@absolutejs/auth 0.55.7 → 0.55.8

package/dist/linkedProviders/index.js

@@ -0,0 +1,3233 @@
+// @bun
+var __create = Object.create;
+var __getProtoOf = Object.getPrototypeOf;
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toESMCache_node;
+var __toESMCache_esm;
+var __toESM = (mod, isNodeMode, target) => {
+  var canCache = mod != null && typeof mod === "object";
+  if (canCache) {
+    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
+    var cached = cache.get(mod);
+    if (cached)
+      return cached;
+  }
+  target = mod != null ? __create(__getProtoOf(mod)) : {};
+  const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
+  for (let key of __getOwnPropNames(mod))
+    if (!__hasOwnProp.call(to, key))
+      __defProp(to, key, {
+        get: __accessProp.bind(mod, key),
+        enumerable: true
+      });
+  if (canCache)
+    cache.set(mod, to);
+  return to;
+};
+var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __require = import.meta.require;
+
+// node_modules/citra/dist/index.js
+var BASE64_BLOCK_SIZE = 4;
+var NUM_GENERATOR_BYTES = 32;
+var anilistProfileQuery = `query {
+  Viewer {
+    id
+    name
+    about
+    avatar {
+      large
+      medium
+    }
+    bannerImage
+    siteUrl
+    createdAt
+    updatedAt
+    donatorTier
+    donatorBadge
+    unreadNotificationCount
+    options {
+      titleLanguage
+      displayAdultContent
+      airingNotifications
+      profileColor
+      activityMergeTime
+      staffNameLanguage
+    }
+    mediaListOptions {
+      scoreFormat
+      rowOrder
+      animeList {
+        sectionOrder
+        customLists
+        advancedScoringEnabled
+      }
+      mangaList {
+        sectionOrder
+        customLists
+        advancedScoringEnabled
+      }
+    }
+    statistics {
+      anime {
+        count
+        meanScore
+        minutesWatched
+        episodesWatched
+      }
+      manga {
+        count
+        meanScore
+        chaptersRead
+        volumesRead
+      }
+    }
+    favourites {
+      anime {
+        nodes {
+          id
+          title {
+            romaji
+            english
+          }
+          siteUrl
+        }
+      }
+      manga {
+        nodes {
+          id
+          title {
+            romaji
+            english
+          }
+          siteUrl
+        }
+      }
+      characters {
+        nodes {
+          id
+          name {
+            full
+          }
+          image {
+            large
+          }
+        }
+      }
+      staff {
+        nodes {
+          id
+          name {
+            full
+          }
+          image {
+            large
+          }
+        }
+      }
+      studios {
+        nodes {
+          id
+          name
+          siteUrl
+        }
+      }
+    }
+    isFollower
+    isFollowing
+  }
+}`;
+var defineProviders = (providers) => providers;
+var defineProvider = (config) => config;
+var providers = defineProviders({
+  "42": {
+    authorizationUrl: "https://api.intra.42.fr/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.intra.42.fr/v2/me"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.intra.42.fr/oauth/token"
+    }
+  },
+  amazoncognito: {
+    authorizationUrl: "https://${domain}/oauth2/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => `https://${config.domain}/oauth2/userInfo`
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: (config) => `https://${config.domain}/oauth2/revoke`
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `https://${config.domain}/oauth2/token`
+    }
+  },
+  anilist: {
+    authorizationUrl: "https://anilist.co/api/v2/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      body: {
+        query: anilistProfileQuery
+      },
+      encoding: "application/json",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json"
+      },
+      method: "POST",
+      url: "https://graphql.anilist.co"
+    },
+    scopeRequired: false,
+    subject: ["data", "Viewer", "id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://anilist.co/api/v2/oauth/token"
+    }
+  },
+  apple: {
+    authorizationUrl: "https://appleid.apple.com/auth/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://appleid.apple.com/auth/userinfo"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://appleid.apple.com/auth/token"
+    }
+  },
+  atlassian: {
+    authorizationUrl: "https://auth.atlassian.com/authorize",
+    createAuthorizationURLSearchParams: {
+      audience: "api.atlassian.com"
+    },
+    email: ["email"],
+    fullName: ["name"],
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["picture"],
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.atlassian.com/me"
+    },
+    scopeRequired: true,
+    subject: ["account_id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://auth.atlassian.com/oauth/token"
+    }
+  },
+  attio: {
+    authorizationUrl: "https://app.attio.com/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.attio.com/v2/self"
+    },
+    scopeRequired: true,
+    subject: ["workspace_id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://app.attio.com/oauth/token"
+    }
+  },
+  auth0: {
+    authorizationUrl: (config) => `https://${config.domain}/authorize`,
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => `https://${config.domain}/userinfo`
+    },
+    revocationRequest: {
+      authIn: "body",
+      body: new URLSearchParams({
+        token_type_hint: "refresh_token"
+      }),
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: (config) => `https://${config.domain}/oauth/revoke`
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `https://${config.domain}/oauth/token`
+    }
+  },
+  authentik: {
+    authorizationUrl: (config) => `https://${config.baseURL}/oauth/authorize`,
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => `https://${config.baseURL}/api/v3/user/`
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `https://${config.baseURL}/oauth/token`
+    }
+  },
+  autodesk: {
+    authorizationUrl: "https://developer.api.autodesk.com/authentication/v2/authorize",
+    email: ["email"],
+    familyName: ["family_name"],
+    fullName: ["name"],
+    givenName: ["given_name"],
+    isOIDC: true,
+    isRefreshable: true,
+    picture: ["picture"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.userprofile.autodesk.com/userinfo"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://developer.api.autodesk.com/authentication/v2/token"
+    }
+  },
+  azureadb2c: {
+    authorizationUrl: (config) => `https://${config.tenantSubdomain}.b2clogin.com/${config.tenantSubdomain}.onmicrosoft.com/${config.policy}/oauth2/v2.0/authorize`,
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    scopeRequired: false,
+    subject: ["sub"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `https://${config.tenantSubdomain}.b2clogin.com/${config.tenantSubdomain}.onmicrosoft.com/${config.policy}/oauth2/v2.0/token`
+    }
+  },
+  battlenet: {
+    authorizationUrl: "https://oauth.battle.net/authorize",
+    isOIDC: true,
+    isRefreshable: false,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://oauth.battle.net/userinfo"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://oauth.battle.net/token"
+    }
+  },
+  bitbucket: {
+    authorizationUrl: "https://bitbucket.org/site/oauth2/authorize",
+    fullName: ["display_name"],
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["links", "avatar", "href"],
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.bitbucket.org/2.0/user"
+    },
+    scopeRequired: false,
+    subject: ["uuid"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://bitbucket.org/site/oauth2/access_token"
+    }
+  },
+  box: {
+    authorizationUrl: "https://account.box.com/api/oauth2/authorize",
+    email: ["login"],
+    fullName: ["name"],
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["avatar_url"],
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.box.com/2.0/users/me"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: "https://api.box.com/oauth2/revoke"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.box.com/oauth2/token"
+    }
+  },
+  bungie: {
+    authorizationUrl: "https://www.bungie.net/en/OAuth/Authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      headers: {
+        "X-API-Key": "<YOUR_API_KEY>"
+      },
+      method: "GET",
+      url: "https://www.bungie.net/Platform/User/GetCurrentBungieNetUser"
+    },
+    scopeRequired: false,
+    subject: ["Response", "membershipId"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://www.bungie.net/Platform/App/OAuth/token"
+    }
+  },
+  calendly: {
+    authorizationUrl: "https://auth.calendly.com/oauth/authorize",
+    email: ["resource", "email"],
+    fullName: ["resource", "name"],
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.calendly.com/users/me"
+    },
+    scopeRequired: false,
+    subject: ["resource", "uri"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://auth.calendly.com/oauth/token"
+    }
+  },
+  close: {
+    authorizationUrl: "https://app.close.com/oauth2/authorize/",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.close.com/api/v1/me/"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.close.com/oauth2/token/"
+    }
+  },
+  coinbase: {
+    authorizationUrl: "https://www.coinbase.com/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.coinbase.com/v2/user"
+    },
+    scopeRequired: false,
+    subject: ["data", "id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.coinbase.com/oauth/token"
+    }
+  },
+  discord: {
+    authorizationUrl: "https://discord.com/api/oauth2/authorize",
+    email: ["email"],
+    isOIDC: true,
+    isRefreshable: true,
+    picture: ["avatar"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://discord.com/api/users/@me"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://discord.com/api/oauth2/token"
+    }
+  },
+  donationalerts: {
+    authorizationUrl: "https://www.donationalerts.com/oauth/authorize",
+    email: ["data", "email"],
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["data", "avatar"],
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://www.donationalerts.com/api/v1/user/oauth"
+    },
+    scopeRequired: false,
+    subject: ["data", "id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://www.donationalerts.com/oauth/token"
+    }
+  },
+  dribbble: {
+    authorizationUrl: "https://dribbble.com/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: false,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.dribbble.com/v2/user"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://dribbble.com/oauth/token"
+    }
+  },
+  dropbox: {
+    authorizationUrl: "https://www.dropbox.com/oauth2/authorize",
+    email: ["email"],
+    familyName: ["name", "surname"],
+    fullName: ["name", "display_name"],
+    givenName: ["name", "given_name"],
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "POST",
