@logto/connector-apple 1.3.1 → 1.4.0

package/lib/index.js

@@ -1,1361 +1,180 @@
-import { ConnectorPlatform, ConnectorConfigFormItemType, ConnectorType, validateConfig, ConnectorError, ConnectorErrorCodes, jsonGuard } from '@logto/connector-kit';
-import * as crypto from 'node:crypto';
-import crypto__default, { KeyObject, createPrivateKey, createPublicKey, constants, createSecretKey } from 'node:crypto';
-import { z } from 'zod';
-import { Buffer as Buffer$1 } from 'node:buffer';
-import * as util from 'node:util';
-import { promisify } from 'node:util';
-import * as http from 'node:http';
-import * as https from 'node:https';
-import { once } from 'node:events';
-
-// https://github.com/facebook/jest/issues/7547
-const assert = (value, error) => {
-    if (!value) {
-        // https://github.com/typescript-eslint/typescript-eslint/issues/3814
-        // eslint-disable-next-line @typescript-eslint/no-throw-literal
-        throw error;
-    }
-};
-
-const POOL_SIZE_MULTIPLIER = 128;
-let pool, poolOffset;
-function fillPool(bytes) {
-  if (!pool || pool.length < bytes) {
-    pool = Buffer.allocUnsafe(bytes * POOL_SIZE_MULTIPLIER);
-    crypto__default.getRandomValues(pool);
-    poolOffset = 0;
-  } else if (poolOffset + bytes > pool.length) {
-    crypto__default.getRandomValues(pool);
-    poolOffset = 0;
-  }
-  poolOffset += bytes;
-}
-function random(bytes) {
-  fillPool((bytes -= 0));
-  return pool.subarray(poolOffset - bytes, poolOffset)
-}
-function customRandom(alphabet, defaultSize, getRandom) {
-  let mask = (2 << (31 - Math.clz32((alphabet.length - 1) | 1))) - 1;
-  let step = Math.ceil((1.6 * mask * defaultSize) / alphabet.length);
-  return (size = defaultSize) => {
-    let id = '';
-    while (true) {
-      let bytes = getRandom(step);
-      let i = step;
-      while (i--) {
-        id += alphabet[bytes[i] & mask] || '';
-        if (id.length === size) return id
-      }
-    }
-  }
-}
-function customAlphabet(alphabet, size = 21) {
-  return customRandom(alphabet, size, random)
-}
-
-const lowercaseAlphabet = '0123456789abcdefghijklmnopqrstuvwxyz';
-const alphabet = `${lowercaseAlphabet}ABCDEFGHIJKLMNOPQRSTUVWXYZ`;
-const buildIdGenerator = (size, includingUppercase = true) => customAlphabet(includingUppercase ? alphabet : lowercaseAlphabet, size);
-/**
- * Generate a standard id with 21 characters, including lowercase letters and numbers.
- *
- * @see {@link lowercaseAlphabet}
- */
-const generateStandardId = buildIdGenerator(21, false);
-/**
- * Generate a standard short id with 12 characters, including lowercase letters and numbers.
- *
- * @see {@link lowercaseAlphabet}
- */
-buildIdGenerator(12, false);
-/**
- * Generate a standard secret with 32 characters, including uppercase letters, lowercase
- * letters, and numbers.
