@codelitdev/oauth-server-kit 0.1.0-alpha.0

package/dist/index.d.ts

@@ -0,0 +1,17 @@
+import { O as OAuthResourceClient, A as AuthenticationResult } from './types-DJxCmhYu.js';
+export { a as AuthenticatedIdentity } from './types-DJxCmhYu.js';
+import '@better-auth/oauth-provider/resource-client';
+
+interface VerifyOAuthAccessTokenOptions {
+    oauthResourceClient: OAuthResourceClient;
+    issuer: string;
+    audiences: readonly string[];
+    resourceMetadataMappings?: Readonly<Record<string, string>>;
+}
+/**
+ * Verifies a Better Auth OAuth access token and returns protocol identity only.
+ * Product claims are deliberately discarded.
+ */
+declare function verifyOAuthAccessToken(options: VerifyOAuthAccessTokenOptions, token: string): Promise<AuthenticationResult>;
+
+export { AuthenticationResult, OAuthResourceClient, type VerifyOAuthAccessTokenOptions, verifyOAuthAccessToken };

package/dist/index.js

@@ -0,0 +1,106 @@
+'use strict';
+
+var __defProp = Object.defineProperty;
+var __defProps = Object.defineProperties;
+var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
+var __getOwnPropSymbols = Object.getOwnPropertySymbols;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __propIsEnum = Object.prototype.propertyIsEnumerable;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp.call(b, prop))
+      __defNormalProp(a, prop, b[prop]);
+  if (__getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(b)) {
+      if (__propIsEnum.call(b, prop))
+        __defNormalProp(a, prop, b[prop]);
+    }
+  return a;
+};
+var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
+
+// src/verify-access-token.ts
+function requireAbsoluteUrl(value, field) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch (e) {
+    throw new Error(`${field} must be an absolute URL`);
+  }
+  if (!["http:", "https:"].includes(url.protocol)) {
+    throw new Error(`${field} must use http or https`);
+  }
+  if (process.env.NODE_ENV === "production" && url.protocol !== "https:") {
+    throw new Error(`${field} must use https in production`);
+  }
+  return url.toString().replace(/\/$/, "");
+}
+function normalizedUniqueStrings(values) {
+  return [...new Set(values.map((value) => value.trim()).filter(Boolean))];
+}
+function claimStrings(value) {
+  if (typeof value === "string") return [value];
+  if (!Array.isArray(value)) return [];
+  return value.filter((item) => typeof item === "string");
+}
+function optionalString(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function validateOAuthVerificationOptions(options) {
+  var _a;
+  requireAbsoluteUrl(options.issuer, "issuer");
+  if (normalizedUniqueStrings(options.audiences).length === 0) {
+    throw new Error("audiences must contain at least one value");
+  }
+  for (const value of Object.values((_a = options.resourceMetadataMappings) != null ? _a : {})) {
+    requireAbsoluteUrl(value, "resourceMetadataMappings");
+  }
+}
+async function verifyOAuthAccessToken(options, token) {
+  var _a, _b;
+  validateOAuthVerificationOptions(options);
+  const issuer = requireAbsoluteUrl(options.issuer, "issuer");
+  const audiences = normalizedUniqueStrings(options.audiences);
+  if (!token.trim()) return { status: "invalid_token" };
+  try {
+    const claims = await options.oauthResourceClient.getActions().verifyAccessToken(token, {
+      verifyOptions: { issuer, audience: audiences },
+      resourceMetadataMappings: (_a = options.resourceMetadataMappings) != null ? _a : {}
+    });
+    const subject = optionalString(claims.sub);
+    const claimIssuer = optionalString(claims.iss);
+    const clientId = (_b = optionalString(claims.azp)) != null ? _b : optionalString(claims.client_id);
+    const tokenAudiences = normalizedUniqueStrings(
+      claimStrings(claims.aud)
+    );
+    const validatedAudiences = tokenAudiences.filter(
+      (audience) => audiences.includes(audience)
+    );
+    if (!subject || (claimIssuer == null ? void 0 : claimIssuer.replace(/\/$/, "")) !== issuer || !clientId || validatedAudiences.length === 0) {
+      return { status: "invalid_token" };
+    }
+    const scopeValue = claims.scope;
+    const scopes = normalizedUniqueStrings(
+      Array.isArray(scopeValue) ? claimStrings(scopeValue) : typeof scopeValue === "string" ? scopeValue.split(/\s+/) : []
+    );
+    const email = optionalString(claims.email);
+    const name = optionalString(claims.name);
+    return {
+      status: "authenticated",
+      identity: __spreadProps(__spreadValues(__spreadValues({
+        method: "oauth",
+        issuer,
+        subject
+      }, email ? { email } : {}), name ? { name } : {}), {
+        clientId,
+        scopes,
+        audiences: validatedAudiences
+      })
+    };
+  } catch (e) {
+    return { status: "invalid_token" };
+  }
+}
+
+exports.verifyOAuthAccessToken = verifyOAuthAccessToken;

