@aura-stack/auth 0.4.0-rc.5 → 0.5.0

package/dist/api/signOut.cjs

@@ -0,0 +1,279 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/api/signOut.ts
+var signOut_exports = {};
+__export(signOut_exports, {
+  signOut: () => signOut
+});
+module.exports = __toCommonJS(signOut_exports);
+
+// src/env.ts
+var import_meta = {};
+var env = new Proxy({}, {
+  get(_, prop) {
+    if (typeof prop !== "string") return void 0;
+    const hasProperty = (process2) => {
+      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
+    };
+    try {
+      if (typeof process !== "undefined" && hasProperty(process.env)) {
+        return process.env[prop];
+      }
+      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
+        return import_meta.env[prop];
+      }
+      if (typeof Deno !== "undefined" && Deno.env?.get) {
+        return Deno.env.get(prop);
+      }
+      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
+        return Bun.env[prop];
+      }
+      const globalValue = globalThis[prop];
+      return typeof globalValue === "string" ? globalValue : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+});
+
+// src/cookie.ts
+var import_cookie = require("@aura-stack/router/cookie");
+
+// src/errors.ts
+var AuthInternalError = class extends Error {
+  type = "AUTH_INTERNAL_ERROR";
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+    this.name = new.target.name;
+    Error.captureStackTrace(this, new.target);
+  }
+};
+var AuthSecurityError = class extends Error {
+  type = "AUTH_SECURITY_ERROR";
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+    this.name = new.target.name;
+    Error.captureStackTrace(this, new.target);
+  }
+};
+
+// src/cookie.ts
+var defaultCookieOptions = {
+  httpOnly: true,
+  sameSite: "lax",
+  path: "/",
+  maxAge: 60 * 60 * 24 * 15
+};
+var oauthCookieOptions = {
+  httpOnly: true,
+  maxAge: 5 * 60,
+  sameSite: "lax",
+  expires: new Date(Date.now() + 5 * 60 * 1e3)
+};
+var expiredCookieAttributes = {
+  ...defaultCookieOptions,
+  expires: /* @__PURE__ */ new Date(0),
+  maxAge: 0,
+  secure: true
+};
+var getCookie = (request, cookieName) => {
+  const cookies = request instanceof Request ? request.headers.get("Cookie") : request.get("Cookie");
+  if (!cookies) {
+    throw new AuthInternalError("COOKIE_NOT_FOUND", "No cookies found. There is no active session");
+  }
+  const value = (0, import_cookie.parse)(cookies)[cookieName];
+  if (!value) {
+    throw new AuthInternalError("COOKIE_NOT_FOUND", `Cookie "${cookieName}" not found. There is no active session`);
+  }
+  return value;
+};
+
+// src/utils.ts
+var import_router = require("@aura-stack/router");
+
+// src/assert.ts
+var import_crypto = require("@aura-stack/jose/crypto");
+var isJWTPayloadWithToken = (payload) => {
+  return typeof payload === "object" && payload !== null && "token" in payload && typeof payload?.token === "string";
+};
+var timingSafeEqual = (a, b) => {
+  const bufferA = import_crypto.encoder.encode(a);
+  const bufferB = import_crypto.encoder.encode(b);
+  const len = Math.max(bufferA.length, bufferB.length);
+  let diff = 0;
+  for (let i = 0; i < len; i++) {
+    diff |= (bufferA[i] ?? 0) ^ (bufferB[i] ?? 0);
+  }
+  return diff === 0 && bufferA.length === bufferB.length;
+};
+
+// src/utils.ts
+var equals = (a, b) => {
+  if (a === null || b === null || a === void 0 || b === void 0) return false;
+  return a === b;
+};
+var getErrorName = (error) => {
+  if (error instanceof Error) {
+    return error.name;
+  }
+  return typeof error === "string" ? error : "UnknownError";
+};
+
+// src/jose.ts
+var import_jose = require("@aura-stack/jose");
+var import_jose2 = require("@aura-stack/jose/jose");
+var import_crypto2 = require("@aura-stack/jose/crypto");
+var jwtVerificationOptions = {
+  algorithms: ["HS256"],
+  typ: "JWT"
+};
+
+// src/secure.ts
+var verifyCSRF = async (jose, cookie, header) => {
+  try {
+    const cookiePayload = await jose.verifyJWS(cookie, jwtVerificationOptions);
+    const headerPayload = await jose.verifyJWS(header, jwtVerificationOptions);
