@cloudauth/providers 0.1.0

package/dist/google.js

@@ -0,0 +1,71 @@
+const GOOGLE_AUTH_URL = 'https://accounts.google.com/o/oauth2/v2/auth';
+const GOOGLE_TOKEN_URL = 'https://oauth2.googleapis.com/token';
+const GOOGLE_USERINFO_URL = 'https://openidconnect.googleapis.com/v1/userinfo';
+const DEFAULT_SCOPES = ['openid', 'email', 'profile'];
+export function google(config) {
+    const scopes = config.scope ?? DEFAULT_SCOPES;
+    return {
+        id: 'google',
+        type: 'oidc',
+        authorizationUrl(params) {
+            const url = new URL(GOOGLE_AUTH_URL);
+            url.searchParams.set('client_id', config.clientId);
+            url.searchParams.set('redirect_uri', params.redirectUri);
+            url.searchParams.set('response_type', 'code');
+            url.searchParams.set('scope', scopes.join(' '));
+            url.searchParams.set('state', params.state);
+            url.searchParams.set('code_challenge', params.codeVerifier);
+            url.searchParams.set('code_challenge_method', 'S256');
+            url.searchParams.set('access_type', 'offline');
+            url.searchParams.set('prompt', 'consent');
+            return url;
+        },
+        async exchangeCode(params) {
+            const body = new URLSearchParams({
+                client_id: config.clientId,
+                client_secret: config.clientSecret,
+                code: params.code,
+                code_verifier: params.codeVerifier,
+                redirect_uri: params.redirectUri,
+                grant_type: 'authorization_code',
+            });
+            const response = await fetch(GOOGLE_TOKEN_URL, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body,
+            });
+            if (!response.ok) {
+                const error = await response.text().catch(() => 'unknown error');
+                throw new Error(`Google token exchange failed: ${String(response.status)} ${error}`);
+            }
+            const data = (await response.json());
+            return {
+                accessToken: data.access_token ?? '',
+                refreshToken: data.refresh_token,
+                idToken: data.id_token,
+                scope: data.scope,
+                tokenType: data.token_type,
+                expiresAt: data.expires_in,
+            };
+        },
+        async getProfile(tokens) {
+            const response = await fetch(GOOGLE_USERINFO_URL, {
+                headers: { Authorization: `Bearer ${tokens.accessToken}` },
+            });
+            if (!response.ok) {
+                throw new Error(`Google userinfo failed: ${String(response.status)}`);
+            }
+            const data = (await response.json());
+            return {
+                provider: 'google',
+                providerAccountId: data.sub ?? '',
+                email: data.email,
+                emailVerified: data.email_verified,
+                name: data.name,
+                image: data.picture,
+                raw: data,
+            };
+        },
+    };
+}
+//# sourceMappingURL=google.js.map