package/dist/index.mjs

@@ -0,0 +1,2 @@
+export { verifyOAuthAccessToken } from './chunk-RJ4ABQXG.mjs';
+import './chunk-I4E63NIC.mjs';

package/dist/mcp.d.mts

@@ -0,0 +1,24 @@
+import { Router } from 'express';
+import { O as OAuthResourceClient } from './types-DJxCmhYu.mjs';
+import '@better-auth/oauth-provider/resource-client';
+
+interface BetterAuthMetadataApi {
+    options: {
+        baseURL?: string;
+        basePath?: string;
+    };
+    api: {
+        getOAuthServerConfig: (...args: never[]) => unknown;
+        getOpenIdConfig: (...args: never[]) => unknown;
+    };
+}
+interface CreateMcpOAuthDiscoveryRoutesOptions {
+    auth: BetterAuthMetadataApi;
+    oauthResourceClient: OAuthResourceClient;
+    resourceUrl: string;
+    scopesSupported: readonly string[];
+    allowedOrigins: readonly string[] | "*";
+}
+declare function createMcpOAuthDiscoveryRoutes(rawOptions: CreateMcpOAuthDiscoveryRoutesOptions): Router;
+
+export { type BetterAuthMetadataApi, type CreateMcpOAuthDiscoveryRoutesOptions, createMcpOAuthDiscoveryRoutes };

package/dist/mcp.d.ts

@@ -0,0 +1,24 @@
+import { Router } from 'express';
+import { O as OAuthResourceClient } from './types-DJxCmhYu.js';
+import '@better-auth/oauth-provider/resource-client';
+
+interface BetterAuthMetadataApi {
+    options: {
+        baseURL?: string;
+        basePath?: string;
+    };
+    api: {
+        getOAuthServerConfig: (...args: never[]) => unknown;
+        getOpenIdConfig: (...args: never[]) => unknown;
+    };
+}
+interface CreateMcpOAuthDiscoveryRoutesOptions {
+    auth: BetterAuthMetadataApi;
+    oauthResourceClient: OAuthResourceClient;
+    resourceUrl: string;
+    scopesSupported: readonly string[];
+    allowedOrigins: readonly string[] | "*";
+}
+declare function createMcpOAuthDiscoveryRoutes(rawOptions: CreateMcpOAuthDiscoveryRoutesOptions): Router;
+
+export { type BetterAuthMetadataApi, type CreateMcpOAuthDiscoveryRoutesOptions, createMcpOAuthDiscoveryRoutes };

