@absolutejs/auth 0.43.0 → 0.44.1

package/dist/providers/index.js

@@ -0,0 +1,2558 @@
+// @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __require = import.meta.require;
+
+// node_modules/citra/dist/index.js
+var BASE64_BLOCK_SIZE = 4;
+var NUM_GENERATOR_BYTES = 32;
+var anilistProfileQuery = `query {
+  Viewer {
+    id
+    name
+    about
+    avatar {
+      large
+      medium
+    }
+    bannerImage
+    siteUrl
+    createdAt
+    updatedAt
+    donatorTier
+    donatorBadge
+    unreadNotificationCount
+    options {
+      titleLanguage
+      displayAdultContent
+      airingNotifications
+      profileColor
+      activityMergeTime
+      staffNameLanguage
+    }
+    mediaListOptions {
+      scoreFormat
+      rowOrder
+      animeList {
+        sectionOrder
+        customLists
+        advancedScoringEnabled
+      }
+      mangaList {
+        sectionOrder
+        customLists
+        advancedScoringEnabled
+      }
+    }
+    statistics {
+      anime {
+        count
+        meanScore
+        minutesWatched
+        episodesWatched
+      }
+      manga {
+        count
+        meanScore
+        chaptersRead
+        volumesRead
+      }
+    }
+    favourites {
+      anime {
+        nodes {
+          id
+          title {
+            romaji
+            english
+          }
+          siteUrl
+        }
+      }
+      manga {
+        nodes {
+          id
+          title {
+            romaji
+            english
+          }
+          siteUrl
+        }
+      }
+      characters {
+        nodes {
+          id
+          name {
+            full
+          }
+          image {
+            large
+          }
+        }
+      }
+      staff {
+        nodes {
+          id
+          name {
+            full
+          }
+          image {
+            large
+          }
+        }
+      }
+      studios {
+        nodes {
+          id
+          name
+          siteUrl
+        }
+      }
+    }
+    isFollower
+    isFollowing
+  }
+}`;
+var defineProviders = (providers) => providers;
+var providers = defineProviders({
+  "42": {
+    authorizationUrl: "https://api.intra.42.fr/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.intra.42.fr/v2/me"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.intra.42.fr/oauth/token"
+    }
+  },
+  amazoncognito: {
+    authorizationUrl: "https://${domain}/oauth2/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => `https://${config.domain}/oauth2/userInfo`
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: (config) => `https://${config.domain}/oauth2/revoke`
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `https://${config.domain}/oauth2/token`
+    }
+  },
+  anilist: {
+    authorizationUrl: "https://anilist.co/api/v2/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      body: {
+        query: anilistProfileQuery
+      },
+      encoding: "application/json",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json"
+      },
+      method: "POST",
+      url: "https://graphql.anilist.co"
+    },
+    scopeRequired: false,
+    subject: ["data", "Viewer", "id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://anilist.co/api/v2/oauth/token"
+    }
+  },
+  apple: {
+    authorizationUrl: "https://appleid.apple.com/auth/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://appleid.apple.com/auth/userinfo"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://appleid.apple.com/auth/token"
+    }
+  },
+  atlassian: {
+    authorizationUrl: "https://auth.atlassian.com/authorize",
+    createAuthorizationURLSearchParams: {
+      audience: "api.atlassian.com"
+    },
+    email: ["email"],
+    fullName: ["name"],
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["picture"],
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.atlassian.com/me"
+    },
+    scopeRequired: true,
+    subject: ["account_id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://auth.atlassian.com/oauth/token"
+    }
+  },
+  attio: {
+    authorizationUrl: "https://app.attio.com/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.attio.com/v2/self"
+    },
+    scopeRequired: true,
+    subject: ["workspace_id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://app.attio.com/oauth/token"
+    }
+  },
+  auth0: {
+    authorizationUrl: (config) => `https://${config.domain}/authorize`,
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => `https://${config.domain}/userinfo`
+    },
+    revocationRequest: {
+      authIn: "body",
+      body: new URLSearchParams({
+        token_type_hint: "refresh_token"
+      }),
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: (config) => `https://${config.domain}/oauth/revoke`
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `https://${config.domain}/oauth/token`
+    }
+  },
+  authentik: {
+    authorizationUrl: (config) => `https://${config.baseURL}/oauth/authorize`,
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => `https://${config.baseURL}/api/v3/user/`
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `https://${config.baseURL}/oauth/token`
+    }
+  },
+  autodesk: {
+    authorizationUrl: "https://developer.api.autodesk.com/authentication/v2/authorize",
+    email: ["email"],
+    familyName: ["family_name"],
+    fullName: ["name"],
+    givenName: ["given_name"],
+    isOIDC: true,
+    isRefreshable: true,
+    picture: ["picture"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.userprofile.autodesk.com/userinfo"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://developer.api.autodesk.com/authentication/v2/token"
+    }
+  },
+  battlenet: {
+    authorizationUrl: "https://oauth.battle.net/authorize",
+    isOIDC: true,
+    isRefreshable: false,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://oauth.battle.net/userinfo"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://oauth.battle.net/token"
+    }
+  },
+  bitbucket: {
+    authorizationUrl: "https://bitbucket.org/site/oauth2/authorize",
+    fullName: ["display_name"],
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["links", "avatar", "href"],
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.bitbucket.org/2.0/user"
+    },
+    scopeRequired: false,
+    subject: ["uuid"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://bitbucket.org/site/oauth2/access_token"
+    }
+  },
+  box: {
+    authorizationUrl: "https://account.box.com/api/oauth2/authorize",
+    email: ["login"],
+    fullName: ["name"],
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["avatar_url"],
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.box.com/2.0/users/me"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: "https://api.box.com/oauth2/revoke"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.box.com/oauth2/token"
+    }
+  },
+  bungie: {
+    authorizationUrl: "https://www.bungie.net/en/OAuth/Authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      headers: {
+        "X-API-Key": "<YOUR_API_KEY>"
+      },
+      method: "GET",
+      url: "https://www.bungie.net/Platform/User/GetCurrentBungieNetUser"
+    },
+    scopeRequired: false,
+    subject: ["Response", "membershipId"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://www.bungie.net/Platform/App/OAuth/token"
+    }
+  },
+  close: {
+    authorizationUrl: "https://app.close.com/oauth2/authorize/",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.close.com/api/v1/me/"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.close.com/oauth2/token/"
+    }
+  },
+  coinbase: {
+    authorizationUrl: "https://www.coinbase.com/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.coinbase.com/v2/user"
