@c9up/transit 0.1.0

package/dist/configure.js

@@ -0,0 +1,33 @@
+/**
+ * `ream configure @c9up/transit` — wire federated sign-in in one command.
+ *
+ * The provider alone is not enough: it reads `config/transit.ts`, and a package
+ * registered without one falls back to a default that is rarely the one an
+ * application wants. Writing both together is what makes `ream add` mean
+ * installed AND working.
+ */
+export async function configure(codemods) {
+    // The config below reads these, so they are declared here. Writing the file
+    // without them leaves an application whose config asks the environment for
+    // something nothing ever put there.
+    await codemods.addEnvVars({
+        GOOGLE_CLIENT_ID: "",
+        GOOGLE_CLIENT_SECRET: "",
+    });
+    await codemods.addProvider("@c9up/transit/provider");
+    await codemods.writeFile("config/transit.ts", `import { defineConfig, socials } from '@c9up/transit'
+import env from '#start/env'
+
+export default defineConfig({
+  // The key is yours: it is what \`transit.begin(name)\` asks for.
+  google: socials.google({
+    clientId: env.get('GOOGLE_CLIENT_ID', ''),
+    clientSecret: env.get('GOOGLE_CLIENT_SECRET', ''),
+    callbackUrl: 'http://localhost:3333/auth/google/callback',
+  }),
+
+  // An OpenID Connect provider needs only its issuer:
+  // work: oidc({ issuer: env.get('OIDC_ISSUER'), clientId, clientSecret, callbackUrl }),
+})`);
+}
+//# sourceMappingURL=configure.js.map

package/dist/configure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure.js","sourceRoot":"","sources":["../src/configure.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAYH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAkB;IACjD,4EAA4E;IAC5E,2EAA2E;IAC3E,oCAAoC;IACpC,MAAM,QAAQ,CAAC,UAAU,CAAC;QACzB,gBAAgB,EAAE,EAAE;QACpB,oBAAoB,EAAE,EAAE;KACxB,CAAC,CAAC;IAEH,MAAM,QAAQ,CAAC,WAAW,CAAC,wBAAwB,CAAC,CAAC;IACrD,MAAM,QAAQ,CAAC,SAAS,CACvB,mBAAmB,EACnB;;;;;;;;;;;;;GAaC,CACD,CAAC;AACH,CAAC"}

package/dist/drivers/AppleDriver.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Sign in with Apple.
+ *
+ * Apple speaks OpenID Connect, so most of this is the generic driver. Three
+ * things differ, and each is a place implementations get caught:
+ *
+ *   - There is no client secret. Apple takes a short-lived JWT signed with the
+ *     `.p8` private key from the developer account.
+ *   - The callback arrives as a **POST**, not a redirect with a query string,
+ *     because asking for a name or an address forces `response_mode=form_post`.
+ *   - The name is sent **once**, in that first POST, and never again.
+ *
+ * Apple publishes no userinfo endpoint: everything there is comes from the
+ * id_token.
+ */
+import { type AppleKey } from "../apple.js";
+import type { TransitUser } from "../types.js";
+import { OidcDriver } from "./OidcDriver.js";
+export interface AppleConfig extends AppleKey {
+    callbackUrl: string;
+    /** Default `["name", "email"]`. */
+    scopes?: string[];
+    /** Extra parameters on the authorize URL. */
+    authorizeParams?: Record<string, string>;
+}
+export declare class AppleDriver extends OidcDriver {
+    constructor(config: AppleConfig);
+    /**
+     * Apple sends `email_verified` and `is_private_email` as the strings
+     * `"true"` / `"false"`. Read as a boolean, a verified address reads as
+     * unverified — and an application that gates account linking on that would
+     * refuse every Apple sign-in.
+     */
+    protected mapUser(raw: Record<string, unknown>): TransitUser;
+}
+//# sourceMappingURL=AppleDriver.d.ts.map

package/dist/drivers/AppleDriver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AppleDriver.d.ts","sourceRoot":"","sources":["../../src/drivers/AppleDriver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,KAAK,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,MAAM,WAAW,WAAY,SAAQ,QAAQ;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,6CAA6C;IAC7C,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAED,qBAAa,WAAY,SAAQ,UAAU;gBAC9B,MAAM,EAAE,WAAW;IAmB/B;;;;;OAKG;cACgB,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW;CAUrE"}