package/dist/google.js 2.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.js","sourceRoot":"","sources":["../src/google.ts"],"names":[],"mappings":"AAeA,MAAM,eAAe,GAAG,8CAA8C,CAAA;AACtE,MAAM,gBAAgB,GAAG,qCAAqC,CAAA;AAC9D,MAAM,mBAAmB,GAAG,kDAAkD,CAAA;AAC9E,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;AAmBrD,MAAM,UAAU,MAAM,CAAC,MAAoB;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,IAAI,cAAc,CAAA;IAE7C,OAAO;QACL,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,MAAM;QAEZ,gBAAgB,CAAC,MAA2B;YAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAA;YACpC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;YAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;YACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAA;YAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;YAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;YAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,YAAY,CAAC,CAAA;YAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAA;YACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAA;YAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;YACzC,OAAO,GAAG,CAAA;QACZ,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,MAA0B;YAC3C,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;gBAC/B,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;gBAClC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,aAAa,EAAE,MAAM,CAAC,YAAY;gBAClC,YAAY,EAAE,MAAM,CAAC,WAAW;gBAChC,UAAU,EAAE,oBAAoB;aACjC,CAAC,CAAA;YAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;gBAC7C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI;aACL,CAAC,CAAA;YAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAA;gBAChE,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC,CAAA;YACtF,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAA;YAC3D,OAAO;gBACL,WAAW,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;gBACpC,YAAY,EAAE,IAAI,CAAC,aAAa;gBAChC,OAAO,EAAE,IAAI,CAAC,QAAQ;gBACtB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,IAAI,CAAC,UAAU;gBAC1B,SAAS,EAAE,IAAI,CAAC,UAAU;aAC3B,CAAA;QACH,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,MAAgB;YAC/B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,mBAAmB,EAAE;gBAChD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE,EAAE;aAC3D,CAAC,CAAA;YAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YACvE,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmB,CAAA;YAEtD,OAAO;gBACL,QAAQ,EAAE,QAAQ;gBAClB,iBAAiB,EAAE,IAAI,CAAC,GAAG,IAAI,EAAE;gBACjC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,aAAa,EAAE,IAAI,CAAC,cAAc;gBAClC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,KAAK,EAAE,IAAI,CAAC,OAAO;gBACnB,GAAG,EAAE,IAAI;aACV,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/google.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.js","sourceRoot":"","sources":["../src/google.ts"],"names":[],"mappings":"AAeA,MAAM,eAAe,GAAG,8CAA8C,CAAA;AACtE,MAAM,gBAAgB,GAAG,qCAAqC,CAAA;AAC9D,MAAM,mBAAmB,GAAG,kDAAkD,CAAA;AAC9E,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;AAmBrD,MAAM,UAAU,MAAM,CAAC,MAAoB;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,IAAI,cAAc,CAAA;IAE7C,OAAO;QACL,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,MAAM;QAEZ,gBAAgB,CAAC,MAA2B;YAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAA;YACpC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;YAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;YACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAA;YAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;YAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;YAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,YAAY,CAAC,CAAA;YAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAA;YACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAA;YAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;YACzC,OAAO,GAAG,CAAA;QACZ,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,MAA0B;YAC3C,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;gBAC/B,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;gBAClC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,aAAa,EAAE,MAAM,CAAC,YAAY;gBAClC,YAAY,EAAE,MAAM,CAAC,WAAW;gBAChC,UAAU,EAAE,oBAAoB;aACjC,CAAC,CAAA;YAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;gBAC7C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI;aACL,CAAC,CAAA;YAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAA;gBAChE,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC,CAAA;YACtF,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAA;YAC3D,OAAO;gBACL,WAAW,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;gBACpC,YAAY,EAAE,IAAI,CAAC,aAAa;gBAChC,OAAO,EAAE,IAAI,CAAC,QAAQ;gBACtB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,IAAI,CAAC,UAAU;gBAC1B,SAAS,EAAE,IAAI,CAAC,UAAU;aAC3B,CAAA;QACH,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,MAAgB;YAC/B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,mBAAmB,EAAE;gBAChD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE,EAAE;aAC3D,CAAC,CAAA;YAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YACvE,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmB,CAAA;YAEtD,OAAO;gBACL,QAAQ,EAAE,QAAQ;gBAClB,iBAAiB,EAAE,IAAI,CAAC,GAAG,IAAI,EAAE;gBACjC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,aAAa,EAAE,IAAI,CAAC,cAAc;gBAClC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,KAAK,EAAE,IAAI,CAAC,OAAO;gBACnB,GAAG,EAAE,IAAI;aACV,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+export type { AuthProvider, AuthorizationParams, ExchangeCodeParams } from '@cloudauth/core';
+export type { ProviderProfile, TokenSet } from '@cloudauth/core';
+export { google } from './google.js';
+export type { GoogleConfig } from './google.js';
+export { github } from './github.js';
+export type { GitHubConfig } from './github.js';
+export { genericOAuth } from './generic-oauth.js';
+export type { GenericOAuthConfig } from './generic-oauth.js';
+export { createOIDCProvider } from './generic-oidc.js';
+export type { GenericOIDCConfig } from './generic-oidc.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts 2.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAC5F,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAEhE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE/C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACtD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAC5F,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAEhE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE/C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACtD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/index.js