+      url: "https://api.dropboxapi.com/2/users/get_current_account"
+    },
+    revocationRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      url: "https://api.dropboxapi.com/2/auth/token/revoke"
+    },
+    scopeRequired: false,
+    subject: ["account_id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.dropboxapi.com/oauth2/token"
+    }
+  },
+  epicgames: {
+    authorizationUrl: "https://www.epicgames.com/id/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.epicgames.dev/epic/oauth/v2/userInfo"
+    },
+    scopeRequired: false,
+    subject: ["account_id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.epicgames.dev/epic/oauth/v1/token"
+    }
+  },
+  etsy: {
+    authorizationUrl: "https://www.etsy.com/oauth/connect",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://openapi.etsy.com/v3/application/users/me"
+    },
+    scopeRequired: false,
+    subject: ["results", "0", "user_id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.etsy.com/v3/public/oauth/token"
+    }
+  },
+  facebook: {
+    authorizationUrl: "https://www.facebook.com/v16.0/dialog/oauth",
+    email: ["email"],
+    familyName: ["family_name"],
+    fullName: ["name"],
+    givenName: ["given_name"],
+    isOIDC: true,
+    isRefreshable: false,
+    picture: ["picture"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "query",
+      encoding: "application/json",
+      method: "GET",
+      searchParams: [["fields", "id,name,email,picture"]],
+      url: "https://graph.facebook.com/me"
+    },
+    scopeRequired: false,
+    subject: ["sub"],
+    subjectBySource: {
+      idToken: ["sub"],
+      profile: ["id"]
+    },
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://graph.facebook.com/v16.0/oauth/access_token"
+    }
+  },
+  figma: {
+    authorizationUrl: "https://www.figma.com/oauth",
+    email: ["email"],
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["img_url"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.figma.com/v1/me"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.figma.com/v1/oauth/token"
+    }
+  },
+  gitea: {
+    authorizationUrl: (config) => `${config.baseURL}/login/oauth/authorize`,
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => `${config.baseURL}/api/v1/user`
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `${config.baseURL}/login/oauth/access_token`
+    }
+  },
+  github: {
+    authorizationUrl: "https://github.com/login/oauth/authorize",
+    email: ["email"],
+    isOIDC: false,
+    isRefreshable: false,
+    picture: ["avatar_url"],
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.github.com/user"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://github.com/login/oauth/access_token"
+    }
+  },
+  gitlab: {
+    authorizationUrl: (config) => `${config.baseURL}/oauth/authorize`,
+    email: ["email"],
+    fullName: ["name"],
+    isOIDC: true,
+    isRefreshable: true,
+    picture: ["picture"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://gitlab.com/api/v4/user"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: (config) => `${config.baseURL}/oauth/revoke`
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `${config.baseURL}/oauth/token`
+    }
+  },
+  gohighlevel: {
+    authorizationUrl: "https://marketplace.gohighlevel.com/v2/oauth/chooselocation",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      headers: {
+        Version: "2021-07-28"
+      },
+      method: "GET",
+      url: "https://services.leadconnectorhq.com/users/me"
+    },
+    scopeRequired: true,
+    subject: ["locationId"],
+    subjectBySource: {
+      tokenResponse: ["locationId"]
+    },
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://services.leadconnectorhq.com/oauth/token"
+    }
+  },
+  google: {
+    authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+    email: ["email"],
+    familyName: ["family_name"],
+    fullName: ["name"],
+    givenName: ["given_name"],
+    isOIDC: true,
+    isRefreshable: true,
+    picture: ["picture"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://openidconnect.googleapis.com/v1/userinfo"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: "https://oauth2.googleapis.com/revoke"
+    },
+    scopeRequired: true,
+    subject: ["sub"],
+    subjectBySource: {
+      idToken: ["sub"],
+      profile: ["sub"]
+    },
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://oauth2.googleapis.com/token"
+    }
+  },
+  hubspot: {
+    authorizationUrl: "https://app.hubspot.com/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "path",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.hubapi.com/oauth/v1/access-tokens"
+    },
+    scopeRequired: true,
+    subject: ["hub_id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.hubapi.com/oauth/v1/token"
+    }
+  },
+  intuit: {
+    authorizationUrl: "https://appcenter.intuit.com/connect/oauth2",
+    isOIDC: true,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => config.environment === "production" ? "https://accounts.platform.intuit.com/v1/openid_connect/userinfo" : "https://sandbox-accounts.platform.intuit.com/v1/openid_connect/userinfo"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      headers: (config) => ({
+        Authorization: `Basic ${encodeBase64(`${config.clientId}:${config.clientSecret}`)}`
+      }),
+      tokenParamName: "token",
+      url: "https://developer.api.intuit.com/v2/oauth2/tokens/revoke"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer"
+    }
+  },
+  kakao: {
+    authorizationUrl: "https://kauth.kakao.com/oauth/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    picture: ["picture"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://kapi.kakao.com/v2/user/me"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://kauth.kakao.com/oauth/token"
+    }
+  },
+  keycloak: {
+    authorizationUrl: (config) => `${config.realmURL}/protocol/openid-connect/auth`,
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.kick.com/v1/user"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: (config) => `${config.realmURL}/protocol/openid-connect/revoke`
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `${config.realmURL}/protocol/openid-connect/token`
+    }
+  },
+  kick: {
+    authorizationUrl: "https://id.kick.com/oauth/authorize",
+    email: ["data", "email"],
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["data", "profile_picture"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.kick.com/public/v1/users"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: "https://id.kick.com/oauth/revoke"
+    },
+    scopeRequired: true,
+    subject: ["data", "user_id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://id.kick.com/oauth/token"
+    }
+  },
+  lichess: {
+    authorizationUrl: "https://lichess.org/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: false,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://lichess.org/api/account"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://lichess.org/api/token"
+    }
+  },
+  line: {
+    authorizationUrl: "https://access.line.me/oauth2/v2.1/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.line.me/v2/profile"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.line.me/oauth2/v2.1/token"
+    }
+  },
+  linear: {
+    authorizationUrl: "https://linear.app/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: false,
+    profileRequest: {
+      authIn: "header",
+      body: {
+        query: `query { viewer { id name } }`
+      },
+      encoding: "application/json",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json"
+      },
+      method: "POST",
+      url: "https://api.linear.app/graphql"
+    },
+    revocationRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      url: "https://api.linear.app/oauth/revoke"
+    },
+    scopeRequired: false,
+    subject: ["data", "viewer", "id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.linear.app/oauth/token"
+    }
+  },
+  linkedin: {
+    authorizationUrl: "https://www.linkedin.com/oauth/v2/authorization",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.linkedin.com/v2/me"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://www.linkedin.com/oauth/v2/accessToken"
+    }
+  },
+  mastodon: {
+    authorizationUrl: (config) => `${config.baseURL}/oauth/authorize`,
+    isOIDC: false,
+    isRefreshable: false,
+    picture: ["avatar"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => `${config.baseURL}/api/v1/accounts/verify_credentials`
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: (config) => `${config.baseURL}/oauth/revoke`
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `${config.baseURL}/oauth/token`
+    }
+  },
+  mercadolibre: {
+    authorizationUrl: "https://auth.mercadolibre.com/authorization",
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.mercadolibre.com/users/me"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.mercadolibre.com/oauth/token"
+    }
+  },
+  mercadopago: {
+    authorizationUrl: "https://auth.mercadopago.com/authorization",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.mercadopago.com/v1/users/me"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.mercadopago.com/oauth/token"
+    }
+  },
+  microsoftentraexternalid: {
+    authorizationUrl: (config) => `https://${config.tenantSubdomain}.ciamlogin.com/${config.tenantId}/oauth2/v2.0/authorize`,
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    scopeRequired: false,
+    subject: ["sub"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `https://${config.tenantSubdomain}.ciamlogin.com/${config.tenantId}/oauth2/v2.0/token`
+    }
+  },
+  microsoftentraid: {
+    authorizationUrl: (config) => `https://login.microsoftonline.com/${config.tenantId}/oauth2/v2.0/authorize`,
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://graph.microsoft.com/oidc/userinfo"
+    },
+    scopeRequired: false,
+    subject: ["sub"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `https://login.microsoftonline.com/${config.tenantId}/oauth2/v2.0/token`
+    }
+  },
+  monday: {
+    authorizationUrl: "https://auth.monday.com/oauth2/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      body: {
+        query: "query { me { id name email } }"
+      },
+      encoding: "application/json",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      method: "POST",
+      url: "https://api.monday.com/v2"
+    },
+    scopeRequired: true,
+    subject: ["data", "me", "id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://auth.monday.com/oauth2/token"
+    }
+  },
+  myanimelist: {
+    authorizationUrl: "https://myanimelist.net/v1/oauth2/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "plain",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.myanimelist.net/v2/users/@me"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://myanimelist.net/v1/oauth2/token"
+    }
+  },
+  naver: {
+    authorizationUrl: "https://nid.naver.com/oauth2.0/authorize",