+    },
+    scopeRequired: false,
+    subject: ["data", "id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.coinbase.com/oauth/token"
+    }
+  },
+  discord: {
+    authorizationUrl: "https://discord.com/api/oauth2/authorize",
+    email: ["email"],
+    isOIDC: true,
+    isRefreshable: true,
+    picture: ["avatar"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://discord.com/api/users/@me"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://discord.com/api/oauth2/token"
+    }
+  },
+  donationalerts: {
+    authorizationUrl: "https://www.donationalerts.com/oauth/authorize",
+    email: ["data", "email"],
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["data", "avatar"],
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://www.donationalerts.com/api/v1/user/oauth"
+    },
+    scopeRequired: false,
+    subject: ["data", "id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://www.donationalerts.com/oauth/token"
+    }
+  },
+  dribbble: {
+    authorizationUrl: "https://dribbble.com/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: false,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.dribbble.com/v2/user"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://dribbble.com/oauth/token"
+    }
+  },
+  dropbox: {
+    authorizationUrl: "https://www.dropbox.com/oauth2/authorize",
+    email: ["email"],
+    familyName: ["name", "surname"],
+    fullName: ["name", "display_name"],
+    givenName: ["name", "given_name"],
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "POST",
+      url: "https://api.dropboxapi.com/2/users/get_current_account"
+    },
+    revocationRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      url: "https://api.dropboxapi.com/2/auth/token/revoke"
+    },
+    scopeRequired: false,
+    subject: ["account_id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.dropboxapi.com/oauth2/token"
+    }
+  },
+  epicgames: {
+    authorizationUrl: "https://www.epicgames.com/id/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.epicgames.dev/epic/oauth/v2/userInfo"
+    },
+    scopeRequired: false,
+    subject: ["account_id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.epicgames.dev/epic/oauth/v1/token"
+    }
+  },
+  etsy: {
+    authorizationUrl: "https://www.etsy.com/oauth/connect",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://openapi.etsy.com/v3/application/users/me"
+    },
+    scopeRequired: false,
+    subject: ["results", "0", "user_id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.etsy.com/v3/public/oauth/token"
+    }
+  },
+  facebook: {
+    authorizationUrl: "https://www.facebook.com/v16.0/dialog/oauth",
+    email: ["email"],
+    familyName: ["family_name"],
+    fullName: ["name"],
+    givenName: ["given_name"],
+    isOIDC: true,
+    isRefreshable: false,
+    picture: ["picture"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "query",
+      encoding: "application/json",
+      method: "GET",
+      searchParams: [["fields", "id,name,email,picture"]],
+      url: "https://graph.facebook.com/me"
+    },
+    scopeRequired: false,
+    subject: ["sub"],
+    subjectBySource: {
+      idToken: ["sub"],
+      profile: ["id"]
+    },
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://graph.facebook.com/v16.0/oauth/access_token"
+    }
+  },
+  figma: {
+    authorizationUrl: "https://www.figma.com/oauth",
+    email: ["email"],
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["img_url"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.figma.com/v1/me"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.figma.com/v1/oauth/token"
+    }
+  },
+  gitea: {
+    authorizationUrl: (config) => `${config.baseURL}/login/oauth/authorize`,
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => `${config.baseURL}/api/v1/user`
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `${config.baseURL}/login/oauth/access_token`
+    }
+  },
+  github: {
+    authorizationUrl: "https://github.com/login/oauth/authorize",
+    email: ["email"],
+    isOIDC: false,
+    isRefreshable: false,
+    picture: ["avatar_url"],
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.github.com/user"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://github.com/login/oauth/access_token"
+    }
+  },
+  gitlab: {
+    authorizationUrl: (config) => `${config.baseURL}/oauth/authorize`,
+    email: ["email"],
+    fullName: ["name"],
+    isOIDC: true,
+    isRefreshable: true,
+    picture: ["picture"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://gitlab.com/api/v4/user"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: (config) => `${config.baseURL}/oauth/revoke`
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `${config.baseURL}/oauth/token`
+    }
+  },
+  gohighlevel: {
+    authorizationUrl: "https://marketplace.gohighlevel.com/oauth/chooselocation",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://services.leadconnectorhq.com/users/me"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://services.leadconnectorhq.com/oauth/token"
+    }
+  },
+  google: {
+    authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+    email: ["email"],
+    familyName: ["family_name"],
+    fullName: ["name"],
+    givenName: ["given_name"],
+    isOIDC: true,
+    isRefreshable: true,
+    picture: ["picture"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://openidconnect.googleapis.com/v1/userinfo"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: "https://oauth2.googleapis.com/revoke"
+    },
+    scopeRequired: true,
+    subject: ["sub"],
+    subjectBySource: {
+      idToken: ["sub"],
+      profile: ["sub"]
+    },
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://oauth2.googleapis.com/token"
+    }
+  },
+  hubspot: {
+    authorizationUrl: "https://app.hubspot.com/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.hubapi.com/oauth/v1/access-tokens/me"
+    },
+    scopeRequired: true,
+    subject: ["hub_id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.hubapi.com/oauth/v1/token"
+    }
+  },
+  intuit: {
+    authorizationUrl: "https://appcenter.intuit.com/connect/oauth2",
+    isOIDC: true,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => config.environment === "production" ? "https://accounts.platform.intuit.com/v1/openid_connect/userinfo" : "https://sandbox-accounts.platform.intuit.com/v1/openid_connect/userinfo"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      headers: (config) => ({
+        Authorization: `Basic ${encodeBase64(`${config.clientId}:${config.clientSecret}`)}`
+      }),
+      tokenParamName: "token",
+      url: "https://developer.api.intuit.com/v2/oauth2/tokens/revoke"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer"
+    }
+  },
+  kakao: {
+    authorizationUrl: "https://kauth.kakao.com/oauth/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    picture: ["picture"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://kapi.kakao.com/v2/user/me"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://kauth.kakao.com/oauth/token"
+    }
+  },
+  keycloak: {
+    authorizationUrl: (config) => `${config.realmURL}/protocol/openid-connect/auth`,
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.kick.com/v1/user"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: (config) => `${config.realmURL}/protocol/openid-connect/revoke`
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `${config.realmURL}/protocol/openid-connect/token`
+    }
+  },
+  kick: {
+    authorizationUrl: "https://id.kick.com/oauth/authorize",
+    email: ["data", "email"],