package/dist/mcp.js

@@ -0,0 +1,228 @@
+'use strict';
+
+var oauthProvider = require('@better-auth/oauth-provider');
+var express = require('express');
+
+var __defProp = Object.defineProperty;
+var __defProps = Object.defineProperties;
+var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
+var __getOwnPropSymbols = Object.getOwnPropertySymbols;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __propIsEnum = Object.prototype.propertyIsEnumerable;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp.call(b, prop))
+      __defNormalProp(a, prop, b[prop]);
+  if (__getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(b)) {
+      if (__propIsEnum.call(b, prop))
+        __defNormalProp(a, prop, b[prop]);
+    }
+  return a;
+};
+var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
+function normalizeOptions(options) {
+  let resource;
+  try {
+    resource = new URL(options.resourceUrl);
+  } catch (e) {
+    throw new Error("resourceUrl must be an absolute URL");
+  }
+  if (!["http:", "https:"].includes(resource.protocol)) {
+    throw new Error("resourceUrl must use http or https");
+  }
+  if (resource.username || resource.password || resource.search || resource.hash) {
+    throw new Error(
+      "resourceUrl must not include credentials, query, or fragment"
+    );
+  }
+  if (process.env.NODE_ENV === "production" && resource.protocol !== "https:") {
+    throw new Error("resourceUrl must use https in production");
+  }
+  if (!options.auth.options.baseURL) {
+    throw new Error("auth.options.baseURL must be configured");
+  }
+  let authorizationServerBase;
+  try {
+    authorizationServerBase = new URL(options.auth.options.baseURL);
+  } catch (e) {
+    throw new Error("auth.options.baseURL must be an absolute URL");
+  }
+  if (!["http:", "https:"].includes(authorizationServerBase.protocol)) {
+    throw new Error("auth.options.baseURL must use http or https");
+  }
+  if (authorizationServerBase.username || authorizationServerBase.password || authorizationServerBase.pathname !== "/" || authorizationServerBase.search || authorizationServerBase.hash) {
+    throw new Error("auth.options.baseURL must be an origin URL");
+  }
+  if (process.env.NODE_ENV === "production" && authorizationServerBase.protocol !== "https:") {
+    throw new Error("auth.options.baseURL must use https in production");
+  }
+  const rawAuthorizationServerPath = options.auth.options.basePath || "/api/auth";
+  if (!rawAuthorizationServerPath.startsWith("/") || rawAuthorizationServerPath.startsWith("//") || rawAuthorizationServerPath.includes("?") || rawAuthorizationServerPath.includes("#") || /\s/.test(rawAuthorizationServerPath)) {
+    throw new Error("auth.options.basePath must be an absolute path");
+  }
+  const authorizationServerPath = rawAuthorizationServerPath === "/" ? "" : rawAuthorizationServerPath.replace(/\/+$/, "");
+  const authorizationServerUrl = `${authorizationServerBase.toString().replace(/\/$/, "")}${authorizationServerPath}`;
+  const scopesSupported = [
+    ...new Set(
+      options.scopesSupported.map((scope) => scope.trim()).filter(Boolean)
+    )
+  ];
+  const allowedOrigins = options.allowedOrigins === "*" ? "*" : new Set(
+    options.allowedOrigins.map((origin) => {
+      let url;
+      try {
+        url = new URL(origin);
+      } catch (e) {
+        throw new Error(
+          "allowedOrigins must contain absolute origins"
+        );
+      }
+      if (!["http:", "https:"].includes(url.protocol)) {
+        throw new Error(
+          "allowedOrigins must use http or https"
+        );
+      }
+      if (url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+        throw new Error(
+          "allowedOrigins must contain origins without paths"
+        );
+      }
+      if (process.env.NODE_ENV === "production" && url.protocol !== "https:") {
+        throw new Error(
+          "allowedOrigins must use https in production"
+        );
+      }
+      return url.origin;
+    })
+  );
+  if (allowedOrigins !== "*" && allowedOrigins.size === 0) {
+    throw new Error("allowedOrigins must not be empty");
+  }
+  return __spreadProps(__spreadValues({}, options), {
+    resourceUrl: resource.toString(),