+    email: ["response", "email"],
+    fullName: ["response", "name"],
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["response", "profile_image"],
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://openapi.naver.com/v1/nid/me"
+    },
+    scopeRequired: false,
+    subject: ["response", "id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://nid.naver.com/oauth2.0/token"
+    }
+  },
+  notion: {
+    authorizationUrl: "https://api.notion.com/v1/oauth/authorize",
+    email: ["bot", "owner", "user", "person", "email"],
+    isOIDC: false,
+    isRefreshable: false,
+    picture: ["bot", "owner", "user", "avatar_url"],
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      headers: {
+        "Notion-Version": "2022-06-28"
+      },
+      method: "GET",
+      url: "https://api.notion.com/v1/users/me"
+    },
+    scopeRequired: false,
+    subject: ["bot", "owner", "user", "id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      url: "https://api.notion.com/v1/oauth/token"
+    }
+  },
+  okta: {
+    authorizationUrl: (config) => `https://${config.domain}/oauth2/default/v1/authorize`,
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => `https://${config.domain}/oauth2/default/v1/userinfo`
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: (config) => `https://${config.domain}/oauth2/default/v1/revoke`
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `https://${config.domain}/oauth2/default/v1/token`
+    }
+  },
+  onspark: {
+    authorizationUrl: "https://onspark.com/oauth2/authorize",
+    email: ["email"],
+    familyName: ["family_name"],
+    fullName: ["name"],
+    givenName: ["given_name"],
+    isOIDC: true,
+    isRefreshable: true,
+    picture: ["picture"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://onspark.com/oauth2/userinfo"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      tokenParamName: "token",
+      url: "https://onspark.com/oauth2/revoke"
+    },
+    scopeRequired: true,
+    subject: ["sub"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://onspark.com/oauth2/token"
+    }
+  },
+  osu: {
+    authorizationUrl: "https://osu.ppy.sh/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["avatar_url"],
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://osu.ppy.sh/api/v2/me"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://osu.ppy.sh/oauth/token"
+    }
+  },
+  patreon: {
+    authorizationUrl: "https://www.patreon.com/oauth2/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://www.patreon.com/api/oauth2/v2/identity"
+    },
+    scopeRequired: false,
+    subject: ["data", "id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://www.patreon.com/api/oauth2/token"
+    }
+  },
+  pipedrive: {
+    authorizationUrl: "https://oauth.pipedrive.com/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.pipedrive.com/v1/users/me"
+    },
+    scopeRequired: true,
+    subject: ["data", "id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://oauth.pipedrive.com/oauth/token"
+    }
+  },
+  polar: {
+    authorizationUrl: "https://polar.sh/oauth2/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.polar.sh/v1/oauth2/userinfo"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: "https://api.polar.sh/v1/oauth2/revoke"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.polar.sh/v1/oauth2/token"
+    }
+  },
+  polaraccesslink: {
+    authorizationUrl: "https://flow.polar.com/oauth2/authorization",
+    isOIDC: false,
+    isRefreshable: false,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://www.polaraccesslink.com/v3/users/me"
+    },
+    scopeRequired: false,
+    subject: ["x_user_id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "header",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://polarremote.com/v2/oauth2/token"
+    }
+  },
+  polarteampro: {
+    authorizationUrl: "https://auth.polar.com/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://www.polaraccesslink.com/v3/users/<USER_ID>"
+    },
+    scopeRequired: false,
+    subject: ["x_user_id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "header",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://auth.polar.com/oauth/token"
+    }
+  },
+  reddit: {
+    authorizationUrl: "https://www.reddit.com/api/v1/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://oauth.reddit.com/api/v1/me"
+    },
+    revocationRequest: {
+      authIn: "header",
+      body: new URLSearchParams({
+        token_type_hint: "refresh_token"
+      }),
+      encoding: "application/json",
+      url: "https://www.reddit.com/api/v1/revoke_token"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "header",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://www.reddit.com/api/v1/access_token"
+    }
+  },
+  roblox: {
+    authorizationUrl: "https://apis.roblox.com/oauth/v1/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    picture: ["picture"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://apis.roblox.com/oauth/v1/userinfo"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://apis.roblox.com/oauth/v1/token"
+    }
+  },
+  salesforce: {
+    authorizationUrl: "https://login.salesforce.com/services/oauth2/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://login.salesforce.com/services/oauth2/userinfo"
+    },
+    revocationRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      url: "https://login.salesforce.com/services/oauth2/revoke"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://login.salesforce.com/services/oauth2/token"
+    }
+  },
+  shikimori: {
+    authorizationUrl: "https://shikimori.org/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://shikimori.one/api/users/whoami"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://shikimori.org/oauth/token"
+    }
+  },
+  slack: {
+    authorizationUrl: "https://slack.com/openid/connect/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "query",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://slack.com/api/users.identity"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: "https://slack.com/api/auth.revoke"
+    },
+    scopeRequired: true,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://slack.com/api/openid.connect.token"
+    }
+  },
+  slackuser: {
+    accessTokenPath: ["authed_user", "access_token"],
+    authorizationUrl: "https://slack.com/oauth/v2/authorize",
+    isOIDC: false,
+    isRefreshable: false,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "POST",
+      url: "https://slack.com/api/auth.test"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: "https://slack.com/api/auth.revoke"
+    },
+    scopeParamName: "user_scope",
+    scopeRequired: true,
+    subject: ["user_id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://slack.com/api/oauth.v2.access"
+    }
+  },
+  spotify: {
+    authorizationUrl: "https://accounts.spotify.com/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.spotify.com/v1/me"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://accounts.spotify.com/api/token"
+    }
+  },
+  startgg: {
+    authorizationUrl: "https://start.gg/oauth/authorize",
+    email: ["data", "currentUser", "email"],
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      body: {
+        query: `query { currentUser { id slug email player { gamerTag } } }`
+      },
+      encoding: "application/json",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json"
+      },
+      method: "POST",
+      url: "https://api.start.gg/gql/alpha"
+    },
+    scopeRequired: false,
+    subject: ["data", "currentUser", "id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.start.gg/oauth/access_token"
+    }
+  },
+  strava: {
+    authorizationUrl: "https://www.strava.com/oauth/authorize",
+    familyName: ["lastname"],
+    givenName: ["firstname"],
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["profile"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://www.strava.com/api/v3/athlete"
+    },
+    revocationRequest: {
+      authIn: "query",
+      body: new URLSearchParams({
+        token_type_hint: "access_token"
+      }),
+      encoding: "application/json",
+      tokenParamName: "access_token",
+      url: "https://www.strava.com/oauth/deauthorize"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://www.strava.com/oauth/token"
+    }
+  },
+  synology: {
+    authorizationUrl: (config) => `${config.baseURL}/webman/sso/SSOOauth.cgi?client_id=${config.clientId}&response_type=code&redirect_uri=${config.redirectUri}`,
+    isOIDC: false,
+    isRefreshable: false,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => `${config.baseURL}/webman/sso/SSOUserInfo.cgi?client_id=${config.clientId}&access_token=${config.accessToken}`
+    },
+    scopeRequired: false,
+    subject: ["data", "id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `${config.baseURL}/webman/sso/SSOAccessToken.cgi?client_id=${config.clientId}&client_secret=${config.clientSecret}`
+    }
+  },
+  tiktok: {
+    authorizationUrl: "https://www.tiktok.com/v2/auth/authorize",
+    createAuthorizationURLSearchParams: (config) => ({
+      client_key: config.clientId
+    }),
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "query",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://open.douyin.com/oauth/userinfo"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "token",
+      url: "https://open.tiktokapis.com/v2/oauth/revoke/"
+    },
+    scopeRequired: false,
+    subject: ["data", "open_id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://open.tiktokapis.com/v2/oauth/token/"
+    }
+  },
+  tiltify: {
+    authorizationUrl: "https://v5api.tiltify.com/oauth/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://v5api.tiltify.com/api/public/current-user"
+    },
+    scopeRequired: false,
+    subject: ["data", "id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://v5api.tiltify.com/oauth/token"
+    }
+  },
+  tumblr: {
+    authorizationUrl: "https://www.tumblr.com/oauth2/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.tumblr.com/v2/user/info"
+    },
+    scopeRequired: false,
+    subject: ["response", "user", "name"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.tumblr.com/v2/oauth2/token"
+    }
+  },
+  twitch: {
+    authorizationUrl: "https://id.twitch.tv/oauth2/authorize",
+    isOIDC: true,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      headers: (config) => ({
+        "Client-Id": config.clientId
+      }),
+      method: "GET",
+      url: "https://api.twitch.tv/helix/users"
+    },
+    revocationRequest: {
+      authIn: "query",
+      encoding: "application/json",
+      headers: (config) => ({
+        "Client-Id": config.clientId
+      }),
+      tokenParamName: "token",
+      url: "https://id.twitch.tv/oauth2/revoke"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://id.twitch.tv/oauth2/token"
+    }
+  },
+  twitter: {
+    authorizationUrl: "https://twitter.com/i/oauth2/authorize",
