error(`Provider ${w} is not supported`),$;let Q=Z[J],{credentials:j,scopes:W=[],searchParams:n=[]}=H,G=new Q(...j);return $[C]={providerInstance:G,scopes:W,searchParams:n},$},{});return new aN().error("OAUTH2_REQUEST_ERROR",oN).error("ARCTIC_FETCH_ERROR",sN).use(k({logoutRoute:E,onLogout:O})).use(v({clientProviders:L,onRevoke:X,revokeRoute:x})).use(h({clientProviders:L,onStatus:D,statusRoute:S})).use(_({clientProviders:L,onRefresh:A,refreshRoute:U})).use(f({authorizeRoute:m,clientProviders:L,onAuthorize:M})).use(b({callbackRoute:I,clientProviders:L,onCallback:T})).use(y()).as("plugin")};export{zE as instantiateUserSession,PE as createAuthConfig,tE as absoluteAuth};
+// node_modules/citra/dist/index.js
+var NUM_GENERATOR_BYTES = 32;
+var BASE64_BLOCK_SIZE = 4;
+var createOAuth2FetchError = async (response) => {
+  const clone = response.clone();
+  const prefix = `HTTP ${response.status} ${response.statusText} for ${response.url}`;
+  const payload = await response.json().catch(() => null);
+  if (payload && typeof payload === "object" && Object.keys(payload).length) {
+    return new Error(`${prefix}
+${JSON.stringify(payload)}`);
+  }
+  const text = await clone.text().catch(() => "");
+  if (text) {
+    return new Error(`${prefix}
+${text}`);
+  }
+  return new Error(prefix);
+};
+var encodeBase64 = (input) => {
+  let raw;
+  if (typeof input === "string") {
+    raw = input;
+  } else {
+    const bytes = input instanceof Uint8Array ? input : new Uint8Array(input);
+    raw = bytes.reduce((acc, byte) => acc + String.fromCharCode(byte), "");
+  }
+  return btoa(raw);
+};
+var decodeBase64 = (input, toUint8Array = false) => {
+  const b64 = input.replace(/-/g, "+").replace(/_/g, "/") + "==".slice(0, (BASE64_BLOCK_SIZE - input.length % BASE64_BLOCK_SIZE) % BASE64_BLOCK_SIZE);
+  const raw = atob(b64);
+  if (!toUint8Array) {
+    return raw;
+  }
+  const bytes = new Uint8Array(raw.length);
+  for (let i = 0;i < raw.length; i++) {
+    bytes[i] = raw.charCodeAt(i);
+  }
+  return bytes;
+};
+var decodeJWT = (tokenString) => {
+  const [headerSegment, payloadSegment, signatureSegment] = tokenString.split(".");
+  if (!headerSegment || !payloadSegment || !signatureSegment) {
+    throw new Error("Invalid JWT format");
+  }
+  const decodedPayload = decodeBase64(payloadSegment);
+  if (typeof decodedPayload !== "string") {
+    throw new Error("Expected JWT payload to be a UTF-8 string");
+  }
+  return JSON.parse(decodedPayload);
+};
+var createOAuth2Request = ({
+  url,
+  body,
+  authIn,
+  headers,
+  encoding,
+  clientId,
+  clientSecret
+}) => {
+  const oauthHeaders = new Headers(headers);
+  oauthHeaders.set("Accept", "application/json");
+  oauthHeaders.set("User-Agent", "citra");
+  if (authIn === "header") {
+    if (!clientSecret) {
+      throw new Error("clientSecret required for header auth");
+    }
+    oauthHeaders.set("Authorization", `Basic ${encodeBase64(`${clientId}:${clientSecret}`)}`);
+  }
+  if (encoding === "json") {
+    oauthHeaders.set("Content-Type", "application/json");
+    return new Request(url, {
+      body: JSON.stringify(body),
+      headers: oauthHeaders,
+      method: "POST"
+    });
+  }
+  oauthHeaders.set("Content-Type", "application/x-www-form-urlencoded");
+  const entries = body instanceof URLSearchParams ? Array.from(body.entries()) : Object.entries(body).filter((entry) => typeof entry[1] === "string");
+  const params = new URLSearchParams(entries);
+  if (authIn === "body") {
+    params.set("client_id", clientId);
+    clientSecret && params.set("client_secret", clientSecret);
+  }
+  return new Request(url, {
+    body: params.toString(),
+    headers: oauthHeaders,
+    method: "POST"
+  });
+};
+var createS256CodeChallenge = async (codeVerifier) => {
+  const data = new TextEncoder().encode(codeVerifier);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+  return base64Url(hashBuffer);
+};
+var createRandomBase64UrlGenerator = (length) => () => {
+  const buffer = crypto.getRandomValues(new Uint8Array(length));
+  return base64Url(buffer);
+};
+var generateCodeVerifier = createRandomBase64UrlGenerator(NUM_GENERATOR_BYTES);
+var generateState = createRandomBase64UrlGenerator(NUM_GENERATOR_BYTES);
+var base64Url = (input) => encodeBase64(input).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+var isValidProviderOption = (option) => {
+  const normalizedOption = option.toLowerCase();
+  return Object.keys(normalizedProviders).includes(normalizedOption);
+};
+var isPKCEProviderOption = (option) => normalizedProviders[option.toLowerCase()]?.PKCEMethod !== undefined;
+var isRefreshableOAuth2Client = (providerName, client) => {
+  const normalizedOption = providerName.toLowerCase();
+  const provider = normalizedProviders[normalizedOption];
+  return isValidProviderOption(providerName) && provider?.isRefreshable === true;
+};
+var isRevocableOAuth2Client = (providerName, client) => {
+  const normalizedOption = providerName.toLowerCase();
+  const provider = normalizedProviders[normalizedOption];
+  return isValidProviderOption(providerName) && provider?.revocationRequest !== undefined;
+};
+var hasClientSecret = (credentials) => {
+  if (typeof credentials !== "object" || credentials === null)
+    return false;
+  const secret = Reflect.get(credentials, "clientSecret");
+  return typeof secret === "string";
+};
+var defineProviders = (providers2) => providers2;
+var providers = defineProviders({
+  "42": {
+    authorizationUrl: "https://api.intra.42.fr/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://api.intra.42.fr/v2/me"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://api.intra.42.fr/oauth/token"
+    }
+  },
+  AmazonCognito: {
+    authorizationUrl: "https://${domain}/oauth2/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: (config) => `https://${config.domain}/oauth2/userInfo`
+    },
+    revocationRequest: {
+      authIn: "body",
+      tokenParamName: "token",
+      url: (config) => `https://${config.domain}/oauth2/revoke`
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: (config) => `https://${config.domain}/oauth2/token`
+    }
+  },
+  AniList: {
+    authorizationUrl: "https://anilist.co/api/v2/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      body: {
+        query: `query { Viewer { id name } }`
+      },
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json"
+      },
+      method: "POST",
+      url: "https://graphql.anilist.co"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://anilist.co/api/v2/oauth/token"
+    }
+  },
+  Apple: {
+    authorizationUrl: "https://appleid.apple.com/auth/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://appleid.apple.com/auth/userinfo"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://appleid.apple.com/auth/token"