package/dist/drivers/AppleDriver.js

@@ -0,0 +1,58 @@
+/**
+ * Sign in with Apple.
+ *
+ * Apple speaks OpenID Connect, so most of this is the generic driver. Three
+ * things differ, and each is a place implementations get caught:
+ *
+ *   - There is no client secret. Apple takes a short-lived JWT signed with the
+ *     `.p8` private key from the developer account.
+ *   - The callback arrives as a **POST**, not a redirect with a query string,
+ *     because asking for a name or an address forces `response_mode=form_post`.
+ *   - The name is sent **once**, in that first POST, and never again.
+ *
+ * Apple publishes no userinfo endpoint: everything there is comes from the
+ * id_token.
+ */
+import { appleClientSecret } from "../apple.js";
+import { OidcDriver } from "./OidcDriver.js";
+export class AppleDriver extends OidcDriver {
+    constructor(config) {
+        super({
+            issuer: "https://appleid.apple.com",
+            clientId: config.clientId,
+            clientSecret: () => appleClientSecret(config),
+            callbackUrl: config.callbackUrl,
+            scopes: config.scopes ?? ["name", "email"],
+            authorizeParams: {
+                // Apple refuses to send a name or an address back on a redirect,
+                // so the callback route has to accept a POST.
+                response_mode: "form_post",
+                ...config.authorizeParams,
+            },
+            // Apple has no userinfo endpoint; asking would be one failed request
+            // per sign-in.
+            userinfo: false,
+        });
+    }
+    /**
+     * Apple sends `email_verified` and `is_private_email` as the strings
+     * `"true"` / `"false"`. Read as a boolean, a verified address reads as
+     * unverified — and an application that gates account linking on that would
+     * refuse every Apple sign-in.
+     */
+    mapUser(raw) {
+        const user = super.mapUser(raw);
+        if (user.email === "")
+            return user;
+        return {
+            ...user,
+            emailVerificationState: appleFlag(raw.email_verified)
+                ? "verified"
+                : "unverified",
+        };
+    }
+}
+function appleFlag(value) {
+    return value === true || value === "true";
+}
+//# sourceMappingURL=AppleDriver.js.map

package/dist/drivers/AppleDriver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AppleDriver.js","sourceRoot":"","sources":["../../src/drivers/AppleDriver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAiB,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAE/D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAU7C,MAAM,OAAO,WAAY,SAAQ,UAAU;IAC1C,YAAY,MAAmB;QAC9B,KAAK,CAAC;YACL,MAAM,EAAE,2BAA2B;YACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,YAAY,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC;YAC7C,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;YAC1C,eAAe,EAAE;gBAChB,iEAAiE;gBACjE,8CAA8C;gBAC9C,aAAa,EAAE,WAAW;gBAC1B,GAAG,MAAM,CAAC,eAAe;aACzB;YACD,qEAAqE;YACrE,eAAe;YACf,QAAQ,EAAE,KAAK;SACf,CAAC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACgB,OAAO,CAAC,GAA4B;QACtD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO;YACN,GAAG,IAAI;YACP,sBAAsB,EAAE,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC;gBACpD,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,YAAY;SACf,CAAC;IACH,CAAC;CACD;AAED,SAAS,SAAS,CAAC,KAAc;IAChC,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,MAAM,CAAC;AAC3C,CAAC"}

package/dist/drivers/DiscordDriver.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Discord OAuth2 driver.
+ */
+import { Oauth2Driver } from "../Oauth2Driver.js";
+import type { TransitUser } from "../types.js";
+export declare class DiscordDriver extends Oauth2Driver {
+    protected readonly provider = "Discord";
+    protected readonly authorizeUrl = "https://discord.com/oauth2/authorize";
+    protected readonly accessTokenUrl = "https://discord.com/api/oauth2/token";
+    protected readonly userInfoUrl = "https://discord.com/api/users/@me";
+    /** `email` is what makes the address present at all; `identify` is the rest. */
+    protected readonly defaultScopes: readonly ["identify", "email"];
+    protected mapUser(raw: Record<string, unknown>): TransitUser;
+}
+//# sourceMappingURL=DiscordDriver.d.ts.map

package/dist/drivers/DiscordDriver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DiscordDriver.d.ts","sourceRoot":"","sources":["../../src/drivers/DiscordDriver.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,qBAAa,aAAc,SAAQ,YAAY;IAC9C,SAAS,CAAC,QAAQ,CAAC,QAAQ,aAAa;IACxC,SAAS,CAAC,QAAQ,CAAC,YAAY,0CAA0C;IACzE,SAAS,CAAC,QAAQ,CAAC,cAAc,0CAA0C;IAC3E,SAAS,CAAC,QAAQ,CAAC,WAAW,uCAAuC;IACrE,gFAAgF;IAChF,SAAS,CAAC,QAAQ,CAAC,aAAa,iCAAkC;IAElE,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW;CAkB5D"}