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.twitter.com/2/users/me"
+    },
+    revocationRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      url: "https://api.twitter.com/2/oauth2/revoke"
+    },
+    scopeRequired: false,
+    subject: ["data", "id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.twitter.com/2/oauth2/token"
+    }
+  },
+  vk: {
+    authorizationUrl: "https://oauth.vk.com/authorize",
+    isOIDC: false,
+    isRefreshable: false,
+    profileRequest: {
+      authIn: "query",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.vk.com/method/users.get"
+    },
+    scopeRequired: false,
+    subject: ["response", "0", "id"],
+    subjectType: "number",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://oauth.vk.com/access_token"
+    }
+  },
+  withings: {
+    accessTokenPath: ["body", "access_token"],
+    authorizationUrl: "https://account.withings.com/oauth2_user/authorize2",
+    isOIDC: false,
+    isRefreshable: true,
+    profileRequest: {
+      authIn: "header",
+      body: async (config) => {
+        const props = await getWithingsProps(config);
+        if (props === undefined)
+          throw new Error("Failed to get Withings search properties");
+        const { nonce, hashedSignature } = props;
+        return [
+          ["action", "getuser"],
+          ["nonce", nonce],
+          ["client_id", config.clientId],
+          ["signature", hashedSignature]
+        ];
+      },
+      encoding: "application/x-www-form-urlencoded",
+      method: "POST",
+      url: "https://wbsapi.withings.net/v2/oauth2"
+    },
+    refreshAccessTokenBody: {
+      action: "requesttoken"
+    },
+    revocationRequest: {
+      authIn: "header",
+      body: async (config) => {
+        const props = await getWithingsProps(config);
+        if (!props)
+          throw new Error("Failed to get Withings props");
+        const { nonce, hashedSignature } = props;
+        return [
+          ["action", "revoke"],
+          ["client_id", config.clientId],
+          ["nonce", nonce],
+          ["signature", hashedSignature]
+        ];
+      },
+      encoding: "application/x-www-form-urlencoded",
+      method: "POST",
+      url: "https://wbsapi.withings.net/v2/oauth2"
+    },
+    scopeDelimiter: ",",
+    scopeRequired: true,
+    subject: ["userid"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://wbsapi.withings.net/v2/oauth2"
+    },
+    validateAuthorizationCodeBody: {
+      action: "requesttoken"
+    }
+  },
+  workos: {
+    authorizationUrl: (config) => `https://${config.domain}/oauth2/authorize`,
+    createAuthorizationURLSearchParams: () => {
+      const nonce = crypto.randomUUID();
+      return {
+        nonce
+      };
+    },
+    email: ["email"],
+    familyName: ["family_name"],
+    fullName: ["name"],
+    givenName: ["given_name"],
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "POST",
+      url: (config) => `https://${config.domain}/oauth2/userinfo`
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `https://${config.domain}/oauth2/token`
+    }
+  },
+  yahoo: {
+    authorizationUrl: "https://api.login.yahoo.com/oauth2/request_auth",
+    isOIDC: true,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.login.yahoo.com/openid/v1/userinfo"
+    },
+    revocationRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      url: "https://api.login.yahoo.com/oauth2/revoke"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://api.login.yahoo.com/oauth2/get_token"
+    }
+  },
+  yandex: {
+    authorizationUrl: "https://oauth.yandex.com/authorize",
+    createAuthorizationURLSearchParams: {
+      device_id: crypto.randomUUID(),
+      device_name: `${navigator.platform ?? "Unknown"} \u2014 ${(navigator.userAgent.split(")")[0] || "").split("(").pop() || "Unknown"}`
+    },
+    email: ["default_email"],
+    familyName: ["last_name"],
+    fullName: ["real_name"],
+    givenName: ["first_name"],
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://login.yandex.ru/info"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/json",
+      tokenParamName: "access_token",
+      url: "https://oauth.yandex.com/revoke_token"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://oauth.yandex.com/token"
+    }
+  },
+  zoho: {
+    authorizationUrl: (config) => `https://accounts.zoho.${config.region ?? "com"}/oauth/v2/auth`,
+    isOIDC: false,
+    isRefreshable: true,
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: (config) => `https://accounts.zoho.${config.region ?? "com"}/oauth/user/info`
+    },
+    revocationRequest: {
+      authIn: "query",
+      encoding: "application/x-www-form-urlencoded",
+      tokenParamName: "token",
+      url: (config) => `https://accounts.zoho.${config.region ?? "com"}/oauth/v2/token/revoke`
+    },
+    scopeRequired: true,
+    subject: ["ZUID"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: (config) => `https://accounts.zoho.${config.region ?? "com"}/oauth/v2/token`
+    }
+  },
+  zoom: {
+    authorizationUrl: "https://zoom.us/oauth/authorize",
+    email: ["email"],
+    familyName: ["last_name"],
+    givenName: ["first_name"],
+    isOIDC: false,
+    isRefreshable: true,
+    picture: ["pic_url"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://api.zoom.us/v2/users/me"
+    },
+    revocationRequest: {
+      authIn: "query",
+      encoding: "application/json",
+      headers: (config) => ({
+        Authorization: `Basic ${btoa(`${config.clientId}:${config.clientSecret}`)}`
+      }),
+      tokenParamName: "token",
+      url: "https://zoom.us/oauth/revoke"
+    },
+    scopeRequired: false,
+    subject: ["id"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://zoom.us/oauth/token"
+    }
+  }
+});
+var hasClientSecret = (credentials) => {
+  if (typeof credentials !== "object" || credentials === null)
+    return false;
+  const secret = Reflect.get(credentials, "clientSecret");
+  return typeof secret === "string";
+};
+var isExpectedType = (value, kind) => {
+  switch (kind) {
+    case "string":
+      return typeof value === "string";
+    case "number":
+      return typeof value === "number";
+    case "boolean":
+      return typeof value === "boolean";
+    case "object":
+      return typeof value === "object" && value !== null;
+    default:
+      return false;
+  }
+};
+var isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value) && Object.prototype.toString.call(value) === "[object Object]";
+var isOIDCProviderOption = (option) => {
+  if (!isValidProviderOption(option))
+    return false;
+  const provider = providers[option];
+  return provider.isOIDC;
+};
+var isPKCEProviderOption = (option) => {
+  if (!isValidProviderOption(option))
+    return false;
+  const provider = providers[option];
+  return provider.PKCEMethod !== undefined;
+};
+var isRefreshableOAuth2Client = (providerName, _client) => isRefreshableProviderOption(providerName);
+var isRefreshableProviderOption = (option) => {
+  if (!isValidProviderOption(option))
+    return false;
+  const provider = providers[option];
+  return provider.isRefreshable;
+};
+var isRevocableOAuth2Client = (providerName, _client) => isRevocableProviderOption(providerName);
+var isRevocableProviderOption = (option) => {
+  if (!isValidProviderOption(option))
+    return false;
+  const provider = providers[option];
+  return provider.revocationRequest !== undefined;
+};
+var isScopeRequiredProviderOption = (option) => {
+  if (!isValidProviderOption(option))
+    return false;
+  const provider = providers[option];
+  return provider.scopeRequired;
+};
+var isValidProviderOption = (option) => Object.hasOwn(providers, option);
+var createOAuth2FetchError = async (response) => {
+  const clone = response.clone();
+  const prefix = `HTTP ${response.status} ${response.statusText} for ${response.url}`;
+  const payload = await response.json().catch(() => null);
+  if (payload && typeof payload === "object" && Object.keys(payload).length) {
+    return new Error(`${prefix}
+${JSON.stringify(payload)}`);
+  }
+  const text = await clone.text().catch(() => "");
+  if (text) {
+    return new Error(`${prefix}
+${text}`);
+  }
+  return new Error(prefix);
+};
+var createOAuth2Request = ({
+  url,
+  body,
+  authIn,
+  headers,
+  encoding,
+  clientId,
+  clientSecret
+}) => {
+  const oauthHeaders = new Headers(headers);
+  oauthHeaders.set("Accept", "application/json");
+  oauthHeaders.set("User-Agent", "citra");
+  if (authIn === "header") {
+    if (!clientSecret) {
+      throw new Error("clientSecret required for header auth");
+    }
+    oauthHeaders.set("Authorization", `Basic ${encodeBase64(`${clientId}:${clientSecret}`)}`);
+  }
+  if (encoding === "application/json") {
+    oauthHeaders.set("Content-Type", "application/json");
+    return new Request(url, {
+      body: JSON.stringify(body),
+      headers: oauthHeaders,
+      method: "POST"
+    });
+  }
+  oauthHeaders.set("Content-Type", "application/x-www-form-urlencoded");
+  const entries = body instanceof URLSearchParams ? Array.from(body.entries()) : Object.entries(body).filter((entry) => typeof entry[1] === "string");
+  const params = new URLSearchParams(entries);
+  if (authIn === "body") {
+    params.set("client_id", clientId);
+    clientSecret && params.set("client_secret", clientSecret);
+  }
+  return new Request(url, {
+    body: params.toString(),
+    headers: oauthHeaders,
+    method: "POST"
+  });
+};
+var decodeBase64 = (input, toUint8Array = false) => {
+  const b64 = input.replace(/-/g, "+").replace(/_/g, "/") + "==".slice(0, (BASE64_BLOCK_SIZE - input.length % BASE64_BLOCK_SIZE) % BASE64_BLOCK_SIZE);
+  const raw = atob(b64);
+  if (!toUint8Array) {
+    return raw;
+  }
+  const bytes = new Uint8Array(raw.length);
+  for (let i = 0;i < raw.length; i++) {
+    bytes[i] = raw.charCodeAt(i);
+  }
+  return bytes;
+};
+var decodeJWT = (tokenString) => {
+  const [headerSegment, payloadSegment, signatureSegment] = tokenString.split(".");
+  if (!headerSegment || !payloadSegment || !signatureSegment) {
+    throw new Error("Invalid JWT format");
+  }
+  const decodedPayload = decodeBase64(payloadSegment);
+  if (typeof decodedPayload !== "string") {
+    throw new Error("Expected JWT payload to be a UTF-8 string");
+  }
+  const claims = JSON.parse(decodedPayload);
+  return claims;
+};
+var encodeBase64 = (input) => {
+  let raw;
+  if (typeof input === "string") {
+    raw = input;
+  } else {
+    const bytes = input instanceof Uint8Array ? input : new Uint8Array(input);
+    raw = bytes.reduce((acc, byte) => acc + String.fromCharCode(byte), "");
+  }
+  return btoa(raw);
+};
+var getWithingsProps = async (config) => {
+  const timestamp = Math.floor(Date.now() / 1000);
+  const signature = `getnonce,${config.clientId},${timestamp}`;
+  const hashedSignature = await hmacSha256(signature, config.clientSecret);
