@kamod-ch/otok-oauth 2.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Kamod
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,163 @@
+# @kamod-ch/otok-oauth
+
+OAuth login helpers (GitHub, Google) for [Otok](https://github.com/kamod-ch/otok) apps.
+
+Ships as an **Otok plugin** (`oauth()`) and as **`createOAuthFlow`** for manual wiring. Sessions come from `@kamod-ch/otok-auth`.
+
+See [MIGRATION.md](./MIGRATION.md) when upgrading from 1.0.
+
+## Install
+
+```bash
+pnpm add @kamod-ch/otok-oauth @kamod-ch/otok-auth arctic hono @kamod-ch/otok
+```
+
+## Plugin (recommended)
+
+Register **after** `auth()`:
+
+```ts
+import auth from "@kamod-ch/otok-auth";
+import oauth from "@kamod-ch/otok-oauth";
+
+export default defineConfig({
+  plugins: [
+    auth({ /* … */ }),
+    oauth({
+      providers: {
+        github: {
+          clientId: env.GITHUB_CLIENT_ID,
+          clientSecret: env.GITHUB_CLIENT_SECRET,
+          redirectUri: `${env.APP_URL}/auth/github/callback`,
+        },
+      },
+      adapter: oauthAdapter,
+    }),
+  ],
+});
+```
+
+## Composition (1.0 API, still supported)
+
+```ts
+import { Hono } from "hono";
+import { createOAuthFlow } from "@kamod-ch/otok-oauth";
+import type { OAuthAdapter } from "@kamod-ch/otok-oauth/adapter";
+import { createSessionManager } from "@kamod-ch/otok-auth/session";
+
+type User = { id: string; email: string | null };
+
+const adapter: OAuthAdapter<User> = {
+  async findOrCreateUser(profile) {
+    // Look up by provider + providerAccountId, or create a local user.
+    return { id: "user_1", email: profile.email };
+  },
+  getUserId: (user) => user.id,
+};
+
+const sessions = createSessionManager<User>(
+  {
+    sessionCookie: "app_session",
+    csrfCookie: "app_csrf",
+    secure: () => process.env.NODE_ENV === "production",
+  },
+  /* your SessionAdapter */,
+);
+
+const oauth = createOAuthFlow({
+  secret: process.env.OAUTH_STATE_SECRET!,
+  adapter,
+  createSession: sessions.createSession,
+  providers: {
+    github: {
+      clientId: process.env.GITHUB_CLIENT_ID!,
+      clientSecret: process.env.GITHUB_CLIENT_SECRET!,
+      redirectUri: process.env.GITHUB_REDIRECT_URI!,
+    },
+    google: {
+      clientId: process.env.GOOGLE_CLIENT_ID!,
+      clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
+      redirectUri: process.env.GOOGLE_REDIRECT_URI!,
+    },
+  },
+});
+
+// With createOtokApp({ configure }):
+configure: (app) => {
+  oauth.mount(app);
+};
+```
+
+Registered routes (default `basePath: "/auth"`):
+
+| Method | Path | Purpose |
+|--------|------|---------|
+| GET | `/auth/github` | Start GitHub login (`?next=/relative/path` optional) |
+| GET | `/auth/github/callback` | GitHub callback |
+| GET | `/auth/google` | Start Google login |
+| GET | `/auth/google/callback` | Google callback |
+
+On success the flow calls `adapter.findOrCreateUser`, then `createSession`, then redirects to a safe relative `next` path (or `/`).
+
+On failure it redirects to `/login?error=<code>` (override with `loginPath` / `onError`).
+
+## Login UI
+
+Link to the authorize routes from your login page:
+
+```tsx
+<a href="/auth/github?next=/studio">Continue with GitHub</a>
+<a href="/auth/google?next=/studio">Continue with Google</a>
+```
+
+Error codes you may show from `?error=`:
+
+- `invalid_state`
+- `missing_code`
+- `provider_error`
+- `profile_error`
+- `adapter_error`
+- `provider_unavailable`
+
+## Adapter
+
+```ts
+import type { OAuthAdapter, OAuthProfile } from "@kamod-ch/otok-oauth/adapter";
+
+const adapter: OAuthAdapter<User> = {
+  async findOrCreateUser(profile: OAuthProfile) {
+    // profile.provider: "github" | "google"
+    // profile.providerAccountId, email, emailVerified, name, avatarUrl
+  },
+  getUserId: (user) => user.id,
+};
+```
+
+## Exports
+
+| Subpath | Purpose |
+|---------|---------|
+| `@kamod-ch/otok-oauth` | `createOAuthFlow`, errors, `OAuthProfile` |
+| `@kamod-ch/otok-oauth/adapter` | `OAuthAdapter`, `OAuthProfile` |
+| `@kamod-ch/otok-oauth/providers/github` | GitHub client helpers |
+| `@kamod-ch/otok-oauth/providers/google` | Google client helpers |
+| `@kamod-ch/otok-oauth/state` | Signed OAuth state cookie helpers |
+
+## Env vars (app)
+
+```bash
+OAUTH_STATE_SECRET=          # min. 32 random bytes
+GITHUB_CLIENT_ID=
+GITHUB_CLIENT_SECRET=
+GITHUB_REDIRECT_URI=         # e.g. http://localhost:3000/auth/github/callback
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+GOOGLE_REDIRECT_URI=         # e.g. http://localhost:3000/auth/google/callback
+```
+
+## Design notes
+
+- Uses [Arctic](https://arcticjs.dev) for provider clients (GitHub authorization code; Google with PKCE).
+- State and PKCE verifier are stored in a short-lived signed httpOnly cookie.
+- `?next=` is open-redirect safe (same-origin relative paths only).
+- Account linking, refresh-token storage, and additional providers are out of scope for v1.

