@argos-js/auth 0.0.0-stage → 0.1.0

package/dist/oauth/base.provider.js

@@ -0,0 +1,139 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BaseOAuthProvider = void 0;
+const pkce_js_1 = require("./pkce.js");
+class BaseOAuthProvider {
+    options;
+    constructor(options) {
+        this.options = { ...options };
+    }
+    get name() {
+        return this.constructor.name.replace(/Provider$/, '').toLowerCase();
+    }
+    /**
+     * Generates the authorization URL with PKCE (S256) and CSRF protection.
+     */
+    createAuthorizationUrl(options = {}) {
+        if (!this.options.authorizationUrl) {
+            throw new Error(`Provider "${this.name}" does not have an authorizationUrl configured`);
+        }
+        const pkce = options.codeVerifier
+            ? {
+                codeVerifier: options.codeVerifier,
+                codeChallenge: options.codeVerifier,
+                codeChallengeMethod: 'S256',
+            }
+            : (0, pkce_js_1.generatePkcePair)();
+        const state = options.state || (0, pkce_js_1.generateState)(undefined, this.options.stateSecret);
+        const scopes = options.scopes || this.options.scopes || [];
+        const url = new URL(this.options.authorizationUrl);
+        url.searchParams.set('client_id', this.options.clientId);
+        url.searchParams.set('redirect_uri', this.options.redirectUri);
+        url.searchParams.set('response_type', 'code');
+        if (scopes.length > 0) {
+            url.searchParams.set('scope', scopes.join(' '));
+        }
+        url.searchParams.set('state', state);
+        url.searchParams.set('code_challenge', pkce.codeChallenge);
+        url.searchParams.set('code_challenge_method', pkce.codeChallengeMethod);
+        if (options.prompt) {
+            url.searchParams.set('prompt', options.prompt);
+        }
+        if (options.accessType) {
+            url.searchParams.set('access_type', options.accessType);
+        }
+        if (options.extraParams) {
+            for (const [k, v] of Object.entries(options.extraParams)) {
+                url.searchParams.set(k, v);
+            }
+        }
+        return {
+            url: url.toString(),
+            state,
+            codeVerifier: pkce.codeVerifier,
+            codeChallenge: pkce.codeChallenge,
+        };
+    }
+    /**
+     * Exchanges an authorization code for access and refresh tokens.
+     */
+    async exchangeCodeForTokens(code, codeVerifier) {
+        if (!this.options.tokenUrl) {
+            throw new Error(`Provider "${this.name}" does not have a tokenUrl configured`);
+        }
+        const bodyParams = new URLSearchParams({
+            client_id: this.options.clientId,
+            code,
+            grant_type: 'authorization_code',
+            redirect_uri: this.options.redirectUri,
+        });
+        if (this.options.clientSecret) {
+            bodyParams.set('client_secret', this.options.clientSecret);
+        }
+        if (codeVerifier) {
+            bodyParams.set('code_verifier', codeVerifier);
+        }
+        const headers = {
+            'content-type': 'application/x-www-form-urlencoded',
+            accept: 'application/json',
+        };
+        const response = await fetch(this.options.tokenUrl, {
+            method: 'POST',
+            headers,
+            body: bodyParams.toString(),
+        });
+        if (!response.ok) {
+            const errorText = await response.text();
+            throw new Error(`OAuth token request failed (${response.status}): ${errorText}`);
+        }
+        const data = (await response.json());
+        const expiresIn = typeof data.expires_in === 'number' ? data.expires_in : undefined;
+        const expiresAt = expiresIn ? new Date(Date.now() + expiresIn * 1000) : undefined;
+        return {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token,
+            idToken: data.id_token,
+            tokenType: data.token_type || 'Bearer',
+            expiresIn,
+            expiresAt,
+            scope: data.scope,
+            raw: data,
+        };
+    }
+    /**
+     * Fetches the raw user profile from userinfo endpoint.
+     */
+    async fetchUserInfo(accessToken) {
+        if (!this.options.userInfoUrl) {
+            throw new Error(`Provider "${this.name}" does not have a userInfoUrl configured`);
+        }
+        const response = await fetch(this.options.userInfoUrl, {
+            headers: {
+                authorization: `Bearer ${accessToken}`,
+                accept: 'application/json',
+            },
+        });
+        if (!response.ok) {
+            const errorText = await response.text();
+            throw new Error(`Failed to fetch OAuth user info (${response.status}): ${errorText}`);
+        }
+        return (await response.json());
+    }
+    /**
+     * High-level flow: validates CSRF state, exchanges code for tokens, and returns mapped user.
+     */
+    async getUser(options) {
+        if (options.savedState || this.options.stateSecret) {
+            const expected = options.savedState || this.options.stateSecret;
+            const isValid = (0, pkce_js_1.verifyState)(options.state || '', expected);
+            if (!isValid) {
+                throw new Error('OAuth state mismatch: potential CSRF attack detected');
+            }
+        }
+        const tokens = await this.exchangeCodeForTokens(options.code, options.codeVerifier);
+        const rawProfile = await this.fetchUserInfo(tokens.accessToken);
+        return this.mapUser(rawProfile, tokens);
+    }
+}
+exports.BaseOAuthProvider = BaseOAuthProvider;
+//# sourceMappingURL=base.provider.js.map

