@kamod-ch/otok-oauth 2.0.0

package/dist/plugin.js

@@ -0,0 +1,60 @@
+import { definePlugin } from "@kamod-ch/otok";
+import { getAuthRuntime, tryGetAuthRuntime } from "@kamod-ch/otok-auth/registry";
+import { createOAuthFlow } from "./flow.js";
+function resolveSecret(options) {
+    const secret = options.secret ?? process.env.AUTH_SECRET ?? process.env.OAUTH_SECRET;
+    if (!secret || secret.length < 32) {
+        throw new Error("otok-oauth: provide secret (min 32 bytes) or set AUTH_SECRET");
+    }
+    return secret;
+}
+function buildFlowOptions(options) {
+    const authRuntime = tryGetAuthRuntime();
+    return {
+        secret: resolveSecret(options),
+        adapter: options.adapter,
+        createSession: async (c, userId) => {
+            const runtime = getAuthRuntime();
+            await runtime.sessions.createSession(c, userId);
+        },
+        providers: options.providers,
+        basePath: options.basePath,
+        loginPath: options.loginPath ?? authRuntime?.loginPath,
+        redirectAllowlist: options.redirectAllowlist ?? authRuntime?.redirectAllowlist,
+        secure: options.secure,
+        onSuccess: options.onSuccess,
+        onError: options.onError,
+        tokenRefresh: options.tokenRefresh,
+    };
+}
+const oauthPluginFactory = definePlugin({
+    name: "@kamod-ch/otok-oauth",
+    version: "1.1.0",
+    schema: {
+        parse(input) {
+            if (!input || typeof input !== "object") {
+                throw new Error("oauth() options must be an object");
+            }
+            const record = input;
+            if (!record.adapter || typeof record.adapter !== "object") {
+                throw new Error("oauth() requires an OAuthAdapter");
+            }
+            if (!record.providers || typeof record.providers !== "object") {
+                throw new Error("oauth() requires providers");
+            }
+            return input;
+        },
+    },
+});
+/** Otok plugin factory — register after auth() in otok.config.ts. */
+export default function oauth(options) {
+    const plugin = oauthPluginFactory(options);
+    const flow = createOAuthFlow(buildFlowOptions(options));
+    plugin.configureApp = ({ app }) => {
+        flow.mount(app);
+    };
+    return plugin;
+}
+/** Programmatic setup — backward compatible with createOAuthFlow(). */
+export { createOAuthFlow };
+//# sourceMappingURL=plugin.js.map

package/dist/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEjF,OAAO,EAAE,eAAe,EAAyB,MAAM,WAAW,CAAC;AAiBnE,SAAS,aAAa,CAAC,OAA2C;IAChE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACrF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAQ,OAAkC;IACjE,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAC;IACxC,OAAO;QACL,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE;YACjC,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;YACjC,MAAM,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAClD,CAAC;QACD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,WAAW,EAAE,SAAS;QACtD,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,WAAW,EAAE,iBAAiB;QAC9E,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,kBAAkB,GAAG,YAAY,CAAqB;IAC1D,IAAI,EAAE,sBAAsB;IAC5B,OAAO,EAAE,OAAO;IAChB,MAAM,EAAE;QACN,KAAK,CAAC,KAAK;YACT,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACvD,CAAC;YACD,MAAM,MAAM,GAAG,KAAgC,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACtD,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,KAA2B,CAAC;QACrC,CAAC;KACF;CACF,CAAC,CAAC;AAEH,qEAAqE;AACrE,MAAM,CAAC,OAAO,UAAU,KAAK,CAAkB,OAAkC;IAC/E,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAA6B,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,eAAe,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IACxD,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;QAChC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uEAAuE;AACvE,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/dist/profile/github.d.ts