package/dist/adapter/index.d.ts

@@ -0,0 +1,2 @@
+export type { OAuthAdapter, OAuthProfile, OAuthProviderId } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/adapter/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/adapter/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC"}

package/dist/adapter/index.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.js.map

package/dist/adapter/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/adapter/index.ts"],"names":[],"mappings":""}

package/dist/adapter/types.d.ts

@@ -0,0 +1,30 @@
+export type OAuthProviderId = "github" | "google" | "microsoft" | "gitlab";
+export type OAuthProfile = {
+    provider: OAuthProviderId;
+    providerAccountId: string;
+    email: string | null;
+    emailVerified: boolean;
+    name: string | null;
+    avatarUrl: string | null;
+};
+export interface OAuthAdapter<TUser> {
+    findOrCreateUser(profile: OAuthProfile): Promise<TUser>;
+    getUserId(user: TUser): string;
+    /**
+     * Link an OAuth account to an existing signed-in user.
+     * Must verify the current session before linking.
+     */
+    linkAccount?(input: {
+        user: TUser;
+        profile: OAuthProfile;
+    }): Promise<TUser>;
+}
+export interface OAuthTokenSet {
+    accessToken: string;
+    refreshToken?: string | null;
+    expiresAt?: Date | null;
+}
+export interface OAuthTokenRefreshHandler {
+    refresh(provider: OAuthProviderId, refreshToken: string): Promise<OAuthTokenSet>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/adapter/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/adapter/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,CAAC;AAE3E,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,eAAe,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,MAAM,WAAW,YAAY,CAAC,KAAK;IACjC,gBAAgB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACxD,SAAS,CAAC,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC;IAC/B;;;OAGG;IACH,WAAW,CAAC,CAAC,KAAK,EAAE;QAClB,IAAI,EAAE,KAAK,CAAC;QACZ,OAAO,EAAE,YAAY,CAAC;KACvB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,QAAQ,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAClF"}

package/dist/adapter/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/adapter/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/adapter/types.ts"],"names":[],"mappings":""}

package/dist/errors.d.ts

@@ -0,0 +1,6 @@
+export type OAuthErrorCode = "invalid_state" | "missing_code" | "provider_error" | "profile_error" | "adapter_error" | "provider_unavailable" | "pkce_error" | "link_verification_failed";
+export declare class OAuthFlowError extends Error {
+    readonly code: OAuthErrorCode;
+    constructor(code: OAuthErrorCode, message?: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GACtB,eAAe,GACf,cAAc,GACd,gBAAgB,GAChB,eAAe,GACf,eAAe,GACf,sBAAsB,GACtB,YAAY,GACZ,0BAA0B,CAAC;AAE/B,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;gBAElB,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,MAAM;CAKnD"}

package/dist/errors.js

@@ -0,0 +1,9 @@
+export class OAuthFlowError extends Error {
+    code;
+    constructor(code, message) {
+        super(message ?? code);
+        this.name = "OAuthFlowError";
+        this.code = code;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAUA,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,IAAI,CAAiB;IAE9B,YAAY,IAAoB,EAAE,OAAgB;QAChD,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/flow.d.ts