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["data", "profile_picture"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.kick.com/public/v1/users"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: "https://id.kick.com/oauth/revoke"
+    },
+    scopeRequired: true,
+    subject: ["data", "user_id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://id.kick.com/oauth/token"
+    }
+  },
+  lichess: {
+    authorizationUrl: "https://lichess.org/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: false,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://lichess.org/api/account"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://lichess.org/api/token"
+    }
+  },
+  line: {
+    authorizationUrl: "https://access.line.me/oauth2/v2.1/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.line.me/v2/profile"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.line.me/oauth2/v2.1/token"
+    }
+  },
+  linear: {
+    authorizationUrl: "https://linear.app/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: false,
+    profileRequest: {
+      authIn: "header",
+      body: {
+        query: `query { viewer { id name } }`
+      },
+      encoding: "application/json",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json"
+      },
+      method: "POST",
+      url: "https://api.linear.app/graphql"
+    },
+    revocationRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      url: "https://api.linear.app/oauth/revoke"
+    },
+    scopeRequired: false,
+    subject: ["data", "viewer", "id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.linear.app/oauth/token"
+    }
+  },
+  linkedin: {
+    authorizationUrl: "https://www.linkedin.com/oauth/v2/authorization",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.linkedin.com/v2/me"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://www.linkedin.com/oauth/v2/accessToken"
+    }
+  },
+  mastodon: {
+    authorizationUrl: (config) => `${config.baseURL}/oauth/authorize`,
+    isOIDC: false,
+    isRefreshable: false,
+    picture: ["avatar"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => `${config.baseURL}/api/v1/accounts/verify_credentials`
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: (config) => `${config.baseURL}/oauth/revoke`
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `${config.baseURL}/oauth/token`
+    }
+  },
+  mercadolibre: {
+    authorizationUrl: "https://auth.mercadolibre.com/authorization",
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.mercadolibre.com/users/me"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.mercadolibre.com/oauth/token"
+    }
+  },
+  mercadopago: {
+    authorizationUrl: "https://auth.mercadopago.com/authorization",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.mercadopago.com/v1/users/me"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.mercadopago.com/oauth/token"
+    }
+  },
+  microsoftentraid: {
+    authorizationUrl: (config) => `https://${config.tenantId}.b2clogin.com/${config.tenantId}/oauth2/v2.0/authorize`,
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => `https://${config.tenantId}.b2clogin.com/${config.tenantId}/openid/userinfo`
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `https://${config.tenantId}.b2clogin.com/${config.tenantId}/oauth2/v2.0/token`
+    }
+  },
+  monday: {
+    authorizationUrl: "https://auth.monday.com/oauth2/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      body: {
+        query: "query { me { id name email } }"
+      },
+      encoding: "application/json",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      method: "POST",
+      url: "https://api.monday.com/v2"
+    },
+    scopeRequired: true,
+    subject: ["data", "me", "id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://auth.monday.com/oauth2/token"
+    }
+  },
+  myanimelist: {
+    authorizationUrl: "https://myanimelist.net/v1/oauth2/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "plain",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.myanimelist.net/v2/users/@me"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://myanimelist.net/v1/oauth2/token"
+    }
+  },
+  naver: {
+    authorizationUrl: "https://nid.naver.com/oauth2.0/authorize",
+    email: ["response", "email"],
+    fullName: ["response", "name"],
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["response", "profile_image"],
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://openapi.naver.com/v1/nid/me"
+    },
+    scopeRequired: false,
+    subject: ["response", "id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://nid.naver.com/oauth2.0/token"
+    }
+  },
+  notion: {
+    authorizationUrl: "https://api.notion.com/v1/oauth/authorize",
+    email: ["bot", "owner", "user", "person", "email"],
+    isOIDC: false,
+    isRefreshable: false,
+    picture: ["bot", "owner", "user", "avatar_url"],
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      headers: {
+        "Notion-Version": "2022-06-28"
+      },
+      method: "GET",
+      url: "https://api.notion.com/v1/users/me"
+    },
+    scopeRequired: false,
+    subject: ["bot", "owner", "user", "id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      url: "https://api.notion.com/v1/oauth/token"
+    }
+  },
+  okta: {
+    authorizationUrl: (config) => `https://${config.domain}/oauth2/default/v1/authorize`,
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => `https://${config.domain}/oauth2/default/v1/userinfo`
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: (config) => `https://${config.domain}/oauth2/default/v1/revoke`
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `https://${config.domain}/oauth2/default/v1/token`
+    }
+  },
+  osu: {
+    authorizationUrl: "https://osu.ppy.sh/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["avatar_url"],
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://osu.ppy.sh/api/v2/me"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://osu.ppy.sh/oauth/token"
+    }
+  },
+  patreon: {
+    authorizationUrl: "https://www.patreon.com/oauth2/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://www.patreon.com/api/oauth2/v2/identity"
+    },
+    scopeRequired: false,
+    subject: ["data", "id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://www.patreon.com/api/oauth2/token"
+    }
+  },
+  pipedrive: {
+    authorizationUrl: "https://oauth.pipedrive.com/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.pipedrive.com/v1/users/me"
+    },
+    scopeRequired: true,
+    subject: ["data", "id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://oauth.pipedrive.com/oauth/token"
+    }
+  },
+  polar: {
+    authorizationUrl: "https://polar.sh/oauth2/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.polar.sh/v1/oauth2/userinfo"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: "https://api.polar.sh/v1/oauth2/revoke"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.polar.sh/v1/oauth2/token"
+    }
+  },
+  polaraccesslink: {
+    authorizationUrl: "https://flow.polar.com/oauth2/authorization",
+    isOIDC: false,
+    isRefreshable: false,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://www.polaraccesslink.com/v3/users/me"
+    },
+    scopeRequired: false,
+    subject: ["x_user_id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "header",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://polarremote.com/v2/oauth2/token"
+    }
+  },
+  polarteampro: {
+    authorizationUrl: "https://auth.polar.com/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://www.polaraccesslink.com/v3/users/<USER_ID>"
+    },
+    scopeRequired: false,
+    subject: ["x_user_id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "header",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://auth.polar.com/oauth/token"