+    }
+  },
+  Atlassian: {
+    authorizationUrl: "https://auth.atlassian.com/authorize",
+    createAuthorizationURLSearchParams: {
+      audience: "api.atlassian.com"
+    },
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://api.atlassian.com/me"
+    },
+    scopeRequired: true,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://auth.atlassian.com/oauth/token"
+    }
+  },
+  Auth0: {
+    authorizationUrl: (config) => `https://${config.domain}/authorize`,
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: (config) => `https://${config.domain}/userinfo`
+    },
+    revocationRequest: {
+      authIn: "body",
+      body: new URLSearchParams({
+        token_type_hint: "refresh_token"
+      }),
+      tokenParamName: "token",
+      url: (config) => `https://${config.domain}/oauth/revoke`
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: (config) => `https://${config.domain}/oauth/token`
+    }
+  },
+  Authentik: {
+    authorizationUrl: (config) => `https://${config.baseURL}/oauth/authorize`,
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: (config) => `https://${config.baseURL}/api/v3/user/`
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: (config) => `https://${config.baseURL}/oauth/token`
+    }
+  },
+  Autodesk: {
+    authorizationUrl: "https://developer.api.autodesk.com/authentication/v2/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://api.userprofile.autodesk.com/userinfo"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://developer.api.autodesk.com/authentication/v2/token"
+    }
+  },
+  Battlenet: {
+    authorizationUrl: "https://oauth.battle.net/authorize",
+    isOIDC: true,
+    isRefreshable: false,
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://oauth.battle.net/userinfo"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://oauth.battle.net/token"
+    }
+  },
+  Bitbucket: {
+    authorizationUrl: "https://bitbucket.org/site/oauth2/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://api.bitbucket.org/2.0/user"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://bitbucket.org/site/oauth2/access_token"
+    }
+  },
+  Box: {
+    authorizationUrl: "https://account.box.com/api/oauth2/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://api.box.com/2.0/users/me"
+    },
+    revocationRequest: {
+      authIn: "body",
+      tokenParamName: "token",
+      url: "https://api.box.com/oauth2/revoke"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://api.box.com/oauth2/token"
+    }
+  },
+  Bungie: {
+    authorizationUrl: "https://www.bungie.net/en/OAuth/Authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      headers: {
+        "X-API-Key": "<YOUR_API_KEY>"
+      },
+      method: "GET",
+      url: "https://www.bungie.net/Platform/User/GetCurrentBungieNetUser"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://www.bungie.net/Platform/App/OAuth/token"
+    }
+  },
+  Coinbase: {
+    authorizationUrl: "https://www.coinbase.com/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://api.coinbase.com/v2/user"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://api.coinbase.com/oauth/token"
+    }
+  },
+  Discord: {
+    authorizationUrl: "https://discord.com/api/oauth2/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://discord.com/api/users/@me"
+    },
+    scopeRequired: true,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://discord.com/api/oauth2/token"
+    }
+  },
+  DonationAlerts: {
+    authorizationUrl: "https://www.donationalerts.com/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://www.donationalerts.com/api/v1/user/oauth"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://www.donationalerts.com/oauth/token"
+    }
+  },
+  Dribbble: {
+    authorizationUrl: "https://dribbble.com/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: false,
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://api.dribbble.com/v2/user"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://dribbble.com/oauth/token"
+    }
+  },
+  Dropbox: {
+    authorizationUrl: "https://www.dropbox.com/oauth2/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      method: "POST",
+      url: "https://api.dropboxapi.com/2/users/get_current_account"
+    },
+    revocationRequest: {
+      authIn: "header",
+      url: "https://api.dropboxapi.com/2/auth/token/revoke"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://api.dropboxapi.com/oauth2/token"
+    }
+  },
+  EpicGames: {
+    authorizationUrl: "https://www.epicgames.com/id/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://api.epicgames.dev/epic/oauth/v2/userInfo"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://api.epicgames.dev/epic/oauth/v1/token"
+    }
+  },
+  Etsy: {
+    authorizationUrl: "https://www.etsy.com/oauth/connect",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://openapi.etsy.com/v3/application/users/me"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://api.etsy.com/v3/public/oauth/token"
+    }
+  },
+  Facebook: {
+    authorizationUrl: "https://www.facebook.com/v16.0/dialog/oauth",
+    isOIDC: true,
+    isRefreshable: false,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "query",
+      method: "GET",
+      searchParams: [["fields", "id,name,email,picture"]],
+      url: "https://graph.facebook.com/me"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://graph.facebook.com/v16.0/oauth/access_token"
+    }
+  },
+  Figma: {
+    authorizationUrl: "https://www.figma.com/oauth",
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://api.figma.com/v1/me"
+    },
+    scopeRequired: true,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://api.figma.com/v1/oauth/token"
+    }
+  },
+  Gitea: {
+    authorizationUrl: (config) => `${config.baseURL}/login/oauth/authorize`,
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: (config) => `${config.baseURL}/api/v1/user`
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: (config) => `${config.baseURL}/login/oauth/access_token`
+    }
+  },
+  GitHub: {
+    authorizationUrl: "https://github.com/login/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: false,
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://api.github.com/user"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://github.com/login/oauth/access_token"
+    }
+  },
+  GitLab: {
+    authorizationUrl: (config) => `${config.baseURL}/oauth/authorize`,
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://gitlab.com/api/v4/user"
+    },
+    revocationRequest: {
+      authIn: "body",
+      tokenParamName: "token",
+      url: (config) => `${config.baseURL}/oauth/revoke`