+  const nonceUrl = new URL("https://wbsapi.withings.net/v2/signature");
+  nonceUrl.searchParams.set("action", "getnonce");
+  nonceUrl.searchParams.set("client_id", config.clientId);
+  nonceUrl.searchParams.set("timestamp", timestamp.toString());
+  nonceUrl.searchParams.set("signature", hashedSignature);
+  const nonceTarget = nonceUrl.toString();
+  const nonceResponse = await fetch(nonceTarget, { method: "POST" });
+  const nonceData = await nonceResponse.json();
+  if (nonceData.status === 0) {
+    return {
+      hashedSignature,
+      nonce: nonceData.body.nonce
+    };
+  }
+  return;
+};
+var hmacSha256 = async (message, secret) => {
+  const encoder = new TextEncoder;
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { hash: "SHA-256", name: "HMAC" }, false, ["sign"]);
+  const sigBuffer = await crypto.subtle.sign("HMAC", key, encoder.encode(message));
+  return Array.from(new Uint8Array(sigBuffer)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
+};
+var extractPropFromIdentity = (identity, keys, propType) => {
+  let value = identity;
+  for (const key of keys) {
+    if (Array.isArray(value))
+      value = value[Number(key)];
+    if (!isObject(value)) {
+      throw new Error(`Invalid identity data shape: expected object, got ${typeof value}`);
+    }
+    value = value[key];
+  }
+  if (propType !== undefined && !isExpectedType(value, propType)) {
+    throw new Error(`Invalid identity data shape: expected ${propType}, got ${typeof value}`);
+  }
+  return value;
+};
+var getProviderSubjectKeys = (providerConfiguration, source) => providerConfiguration.subjectBySource?.[source] ?? providerConfiguration.subject;
+var setPropInIdentity = (identity, keys, value) => {
+  if (keys.length === 0) {
+    return identity;
+  }
+  let cursor = identity;
+  for (const key of keys.slice(0, -1)) {
+    const next = cursor[key];
+    cursor[key] = isObject(next) ? next : {};
+    cursor = cursor[key];
+  }
+  cursor[keys[keys.length - 1]] = value;
+  return identity;
+};
+var normalizeProviderIdentity = ({
+  identity,
+  providerConfiguration,
+  source
+}) => {
+  const sourceKeys = getProviderSubjectKeys(providerConfiguration, source);
+  const canonicalKeys = providerConfiguration.subject;
+  if (sourceKeys.join(".") === canonicalKeys.join(".")) {
+    return identity;
+  }
+  const subject = extractPropFromIdentity(identity, sourceKeys, providerConfiguration.subjectType);
+  const normalizedIdentity = structuredClone(identity);
+  return setPropInIdentity(normalizedIdentity, canonicalKeys, subject);
+};
+var createS256CodeChallenge = async (codeVerifier) => {
+  const data = new TextEncoder().encode(codeVerifier);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+  return base64Url(hashBuffer);
+};
+var createRandomBase64UrlGenerator = (length) => () => {
+  const buffer = crypto.getRandomValues(new Uint8Array(length));
+  return base64Url(buffer);
+};
+var generateCodeVerifier = createRandomBase64UrlGenerator(NUM_GENERATOR_BYTES);
+var generateState = createRandomBase64UrlGenerator(NUM_GENERATOR_BYTES);
+var base64Url = (input) => encodeBase64(input).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+var ALG_ES256 = "ES256";
+var ALG_RS256 = "RS256";
+var CLOCK_SKEW_SECONDS = 60;
+var DEFAULT_SCOPES = ["openid", "email", "profile"];
+var JWKS_REFETCH_COOLDOWN_MS = 60000;
+var JWT_SEGMENT_COUNT = 3;
+var MILLISECONDS_PER_SECOND = 1000;
+var trimTrailingSlash = (value) => value.endsWith("/") ? value.slice(0, -1) : value;
+var fetchJson = async (url) => {
+  const response = await fetch(url, {
+    headers: { accept: "application/json" }
+  });
+  if (!response.ok) {
+    throw new Error(`Request to ${url} failed with status ${response.status}`);
+  }
+  return response.json();
+};
+var decodeJsonSegment = (segment) => {
+  const decoded = decodeBase64(segment);
+  if (typeof decoded !== "string") {
+    throw new Error("Expected a base64url-encoded JWT segment");
+  }
+  const parsed = JSON.parse(decoded);
+  if (typeof parsed !== "object" || parsed === null) {
+    throw new Error("Expected a JWT segment to decode to a JSON object");
+  }
+  return parsed;
+};
+var importVerificationKey = (jwk, alg) => {
+  if (alg === ALG_RS256) {
+    return crypto.subtle.importKey("jwk", jwk, { hash: "SHA-256", name: "RSASSA-PKCS1-v1_5" }, false, ["verify"]);
+  }
+  if (alg === ALG_ES256) {
+    return crypto.subtle.importKey("jwk", jwk, { name: "ECDSA", namedCurve: "P-256" }, false, ["verify"]);
+  }
+  throw new Error(`Unsupported id_token signing algorithm "${alg}"`);
+};
+var verifySignature = (key, alg, signingInput, signature) => {
+  const algorithm = alg === ALG_ES256 ? { hash: "SHA-256", name: "ECDSA" } : { name: "RSASSA-PKCS1-v1_5" };
+  return crypto.subtle.verify(algorithm, key, new Uint8Array(signature), new TextEncoder().encode(signingInput));
+};
+var selectKey = (jwks, kid) => jwks.find((jwk) => kid === undefined || jwk.kid === kid);
+var assertClaims = (payload, expected) => {
+  const aud = Reflect.get(payload, "aud");
+  const exp = Reflect.get(payload, "exp");
+  const iss = Reflect.get(payload, "iss");
+  const sub = Reflect.get(payload, "sub");
+  const audiences = Array.isArray(aud) ? aud : [aud];
+  const nowSeconds = Math.floor(Date.now() / MILLISECONDS_PER_SECOND);
+  if (iss !== expected.issuer) {
+    throw new Error('id_token "iss" does not match the provider issuer');
+  }
+  if (typeof sub !== "string" || sub.length === 0) {
+    throw new Error('id_token is missing "sub"');
+  }
+  if (!audiences.includes(expected.audience)) {
+    throw new Error('id_token "aud" does not include the client id');
+  }
+  if (typeof exp !== "number" || exp + CLOCK_SKEW_SECONDS < nowSeconds) {
+    throw new Error("id_token has expired");
+  }
+  if (expected.nonce !== undefined && Reflect.get(payload, "nonce") !== expected.nonce) {
+    throw new Error('id_token "nonce" does not match');
+  }
+  const claims = { ...payload, aud, exp, iss, sub };
+  return claims;
+};
+var verifyIdToken = async ({
+  audience,
+  idToken,
+  issuer,
+  jwks,
+  nonce
+}) => {
+  const segments = idToken.split(".");
+  const [headerSegment, payloadSegment, signatureSegment] = segments;
+  if (segments.length !== JWT_SEGMENT_COUNT || headerSegment === undefined || payloadSegment === undefined || signatureSegment === undefined) {
+    throw new Error("Invalid id_token: expected three segments");
+  }
+  const header = decodeJsonSegment(headerSegment);
+  const alg = Reflect.get(header, "alg");
+  const kid = Reflect.get(header, "kid");
+  if (typeof alg !== "string") {
+    throw new Error('id_token header is missing "alg"');
+  }
+  const jwk = selectKey(jwks, typeof kid === "string" ? kid : undefined);
+  if (jwk === undefined) {
+    throw new Error('No JWKS key matches the id_token "kid"');
+  }
+  const key = await importVerificationKey(jwk, alg);
+  const signature = decodeBase64(signatureSegment, true);
+  if (typeof signature === "string") {
+    throw new Error("Failed to decode the id_token signature");
+  }
+  const isValid = await verifySignature(key, alg, `${headerSegment}.${payloadSegment}`, signature);
+  if (!isValid) {
+    throw new Error("id_token signature verification failed");
+  }
+  return assertClaims(decodeJsonSegment(payloadSegment), {
+    audience,
+    issuer,
+    nonce
+  });
+};
+var toDiscoveryDocument = (value, expectedIssuer) => {
+  if (typeof value !== "object" || value === null) {
+    throw new Error("OIDC discovery document is not a JSON object");
+  }
+  const issuer = Reflect.get(value, "issuer");
+  const authorizationEndpoint = Reflect.get(value, "authorization_endpoint");
+  const tokenEndpoint = Reflect.get(value, "token_endpoint");
+  const jwksUri = Reflect.get(value, "jwks_uri");
+  const userinfoEndpoint = Reflect.get(value, "userinfo_endpoint");
+  if (typeof issuer !== "string" || typeof authorizationEndpoint !== "string" || typeof tokenEndpoint !== "string" || typeof jwksUri !== "string") {
+    throw new Error("OIDC discovery document is missing required endpoints");
+  }
+  if (trimTrailingSlash(issuer) !== trimTrailingSlash(expectedIssuer)) {
+    throw new Error(`OIDC discovery issuer "${issuer}" does not match configured issuer "${expectedIssuer}"`);
+  }
+  return {
+    authorization_endpoint: authorizationEndpoint,
+    issuer,
+    jwks_uri: jwksUri,
+    token_endpoint: tokenEndpoint,
+    userinfo_endpoint: typeof userinfoEndpoint === "string" ? userinfoEndpoint : undefined
+  };
+};
+var fetchDiscoveryDocument = async (issuer) => {
+  const base = trimTrailingSlash(issuer);
+  const document = await fetchJson(`${base}/.well-known/openid-configuration`);
+  return toDiscoveryDocument(document, issuer);
+};
+var fetchJwks = async (jwksUri) => {
+  const body = await fetchJson(jwksUri);
+  const value = Reflect.get(body ?? {}, "keys");
+  if (!Array.isArray(value)) {
+    throw new Error('JWKS response is missing a "keys" array');
+  }
+  const keys = value;
+  return keys;
+};
+var createOIDCClient = async (config) => {
+  const discovery = await fetchDiscoveryDocument(config.issuer);
+  const scopes = config.scopes !== undefined && config.scopes.length > 0 ? config.scopes : DEFAULT_SCOPES;
+  let cachedJwks;
+  let jwksFetchedAtMs = 0;
+  const resolveJwks = async (forceRefresh) => {
+    const isStale = Date.now() - jwksFetchedAtMs > JWKS_REFETCH_COOLDOWN_MS;
+    if (cachedJwks === undefined || forceRefresh && isStale) {
+      cachedJwks = await fetchJwks(discovery.jwks_uri);
+      jwksFetchedAtMs = Date.now();
+    }
+    return cachedJwks;
+  };
+  const createAuthorizationUrl = async (options) => {
+    const url = new URL(discovery.authorization_endpoint);
+    const challenge = await createS256CodeChallenge(options.codeVerifier);
+    const { searchParams } = url;
+    searchParams.set("client_id", config.clientId);
+    searchParams.set("code_challenge", challenge);
+    searchParams.set("code_challenge_method", "S256");
+    searchParams.set("redirect_uri", config.redirectUri);
+    searchParams.set("response_type", "code");
+    searchParams.set("scope", (options.scope ?? scopes).join(" "));
+    searchParams.set("state", options.state);
+    if (options.nonce !== undefined) {
+      searchParams.set("nonce", options.nonce);
+    }
+    return url;
+  };
+  const validateAuthorizationCode = async (options) => {
+    const body = new URLSearchParams;
+    body.set("client_id", config.clientId);
+    body.set("client_secret", config.clientSecret);
+    body.set("code", options.code);
+    body.set("code_verifier", options.codeVerifier);
+    body.set("grant_type", "authorization_code");
+    body.set("redirect_uri", config.redirectUri);
+    const response = await fetch(discovery.token_endpoint, {
+      body,
+      headers: {
+        accept: "application/json",
+        "content-type": "application/x-www-form-urlencoded"
+      },
+      method: "POST"