- *
- * @see {@link alphabet}
- */
-buildIdGenerator(32);
-
-const encoder = new TextEncoder();
-const decoder = new TextDecoder();
-function concat(...buffers) {
-    const size = buffers.reduce((acc, { length }) => acc + length, 0);
-    const buf = new Uint8Array(size);
-    let i = 0;
-    buffers.forEach((buffer) => {
-        buf.set(buffer, i);
-        i += buffer.length;
-    });
-    return buf;
-}
-
-function normalize(input) {
-    let encoded = input;
-    if (encoded instanceof Uint8Array) {
-        encoded = decoder.decode(encoded);
-    }
-    return encoded;
-}
-const decode = (input) => new Uint8Array(Buffer$1.from(normalize(input), 'base64'));
-
-class JOSEError extends Error {
-    static get code() {
-        return 'ERR_JOSE_GENERIC';
-    }
-    code = 'ERR_JOSE_GENERIC';
-    constructor(message) {
-        super(message);
-        this.name = this.constructor.name;
-        Error.captureStackTrace?.(this, this.constructor);
-    }
-}
-class JWTClaimValidationFailed extends JOSEError {
-    static get code() {
-        return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
-    }
-    code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
-    claim;
-    reason;
-    constructor(message, claim = 'unspecified', reason = 'unspecified') {
-        super(message);
-        this.claim = claim;
-        this.reason = reason;
-    }
-}
-class JWTExpired extends JOSEError {
-    static get code() {
-        return 'ERR_JWT_EXPIRED';
-    }
-    code = 'ERR_JWT_EXPIRED';
-    claim;
-    reason;
-    constructor(message, claim = 'unspecified', reason = 'unspecified') {
-        super(message);
-        this.claim = claim;
-        this.reason = reason;
-    }
-}
-class JOSEAlgNotAllowed extends JOSEError {
-    static get code() {
-        return 'ERR_JOSE_ALG_NOT_ALLOWED';
-    }
-    code = 'ERR_JOSE_ALG_NOT_ALLOWED';
-}
-class JOSENotSupported extends JOSEError {
-    static get code() {
-        return 'ERR_JOSE_NOT_SUPPORTED';
-    }
-    code = 'ERR_JOSE_NOT_SUPPORTED';
-}
-class JWSInvalid extends JOSEError {
-    static get code() {
-        return 'ERR_JWS_INVALID';
-    }
-    code = 'ERR_JWS_INVALID';
-}
-class JWTInvalid extends JOSEError {
-    static get code() {
-        return 'ERR_JWT_INVALID';
-    }
-    code = 'ERR_JWT_INVALID';
-}
-class JWKSInvalid extends JOSEError {
-    static get code() {
-        return 'ERR_JWKS_INVALID';
-    }
-    code = 'ERR_JWKS_INVALID';
-}
-class JWKSNoMatchingKey extends JOSEError {
-    static get code() {
-        return 'ERR_JWKS_NO_MATCHING_KEY';
-    }
-    code = 'ERR_JWKS_NO_MATCHING_KEY';
-    message = 'no applicable key found in the JSON Web Key Set';
-}
-class JWKSMultipleMatchingKeys extends JOSEError {
-    [Symbol.asyncIterator];
-    static get code() {
-        return 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
-    }
-    code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
-    message = 'multiple matching keys found in the JSON Web Key Set';
-}
-class JWKSTimeout extends JOSEError {
-    static get code() {
-        return 'ERR_JWKS_TIMEOUT';
-    }
-    code = 'ERR_JWKS_TIMEOUT';
-    message = 'request timed out';
-}
-class JWSSignatureVerificationFailed extends JOSEError {
-    static get code() {
-        return 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
-    }
-    code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
-    message = 'signature verification failed';
-}
-
-var isKeyObject = (obj) => util.types.isKeyObject(obj);
-
-const webcrypto = crypto.webcrypto;
-const isCryptoKey = (key) => util.types.isCryptoKey(key);
-
-function unusable(name, prop = 'algorithm.name') {
-    return new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
-}
-function isAlgorithm(algorithm, name) {
-    return algorithm.name === name;
-}
-function getHashLength(hash) {
-    return parseInt(hash.name.slice(4), 10);
-}
-function getNamedCurve$1(alg) {
-    switch (alg) {
-        case 'ES256':
-            return 'P-256';
-        case 'ES384':
-            return 'P-384';
-        case 'ES512':
-            return 'P-521';
-        default:
-            throw new Error('unreachable');
-    }
-}
-function checkUsage(key, usages) {
-    if (usages.length && !usages.some((expected) => key.usages.includes(expected))) {
-        let msg = 'CryptoKey does not support this operation, its usages must include ';
-        if (usages.length > 2) {
-            const last = usages.pop();
-            msg += `one of ${usages.join(', ')}, or ${last}.`;
-        }
-        else if (usages.length === 2) {
-            msg += `one of ${usages[0]} or ${usages[1]}.`;
-        }
-        else {
-            msg += `${usages[0]}.`;
-        }
-        throw new TypeError(msg);
-    }
-}
-function checkSigCryptoKey(key, alg, ...usages) {
-    switch (alg) {
-        case 'HS256':
-        case 'HS384':
-        case 'HS512': {