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: (config) => `${config.baseURL}/oauth/token`
+    }
+  },
+  Google: {
+    authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      searchParams: [["personFields", "names,emailAddresses,photos"]],
+      url: "https://people.googleapis.com/v1/people/me"
+    },
+    revocationRequest: {
+      authIn: "body",
+      tokenParamName: "token",
+      url: "https://oauth2.googleapis.com/revoke"
+    },
+    scopeRequired: true,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://oauth2.googleapis.com/token"
+    }
+  },
+  Intuit: {
+    authorizationUrl: "https://appcenter.intuit.com/connect/oauth2",
+    isOIDC: true,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: (config) => config.environment === "production" ? "https://accounts.platform.intuit.com/v1/openid_connect/userinfo" : "https://sandbox-accounts.platform.intuit.com/v1/openid_connect/userinfo"
+    },
+    revocationRequest: {
+      authIn: "body",
+      headers: (config) => ({
+        Authorization: `Basic ${encodeBase64(`${config.clientId}:${config.clientSecret}`)}`
+      }),
+      tokenParamName: "token",
+      url: "https://developer.api.intuit.com/v2/oauth2/tokens/revoke"
+    },
+    scopeRequired: true,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer"
+    }
+  },
+  Kakao: {
+    authorizationUrl: "https://kauth.kakao.com/oauth/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://kapi.kakao.com/v2/user/me"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://kauth.kakao.com/oauth/token"
+    }
+  },
+  Keycloak: {
+    authorizationUrl: (config) => `${config.realmURL}/protocol/openid-connect/auth`,
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://api.kick.com/v1/user"
+    },
+    revocationRequest: {
+      authIn: "body",
+      tokenParamName: "token",
+      url: (config) => `${config.realmURL}/protocol/openid-connect/revoke`
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: (config) => `${config.realmURL}/protocol/openid-connect/token`
+    }
+  },
+  Kick: {
+    authorizationUrl: "https://id.kick.com/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://id.kick.com/v1/user"
+    },
+    revocationRequest: {
+      authIn: "body",
+      tokenParamName: "token",
+      url: "https://id.kick.com/oauth/revoke"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://id.kick.com/oauth/token"
+    }
+  },
+  Lichess: {
+    authorizationUrl: "https://lichess.org/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: false,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://lichess.org/api/account"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://lichess.org/api/token"
+    }
+  },
+  LINE: {
+    authorizationUrl: "https://access.line.me/oauth2/v2.1/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://api.line.me/v2/profile"
+    },
+    scopeRequired: true,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://api.line.me/oauth2/v2.1/token"
+    }
+  },
+  Linear: {
+    authorizationUrl: "https://linear.app/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: false,
+    profileRequest: {
+      authIn: "header",
+      body: {
+        query: `query { viewer { id name } }`
+      },
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json"
+      },
+      method: "POST",
+      url: "https://api.linear.app/graphql"
+    },
+    revocationRequest: {
+      authIn: "header",
+      url: "https://api.linear.app/oauth/revoke"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://api.linear.app/oauth/token"
+    }
+  },
+  LinkedIn: {
+    authorizationUrl: "https://www.linkedin.com/oauth/v2/authorization",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://api.linkedin.com/v2/me"
+    },
+    scopeRequired: true,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://www.linkedin.com/oauth/v2/accessToken"
+    }
+  },
+  Mastodon: {
+    authorizationUrl: (config) => `${config.baseURL}/oauth/authorize`,
+    isOIDC: false,
+    isRefreshable: false,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: (config) => `${config.baseURL}/api/v1/accounts/verify_credentials`
+    },
+    revocationRequest: {
+      authIn: "body",
+      tokenParamName: "token",
+      url: (config) => `${config.baseURL}/oauth/revoke`
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: (config) => `${config.baseURL}/oauth/token`
+    }
+  },
+  MercadoLibre: {
+    authorizationUrl: "https://auth.mercadolibre.com/authorization",
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://api.mercadolibre.com/users/me"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://api.mercadolibre.com/oauth/token"
+    }
+  },
+  MercadoPago: {
+    authorizationUrl: "https://auth.mercadopago.com/authorization",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://api.mercadopago.com/v1/users/me"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://api.mercadopago.com/oauth/token"
+    }
+  },
+  MicrosoftEntraId: {
+    authorizationUrl: (config) => `https://${config.tenantId}.b2clogin.com/${config.tenantId}/oauth2/v2.0/authorize`,
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: (config) => `https://${config.tenantId}.b2clogin.com/${config.tenantId}/openid/userinfo`
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: (config) => `https://${config.tenantId}.b2clogin.com/${config.tenantId}/oauth2/v2.0/token`
+    }
+  },
+  MyAnimeList: {
+    authorizationUrl: "https://myanimelist.net/v1/oauth2/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "plain",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://api.myanimelist.net/v2/users/@me"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://myanimelist.net/v1/oauth2/token"
+    }
+  },
+  Naver: {
+    authorizationUrl: "https://nid.naver.com/oauth2.0/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://openapi.naver.com/v1/nid/me"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://nid.naver.com/oauth2.0/token"
+    }
+  },
+  Notion: {
+    authorizationUrl: "https://api.notion.com/v1/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: false,
+    profileRequest: {
+      authIn: "header",
+      headers: {
+        "Notion-Version": "2022-06-28"
+      },
+      method: "GET",
+      url: "https://api.notion.com/v1/users/me"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "header",
+      encoding: "json",
+      url: "https://api.notion.com/v1/oauth/token"
+    }
+  },
+  Okta: {
+    authorizationUrl: (config) => `https://${config.domain}/oauth2/default/v1/authorize`,
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: (config) => `https://${config.domain}/oauth2/default/v1/userinfo`
+    },
+    revocationRequest: {
+      authIn: "body",
+      tokenParamName: "token",