@@ -0,0 +1,28 @@
+import type { Context } from "hono";
+import type { Hono } from "hono";
+import type { OAuthAdapter, OAuthProviderId, OAuthTokenRefreshHandler } from "./adapter/types.js";
+import { type OAuthErrorCode } from "./errors.js";
+import type { OAuthProviderConfig } from "./providers/types.js";
+export type OAuthFlowOptions<TUser> = {
+    secret: string;
+    adapter: OAuthAdapter<TUser>;
+    createSession: (c: Context, userId: string) => Promise<void>;
+    providers: Partial<Record<OAuthProviderId, OAuthProviderConfig>>;
+    basePath?: string;
+    stateCookie?: string;
+    secure?: boolean | ((c: Context) => boolean);
+    loginPath?: string;
+    redirectAllowlist?: readonly string[];
+    tokenRefresh?: OAuthTokenRefreshHandler;
+    /** Called after a successful login, before redirect. */
+    onSuccess?: (c: Context, user: TUser) => void | Promise<void>;
+    /** Override default error redirect. */
+    onError?: (c: Context, code: OAuthErrorCode) => Response | Promise<Response>;
+};
+export type OAuthFlow<TUser> = {
+    mount(app: Hono): void;
+    authorize(provider: OAuthProviderId): (c: Context) => Promise<Response>;
+    callback(provider: OAuthProviderId): (c: Context) => Promise<Response>;
+};
+export declare function createOAuthFlow<TUser>(options: OAuthFlowOptions<TUser>): OAuthFlow<TUser>;
+//# sourceMappingURL=flow.d.ts.map

package/dist/flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../src/flow.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAGjC,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAClG,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAalE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAchE,MAAM,MAAM,gBAAgB,CAAC,KAAK,IAAI;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAC7B,aAAa,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,YAAY,CAAC,EAAE,wBAAwB,CAAC;IACxC,wDAAwD;IACxD,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,uCAAuC;IACvC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC9E,CAAC;AAEF,MAAM,MAAM,SAAS,CAAC,KAAK,IAAI;IAC7B,KAAK,CAAC,GAAG,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,SAAS,CAAC,QAAQ,EAAE,eAAe,GAAG,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxE,QAAQ,CAAC,QAAQ,EAAE,eAAe,GAAG,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxE,CAAC;AA4BF,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAoMzF"}