package/dist/oauth/base.provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.provider.js","sourceRoot":"","sources":["../../src/oauth/base.provider.ts"],"names":[],"mappings":";;;AAQA,uCAAyE;AAEzE,MAAsB,iBAAiB;IAC3B,OAAO,CAA2B;IAE5C,YAAY,OAAiC;QAC3C,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,IAAW,IAAI;QACb,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACtE,CAAC;IAED;;OAEG;IACI,sBAAsB,CAAC,UAAyC,EAAE;QACvE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,IAAI,gDAAgD,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY;YAC/B,CAAC,CAAC;gBACE,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,aAAa,EAAE,OAAO,CAAC,YAAY;gBACnC,mBAAmB,EAAE,MAAe;aACrC;YACH,CAAC,CAAC,IAAA,0BAAgB,GAAE,CAAC;QAEvB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAA,uBAAa,EAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAElF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QAC3D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAEnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC/D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,CAAC;QACD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAExE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,OAAO;YACL,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;YACnB,KAAK;YACL,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC;IACJ,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,qBAAqB,CAAC,IAAY,EAAE,YAAqB;QACpE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,IAAI,uCAAuC,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,eAAe,CAAC;YACrC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAChC,IAAI;YACJ,UAAU,EAAE,oBAAoB;YAChC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;SACvC,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC9B,UAAU,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,YAAY,EAAE,CAAC;YACjB,UAAU,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE;SAC5B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,MAAM,SAAS,EAAE,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC;QAE5D,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACpF,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAElF,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;YACtC,SAAS;YACT,SAAS;YACT,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,EAAE,IAAI;SACV,CAAC;IACJ,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,aAAa,CAAC,WAAmB;QAC5C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,IAAI,0CAA0C,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE;YACrD,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,MAAM,EAAE,kBAAkB;aAC3B;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,CAAC,MAAM,MAAM,SAAS,EAAE,CAAC,CAAC;QACxF,CAAC;QAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC5D,CAAC;IAOD;;OAEG;IACI,KAAK,CAAC,OAAO,CAAC,OAAuB;QAC1C,IAAI,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,WAAY,CAAC;YACjE,MAAM,OAAO,GAAG,IAAA,qBAAW,EAAC,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;YAC3D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QACpF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;CACF;AAlKD,8CAkKC"}

package/dist/oauth/index.d.ts

@@ -0,0 +1,6 @@
+export * from './oauth.types.js';
+export * from './pkce.js';
+export * from './base.provider.js';
+export * from './providers/index.js';
+export * from './oauth-manager.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/oauth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,WAAW,CAAC;AAC1B,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC"}