+      url: (config) => `https://${config.domain}/oauth2/default/v1/revoke`
+    },
+    scopeRequired: true,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: (config) => `https://${config.domain}/oauth2/default/v1/token`
+    }
+  },
+  Osu: {
+    authorizationUrl: "https://osu.ppy.sh/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://osu.ppy.sh/api/v2/me"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://osu.ppy.sh/oauth/token"
+    }
+  },
+  Patreon: {
+    authorizationUrl: "https://www.patreon.com/oauth2/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://www.patreon.com/api/oauth2/v2/identity"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://www.patreon.com/api/oauth2/token"
+    }
+  },
+  Polar: {
+    authorizationUrl: "https://polar.sh/oauth2/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://api.polar.sh/v1/oauth2/userinfo"
+    },
+    revocationRequest: {
+      authIn: "body",
+      tokenParamName: "token",
+      url: "https://api.polar.sh/v1/oauth2/revoke"
+    },
+    scopeRequired: true,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://api.polar.sh/v1/oauth2/token"
+    }
+  },
+  PolarAccessLink: {
+    authorizationUrl: "https://flow.polar.com/oauth2/authorization",
+    isOIDC: false,
+    isRefreshable: false,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://www.polaraccesslink.com/v3/users/me"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "header",
+      encoding: "form",
+      url: "https://polarremote.com/v2/oauth2/token"
+    }
+  },
+  PolarTeamPro: {
+    authorizationUrl: "https://auth.polar.com/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://www.polaraccesslink.com/v3/users/<USER_ID>"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "header",
+      encoding: "form",
+      url: "https://auth.polar.com/oauth/token"
+    }
+  },
+  Reddit: {
+    authorizationUrl: "https://www.reddit.com/api/v1/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://oauth.reddit.com/api/v1/me"
+    },
+    revocationRequest: {
+      authIn: "header",
+      body: new URLSearchParams({
+        token_type_hint: "refresh_token"
+      }),
+      url: "https://www.reddit.com/api/v1/revoke_token"
+    },
+    scopeRequired: true,
+    tokenRequest: {
+      authIn: "header",
+      encoding: "form",
+      url: "https://www.reddit.com/api/v1/access_token"
+    }
+  },
+  Roblox: {
+    authorizationUrl: "https://apis.roblox.com/oauth/v1/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://apis.roblox.com/oauth/v1/userinfo"
+    },
+    scopeRequired: true,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://apis.roblox.com/oauth/v1/token"
+    }
+  },
+  Salesforce: {
+    authorizationUrl: "https://login.salesforce.com/services/oauth2/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://login.salesforce.com/services/oauth2/userinfo"
+    },
+    revocationRequest: {
+      authIn: "header",
+      url: "https://login.salesforce.com/services/oauth2/revoke"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://login.salesforce.com/services/oauth2/token"
+    }
+  },
+  Shikimori: {
+    authorizationUrl: "https://shikimori.org/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://shikimori.one/api/users/whoami"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://shikimori.org/oauth/token"
+    }
+  },
+  Slack: {
+    authorizationUrl: "https://slack.com/openid/connect/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "query",
+      method: "GET",
+      url: "https://slack.com/api/users.identity"
+    },
+    revocationRequest: {
+      authIn: "body",
+      tokenParamName: "token",
+      url: "https://slack.com/api/auth.revoke"
+    },
+    scopeRequired: true,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://slack.com/api/openid.connect.token"
+    }
+  },
+  Spotify: {
+    authorizationUrl: "https://accounts.spotify.com/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://api.spotify.com/v1/me"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://accounts.spotify.com/api/token"
+    }
+  },
+  StartGG: {
+    authorizationUrl: "https://start.gg/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      body: {
+        query: `query { currentUser { id slug email player { gamerTag } } }`
+      },
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json"
+      },
+      method: "POST",
+      url: "https://api.start.gg/gql/alpha"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://api.start.gg/oauth/access_token"
+    }
+  },
+  Strava: {
+    authorizationUrl: "https://www.strava.com/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://www.strava.com/api/v3/athlete"
+    },
+    revocationRequest: {
+      authIn: "query",
+      body: new URLSearchParams({
+        token_type_hint: "access_token"
+      }),
+      tokenParamName: "access_token",
+      url: "https://www.strava.com/oauth/deauthorize"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://www.strava.com/oauth/token"
+    }
+  },
+  Synology: {
+    authorizationUrl: (config) => `${config.baseURL}/webman/sso/SSOOauth.cgi?client_id=${config.clientId}&response_type=code&redirect_uri=${config.redirectUri}`,
+    isOIDC: false,
+    isRefreshable: false,
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: (config) => `${config.baseURL}/webman/sso/SSOUserInfo.cgi?client_id=${config.clientId}&access_token=${config.accessToken}`
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: (config) => `${config.baseURL}/webman/sso/SSOAccessToken.cgi?client_id=${config.clientId}&client_secret=${config.clientSecret}`
+    }
+  },
+  TikTok: {
+    authorizationUrl: "https://www.tiktok.com/v2/auth/authorize",
+    createAuthorizationURLSearchParams: (config) => ({
+      client_key: config.clientId
+    }),
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "query",
+      method: "GET",
+      url: "https://open.douyin.com/oauth/userinfo"
+    },
+    revocationRequest: {
+      authIn: "body",
+      tokenParamName: "token",
+      url: "https://open.tiktokapis.com/v2/oauth/revoke/"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://open.tiktokapis.com/v2/oauth/token/"
+    }
+  },
+  Tiltify: {
+    authorizationUrl: "https://v5api.tiltify.com/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://v5api.tiltify.com/api/public/current-user"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://v5api.tiltify.com/oauth/token"
+    }
+  },
+  Tumblr: {
+    authorizationUrl: "https://www.tumblr.com/oauth2/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://api.tumblr.com/v2/user/info"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://api.tumblr.com/v2/oauth2/token"
+    }
+  },
+  Twitch: {