@@ -0,0 +1,3 @@
+import type { OAuthProfile } from "../adapter/types.js";
+export declare function fetchGitHubProfile(accessToken: string): Promise<OAuthProfile>;
+//# sourceMappingURL=github.d.ts.map

package/dist/profile/github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../src/profile/github.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAiBxD,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CA+CnF"}

package/dist/profile/github.js

@@ -0,0 +1,45 @@
+import { OAuthFlowError } from "../errors.js";
+export async function fetchGitHubProfile(accessToken) {
+    const [userRes, emailsRes] = await Promise.all([
+        fetch("https://api.github.com/user", {
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                Accept: "application/vnd.github+json",
+                "User-Agent": "otok-oauth",
+            },
+        }),
+        fetch("https://api.github.com/user/emails", {
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                Accept: "application/vnd.github+json",
+                "User-Agent": "otok-oauth",
+            },
+        }),
+    ]);
+    if (!userRes.ok) {
+        throw new OAuthFlowError("profile_error", `GitHub /user failed with ${userRes.status}`);
+    }
+    const user = (await userRes.json());
+    let email = user.email;
+    let emailVerified = false;
+    if (emailsRes.ok) {
+        const emails = (await emailsRes.json());
+        const primary = emails.find((entry) => entry.primary && entry.verified) ??
+            emails.find((entry) => entry.verified) ??
+            emails.find((entry) => entry.primary) ??
+            null;
+        if (primary) {
+            email = primary.email;
+            emailVerified = primary.verified;
+        }
+    }
+    return {
+        provider: "github",
+        providerAccountId: String(user.id),
+        email,
+        emailVerified,
+        name: user.name ?? user.login ?? null,
+        avatarUrl: user.avatar_url ?? null,
+    };
+}
+//# sourceMappingURL=github.js.map

package/dist/profile/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../src/profile/github.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAgB9C,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,WAAmB;IAC1D,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC7C,KAAK,CAAC,6BAA6B,EAAE;YACnC,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,MAAM,EAAE,6BAA6B;gBACrC,YAAY,EAAE,YAAY;aAC3B;SACF,CAAC;QACF,KAAK,CAAC,oCAAoC,EAAE;YAC1C,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,MAAM,EAAE,6BAA6B;gBACrC,YAAY,EAAE,YAAY;aAC3B;SACF,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,4BAA4B,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAe,CAAC;IAClD,IAAI,KAAK,GAAkB,IAAI,CAAC,KAAK,CAAC;IACtC,IAAI,aAAa,GAAG,KAAK,CAAC;IAE1B,IAAI,SAAS,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAkB,CAAC;QACzD,MAAM,OAAO,GACX,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC;YACvD,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;YACrC,IAAI,CAAC;QACP,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YACtB,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC;QACnC,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,QAAQ;QAClB,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,KAAK;QACL,aAAa;QACb,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI;QACrC,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;KACnC,CAAC;AACJ,CAAC"}

package/dist/profile/gitlab.d.ts

@@ -0,0 +1,3 @@
+import type { OAuthProfile } from "../adapter/types.js";
+export declare function fetchGitLabProfile(accessToken: string, baseURL?: string): Promise<OAuthProfile>;
+//# sourceMappingURL=gitlab.d.ts.map

package/dist/profile/gitlab.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlab.d.ts","sourceRoot":"","sources":["../../src/profile/gitlab.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAYxD,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,OAAO,SAAuB,GAC7B,OAAO,CAAC,YAAY,CAAC,CAyBvB"}

package/dist/profile/gitlab.js

@@ -0,0 +1,25 @@
+import { OAuthFlowError } from "../errors.js";
+export async function fetchGitLabProfile(accessToken, baseURL = "https://gitlab.com") {
+    const origin = baseURL.replace(/\/+$/, "");
+    const response = await fetch(`${origin}/api/v4/user`, {
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+        },
+    });
+    if (!response.ok) {
+        throw new OAuthFlowError("profile_error", `GitLab /api/v4/user failed with ${response.status}`);
+    }
+    const user = (await response.json());
+    if (user.id == null) {
+        throw new OAuthFlowError("profile_error", "GitLab profile missing id");
+    }
+    return {
+        provider: "gitlab",
+        providerAccountId: String(user.id),
+        email: user.email ?? null,
+        emailVerified: Boolean(user.confirmed_at),
+        name: user.name ?? user.username ?? null,
+        avatarUrl: user.avatar_url ?? null,
+    };
+}
+//# sourceMappingURL=gitlab.js.map

package/dist/profile/gitlab.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlab.js","sourceRoot":"","sources":["../../src/profile/gitlab.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAW9C,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAmB,EACnB,OAAO,GAAG,oBAAoB;IAE9B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,cAAc,EAAE;QACpD,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;KACF,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,mCAAmC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAe,CAAC;IACnD,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IACzE,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,QAAQ;QAClB,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;QACzB,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;QACzC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI;QACxC,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;KACnC,CAAC;AACJ,CAAC"}