package/dist/oauth/index.js

@@ -0,0 +1,22 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./oauth.types.js"), exports);
+__exportStar(require("./pkce.js"), exports);
+__exportStar(require("./base.provider.js"), exports);
+__exportStar(require("./providers/index.js"), exports);
+__exportStar(require("./oauth-manager.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist/oauth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,mDAAiC;AACjC,4CAA0B;AAC1B,qDAAmC;AACnC,uDAAqC;AACrC,qDAAmC"}

package/dist/oauth/oauth-manager.d.ts

@@ -0,0 +1,41 @@
+import { BaseOAuthProvider } from './base.provider.js';
+import { GoogleProvider, type GoogleProviderOptions } from './providers/google.provider.js';
+import { GitHubProvider, type GitHubProviderOptions } from './providers/github.provider.js';
+import { MicrosoftProvider, type MicrosoftProviderOptions } from './providers/microsoft.provider.js';
+import { GenericOidcProvider, type GenericOidcProviderOptions } from './providers/generic-oidc.provider.js';
+export type SupportedOAuthProvider = 'google' | 'github' | 'microsoft' | 'oidc';
+export type OAuthProviderOptionsMap = {
+    google: GoogleProviderOptions;
+    github: GitHubProviderOptions;
+    microsoft: MicrosoftProviderOptions;
+    oidc: GenericOidcProviderOptions;
+};
+/**
+ * Registers an OAuth provider instance under a given name.
+ */
+export declare function registerOAuthProvider(name: string, provider: BaseOAuthProvider): void;
+/**
+ * Gets a registered OAuth provider.
+ */
+export declare function getOAuthProvider(name: string): BaseOAuthProvider | undefined;
+/**
+ * Fluent factory to instantiate or retrieve an OAuth2 / OIDC provider.
+ *
+ * Example:
+ * ```ts
+ * const google = oauth('google', {
+ *   clientId: process.env.GOOGLE_CLIENT_ID!,
+ *   clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
+ *   redirectUri: 'https://api.myapp.com/auth/google/callback',
+ * });
+ *
+ * const { url, state, codeVerifier } = google.createAuthorizationUrl();
+ * const user = await google.getUser({ code, codeVerifier, state, savedState });
+ * ```
+ */
+export declare function oauth(provider: 'google', options: GoogleProviderOptions): GoogleProvider;
+export declare function oauth(provider: 'github', options: GitHubProviderOptions): GitHubProvider;
+export declare function oauth(provider: 'microsoft', options: MicrosoftProviderOptions): MicrosoftProvider;
+export declare function oauth(provider: 'oidc', options: GenericOidcProviderOptions): GenericOidcProvider;
+export declare function oauth(provider: string, options?: any): BaseOAuthProvider;
+//# sourceMappingURL=oauth-manager.d.ts.map

package/dist/oauth/oauth-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-manager.d.ts","sourceRoot":"","sources":["../../src/oauth/oauth-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,KAAK,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,KAAK,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAE5G,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,MAAM,CAAC;AAEhF,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,SAAS,EAAE,wBAAwB,CAAC;IACpC,IAAI,EAAE,0BAA0B,CAAC;CAClC,CAAC;AAIF;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAErF;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAE5E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,KAAK,CACnB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,qBAAqB,GAC7B,cAAc,CAAC;AAClB,wBAAgB,KAAK,CACnB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,qBAAqB,GAC7B,cAAc,CAAC;AAClB,wBAAgB,KAAK,CACnB,QAAQ,EAAE,WAAW,EACrB,OAAO,EAAE,wBAAwB,GAChC,iBAAiB,CAAC;AACrB,wBAAgB,KAAK,CACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,0BAA0B,GAClC,mBAAmB,CAAC;AACvB,wBAAgB,KAAK,CACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,GAAG,GACZ,iBAAiB,CAAC"}