package/dist/flow.js

@@ -0,0 +1,238 @@
+import { generateCodeVerifier, generateState } from "arctic";
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
+import { tryGetAuthRuntime } from "@kamod-ch/otok-auth/registry";
+import { OAuthFlowError } from "./errors.js";
+import { fetchGitHubProfile } from "./profile/github.js";
+import { fetchGitLabProfile } from "./profile/gitlab.js";
+import { fetchGoogleProfile } from "./profile/google.js";
+import { fetchMicrosoftProfile } from "./profile/microsoft.js";
+import { createGitHubClient, githubScopes } from "./providers/github.js";
+import { createGitLabClient, gitlabScopes } from "./providers/gitlab.js";
+import { createGoogleClient, googleScopes } from "./providers/google.js";
+import { createMicrosoftClient, microsoftScopes, } from "./providers/microsoft.js";
+import { safeNextPath } from "./redirect.js";
+import { DEFAULT_MAX_AGE_MS, sealOAuthState, unsealOAuthState, } from "./state.js";
+const DEFAULT_BASE_PATH = "/auth";
+const DEFAULT_STATE_COOKIE = "otok_oauth_state";
+const DEFAULT_LOGIN_PATH = "/login";
+const STATE_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_MAX_AGE_MS / 1000);
+function resolveSecure(c, secure) {
+    if (typeof secure === "function")
+        return secure(c);
+    if (typeof secure === "boolean")
+        return secure;
+    return process.env.NODE_ENV === "production";
+}
+function joinPath(base, ...parts) {
+    const normalizedBase = base.endsWith("/") ? base.slice(0, -1) : base || "";
+    const suffix = parts.map((part) => part.replace(/^\/+|\/+$/g, "")).filter(Boolean).join("/");
+    return `${normalizedBase}/${suffix}`.replace(/\/{2,}/g, "/");
+}
+function errorRedirect(loginPath, code) {
+    const url = new URL(loginPath, "http://localhost");
+    url.searchParams.set("error", code);
+    const location = `${url.pathname}${url.search}`;
+    return new Response(null, {
+        status: 303,
+        headers: { Location: location },
+    });
+}
+function resolveAllowlist(options) {
+    return options.redirectAllowlist ?? tryGetAuthRuntime()?.redirectAllowlist ?? ["/"];
+}
+export function createOAuthFlow(options) {
+    if (!options.secret) {
+        throw new Error("createOAuthFlow requires a non-empty secret");
+    }
+    const basePath = options.basePath ?? DEFAULT_BASE_PATH;
+    const stateCookie = options.stateCookie ?? DEFAULT_STATE_COOKIE;
+    const loginPath = options.loginPath ?? DEFAULT_LOGIN_PATH;
+    const allowlist = resolveAllowlist(options);
+    async function fail(c, code) {
+        if (options.onError)
+            return options.onError(c, code);
+        return errorRedirect(loginPath, code);
+    }
+    function authorize(provider) {
+        return async (c) => {
+            const config = options.providers[provider];
+            if (!config)
+                return fail(c, "provider_unavailable");
+            const providerError = c.req.query("error");
+            if (providerError)
+                return fail(c, "provider_error");
+            try {
+                const state = generateState();
+                const next = safeNextPath(c.req.query("next"), allowlist);
+                const link = c.req.query("link") === "1";
+                let codeVerifier = null;
+                let authorizationURL;
+                if (provider === "github") {
+                    const client = createGitHubClient(config);
+                    authorizationURL = client.createAuthorizationURL(state, githubScopes(config));
+                }
+                else if (provider === "google") {
+                    const client = createGoogleClient(config);
+                    codeVerifier = generateCodeVerifier();
+                    authorizationURL = client.createAuthorizationURL(state, codeVerifier, googleScopes(config));
+                }
+                else if (provider === "microsoft") {
+                    const client = createMicrosoftClient(config);
+                    codeVerifier = generateCodeVerifier();
+                    authorizationURL = client.createAuthorizationURL(state, codeVerifier, microsoftScopes(config));
+                }
+                else if (provider === "gitlab") {
+                    const client = createGitLabClient(config);
+                    authorizationURL = client.createAuthorizationURL(state, gitlabScopes(config));
+                }
+                else {
+                    return fail(c, "provider_unavailable");
+                }
+                const payload = {
+                    provider,
+                    state,
+                    codeVerifier,
+                    next,
+                    link,
+                    issuedAt: Date.now(),
+                };
+                setCookie(c, stateCookie, sealOAuthState(payload, options.secret), {
+                    httpOnly: true,
+                    secure: resolveSecure(c, options.secure),
+                    sameSite: "Lax",
+                    path: "/",
+                    maxAge: STATE_COOKIE_MAX_AGE_SECONDS,
+                });
+                return c.redirect(authorizationURL.toString(), 302);
+            }
+            catch {
+                return fail(c, "provider_error");
+            }
+        };
+    }
+    function callback(provider) {
+        return async (c) => {
+            const config = options.providers[provider];
+            if (!config)
+                return fail(c, "provider_unavailable");
+            const providerError = c.req.query("error");
+            if (providerError)
+                return fail(c, "provider_error");
+            const code = c.req.query("code");