+    }
+  },
+  reddit: {
+    authorizationUrl: "https://www.reddit.com/api/v1/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://oauth.reddit.com/api/v1/me"
+    },
+    revocationRequest: {
+      authIn: "header",
+      body: new URLSearchParams({
+        token_type_hint: "refresh_token"
+      }),
+      encoding: "application/json",
+      url: "https://www.reddit.com/api/v1/revoke_token"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "header",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://www.reddit.com/api/v1/access_token"
+    }
+  },
+  roblox: {
+    authorizationUrl: "https://apis.roblox.com/oauth/v1/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    picture: ["picture"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://apis.roblox.com/oauth/v1/userinfo"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://apis.roblox.com/oauth/v1/token"
+    }
+  },
+  salesforce: {
+    authorizationUrl: "https://login.salesforce.com/services/oauth2/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://login.salesforce.com/services/oauth2/userinfo"
+    },
+    revocationRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      url: "https://login.salesforce.com/services/oauth2/revoke"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://login.salesforce.com/services/oauth2/token"
+    }
+  },
+  shikimori: {
+    authorizationUrl: "https://shikimori.org/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://shikimori.one/api/users/whoami"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://shikimori.org/oauth/token"
+    }
+  },
+  slack: {
+    authorizationUrl: "https://slack.com/openid/connect/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "query",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://slack.com/api/users.identity"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: "https://slack.com/api/auth.revoke"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://slack.com/api/openid.connect.token"
+    }
+  },
+  spotify: {
+    authorizationUrl: "https://accounts.spotify.com/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.spotify.com/v1/me"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://accounts.spotify.com/api/token"
+    }
+  },
+  startgg: {
+    authorizationUrl: "https://start.gg/oauth/authorize",
+    email: ["data", "currentUser", "email"],
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      body: {
+        query: `query { currentUser { id slug email player { gamerTag } } }`
+      },
+      encoding: "application/json",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json"
+      },
+      method: "POST",
+      url: "https://api.start.gg/gql/alpha"
+    },
+    scopeRequired: false,
+    subject: ["data", "currentUser", "id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.start.gg/oauth/access_token"
+    }
+  },
+  strava: {
+    authorizationUrl: "https://www.strava.com/oauth/authorize",
+    familyName: ["lastname"],
+    givenName: ["firstname"],
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["profile"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://www.strava.com/api/v3/athlete"
+    },
+    revocationRequest: {
+      authIn: "query",
+      body: new URLSearchParams({
+        token_type_hint: "access_token"
+      }),
+      encoding: "application/json",
+      tokenParamName: "access_token",
+      url: "https://www.strava.com/oauth/deauthorize"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://www.strava.com/oauth/token"
+    }
+  },
+  synology: {
+    authorizationUrl: (config) => `${config.baseURL}/webman/sso/SSOOauth.cgi?client_id=${config.clientId}&response_type=code&redirect_uri=${config.redirectUri}`,
+    isOIDC: false,
+    isRefreshable: false,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => `${config.baseURL}/webman/sso/SSOUserInfo.cgi?client_id=${config.clientId}&access_token=${config.accessToken}`
+    },
+    scopeRequired: false,
+    subject: ["data", "id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `${config.baseURL}/webman/sso/SSOAccessToken.cgi?client_id=${config.clientId}&client_secret=${config.clientSecret}`
+    }
+  },
+  tiktok: {
+    authorizationUrl: "https://www.tiktok.com/v2/auth/authorize",
+    createAuthorizationURLSearchParams: (config) => ({
+      client_key: config.clientId
+    }),
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "query",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://open.douyin.com/oauth/userinfo"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: "https://open.tiktokapis.com/v2/oauth/revoke/"
+    },
+    scopeRequired: false,
+    subject: ["data", "open_id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://open.tiktokapis.com/v2/oauth/token/"
+    }
+  },
+  tiltify: {
+    authorizationUrl: "https://v5api.tiltify.com/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://v5api.tiltify.com/api/public/current-user"
+    },
+    scopeRequired: false,
+    subject: ["data", "id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://v5api.tiltify.com/oauth/token"
+    }
+  },
+  tumblr: {
+    authorizationUrl: "https://www.tumblr.com/oauth2/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.tumblr.com/v2/user/info"
+    },
+    scopeRequired: false,
+    subject: ["response", "user", "name"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.tumblr.com/v2/oauth2/token"
+    }
+  },
+  twitch: {
+    authorizationUrl: "https://id.twitch.tv/oauth2/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      headers: (config) => ({
+        "Client-Id": config.clientId
+      }),
+      method: "GET",
+      url: "https://api.twitch.tv/helix/users"
+    },
+    revocationRequest: {
+      authIn: "query",
+      encoding: "application/json",
+      headers: (config) => ({
+        "Client-Id": config.clientId
+      }),
+      tokenParamName: "token",
+      url: "https://id.twitch.tv/oauth2/revoke"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://id.twitch.tv/oauth2/token"
+    }
+  },
+  twitter: {
+    authorizationUrl: "https://twitter.com/i/oauth2/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.twitter.com/2/users/me"
+    },
+    revocationRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      url: "https://api.twitter.com/2/oauth2/revoke"
+    },
+    scopeRequired: false,
+    subject: ["data", "id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.twitter.com/2/oauth2/token"
+    }
+  },
+  vk: {
+    authorizationUrl: "https://oauth.vk.com/authorize",
+    isOIDC: false,
+    isRefreshable: false,
+    profileRequest: {
+      authIn: "query",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.vk.com/method/users.get"
+    },
+    scopeRequired: false,
+    subject: ["response", "0", "id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://oauth.vk.com/access_token"
+    }
+  },
+  withings: {
+    authorizationUrl: "https://account.withings.com/oauth2_user/authorize2",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      body: async (config) => {
+        const props = await getWithingsProps(config);
+        if (props === undefined)
+          throw new Error("Failed to get Withings search properties");
+        const { nonce, hashedSignature } = props;
+        return [
+          ["action", "getuser"],
+          ["nonce", nonce],
+          ["client_id", config.clientId],
+          ["signature", hashedSignature]
+        ];
+      },
+      encoding: "application/x-www-form-urlencoded",
+      method: "POST",
+      url: "https://wbsapi.withings.net/v2/oauth2"
+    },
+    refreshAccessTokenBody: {