+    scopesSupported,
+    allowedOrigins,
+    authorizationServerUrl,
+    authorizationServerPath
+  });
+}
+function applyCors(request, response, allowedOrigins) {
+  const origin = request.headers.origin;
+  if (allowedOrigins === "*") {
+    response.header("Access-Control-Allow-Origin", "*");
+  } else if (origin && allowedOrigins.has(origin)) {
+    response.header("Access-Control-Allow-Origin", origin);
+    response.header("Vary", "Origin");
+  } else if (origin) {
+    return false;
+  }
+  response.header("Access-Control-Allow-Methods", "GET, OPTIONS");
+  response.header(
+    "Access-Control-Allow-Headers",
+    "Accept, Authorization, Content-Type, Mcp-Protocol-Version, Mcp-Session-Id"
+  );
+  response.header("Access-Control-Expose-Headers", "Mcp-Session-Id");
+  return true;
+}
+async function sendFetchResponse(response, fetchResponse) {
+  response.status(fetchResponse.status);
+  fetchResponse.headers.forEach(
+    (value, key) => response.setHeader(key, value)
+  );
+  response.send(await fetchResponse.text());
+}
+function asyncHandler(handler) {
+  return (request, response, next) => {
+    void handler(request, response).catch(next);
+  };
+}
+function createMcpOAuthDiscoveryRoutes(rawOptions) {
+  const options = normalizeOptions(rawOptions);
+  const router = express.Router();
+  const authorizationServerPaths = /* @__PURE__ */ new Set([
+    "/.well-known/oauth-authorization-server",
+    `/.well-known/oauth-authorization-server${options.authorizationServerPath}`
+  ]);
+  const openIdPaths = /* @__PURE__ */ new Set([
+    "/.well-known/openid-configuration",
+    `${options.authorizationServerPath}/.well-known/openid-configuration`
+  ]);
+  const resourcePath = new URL(options.resourceUrl).pathname.replace(
+    /\/$/,
+    ""
+  );
+  const protectedResourcePaths = /* @__PURE__ */ new Set([
+    "/.well-known/oauth-protected-resource",
+    `/.well-known/oauth-protected-resource${resourcePath}`
+  ]);
+  const metadataPaths = /* @__PURE__ */ new Set([
+    ...authorizationServerPaths,
+    ...openIdPaths,
+    ...protectedResourcePaths
+  ]);
+  router.use((request, response, next) => {
+    if (!metadataPaths.has(request.path)) {
+      next();
+      return;
+    }
+    if (!applyCors(request, response, options.allowedOrigins)) {
+      response.status(403).json({ error: "origin_not_allowed" });
+      return;
+    }
+    if (request.method === "OPTIONS") {
+      response.status(204).end();
+      return;
+    }
+    next();
+  });
+  async function authorizationServerMetadata(request, response) {
+    const handler = oauthProvider.oauthProviderAuthServerMetadata(options.auth);
+    await sendFetchResponse(
+      response,
+      await handler(
+        new Request(
+          `${request.protocol}://${request.get("host")}${request.originalUrl}`,
+          { headers: request.headers }
+        )
+      )
+    );
+  }
+  async function openIdMetadata(request, response) {
+    const handler = oauthProvider.oauthProviderOpenIdConfigMetadata(options.auth);
+    await sendFetchResponse(
+      response,
+      await handler(
+        new Request(
+          `${request.protocol}://${request.get("host")}${request.originalUrl}`,
+          { headers: request.headers }
+        )
+      )
+    );
+  }
+  for (const path of authorizationServerPaths) {
+    router.get(path, asyncHandler(authorizationServerMetadata));
+  }
+  for (const path of openIdPaths) {
+    router.get(path, asyncHandler(openIdMetadata));
+  }
+  async function protectedResourceMetadata(_request, response) {
+    const metadata = await options.oauthResourceClient.getActions().getProtectedResourceMetadata(
+      {
+        resource: options.resourceUrl,
+        authorization_servers: [options.authorizationServerUrl],
+        scopes_supported: options.scopesSupported,
+        bearer_methods_supported: ["header"]
+      },
+      { silenceWarnings: { oidcScopes: true } }
+    );
+    response.json(metadata);
+  }
+  for (const path of protectedResourcePaths) {
+    router.get(path, asyncHandler(protectedResourceMetadata));
+  }
+  return router;
+}
+
+exports.createMcpOAuthDiscoveryRoutes = createMcpOAuthDiscoveryRoutes;