+    if (!isJWTPayloadWithToken(cookiePayload)) {
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "Cookie payload missing token field.");
+    }
+    if (!isJWTPayloadWithToken(headerPayload)) {
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "Header payload missing token field.");
+    }
+    if (!equals(cookiePayload.token.length, headerPayload.token.length)) {
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
+    }
+    if (!timingSafeEqual(cookiePayload.token, headerPayload.token)) {
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
+    }
+    return true;
+  } catch {
+    throw new AuthSecurityError("CSRF_TOKEN_INVALID", "The CSRF tokens do not match.");
+  }
+};
+
+// src/headers.ts
+var cacheControl = {
+  "Cache-Control": "no-store",
+  Pragma: "no-cache",
+  Expires: "0",
+  Vary: "Cookie"
+};
+var contentSecurityPolicy = {
+  "Content-Security-Policy": [
+    "default-src 'none'",
+    "script-src 'self'",
+    "frame-src 'none'",
+    "object-src 'none'",
+    "frame-ancestors 'none'",
+    "base-uri 'none'"
+  ].join("; ")
+};
+var secureHeaders = {
+  "X-Content-Type-Options": "nosniff",
+  "X-Frame-Options": "DENY",
+  "Referrer-Policy": "strict-origin-when-cross-origin"
+};
+var secureApiHeaders = {
+  ...cacheControl,
+  ...contentSecurityPolicy,
+  ...secureHeaders
+};
+
+// src/api/signOut.ts
+var import_router2 = require("@aura-stack/router");
+var signOut = async ({
+  ctx,
+  headers: headersInit,
+  redirectTo = "/",
+  skipCSRFCheck = false
+}) => {
+  const headers = new Headers(headersInit);
+  const header = headers.get("X-CSRF-Token");
+  let session = null;
+  let csrfToken = null;
+  try {
+    session = getCookie(headers, ctx.cookies.sessionToken.name);
+  } catch {
+    throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
+  }
+  try {
+    csrfToken = getCookie(headers, ctx.cookies.csrfToken.name);
+  } catch {
+    throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF token is missing.");
+  }
+  ctx?.logger?.log("SIGN_OUT_ATTEMPT", {
+    structuredData: {
+      has_session: Boolean(session),
+      has_csrf_token: Boolean(csrfToken),
+      has_csrf_header: Boolean(header),
+      skip_csrf_check: skipCSRFCheck
+    }
+  });
+  if (!session) {
+    ctx?.logger?.log("SESSION_TOKEN_MISSING");
+    throw new AuthSecurityError("SESSION_TOKEN_MISSING", "The sessionToken is missing.");
+  }
+  if (!skipCSRFCheck) {
+    if (!csrfToken) {
+      ctx?.logger?.log("CSRF_TOKEN_MISSING");
+      throw new AuthSecurityError("CSRF_TOKEN_MISSING", "The CSRF token is missing.");
+    }
+    if (!header) {
+      ctx?.logger?.log("CSRF_HEADER_MISSING");
+      throw new AuthSecurityError("CSRF_HEADER_MISSING", "The CSRF header is missing.");
+    }
+    try {
+      await verifyCSRF(ctx.jose, csrfToken, header);
+    } catch (error) {
+      ctx?.logger?.log("CSRF_TOKEN_INVALID", { structuredData: { error_type: getErrorName(error) } });
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "CSRF token verification failed");
+    }
+    ctx?.logger?.log("SIGN_OUT_CSRF_VERIFIED");
+  } else {
+    try {
+      await ctx.jose.verifyJWS(csrfToken);
+    } catch (error) {
+      ctx?.logger?.log("CSRF_TOKEN_INVALID", { structuredData: { error_type: getErrorName(error) } });
+      throw new AuthSecurityError("CSRF_TOKEN_INVALID", "CSRF token verification failed");
+    }
+  }
+  try {
+    await ctx.jose.decodeJWT(session);
+    ctx?.logger?.log("SIGN_OUT_SUCCESS");
+  } catch (error) {
+    ctx?.logger?.log("INVALID_JWT_TOKEN", { structuredData: { error_type: getErrorName(error) } });
+  }
+  const headersList = new import_router2.HeadersBuilder(secureApiHeaders).setHeader("Location", redirectTo).setCookie(ctx.cookies.csrfToken.name, "", expiredCookieAttributes).setCookie(ctx.cookies.sessionToken.name, "", expiredCookieAttributes).toHeaders();
+  return Response.json(
+    { redirect: Boolean(redirectTo), url: redirectTo },
+    {
+      status: 202,
+      headers: headersList
+    }
+  );
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  signOut
+});