package/dist/drivers/DiscordDriver.js

@@ -0,0 +1,45 @@
+/**
+ * Discord OAuth2 driver.
+ */
+import { Oauth2Driver } from "../Oauth2Driver.js";
+export class DiscordDriver extends Oauth2Driver {
+    provider = "Discord";
+    authorizeUrl = "https://discord.com/oauth2/authorize";
+    accessTokenUrl = "https://discord.com/api/oauth2/token";
+    userInfoUrl = "https://discord.com/api/users/@me";
+    /** `email` is what makes the address present at all; `identify` is the rest. */
+    defaultScopes = ["identify", "email"];
+    mapUser(raw) {
+        const id = String(raw.id ?? "");
+        return {
+            id,
+            email: String(raw.email ?? ""),
+            name: String(raw.global_name ?? raw.username ?? ""),
+            nickName: typeof raw.username === "string" ? raw.username : undefined,
+            avatarUrl: avatarUrl(id, raw),
+            // Discord reports it only when the `email` scope was granted.
+            emailVerificationState: "verified" in raw
+                ? raw.verified === true
+                    ? "verified"
+                    : "unverified"
+                : "unsupported",
+            raw,
+        };
+    }
+}
+/**
+ * Discord serves avatars from a CDN path built from the id and the hash, and
+ * animated ones only as `.gif`. An account with no avatar has a default one
+ * derived from its id.
+ */
+function avatarUrl(id, raw) {
+    const hash = raw.avatar;
+    if (typeof hash !== "string" || hash === "") {
+        // Post-migration accounts (no discriminator) index the defaults by id.
+        const index = (BigInt(id || "0") >> 22n) % 6n;
+        return `https://cdn.discordapp.com/embed/avatars/${index}.png`;
+    }
+    const extension = hash.startsWith("a_") ? "gif" : "png";
+    return `https://cdn.discordapp.com/avatars/${id}/${hash}.${extension}`;
+}
+//# sourceMappingURL=DiscordDriver.js.map

package/dist/drivers/DiscordDriver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DiscordDriver.js","sourceRoot":"","sources":["../../src/drivers/DiscordDriver.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,MAAM,OAAO,aAAc,SAAQ,YAAY;IAC3B,QAAQ,GAAG,SAAS,CAAC;IACrB,YAAY,GAAG,sCAAsC,CAAC;IACtD,cAAc,GAAG,sCAAsC,CAAC;IACxD,WAAW,GAAG,mCAAmC,CAAC;IACrE,gFAAgF;IAC7D,aAAa,GAAG,CAAC,UAAU,EAAE,OAAO,CAAU,CAAC;IAExD,OAAO,CAAC,GAA4B;QAC7C,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,OAAO;YACN,EAAE;YACF,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9B,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;YACnD,QAAQ,EAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YACrE,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC;YAC7B,8DAA8D;YAC9D,sBAAsB,EACrB,UAAU,IAAI,GAAG;gBAChB,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI;oBACtB,CAAC,CAAC,UAAU;oBACZ,CAAC,CAAC,YAAY;gBACf,CAAC,CAAC,aAAa;YACjB,GAAG;SACH,CAAC;IACH,CAAC;CACD;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,EAAU,EAAE,GAA4B;IAC1D,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC;IACxB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAC7C,uEAAuE;QACvE,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;QAC9C,OAAO,4CAA4C,KAAK,MAAM,CAAC;IAChE,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACxD,OAAO,sCAAsC,EAAE,IAAI,IAAI,IAAI,SAAS,EAAE,CAAC;AACxE,CAAC"}

package/dist/drivers/FacebookDriver.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Facebook OAuth2 driver.
+ */
+import { Oauth2Driver } from "../Oauth2Driver.js";
+import type { TransitUser } from "../types.js";
+export declare class FacebookDriver extends Oauth2Driver {
+    protected readonly provider = "Facebook";
+    protected readonly authorizeUrl = "https://www.facebook.com/v21.0/dialog/oauth";
+    protected readonly accessTokenUrl = "https://graph.facebook.com/v21.0/oauth/access_token";
+    protected readonly userInfoUrl = "https://graph.facebook.com/v21.0/me";
+    protected readonly defaultScopes: readonly ["email"];
+    protected userInfoParams(): Record<string, string>;
+    protected mapUser(raw: Record<string, unknown>): TransitUser;
+}
+//# sourceMappingURL=FacebookDriver.d.ts.map