package/dist/mcp.mjs

@@ -0,0 +1,208 @@
+import { __spreadProps, __spreadValues } from './chunk-I4E63NIC.mjs';
+import { oauthProviderAuthServerMetadata, oauthProviderOpenIdConfigMetadata } from '@better-auth/oauth-provider';
+import { Router } from 'express';
+
+function normalizeOptions(options) {
+  let resource;
+  try {
+    resource = new URL(options.resourceUrl);
+  } catch (e) {
+    throw new Error("resourceUrl must be an absolute URL");
+  }
+  if (!["http:", "https:"].includes(resource.protocol)) {
+    throw new Error("resourceUrl must use http or https");
+  }
+  if (resource.username || resource.password || resource.search || resource.hash) {
+    throw new Error(
+      "resourceUrl must not include credentials, query, or fragment"
+    );
+  }
+  if (process.env.NODE_ENV === "production" && resource.protocol !== "https:") {
+    throw new Error("resourceUrl must use https in production");
+  }
+  if (!options.auth.options.baseURL) {
+    throw new Error("auth.options.baseURL must be configured");
+  }
+  let authorizationServerBase;
+  try {
+    authorizationServerBase = new URL(options.auth.options.baseURL);
+  } catch (e) {
+    throw new Error("auth.options.baseURL must be an absolute URL");
+  }
+  if (!["http:", "https:"].includes(authorizationServerBase.protocol)) {
+    throw new Error("auth.options.baseURL must use http or https");
+  }
+  if (authorizationServerBase.username || authorizationServerBase.password || authorizationServerBase.pathname !== "/" || authorizationServerBase.search || authorizationServerBase.hash) {
+    throw new Error("auth.options.baseURL must be an origin URL");
+  }
+  if (process.env.NODE_ENV === "production" && authorizationServerBase.protocol !== "https:") {
+    throw new Error("auth.options.baseURL must use https in production");
+  }
+  const rawAuthorizationServerPath = options.auth.options.basePath || "/api/auth";
+  if (!rawAuthorizationServerPath.startsWith("/") || rawAuthorizationServerPath.startsWith("//") || rawAuthorizationServerPath.includes("?") || rawAuthorizationServerPath.includes("#") || /\s/.test(rawAuthorizationServerPath)) {
+    throw new Error("auth.options.basePath must be an absolute path");
+  }
+  const authorizationServerPath = rawAuthorizationServerPath === "/" ? "" : rawAuthorizationServerPath.replace(/\/+$/, "");
+  const authorizationServerUrl = `${authorizationServerBase.toString().replace(/\/$/, "")}${authorizationServerPath}`;
+  const scopesSupported = [
+    ...new Set(
+      options.scopesSupported.map((scope) => scope.trim()).filter(Boolean)
+    )
+  ];
+  const allowedOrigins = options.allowedOrigins === "*" ? "*" : new Set(
+    options.allowedOrigins.map((origin) => {
+      let url;
+      try {
+        url = new URL(origin);
+      } catch (e) {
+        throw new Error(
+          "allowedOrigins must contain absolute origins"
+        );
+      }
+      if (!["http:", "https:"].includes(url.protocol)) {
+        throw new Error(
+          "allowedOrigins must use http or https"
+        );
+      }
+      if (url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+        throw new Error(
+          "allowedOrigins must contain origins without paths"
+        );
+      }
+      if (process.env.NODE_ENV === "production" && url.protocol !== "https:") {
+        throw new Error(
+          "allowedOrigins must use https in production"
+        );
+      }
+      return url.origin;
+    })
+  );
+  if (allowedOrigins !== "*" && allowedOrigins.size === 0) {
+    throw new Error("allowedOrigins must not be empty");
+  }
+  return __spreadProps(__spreadValues({}, options), {
+    resourceUrl: resource.toString(),
+    scopesSupported,
+    allowedOrigins,
+    authorizationServerUrl,
+    authorizationServerPath
+  });
+}
+function applyCors(request, response, allowedOrigins) {
+  const origin = request.headers.origin;
+  if (allowedOrigins === "*") {
+    response.header("Access-Control-Allow-Origin", "*");
+  } else if (origin && allowedOrigins.has(origin)) {
+    response.header("Access-Control-Allow-Origin", origin);
+    response.header("Vary", "Origin");
+  } else if (origin) {
+    return false;
+  }
+  response.header("Access-Control-Allow-Methods", "GET, OPTIONS");
+  response.header(
+    "Access-Control-Allow-Headers",
+    "Accept, Authorization, Content-Type, Mcp-Protocol-Version, Mcp-Session-Id"
+  );
+  response.header("Access-Control-Expose-Headers", "Mcp-Session-Id");
+  return true;
+}
+async function sendFetchResponse(response, fetchResponse) {
+  response.status(fetchResponse.status);
+  fetchResponse.headers.forEach(
+    (value, key) => response.setHeader(key, value)
+  );
+  response.send(await fetchResponse.text());
+}
+function asyncHandler(handler) {
+  return (request, response, next) => {
+    void handler(request, response).catch(next);
+  };
+}
+function createMcpOAuthDiscoveryRoutes(rawOptions) {
+  const options = normalizeOptions(rawOptions);
+  const router = Router();
+  const authorizationServerPaths = /* @__PURE__ */ new Set([
+    "/.well-known/oauth-authorization-server",
+    `/.well-known/oauth-authorization-server${options.authorizationServerPath}`
+  ]);
+  const openIdPaths = /* @__PURE__ */ new Set([
+    "/.well-known/openid-configuration",
+    `${options.authorizationServerPath}/.well-known/openid-configuration`
+  ]);
+  const resourcePath = new URL(options.resourceUrl).pathname.replace(
+    /\/$/,
+    ""
+  );
+  const protectedResourcePaths = /* @__PURE__ */ new Set([
+    "/.well-known/oauth-protected-resource",
+    `/.well-known/oauth-protected-resource${resourcePath}`
+  ]);
+  const metadataPaths = /* @__PURE__ */ new Set([
+    ...authorizationServerPaths,
+    ...openIdPaths,
+    ...protectedResourcePaths
+  ]);
+  router.use((request, response, next) => {
+    if (!metadataPaths.has(request.path)) {
+      next();
+      return;
+    }
+    if (!applyCors(request, response, options.allowedOrigins)) {
+      response.status(403).json({ error: "origin_not_allowed" });
+      return;
+    }
+    if (request.method === "OPTIONS") {
+      response.status(204).end();
+      return;
+    }
+    next();
+  });
+  async function authorizationServerMetadata(request, response) {
+    const handler = oauthProviderAuthServerMetadata(options.auth);
+    await sendFetchResponse(
+      response,
+      await handler(
+        new Request(
+          `${request.protocol}://${request.get("host")}${request.originalUrl}`,
+          { headers: request.headers }
+        )
+      )
+    );
+  }
+  async function openIdMetadata(request, response) {
+    const handler = oauthProviderOpenIdConfigMetadata(options.auth);
+    await sendFetchResponse(
+      response,
+      await handler(
+        new Request(
+          `${request.protocol}://${request.get("host")}${request.originalUrl}`,
+          { headers: request.headers }
+        )
+      )
+    );
+  }
+  for (const path of authorizationServerPaths) {
+    router.get(path, asyncHandler(authorizationServerMetadata));
+  }
+  for (const path of openIdPaths) {
+    router.get(path, asyncHandler(openIdMetadata));
+  }
+  async function protectedResourceMetadata(_request, response) {
+    const metadata = await options.oauthResourceClient.getActions().getProtectedResourceMetadata(
+      {
+        resource: options.resourceUrl,
+        authorization_servers: [options.authorizationServerUrl],
+        scopes_supported: options.scopesSupported,
+        bearer_methods_supported: ["header"]
+      },
+      { silenceWarnings: { oidcScopes: true } }
+    );
+    response.json(metadata);
+  }
+  for (const path of protectedResourcePaths) {
+    router.get(path, asyncHandler(protectedResourceMetadata));
+  }
+  return router;
+}
+
+export { createMcpOAuthDiscoveryRoutes };