+    authorizationUrl: "https://id.twitch.tv/oauth2/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      headers: (config) => ({
+        "Client-Id": config.clientId
+      }),
+      method: "GET",
+      url: "https://api.twitch.tv/helix/users"
+    },
+    revocationRequest: {
+      authIn: "query",
+      headers: (config) => ({
+        "Client-Id": config.clientId
+      }),
+      tokenParamName: "token",
+      url: "https://id.twitch.tv/oauth2/revoke"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://id.twitch.tv/oauth2/token"
+    }
+  },
+  Twitter: {
+    authorizationUrl: "https://twitter.com/i/oauth2/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://api.twitter.com/2/users/me"
+    },
+    revocationRequest: {
+      authIn: "header",
+      url: "https://api.twitter.com/2/oauth2/revoke"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://api.twitter.com/2/oauth2/token"
+    }
+  },
+  VK: {
+    authorizationUrl: "https://oauth.vk.com/authorize",
+    isOIDC: false,
+    isRefreshable: false,
+    profileRequest: {
+      authIn: "query",
+      method: "GET",
+      url: "https://api.vk.com/method/users.get"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://oauth.vk.com/access_token"
+    }
+  },
+  WorkOS: {
+    authorizationUrl: "https://api.workos.com/sso/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://api.workos.com/sso/userinfo"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://api.workos.com/sso/token"
+    }
+  },
+  Yahoo: {
+    authorizationUrl: "https://api.login.yahoo.com/oauth2/request_auth",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://api.login.yahoo.com/openid/v1/userinfo"
+    },
+    revocationRequest: {
+      authIn: "header",
+      url: "https://api.login.yahoo.com/oauth2/revoke"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://api.login.yahoo.com/oauth2/get_token"
+    }
+  },
+  Yandex: {
+    authorizationUrl: "https://oauth.yandex.com/authorize",
+    createAuthorizationURLSearchParams: {
+      device_id: crypto.randomUUID(),
+      device_name: `${navigator.platform ?? "Unknown"} \u2014 ${(navigator.userAgent.split(")")[0] || "").split("(").pop() || "Unknown"}`
+    },
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://login.yandex.ru/info"
+    },
+    revocationRequest: {
+      authIn: "body",
+      tokenParamName: "access_token",
+      url: "https://oauth.yandex.com/revoke_token"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://oauth.yandex.com/token"
+    }
+  },
+  Zoom: {
+    authorizationUrl: "https://zoom.us/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      method: "GET",
+      url: "https://api.zoom.us/v2/users/me"
+    },
+    revocationRequest: {
+      authIn: "query",
+      headers: (config) => ({
+        Authorization: `Basic ${btoa(`${config.clientId}:${config.clientSecret}`)}`
+      }),
+      tokenParamName: "token",
+      url: "https://zoom.us/oauth/revoke"
+    },
+    scopeRequired: false,
+    tokenRequest: {
+      authIn: "body",
+      encoding: "form",
+      url: "https://zoom.us/oauth/token"
+    }
+  }
+});
+var normalizedProviders = Object.fromEntries(Object.entries(providers).map(([key, def]) => [key.toLowerCase(), def]));
+var providerOptions = Object.keys(providers).filter(isValidProviderOption);
+var createOAuth2Client = (providerName, config) => {
+  const meta = providers[providerName];
+  const isConfigPropertyFunction = (cfgProp) => typeof cfgProp === "function";
+  const resolveConfigProp = (cfgProp) => isConfigPropertyFunction(cfgProp) ? cfgProp(config) : cfgProp;
+  const authorizationUrl = resolveConfigProp(meta.authorizationUrl);
+  const tokenUrl = resolveConfigProp(meta.tokenRequest.url);
+  return {
+    async createAuthorizationUrl(opts) {
+      const { state, scope = [], searchParams = [], codeVerifier } = opts;
+      const url = new URL(authorizationUrl);
+      url.searchParams.set("response_type", "code");
+      url.searchParams.set("client_id", config.clientId);
+      if (config.redirectUri)
+        url.searchParams.set("redirect_uri", config.redirectUri);
+      if (state)
+        url.searchParams.set("state", state);
+      if (scope.length)
+        url.searchParams.set("scope", scope.join(" "));
+      if (meta.PKCEMethod !== undefined) {
+        if (!codeVerifier) {
+          throw new Error("`codeVerifier` is required when PKCE is enabled");
+        }
+        const codeChallenge = meta.PKCEMethod === "S256" ? await createS256CodeChallenge(codeVerifier) : codeVerifier;
+        url.searchParams.set("code_challenge_method", meta.PKCEMethod);
+        url.searchParams.set("code_challenge", codeChallenge);
+      }
+      Object.entries(resolveConfigProp(meta.createAuthorizationURLSearchParams) ?? {}).forEach(([key, value]) => url.searchParams.set(key, value));
+      searchParams.forEach(([key, value]) => url.searchParams.set(key, value));
+      return url;
+    },
+    async fetchUserProfile(accessToken) {
+      const { profileRequest } = meta;
+      const {
+        url,
+        method,
+        authIn,
+        searchParams,
+        body: profileBody,
+        headers
+      } = profileRequest;
+      const endpoint = new URL(resolveConfigProp(url));
+      new URLSearchParams(searchParams).forEach((value, key) => endpoint.searchParams.append(key, value));
+      let headerEntries = [];
+      const rawHeaders = headers ? resolveConfigProp(headers) : undefined;
+      if (rawHeaders instanceof Headers)
+        headerEntries = Array.from(rawHeaders.entries());
+      else if (Array.isArray(rawHeaders))
+        headerEntries = rawHeaders;
+      else if (rawHeaders && typeof rawHeaders === "object")
+        headerEntries = Object.entries(rawHeaders);
+      const profileHeaders = Object.fromEntries(headerEntries.filter(([, value]) => value !== ""));
+      if (authIn === "header") {
+        profileHeaders.Authorization = `Bearer ${accessToken}`;
+      } else {
+        endpoint.searchParams.append("access_token", accessToken);
+      }
+      const init = { headers: profileHeaders, method };
+      if (method === "POST" && profileBody) {
+        profileHeaders["Content-Type"] = "application/json";
+        init.body = JSON.stringify(profileBody);
+      }
+      const response = await fetch(endpoint.toString(), init);
+      if (!response.ok)
+        throw await createOAuth2FetchError(response);
+      return response.json();
+    },
+    async refreshAccessToken(refreshToken) {
+      const { authIn, encoding } = meta.tokenRequest;
+      const params = new URLSearchParams(meta.refreshAccessTokenBody);
+      params.set("grant_type", "refresh_token");
+      params.set("refresh_token", refreshToken);
+      const { clientId } = config;
+      let clientSecretValue;