+      action: "requesttoken"
+    },
+    revocationRequest: {
+      authIn: "header",
+      body: async (config) => {
+        const props = await getWithingsProps(config);
+        if (!props)
+          throw new Error("Failed to get Withings props");
+        const { nonce, hashedSignature } = props;
+        return [
+          ["action", "revoke"],
+          ["client_id", config.clientId],
+          ["nonce", nonce],
+          ["signature", hashedSignature]
+        ];
+      },
+      encoding: "application/x-www-form-urlencoded",
+      method: "POST",
+      url: "https://wbsapi.withings.net/v2/oauth2"
+    },
+    scopeRequired: true,
+    subject: ["userid"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://wbsapi.withings.net/v2/oauth2"
+    },
+    validateAuthorizationCodeBody: {
+      action: "requesttoken"
+    }
+  },
+  workos: {
+    authorizationUrl: (config) => `https://${config.domain}/oauth2/authorize`,
+    createAuthorizationURLSearchParams: () => {
+      const nonce = crypto.randomUUID();
+      return {
+        nonce
+      };
+    },
+    email: ["email"],
+    familyName: ["family_name"],
+    fullName: ["name"],
+    givenName: ["given_name"],
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "POST",
+      url: (config) => `https://${config.domain}/oauth2/userinfo`
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `https://${config.domain}/oauth2/token`
+    }
+  },
+  yahoo: {
+    authorizationUrl: "https://api.login.yahoo.com/oauth2/request_auth",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.login.yahoo.com/openid/v1/userinfo"
+    },
+    revocationRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      url: "https://api.login.yahoo.com/oauth2/revoke"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.login.yahoo.com/oauth2/get_token"
+    }
+  },
+  yandex: {
+    authorizationUrl: "https://oauth.yandex.com/authorize",
+    createAuthorizationURLSearchParams: {
+      device_id: crypto.randomUUID(),
+      device_name: `${navigator.platform ?? "Unknown"} \u2014 ${(navigator.userAgent.split(")")[0] || "").split("(").pop() || "Unknown"}`
+    },
+    email: ["default_email"],
+    familyName: ["last_name"],
+    fullName: ["real_name"],
+    givenName: ["first_name"],
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://login.yandex.ru/info"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "access_token",
+      url: "https://oauth.yandex.com/revoke_token"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://oauth.yandex.com/token"
+    }
+  },
+  zoho: {
+    authorizationUrl: (config) => `https://accounts.zoho.${config.region ?? "com"}/oauth/v2/auth`,
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => `https://accounts.zoho.${config.region ?? "com"}/oauth/user/info`
+    },
+    revocationRequest: {
+      authIn: "query",
+      encoding: "application/x-www-form-urlencoded",
+      tokenParamName: "token",
+      url: (config) => `https://accounts.zoho.${config.region ?? "com"}/oauth/v2/token/revoke`
+    },
+    scopeRequired: true,
+    subject: ["ZUID"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `https://accounts.zoho.${config.region ?? "com"}/oauth/v2/token`
+    }
+  },
+  zoom: {
+    authorizationUrl: "https://zoom.us/oauth/authorize",
+    email: ["email"],
+    familyName: ["last_name"],
+    givenName: ["first_name"],
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["pic_url"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.zoom.us/v2/users/me"
+    },
+    revocationRequest: {
+      authIn: "query",
+      encoding: "application/json",
+      headers: (config) => ({
+        Authorization: `Basic ${btoa(`${config.clientId}:${config.clientSecret}`)}`
+      }),
+      tokenParamName: "token",
+      url: "https://zoom.us/oauth/revoke"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://zoom.us/oauth/token"
+    }
+  }
+});
+var hasClientSecret = (credentials) => {
+  if (typeof credentials !== "object" || credentials === null)
+    return false;
+  const secret = Reflect.get(credentials, "clientSecret");
+  return typeof secret === "string";
+};
+var isExpectedType = (value, kind) => {
+  switch (kind) {
+    case "string":
+      return typeof value === "string";
+    case "number":
+      return typeof value === "number";
+    case "boolean":
+      return typeof value === "boolean";
+    case "object":
+      return typeof value === "object" && value !== null;
+    default:
+      return false;
+  }
+};
+var isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value) && Object.prototype.toString.call(value) === "[object Object]";
+var isOIDCProviderOption = (option) => {
+  if (!isValidProviderOption(option))
+    return false;
+  const provider = providers[option];
+  return provider.isOIDC;
+};
+var isPKCEProviderOption = (option) => {
+  if (!isValidProviderOption(option))
+    return false;
+  const provider = providers[option];
+  return provider.PKCEMethod !== undefined;
+};
+var isRefreshableOAuth2Client = (providerName, _client) => isRefreshableProviderOption(providerName);
+var isRefreshableProviderOption = (option) => {
+  if (!isValidProviderOption(option))
+    return false;
+  const provider = providers[option];
+  return provider.isRefreshable;
+};
+var isRevocableOAuth2Client = (providerName, _client) => isRevocableProviderOption(providerName);
+var isRevocableProviderOption = (option) => {
+  if (!isValidProviderOption(option))
+    return false;
+  const provider = providers[option];
+  return provider.revocationRequest !== undefined;
+};
+var isScopeRequiredProviderOption = (option) => {
+  if (!isValidProviderOption(option))
+    return false;
+  const provider = providers[option];
+  return provider.scopeRequired;
+};
+var isValidProviderOption = (option) => Object.hasOwn(providers, option);
+var createOAuth2FetchError = async (response) => {
+  const clone = response.clone();
+  const prefix = `HTTP ${response.status} ${response.statusText} for ${response.url}`;
+  const payload = await response.json().catch(() => null);
+  if (payload && typeof payload === "object" && Object.keys(payload).length) {
+    return new Error(`${prefix}
+${JSON.stringify(payload)}`);
+  }
+  const text = await clone.text().catch(() => "");
+  if (text) {
+    return new Error(`${prefix}
+${text}`);
+  }
+  return new Error(prefix);
+};
+var createOAuth2Request = ({
+  url,
+  body,
+  authIn,
+  headers,
+  encoding,
+  clientId,
+  clientSecret
+}) => {
+  const oauthHeaders = new Headers(headers);
+  oauthHeaders.set("Accept", "application/json");
+  oauthHeaders.set("User-Agent", "citra");
+  if (authIn === "header") {
+    if (!clientSecret) {
+      throw new Error("clientSecret required for header auth");
+    }
+    oauthHeaders.set("Authorization", `Basic ${encodeBase64(`${clientId}:${clientSecret}`)}`);
+  }
+  if (encoding === "application/json") {
+    oauthHeaders.set("Content-Type", "application/json");
+    return new Request(url, {
+      body: JSON.stringify(body),
+      headers: oauthHeaders,
+      method: "POST"
+    });
+  }
+  oauthHeaders.set("Content-Type", "application/x-www-form-urlencoded");
+  const entries = body instanceof URLSearchParams ? Array.from(body.entries()) : Object.entries(body).filter((entry) => typeof entry[1] === "string");
+  const params = new URLSearchParams(entries);
+  if (authIn === "body") {
+    params.set("client_id", clientId);
+    clientSecret && params.set("client_secret", clientSecret);
+  }
+  return new Request(url, {
+    body: params.toString(),
+    headers: oauthHeaders,
+    method: "POST"
+  });
+};
+var decodeBase64 = (input, toUint8Array = false) => {