package/dist/oauth/oauth-manager.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerOAuthProvider = registerOAuthProvider;
+exports.getOAuthProvider = getOAuthProvider;
+exports.oauth = oauth;
+const base_provider_js_1 = require("./base.provider.js");
+const google_provider_js_1 = require("./providers/google.provider.js");
+const github_provider_js_1 = require("./providers/github.provider.js");
+const microsoft_provider_js_1 = require("./providers/microsoft.provider.js");
+const generic_oidc_provider_js_1 = require("./providers/generic-oidc.provider.js");
+const registeredProviders = new Map();
+/**
+ * Registers an OAuth provider instance under a given name.
+ */
+function registerOAuthProvider(name, provider) {
+    registeredProviders.set(name.toLowerCase(), provider);
+}
+/**
+ * Gets a registered OAuth provider.
+ */
+function getOAuthProvider(name) {
+    return registeredProviders.get(name.toLowerCase());
+}
+function oauth(provider, options) {
+    const normalized = provider.toLowerCase();
+    if (!options) {
+        const existing = registeredProviders.get(normalized);
+        if (existing)
+            return existing;
+        throw new Error(`Provider "${provider}" is not registered. Pass configuration options to instantiate it.`);
+    }
+    let instance;
+    switch (normalized) {
+        case 'google':
+            instance = new google_provider_js_1.GoogleProvider(options);
+            break;
+        case 'github':
+            instance = new github_provider_js_1.GitHubProvider(options);
+            break;
+        case 'microsoft':
+            instance = new microsoft_provider_js_1.MicrosoftProvider(options);
+            break;
+        case 'oidc':
+            instance = new generic_oidc_provider_js_1.GenericOidcProvider(options);
+            break;
+        default:
+            if (options instanceof base_provider_js_1.BaseOAuthProvider) {
+                instance = options;
+            }
+            else {
+                instance = new generic_oidc_provider_js_1.GenericOidcProvider(options);
+            }
+            break;
+    }
+    registeredProviders.set(normalized, instance);
+    return instance;
+}
+//# sourceMappingURL=oauth-manager.js.map

package/dist/oauth/oauth-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-manager.js","sourceRoot":"","sources":["../../src/oauth/oauth-manager.ts"],"names":[],"mappings":";;AAoBA,sDAEC;AAKD,4CAEC;AAqCD,sBAqCC;AAvGD,yDAAuD;AACvD,uEAA4F;AAC5F,uEAA4F;AAC5F,6EAAqG;AACrG,mFAA4G;AAW5G,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAA6B,CAAC;AAEjE;;GAEG;AACH,SAAgB,qBAAqB,CAAC,IAAY,EAAE,QAA2B;IAC7E,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAAC,IAAY;IAC3C,OAAO,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AACrD,CAAC;AAqCD,SAAgB,KAAK,CACnB,QAAgB,EAChB,OAAa;IAEb,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAE1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,aAAa,QAAQ,oEAAoE,CAAC,CAAC;IAC7G,CAAC;IAED,IAAI,QAA2B,CAAC;IAChC,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,QAAQ;YACX,QAAQ,GAAG,IAAI,mCAAc,CAAC,OAAO,CAAC,CAAC;YACvC,MAAM;QACR,KAAK,QAAQ;YACX,QAAQ,GAAG,IAAI,mCAAc,CAAC,OAAO,CAAC,CAAC;YACvC,MAAM;QACR,KAAK,WAAW;YACd,QAAQ,GAAG,IAAI,yCAAiB,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM;QACR,KAAK,MAAM;YACT,QAAQ,GAAG,IAAI,8CAAmB,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM;QACR;YACE,IAAI,OAAO,YAAY,oCAAiB,EAAE,CAAC;gBACzC,QAAQ,GAAG,OAAO,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,IAAI,8CAAmB,CAAC,OAAO,CAAC,CAAC;YAC9C,CAAC;YACD,MAAM;IACV,CAAC;IAED,mBAAmB,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC9C,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/oauth/oauth.types.d.ts