+      if (hasClientSecret(config)) {
+        clientSecretValue = config.clientSecret;
+        params.set("client_id", clientId);
+        params.set("client_secret", clientSecretValue);
+      }
+      const request = createOAuth2Request({
+        authIn,
+        body: params,
+        clientId,
+        clientSecret: clientSecretValue,
+        encoding,
+        url: tokenUrl
+      });
+      const response = await fetch(request);
+      if (!response.ok)
+        throw await createOAuth2FetchError(response);
+      return response.json();
+    },
+    async revokeToken(token) {
+      const { revocationRequest } = meta;
+      if (!revocationRequest) {
+        throw new Error("Token revocation not defined for this provider");
+      }
+      const { url, authIn, body, headers, tokenParamName } = revocationRequest;
+      const endpoint = resolveConfigProp(url);
+      const revocationBody = body ?? new URLSearchParams;
+      const revocationHeaders = new Headers(headers && resolveConfigProp(headers));
+      const { clientId } = config;
+      const clientSecret = hasClientSecret(config) ? config.clientSecret : undefined;
+      let request;
+      if (authIn === "body") {
+        revocationBody.set(tokenParamName, token);
+        revocationBody.set("client_id", clientId);
+        if (clientSecret)
+          revocationBody.set("client_secret", clientSecret);
+        request = createOAuth2Request({
+          authIn: "body",
+          body: revocationBody,
+          clientId,
+          clientSecret,
+          encoding: "form",
+          headers: revocationHeaders,
+          url: endpoint.toString()
+        });
+      } else if (authIn === "header") {
+        revocationHeaders.set("Authorization", `Bearer ${token}`);
+        request = createOAuth2Request({
+          authIn: "header",
+          body: revocationBody,
+          clientId,
+          clientSecret,
+          encoding: "form",
+          headers: revocationHeaders,
+          url: endpoint.toString()
+        });
+      } else {
+        request = createOAuth2Request({
+          authIn: "query",
+          body: revocationBody,
+          clientId,
+          clientSecret,
+          encoding: "form",
+          headers: revocationHeaders,
+          url: `${endpoint.toString()}?${tokenParamName}=${token}`
+        });
+      }
+      const response = await fetch(request);
+      if (!response.ok)
+        throw await createOAuth2FetchError(response);
+    },
+    async validateAuthorizationCode(opts) {
+      const { code, codeVerifier } = opts;
+      const { authIn, encoding } = meta.tokenRequest;
+      const bodyObj = {};
+      for (const key in meta.validateAuthorizationCodeBody ?? {}) {
+        const value = meta.validateAuthorizationCodeBody[key];
+        if (typeof value === "string")
+          bodyObj[key] = value;
+      }
+      bodyObj.grant_type = "authorization_code";
+      bodyObj.code = code;
+      if (config.redirectUri)
+        bodyObj.redirect_uri = config.redirectUri;
+      if (meta.PKCEMethod !== undefined) {
+        if (!codeVerifier) {
+          throw new Error("codeVerifier required when PKCE is enabled");
+        }
+        bodyObj.code_verifier = codeVerifier;
+      }
+      const payload = encoding === "json" ? bodyObj : new URLSearchParams(bodyObj);
+      const request = createOAuth2Request({
+        authIn,
+        body: payload,
+        clientId: config.clientId,
+        clientSecret: hasClientSecret(config) ? config.clientSecret : undefined,
+        encoding,
+        url: tokenUrl
+      });
+      const response = await fetch(request);
+      if (!response.ok)
+        throw await createOAuth2FetchError(response);
+      return response.json();
+    }
+  };
+};
+
+// src/index.ts
+import { Elysia as Elysia10 } from "elysia";
+
+// src/authorize.ts
+import { Elysia } from "elysia";
+
+// src/constants.ts
+var SECONDS_IN_A_MINUTE = 60;
+var MILLISECONDS_IN_A_SECOND = 1000;
+var MILLISECONDS_IN_A_MINUTE = MILLISECONDS_IN_A_SECOND * SECONDS_IN_A_MINUTE;
+var MINUTES_IN_AN_HOUR = 60;
+var HOURS_IN_A_DAY = 24;
+var MILLISECONDS_IN_A_DAY = MILLISECONDS_IN_A_SECOND * SECONDS_IN_A_MINUTE * MINUTES_IN_AN_HOUR * HOURS_IN_A_DAY;
+var COOKIE_MINUTES = 30;
+var COOKIE_DURATION = SECONDS_IN_A_MINUTE * COOKIE_MINUTES;
+
+// src/authorize.ts
+var authorize = ({
+  clientProviders,
+  authorizeRoute = "/oauth2/:provider/authorization",
+  onAuthorize
+}) => new Elysia().get(authorizeRoute, async ({
+  error,
+  redirect,
+  cookie: { state, code_verifier, auth_provider, redirect_url },
+  params: { provider },
+  headers
+}) => {
+  if (auth_provider === undefined || redirect_url === undefined || state === undefined || code_verifier === undefined)
+    return error("Bad Request", "Cookies are missing");
+  if (provider === undefined)
+    return error("Bad Request", "Provider is required");
+  if (!isValidProviderOption(provider)) {
+    return error("Bad Request", "Invalid provider");
+  }
+  const providerConfig = clientProviders[provider];
+  if (!providerConfig) {
+    return error("Unauthorized", "Invalid provider");
+  }
+  const { providerInstance, scope, searchParams } = providerConfig;
+  const normalizedProvider = provider.toLowerCase();
+  try {
+    const redirectUrl = headers["referer"] ?? "/";
+    redirect_url.set({
+      httpOnly: true,
+      maxAge: COOKIE_DURATION,
+      path: "/",
+      sameSite: "lax",
+      secure: true,
+      value: redirectUrl
+    });
+    auth_provider.set({
+      httpOnly: true,
+      maxAge: COOKIE_DURATION,
+      path: "/",
+      sameSite: "lax",
+      secure: true,
+      value: normalizedProvider
+    });
+    const currentState = generateState();
+    state.set({
+      httpOnly: true,
+      maxAge: COOKIE_DURATION,
+      path: "/",
+      sameSite: "lax",
+      secure: true,
+      value: currentState
+    });
+    const codeVerifier = isPKCEProviderOption(provider) ? generateCodeVerifier() : undefined;
+    codeVerifier && code_verifier.set({
+      httpOnly: true,
+      maxAge: COOKIE_DURATION,
+      path: "/",
+      sameSite: "lax",
+      secure: true,
+      value: codeVerifier
+    });
+    const authorizationURL = await providerInstance.createAuthorizationUrl(codeVerifier ? { codeVerifier, scope, state: currentState } : { scope, state: currentState });
+    searchParams?.forEach(([key, value]) => authorizationURL.searchParams.set(key, value));
+    onAuthorize?.();
+    return redirect(authorizationURL.toString());
+  } catch (err) {
+    if (err instanceof Error) {
+      return error("Internal Server Error", `${err.message} - ${err.stack ?? ""}`);
+    }
+    return error("Internal Server Error", `Unknown error: ${err}`);