package/dist/profile/google.d.ts

@@ -0,0 +1,3 @@
+import type { OAuthProfile } from "../adapter/types.js";
+export declare function fetchGoogleProfile(accessToken: string): Promise<OAuthProfile>;
+//# sourceMappingURL=google.d.ts.map

package/dist/profile/google.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.d.ts","sourceRoot":"","sources":["../../src/profile/google.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAWxD,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAwBnF"}

package/dist/profile/google.js

@@ -0,0 +1,24 @@
+import { OAuthFlowError } from "../errors.js";
+export async function fetchGoogleProfile(accessToken) {
+    const response = await fetch("https://openidconnect.googleapis.com/v1/userinfo", {
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+        },
+    });
+    if (!response.ok) {
+        throw new OAuthFlowError("profile_error", `Google userinfo failed with ${response.status}`);
+    }
+    const info = (await response.json());
+    if (!info.sub) {
+        throw new OAuthFlowError("profile_error", "Google userinfo missing sub");
+    }
+    return {
+        provider: "google",
+        providerAccountId: info.sub,
+        email: info.email ?? null,
+        emailVerified: Boolean(info.email_verified),
+        name: info.name ?? null,
+        avatarUrl: info.picture ?? null,
+    };
+}
+//# sourceMappingURL=google.js.map

package/dist/profile/google.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.js","sourceRoot":"","sources":["../../src/profile/google.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAU9C,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,WAAmB;IAC1D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,kDAAkD,EAAE;QAC/E,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;KACF,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,+BAA+B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmB,CAAC;IACvD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,QAAQ;QAClB,iBAAiB,EAAE,IAAI,CAAC,GAAG;QAC3B,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;QACzB,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;QAC3C,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI;QACvB,SAAS,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI;KAChC,CAAC;AACJ,CAAC"}

package/dist/profile/microsoft.d.ts

@@ -0,0 +1,3 @@
+import type { OAuthProfile } from "../adapter/types.js";
+export declare function fetchMicrosoftProfile(accessToken: string): Promise<OAuthProfile>;
+//# sourceMappingURL=microsoft.d.ts.map

package/dist/profile/microsoft.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"microsoft.d.ts","sourceRoot":"","sources":["../../src/profile/microsoft.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAcxD,wBAAsB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CA2BtF"}

package/dist/profile/microsoft.js

@@ -0,0 +1,26 @@
+import { OAuthFlowError } from "../errors.js";
+export async function fetchMicrosoftProfile(accessToken) {
+    const response = await fetch("https://graph.microsoft.com/v1.0/me", {
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+        },
+    });
+    if (!response.ok) {
+        throw new OAuthFlowError("profile_error", `Microsoft Graph /me failed with ${response.status}`);
+    }
+    const info = (await response.json());
+    const providerAccountId = info.id ?? info.sub;
+    if (!providerAccountId) {
+        throw new OAuthFlowError("profile_error", "Microsoft profile missing id");
+    }
+    const email = info.mail ?? info.userPrincipalName ?? info.email ?? null;
+    return {
+        provider: "microsoft",
+        providerAccountId: String(providerAccountId),
+        email,
+        emailVerified: Boolean(email),
+        name: info.displayName ?? info.name ?? null,
+        avatarUrl: null,
+    };
+}
+//# sourceMappingURL=microsoft.js.map

package/dist/profile/microsoft.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"microsoft.js","sourceRoot":"","sources":["../../src/profile/microsoft.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAa9C,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,WAAmB;IAC7D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,qCAAqC,EAAE;QAClE,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;KACF,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,mCAAmC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAsB,CAAC;IAC1D,MAAM,iBAAiB,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;IAC9C,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,8BAA8B,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;IAExE,OAAO;QACL,QAAQ,EAAE,WAAW;QACrB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,CAAC;QAC5C,KAAK;QACL,aAAa,EAAE,OAAO,CAAC,KAAK,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI;QAC3C,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC"}