package/dist/drivers/FacebookDriver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FacebookDriver.d.ts","sourceRoot":"","sources":["../../src/drivers/FacebookDriver.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAY/C,qBAAa,cAAe,SAAQ,YAAY;IAC/C,SAAS,CAAC,QAAQ,CAAC,QAAQ,cAAc;IACzC,SAAS,CAAC,QAAQ,CAAC,YAAY,iDACgB;IAC/C,SAAS,CAAC,QAAQ,CAAC,cAAc,yDACsB;IACvD,SAAS,CAAC,QAAQ,CAAC,WAAW,yCAAyC;IACvE,SAAS,CAAC,QAAQ,CAAC,aAAa,qBAAsB;cAEnC,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAI3D,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW;CAY5D"}

package/dist/drivers/FacebookDriver.js

@@ -0,0 +1,47 @@
+/**
+ * Facebook OAuth2 driver.
+ */
+import { Oauth2Driver } from "../Oauth2Driver.js";
+/** The Graph API returns nothing but the id unless the fields are asked for. */
+const USER_FIELDS = [
+    "name",
+    "first_name",
+    "last_name",
+    "link",
+    "email",
+    "picture.width(400).height(400)",
+];
+export class FacebookDriver extends Oauth2Driver {
+    provider = "Facebook";
+    authorizeUrl = "https://www.facebook.com/v21.0/dialog/oauth";
+    accessTokenUrl = "https://graph.facebook.com/v21.0/oauth/access_token";
+    userInfoUrl = "https://graph.facebook.com/v21.0/me";
+    defaultScopes = ["email"];
+    userInfoParams() {
+        return { fields: USER_FIELDS.join(",") };
+    }
+    mapUser(raw) {
+        return {
+            id: String(raw.id ?? ""),
+            // The address is absent unless the user granted the `email` scope.
+            email: String(raw.email ?? ""),
+            name: String(raw.name ?? ""),
+            nickName: typeof raw.name === "string" ? raw.name : undefined,
+            avatarUrl: pictureUrl(raw),
+            emailVerificationState: "unsupported",
+            raw,
+        };
+    }
+}
+/** The picture arrives nested as `picture.data.url`. */
+function pictureUrl(raw) {
+    const picture = raw.picture;
+    if (typeof picture !== "object" || picture === null)
+        return undefined;
+    const data = Reflect.get(picture, "data");
+    if (typeof data !== "object" || data === null)
+        return undefined;
+    const url = Reflect.get(data, "url");
+    return typeof url === "string" && url !== "" ? url : undefined;
+}
+//# sourceMappingURL=FacebookDriver.js.map

package/dist/drivers/FacebookDriver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FacebookDriver.js","sourceRoot":"","sources":["../../src/drivers/FacebookDriver.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,gFAAgF;AAChF,MAAM,WAAW,GAAG;IACnB,MAAM;IACN,YAAY;IACZ,WAAW;IACX,MAAM;IACN,OAAO;IACP,gCAAgC;CACvB,CAAC;AAEX,MAAM,OAAO,cAAe,SAAQ,YAAY;IAC5B,QAAQ,GAAG,UAAU,CAAC;IACtB,YAAY,GAC9B,6CAA6C,CAAC;IAC5B,cAAc,GAChC,qDAAqD,CAAC;IACpC,WAAW,GAAG,qCAAqC,CAAC;IACpD,aAAa,GAAG,CAAC,OAAO,CAAU,CAAC;IAEnC,cAAc;QAChC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1C,CAAC;IAES,OAAO,CAAC,GAA4B;QAC7C,OAAO;YACN,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;YACxB,mEAAmE;YACnE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9B,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;YAC5B,QAAQ,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YAC7D,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC;YAC1B,sBAAsB,EAAE,aAAa;YACrC,GAAG;SACH,CAAC;IACH,CAAC;CACD;AAED,wDAAwD;AACxD,SAAS,UAAU,CAAC,GAA4B;IAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC"}