+            const returnedState = c.req.query("state");
+            if (!code)
+                return fail(c, "missing_code");
+            if (!returnedState)
+                return fail(c, "invalid_state");
+            const cookieValue = getCookie(c, stateCookie);
+            deleteCookie(c, stateCookie, { path: "/" });
+            if (!cookieValue)
+                return fail(c, "invalid_state");
+            const payload = unsealOAuthState(cookieValue, options.secret);
+            if (!payload || payload.provider !== provider || payload.state !== returnedState) {
+                return fail(c, "invalid_state");
+            }
+            try {
+                let accessToken;
+                let refreshToken = null;
+                if (provider === "github") {
+                    const client = createGitHubClient(config);
+                    const tokens = await client.validateAuthorizationCode(code);
+                    accessToken = tokens.accessToken();
+                    refreshToken = tokens.hasRefreshToken() ? tokens.refreshToken() : null;
+                }
+                else if (provider === "google") {
+                    if (!payload.codeVerifier)
+                        return fail(c, "pkce_error");
+                    const client = createGoogleClient(config);
+                    const tokens = await client.validateAuthorizationCode(code, payload.codeVerifier);
+                    accessToken = tokens.accessToken();
+                    refreshToken = tokens.hasRefreshToken() ? tokens.refreshToken() : null;
+                }
+                else if (provider === "microsoft") {
+                    if (!payload.codeVerifier)
+                        return fail(c, "pkce_error");
+                    const client = createMicrosoftClient(config);
+                    const tokens = await client.validateAuthorizationCode(code, payload.codeVerifier);
+                    accessToken = tokens.accessToken();
+                    refreshToken = tokens.hasRefreshToken() ? tokens.refreshToken() : null;
+                }
+                else if (provider === "gitlab") {
+                    const client = createGitLabClient(config);
+                    const tokens = await client.validateAuthorizationCode(code);
+                    accessToken = tokens.accessToken();
+                    refreshToken = tokens.hasRefreshToken() ? tokens.refreshToken() : null;
+                }
+                else {
+                    return fail(c, "provider_unavailable");
+                }
+                if (refreshToken && options.tokenRefresh) {
+                    await options.tokenRefresh.refresh(provider, refreshToken);
+                }
+                let profile;
+                try {
+                    if (provider === "github") {
+                        profile = await fetchGitHubProfile(accessToken);
+                    }
+                    else if (provider === "google") {
+                        profile = await fetchGoogleProfile(accessToken);
+                    }
+                    else if (provider === "microsoft") {
+                        profile = await fetchMicrosoftProfile(accessToken);
+                    }
+                    else if (provider === "gitlab") {
+                        const baseURL = config.baseURL ?? "https://gitlab.com";
+                        profile = await fetchGitLabProfile(accessToken, baseURL);
+                    }
+                    else {
+                        return fail(c, "provider_unavailable");
+                    }
+                }
+                catch (error) {
+                    if (error instanceof OAuthFlowError)
+                        return fail(c, error.code);
+                    return fail(c, "profile_error");
+                }
+                let user;
+                try {
+                    if (payload.link) {
+                        const runtime = tryGetAuthRuntime();
+                        const current = runtime ? await runtime.helpers.getSession(c) : null;
+                        if (!current || !options.adapter.linkAccount) {
+                            return fail(c, "link_verification_failed");
+                        }
+                        user = await options.adapter.linkAccount({ user: current, profile });
+                    }
+                    else {
+                        user = await options.adapter.findOrCreateUser(profile);
+                    }
+                }
+                catch {
+                    return fail(c, "adapter_error");
+                }
+                const userId = options.adapter.getUserId(user);
+                if (!payload.link) {
+                    await options.createSession(c, userId);
+                }
+                await options.onSuccess?.(c, user);
+                const destination = payload.next ?? "/";
+                return c.redirect(destination, 303);
+            }
+            catch (error) {
+                if (error instanceof OAuthFlowError)
+                    return fail(c, error.code);
+                return fail(c, "provider_error");
+            }
+        };
+    }
+    function mount(app) {
+        for (const provider of Object.keys(options.providers)) {
+            if (!options.providers[provider])
+                continue;
+            app.get(joinPath(basePath, provider), authorize(provider));
+            app.get(joinPath(basePath, provider, "callback"), callback(provider));
+        }
+    }
+    return { mount, authorize, callback };
+}
+//# sourceMappingURL=flow.js.map