@@ -0,0 +1,5 @@
+export { google } from './google.js';
+export { github } from './github.js';
+export { genericOAuth } from './generic-oauth.js';
+export { createOIDCProvider } from './generic-oidc.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAGpC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAGpC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAGjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA"}

package/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@cloudauth/providers",
+  "version": "0.1.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "dependencies": {
+    "@cloudauth/core": "0.1.0"
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit"
+  }
+}

package/src/generic-oauth.ts

@@ -0,0 +1,95 @@
+import type {
+  AuthProvider,
+  AuthorizationParams,
+  ExchangeCodeParams,
+  TokenSet,
+  ProviderProfile,
+} from '@cloudauth/core'
+
+export interface GenericOAuthConfig {
+  id: string
+  clientId: string
+  clientSecret: string
+  authorizationEndpoint: string
+  tokenEndpoint: string
+  userinfoEndpoint: string
+  redirectUri?: string
+  scopes?: string[]
+  mapProfile: (profile: Record<string, unknown>) => ProviderProfile
+}
+
+export function genericOAuth(config: GenericOAuthConfig): AuthProvider {
+  const scopes = config.scopes ?? ['profile']
+
+  return {
+    id: config.id,
+    type: 'oauth',
+
+    authorizationUrl(params: AuthorizationParams): URL {
+      const url = new URL(config.authorizationEndpoint)
+      url.searchParams.set('client_id', config.clientId)
+      url.searchParams.set('redirect_uri', params.redirectUri)
+      url.searchParams.set('response_type', 'code')
+      url.searchParams.set('scope', scopes.join(' '))
+      url.searchParams.set('state', params.state)
+      return url
+    },
+
+    async exchangeCode(params: ExchangeCodeParams): Promise<TokenSet> {
+      const body = new URLSearchParams({
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        code: params.code,
+        redirect_uri: params.redirectUri,
+        grant_type: 'authorization_code',
+      })
+
+      const response = await fetch(config.tokenEndpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body,
+      })
+
+      if (!response.ok) {
+        const error = await response.text().catch(() => 'unknown error')
+        throw new Error(`${config.id} token exchange failed: ${String(response.status)} ${error}`)
+      }
+
+      const data = (await response.json()) as {
+        access_token?: string
+        refresh_token?: string
+        id_token?: string
+        scope?: string
+        token_type?: string
+        expires_in?: number
+      }
+
+      return {
+        accessToken: data.access_token ?? '',
+        refreshToken: data.refresh_token,
+        idToken: data.id_token,
+        scope: data.scope,
+        tokenType: data.token_type,
+        expiresAt: data.expires_in,
+      }
+    },
+
+    async getProfile(tokens: TokenSet): Promise<ProviderProfile> {
+      const response = await fetch(config.userinfoEndpoint, {
+        headers: { Authorization: `Bearer ${tokens.accessToken}` },
+      })
+
+      if (!response.ok) {
+        throw new Error(`${config.id} userinfo failed: ${String(response.status)}`)
+      }
+
+      const data = (await response.json()) as Record<string, unknown>
+      const profile = config.mapProfile(data)
+      return {
+        ...profile,
+        provider: config.id,
+        raw: data,
+      }
+    },
+  }
+}