package/dist/drivers/GitHubDriver.d.ts

@@ -0,0 +1,33 @@
+/**
+ * GitHub OAuth2 driver.
+ */
+import { Oauth2Driver } from "../Oauth2Driver.js";
+import type { TransitUser } from "../types.js";
+/** One entry of `/user/emails`. */
+interface GitHubEmail {
+    email: string;
+    primary: boolean;
+    verified: boolean;
+}
+export declare class GitHubDriver extends Oauth2Driver {
+    protected readonly provider = "GitHub";
+    protected readonly authorizeUrl = "https://github.com/login/oauth/authorize";
+    protected readonly accessTokenUrl = "https://github.com/login/oauth/access_token";
+    protected readonly userInfoUrl = "https://api.github.com/user";
+    protected readonly defaultScopes: readonly ["read:user", "user:email"];
+    /**
+     * An account whose address is private returns `email: null` from `/user`,
+     * which is most accounts. The address then lives behind `/user/emails`,
+     * which also says whether GitHub verified it.
+     */
+    protected fetchUser(accessToken: string): Promise<TransitUser>;
+    /**
+     * The verified primary address, or the best available one. Returns
+     * `undefined` when the token was not granted `user:email` — a sign-in
+     * without an address is still a sign-in.
+     */
+    fetchEmail(accessToken: string): Promise<GitHubEmail | undefined>;
+    protected mapUser(raw: Record<string, unknown>): TransitUser;
+}
+export {};
+//# sourceMappingURL=GitHubDriver.d.ts.map

package/dist/drivers/GitHubDriver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubDriver.d.ts","sourceRoot":"","sources":["../../src/drivers/GitHubDriver.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAO,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/C,mCAAmC;AACnC,UAAU,WAAW;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,YAAa,SAAQ,YAAY;IAC7C,SAAS,CAAC,QAAQ,CAAC,QAAQ,YAAY;IACvC,SAAS,CAAC,QAAQ,CAAC,YAAY,8CAA8C;IAC7E,SAAS,CAAC,QAAQ,CAAC,cAAc,iDACc;IAC/C,SAAS,CAAC,QAAQ,CAAC,WAAW,iCAAiC;IAC/D,SAAS,CAAC,QAAQ,CAAC,aAAa,uCAAwC;IAExE;;;;OAIG;cACsB,SAAS,CACjC,WAAW,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IAcvB;;;;OAIG;IACG,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAkBvE,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW;CAc5D"}

package/dist/drivers/GitHubDriver.js

@@ -0,0 +1,72 @@
+/**
+ * GitHub OAuth2 driver.
+ */
+import { Oauth2Driver, str } from "../Oauth2Driver.js";
+const EMAILS_URL = "https://api.github.com/user/emails";
+export class GitHubDriver extends Oauth2Driver {
+    provider = "GitHub";
+    authorizeUrl = "https://github.com/login/oauth/authorize";
+    accessTokenUrl = "https://github.com/login/oauth/access_token";
+    userInfoUrl = "https://api.github.com/user";
+    defaultScopes = ["read:user", "user:email"];
+    /**
+     * An account whose address is private returns `email: null` from `/user`,
+     * which is most accounts. The address then lives behind `/user/emails`,
+     * which also says whether GitHub verified it.
+     */
+    async fetchUser(accessToken) {
+        const raw = await this.get(this.userInfoUrl, accessToken);
+        const user = this.mapUser(raw);
+        if (user.email !== "")
+            return user;
+        const found = await this.fetchEmail(accessToken);
+        if (found === undefined)
+            return user;
+        return {
+            ...user,
+            email: found.email,
+            emailVerificationState: found.verified ? "verified" : "unverified",
+        };
+    }
+    /**
+     * The verified primary address, or the best available one. Returns
+     * `undefined` when the token was not granted `user:email` — a sign-in
+     * without an address is still a sign-in.
+     */
+    async fetchEmail(accessToken) {
+        let entries;
+        try {
+            entries = await this.getList(EMAILS_URL, accessToken);
+        }
+        catch {
+            return undefined;
+        }
+        const emails = entries.filter(isGitHubEmail);
+        // Primary first, then verified: an unverified primary is still the
+        // address the account is known by.
+        return (emails.find((entry) => entry.primary && entry.verified) ??
+            emails.find((entry) => entry.verified) ??
+            emails.find((entry) => entry.primary) ??
+            emails[0]);
+    }
+    mapUser(raw) {
+        return {
+            id: String(raw.id ?? ""),
+            email: String(raw.email ?? ""),
+            // An account with no display name still has a login.
+            name: String(raw.name ?? raw.login ?? ""),
+            nickName: str(raw, "login"),
+            avatarUrl: str(raw, "avatar_url"),
+            // `/user` says nothing about the address; `fetchUser` refines this
+            // when it has to read `/user/emails`.
+            emailVerificationState: "unsupported",
+            raw,
+        };
+    }
+}
+function isGitHubEmail(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        typeof Reflect.get(value, "email") === "string");
+}
+//# sourceMappingURL=GitHubDriver.js.map