package/dist/api/signOut.d.ts

@@ -0,0 +1,16 @@
+import { F as FunctionAPIContext, i as SignOutAPIOptions } from '../index-_aXtxb_s.js';
+import 'zod';
+import '../schemas.js';
+import 'zod/v4';
+import '@aura-stack/jose';
+import '@aura-stack/jose/jose';
+import '@aura-stack/jose/crypto';
+import '@aura-stack/router/cookie';
+import '../@types/utility.js';
+import 'jose';
+import '@aura-stack/router';
+import 'zod/v4/core';
+
+declare const signOut: ({ ctx, headers: headersInit, redirectTo, skipCSRFCheck, }: FunctionAPIContext<SignOutAPIOptions>) => Promise<Response>;
+
+export { signOut };

package/dist/api/signOut.js

@@ -0,0 +1,13 @@
+import {
+  signOut
+} from "../chunk-KBXWTD6E.js";
+import "../chunk-V6LLEAR4.js";
+import "../chunk-UZQJJD6A.js";
+import "../chunk-LX3TJ2TJ.js";
+import "../chunk-XY5R3EHH.js";
+import "../chunk-WHNDRO3N.js";
+import "../chunk-U5663F2U.js";
+import "../chunk-EBAMFRB7.js";
+export {
+  signOut
+};