-            if (!isAlgorithm(key.algorithm, 'HMAC'))
-                throw unusable('HMAC');
-            const expected = parseInt(alg.slice(2), 10);
-            const actual = getHashLength(key.algorithm.hash);
-            if (actual !== expected)
-                throw unusable(`SHA-${expected}`, 'algorithm.hash');
-            break;
-        }
-        case 'RS256':
-        case 'RS384':
-        case 'RS512': {
-            if (!isAlgorithm(key.algorithm, 'RSASSA-PKCS1-v1_5'))
-                throw unusable('RSASSA-PKCS1-v1_5');
-            const expected = parseInt(alg.slice(2), 10);
-            const actual = getHashLength(key.algorithm.hash);
-            if (actual !== expected)
-                throw unusable(`SHA-${expected}`, 'algorithm.hash');
-            break;
-        }
-        case 'PS256':
-        case 'PS384':
-        case 'PS512': {
-            if (!isAlgorithm(key.algorithm, 'RSA-PSS'))
-                throw unusable('RSA-PSS');
-            const expected = parseInt(alg.slice(2), 10);
-            const actual = getHashLength(key.algorithm.hash);
-            if (actual !== expected)
-                throw unusable(`SHA-${expected}`, 'algorithm.hash');
-            break;
-        }
-        case 'EdDSA': {
-            if (key.algorithm.name !== 'Ed25519' && key.algorithm.name !== 'Ed448') {
-                throw unusable('Ed25519 or Ed448');
-            }
-            break;
-        }
-        case 'ES256':
-        case 'ES384':
-        case 'ES512': {
-            if (!isAlgorithm(key.algorithm, 'ECDSA'))
-                throw unusable('ECDSA');
-            const expected = getNamedCurve$1(alg);
-            const actual = key.algorithm.namedCurve;
-            if (actual !== expected)
-                throw unusable(expected, 'algorithm.namedCurve');
-            break;
-        }
-        default:
-            throw new TypeError('CryptoKey does not support this operation');
-    }
-    checkUsage(key, usages);
-}
-
-function message(msg, actual, ...types) {
-    if (types.length > 2) {
-        const last = types.pop();
-        msg += `one of type ${types.join(', ')}, or ${last}.`;
-    }
-    else if (types.length === 2) {
-        msg += `one of type ${types[0]} or ${types[1]}.`;
-    }
-    else {
-        msg += `of type ${types[0]}.`;
-    }
-    if (actual == null) {
-        msg += ` Received ${actual}`;
-    }
-    else if (typeof actual === 'function' && actual.name) {
-        msg += ` Received function ${actual.name}`;
-    }
-    else if (typeof actual === 'object' && actual != null) {
-        if (actual.constructor && actual.constructor.name) {
-            msg += ` Received an instance of ${actual.constructor.name}`;
-        }
-    }
-    return msg;
-}
-var invalidKeyInput = (actual, ...types) => {
-    return message('Key must be ', actual, ...types);
-};
-function withAlg(alg, actual, ...types) {
-    return message(`Key for the ${alg} algorithm must be `, actual, ...types);
-}
-
-var isKeyLike = (key) => isKeyObject(key) || isCryptoKey(key);
-const types = ['KeyObject'];
-if (globalThis.CryptoKey || webcrypto?.CryptoKey) {
-    types.push('CryptoKey');
-}
-
-const isDisjoint = (...headers) => {
-    const sources = headers.filter(Boolean);
-    if (sources.length === 0 || sources.length === 1) {
-        return true;
-    }
-    let acc;
-    for (const header of sources) {
-        const parameters = Object.keys(header);
-        if (!acc || acc.size === 0) {
-            acc = new Set(parameters);
-            continue;
-        }
-        for (const parameter of parameters) {
-            if (acc.has(parameter)) {
-                return false;
-            }
-            acc.add(parameter);
-        }
-    }
-    return true;
-};
-
-function isObjectLike(value) {
-    return typeof value === 'object' && value !== null;
-}
-function isObject(input) {
-    if (!isObjectLike(input) || Object.prototype.toString.call(input) !== '[object Object]') {
-        return false;
-    }
-    if (Object.getPrototypeOf(input) === null) {
-        return true;
-    }
-    let proto = input;
-    while (Object.getPrototypeOf(proto) !== null) {
-        proto = Object.getPrototypeOf(proto);
-    }
-    return Object.getPrototypeOf(input) === proto;
-}
-
-const namedCurveToJOSE = (namedCurve) => {
-    switch (namedCurve) {
-        case 'prime256v1':
-            return 'P-256';
-        case 'secp384r1':
-            return 'P-384';
-        case 'secp521r1':
-            return 'P-521';
-        case 'secp256k1':
-            return 'secp256k1';
-        default:
-            throw new JOSENotSupported('Unsupported key curve for this operation');
-    }
-};
-const getNamedCurve = (kee, raw) => {
-    let key;
-    if (isCryptoKey(kee)) {
-        key = KeyObject.from(kee);
-    }
-    else if (isKeyObject(kee)) {
-        key = kee;
-    }
-    else {
-        throw new TypeError(invalidKeyInput(kee, ...types));