@@ -0,0 +1,55 @@
+export interface OAuthTokens {
+    accessToken: string;
+    refreshToken?: string;
+    idToken?: string;
+    tokenType: string;
+    expiresIn?: number;
+    expiresAt?: Date;
+    scope?: string;
+    raw?: Record<string, unknown>;
+}
+export interface OAuthUser {
+    id: string;
+    email?: string;
+    emailVerified?: boolean;
+    name?: string;
+    username?: string;
+    avatar?: string;
+    raw: Record<string, unknown>;
+}
+export interface BaseOAuthProviderOptions {
+    clientId: string;
+    clientSecret?: string;
+    redirectUri: string;
+    scopes?: string[];
+    authorizationUrl?: string;
+    tokenUrl?: string;
+    userInfoUrl?: string;
+    stateSecret?: string;
+}
+export interface CreateAuthorizationUrlOptions {
+    scopes?: string[];
+    state?: string;
+    codeVerifier?: string;
+    prompt?: string;
+    accessType?: string;
+    extraParams?: Record<string, string>;
+}
+export interface AuthorizationUrlResult {
+    url: string;
+    state: string;
+    codeVerifier: string;
+    codeChallenge: string;
+}
+export interface GetUserOptions {
+    code: string;
+    codeVerifier?: string;
+    state?: string;
+    savedState?: string;
+}
+export interface PkcePair {
+    codeVerifier: string;
+    codeChallenge: string;
+    codeChallengeMethod: 'S256';
+}
+//# sourceMappingURL=oauth.types.d.ts.map

package/dist/oauth/oauth.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.types.d.ts","sourceRoot":"","sources":["../../src/oauth/oauth.types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,6BAA6B;IAC5C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,QAAQ;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;CAC7B"}

package/dist/oauth/oauth.types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=oauth.types.js.map

package/dist/oauth/oauth.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.types.js","sourceRoot":"","sources":["../../src/oauth/oauth.types.ts"],"names":[],"mappings":""}

package/dist/oauth/pkce.d.ts

@@ -0,0 +1,26 @@
+import type { PkcePair } from './oauth.types.js';
+/**
+ * Generates an RFC 7636 compliant PKCE code_verifier and code_challenge (S256).
+ */
+export declare function generatePkcePair(byteLength?: number): PkcePair;
+/**
+ * Computes the S256 code_challenge for a given code_verifier.
+ */
+export declare function computeCodeChallenge(codeVerifier: string): string;
+export interface StateMetadata {
+    returnTo?: string;
+    timestamp?: number;
+    [key: string]: unknown;
+}
+/**
+ * Generates a cryptographically random, CSRF-resistant state parameter.
+ * If a secret is provided, creates a signed and tamper-evident state token.
+ */
+export declare function generateState(metadata?: StateMetadata, secret?: string): string;
+/**
+ * Validates a state token against an expected string or verifies its HMAC signature.
+ */
+export declare function verifyState(receivedState: string, expectedStateOrSecret: string, options?: {
+    maxAgeMs?: number;
+}): boolean;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/oauth/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/oauth/pkce.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEjD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,SAAK,GAAG,QAAQ,CAc1D;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAKjE;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,QAAQ,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAmB/E;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,aAAa,EAAE,MAAM,EACrB,qBAAqB,EAAE,MAAM,EAC7B,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9B,OAAO,CAoDT"}