package/src/generic-oidc.ts

@@ -0,0 +1,128 @@
+import type {
+  AuthProvider,
+  AuthorizationParams,
+  ExchangeCodeParams,
+  TokenSet,
+  ProviderProfile,
+} from '@cloudauth/core'
+
+export interface GenericOIDCConfig {
+  id: string
+  clientId: string
+  clientSecret: string
+  issuer: string
+  redirectUri?: string
+  scopes?: string[]
+  mapProfile?: (profile: Record<string, unknown>) => Partial<ProviderProfile>
+}
+
+interface UserinfoResponse {
+  sub?: string
+  email?: string
+  email_verified?: boolean
+  name?: string
+  picture?: string
+  [key: string]: unknown
+}
+
+const DEFAULT_OIDC_SCOPES = ['openid', 'email', 'profile']
+
+/**
+ * Create a generic OIDC provider.
+ * Uses the issuer URL to discover the authorization, token, and userinfo endpoints
+ * via the OIDC discovery document (/.well-known/openid-configuration).
+ */
+export async function createOIDCProvider(config: GenericOIDCConfig): Promise<AuthProvider> {
+  const scopes = config.scopes ?? DEFAULT_OIDC_SCOPES
+
+  const discoveryUrl = `${config.issuer.replace(/\/+$/, '')}/.well-known/openid-configuration`
+  const discoveryResponse = await fetch(discoveryUrl)
+
+  if (!discoveryResponse.ok) {
+    throw new Error(`OIDC discovery failed for ${config.id}: ${String(discoveryResponse.status)}`)
+  }
+
+  const discovery = (await discoveryResponse.json()) as {
+    authorization_endpoint: string
+    token_endpoint: string
+    userinfo_endpoint: string
+  }
+
+  return {
+    id: config.id,
+    type: 'oidc',
+
+    authorizationUrl(params: AuthorizationParams): URL {
+      const url = new URL(discovery.authorization_endpoint)
+      url.searchParams.set('client_id', config.clientId)
+      url.searchParams.set('redirect_uri', params.redirectUri)
+      url.searchParams.set('response_type', 'code')
+      url.searchParams.set('scope', scopes.join(' '))
+      url.searchParams.set('state', params.state)
+      return url
+    },
+
+    async exchangeCode(params: ExchangeCodeParams): Promise<TokenSet> {
+      const body = new URLSearchParams({
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        code: params.code,
+        redirect_uri: params.redirectUri,
+        grant_type: 'authorization_code',
+      })
+
+      const response = await fetch(discovery.token_endpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body,
+      })
+
+      if (!response.ok) {
+        const error = await response.text().catch(() => 'unknown error')
+        throw new Error(`${config.id} token exchange failed: ${String(response.status)} ${error}`)
+      }
+
+      const data = (await response.json()) as {
+        access_token?: string
+        refresh_token?: string
+        id_token?: string
+        scope?: string
+        token_type?: string
+        expires_in?: number
+      }
+
+      return {
+        accessToken: data.access_token ?? '',
+        refreshToken: data.refresh_token,
+        idToken: data.id_token,
+        scope: data.scope,
+        tokenType: data.token_type,
+        expiresAt: data.expires_in,
+      }
+    },
+
+    async getProfile(tokens: TokenSet): Promise<ProviderProfile> {
+      const response = await fetch(discovery.userinfo_endpoint, {
+        headers: { Authorization: `Bearer ${tokens.accessToken}` },
+      })
+
+      if (!response.ok) {
+        throw new Error(`${config.id} userinfo failed: ${String(response.status)}`)
+      }
+
+      const data = (await response.json()) as UserinfoResponse
+      const mapped = config.mapProfile?.(data) ?? {}
+
+      return {
+        provider: config.id,
+        providerAccountId: data.sub ?? '',
+        email: data.email,
+        emailVerified: data.email_verified,
+        name: data.name,
+        image: data.picture,
+        ...mapped,
+        raw: data,
+      }
+    },
+  }
+}