package/dist/flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow.js","sourceRoot":"","sources":["../src/flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAG7D,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEjE,OAAO,EAAE,cAAc,EAAuB,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAA6B,MAAM,uBAAuB,CAAC;AACpG,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EACL,qBAAqB,EACrB,eAAe,GAEhB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,gBAAgB,GAEjB,MAAM,YAAY,CAAC;AAEpB,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAClC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAChD,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AACpC,MAAM,4BAA4B,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;AAyB3E,SAAS,aAAa,CAAC,CAAU,EAAE,MAA4C;IAC7E,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,OAAO,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAC/C,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC/C,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,GAAG,KAAe;IAChD,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7F,OAAO,GAAG,cAAc,IAAI,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB,EAAE,IAAoB;IAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;IAChD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;KAChC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAkC;IAC1D,OAAO,OAAO,CAAC,iBAAiB,IAAI,iBAAiB,EAAE,EAAE,iBAAiB,IAAI,CAAC,GAAG,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,eAAe,CAAQ,OAAgC;IACrE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IACvD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAChE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAoC,CAAC,CAAC;IAEzE,KAAK,UAAU,IAAI,CAAC,CAAU,EAAE,IAAoB;QAClD,IAAI,OAAO,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrD,OAAO,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,SAAS,SAAS,CAAC,QAAyB;QAC1C,OAAO,KAAK,EAAE,CAAU,EAAqB,EAAE;YAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;YAEpD,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,aAAa;gBAAE,OAAO,IAAI,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAEpD,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;gBAC1D,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC;gBACzC,IAAI,YAAY,GAAkB,IAAI,CAAC;gBACvC,IAAI,gBAAqB,CAAC;gBAE1B,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBAC1B,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;oBAC1C,gBAAgB,GAAG,MAAM,CAAC,sBAAsB,CAAC,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;gBAChF,CAAC;qBAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBACjC,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;oBAC1C,YAAY,GAAG,oBAAoB,EAAE,CAAC;oBACtC,gBAAgB,GAAG,MAAM,CAAC,sBAAsB,CAC9C,KAAK,EACL,YAAY,EACZ,YAAY,CAAC,MAAM,CAAC,CACrB,CAAC;gBACJ,CAAC;qBAAM,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;oBACpC,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAiC,CAAC,CAAC;oBACxE,YAAY,GAAG,oBAAoB,EAAE,CAAC;oBACtC,gBAAgB,GAAG,MAAM,CAAC,sBAAsB,CAC9C,KAAK,EACL,YAAY,EACZ,eAAe,CAAC,MAAM,CAAC,CACxB,CAAC;gBACJ,CAAC;qBAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBACjC,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAA8B,CAAC,CAAC;oBAClE,gBAAgB,GAAG,MAAM,CAAC,sBAAsB,CAAC,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;gBAChF,CAAC;qBAAM,CAAC;oBACN,OAAO,IAAI,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;gBACzC,CAAC;gBAED,MAAM,OAAO,GAAsB;oBACjC,QAAQ;oBACR,KAAK;oBACL,YAAY;oBACZ,IAAI;oBACJ,IAAI;oBACJ,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;iBACrB,CAAC;gBAEF,SAAS,CAAC,CAAC,EAAE,WAAW,EAAE,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;oBACjE,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC;oBACxC,QAAQ,EAAE,KAAK;oBACf,IAAI,EAAE,GAAG;oBACT,MAAM,EAAE,4BAA4B;iBACrC,CAAC,CAAC;gBAEH,OAAO,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;YACnC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED,SAAS,QAAQ,CAAC,QAAyB;QACzC,OAAO,KAAK,EAAE,CAAU,EAAqB,EAAE;YAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;YAEpD,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,aAAa;gBAAE,OAAO,IAAI,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAEpD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;YAC1C,IAAI,CAAC,aAAa;gBAAE,OAAO,IAAI,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;YAEpD,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YAC9C,YAAY,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAE5C,IAAI,CAAC,WAAW;gBAAE,OAAO,IAAI,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;YAElD,MAAM,OAAO,GAAG,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC9D,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;gBACjF,OAAO,IAAI,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;YAClC,CAAC;YAED,IAAI,CAAC;gBACH,IAAI,WAAmB,CAAC;gBACxB,IAAI,YAAY,GAAkB,IAAI,CAAC;gBAEvC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBAC1B,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;oBAC1C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;oBAC5D,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;oBACnC,YAAY,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBACzE,CAAC;qBAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBACjC,IAAI,CAAC,OAAO,CAAC,YAAY;wBAAE,OAAO,IAAI,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;oBACxD,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;oBAC1C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;oBAClF,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;oBACnC,YAAY,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBACzE,CAAC;qBAAM,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;oBACpC,IAAI,CAAC,OAAO,CAAC,YAAY;wBAAE,OAAO,IAAI,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;oBACxD,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAiC,CAAC,CAAC;oBACxE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;oBAClF,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;oBACnC,YAAY,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBACzE,CAAC;qBAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBACjC,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAA8B,CAAC,CAAC;oBAClE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;oBAC5D,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;oBACnC,YAAY,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBACzE,CAAC;qBAAM,CAAC;oBACN,OAAO,IAAI,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;gBACzC,CAAC;gBAED,IAAI,YAAY,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;oBACzC,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;gBAC7D,CAAC;gBAED,IAAI,OAAO,CAAC;gBACZ,IAAI,CAAC;oBACH,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;wBAC1B,OAAO,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAC;oBAClD,CAAC;yBAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;wBACjC,OAAO,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAC;oBAClD,CAAC;yBAAM,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;wBACpC,OAAO,GAAG,MAAM,qBAAqB,CAAC,WAAW,CAAC,CAAC;oBACrD,CAAC;yBAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;wBACjC,MAAM,OAAO,GAAI,MAA+B,CAAC,OAAO,IAAI,oBAAoB,CAAC;wBACjF,OAAO,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;oBAC3D,CAAC;yBAAM,CAAC;wBACN,OAAO,IAAI,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;oBACzC,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,KAAK,YAAY,cAAc;wBAAE,OAAO,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;oBAChE,OAAO,IAAI,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;gBAClC,CAAC;gBAED,IAAI,IAAW,CAAC;gBAChB,IAAI,CAAC;oBACH,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;wBACjB,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;wBACpC,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;wBACrE,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;4BAC7C,OAAO,IAAI,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC;wBAC7C,CAAC;wBACD,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE,OAAO,EAAE,CAAC,CAAC;oBAChF,CAAC;yBAAM,CAAC;wBACN,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;oBACzD,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;gBAClC,CAAC;gBAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBAC/C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;oBAClB,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;gBACzC,CAAC;gBACD,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;gBAEnC,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC;gBACxC,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YACtC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,cAAc;oBAAE,OAAO,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBAChE,OAAO,IAAI,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;YACnC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED,SAAS,KAAK,CAAC,GAAS;QACtB,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAsB,EAAE,CAAC;YAC3E,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAC3C,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACxC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export { createOAuthFlow, type OAuthFlow, type OAuthFlowOptions } from "./flow.js";
+export { OAuthFlowError, type OAuthErrorCode } from "./errors.js";
+export type { OAuthAdapter, OAuthProfile, OAuthProviderId, OAuthTokenRefreshHandler, OAuthTokenSet, } from "./adapter/types.js";
+export { safeNextPath } from "./redirect.js";
+export { default } from "./plugin.js";
+export type { OAuthPluginOptions } from "./plugin.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,KAAK,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAClE,YAAY,EACV,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,wBAAwB,EACxB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+export { createOAuthFlow } from "./flow.js";
+export { OAuthFlowError } from "./errors.js";
+export { safeNextPath } from "./redirect.js";
+export { default } from "./plugin.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAyC,MAAM,WAAW,CAAC;AACnF,OAAO,EAAE,cAAc,EAAuB,MAAM,aAAa,CAAC;AAQlE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC"}