package/dist/providers/github.d.ts

@@ -0,0 +1,7 @@
+import { GitHub } from "arctic";
+import { DEFAULT_GITHUB_SCOPES, type OAuthProviderConfig } from "./types.js";
+export declare function createGitHubClient(config: OAuthProviderConfig): GitHub;
+export declare function githubScopes(config: OAuthProviderConfig): string[];
+export { DEFAULT_GITHUB_SCOPES };
+export type { OAuthProviderConfig };
+//# sourceMappingURL=github.d.ts.map

package/dist/providers/github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../src/providers/github.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,qBAAqB,EAAE,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAE7E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAEtE;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,EAAE,CAElE;AAED,OAAO,EAAE,qBAAqB,EAAE,CAAC;AACjC,YAAY,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/providers/github.js

@@ -0,0 +1,10 @@
+import { GitHub } from "arctic";
+import { DEFAULT_GITHUB_SCOPES } from "./types.js";
+export function createGitHubClient(config) {
+    return new GitHub(config.clientId, config.clientSecret, config.redirectUri);
+}
+export function githubScopes(config) {
+    return config.scopes ?? [...DEFAULT_GITHUB_SCOPES];
+}
+export { DEFAULT_GITHUB_SCOPES };
+//# sourceMappingURL=github.js.map

package/dist/providers/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../src/providers/github.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,qBAAqB,EAA4B,MAAM,YAAY,CAAC;AAE7E,MAAM,UAAU,kBAAkB,CAAC,MAA2B;IAC5D,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAA2B;IACtD,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,qBAAqB,CAAC,CAAC;AACrD,CAAC;AAED,OAAO,EAAE,qBAAqB,EAAE,CAAC"}

package/dist/providers/gitlab.d.ts

@@ -0,0 +1,11 @@
+import { GitLab } from "arctic";
+import type { OAuthProviderConfig } from "./types.js";
+export declare const DEFAULT_GITLAB_SCOPES: readonly ["read_user"];
+export type GitLabProviderConfig = OAuthProviderConfig & {
+    /** GitLab base URL. Defaults to `https://gitlab.com`. */
+    baseURL?: string;
+};
+export declare function gitlabScopes(config: OAuthProviderConfig): string[];
+export declare function createGitLabClient(config: GitLabProviderConfig): GitLab;
+export type { OAuthProviderConfig };
+//# sourceMappingURL=gitlab.d.ts.map

package/dist/providers/gitlab.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlab.d.ts","sourceRoot":"","sources":["../../src/providers/gitlab.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,eAAO,MAAM,qBAAqB,wBAAyB,CAAC;AAE5D,MAAM,MAAM,oBAAoB,GAAG,mBAAmB,GAAG;IACvD,yDAAyD;IACzD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,wBAAgB,YAAY,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,EAAE,CAElE;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAOvE;AAED,YAAY,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/providers/gitlab.js

@@ -0,0 +1,9 @@
+import { GitLab } from "arctic";
+export const DEFAULT_GITLAB_SCOPES = ["read_user"];
+export function gitlabScopes(config) {
+    return config.scopes ?? [...DEFAULT_GITLAB_SCOPES];
+}
+export function createGitLabClient(config) {
+    return new GitLab(config.baseURL ?? "https://gitlab.com", config.clientId, config.clientSecret, config.redirectUri);
+}
+//# sourceMappingURL=gitlab.js.map

package/dist/providers/gitlab.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlab.js","sourceRoot":"","sources":["../../src/providers/gitlab.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGhC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,WAAW,CAAU,CAAC;AAO5D,MAAM,UAAU,YAAY,CAAC,MAA2B;IACtD,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,qBAAqB,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAA4B;IAC7D,OAAO,IAAI,MAAM,CACf,MAAM,CAAC,OAAO,IAAI,oBAAoB,EACtC,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,WAAW,CACnB,CAAC;AACJ,CAAC"}

package/dist/providers/google.d.ts

@@ -0,0 +1,7 @@
+import { Google } from "arctic";
+import { DEFAULT_GOOGLE_SCOPES, type OAuthProviderConfig } from "./types.js";
+export declare function createGoogleClient(config: OAuthProviderConfig): Google;
+export declare function googleScopes(config: OAuthProviderConfig): string[];
+export { DEFAULT_GOOGLE_SCOPES };
+export type { OAuthProviderConfig };
+//# sourceMappingURL=google.d.ts.map

package/dist/providers/google.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.d.ts","sourceRoot":"","sources":["../../src/providers/google.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,qBAAqB,EAAE,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAE7E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAEtE;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,EAAE,CAElE;AAED,OAAO,EAAE,qBAAqB,EAAE,CAAC;AACjC,YAAY,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/providers/google.js