-    }
-    if (key.type === 'secret') {
-        throw new TypeError('only "private" or "public" type keys can be used for this operation');
-    }
-    switch (key.asymmetricKeyType) {
-        case 'ed25519':
-        case 'ed448':
-            return `Ed${key.asymmetricKeyType.slice(2)}`;
-        case 'x25519':
-        case 'x448':
-            return `X${key.asymmetricKeyType.slice(1)}`;
-        case 'ec': {
-            let namedCurve = key.asymmetricKeyDetails.namedCurve;
-            if (raw) {
-                return namedCurve;
-            }
-            return namedCurveToJOSE(namedCurve);
-        }
-        default:
-            throw new TypeError('Invalid asymmetric key type for this operation');
-    }
-};
-
-var checkKeyLength = (key, alg) => {
-    const { modulusLength } = key.asymmetricKeyDetails;
-    if (typeof modulusLength !== 'number' || modulusLength < 2048) {
-        throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
-    }
-};
-
-const parse = (jwk) => {
-    return (jwk.d ? createPrivateKey : createPublicKey)({ format: 'jwk', key: jwk });
-};
-
-async function importJWK(jwk, alg) {
-    if (!isObject(jwk)) {
-        throw new TypeError('JWK must be an object');
-    }
-    alg ||= jwk.alg;
-    switch (jwk.kty) {
-        case 'oct':
-            if (typeof jwk.k !== 'string' || !jwk.k) {
-                throw new TypeError('missing "k" (Key Value) Parameter value');
-            }
-            return decode(jwk.k);
-        case 'RSA':
-            if (jwk.oth !== undefined) {
-                throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
-            }
-        case 'EC':
-        case 'OKP':
-            return parse({ ...jwk, alg });
-        default:
-            throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
-    }
-}
-
-const symmetricTypeCheck = (alg, key) => {
-    if (key instanceof Uint8Array)
-        return;
-    if (!isKeyLike(key)) {
-        throw new TypeError(withAlg(alg, key, ...types, 'Uint8Array'));
-    }
-    if (key.type !== 'secret') {
-        throw new TypeError(`${types.join(' or ')} instances for symmetric algorithms must be of type "secret"`);
-    }
-};
-const asymmetricTypeCheck = (alg, key, usage) => {
-    if (!isKeyLike(key)) {
-        throw new TypeError(withAlg(alg, key, ...types));
-    }
-    if (key.type === 'secret') {
-        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithms must not be of type "secret"`);
-    }
-    if (usage === 'sign' && key.type === 'public') {
-        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithm signing must be of type "private"`);
-    }
-    if (usage === 'decrypt' && key.type === 'public') {
-        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithm decryption must be of type "private"`);
-    }
-    if (key.algorithm && usage === 'verify' && key.type === 'private') {
-        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithm verifying must be of type "public"`);
-    }
-    if (key.algorithm && usage === 'encrypt' && key.type === 'private') {
-        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithm encryption must be of type "public"`);
-    }
-};
-const checkKeyType = (alg, key, usage) => {
-    const symmetric = alg.startsWith('HS') ||
-        alg === 'dir' ||
-        alg.startsWith('PBES2') ||
-        /^A\d{3}(?:GCM)?KW$/.test(alg);
-    if (symmetric) {
-        symmetricTypeCheck(alg, key);
-    }
-    else {
-        asymmetricTypeCheck(alg, key, usage);
-    }
-};
-
-function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
-    if (joseHeader.crit !== undefined && protectedHeader.crit === undefined) {
-        throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
-    }
-    if (!protectedHeader || protectedHeader.crit === undefined) {
-        return new Set();
-    }
-    if (!Array.isArray(protectedHeader.crit) ||
-        protectedHeader.crit.length === 0 ||
-        protectedHeader.crit.some((input) => typeof input !== 'string' || input.length === 0)) {
-        throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
-    }
-    let recognized;
-    if (recognizedOption !== undefined) {
-        recognized = new Map([...Object.entries(recognizedOption), ...recognizedDefault.entries()]);
-    }
-    else {
-        recognized = recognizedDefault;
-    }
-    for (const parameter of protectedHeader.crit) {
-        if (!recognized.has(parameter)) {
-            throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
-        }
-        if (joseHeader[parameter] === undefined) {
-            throw new Err(`Extension Header Parameter "${parameter}" is missing`);
-        }
-        else if (recognized.get(parameter) && protectedHeader[parameter] === undefined) {
-            throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
-        }
-    }
-    return new Set(protectedHeader.crit);
-}
-