package/dist/drivers/GitHubDriver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubDriver.js","sourceRoot":"","sources":["../../src/drivers/GitHubDriver.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAGvD,MAAM,UAAU,GAAG,oCAAoC,CAAC;AASxD,MAAM,OAAO,YAAa,SAAQ,YAAY;IAC1B,QAAQ,GAAG,QAAQ,CAAC;IACpB,YAAY,GAAG,0CAA0C,CAAC;IAC1D,cAAc,GAChC,6CAA6C,CAAC;IAC5B,WAAW,GAAG,6BAA6B,CAAC;IAC5C,aAAa,GAAG,CAAC,WAAW,EAAE,YAAY,CAAU,CAAC;IAExE;;;;OAIG;IACgB,KAAK,CAAC,SAAS,CACjC,WAAmB;QAEnB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QAEnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO;YACN,GAAG,IAAI;YACP,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,sBAAsB,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY;SAClE,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,WAAmB;QACnC,IAAI,OAAkB,CAAC;QACvB,IAAI,CAAC;YACJ,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC7C,mEAAmE;QACnE,mCAAmC;QACnC,OAAO,CACN,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC;YACvD,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;YACrC,MAAM,CAAC,CAAC,CAAC,CACT,CAAC;IACH,CAAC;IAES,OAAO,CAAC,GAA4B;QAC7C,OAAO;YACN,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;YACxB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9B,qDAAqD;YACrD,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YACzC,QAAQ,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC;YAC3B,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC;YACjC,mEAAmE;YACnE,sCAAsC;YACtC,sBAAsB,EAAE,aAAa;YACrC,GAAG;SACH,CAAC;IACH,CAAC;CACD;AAED,SAAS,aAAa,CAAC,KAAc;IACpC,OAAO,CACN,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,QAAQ,CAC/C,CAAC;AACH,CAAC"}

package/dist/drivers/GoogleDriver.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Google OAuth2 driver.
+ */
+import { Oauth2Driver } from "../Oauth2Driver.js";
+import type { TransitUser } from "../types.js";
+export declare class GoogleDriver extends Oauth2Driver {
+    protected readonly provider = "Google";
+    protected readonly authorizeUrl = "https://accounts.google.com/o/oauth2/v2/auth";
+    protected readonly accessTokenUrl = "https://oauth2.googleapis.com/token";
+    protected readonly userInfoUrl = "https://www.googleapis.com/oauth2/v3/userinfo";
+    protected readonly defaultScopes: readonly ["openid", "email", "profile"];
+    /** Asking for offline access is what makes Google issue a refresh token. */
+    protected authorizeParams(): Record<string, string>;
+    protected mapUser(raw: Record<string, unknown>): TransitUser;
+}
+//# sourceMappingURL=GoogleDriver.d.ts.map

package/dist/drivers/GoogleDriver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GoogleDriver.d.ts","sourceRoot":"","sources":["../../src/drivers/GoogleDriver.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAO,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,qBAAa,YAAa,SAAQ,YAAY;IAC7C,SAAS,CAAC,QAAQ,CAAC,QAAQ,YAAY;IACvC,SAAS,CAAC,QAAQ,CAAC,YAAY,kDACiB;IAChD,SAAS,CAAC,QAAQ,CAAC,cAAc,yCAAyC;IAC1E,SAAS,CAAC,QAAQ,CAAC,WAAW,mDACmB;IACjD,SAAS,CAAC,QAAQ,CAAC,aAAa,0CAA2C;IAE3E,4EAA4E;cACzD,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAI5D,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW;CAgB5D"}

package/dist/drivers/GoogleDriver.js

@@ -0,0 +1,31 @@
+/**
+ * Google OAuth2 driver.
+ */
+import { Oauth2Driver, str } from "../Oauth2Driver.js";
+export class GoogleDriver extends Oauth2Driver {
+    provider = "Google";
+    authorizeUrl = "https://accounts.google.com/o/oauth2/v2/auth";
+    accessTokenUrl = "https://oauth2.googleapis.com/token";
+    userInfoUrl = "https://www.googleapis.com/oauth2/v3/userinfo";
+    defaultScopes = ["openid", "email", "profile"];
+    /** Asking for offline access is what makes Google issue a refresh token. */
+    authorizeParams() {
+        return { access_type: "offline" };
+    }
+    mapUser(raw) {
+        return {
+            // The OpenID Connect endpoint calls the subject `sub`; the older one
+            // called it `id`, and both are the same value.
+            id: String(raw.sub ?? raw.id ?? ""),
+            email: String(raw.email ?? ""),
+            name: String(raw.name ?? ""),
+            nickName: str(raw, "given_name") ?? str(raw, "name"),
+            avatarUrl: str(raw, "picture"),
+            emailVerificationState: raw.email_verified === true || raw.verified_email === true
+                ? "verified"
+                : "unverified",
+            raw,
+        };
+    }
+}
+//# sourceMappingURL=GoogleDriver.js.map