package/dist/plugin.d.ts

@@ -0,0 +1,21 @@
+import type { OAuthAdapter } from "./adapter/types.js";
+import { createOAuthFlow, type OAuthFlowOptions } from "./flow.js";
+import type { OAuthProviderConfig } from "./providers/types.js";
+import type { OAuthProviderId } from "./adapter/types.js";
+export interface OAuthPluginOptions<TUser = unknown> {
+    secret?: string;
+    adapter: OAuthAdapter<TUser>;
+    providers: Partial<Record<OAuthProviderId, OAuthProviderConfig>>;
+    basePath?: string;
+    loginPath?: string;
+    redirectAllowlist?: readonly string[];
+    secure?: OAuthFlowOptions<TUser>["secure"];
+    onSuccess?: OAuthFlowOptions<TUser>["onSuccess"];
+    onError?: OAuthFlowOptions<TUser>["onError"];
+    tokenRefresh?: OAuthFlowOptions<TUser>["tokenRefresh"];
+}
+/** Otok plugin factory — register after auth() in otok.config.ts. */
+export default function oauth<TUser = unknown>(options: OAuthPluginOptions<TUser>): import("@kamod-ch/otok-config").OtokPlugin<unknown>;
+/** Programmatic setup — backward compatible with createOAuthFlow(). */
+export { createOAuthFlow };
+//# sourceMappingURL=plugin.d.ts.map

package/dist/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,MAAM,WAAW,kBAAkB,CAAC,KAAK,GAAG,OAAO;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAC7B,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,MAAM,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC3C,SAAS,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7C,YAAY,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,CAAC;CACxD;AAkDD,qEAAqE;AACrE,MAAM,CAAC,OAAO,UAAU,KAAK,CAAC,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,uDAOhF;AAED,uEAAuE;AACvE,OAAO,EAAE,eAAe,EAAE,CAAC"}