package/src/github.ts

@@ -0,0 +1,134 @@
+import type {
+  AuthProvider,
+  AuthorizationParams,
+  ExchangeCodeParams,
+  TokenSet,
+  ProviderProfile,
+} from '@cloudauth/core'
+
+export interface GitHubConfig {
+  clientId: string
+  clientSecret: string
+  redirectUri?: string
+  scope?: string[]
+}
+
+const GITHUB_AUTH_URL = 'https://github.com/login/oauth/authorize'
+const GITHUB_TOKEN_URL = 'https://github.com/login/oauth/access_token'
+const GITHUB_USER_API = 'https://api.github.com/user'
+const GITHUB_USER_EMAILS_API = 'https://api.github.com/user/emails'
+const DEFAULT_SCOPES = ['read:user', 'user:email']
+
+interface GitHubTokenResponse {
+  access_token?: string
+  refresh_token?: string
+  id_token?: string
+  scope?: string
+  token_type?: string
+  expires_in?: number
+}
+
+interface GitHubUser {
+  id?: number
+  login?: string
+  name?: string
+  avatar_url?: string
+  email?: string
+}
+
+interface GitHubEmail {
+  email: string
+  verified: boolean
+  primary: boolean
+}
+
+export function github(config: GitHubConfig): AuthProvider {
+  const scopes = config.scope ?? DEFAULT_SCOPES
+
+  return {
+    id: 'github',
+    type: 'oauth',
+
+    authorizationUrl(params: AuthorizationParams): URL {
+      const url = new URL(GITHUB_AUTH_URL)
+      url.searchParams.set('client_id', config.clientId)
+      url.searchParams.set('redirect_uri', params.redirectUri)
+      url.searchParams.set('scope', scopes.join(' '))
+      url.searchParams.set('state', params.state)
+      return url
+    },
+
+    async exchangeCode(params: ExchangeCodeParams): Promise<TokenSet> {
+      const body = new URLSearchParams({
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        code: params.code,
+        redirect_uri: params.redirectUri,
+      })
+
+      const response = await fetch(GITHUB_TOKEN_URL, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          Accept: 'application/json',
+        },
+        body,
+      })
+
+      if (!response.ok) {
+        const error = await response.text().catch(() => 'unknown error')
+        throw new Error(`GitHub token exchange failed: ${String(response.status)} ${error}`)
+      }
+
+      const data = (await response.json()) as GitHubTokenResponse
+      return {
+        accessToken: data.access_token ?? '',
+        refreshToken: data.refresh_token,
+        idToken: data.id_token,
+        scope: data.scope,
+        tokenType: data.token_type,
+        expiresAt: data.expires_in,
+      }
+    },
+
+    async getProfile(tokens: TokenSet): Promise<ProviderProfile> {
+      const userResponse = await fetch(GITHUB_USER_API, {
+        headers: { Authorization: `Bearer ${tokens.accessToken}` },
+      })
+
+      if (!userResponse.ok) {
+        throw new Error(`GitHub user API failed: ${String(userResponse.status)}`)
+      }
+
+      const userData = (await userResponse.json()) as GitHubUser
+
+      let email = userData.email
+      let emailVerified = Boolean(userData.email)
+
+      if (!email) {
+        const emailsResponse = await fetch(GITHUB_USER_EMAILS_API, {
+          headers: { Authorization: `Bearer ${tokens.accessToken}` },
+        })
+
+        if (emailsResponse.ok) {
+          const emails = (await emailsResponse.json()) as GitHubEmail[]
+          const primaryEmail = emails.find((e) => e.primary)
+          if (primaryEmail) {
+            email = primaryEmail.email
+            emailVerified = primaryEmail.verified
+          }
+        }
+      }
+
+      return {
+        provider: 'github',
+        providerAccountId: userData.id != null ? String(userData.id) : '',
+        email,
+        emailVerified,
+        name: userData.name ?? userData.login,
+        image: userData.avatar_url,
+        raw: { ...userData, emails: undefined },
+      }
+    },
+  }
+}