+  }
+});
+
+// src/callback.ts
+import { Elysia as Elysia3 } from "elysia";
+
+// src/sessionStore.ts
+import { Elysia as Elysia2 } from "elysia";
+var sessionStore = () => {
+  const initialSession = {};
+  return new Elysia2({ name: "sessionStore" }).state({
+    session: initialSession
+  });
+};
+
+// src/typeGuards.ts
+var isValidUser = (user) => true;
+var isNonEmptyString = (str) => str !== null && str !== undefined && str.trim() !== "";
+
+// src/callback.ts
+var callback = ({
+  clientProviders,
+  callbackRoute = "/oauth2/callback",
+  onCallback
+}) => new Elysia3().use(sessionStore()).get(callbackRoute, async ({
+  error,
+  redirect,
+  store: { session },
+  cookie: {
+    state: stored_state,
+    code_verifier,
+    redirect_url,
+    user_session_id,
+    auth_provider
+  },
+  query: { code, state: callback_state }
+}) => {
+  if (stored_state === undefined || code_verifier === undefined || auth_provider === undefined || user_session_id === undefined)
+    return error("Bad Request", "Cookies are missing");
+  if (!isNonEmptyString(code) || stored_state.value === undefined) {
+    return error("Bad Request", "Invalid callback request");
+  }
+  if (callback_state !== stored_state.value) {
+    return error("Bad Request", "Invalid state mismatch");
+  }
+  if (auth_provider.value === undefined) {
+    return error("Unauthorized", "No auth provider found");
+  }
+  if (!isValidProviderOption(auth_provider.value)) {
+    return error("Unauthorized", "Invalid provider");
+  }
+  const providerConfig = clientProviders[auth_provider.value];
+  if (!providerConfig) {
+    return error("Unauthorized", "Invalid provider");
+  }
+  const { providerInstance } = providerConfig;
+  try {
+    stored_state.remove();
+    const authProvider = auth_provider.value;
+    const requiresPKCE = isPKCEProviderOption(authProvider);
+    const verifier = requiresPKCE ? code_verifier.value : undefined;
+    if (requiresPKCE && verifier === undefined) {
+      return error("Bad Request", "Code verifier not found and is required");
+    }
+    const tokenResponse = await providerInstance.validateAuthorizationCode(requiresPKCE ? { code, codeVerifier: verifier } : { code });
+    const userProfile = tokenResponse.id_token ? decodeJWT(tokenResponse.id_token) : await providerInstance.fetchUserProfile(tokenResponse.access_token);
+    await onCallback?.({
+      authProvider,
+      session,
+      tokenResponse,
+      user_session_id,
+      userProfile
+    });
+    const redirectUrl = redirect_url?.value ?? "/";
+    return redirect(redirectUrl);
+  } catch (err) {
+    return err instanceof Error ? error("Internal Server Error", `${err.message} - ${err.stack ?? ""}`) : error("Internal Server Error", `Failed to validate authorization code: Unknown error: ${err}`);
+  }
+});
+
+// src/profile.ts
+import { Elysia as Elysia4 } from "elysia";
+var profile = ({
+  clientProviders,
+  profileRoute = "/oauth2/profile",
+  onProfile
+}) => new Elysia4().use(sessionStore()).get(profileRoute, async ({
+  error,
+  store: { session },
+  cookie: { user_session_id, auth_provider }
+}) => {
+  if (auth_provider === undefined || user_session_id === undefined)
+    return error("Bad Request", "Cookies are missing");
+  if (auth_provider.value === undefined) {
+    return error("Unauthorized", "No auth provider found");
+  }
+  if (!isValidProviderOption(auth_provider.value)) {
+    return error("Unauthorized", "Invalid provider");
+  }
+  if (user_session_id.value === undefined) {
+    return error("Unauthorized", "No user session found");
+  }
+  const providerConfig = clientProviders[auth_provider.value];
+  if (!providerConfig) {
+    return error("Unauthorized", "Invalid provider");
+  }
+  const { providerInstance } = providerConfig;
+  const userSession = session[user_session_id.value];
+  if (userSession === undefined) {
+    return error("Unauthorized", "No user session found");
+  }
+  const { accessToken } = userSession;
+  try {
+    const userProfile = await providerInstance.fetchUserProfile(accessToken);
+    await onProfile?.({
+      userProfile
+    });
+    return new Response(JSON.stringify(userProfile));
+  } catch (err) {
+    return err instanceof Error ? error("Internal Server Error", `${err.message} - ${err.stack ?? ""}`) : error("Internal Server Error", `Failed to validate authorization code: Unknown error: ${err}`);
+  }
+});
+
+// src/protectRoute.ts
+import { Elysia as Elysia5 } from "elysia";
+var protectRoute = () => new Elysia5().use(sessionStore()).derive(({ store: { session }, cookie: { user_session_id }, error }) => ({
+  protectRoute: async (handleAuth, handleAuthFail) => {
+    if (user_session_id === undefined)
+      return error("Bad Request", "Cookies are missing");
+    if (user_session_id.value === undefined) {
+      return handleAuthFail?.() ?? error("Unauthorized", "No session ID found");
+    }
+    const userSession = session[user_session_id.value];
+    if (userSession === undefined) {
+      return handleAuthFail?.() ?? error("Unauthorized", "No session found");
+    }
+    return handleAuth();
+  }
+})).as("plugin");
+
+// src/refresh.ts
+import { Elysia as Elysia6 } from "elysia";
+var refresh = ({
+  clientProviders,
+  refreshRoute = "/oauth2/tokens",
+  onRefresh
+}) => new Elysia6().use(sessionStore()).post(refreshRoute, async ({
+  error,
+  store: { session },
+  cookie: { user_session_id, auth_provider }
+}) => {
+  if (auth_provider === undefined || user_session_id === undefined)
+    return error("Bad Request", "Cookies are missing");
+  if (auth_provider.value === undefined) {
+    return error("Unauthorized", "No auth provider found");
+  }
+  if (!isValidProviderOption(auth_provider.value)) {
+    return error("Bad Request", "Invalid provider");
+  }
+  if (user_session_id.value === undefined) {
+    return error("Unauthorized", "No user session found");
+  }
+  const providerConfig = clientProviders[auth_provider.value];
+  if (!providerConfig) {
+    return error("Unauthorized", "Invalid provider");
+  }
+  const { providerInstance } = providerConfig;
+  const userSession = session[user_session_id.value];
+  if (userSession === undefined) {
+    return error("Unauthorized", "No user session found");
+  }
+  const { refreshToken } = userSession;
+  if (!isRefreshableOAuth2Client(auth_provider.value, providerInstance)) {
+    return error("Not Implemented", "Provider is not refreshable");
+  }
+  if (refreshToken === undefined) {
+    return error("Bad Request", "No refresh token found");
+  }
+  try {
+    const tokenResponse = await providerInstance.refreshAccessToken(refreshToken);
+    onRefresh?.({ tokenResponse });
+    return new Response("Token refreshed", {