-const validateAlgorithms = (option, algorithms) => {
-    if (algorithms !== undefined &&
-        (!Array.isArray(algorithms) || algorithms.some((s) => typeof s !== 'string'))) {
-        throw new TypeError(`"${option}" option must be an array of strings`);
-    }
-    if (!algorithms) {
-        return undefined;
-    }
-    return new Set(algorithms);
-};
-
-function dsaDigest(alg) {
-    switch (alg) {
-        case 'PS256':
-        case 'RS256':
-        case 'ES256':
-        case 'ES256K':
-            return 'sha256';
-        case 'PS384':
-        case 'RS384':
-        case 'ES384':
-            return 'sha384';
-        case 'PS512':
-        case 'RS512':
-        case 'ES512':
-            return 'sha512';
-        case 'EdDSA':
-            return undefined;
-        default:
-            throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
-    }
-}
-
-const PSS = {
-    padding: constants.RSA_PKCS1_PSS_PADDING,
-    saltLength: constants.RSA_PSS_SALTLEN_DIGEST,
-};
-const ecCurveAlgMap = new Map([
-    ['ES256', 'P-256'],
-    ['ES256K', 'secp256k1'],
-    ['ES384', 'P-384'],
-    ['ES512', 'P-521'],
-]);
-function keyForCrypto(alg, key) {
-    switch (alg) {
-        case 'EdDSA':
-            if (!['ed25519', 'ed448'].includes(key.asymmetricKeyType)) {
-                throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be ed25519 or ed448');
-            }
-            return key;
-        case 'RS256':
-        case 'RS384':
-        case 'RS512':
-            if (key.asymmetricKeyType !== 'rsa') {
-                throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa');
-            }
-            checkKeyLength(key, alg);
-            return key;
-        case 'PS256':
-        case 'PS384':
-        case 'PS512':
-            if (key.asymmetricKeyType === 'rsa-pss') {
-                const { hashAlgorithm, mgf1HashAlgorithm, saltLength } = key.asymmetricKeyDetails;
-                const length = parseInt(alg.slice(-3), 10);
-                if (hashAlgorithm !== undefined &&
-                    (hashAlgorithm !== `sha${length}` || mgf1HashAlgorithm !== hashAlgorithm)) {
-                    throw new TypeError(`Invalid key for this operation, its RSA-PSS parameters do not meet the requirements of "alg" ${alg}`);
-                }
-                if (saltLength !== undefined && saltLength > length >> 3) {
-                    throw new TypeError(`Invalid key for this operation, its RSA-PSS parameter saltLength does not meet the requirements of "alg" ${alg}`);
-                }
-            }
-            else if (key.asymmetricKeyType !== 'rsa') {
-                throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa or rsa-pss');
-            }
-            checkKeyLength(key, alg);
-            return { key, ...PSS };
-        case 'ES256':
-        case 'ES256K':
-        case 'ES384':
-        case 'ES512': {
-            if (key.asymmetricKeyType !== 'ec') {
-                throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be ec');
-            }
-            const actual = getNamedCurve(key);
-            const expected = ecCurveAlgMap.get(alg);
-            if (actual !== expected) {
-                throw new TypeError(`Invalid key curve for the algorithm, its curve must be ${expected}, got ${actual}`);
-            }
-            return { dsaEncoding: 'ieee-p1363', key };
-        }
-        default:
-            throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
-    }
-}
-
-function hmacDigest(alg) {
-    switch (alg) {
-        case 'HS256':
-            return 'sha256';
-        case 'HS384':
-            return 'sha384';
-        case 'HS512':
-            return 'sha512';
-        default:
-            throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
-    }
-}
-
-function getSignVerifyKey(alg, key, usage) {
-    if (key instanceof Uint8Array) {
-        if (!alg.startsWith('HS')) {
-            throw new TypeError(invalidKeyInput(key, ...types));
-        }
-        return createSecretKey(key);
-    }
-    if (key instanceof KeyObject) {
-        return key;
-    }
-    if (isCryptoKey(key)) {
-        checkSigCryptoKey(key, alg, usage);
-        return KeyObject.from(key);
-    }
-    throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
-}
-
-const oneShotSign = promisify(crypto.sign);
-const sign = async (alg, key, data) => {
-    const keyObject = getSignVerifyKey(alg, key, 'sign');
-    if (alg.startsWith('HS')) {
-        const hmac = crypto.createHmac(hmacDigest(alg), keyObject);
-        hmac.update(data);
-        return hmac.digest();
-    }
-    return oneShotSign(dsaDigest(alg), data, keyForCrypto(alg, keyObject));
-};
-
-const oneShotVerify = promisify(crypto.verify);
-const verify = async (alg, key, signature, data) => {
-    const keyObject = getSignVerifyKey(alg, key, 'verify');
-    if (alg.startsWith('HS')) {
-        const expected = await sign(alg, keyObject, data);