@@ -0,0 +1,10 @@
+import { Google } from "arctic";
+import { DEFAULT_GOOGLE_SCOPES } from "./types.js";
+export function createGoogleClient(config) {
+    return new Google(config.clientId, config.clientSecret, config.redirectUri);
+}
+export function googleScopes(config) {
+    return config.scopes ?? [...DEFAULT_GOOGLE_SCOPES];
+}
+export { DEFAULT_GOOGLE_SCOPES };
+//# sourceMappingURL=google.js.map

package/dist/providers/google.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.js","sourceRoot":"","sources":["../../src/providers/google.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,qBAAqB,EAA4B,MAAM,YAAY,CAAC;AAE7E,MAAM,UAAU,kBAAkB,CAAC,MAA2B;IAC5D,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAA2B;IACtD,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,qBAAqB,CAAC,CAAC;AACrD,CAAC;AAED,OAAO,EAAE,qBAAqB,EAAE,CAAC"}

package/dist/providers/microsoft.d.ts

@@ -0,0 +1,11 @@
+import { MicrosoftEntraId } from "arctic";
+import type { OAuthProviderConfig } from "./types.js";
+export declare const DEFAULT_MICROSOFT_SCOPES: readonly ["openid", "email", "profile", "User.Read"];
+export type MicrosoftProviderConfig = OAuthProviderConfig & {
+    /** Entra ID tenant. Defaults to `common`. */
+    tenant?: string;
+};
+export declare function microsoftScopes(config: OAuthProviderConfig): string[];
+export declare function createMicrosoftClient(config: MicrosoftProviderConfig): MicrosoftEntraId;
+export type { OAuthProviderConfig };
+//# sourceMappingURL=microsoft.d.ts.map

package/dist/providers/microsoft.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"microsoft.d.ts","sourceRoot":"","sources":["../../src/providers/microsoft.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAC1C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,eAAO,MAAM,wBAAwB,sDAAuD,CAAC;AAE7F,MAAM,MAAM,uBAAuB,GAAG,mBAAmB,GAAG;IAC1D,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,wBAAgB,eAAe,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,EAAE,CAErE;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,uBAAuB,GAAG,gBAAgB,CAOvF;AAED,YAAY,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/providers/microsoft.js

@@ -0,0 +1,9 @@
+import { MicrosoftEntraId } from "arctic";
+export const DEFAULT_MICROSOFT_SCOPES = ["openid", "email", "profile", "User.Read"];
+export function microsoftScopes(config) {
+    return config.scopes ?? [...DEFAULT_MICROSOFT_SCOPES];
+}
+export function createMicrosoftClient(config) {
+    return new MicrosoftEntraId(config.tenant ?? "common", config.clientId, config.clientSecret, config.redirectUri);
+}
+//# sourceMappingURL=microsoft.js.map

package/dist/providers/microsoft.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"microsoft.js","sourceRoot":"","sources":["../../src/providers/microsoft.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAG1C,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAU,CAAC;AAO7F,MAAM,UAAU,eAAe,CAAC,MAA2B;IACzD,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,wBAAwB,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAA+B;IACnE,OAAO,IAAI,gBAAgB,CACzB,MAAM,CAAC,MAAM,IAAI,QAAQ,EACzB,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,WAAW,CACnB,CAAC;AACJ,CAAC"}

package/dist/providers/types.d.ts

@@ -0,0 +1,9 @@
+export type OAuthProviderConfig = {
+    clientId: string;
+    clientSecret: string;
+    redirectUri: string;
+    scopes?: string[];
+};
+export declare const DEFAULT_GITHUB_SCOPES: readonly ["user:email"];
+export declare const DEFAULT_GOOGLE_SCOPES: readonly ["openid", "email", "profile"];
+//# sourceMappingURL=types.d.ts.map

package/dist/providers/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/providers/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEF,eAAO,MAAM,qBAAqB,yBAA0B,CAAC;AAC7D,eAAO,MAAM,qBAAqB,yCAA0C,CAAC"}