+  const b64 = input.replace(/-/g, "+").replace(/_/g, "/") + "==".slice(0, (BASE64_BLOCK_SIZE - input.length % BASE64_BLOCK_SIZE) % BASE64_BLOCK_SIZE);
+  const raw = atob(b64);
+  if (!toUint8Array) {
+    return raw;
+  }
+  const bytes = new Uint8Array(raw.length);
+  for (let i = 0;i < raw.length; i++) {
+    bytes[i] = raw.charCodeAt(i);
+  }
+  return bytes;
+};
+var decodeJWT = (tokenString) => {
+  const [headerSegment, payloadSegment, signatureSegment] = tokenString.split(".");
+  if (!headerSegment || !payloadSegment || !signatureSegment) {
+    throw new Error("Invalid JWT format");
+  }
+  const decodedPayload = decodeBase64(payloadSegment);
+  if (typeof decodedPayload !== "string") {
+    throw new Error("Expected JWT payload to be a UTF-8 string");
+  }
+  const claims = JSON.parse(decodedPayload);
+  return claims;
+};
+var encodeBase64 = (input) => {
+  let raw;
+  if (typeof input === "string") {
+    raw = input;
+  } else {
+    const bytes = input instanceof Uint8Array ? input : new Uint8Array(input);
+    raw = bytes.reduce((acc, byte) => acc + String.fromCharCode(byte), "");
+  }
+  return btoa(raw);
+};
+var getWithingsProps = async (config) => {
+  const timestamp = Math.floor(Date.now() / 1000);
+  const signature = `getnonce,${config.clientId},${timestamp}`;
+  const hashedSignature = await hmacSha256(signature, config.clientSecret);
+  const nonceUrl = new URL("https://wbsapi.withings.net/v2/signature");
+  nonceUrl.searchParams.set("action", "getnonce");
+  nonceUrl.searchParams.set("client_id", config.clientId);
+  nonceUrl.searchParams.set("timestamp", timestamp.toString());
+  nonceUrl.searchParams.set("signature", hashedSignature);
+  const nonceTarget = nonceUrl.toString();
+  const nonceResponse = await fetch(nonceTarget, {
+    ...h2IfHttps(nonceTarget),
+    method: "POST"
+  });
+  const nonceData = await nonceResponse.json();
+  if (nonceData.status === 0) {
+    return {
+      hashedSignature,
+      nonce: nonceData.body.nonce
+    };
+  }
+  return;
+};
+var h2IfHttps = (url) => {
+  const init = url.startsWith("https://") ? { protocol: "http2" } : {};
+  return init;
+};
+var hmacSha256 = async (message, secret) => {
+  const encoder = new TextEncoder;
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { hash: "SHA-256", name: "HMAC" }, false, ["sign"]);
+  const sigBuffer = await crypto.subtle.sign("HMAC", key, encoder.encode(message));
+  return Array.from(new Uint8Array(sigBuffer)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
+};
+var extractPropFromIdentity = (identity, keys, propType) => {
+  let value = identity;
+  for (const key of keys) {
+    if (Array.isArray(value))
+      value = value[Number(key)];
+    if (!isObject(value)) {
+      throw new Error(`Invalid identity data shape: expected object, got ${typeof value}`);
+    }
+    value = value[key];
+  }
+  if (propType !== undefined && !isExpectedType(value, propType)) {
+    throw new Error(`Invalid identity data shape: expected ${propType}, got ${typeof value}`);
+  }
+  return value;
+};
+var getProviderSubjectKeys = (providerConfiguration, source) => providerConfiguration.subjectBySource?.[source] ?? providerConfiguration.subject;
+var setPropInIdentity = (identity, keys, value) => {
+  if (keys.length === 0) {
+    return identity;
+  }
+  let cursor = identity;
+  for (const key of keys.slice(0, -1)) {
+    const next = cursor[key];
+    cursor[key] = isObject(next) ? next : {};
+    cursor = cursor[key];
+  }
+  cursor[keys[keys.length - 1]] = value;
+  return identity;
+};
+var normalizeProviderIdentity = ({
+  identity,
+  providerConfiguration,
+  source
+}) => {
+  const sourceKeys = getProviderSubjectKeys(providerConfiguration, source);
+  const canonicalKeys = providerConfiguration.subject;
+  if (sourceKeys.join(".") === canonicalKeys.join(".")) {
+    return identity;
+  }
+  const subject = extractPropFromIdentity(identity, sourceKeys, providerConfiguration.subjectType);
+  const normalizedIdentity = structuredClone(identity);
+  return setPropInIdentity(normalizedIdentity, canonicalKeys, subject);
+};
+var createS256CodeChallenge = async (codeVerifier) => {
+  const data = new TextEncoder().encode(codeVerifier);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+  return base64Url(hashBuffer);
+};
+var createRandomBase64UrlGenerator = (length) => () => {
+  const buffer = crypto.getRandomValues(new Uint8Array(length));
+  return base64Url(buffer);
+};
+var generateCodeVerifier = createRandomBase64UrlGenerator(NUM_GENERATOR_BYTES);
+var generateState = createRandomBase64UrlGenerator(NUM_GENERATOR_BYTES);
+var base64Url = (input) => encodeBase64(input).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+var ALG_ES256 = "ES256";
+var ALG_RS256 = "RS256";
+var CLOCK_SKEW_SECONDS = 60;
+var DEFAULT_SCOPES = ["openid", "email", "profile"];
+var JWKS_REFETCH_COOLDOWN_MS = 60000;
+var JWT_SEGMENT_COUNT = 3;
+var MILLISECONDS_PER_SECOND = 1000;
+var trimTrailingSlash = (value) => value.endsWith("/") ? value.slice(0, -1) : value;
+var fetchJson = async (url) => {
+  const response = await fetch(url, {
+    headers: { accept: "application/json" }
+  });
+  if (!response.ok) {
+    throw new Error(`Request to ${url} failed with status ${response.status}`);
+  }
+  return response.json();
+};
+var decodeJsonSegment = (segment) => {
+  const decoded = decodeBase64(segment);
+  if (typeof decoded !== "string") {
+    throw new Error("Expected a base64url-encoded JWT segment");
+  }
+  const parsed = JSON.parse(decoded);
+  if (typeof parsed !== "object" || parsed === null) {
+    throw new Error("Expected a JWT segment to decode to a JSON object");
+  }
+  return parsed;
+};
+var importVerificationKey = (jwk, alg) => {
+  if (alg === ALG_RS256) {
+    return crypto.subtle.importKey("jwk", jwk, { hash: "SHA-256", name: "RSASSA-PKCS1-v1_5" }, false, ["verify"]);
+  }
+  if (alg === ALG_ES256) {
+    return crypto.subtle.importKey("jwk", jwk, { name: "ECDSA", namedCurve: "P-256" }, false, ["verify"]);
+  }
+  throw new Error(`Unsupported id_token signing algorithm "${alg}"`);
+};
+var verifySignature = (key, alg, signingInput, signature) => {
+  const algorithm = alg === ALG_ES256 ? { hash: "SHA-256", name: "ECDSA" } : { name: "RSASSA-PKCS1-v1_5" };
+  return crypto.subtle.verify(algorithm, key, new Uint8Array(signature), new TextEncoder().encode(signingInput));
+};
+var selectKey = (jwks, kid) => jwks.find((jwk) => kid === undefined || jwk.kid === kid);
+var assertClaims = (payload, expected) => {
+  const aud = Reflect.get(payload, "aud");
+  const exp = Reflect.get(payload, "exp");
+  const iss = Reflect.get(payload, "iss");
+  const sub = Reflect.get(payload, "sub");
+  const audiences = Array.isArray(aud) ? aud : [aud];
+  const nowSeconds = Math.floor(Date.now() / MILLISECONDS_PER_SECOND);
+  if (iss !== expected.issuer) {
+    throw new Error('id_token "iss" does not match the provider issuer');
+  }
+  if (typeof sub !== "string" || sub.length === 0) {
+    throw new Error('id_token is missing "sub"');
+  }
+  if (!audiences.includes(expected.audience)) {
+    throw new Error('id_token "aud" does not include the client id');
+  }
+  if (typeof exp !== "number" || exp + CLOCK_SKEW_SECONDS < nowSeconds) {
+    throw new Error("id_token has expired");
+  }
+  if (expected.nonce !== undefined && Reflect.get(payload, "nonce") !== expected.nonce) {
+    throw new Error('id_token "nonce" does not match');
+  }
+  const claims = { ...payload, aud, exp, iss, sub };
+  return claims;
+};
+var verifyIdToken = async ({
+  audience,
+  idToken,
+  issuer,
+  jwks,
+  nonce
+}) => {