package/dist/assert.cjs

@@ -22,28 +22,173 @@ var assert_exports = {};
 __export(assert_exports, {
   isFalsy: () => isFalsy,
   isJWTPayloadWithToken: () => isJWTPayloadWithToken,
+  isRelativeURL: () => isRelativeURL,
   isRequest: () => isRequest,
-  isValidURL: () => isValidURL
+  isSameOrigin: () => isSameOrigin,
+  isTrustedOrigin: () => isTrustedOrigin,
+  isValidURL: () => isValidURL,
+  patternToRegex: () => patternToRegex,
+  timingSafeEqual: () => timingSafeEqual,
+  unsafeChars: () => unsafeChars
 });
 module.exports = __toCommonJS(assert_exports);
+
+// src/utils.ts
+var import_router = require("@aura-stack/router");
+
+// src/env.ts
+var import_meta = {};
+var env = new Proxy({}, {
+  get(_, prop) {
+    if (typeof prop !== "string") return void 0;
+    const hasProperty = (process2) => {
+      return process2 && Object.prototype.hasOwnProperty.call(process2, prop);
+    };
+    try {
+      if (typeof process !== "undefined" && hasProperty(process.env)) {
+        return process.env[prop];
+      }
+      if (typeof import_meta !== "undefined" && hasProperty(import_meta.env)) {
+        return import_meta.env[prop];
+      }
+      if (typeof Deno !== "undefined" && Deno.env?.get) {
+        return Deno.env.get(prop);
+      }
+      if (typeof Bun !== "undefined" && hasProperty(Bun.env)) {
+        return Bun.env[prop];
+      }
+      const globalValue = globalThis[prop];
+      return typeof globalValue === "string" ? globalValue : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+});
+
+// src/utils.ts
+var equals = (a, b) => {
+  if (a === null || b === null || a === void 0 || b === void 0) return false;
+  return a === b;
+};
+
+// src/assert.ts
+var import_crypto = require("@aura-stack/jose/crypto");
 var isFalsy = (value) => {
   return value === false || value === 0 || value === "" || value === null || value === void 0 || Number.isNaN(value);
 };
 var isRequest = (value) => {
   return typeof Request !== "undefined" && value instanceof Request;
 };
+var unsafeChars = [
+  "<",
+  ">",
+  '"',
+  "`",
+  " ",
+  "\r",
+  "\n",
+  "	",
+  "\\",
+  "%2F",
+  "%5C",
+  "%2f",
+  "%5c",
+  "\r\n",
+  "%0A",
+  "%0D",
+  "%0a",
+  "%0d",
+  "..",
+  "//",
+  "///",
+  "...",
+  "%20",
+  "\0"
+];
 var isValidURL = (value) => {
-  if (value.includes("\r\n") || value.includes("\n") || value.includes("\r")) return false;
-  const regex = /^https?:\/\/(?:[a-zA-Z0-9._-]+|localhost|\[[0-9a-fA-F:]+\])(?::\d{1,5})?(?:\/[a-zA-Z0-9._~!$&'()*+,;=:@-]*)*\/?$/;
-  return regex.test(value);
+  if (!new RegExp(/^https?:\/\/[^/]/).test(value)) {
+    return false;
+  }
+  const match = value.match(/^(https?:\/\/)(.*)$/);
+  if (!match) return false;
+  const rest = match[2];
+  for (const char of unsafeChars) {
+    if (rest.includes(char)) return false;
+  }
+  const regex = /^https?:\/\/(?:[a-zA-Z0-9._-]+|localhost|\[[0-9a-fA-F:]+\])(?::\d{1,5})?(?:\/[a-zA-Z0-9._~!$&'()?#*+,;=:@-]*)*\/?$/;
+  return regex.test(match[0]);
 };
 var isJWTPayloadWithToken = (payload) => {
   return typeof payload === "object" && payload !== null && "token" in payload && typeof payload?.token === "string";
 };
+var isRelativeURL = (value) => {
+  if (value.length > 100) return false;
+  for (const char of unsafeChars) {
+    if (value.includes(char)) return false;
+  }
+  const regex = /^\/[a-zA-Z0-9\-_\/.?&=#]*\/?$/;
+  return regex.test(value);
+};
+var isSameOrigin = (origin, expected) => {
+  const originURL = new URL(origin);
+  const expectedURL = new URL(expected);
+  return equals(originURL.origin, expectedURL.origin);
+};
+var patternToRegex = (pattern) => {
+  try {
+    if (pattern.length > 2048) return null;
+    pattern = pattern.replace(/\\/g, "");
+    const match = pattern.match(/^(https?):\/\/([a-zA-Z0-9.*-]{1,253})(?::(\d{1,5}|\*))?(?:\/.*)?$/);
+    if (!match) return null;
+    const [, protocol, host, port] = match;
+    const hasWildcard = host.includes("*");
+    if (hasWildcard && !host.startsWith("*.")) return null;
+    if (hasWildcard && host.slice(2).includes("*")) return null;
+    const domain = hasWildcard ? host.slice(2) : host;
+    const escapedDomain = domain.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const hostRegex = hasWildcard ? `[^.]+\\.${escapedDomain}` : escapedDomain;
+    const portRegex = port === "*" ? ":\\d{1,5}" : port ? `:${port}` : "";
+    return new RegExp(`^${protocol}:\\/\\/${hostRegex}${portRegex}$`);
+  } catch {
+    return null;
+  }
+};
+var isTrustedOrigin = (url, trustedOrigins) => {
+  if (!isValidURL(url) || trustedOrigins.length === 0) return false;
+  try {
+    const urlOrigin = new URL(url).origin;
+    for (const pattern of trustedOrigins) {
+      const regex = patternToRegex(pattern);
+      if (regex?.test(urlOrigin)) return true;
+      try {
+        if (isValidURL(pattern) && equals(new URL(pattern).origin, urlOrigin)) return true;
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return false;
+};
+var timingSafeEqual = (a, b) => {
+  const bufferA = import_crypto.encoder.encode(a);
+  const bufferB = import_crypto.encoder.encode(b);
+  const len = Math.max(bufferA.length, bufferB.length);
+  let diff = 0;
+  for (let i = 0; i < len; i++) {
+    diff |= (bufferA[i] ?? 0) ^ (bufferB[i] ?? 0);
+  }
+  return diff === 0 && bufferA.length === bufferB.length;
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   isFalsy,
   isJWTPayloadWithToken,
+  isRelativeURL,
   isRequest,
-  isValidURL
+  isSameOrigin,
+  isTrustedOrigin,
+  isValidURL,
+  patternToRegex,
+  timingSafeEqual,
+  unsafeChars
 });