+    });
+    if (!response.ok) {
+      throw new Error(`OIDC token request failed with status ${response.status}`);
+    }
+    const tokens = await response.json();
+    return tokens;
+  };
+  const verifyToken = async (idToken, options) => {
+    const jwks = await resolveJwks(false);
+    const params = {
+      audience: config.clientId,
+      idToken,
+      issuer: discovery.issuer,
+      nonce: options?.nonce
+    };
+    try {
+      return await verifyIdToken({ ...params, jwks });
+    } catch (error) {
+      const refreshed = await resolveJwks(true);
+      if (refreshed === jwks)
+        throw error;
+      return verifyIdToken({ ...params, jwks: refreshed });
+    }
+  };
+  const fetchUserProfile = async (accessToken) => {
+    if (discovery.userinfo_endpoint === undefined) {
+      throw new Error("OIDC provider does not expose a userinfo endpoint");
+    }
+    const response = await fetch(discovery.userinfo_endpoint, {
+      headers: {
+        accept: "application/json",
+        authorization: `Bearer ${accessToken}`
+      }
+    });
+    if (!response.ok) {
+      throw new Error(`OIDC userinfo request failed with status ${response.status}`);
+    }
+    const profile = await response.json();
+    return profile;
+  };
+  return {
+    createAuthorizationUrl,
+    discovery,
+    fetchUserProfile,
+    validateAuthorizationCode,
+    verifyIdToken: verifyToken
+  };
+};
+var oidcProviderOptions = Object.keys(providers).filter(isOIDCProviderOption);
+var pkceProviderOptions = Object.keys(providers).filter(isPKCEProviderOption);
+var providerOptions = Object.keys(providers).filter(isValidProviderOption);
+var refreshableProviderOptions = Object.keys(providers).filter(isRefreshableProviderOption);
+var revocableProviderOptions = Object.keys(providers).filter(isRevocableProviderOption);
+var scopeRequiredProviderOptions = Object.keys(providers).filter(isScopeRequiredProviderOption);
+var readPath = (value, path) => path.reduce((cursor, key) => cursor && typeof cursor === "object" ? Reflect.get(cursor, key) : undefined, value);
+var buildOAuth2Client = async (meta, config) => {
+  const isConfigPropertyFunction = (cfgProp) => typeof cfgProp === "function";
+  const resolveConfigProp = async (cfgProp) => {
+    const result = isConfigPropertyFunction(cfgProp) ? cfgProp(config) : cfgProp;
+    return result;
+  };
+  const authorizationUrl = await resolveConfigProp(meta.authorizationUrl);
+  const tokenUrl = await resolveConfigProp(meta.tokenRequest.url);
+  return {
+    async createAuthorizationUrl(opts) {
+      const { state, scope = [], searchParams = [], codeVerifier } = opts;
+      const url = new URL(authorizationUrl);
+      url.searchParams.set("response_type", "code");
+      url.searchParams.set("client_id", config.clientId);
+      if (config.redirectUri)
+        url.searchParams.set("redirect_uri", config.redirectUri);
+      if (state)
+        url.searchParams.set("state", state);
+      if (scope.length !== 0) {
+        url.searchParams.set(meta.scopeParamName ?? "scope", scope.join(meta.scopeDelimiter ?? " "));
+      }
+      if (meta.PKCEMethod !== undefined) {
+        if (!codeVerifier) {
+          throw new Error("`codeVerifier` is required when PKCE is enabled");
+        }
+        const codeChallenge = meta.PKCEMethod === "S256" ? await createS256CodeChallenge(codeVerifier) : codeVerifier;
+        url.searchParams.set("code_challenge_method", meta.PKCEMethod);
+        url.searchParams.set("code_challenge", codeChallenge);
+      }
+      Object.entries(resolveConfigProp(meta.createAuthorizationURLSearchParams) ?? {}).forEach(([key, value]) => url.searchParams.set(key, value));
+      searchParams.forEach(([key, value]) => url.searchParams.set(key, value));
+      return url;
+    },
+    async fetchUserProfile(accessToken) {
+      const { profileRequest } = meta;
+      if (!profileRequest) {
+        throw new Error("OIDC provider exposes identity through the id_token and does not define a UserInfo endpoint");
+      }
+      const {
+        url,
+        method,
+        authIn,
+        searchParams,
+        body: profileBody,
+        headers,
+        encoding
+      } = profileRequest;
+      const endpoint = new URL(await resolveConfigProp(url));
+      const resolvedBody = await resolveConfigProp(profileBody);
+      new URLSearchParams(await resolveConfigProp(searchParams)).forEach((value, key) => endpoint.searchParams.append(key, value));
+      let headerEntries = [];
+      const rawHeaders = headers ? await resolveConfigProp(headers) : undefined;
+      if (rawHeaders instanceof Headers)
+        headerEntries = Array.from(rawHeaders.entries());
+      else if (Array.isArray(rawHeaders))
+        headerEntries = rawHeaders;
+      else if (rawHeaders && typeof rawHeaders === "object")
+        headerEntries = Object.entries(rawHeaders);
+      const profileHeaders = Object.fromEntries(headerEntries.filter(([, value]) => value !== ""));
+      if (authIn === "header") {
+        profileHeaders.Authorization = `Bearer ${accessToken}`;
+      } else if (authIn === "path") {
+        endpoint.pathname = `${endpoint.pathname.replace(/\/+$/, "")}/${accessToken}`;
+      } else {
+        endpoint.searchParams.append("access_token", accessToken);
+      }
+      const init = { headers: profileHeaders, method };
+      if (method === "POST" && resolvedBody !== undefined) {
+        profileHeaders["Content-Type"] = encoding;
+        init.body = encoding === "application/json" ? JSON.stringify(resolvedBody) : new URLSearchParams(resolvedBody).toString();
+      }
+      const profileTarget = endpoint.toString();
+      const response = await fetch(profileTarget, init);
+      if (!response.ok)
+        throw await createOAuth2FetchError(response);
+      return response.json();
+    },
+    async refreshAccessToken(refreshToken) {
+      const { authIn, encoding } = meta.tokenRequest;
+      const params = new URLSearchParams(meta.refreshAccessTokenBody);
+      params.set("grant_type", "refresh_token");
+      params.set("refresh_token", refreshToken);
+      const { clientId } = config;
+      let clientSecretValue;
+      if (hasClientSecret(config)) {
+        clientSecretValue = config.clientSecret;
+        params.set("client_id", clientId);
+        params.set("client_secret", clientSecretValue);
+      }
+      const request = createOAuth2Request({
+        authIn,
+        body: params,
+        clientId,
+        clientSecret: clientSecretValue,
+        encoding,
+        url: tokenUrl
+      });
+      const response = await fetch(request);
+      if (!response.ok)
+        throw await createOAuth2FetchError(response);
+      return response.json();
+    },
+    async revokeToken(token) {
+      const { revocationRequest } = meta;
+      if (!revocationRequest) {
+        throw new Error("Token revocation not defined for this provider");
+      }
+      const { url, authIn, body, headers, tokenParamName } = revocationRequest;
+      const endpoint = await resolveConfigProp(url);
+      const resolvedBody = await resolveConfigProp(body);
+      const revocationBody = new URLSearchParams(resolvedBody);
+      const revocationHeaders = new Headers(headers && await resolveConfigProp(headers));
+      const { clientId } = config;
+      const clientSecret = hasClientSecret(config) ? config.clientSecret : undefined;
+      let request;
+      if (authIn === "body") {
+        revocationBody.set(tokenParamName, token);
+        revocationBody.set("client_id", clientId);
+        if (clientSecret)
+          revocationBody.set("client_secret", clientSecret);
+        request = createOAuth2Request({
+          authIn: "body",
+          body: revocationBody,
+          clientId,
+          clientSecret,
+          encoding: "application/x-www-form-urlencoded",
+          headers: revocationHeaders,
+          url: endpoint.toString()
+        });
+      } else if (authIn === "header") {
+        revocationHeaders.set("Authorization", `Bearer ${token}`);
+        request = createOAuth2Request({
+          authIn: "header",
+          body: revocationBody,
+          clientId,
+          clientSecret,
+          encoding: "application/x-www-form-urlencoded",
+          headers: revocationHeaders,
+          url: endpoint.toString()
+        });
+      } else {
+        request = createOAuth2Request({
+          authIn: "query",
+          body: revocationBody,
+          clientId,
+          clientSecret,
+          encoding: "application/x-www-form-urlencoded",
+          headers: revocationHeaders,
+          url: `${endpoint.toString()}?${tokenParamName}=${token}`
+        });
+      }
+      const response = await fetch(request);
+      if (!response.ok)
+        throw await createOAuth2FetchError(response);
+    },
+    async validateAuthorizationCode(opts) {
+      const { code, codeVerifier } = opts;
+      const { authIn, encoding } = meta.tokenRequest;
+      const bodyObj = {};
+      for (const key in meta.validateAuthorizationCodeBody ?? {}) {
+        const value = meta.validateAuthorizationCodeBody[key];
+        if (typeof value === "string")
+          bodyObj[key] = value;
+      }
+      bodyObj.grant_type = "authorization_code";
+      bodyObj.code = code;
+      if (config.redirectUri)
+        bodyObj.redirect_uri = config.redirectUri;
+      if (meta.PKCEMethod !== undefined) {
+        if (!codeVerifier) {
+          throw new Error("codeVerifier required when PKCE is enabled");
+        }
+        bodyObj.code_verifier = codeVerifier;
+      }
+      const payload = encoding === "application/json" ? bodyObj : new URLSearchParams(bodyObj);
+      const request = createOAuth2Request({
+        authIn,
+        body: payload,
+        clientId: config.clientId,
+        clientSecret: hasClientSecret(config) ? config.clientSecret : undefined,
+        encoding,
+        url: tokenUrl
+      });
+      const response = await fetch(request);
+      if (!response.ok)
+        throw await createOAuth2FetchError(response);
+      const tokenResponse = await response.json();
+      if (!tokenResponse || typeof tokenResponse !== "object") {
+        throw new Error("OAuth token endpoint returned a non-object response");
+      }
+      const oauthError = Reflect.get(tokenResponse, "error");
+      if (typeof oauthError === "string" && oauthError.length > 0) {
+        throw new Error(`OAuth token exchange failed: ${oauthError}`);
+      }
+      const nestedToken = meta.accessTokenPath ? readPath(tokenResponse, meta.accessTokenPath) : undefined;
+      if (typeof nestedToken === "string" && nestedToken.length > 0 && tokenResponse && typeof tokenResponse === "object") {
+        tokenResponse.access_token = nestedToken;
+      }
+      const accessToken = Reflect.get(tokenResponse, "access_token");
+      if (typeof accessToken !== "string" || accessToken.length === 0) {