package/dist/drivers/GoogleDriver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GoogleDriver.js","sourceRoot":"","sources":["../../src/drivers/GoogleDriver.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAGvD,MAAM,OAAO,YAAa,SAAQ,YAAY;IAC1B,QAAQ,GAAG,QAAQ,CAAC;IACpB,YAAY,GAC9B,8CAA8C,CAAC;IAC7B,cAAc,GAAG,qCAAqC,CAAC;IACvD,WAAW,GAC7B,+CAA+C,CAAC;IAC9B,aAAa,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAU,CAAC;IAE3E,4EAA4E;IACzD,eAAe;QACjC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IACnC,CAAC;IAES,OAAO,CAAC,GAA4B;QAC7C,OAAO;YACN,qEAAqE;YACrE,+CAA+C;YAC/C,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;YACnC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9B,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;YAC5B,QAAQ,EAAE,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC;YACpD,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC;YAC9B,sBAAsB,EACrB,GAAG,CAAC,cAAc,KAAK,IAAI,IAAI,GAAG,CAAC,cAAc,KAAK,IAAI;gBACzD,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,YAAY;YAChB,GAAG;SACH,CAAC;IACH,CAAC;CACD"}

package/dist/drivers/LdapDirectory.d.ts

@@ -0,0 +1,51 @@
+/**
+ * An LDAP or Active Directory directory.
+ *
+ * Nothing is redirected: the application already holds the credentials, and the
+ * directory is the authority that says whether they are right. Verifying them
+ * means binding AS that person — a bind that succeeds is the answer, and there
+ * is no other one.
+ *
+ * The flow is two connections on purpose. The first finds the person's DN,
+ * bound as whatever the application is allowed to search with. The second binds
+ * as the person, and is closed immediately: a connection carries the identity
+ * of whatever last bound on it, so nothing else may run on that one.
+ */
+import { type LdapFilter } from "../ldap.js";
+import type { DirectoryDriver, TransitUser } from "../types.js";
+export interface LdapConfig {
+    /** `ldaps://directory.acme.test:636`. */
+    url: string;
+    /** Where to search from — `dc=acme,dc=test`. */
+    baseDn: string;
+    /**
+     * The attribute a person types. `uid` on OpenLDAP,
+     * `sAMAccountName` or `userPrincipalName` on Active Directory.
+     */
+    loginAttribute: string;
+    /** The account the search runs as. Omitted means an anonymous search. */
+    bindDn?: string;
+    bindPassword?: string;
+    /** Extra conditions on the search, ANDed with the login attribute. */
+    filter?: LdapFilter;
+    /** Attributes to read. Defaults to the ones the mapping below uses. */
+    attributes?: string[];
+    /** The attribute names this directory uses, when they are not the usual ones. */
+    claims?: {
+        email?: string;
+        name?: string;
+        nickName?: string;
+    };
+    /** Allow a plaintext connection — see the note on `LdapOptions`. */
+    allowInsecure?: boolean;
+    /** Refuse a server certificate that does not check out. Default true. */
+    rejectUnauthorized?: boolean;
+    /** How long to wait for the directory, in milliseconds. Default 10 000. */
+    timeoutMs?: number;
+}
+export declare class LdapDirectory implements DirectoryDriver {
+    #private;
+    constructor(config: LdapConfig);
+    authenticate(username: string, password: string): Promise<TransitUser>;
+}
+//# sourceMappingURL=LdapDirectory.d.ts.map

package/dist/drivers/LdapDirectory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LdapDirectory.d.ts","sourceRoot":"","sources":["../../src/drivers/LdapDirectory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAIN,KAAK,UAAU,EACf,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEhE,MAAM,WAAW,UAAU;IAC1B,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,iFAAiF;IACjF,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,oEAAoE;IACpE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,yEAAyE;IACzE,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAMD,qBAAa,aAAc,YAAW,eAAe;;gBAGxC,MAAM,EAAE,UAAU;IAIxB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;CAgH5E"}