+      status: 204
+    });
+  } catch (err) {
+    if (err instanceof Error) {
+      return error("Internal Server Error", `Failed to refresh token: ${err.message}`);
+    }
+    return error("Internal Server Error", `Failed to refresh token: Unknown error: ${err}`);
+  }
+});
+
+// src/revoke.ts
+import { Elysia as Elysia7 } from "elysia";
+var revoke = ({
+  clientProviders,
+  revokeRoute = "/oauth2/revocation",
+  onRevocation
+}) => new Elysia7().use(sessionStore()).post(revokeRoute, async ({
+  error,
+  store: { session },
+  cookie: { user_session_id, auth_provider }
+}) => {
+  if (auth_provider === undefined || user_session_id === undefined)
+    return error("Bad Request", "Cookies are missing");
+  if (auth_provider.value === undefined) {
+    return error("Unauthorized", "No auth provider found");
+  }
+  if (!isValidProviderOption(auth_provider.value)) {
+    return error("Bad Request", "Invalid provider");
+  }
+  if (user_session_id.value === undefined) {
+    return error("Unauthorized", "No user session found");
+  }
+  const providerConfig = clientProviders[auth_provider.value];
+  if (!providerConfig) {
+    return error("Unauthorized", "Invalid provider");
+  }
+  const { providerInstance } = providerConfig;
+  if (!isRevocableOAuth2Client(auth_provider.value, providerInstance)) {
+    return error("Not Implemented", "Provider does not support revocation");
+  }
+  const userSession = session[user_session_id.value];
+  if (userSession === undefined) {
+    return error("Unauthorized", "No user session found");
+  }
+  const { accessToken } = userSession;
+  try {
+    await providerInstance.revokeToken(accessToken);
+    onRevocation?.({ tokenToRevoke: accessToken });
+    return new Response("Token revoked", {
+      status: 204
+    });
+  } catch (err) {
+    if (err instanceof Error) {
+      return error("Internal Server Error", `Failed to revoke token: ${err.message}`);
+    }
+    return error("Internal Server Error", `Failed to revoke token: Unknown error: ${err}`);
+  }
+});
+
+// src/signout.ts
+import { Elysia as Elysia8 } from "elysia";
+var signout = ({
+  signoutRoute = "/oauth2/signout",
+  onSignOut
+}) => new Elysia8().post(signoutRoute, async ({ error, cookie: { user_session_id, auth_provider } }) => {
+  if (auth_provider === undefined || user_session_id === undefined)
+    return error("Bad Request", "Cookies are missing");
+  if (auth_provider.value === undefined) {
+    return error("Unauthorized", "No auth provider found");
+  }
+  try {
+    onSignOut?.();
+    user_session_id.remove();
+    auth_provider.remove();
+    return new Response("Succesfuly Logged Out", {
+      status: 204
+    });
+  } catch (err) {
+    if (err instanceof Error) {
+      return error("Internal Server Error", `Failed to signout: ${err.message}`);
+    }
+    return error("Internal Server Error", `Failed to signout: Unknown error: ${err}`);
+  }
+});
+
+// src/status.ts
+import { Elysia as Elysia9 } from "elysia";
+var status = ({
+  clientProviders,
+  statusRoute = "/oauth2/status",
+  onStatus
+}) => new Elysia9().use(sessionStore()).get(statusRoute, async ({
+  error,
+  cookie: { user_session_id, auth_provider },
+  store: { session }
+}) => {
+  if (auth_provider === undefined || user_session_id === undefined)
+    return error("Bad Request", "Cookies are missing");
+  try {
+    if (user_session_id.value === undefined) {
+      return new Response(JSON.stringify({ isLoggedIn: false, user: null }), {
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+    if (auth_provider.value === undefined) {
+      return new Response(JSON.stringify({ isLoggedIn: false, user: null }), {
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+    const providerConfig = clientProviders[auth_provider.value];
+    if (!providerConfig) {
+      return error("Unauthorized", "Invalid provider");
+    }
+    const { providerInstance } = providerConfig;
+    if (!isRefreshableOAuth2Client("Google", providerInstance)) {
+      return error("Not Implemented", "Provider is not refreshable");
+    }
+    const userSession = session[user_session_id.value];
+    if (userSession === undefined) {
+      return new Response(JSON.stringify({ isLoggedIn: false, user: null }), {
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+    const { user } = userSession;
+    onStatus?.();
+    return new Response(JSON.stringify({ isLoggedIn: true, user }), {
+      headers: { "Content-Type": "application/json" }
+    });
+  } catch (err) {
+    if (err instanceof Error) {
+      return error("Internal Server Error", `Error: ${err.message} - ${err.stack ?? ""}`);
+    }
+    return error("Internal Server Error", `Unknown Error: ${err}`);
+  }
+});
+
+// src/utils.ts
+var instantiateUserSession = async ({
+  user_session_id,
+  session,
+  tokenResponse,
+  getUser,
+  createUser
+}) => {
+  let user = await getUser();
+  user = user ?? await createUser();
+  if (!isValidUser(user))
+    throw new Error("Internal Server Error - Invalid user schema");
+  const sessionKey = crypto.randomUUID();
+  session[sessionKey] = {
+    accessToken: tokenResponse.access_token,
+    expiresAt: Date.now() + MILLISECONDS_IN_A_DAY,
+    refreshToken: tokenResponse.refresh_token,
+    user
+  };
+  user_session_id.set({
+    httpOnly: true,
+    sameSite: "lax",
+    secure: true,
+    value: sessionKey
+  });
+};
+var createAuthConfig = (props) => props;
+
+// src/index.ts
+var absoluteAuth = ({
+  config,
+  authorizeRoute,
+  callbackRoute,
+  profileRoute,
+  signoutRoute,
+  statusRoute,
+  refreshRoute,
+  revokeRoute,
+  onAuthorize,
+  onProfile,
+  onCallback,
+  onStatus,
+  onRefresh,
+  onSignOut,
+  onRevocation
+}) => {
+  const clientProviders = Object.entries(config).reduce((acc, [providerName, providerConfig]) => {
+    if (isValidProviderOption(providerName)) {
+      acc[providerName.toLocaleLowerCase()] = {
+        providerInstance: createOAuth2Client(providerName, providerConfig.credentials),
+        scope: providerConfig.scope,
+        searchParams: providerConfig.searchParams
+      };
+    }
+    return acc;
+  }, {});
+  return new Elysia10().use(signout({ onSignOut, signoutRoute })).use(revoke({ clientProviders, onRevocation, revokeRoute })).use(status({ clientProviders, onStatus, statusRoute })).use(refresh({ clientProviders, onRefresh, refreshRoute })).use(authorize({ authorizeRoute, clientProviders, onAuthorize })).use(callback({
+    callbackRoute,
+    clientProviders,
+    onCallback
+  })).use(profile({
+    clientProviders,
+    onProfile,
+    profileRoute
+  })).use(protectRoute()).as("plugin");
+};
+export {
+  instantiateUserSession,
+  createAuthConfig,
+  absoluteAuth
+};