+  const segments = idToken.split(".");
+  const [headerSegment, payloadSegment, signatureSegment] = segments;
+  if (segments.length !== JWT_SEGMENT_COUNT || headerSegment === undefined || payloadSegment === undefined || signatureSegment === undefined) {
+    throw new Error("Invalid id_token: expected three segments");
+  }
+  const header = decodeJsonSegment(headerSegment);
+  const alg = Reflect.get(header, "alg");
+  const kid = Reflect.get(header, "kid");
+  if (typeof alg !== "string") {
+    throw new Error('id_token header is missing "alg"');
+  }
+  const jwk = selectKey(jwks, typeof kid === "string" ? kid : undefined);
+  if (jwk === undefined) {
+    throw new Error('No JWKS key matches the id_token "kid"');
+  }
+  const key = await importVerificationKey(jwk, alg);
+  const signature = decodeBase64(signatureSegment, true);
+  if (typeof signature === "string") {
+    throw new Error("Failed to decode the id_token signature");
+  }
+  const isValid = await verifySignature(key, alg, `${headerSegment}.${payloadSegment}`, signature);
+  if (!isValid) {
+    throw new Error("id_token signature verification failed");
+  }
+  return assertClaims(decodeJsonSegment(payloadSegment), {
+    audience,
+    issuer,
+    nonce
+  });
+};
+var toDiscoveryDocument = (value, expectedIssuer) => {
+  if (typeof value !== "object" || value === null) {
+    throw new Error("OIDC discovery document is not a JSON object");
+  }
+  const issuer = Reflect.get(value, "issuer");
+  const authorizationEndpoint = Reflect.get(value, "authorization_endpoint");
+  const tokenEndpoint = Reflect.get(value, "token_endpoint");
+  const jwksUri = Reflect.get(value, "jwks_uri");
+  const userinfoEndpoint = Reflect.get(value, "userinfo_endpoint");
+  if (typeof issuer !== "string" || typeof authorizationEndpoint !== "string" || typeof tokenEndpoint !== "string" || typeof jwksUri !== "string") {
+    throw new Error("OIDC discovery document is missing required endpoints");
+  }
+  if (trimTrailingSlash(issuer) !== trimTrailingSlash(expectedIssuer)) {
+    throw new Error(`OIDC discovery issuer "${issuer}" does not match configured issuer "${expectedIssuer}"`);
+  }
+  return {
+    authorization_endpoint: authorizationEndpoint,
+    issuer,
+    jwks_uri: jwksUri,
+    token_endpoint: tokenEndpoint,
+    userinfo_endpoint: typeof userinfoEndpoint === "string" ? userinfoEndpoint : undefined
+  };
+};
+var fetchDiscoveryDocument = async (issuer) => {
+  const base = trimTrailingSlash(issuer);
+  const document = await fetchJson(`${base}/.well-known/openid-configuration`);
+  return toDiscoveryDocument(document, issuer);
+};
+var fetchJwks = async (jwksUri) => {
+  const body = await fetchJson(jwksUri);
+  const value = Reflect.get(body ?? {}, "keys");
+  if (!Array.isArray(value)) {
+    throw new Error('JWKS response is missing a "keys" array');
+  }
+  const keys = value;
+  return keys;
+};
+var createOIDCClient = async (config) => {
+  const discovery = await fetchDiscoveryDocument(config.issuer);
+  const scopes = config.scopes !== undefined && config.scopes.length > 0 ? config.scopes : DEFAULT_SCOPES;
+  let cachedJwks;
+  let jwksFetchedAtMs = 0;
+  const resolveJwks = async (forceRefresh) => {
+    const isStale = Date.now() - jwksFetchedAtMs > JWKS_REFETCH_COOLDOWN_MS;
+    if (cachedJwks === undefined || forceRefresh && isStale) {
+      cachedJwks = await fetchJwks(discovery.jwks_uri);
+      jwksFetchedAtMs = Date.now();
+    }
+    return cachedJwks;
+  };
+  const createAuthorizationUrl = async (options) => {
+    const url = new URL(discovery.authorization_endpoint);
+    const challenge = await createS256CodeChallenge(options.codeVerifier);
+    const { searchParams } = url;
+    searchParams.set("client_id", config.clientId);
+    searchParams.set("code_challenge", challenge);
+    searchParams.set("code_challenge_method", "S256");
+    searchParams.set("redirect_uri", config.redirectUri);
+    searchParams.set("response_type", "code");
+    searchParams.set("scope", (options.scope ?? scopes).join(" "));
+    searchParams.set("state", options.state);
+    if (options.nonce !== undefined) {
+      searchParams.set("nonce", options.nonce);
+    }
+    return url;
+  };
+  const validateAuthorizationCode = async (options) => {
+    const body = new URLSearchParams;
+    body.set("client_id", config.clientId);
+    body.set("client_secret", config.clientSecret);
+    body.set("code", options.code);
+    body.set("code_verifier", options.codeVerifier);
+    body.set("grant_type", "authorization_code");
+    body.set("redirect_uri", config.redirectUri);
+    const response = await fetch(discovery.token_endpoint, {
+      body,
+      headers: {
+        accept: "application/json",
+        "content-type": "application/x-www-form-urlencoded"
+      },
+      method: "POST"
+    });
+    if (!response.ok) {
+      throw new Error(`OIDC token request failed with status ${response.status}`);
+    }
+    const tokens = await response.json();
+    return tokens;
+  };
+  const verifyToken = async (idToken, options) => {
+    const jwks = await resolveJwks(false);
+    const params = {
+      audience: config.clientId,
+      idToken,
+      issuer: discovery.issuer,
+      nonce: options?.nonce
+    };
+    try {
+      return await verifyIdToken({ ...params, jwks });
+    } catch (error) {
+      const refreshed = await resolveJwks(true);
+      if (refreshed === jwks)
+        throw error;
+      return verifyIdToken({ ...params, jwks: refreshed });
+    }
+  };
+  const fetchUserProfile = async (accessToken) => {
+    if (discovery.userinfo_endpoint === undefined) {
+      throw new Error("OIDC provider does not expose a userinfo endpoint");
+    }
+    const response = await fetch(discovery.userinfo_endpoint, {
+      headers: {
+        accept: "application/json",
+        authorization: `Bearer ${accessToken}`
+      }
+    });
+    if (!response.ok) {
+      throw new Error(`OIDC userinfo request failed with status ${response.status}`);
+    }
+    const profile = await response.json();
+    return profile;
+  };
+  return {
+    createAuthorizationUrl,
+    discovery,
+    fetchUserProfile,
+    validateAuthorizationCode,
+    verifyIdToken: verifyToken
+  };
+};
+var oidcProviderOptions = Object.keys(providers).filter(isOIDCProviderOption);
+var pkceProviderOptions = Object.keys(providers).filter(isPKCEProviderOption);
+var providerOptions = Object.keys(providers).filter(isValidProviderOption);
+var refreshableProviderOptions = Object.keys(providers).filter(isRefreshableProviderOption);
+var revocableProviderOptions = Object.keys(providers).filter(isRevocableProviderOption);
+var scopeRequiredProviderOptions = Object.keys(providers).filter(isScopeRequiredProviderOption);
+var createOAuth2Client = async (providerName, config) => {
+  const meta = providers[providerName];
+  const isConfigPropertyFunction = (cfgProp) => typeof cfgProp === "function";
+  const resolveConfigProp = async (cfgProp) => {
+    const result = isConfigPropertyFunction(cfgProp) ? cfgProp(config) : cfgProp;
+    return result;
+  };
+  const authorizationUrl = await resolveConfigProp(meta.authorizationUrl);
+  const tokenUrl = await resolveConfigProp(meta.tokenRequest.url);
+  return {
+    async createAuthorizationUrl(opts) {
+      const { state, scope = [], searchParams = [], codeVerifier } = opts;
+      const url = new URL(authorizationUrl);
+      url.searchParams.set("response_type", "code");
+      url.searchParams.set("client_id", config.clientId);
+      if (config.redirectUri)
+        url.searchParams.set("redirect_uri", config.redirectUri);
+      if (state)