-        const actual = signature;
-        try {
-            return crypto.timingSafeEqual(actual, expected);
-        }
-        catch {
-            return false;
-        }
-    }
-    const algorithm = dsaDigest(alg);
-    const keyInput = keyForCrypto(alg, keyObject);
-    try {
-        return await oneShotVerify(algorithm, data, keyInput, signature);
-    }
-    catch {
-        return false;
-    }
-};
-
-async function flattenedVerify(jws, key, options) {
-    if (!isObject(jws)) {
-        throw new JWSInvalid('Flattened JWS must be an object');
-    }
-    if (jws.protected === undefined && jws.header === undefined) {
-        throw new JWSInvalid('Flattened JWS must have either of the "protected" or "header" members');
-    }
-    if (jws.protected !== undefined && typeof jws.protected !== 'string') {
-        throw new JWSInvalid('JWS Protected Header incorrect type');
-    }
-    if (jws.payload === undefined) {
-        throw new JWSInvalid('JWS Payload missing');
-    }
-    if (typeof jws.signature !== 'string') {
-        throw new JWSInvalid('JWS Signature missing or incorrect type');
-    }
-    if (jws.header !== undefined && !isObject(jws.header)) {
-        throw new JWSInvalid('JWS Unprotected Header incorrect type');
-    }
-    let parsedProt = {};
-    if (jws.protected) {
-        try {
-            const protectedHeader = decode(jws.protected);
-            parsedProt = JSON.parse(decoder.decode(protectedHeader));
-        }
-        catch {
-            throw new JWSInvalid('JWS Protected Header is invalid');
-        }
-    }
-    if (!isDisjoint(parsedProt, jws.header)) {
-        throw new JWSInvalid('JWS Protected and JWS Unprotected Header Parameter names must be disjoint');
-    }
-    const joseHeader = {
-        ...parsedProt,
-        ...jws.header,
-    };
-    const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options?.crit, parsedProt, joseHeader);
-    let b64 = true;
-    if (extensions.has('b64')) {
-        b64 = parsedProt.b64;
-        if (typeof b64 !== 'boolean') {
-            throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
-        }
-    }
-    const { alg } = joseHeader;
-    if (typeof alg !== 'string' || !alg) {
-        throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
-    }
-    const algorithms = options && validateAlgorithms('algorithms', options.algorithms);
-    if (algorithms && !algorithms.has(alg)) {
-        throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
-    }
-    if (b64) {
-        if (typeof jws.payload !== 'string') {
-            throw new JWSInvalid('JWS Payload must be a string');
-        }
-    }
-    else if (typeof jws.payload !== 'string' && !(jws.payload instanceof Uint8Array)) {
-        throw new JWSInvalid('JWS Payload must be a string or an Uint8Array instance');
-    }
-    let resolvedKey = false;
-    if (typeof key === 'function') {
-        key = await key(parsedProt, jws);
-        resolvedKey = true;
-    }
-    checkKeyType(alg, key, 'verify');
-    const data = concat(encoder.encode(jws.protected ?? ''), encoder.encode('.'), typeof jws.payload === 'string' ? encoder.encode(jws.payload) : jws.payload);
-    let signature;
-    try {
-        signature = decode(jws.signature);
-    }
-    catch {
-        throw new JWSInvalid('Failed to base64url decode the signature');
-    }
-    const verified = await verify(alg, key, signature, data);
-    if (!verified) {
-        throw new JWSSignatureVerificationFailed();
-    }
-    let payload;
-    if (b64) {
-        try {
-            payload = decode(jws.payload);
-        }
-        catch {
-            throw new JWSInvalid('Failed to base64url decode the payload');
-        }
-    }
-    else if (typeof jws.payload === 'string') {
-        payload = encoder.encode(jws.payload);
-    }
-    else {
-        payload = jws.payload;
-    }
-    const result = { payload };
-    if (jws.protected !== undefined) {
-        result.protectedHeader = parsedProt;
-    }
-    if (jws.header !== undefined) {
-        result.unprotectedHeader = jws.header;
-    }
-    if (resolvedKey) {
-        return { ...result, key };
-    }
-    return result;
-}
-
-async function compactVerify(jws, key, options) {
-    if (jws instanceof Uint8Array) {
-        jws = decoder.decode(jws);
-    }
-    if (typeof jws !== 'string') {
-        throw new JWSInvalid('Compact JWS must be a string or Uint8Array');
-    }
-    const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split('.');
-    if (length !== 3) {
-        throw new JWSInvalid('Invalid Compact JWS');
-    }
-    const verified = await flattenedVerify({ payload, protected: protectedHeader, signature }, key, options);
-    const result = { payload: verified.payload, protectedHeader: verified.protectedHeader };
-    if (typeof key === 'function') {
-        return { ...result, key: verified.key };
-    }