package/dist/assert.d.ts

@@ -1,14 +1,37 @@
-import { J as JWTPayloadWithToken } from './index-B8jeIElf.js';
+import { J as JWTPayloadWithToken } from './index-_aXtxb_s.js';
 import 'zod';
 import './schemas.js';
-import '@aura-stack/router/cookie';
+import 'zod/v4';
 import '@aura-stack/jose';
 import '@aura-stack/jose/jose';
+import '@aura-stack/jose/crypto';
+import '@aura-stack/router/cookie';
 import './@types/utility.js';
+import 'jose';
+import '@aura-stack/router';
+import 'zod/v4/core';
 
 declare const isFalsy: (value: unknown) => boolean;
 declare const isRequest: (value: unknown) => value is Request;
+declare const unsafeChars: string[];
 declare const isValidURL: (value: string) => boolean;
 declare const isJWTPayloadWithToken: (payload: unknown) => payload is JWTPayloadWithToken;
+declare const isRelativeURL: (value: string) => boolean;
+declare const isSameOrigin: (origin: string, expected: string) => boolean;
+/**
+ * Converts a trusted origin pattern to a regex for matching.
+ * Supports `*` as subdomain wildcard: `https://*.example.com` matches `https://app.example.com`
+ * @todo: add support to Custom URI Schemes (e.g. `myapp://*`).
+ */
+declare const patternToRegex: (pattern: string) => RegExp | null;
+/**
+ * Checks if a URL matches any of the trusted origin patterns.
+ * A URL is trusted if its origin matches any pattern (exact or wildcard).
+ *
+ * @param url - The URL to validate (e.g. from Referer, Origin, redirectTo)
+ * @param trustedOrigins - Array of exact URLs or patterns (e.g. `https://*.example.com`)
+ */
+declare const isTrustedOrigin: (url: string, trustedOrigins: string[]) => boolean;
+declare const timingSafeEqual: (a: string, b: string) => boolean;
 
-export { isFalsy, isJWTPayloadWithToken, isRequest, isValidURL };
+export { isFalsy, isJWTPayloadWithToken, isRelativeURL, isRequest, isSameOrigin, isTrustedOrigin, isValidURL, patternToRegex, timingSafeEqual, unsafeChars };

package/dist/assert.js

@@ -1,12 +1,26 @@
 import {
   isFalsy,
   isJWTPayloadWithToken,
+  isRelativeURL,
   isRequest,
-  isValidURL
-} from "./chunk-EIL2FPSS.js";
+  isSameOrigin,
+  isTrustedOrigin,
+  isValidURL,
+  patternToRegex,
+  timingSafeEqual,
+  unsafeChars
+} from "./chunk-LX3TJ2TJ.js";
+import "./chunk-WHNDRO3N.js";
+import "./chunk-U5663F2U.js";
 export {
   isFalsy,
   isJWTPayloadWithToken,
+  isRelativeURL,
   isRequest,
-  isValidURL
+  isSameOrigin,
+  isTrustedOrigin,
+  isValidURL,
+  patternToRegex,
+  timingSafeEqual,
+  unsafeChars
 };