+        url.searchParams.set("state", state);
+      if (scope.length !== 0) {
+        const delimeter = providerName === "withings" ? "," : " ";
+        url.searchParams.set("scope", scope.join(delimeter));
+      }
+      if (meta.PKCEMethod !== undefined) {
+        if (!codeVerifier) {
+          throw new Error("`codeVerifier` is required when PKCE is enabled");
+        }
+        const codeChallenge = meta.PKCEMethod === "S256" ? await createS256CodeChallenge(codeVerifier) : codeVerifier;
+        url.searchParams.set("code_challenge_method", meta.PKCEMethod);
+        url.searchParams.set("code_challenge", codeChallenge);
+      }
+      Object.entries(resolveConfigProp(meta.createAuthorizationURLSearchParams) ?? {}).forEach(([key, value]) => url.searchParams.set(key, value));
+      searchParams.forEach(([key, value]) => url.searchParams.set(key, value));
+      return url;
+    },
+    async fetchUserProfile(accessToken) {
+      const { profileRequest } = meta;
+      const {
+        url,
+        method,
+        authIn,
+        searchParams,
+        body: profileBody,
+        headers,
+        encoding
+      } = profileRequest;
+      const endpoint = new URL(await resolveConfigProp(url));
+      const resolvedBody = await resolveConfigProp(profileBody);
+      new URLSearchParams(await resolveConfigProp(searchParams)).forEach((value, key) => endpoint.searchParams.append(key, value));
+      let headerEntries = [];
+      const rawHeaders = headers ? await resolveConfigProp(headers) : undefined;
+      if (rawHeaders instanceof Headers)
+        headerEntries = Array.from(rawHeaders.entries());
+      else if (Array.isArray(rawHeaders))
+        headerEntries = rawHeaders;
+      else if (rawHeaders && typeof rawHeaders === "object")
+        headerEntries = Object.entries(rawHeaders);
+      const profileHeaders = Object.fromEntries(headerEntries.filter(([, value]) => value !== ""));
+      if (authIn === "header") {
+        profileHeaders.Authorization = `Bearer ${accessToken}`;
+      } else {
+        endpoint.searchParams.append("access_token", accessToken);
+      }
+      const init = { headers: profileHeaders, method };
+      if (method === "POST" && resolvedBody !== undefined) {
+        profileHeaders["Content-Type"] = encoding;
+        init.body = encoding === "application/json" ? JSON.stringify(resolvedBody) : new URLSearchParams(resolvedBody).toString();
+      }
+      const profileTarget = endpoint.toString();
+      const response = await fetch(profileTarget, {
+        ...h2IfHttps(profileTarget),
+        ...init
+      });
+      if (!response.ok)
+        throw await createOAuth2FetchError(response);
+      return response.json();
+    },
+    async refreshAccessToken(refreshToken) {
+      const { authIn, encoding } = meta.tokenRequest;
+      const params = new URLSearchParams(meta.refreshAccessTokenBody);
+      params.set("grant_type", "refresh_token");
+      params.set("refresh_token", refreshToken);
+      const { clientId } = config;
+      let clientSecretValue;
+      if (hasClientSecret(config)) {
+        clientSecretValue = config.clientSecret;
+        params.set("client_id", clientId);
+        params.set("client_secret", clientSecretValue);
+      }
+      const request = createOAuth2Request({
+        authIn,
+        body: params,
+        clientId,
+        clientSecret: clientSecretValue,
+        encoding,
+        url: tokenUrl
+      });
+      const response = await fetch(request, {
+        ...h2IfHttps(request.url)
+      });
+      if (!response.ok)
+        throw await createOAuth2FetchError(response);
+      return response.json();
+    },
+    async revokeToken(token) {
+      const { revocationRequest } = meta;
+      if (!revocationRequest) {
+        throw new Error("Token revocation not defined for this provider");
+      }
+      const { url, authIn, body, headers, tokenParamName } = revocationRequest;
+      const endpoint = await resolveConfigProp(url);
+      const resolvedBody = await resolveConfigProp(body);
+      const revocationBody = new URLSearchParams(resolvedBody);
+      const revocationHeaders = new Headers(headers && await resolveConfigProp(headers));
+      const { clientId } = config;
+      const clientSecret = hasClientSecret(config) ? config.clientSecret : undefined;
+      let request;
+      if (authIn === "body") {
+        revocationBody.set(tokenParamName, token);
+        revocationBody.set("client_id", clientId);
+        if (clientSecret)
+          revocationBody.set("client_secret", clientSecret);
+        request = createOAuth2Request({
+          authIn: "body",
+          body: revocationBody,
+          clientId,
+          clientSecret,
+          encoding: "application/x-www-form-urlencoded",
+          headers: revocationHeaders,
+          url: endpoint.toString()
+        });
+      } else if (authIn === "header") {
+        revocationHeaders.set("Authorization", `Bearer ${token}`);
+        request = createOAuth2Request({
+          authIn: "header",
+          body: revocationBody,
+          clientId,
+          clientSecret,
+          encoding: "application/x-www-form-urlencoded",
+          headers: revocationHeaders,
+          url: endpoint.toString()
+        });
+      } else {
+        request = createOAuth2Request({
+          authIn: "query",
+          body: revocationBody,
+          clientId,
+          clientSecret,
+          encoding: "application/x-www-form-urlencoded",
+          headers: revocationHeaders,
+          url: `${endpoint.toString()}?${tokenParamName}=${token}`
+        });
+      }
+      const response = await fetch(request, {
+        ...h2IfHttps(request.url)
+      });
+      if (!response.ok)
+        throw await createOAuth2FetchError(response);
+    },
+    async validateAuthorizationCode(opts) {
+      const { code, codeVerifier } = opts;
+      const { authIn, encoding } = meta.tokenRequest;
+      const bodyObj = {};
+      for (const key in meta.validateAuthorizationCodeBody ?? {}) {
+        const value = meta.validateAuthorizationCodeBody[key];
+        if (typeof value === "string")
+          bodyObj[key] = value;
+      }
+      bodyObj.grant_type = "authorization_code";
+      bodyObj.code = code;
+      if (config.redirectUri)
+        bodyObj.redirect_uri = config.redirectUri;
+      if (meta.PKCEMethod !== undefined) {
+        if (!codeVerifier) {
+          throw new Error("codeVerifier required when PKCE is enabled");
+        }
+        bodyObj.code_verifier = codeVerifier;
+      }
+      const payload = encoding === "application/json" ? bodyObj : new URLSearchParams(bodyObj);
+      const request = createOAuth2Request({
+        authIn,
+        body: payload,
+        clientId: config.clientId,
+        clientSecret: hasClientSecret(config) ? config.clientSecret : undefined,
+        encoding,
+        url: tokenUrl
+      });
+      const response = await fetch(request, {
+        ...h2IfHttps(request.url)
+      });
+      if (!response.ok)
+        throw await createOAuth2FetchError(response);
+      return response.json();
+    }
+  };
+};
+export {
+  scopeRequiredProviderOptions,
+  revocableProviderOptions,
+  refreshableProviderOptions,
+  providers,
+  providerOptions,
+  pkceProviderOptions,
+  oidcProviderOptions,
+  isValidProviderOption,
+  isRevocableProviderOption,
+  isRevocableOAuth2Client,
+  isRefreshableProviderOption,
+  isRefreshableOAuth2Client,
+  isPKCEProviderOption,
+  isOIDCProviderOption,
+  extractPropFromIdentity,
+  decodeJWT
+};
+
+//# debugId=2E1CE4D0162FAFF764756E2164756E21
+//# sourceMappingURL=index.js.map