+        throw new Error("OAuth token endpoint returned no access_token");
+      }
+      return tokenResponse;
+    }
+  };
+};
+var createCustomOAuth2Client = (providerConfig, credentials) => buildOAuth2Client(providerConfig, credentials);
+var createOAuth2Client = (providerName, config) => buildOAuth2Client(providers[providerName], config);
+
+// src/providers/clients.ts
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isProviderClientConfig = (value) => isRecord(value) && ("credentials" in value);
+var isCustomClientConfig = (value) => isRecord(value) && ("credentials" in value) && ("providerConfig" in value);
+var normalizeCustomClients = (providerName, providerConfig) => {
+  if (isCustomClientConfig(providerConfig))
+    return { "": providerConfig };
+  if (!isRecord(providerConfig) || Object.keys(providerConfig).length === 0) {
+    throw new Error(`Invalid custom provider configuration for ${providerName}`);
+  }
+  Object.entries(providerConfig).forEach(([clientName, clientConfig]) => {
+    if (!isCustomClientConfig(clientConfig)) {
+      throw new Error(`Invalid custom client configuration for ${providerName}.${clientName}`);
+    }
+  });
+  return providerConfig;
+};
+var buildCustomProviderGroups = async (customProviders) => {
+  const groups = await Promise.all(Object.entries(customProviders).map(async ([providerName, config]) => {
+    if (isValidProviderOption(providerName)) {
+      throw new Error(`Custom provider "${providerName}" collides with a built-in provider \u2014 configure it under providersConfiguration instead`);
+    }
+    const clients = normalizeCustomClients(providerName, config);
+    const entries = await Promise.all(Object.entries(clients).map(async ([clientName, clientConfig]) => {
+      const providerInstance = await createCustomOAuth2Client(clientConfig.providerConfig, clientConfig.credentials);
+      return [
+        clientName,
+        {
+          clientName: clientName.length > 0 ? clientName : undefined,
+          providerConfiguration: clientConfig.providerConfig,
+          providerInstance,
+          requiresPKCE: clientConfig.providerConfig.PKCEMethod !== undefined,
+          scope: clientConfig.scope,
+          searchParams: clientConfig.searchParams
+        }
+      ];
+    }));
+    return [
+      providerName,
+      {
+        entries: Object.fromEntries(entries),
+        isSingleClient: entries.length === 1 && entries[0]?.[0] === ""
+      }
+    ];
+  }));
+  return Object.fromEntries(groups);
+};
+var buildClientProviders = async (providersConfiguration, createOAuth2ClientFn, customProviders) => {
+  const customGroups = customProviders ? await buildCustomProviderGroups(customProviders) : {};
+  const normalized = normalizeProvidersConfiguration(providersConfiguration);
+  const groups = await Promise.all(Object.entries(normalized).map(async ([providerName, clients]) => {
+    if (!isValidProviderOption(providerName)) {
+      throw new Error(`Invalid provider configuration for ${providerName}`);
+    }
+    const entries = await Promise.all(Object.entries(clients).map(async ([clientName, providerConfig]) => {
+      const providerInstance = await createOAuth2ClientFn(providerName, providerConfig.credentials);
+      return [
+        clientName,
+        {
+          clientName: clientName.length > 0 ? clientName : undefined,
+          providerConfiguration: providers[providerName],
+          providerInstance,
+          requiresPKCE: providers[providerName].PKCEMethod !== undefined,
+          scope: providerConfig.scope,
+          searchParams: providerConfig.searchParams
+        }
+      ];
+    }));
+    return [
+      providerName,
+      {
+        entries: Object.fromEntries(entries),
+        isSingleClient: entries.length === 1 && entries[0]?.[0] === ""
+      }
+    ];
+  }));
+  return { ...customGroups, ...Object.fromEntries(groups) };
+};
+var normalizeClientConfig = (providerName, clientName, clientConfig) => {
+  if (!isProviderClientConfig(clientConfig)) {
+    throw new Error(`Invalid client configuration for ${providerName}.${clientName}`);
+  }
+  return [clientName, clientConfig];
+};
+var normalizeProviderClients = (providerName, providerConfig) => {
+  if (isProviderClientConfig(providerConfig)) {
+    return { "": providerConfig };
+  }
+  if (!isRecord(providerConfig) || Object.keys(providerConfig).length === 0) {
+    throw new Error(`Invalid provider configuration for ${providerName}`);
+  }
+  return Object.fromEntries(Object.entries(providerConfig).map(([clientName, clientConfig]) => normalizeClientConfig(providerName, clientName, clientConfig)));
+};
+var normalizeProvidersConfiguration = (providersConfiguration) => {
+  const entries = Object.entries(providersConfiguration).flatMap(([providerName, providerConfig]) => {
+    if (!isValidProviderOption(providerName) || !providerConfig) {
+      return [];
+    }
+    return [
+      [
+        providerName,
+        normalizeProviderClients(providerName, providerConfig)
+      ]
+    ];
+  });
+  return Object.fromEntries(entries);
+};
+var resolveClientProviderEntry = ({
+  clientName,
+  clientProviders,
+  providerName
+}) => {
+  if (!providerName) {
+    return { error: "Provider is required" };
+  }
+  const group = clientProviders[providerName];
+  if (!group) {
+    return { error: "Client provider not found" };
+  }
+  if (group.isSingleClient) {
+    const entry2 = group.entries[""];
+    if (!entry2) {
+      return { error: "Client provider not found" };
+    }
+    return { entry: entry2 };
+  }
+  const requestedClient = clientName?.trim();
+  if (!requestedClient) {
+    return { error: "Client variant is required" };
+  }
+  const entry = group.entries[requestedClient];
+  if (!entry) {
+    return { error: "Client variant not found" };
+  }
+  return { entry };
+};
+var resolveProviderClientConfiguration = ({
+  clientName,
+  providerName,
+  providersConfiguration
+}) => {
+  const normalized = normalizeProvidersConfiguration(providersConfiguration);
+  const clients = normalized[providerName];
+  if (!clients) {
+    return { error: "Client provider not found" };
+  }
+  const keys = Object.keys(clients);
+  if (keys.length === 1 && keys[0] === "") {
+    return { config: clients[""] };
+  }
+  const requestedClient = clientName?.trim();
+  if (!requestedClient) {
+    return { error: "Client variant is required" };
+  }
+  const config = clients[requestedClient];
+  if (!config) {
+    return { error: "Client variant not found" };
+  }
+  return { config };
+};
+
+// src/linkedProviders/resolver.ts
+var uniqueStrings = (values) => [...new Set(values)];
+var getEffectiveScopes = (grant, binding) => {
+  if (binding.availableScopes.length === 0) {
+    return uniqueStrings(grant.grantedScopes);
+  }
+  const bindingScopeSet = new Set(binding.availableScopes);
+  return uniqueStrings(grant.grantedScopes.filter((scope) => bindingScopeSet.has(scope)));
+};
+var hasRequiredScopes = (availableScopes, requiredScopes) => (requiredScopes ?? []).every((scope) => availableScopes.includes(scope));
+var isGrantUsable = (grant) => grant.status === "active" || grant.status === "refresh_required";
+var isBindingUsable = (binding) => binding.status === "active";
+var needsRefresh = (lease, now, minValidityMs) => {
+  if (!lease)
+    return true;
+  if (lease.expiresAt === undefined)
+    return false;
+  return lease.expiresAt <= now + (minValidityMs ?? 0);
+};
+var ensureLeaseScopes = (lease, requiredScopes) => {
+  if (!hasRequiredScopes(lease.grantedScopes, requiredScopes)) {
+    throw new Error("Linked provider access token lease is missing required scopes");
+  }
+};
+var ensureLeaseValidity = (lease, now, minValidityMs) => {
+  if (lease.expiresAt === undefined)
+    return;
+  if (lease.expiresAt <= now + (minValidityMs ?? 0)) {
+    throw new Error("Linked provider access token lease does not satisfy minimum validity");
+  }
+};
+var buildResolvedCredential = (grant, binding) => ({
+  authProviderKey: grant.authProviderKey,
+  bindingId: binding.id,
+  capabilities: binding.capabilities ? [...binding.capabilities] : undefined,
+  connectorProvider: binding.connectorProvider,
+  email: binding.email,
+  externalAccountId: binding.externalAccountId,
+  externalAccountType: binding.externalAccountType,
+  grantId: grant.id,
+  label: binding.label,
+  metadata: {
+    ...grant.metadata ?? {},
+    ...binding.metadata ?? {}
+  },
+  ownerRef: grant.ownerRef,
+  providerFamily: grant.providerFamily,
+  scopes: getEffectiveScopes(grant, binding),
+  username: binding.username
+});
+var annotateFailureMetadata = (metadata, report, now) => ({
+  ...metadata ?? {},
+  lastCredentialFailureAt: now,
+  lastCredentialFailureCode: report.code,
+  lastCredentialFailureMessage: report.message,
+  lastCredentialFailureRetryAt: report.retryAt
+});
+var sortNewestFirst = (items) => [...items].sort((left, right) => right.updatedAt - left.updatedAt);
+var resolveGrantFailureStatus = (grant, report) => {
+  if (report.code === "unauthorized" || report.code === "revoked") {
+    return "revoked";
+  }
+  return grant.status;
+};
+var resolveBindingFailureStatus = (binding, report) => {
+  if (report.code === "unauthorized" || report.code === "revoked") {
+    return "disconnected";
+  }
+  if (report.code === "insufficient_scope") {
+    return "restricted";
+  }
+  return binding.status;
+};
+var buildNextGrant = (grant, report, currentTime) => ({
+  ...grant,
+  lastRefreshError: report.message ?? report.code,
+  metadata: annotateFailureMetadata(grant.metadata, report, currentTime),
+  status: resolveGrantFailureStatus(grant, report),
+  updatedAt: currentTime
+});
+var buildNextBinding = (binding, report, currentTime) => ({
+  ...binding,
+  metadata: annotateFailureMetadata(binding.metadata, report, currentTime),
+  status: resolveBindingFailureStatus(binding, report),
+  updatedAt: currentTime
+});
+var resolveBindingCredential = async (grantStore, binding, input) => {
+  const grant = await grantStore.getGrant(binding.grantId);
+  if (!grant || grant.ownerRef !== input.ownerRef || !isGrantUsable(grant)) {
+    return null;
+  }
+  const effectiveScopes = getEffectiveScopes(grant, binding);
+  if (!hasRequiredScopes(effectiveScopes, input.requiredScopes)) {
+    return null;
+  }
+  return buildResolvedCredential(grant, binding);
+};
+var createLinkedProviderCredentialResolver = ({
+  grantStore,
+  bindingStore,
+  loadAccessTokenLease,
+  refreshAccessTokenLease,
+  now = () => Date.now(),
+  onReportFailure
+}) => ({
+  getAccessToken: async (credential, input) => {
+    const binding = await bindingStore.getBinding(credential.bindingId);
+    if (!binding || !isBindingUsable(binding)) {
+      throw new Error("Linked provider binding is unavailable");
+    }
+    const grant = await grantStore.getGrant(credential.grantId);
+    if (!grant || !isGrantUsable(grant)) {