package/dist/providers/types.js

@@ -0,0 +1,3 @@
+export const DEFAULT_GITHUB_SCOPES = ["user:email"];
+export const DEFAULT_GOOGLE_SCOPES = ["openid", "email", "profile"];
+//# sourceMappingURL=types.js.map

package/dist/providers/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/providers/types.ts"],"names":[],"mappings":"AAOA,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,YAAY,CAAU,CAAC;AAC7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAU,CAAC"}

package/dist/redirect.d.ts

@@ -0,0 +1,3 @@
+/** Only same-origin relative paths within an optional allowlist. */
+export declare function safeNextPath(raw: string | null | undefined, allowlist?: readonly string[]): string | null;
+//# sourceMappingURL=redirect.d.ts.map

package/dist/redirect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../src/redirect.ts"],"names":[],"mappings":"AAEA,oEAAoE;AACpE,wBAAgB,YAAY,CAC1B,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC9B,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,GAC5B,MAAM,GAAG,IAAI,CAEf"}

package/dist/redirect.js

@@ -0,0 +1,6 @@
+import { safeRedirectPath } from "@kamod-ch/otok-auth/redirect";
+/** Only same-origin relative paths within an optional allowlist. */
+export function safeNextPath(raw, allowlist) {
+    return safeRedirectPath(raw, allowlist ?? ["/"]);
+}
+//# sourceMappingURL=redirect.js.map

package/dist/redirect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect.js","sourceRoot":"","sources":["../src/redirect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAEhE,oEAAoE;AACpE,MAAM,UAAU,YAAY,CAC1B,GAA8B,EAC9B,SAA6B;IAE7B,OAAO,gBAAgB,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACnD,CAAC"}

package/dist/state.d.ts

@@ -0,0 +1,22 @@
+import type { OAuthProviderId } from "./adapter/types.js";
+export type OAuthStatePayload = {
+    provider: OAuthProviderId;
+    state: string;
+    codeVerifier: string | null;
+    next: string | null;
+    link?: boolean;
+    issuedAt: number;
+};
+declare const DEFAULT_MAX_AGE_MS: number;
+export declare function encodePayload(payload: string): string;
+export declare function decodePayload(encoded: string): string | null;
+export declare function signPayload(encodedPayload: string, secret: string): string;
+export declare function seal(value: string, secret: string): string;
+export declare function unseal(token: string, secret: string): string | null;
+export declare function sealOAuthState(payload: OAuthStatePayload, secret: string): string;
+export declare function unsealOAuthState(token: string, secret: string, options?: {
+    maxAgeMs?: number;
+    now?: number;
+}): OAuthStatePayload | null;
+export { DEFAULT_MAX_AGE_MS };
+//# sourceMappingURL=state.d.ts.map

package/dist/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,eAAe,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,QAAA,MAAM,kBAAkB,QAAiB,CAAC;AAE1C,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM5D;AAED,wBAAgB,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAcnE;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5C,iBAAiB,GAAG,IAAI,CAkB1B;AAkBD,OAAO,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/state.js

@@ -0,0 +1,73 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+const DEFAULT_MAX_AGE_MS = 10 * 60 * 1000;
+export function encodePayload(payload) {
+    return Buffer.from(payload, "utf8").toString("base64url");
+}
+export function decodePayload(encoded) {
+    try {
+        return Buffer.from(encoded, "base64url").toString("utf8");
+    }
+    catch {
+        return null;
+    }
+}
+export function signPayload(encodedPayload, secret) {
+    return createHmac("sha256", secret).update(encodedPayload).digest("base64url");
+}
+export function seal(value, secret) {
+    const encoded = encodePayload(value);
+    return `${encoded}.${signPayload(encoded, secret)}`;
+}
+export function unseal(token, secret) {
+    const separator = token.lastIndexOf(".");
+    if (separator <= 0)
+        return null;
+    const encoded = token.slice(0, separator);
+    const signature = token.slice(separator + 1);
+    if (!encoded || !signature)
+        return null;
+    const expected = signPayload(encoded, secret);
+    const left = Buffer.from(signature);
+    const right = Buffer.from(expected);
+    if (left.length !== right.length || !timingSafeEqual(left, right))
+        return null;
+    return decodePayload(encoded);
+}
+export function sealOAuthState(payload, secret) {
+    return seal(JSON.stringify(payload), secret);
+}
+export function unsealOAuthState(token, secret, options) {
+    const raw = unseal(token, secret);
+    if (!raw)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!isOAuthStatePayload(parsed))
+        return null;
+    const maxAgeMs = options?.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
+    const now = options?.now ?? Date.now();
+    if (now - parsed.issuedAt > maxAgeMs)
+        return null;
+    return parsed;
+}
+function isOAuthStatePayload(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const record = value;
+    return ((record.provider === "github" ||
+        record.provider === "google" ||
+        record.provider === "microsoft" ||
+        record.provider === "gitlab") &&
+        typeof record.state === "string" &&
+        (typeof record.codeVerifier === "string" || record.codeVerifier === null) &&
+        (typeof record.next === "string" || record.next === null) &&
+        (record.link === undefined || typeof record.link === "boolean") &&
+        typeof record.issuedAt === "number");
+}
+export { DEFAULT_MAX_AGE_MS };
+//# sourceMappingURL=state.js.map