-    return result;
-}
-
-var epoch = (date) => Math.floor(date.getTime() / 1000);
-
-const minute = 60;
-const hour = minute * 60;
-const day = hour * 24;
-const week = day * 7;
-const year = day * 365.25;
-const REGEX = /^(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)$/i;
-var secs = (str) => {
-    const matched = REGEX.exec(str);
-    if (!matched) {
-        throw new TypeError('Invalid time period format');
-    }
-    const value = parseFloat(matched[1]);
-    const unit = matched[2].toLowerCase();
-    switch (unit) {
-        case 'sec':
-        case 'secs':
-        case 'second':
-        case 'seconds':
-        case 's':
-            return Math.round(value);
-        case 'minute':
-        case 'minutes':
-        case 'min':
-        case 'mins':
-        case 'm':
-            return Math.round(value * minute);
-        case 'hour':
-        case 'hours':
-        case 'hr':
-        case 'hrs':
-        case 'h':
-            return Math.round(value * hour);
-        case 'day':
-        case 'days':
-        case 'd':
-            return Math.round(value * day);
-        case 'week':
-        case 'weeks':
-        case 'w':
-            return Math.round(value * week);
-        default:
-            return Math.round(value * year);
-    }
-};
-
-const normalizeTyp = (value) => value.toLowerCase().replace(/^application\//, '');
-const checkAudiencePresence = (audPayload, audOption) => {
-    if (typeof audPayload === 'string') {
-        return audOption.includes(audPayload);
-    }
-    if (Array.isArray(audPayload)) {
-        return audOption.some(Set.prototype.has.bind(new Set(audPayload)));
-    }
-    return false;
-};
-var jwtPayload = (protectedHeader, encodedPayload, options = {}) => {
-    const { typ } = options;
-    if (typ &&
-        (typeof protectedHeader.typ !== 'string' ||
-            normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
-        throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', 'typ', 'check_failed');
-    }
-    let payload;
-    try {
-        payload = JSON.parse(decoder.decode(encodedPayload));
-    }
-    catch {
-    }
-    if (!isObject(payload)) {
-        throw new JWTInvalid('JWT Claims Set must be a top-level JSON object');
-    }
-    const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
-    if (maxTokenAge !== undefined)
-        requiredClaims.push('iat');
-    if (audience !== undefined)
-        requiredClaims.push('aud');
-    if (subject !== undefined)
-        requiredClaims.push('sub');
-    if (issuer !== undefined)
-        requiredClaims.push('iss');
-    for (const claim of new Set(requiredClaims.reverse())) {
-        if (!(claim in payload)) {
-            throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, claim, 'missing');
-        }
-    }
-    if (issuer && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {
-        throw new JWTClaimValidationFailed('unexpected "iss" claim value', 'iss', 'check_failed');
-    }
-    if (subject && payload.sub !== subject) {
-        throw new JWTClaimValidationFailed('unexpected "sub" claim value', 'sub', 'check_failed');
-    }
-    if (audience &&
-        !checkAudiencePresence(payload.aud, typeof audience === 'string' ? [audience] : audience)) {
-        throw new JWTClaimValidationFailed('unexpected "aud" claim value', 'aud', 'check_failed');
-    }
-    let tolerance;
-    switch (typeof options.clockTolerance) {
-        case 'string':
-            tolerance = secs(options.clockTolerance);
-            break;
-        case 'number':
-            tolerance = options.clockTolerance;
-            break;
-        case 'undefined':
-            tolerance = 0;
-            break;
-        default:
-            throw new TypeError('Invalid clockTolerance option type');
-    }
-    const { currentDate } = options;
-    const now = epoch(currentDate || new Date());
-    if ((payload.iat !== undefined || maxTokenAge) && typeof payload.iat !== 'number') {
-        throw new JWTClaimValidationFailed('"iat" claim must be a number', 'iat', 'invalid');
-    }
-    if (payload.nbf !== undefined) {
-        if (typeof payload.nbf !== 'number') {
-            throw new JWTClaimValidationFailed('"nbf" claim must be a number', 'nbf', 'invalid');
-        }
-        if (payload.nbf > now + tolerance) {
-            throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', 'nbf', 'check_failed');
-        }
-    }
-    if (payload.exp !== undefined) {
-        if (typeof payload.exp !== 'number') {
-            throw new JWTClaimValidationFailed('"exp" claim must be a number', 'exp', 'invalid');
-        }
-        if (payload.exp <= now - tolerance) {
-            throw new JWTExpired('"exp" claim timestamp check failed', 'exp', 'check_failed');
-        }
-    }
-    if (maxTokenAge) {
-        const age = now - payload.iat;
-        const max = typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge);