+      throw new Error("Linked provider grant is unavailable");
+    }
+    const requiredScopes = input?.requiredScopes;
+    const effectiveScopes = getEffectiveScopes(grant, binding);
+    if (!hasRequiredScopes(effectiveScopes, requiredScopes)) {
+      throw new Error("Linked provider credential is missing required scopes");
+    }
+    const currentTime = now();
+    let lease = await loadAccessTokenLease(grant);
+    if (needsRefresh(lease, currentTime, input?.minValidityMs)) {
+      if (!refreshAccessTokenLease) {
+        throw new Error("Linked provider access token lease requires refresh");
+      }
+      const refreshed = await refreshAccessTokenLease(grant, input);
+      if (!refreshed) {
+        throw new Error("Linked provider access token refresh failed");
+      }
+      await grantStore.saveGrant(refreshed.grant);
+      ({ lease } = refreshed);
+    }
+    if (!lease) {
+      throw new Error("Linked provider access token lease is unavailable");
+    }
+    ensureLeaseScopes(lease, requiredScopes);
+    ensureLeaseValidity(lease, currentTime, input?.minValidityMs);
+    return lease;
+  },
+  listBindings: async ({ ownerRef, connectorProvider, status }) => sortNewestFirst(await bindingStore.listBindingsByOwner(ownerRef)).filter((binding) => (connectorProvider === undefined || binding.connectorProvider === connectorProvider) && (status === undefined || binding.status === status)),
+  reportFailure: async (credential, report) => {
+    const currentTime = now();
+    const grant = await grantStore.getGrant(credential.grantId);
+    const binding = await bindingStore.getBinding(credential.bindingId);
+    if (grant) {
+      await grantStore.saveGrant(buildNextGrant(grant, report, currentTime));
+    }
+    if (binding) {
+      await bindingStore.saveBinding(buildNextBinding(binding, report, currentTime));
+    }
+    await onReportFailure?.({
+      binding: binding ?? undefined,
+      credential,
+      grant: grant ?? undefined,
+      report
+    });
+  },
+  resolveCredential: async (input) => {
+    const bindings = sortNewestFirst(await bindingStore.listBindingsByOwner(input.ownerRef)).filter((binding) => binding.connectorProvider === input.connectorProvider && isBindingUsable(binding) && (input.bindingId === undefined || binding.id === input.bindingId) && (input.externalAccountId === undefined || binding.externalAccountId === input.externalAccountId));
+    return bindings.reduce(async (pendingCredential, binding) => {
+      const credential = await pendingCredential;
+      if (credential)
+        return credential;
+      return resolveBindingCredential(grantStore, binding, input);
+    }, Promise.resolve(null));
+  }
+});
+
+// src/linkedProviders/oauthResolver.ts
+var getGrantedScopes = (scopeValue, fallbackScopes) => {
+  if (typeof scopeValue === "string" && scopeValue.trim().length > 0) {
+    return [...new Set(scopeValue.split(/\s+/).filter(Boolean))];
+  }
+  return [...new Set(fallbackScopes.filter(Boolean))];
+};
+var parseExpiresInSeconds = (expiresIn) => {
+  if (typeof expiresIn === "number") {
+    return expiresIn;
+  }
+  if (typeof expiresIn === "string" && expiresIn.trim().length > 0) {
+    return Number(expiresIn);
+  }
+  return Number.NaN;
+};
+var getExpiresAt = (tokenResponse) => {
+  const expiresInSeconds = parseExpiresInSeconds(tokenResponse.expires_in);
+  if (!Number.isFinite(expiresInSeconds) || expiresInSeconds <= 0) {
+    return;
+  }
+  return Date.now() + expiresInSeconds * 1000;
+};
+var buildClientEntry = (providerName, providersConfiguration) => {
+  if (!isValidProviderOption(providerName)) {
+    return null;
+  }
+  const resolvedProviderClientConfiguration = resolveProviderClientConfiguration({
+    providerName,
+    providersConfiguration
+  });
+  if ("error" in resolvedProviderClientConfiguration || !resolvedProviderClientConfiguration.config) {
+    return null;
+  }
+  return createOAuth2Client(providerName, resolvedProviderClientConfiguration.config.credentials).then((providerInstance) => [providerName, providerInstance]);
+};
+var createOAuthLinkedProviderCredentialResolver = async ({
+  bindingStore,
+  grantStore,
+  now,
+  providersConfiguration
+}) => {
+  const clientEntries = Object.keys(providersConfiguration).map((providerName) => buildClientEntry(providerName, providersConfiguration)).filter((entry) => entry !== null);
+  await Promise.all(clientEntries);
+  return createLinkedProviderCredentialResolver({
+    bindingStore,
+    grantStore,
+    now,
+    loadAccessTokenLease: async (grant) => grant.accessTokenCiphertext ? {
+      accessToken: grant.accessTokenCiphertext,
+      expiresAt: grant.expiresAt,
+      grantedScopes: grant.grantedScopes,
+      tokenType: grant.tokenType
+    } : null,
+    refreshAccessTokenLease: async (grant) => {
+      if (!isValidProviderOption(grant.authProviderKey) || !grant.refreshTokenCiphertext) {
+        return null;
+      }
+      const providerKey = grant.authProviderKey;
+      const providerClientName = typeof grant.metadata?.providerClient === "string" && grant.metadata.providerClient.trim().length > 0 ? grant.metadata.providerClient.trim() : undefined;
+      const resolvedProviderClientConfiguration = resolveProviderClientConfiguration({
+        clientName: providerClientName,
+        providerName: providerKey,
+        providersConfiguration
+      });
+      if ("error" in resolvedProviderClientConfiguration || !resolvedProviderClientConfiguration.config) {
+        return null;
+      }
+      const providerClient = await createOAuth2Client(providerKey, resolvedProviderClientConfiguration.config.credentials);
+      if (!providerClient || !isRefreshableOAuth2Client(providerKey, providerClient)) {
+        return null;
+      }
+      const tokenResponse = await providerClient.refreshAccessToken(grant.refreshTokenCiphertext);
+      const refreshedAt = Date.now();
+      const grantedScopes = getGrantedScopes(Reflect.get(tokenResponse, "scope"), grant.grantedScopes);
+      const tokenType = Reflect.get(tokenResponse, "token_type");
+      const refreshedGrant = {
+        ...grant,
+        accessTokenCiphertext: tokenResponse.access_token,
+        expiresAt: getExpiresAt(tokenResponse),
+        grantedScopes,
+        lastRefreshedAt: refreshedAt,
+        lastRefreshError: undefined,
+        refreshTokenCiphertext: tokenResponse.refresh_token ?? grant.refreshTokenCiphertext,
+        status: "active",
+        tokenType: typeof tokenType === "string" ? tokenType : grant.tokenType,
+        updatedAt: refreshedAt
+      };
+      return {
+        grant: refreshedGrant,
+        lease: {
+          accessToken: refreshedGrant.accessTokenCiphertext ?? "",
+          expiresAt: refreshedGrant.expiresAt,
+          grantedScopes: refreshedGrant.grantedScopes,
+          tokenType: refreshedGrant.tokenType
+        }
+      };
+    }
+  });
+};
+
+// src/linkedProviders/oauthAccountResolver.ts
+var bindingId = (accountId) => `oauth-account:${accountId}`;
+var accountIdFromBinding = (id) => {
+  const prefix = "oauth-account:";
+  return id.startsWith(prefix) ? id.slice(prefix.length) : null;
+};
+var toGrant = (account) => ({
+  accessTokenCiphertext: account.accessToken,
+  authProviderKey: account.authProviderKey,
+  createdAt: account.createdAt,
+  expiresAt: account.expiresAt,
+  grantedScopes: [...account.grantedScopes],
+  id: account.id,
+  metadata: account.metadata,
+  ownerRef: account.ownerRef,
+  providerFamily: account.authProviderKey,
+  providerSubject: account.providerSubject,
+  refreshTokenCiphertext: account.refreshToken,
+  status: account.status,
+  tokenType: account.tokenType,
+  updatedAt: account.updatedAt
+});
+var toBinding = (account) => ({
+  availableScopes: [...account.grantedScopes],
+  connectorProvider: account.authProviderKey,
+  createdAt: account.createdAt,
+  externalAccountId: account.providerSubject,
+  externalAccountType: "user",
+  grantId: account.id,
+  id: bindingId(account.id),
+  metadata: account.metadata,
+  status: account.status === "revoked" || account.status === "error" ? "disconnected" : "active",
+  updatedAt: account.updatedAt
+});
+var accountWithGrant = (account, grant) => ({
+  ...account,
+  accessToken: grant.accessTokenCiphertext,
+  authProviderKey: grant.authProviderKey,
+  expiresAt: grant.expiresAt,
+  grantedScopes: [...grant.grantedScopes],
+  metadata: grant.metadata,
+  ownerRef: grant.ownerRef,
+  providerSubject: grant.providerSubject,
+  refreshToken: grant.refreshTokenCiphertext,
+  status: grant.status,
+  tokenType: grant.tokenType,
+  updatedAt: grant.updatedAt
+});
+var accountStatusForBinding = (account, binding) => {
+  if (binding.status === "disconnected")
+    return "revoked";
+  if (binding.status === "restricted")
+    return "error";
+  return account.status;
+};
+var createOAuthAccountLinkedProviderCredentialResolver = async ({
+  accountStore,
+  now,
+  providersConfiguration
+}) => {
+  const grantStore = {
+    getGrant: async (id) => {
+      const account = await accountStore.getAccount(id);
+      return account ? toGrant(account) : undefined;
+    },
+    listGrantsByOwner: async (ownerRef) => (await accountStore.listAccountsByOwner(ownerRef)).map(toGrant),
+    saveGrant: async (grant) => {
+      const account = await accountStore.getAccount(grant.id);
+      if (!account)
+        throw new Error("OAuth linked account is unavailable");
+      await accountStore.saveAccount(accountWithGrant(account, grant));
+    }
+  };
+  const bindingStore = {
+    getBinding: async (id) => {
+      const accountId = accountIdFromBinding(id);
+      if (!accountId)
+        return;
+      const account = await accountStore.getAccount(accountId);
+      return account ? toBinding(account) : undefined;
+    },
+    listBindingsByGrant: async (grantId) => {
+      const account = await accountStore.getAccount(grantId);
+      return account ? [toBinding(account)] : [];
+    },
+    listBindingsByOwner: async (ownerRef) => (await accountStore.listAccountsByOwner(ownerRef)).map(toBinding),
+    saveBinding: async (binding) => {
+      const account = await accountStore.getAccount(binding.grantId);
+      if (!account)
+        throw new Error("OAuth linked account is unavailable");
+      await accountStore.saveAccount({
+        ...account,
+        metadata: binding.metadata,
+        status: accountStatusForBinding(account, binding),
+        updatedAt: binding.updatedAt
+      });
+    }
+  };
+  return createOAuthLinkedProviderCredentialResolver({
+    bindingStore,
+    grantStore,
+    ...now ? { now } : {},
+    providersConfiguration
+  });
+};
+export {
+  createOAuthLinkedProviderCredentialResolver,
+  createOAuthAccountLinkedProviderCredentialResolver,
+  createLinkedProviderCredentialResolver
+};
+
+//# debugId=B59DE2430BCDE3E764756E2164756E21
+//# sourceMappingURL=index.js.map