package/dist/{chunk-YRCB5FLE.js → chunk-2A5B7GWR.js}

@@ -1,11 +1,56 @@
 // src/schemas.ts
-import { object, string, enum as options, number, z, null as nullable } from "zod";
+import { object, string, enum as options, number, z, null as nullable, union, array } from "zod/v4";
+var AuthorizeConfigSchema = z.union([
+  string().url(),
+  object({
+    url: string().url(),
+    params: object({
+      responseType: options(["code", "token", "id_token", "refresh_token"]).optional(),
+      scope: string().optional()
+    })
+  })
+]);
+var AccessTokenConfigSchema = z.union([
+  string().url(),
+  object({
+    url: string().url(),
+    headers: z.record(string(), string()).optional()
+  })
+]);
+var UserInfoConfigSchema = z.union([
+  string().url(),
+  object({
+    url: string().url(),
+    headers: z.record(string(), string()).optional(),
+    method: string().optional()
+  })
+]);
+var OAuthProviderCredentialsSchema = object({
+  id: string(),
+  name: string(),
+  authorize: AuthorizeConfigSchema.optional(),
+  /** @deprecated */
+  authorizeURL: string().url().optional(),
+  accessToken: AccessTokenConfigSchema,
+  /** @deprecated */
+  scope: string().optional(),
+  userInfo: UserInfoConfigSchema,
+  /** @deprecated */
+  responseType: options(["code", "token", "id_token", "refresh_token"]).optional(),
+  clientId: string(),
+  clientSecret: string(),
+  profile: z.function().optional()
+});
 var OAuthProviderConfigSchema = object({
-  authorizeURL: string().url(),
-  accessToken: string().url(),
+  authorize: AuthorizeConfigSchema.optional(),
+  /** @deprecated */
+  authorizeURL: string().url().optional(),
+  accessToken: AccessTokenConfigSchema,
+  /** @deprecated */
   scope: string().optional(),
-  userInfo: string().url(),
-  responseType: options(["code", "token", "id_token"]),
+  userInfo: UserInfoConfigSchema,
+  /** @deprecated */
+  responseType: options(["code", "token", "id_token", "refresh_token"]).optional(),
   clientId: string(),
   clientSecret: string()
 });
@@ -43,7 +88,7 @@ var OAuthAccessTokenResponse = object({
   token_type: string().optional(),
   expires_in: number().optional(),
   refresh_token: string().optional(),
-  scope: string().optional().or(nullable())
+  scope: union([string().optional().or(nullable()), array(string()).optional()])
 });
 var OAuthAccessTokenErrorResponse = object({
   error: options([
@@ -67,6 +112,7 @@ var OAuthEnvSchema = object({
 });
 
 export {
+  OAuthProviderCredentialsSchema,
   OAuthProviderConfigSchema,
   OAuthAuthorization,
   OAuthAuthorizationResponse,

package/dist/chunk-2GQLSIJ2.js

@@ -0,0 +1,40 @@
+import {
+  getEnv
+} from "./chunk-WHNDRO3N.js";
+
+// src/oauth/twitch.ts
+var twitch = (options) => {
+  const clientId = options?.clientId ?? getEnv("TWITCH_CLIENT_ID");
+  return {
+    id: "twitch",
+    name: "Twitch",
+    authorize: {
+      url: "https://id.twitch.tv/oauth2/authorize",
+      params: { scope: "user:read:email", responseType: "code" }
+    },
+    accessToken: "https://id.twitch.tv/oauth2/token",
+    userInfo: {
+      url: "https://api.twitch.tv/helix/users",
+      headers: {
+        "Client-ID": clientId
+      }
+    },
+    profile(profile) {
+      const user = profile.data[0];
+      if (!user) {
+        throw new Error("No user data found in Twitch profile response");
+      }
+      return {
+        sub: user.id,
+        name: user.display_name,
+        email: user.email,
+        picture: user.profile_image_url
+      };
+    },
+    ...options
+  };
+};
+
+export {
+  twitch
+};