package/src/google.ts

@@ -0,0 +1,113 @@
+import type {
+  AuthProvider,
+  AuthorizationParams,
+  ExchangeCodeParams,
+  TokenSet,
+  ProviderProfile,
+} from '@cloudauth/core'
+
+export interface GoogleConfig {
+  clientId: string
+  clientSecret: string
+  redirectUri?: string
+  scope?: string[]
+}
+
+const GOOGLE_AUTH_URL = 'https://accounts.google.com/o/oauth2/v2/auth'
+const GOOGLE_TOKEN_URL = 'https://oauth2.googleapis.com/token'
+const GOOGLE_USERINFO_URL = 'https://openidconnect.googleapis.com/v1/userinfo'
+const DEFAULT_SCOPES = ['openid', 'email', 'profile']
+
+interface GoogleTokenResponse {
+  access_token?: string
+  refresh_token?: string
+  id_token?: string
+  scope?: string
+  token_type?: string
+  expires_in?: number
+}
+
+interface GoogleUserInfo {
+  sub?: string
+  email?: string
+  email_verified?: boolean
+  name?: string
+  picture?: string
+}
+
+export function google(config: GoogleConfig): AuthProvider {
+  const scopes = config.scope ?? DEFAULT_SCOPES
+
+  return {
+    id: 'google',
+    type: 'oidc',
+
+    authorizationUrl(params: AuthorizationParams): URL {
+      const url = new URL(GOOGLE_AUTH_URL)
+      url.searchParams.set('client_id', config.clientId)
+      url.searchParams.set('redirect_uri', params.redirectUri)
+      url.searchParams.set('response_type', 'code')
+      url.searchParams.set('scope', scopes.join(' '))
+      url.searchParams.set('state', params.state)
+      url.searchParams.set('code_challenge', params.codeVerifier)
+      url.searchParams.set('code_challenge_method', 'S256')
+      url.searchParams.set('access_type', 'offline')
+      url.searchParams.set('prompt', 'consent')
+      return url
+    },
+
+    async exchangeCode(params: ExchangeCodeParams): Promise<TokenSet> {
+      const body = new URLSearchParams({
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        code: params.code,
+        code_verifier: params.codeVerifier,
+        redirect_uri: params.redirectUri,
+        grant_type: 'authorization_code',
+      })
+
+      const response = await fetch(GOOGLE_TOKEN_URL, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body,
+      })
+
+      if (!response.ok) {
+        const error = await response.text().catch(() => 'unknown error')
+        throw new Error(`Google token exchange failed: ${String(response.status)} ${error}`)
+      }
+
+      const data = (await response.json()) as GoogleTokenResponse
+      return {
+        accessToken: data.access_token ?? '',
+        refreshToken: data.refresh_token,
+        idToken: data.id_token,
+        scope: data.scope,
+        tokenType: data.token_type,
+        expiresAt: data.expires_in,
+      }
+    },
+
+    async getProfile(tokens: TokenSet): Promise<ProviderProfile> {
+      const response = await fetch(GOOGLE_USERINFO_URL, {
+        headers: { Authorization: `Bearer ${tokens.accessToken}` },
+      })
+
+      if (!response.ok) {
+        throw new Error(`Google userinfo failed: ${String(response.status)}`)
+      }
+
+      const data = (await response.json()) as GoogleUserInfo
+
+      return {
+        provider: 'google',
+        providerAccountId: data.sub ?? '',
+        email: data.email,
+        emailVerified: data.email_verified,
+        name: data.name,
+        image: data.picture,
+        raw: data,
+      }
+    },
+  }
+}

package/src/index.ts

@@ -0,0 +1,14 @@
+export type { AuthProvider, AuthorizationParams, ExchangeCodeParams } from '@cloudauth/core'
+export type { ProviderProfile, TokenSet } from '@cloudauth/core'
+
+export { google } from './google.js'
+export type { GoogleConfig } from './google.js'
+
+export { github } from './github.js'
+export type { GitHubConfig } from './github.js'
+
+export { genericOAuth } from './generic-oauth.js'
+export type { GenericOAuthConfig } from './generic-oauth.js'
+
+export { createOIDCProvider } from './generic-oidc.js'
+export type { GenericOIDCConfig } from './generic-oidc.js'

package/tsconfig.json

@@ -0,0 +1,11 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "composite": true,
+    "declaration": true
+  },
+  "include": ["src"],
+  "references": [{ "path": "../core" }]
+}