package/dist/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAY1D,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE1C,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,cAAsB,EAAE,MAAc;IAChE,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,KAAa,EAAE,MAAc;IAChD,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,GAAG,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAa,EAAE,MAAc;IAClD,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAExC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/E,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAA0B,EAAE,MAAc;IACvE,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,KAAa,EACb,MAAc,EACd,OAA6C;IAE7C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,kBAAkB,CAAC;IACzD,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACvC,IAAI,GAAG,GAAG,MAAM,CAAC,QAAQ,GAAG,QAAQ;QAAE,OAAO,IAAI,CAAC;IAElD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,CACL,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAC3B,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAC5B,MAAM,CAAC,QAAQ,KAAK,WAAW;QAC/B,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC/B,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAChC,CAAC,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI,CAAC;QACzE,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC;QACzD,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC;QAC/D,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CACpC,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAC"}

package/package.json

@@ -0,0 +1,88 @@
+{
+  "name": "@kamod-ch/otok-oauth",
+  "version": "2.0.0",
+  "description": "OAuth login helpers (GitHub, Google, Microsoft, GitLab) for Otok apps.",
+  "license": "MIT",
+  "homepage": "https://github.com/kamod-ch/otok/tree/main/packages/otok-oauth#readme",
+  "bugs": {
+    "url": "https://github.com/kamod-ch/otok/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kamod-ch/otok.git",
+    "directory": "packages/otok-oauth"
+  },
+  "type": "module",
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./adapter": {
+      "types": "./dist/adapter/index.d.ts",
+      "default": "./dist/adapter/index.js"
+    },
+    "./providers/github": {
+      "types": "./dist/providers/github.d.ts",
+      "default": "./dist/providers/github.js"
+    },
+    "./providers/google": {
+      "types": "./dist/providers/google.d.ts",
+      "default": "./dist/providers/google.js"
+    },
+    "./state": {
+      "types": "./dist/state.d.ts",
+      "default": "./dist/state.js"
+    },
+    "./plugin": {
+      "types": "./dist/plugin.d.ts",
+      "default": "./dist/plugin.js"
+    },
+    "./providers/microsoft": {
+      "types": "./dist/providers/microsoft.d.ts",
+      "default": "./dist/providers/microsoft.js"
+    },
+    "./providers/gitlab": {
+      "types": "./dist/providers/gitlab.d.ts",
+      "default": "./dist/providers/gitlab.js"
+    }
+  },
+  "peerDependencies": {
+    "@kamod-ch/otok": ">=0.6.1",
+    "@kamod-ch/otok-auth": ">=2.0.0",
+    "arctic": ">=3.0.0",
+    "hono": ">=4"
+  },
+  "peerDependenciesMeta": {
+    "otok": {
+      "optional": true
+    },
+    "@kamod-ch/otok-auth": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/node": "^24.12.2",
+    "arctic": "^3.7.0",
+    "hono": "^4.12.25",
+    "typescript": "~6.0.2",
+    "vitest": "^4.1.2",
+    "@kamod-ch/otok": "0.6.1",
+    "@kamod-ch/otok-auth": "2.0.0"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
+}