package/dist/types-DJxCmhYu.d.mts

@@ -0,0 +1,33 @@
+import { oauthProviderResourceClient } from '@better-auth/oauth-provider/resource-client';
+
+type AuthenticatedIdentity = {
+    method: "session";
+    issuer: string;
+    subject: string;
+    email: string;
+    name?: string | null;
+    scopes: [];
+} | {
+    method: "oauth";
+    issuer: string;
+    subject: string;
+    email?: string;
+    name?: string | null;
+    clientId: string;
+    scopes: string[];
+    audiences: string[];
+};
+type AuthenticationResult = {
+    status: "authenticated";
+    identity: AuthenticatedIdentity;
+} | {
+    status: "missing";
+} | {
+    status: "invalid_token";
+} | {
+    status: "unavailable";
+    cause?: unknown;
+};
+type OAuthResourceClient = ReturnType<typeof oauthProviderResourceClient<ConfiguredResourceClientAuth>>;
+
+export type { AuthenticationResult as A, OAuthResourceClient as O, AuthenticatedIdentity as a };

package/dist/types-DJxCmhYu.d.ts

@@ -0,0 +1,33 @@
+import { oauthProviderResourceClient } from '@better-auth/oauth-provider/resource-client';
+
+type AuthenticatedIdentity = {
+    method: "session";
+    issuer: string;
+    subject: string;
+    email: string;
+    name?: string | null;
+    scopes: [];
+} | {
+    method: "oauth";
+    issuer: string;
+    subject: string;
+    email?: string;
+    name?: string | null;
+    clientId: string;
+    scopes: string[];
+    audiences: string[];
+};
+type AuthenticationResult = {
+    status: "authenticated";
+    identity: AuthenticatedIdentity;
+} | {
+    status: "missing";
+} | {
+    status: "invalid_token";
+} | {
+    status: "unavailable";
+    cause?: unknown;
+};
+type OAuthResourceClient = ReturnType<typeof oauthProviderResourceClient<ConfiguredResourceClientAuth>>;
+
+export type { AuthenticationResult as A, OAuthResourceClient as O, AuthenticatedIdentity as a };