package/dist/oauth/pkce.js

@@ -0,0 +1,136 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generatePkcePair = generatePkcePair;
+exports.computeCodeChallenge = computeCodeChallenge;
+exports.generateState = generateState;
+exports.verifyState = verifyState;
+const crypto = __importStar(require("node:crypto"));
+/**
+ * Generates an RFC 7636 compliant PKCE code_verifier and code_challenge (S256).
+ */
+function generatePkcePair(byteLength = 48) {
+    // 48 random bytes yields 64 base64url characters (within the 43-128 range)
+    const codeVerifier = crypto.randomBytes(byteLength).toString('base64url');
+    const codeChallenge = crypto
+        .createHash('sha256')
+        .update(codeVerifier, 'ascii')
+        .digest('base64url');
+    return {
+        codeVerifier,
+        codeChallenge,
+        codeChallengeMethod: 'S256',
+    };
+}
+/**
+ * Computes the S256 code_challenge for a given code_verifier.
+ */
+function computeCodeChallenge(codeVerifier) {
+    return crypto
+        .createHash('sha256')
+        .update(codeVerifier, 'ascii')
+        .digest('base64url');
+}
+/**
+ * Generates a cryptographically random, CSRF-resistant state parameter.
+ * If a secret is provided, creates a signed and tamper-evident state token.
+ */
+function generateState(metadata, secret) {
+    const randomEntropy = crypto.randomBytes(24).toString('base64url');
+    if (!secret) {
+        if (!metadata || Object.keys(metadata).length === 0) {
+            return randomEntropy;
+        }
+        const payload = JSON.stringify({ rnd: randomEntropy, ...metadata, ts: Date.now() });
+        return Buffer.from(payload, 'utf-8').toString('base64url');
+    }
+    const payload = JSON.stringify({ rnd: randomEntropy, ...metadata, ts: Date.now() });
+    const payloadB64 = Buffer.from(payload, 'utf-8').toString('base64url');
+    const signature = crypto
+        .createHmac('sha256', secret)
+        .update(payloadB64)
+        .digest('base64url');
+    return `${payloadB64}.${signature}`;
+}
+/**
+ * Validates a state token against an expected string or verifies its HMAC signature.
+ */
+function verifyState(receivedState, expectedStateOrSecret, options) {
+    if (!receivedState || !expectedStateOrSecret) {
+        return false;
+    }
+    // 1. Direct match comparison (constant-time)
+    const bufReceived = Buffer.from(receivedState);
+    const bufExpected = Buffer.from(expectedStateOrSecret);
+    if (bufReceived.length === bufExpected.length) {
+        if (crypto.timingSafeEqual(bufReceived, bufExpected)) {
+            return true;
+        }
+    }
+    // 2. Signed State verification (if expectedStateOrSecret is a signing secret)
+    if (receivedState.includes('.')) {
+        const parts = receivedState.split('.');
+        if (parts.length !== 2)
+            return false;
+        const [payloadB64, signature] = parts;
+        const computedSignature = crypto
+            .createHmac('sha256', expectedStateOrSecret)
+            .update(payloadB64)
+            .digest('base64url');
+        const sigBuf = Buffer.from(signature);
+        const compBuf = Buffer.from(computedSignature);
+        if (sigBuf.length !== compBuf.length || !crypto.timingSafeEqual(sigBuf, compBuf)) {
+            return false;
+        }
+        // Check age if requested
+        if (options?.maxAgeMs) {
+            try {
+                const parsed = JSON.parse(Buffer.from(payloadB64, 'base64url').toString('utf-8'));
+                if (typeof parsed.ts === 'number') {
+                    const age = Date.now() - parsed.ts;
+                    if (age > options.maxAgeMs || age < 0) {
+                        return false;
+                    }
+                }
+            }
+            catch {
+                return false;
+            }
+        }
+        return true;
+    }
+    return false;
+}
+//# sourceMappingURL=pkce.js.map