package/dist/drivers/LdapDirectory.js

@@ -0,0 +1,127 @@
+/**
+ * An LDAP or Active Directory directory.
+ *
+ * Nothing is redirected: the application already holds the credentials, and the
+ * directory is the authority that says whether they are right. Verifying them
+ * means binding AS that person — a bind that succeeds is the answer, and there
+ * is no other one.
+ *
+ * The flow is two connections on purpose. The first finds the person's DN,
+ * bound as whatever the application is allowed to search with. The second binds
+ * as the person, and is closed immediately: a connection carries the identity
+ * of whatever last bound on it, so nothing else may run on that one.
+ */
+import { LdapConnection, LdapError, } from "../ldap.js";
+const EMAIL_ATTRS = ["mail", "userPrincipalName", "email"];
+const NAME_ATTRS = ["displayName", "cn", "name"];
+const NICK_ATTRS = ["uid", "sAMAccountName", "givenName"];
+export class LdapDirectory {
+    #config;
+    constructor(config) {
+        this.#config = config;
+    }
+    async authenticate(username, password) {
+        // Refused here as well as in the bind: a form that submits an empty
+        // password must not reach the directory, which would answer success to
+        // an anonymous bind.
+        if (password === "") {
+            throw new LdapError("a password is required — an empty one is an anonymous bind, which the directory would accept");
+        }
+        if (username === "") {
+            throw new LdapError("a username is required");
+        }
+        const entry = await this.#find(username);
+        await this.#bindAs(entry.dn, password);
+        return this.#mapUser(entry);
+    }
+    /** Find the person, bound as whatever may search. */
+    async #find(username) {
+        const connection = this.#open();
+        await connection.connect();
+        try {
+            if (this.#config.bindDn) {
+                await connection.bind(this.#config.bindDn, this.#config.bindPassword ?? "");
+            }
+            // The username is a VALUE in a structure, never text in a filter, so
+            // a login of `*)(uid=admin` is a login containing those characters.
+            const login = {
+                equals: [this.#config.loginAttribute, username],
+            };
+            const filter = this.#config.filter
+                ? { and: [this.#config.filter, login] }
+                : login;
+            const entries = await connection.search({
+                base: this.#config.baseDn,
+                filter,
+                attributes: this.#config.attributes ?? [
+                    ...EMAIL_ATTRS,
+                    ...NAME_ATTRS,
+                    ...NICK_ATTRS,
+                ],
+                // Two, so an ambiguous login is seen rather than silently
+                // resolved to whichever the directory returned first.
+                sizeLimit: 2,
+            });
+            if (entries.length === 0) {
+                // The same message as a wrong password: which of the two it was
+                // is not something a sign-in form should disclose.
+                throw new LdapError("the directory refused the bind: invalid credentials", 49);
+            }
+            if (entries.length > 1) {
+                throw new LdapError(`'${username}' matches ${entries.length} entries, and this signs in one person`);
+            }
+            return entries[0];
+        }
+        finally {
+            await connection.close();
+        }
+    }
+    /** Bind as the person. A bind that succeeds IS the verification. */
+    async #bindAs(dn, password) {
+        const connection = this.#open();
+        await connection.connect();
+        try {
+            await connection.bind(dn, password);
+        }
+        finally {
+            // The connection now carries this person's identity; it is closed
+            // rather than reused.
+            await connection.close();
+        }
+    }
+    #open() {
+        return new LdapConnection({
+            url: this.#config.url,
+            allowInsecure: this.#config.allowInsecure,
+            rejectUnauthorized: this.#config.rejectUnauthorized,
+            timeoutMs: this.#config.timeoutMs,
+        });
+    }
+    #mapUser(entry) {
+        const claims = this.#config.claims ?? {};
+        const email = pick(entry, claims.email, EMAIL_ATTRS);
+        const name = pick(entry, claims.name, NAME_ATTRS);
+        const nickName = pick(entry, claims.nickName, NICK_ATTRS);
+        return {
+            // The DN is what the directory calls this entry, and the only value
+            // guaranteed to be unique and stable.
+            id: entry.dn,
+            email: email ?? "",
+            name: name ?? nickName ?? entry.dn,
+            nickName,
+            // A directory that holds an address has vouched for it: that is what
+            // a directory is.
+            emailVerificationState: email === undefined ? "unsupported" : "verified",
+            raw: { dn: entry.dn, attributes: entry.attributes },
+        };
+    }
+}
+function pick(entry, configured, candidates) {
+    for (const name of configured ? [configured] : candidates) {
+        const value = entry.attributes[name]?.[0];
+        if (value !== undefined && value !== "")
+            return value;
+    }
+    return undefined;
+}
+//# sourceMappingURL=LdapDirectory.js.map