package/dist/oauth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/oauth/pkce.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAMA,4CAcC;AAKD,oDAKC;AAYD,sCAmBC;AAKD,kCAwDC;AA1HD,oDAAsC;AAGtC;;GAEG;AACH,SAAgB,gBAAgB,CAAC,UAAU,GAAG,EAAE;IAC9C,2EAA2E;IAC3E,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAE1E,MAAM,aAAa,GAAG,MAAM;SACzB,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC;SAC7B,MAAM,CAAC,WAAW,CAAC,CAAC;IAEvB,OAAO;QACL,YAAY;QACZ,aAAa;QACb,mBAAmB,EAAE,MAAM;KAC5B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,oBAAoB,CAAC,YAAoB;IACvD,OAAO,MAAM;SACV,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC;SAC7B,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAQD;;;GAGG;AACH,SAAgB,aAAa,CAAC,QAAwB,EAAE,MAAe;IACrE,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEnE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,aAAa,CAAC;QACvB,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACpF,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACpF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,MAAM;SACrB,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;SAC5B,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC,WAAW,CAAC,CAAC;IAEvB,OAAO,GAAG,UAAU,IAAI,SAAS,EAAE,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,SAAgB,WAAW,CACzB,aAAqB,EACrB,qBAA6B,EAC7B,OAA+B;IAE/B,IAAI,CAAC,aAAa,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6CAA6C;IAC7C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAEvD,IAAI,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;QAC9C,IAAI,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,IAAI,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAErC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;QACtC,MAAM,iBAAiB,GAAG,MAAM;aAC7B,UAAU,CAAC,QAAQ,EAAE,qBAAqB,CAAC;aAC3C,MAAM,CAAC,UAAU,CAAC;aAClB,MAAM,CAAC,WAAW,CAAC,CAAC;QAEvB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAE/C,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YACjF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,yBAAyB;QACzB,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;gBAClF,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;oBAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;oBACnC,IAAI,GAAG,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;wBACtC,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/oauth/providers/generic-oidc.provider.d.ts

@@ -0,0 +1,25 @@
+import { BaseOAuthProvider } from '../base.provider.js';
+import type { BaseOAuthProviderOptions, OAuthTokens, OAuthUser } from '../oauth.types.js';
+export interface GenericOidcProviderOptions extends BaseOAuthProviderOptions {
+    issuer?: string;
+    discoveryUrl?: string;
+}
+export interface OidcDiscoveryDocument {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    userinfo_endpoint?: string;
+    jwks_uri?: string;
+    [key: string]: unknown;
+}
+export declare class GenericOidcProvider extends BaseOAuthProvider {
+    constructor(options: GenericOidcProviderOptions);
+    /**
+     * Initializes a GenericOidcProvider by auto-discovering endpoints via .well-known/openid-configuration.
+     */
+    static fromDiscovery(options: GenericOidcProviderOptions & {
+        issuer: string;
+    }): Promise<GenericOidcProvider>;
+    mapUser(rawProfile: Record<string, unknown>, _tokens: OAuthTokens): OAuthUser;
+}
+//# sourceMappingURL=generic-oidc.provider.d.ts.map

package/dist/oauth/providers/generic-oidc.provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generic-oidc.provider.d.ts","sourceRoot":"","sources":["../../../src/oauth/providers/generic-oidc.provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE1F,MAAM,WAAW,0BAA2B,SAAQ,wBAAwB;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,qBAAa,mBAAoB,SAAQ,iBAAiB;gBAC5C,OAAO,EAAE,0BAA0B;IAO/C;;OAEG;WACiB,aAAa,CAC/B,OAAO,EAAE,0BAA0B,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GACvD,OAAO,CAAC,mBAAmB,CAAC;IAmBxB,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,GAAG,SAAS;CAWrF"}

package/dist/oauth/providers/generic-oidc.provider.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GenericOidcProvider = void 0;
+const base_provider_js_1 = require("../base.provider.js");
+class GenericOidcProvider extends base_provider_js_1.BaseOAuthProvider {
+    constructor(options) {
+        super({
+            scopes: ['openid', 'profile', 'email'],
+            ...options,
+        });
+    }
+    /**
+     * Initializes a GenericOidcProvider by auto-discovering endpoints via .well-known/openid-configuration.
+     */
+    static async fromDiscovery(options) {
+        const issuer = options.issuer.replace(/\/$/, '');
+        const discoveryUrl = options.discoveryUrl || `${issuer}/.well-known/openid-configuration`;
+        const res = await fetch(discoveryUrl);
+        if (!res.ok) {
+            throw new Error(`Failed to fetch OIDC discovery document from ${discoveryUrl}: HTTP ${res.status}`);
+        }
+        const doc = (await res.json());
+        return new GenericOidcProvider({
+            ...options,
+            authorizationUrl: doc.authorization_endpoint,
+            tokenUrl: doc.token_endpoint,
+            userInfoUrl: doc.userinfo_endpoint,
+        });
+    }
+    mapUser(rawProfile, _tokens) {
+        return {
+            id: String(rawProfile.sub ?? rawProfile.id ?? ''),
+            email: rawProfile.email,
+            emailVerified: Boolean(rawProfile.email_verified),
+            name: rawProfile.name ?? rawProfile.preferred_username,
+            username: rawProfile.preferred_username,
+            avatar: rawProfile.picture ?? undefined,
+            raw: rawProfile,
+        };
+    }
+}
+exports.GenericOidcProvider = GenericOidcProvider;
+//# sourceMappingURL=generic-oidc.provider.js.map

package/dist/oauth/providers/generic-oidc.provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generic-oidc.provider.js","sourceRoot":"","sources":["../../../src/oauth/providers/generic-oidc.provider.ts"],"names":[],"mappings":";;;AAAA,0DAAwD;AAiBxD,MAAa,mBAAoB,SAAQ,oCAAiB;IACxD,YAAY,OAAmC;QAC7C,KAAK,CAAC;YACJ,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;YACtC,GAAG,OAAO;SACX,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,aAAa,CAC/B,OAAwD;QAExD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,GAAG,MAAM,mCAAmC,CAAC;QAE1F,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,gDAAgD,YAAY,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACtG,CAAC;QAED,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;QAExD,OAAO,IAAI,mBAAmB,CAAC;YAC7B,GAAG,OAAO;YACV,gBAAgB,EAAE,GAAG,CAAC,sBAAsB;YAC5C,QAAQ,EAAE,GAAG,CAAC,cAAc;YAC5B,WAAW,EAAE,GAAG,CAAC,iBAAiB;SACnC,CAAC,CAAC;IACL,CAAC;IAEM,OAAO,CAAC,UAAmC,EAAE,OAAoB;QACtE,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC;YACjD,KAAK,EAAE,UAAU,CAAC,KAA2B;YAC7C,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC;YACjD,IAAI,EAAG,UAAU,CAAC,IAAe,IAAK,UAAU,CAAC,kBAA6B;YAC9E,QAAQ,EAAE,UAAU,CAAC,kBAAwC;YAC7D,MAAM,EAAG,UAAU,CAAC,OAAkB,IAAI,SAAS;YACnD,GAAG,EAAE,UAAU;SAChB,CAAC;IACJ,CAAC;CACF;AA3CD,kDA2CC"}

package/dist/oauth/providers/github.provider.d.ts

@@ -0,0 +1,15 @@
+import { BaseOAuthProvider } from '../base.provider.js';
+import type { BaseOAuthProviderOptions, OAuthTokens, OAuthUser } from '../oauth.types.js';
+export interface GitHubProviderOptions extends Omit<BaseOAuthProviderOptions, 'authorizationUrl' | 'tokenUrl'> {
+    authorizationUrl?: string;
+    tokenUrl?: string;
+    userInfoUrl?: string;
+    emailsUrl?: string;
+}
+export declare class GitHubProvider extends BaseOAuthProvider {
+    private emailsUrl;
+    constructor(options: GitHubProviderOptions);
+    fetchUserInfo(accessToken: string): Promise<Record<string, unknown>>;
+    mapUser(rawProfile: Record<string, unknown>, _tokens: OAuthTokens): OAuthUser;
+}
+//# sourceMappingURL=github.provider.d.ts.map

package/dist/oauth/providers/github.provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.provider.d.ts","sourceRoot":"","sources":["../../../src/oauth/providers/github.provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE1F,MAAM,WAAW,qBAAsB,SAAQ,IAAI,CAAC,wBAAwB,EAAE,kBAAkB,GAAG,UAAU,CAAC;IAC5G,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,cAAe,SAAQ,iBAAiB;IACnD,OAAO,CAAC,SAAS,CAAS;gBAEd,OAAO,EAAE,qBAAqB;IAWpB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IA4CnF,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,GAAG,SAAS;CAWrF"}