-        if (age - tolerance > max) {
-            throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', 'iat', 'check_failed');
-        }
-        if (age < 0 - tolerance) {
-            throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', 'iat', 'check_failed');
-        }
-    }
-    return payload;
-};
-
-async function jwtVerify(jwt, key, options) {
-    const verified = await compactVerify(jwt, key, options);
-    if (verified.protectedHeader.crit?.includes('b64') && verified.protectedHeader.b64 === false) {
-        throw new JWTInvalid('JWTs MUST NOT use unencoded payload');
-    }
-    const payload = jwtPayload(verified.protectedHeader, verified.payload, options);
-    const result = { payload, protectedHeader: verified.protectedHeader };
-    if (typeof key === 'function') {
-        return { ...result, key: verified.key };
-    }
-    return result;
-}
-
-function getKtyFromAlg(alg) {
-    switch (typeof alg === 'string' && alg.slice(0, 2)) {
-        case 'RS':
-        case 'PS':
-            return 'RSA';
-        case 'ES':
-            return 'EC';
-        case 'Ed':
-            return 'OKP';
-        default:
-            throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
-    }
-}
-function isJWKSLike(jwks) {
-    return (jwks &&
-        typeof jwks === 'object' &&
-        Array.isArray(jwks.keys) &&
-        jwks.keys.every(isJWKLike));
-}
-function isJWKLike(key) {
-    return isObject(key);
-}
-function clone(obj) {
-    if (typeof structuredClone === 'function') {
-        return structuredClone(obj);
-    }
-    return JSON.parse(JSON.stringify(obj));
-}
-class LocalJWKSet {
-    _jwks;
-    _cached = new WeakMap();
-    constructor(jwks) {
-        if (!isJWKSLike(jwks)) {
-            throw new JWKSInvalid('JSON Web Key Set malformed');
-        }
-        this._jwks = clone(jwks);
-    }
-    async getKey(protectedHeader, token) {
-        const { alg, kid } = { ...protectedHeader, ...token?.header };
-        const kty = getKtyFromAlg(alg);
-        const candidates = this._jwks.keys.filter((jwk) => {
-            let candidate = kty === jwk.kty;
-            if (candidate && typeof kid === 'string') {
-                candidate = kid === jwk.kid;
-            }
-            if (candidate && typeof jwk.alg === 'string') {
-                candidate = alg === jwk.alg;
-            }
-            if (candidate && typeof jwk.use === 'string') {
-                candidate = jwk.use === 'sig';
-            }
-            if (candidate && Array.isArray(jwk.key_ops)) {
-                candidate = jwk.key_ops.includes('verify');
-            }
-            if (candidate && alg === 'EdDSA') {
-                candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
-            }
-            if (candidate) {
-                switch (alg) {
-                    case 'ES256':
-                        candidate = jwk.crv === 'P-256';
-                        break;
-                    case 'ES256K':
-                        candidate = jwk.crv === 'secp256k1';
-                        break;
-                    case 'ES384':
-                        candidate = jwk.crv === 'P-384';
-                        break;
-                    case 'ES512':
-                        candidate = jwk.crv === 'P-521';
-                        break;
-                }
-            }
-            return candidate;
-        });
-        const { 0: jwk, length } = candidates;
-        if (length === 0) {
-            throw new JWKSNoMatchingKey();
-        }
-        else if (length !== 1) {
-            const error = new JWKSMultipleMatchingKeys();
-            const { _cached } = this;
-            error[Symbol.asyncIterator] = async function* () {
-                for (const jwk of candidates) {
-                    try {
-                        yield await importWithAlgCache(_cached, jwk, alg);
-                    }
-                    catch {
-                        continue;
-                    }
-                }
-            };
-            throw error;
-        }
-        return importWithAlgCache(this._cached, jwk, alg);
-    }
-}
-async function importWithAlgCache(cache, jwk, alg) {
-    const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk);
-    if (cached[alg] === undefined) {
-        const key = await importJWK({ ...jwk, ext: true }, alg);
-        if (key instanceof Uint8Array || key.type !== 'public') {
-            throw new JWKSInvalid('JSON Web Key Set members must be public keys');
-        }
-        cached[alg] = key;
-    }
-    return cached[alg];
-}
-
-const fetchJwks = async (url, timeout, options) => {
-    let get;
-    switch (url.protocol) {
-        case 'https:':
-            get = https.get;
-            break;
-        case 'http:':
-            get = http.get;
-            break;
-        default:
-            throw new TypeError('Unsupported URL protocol.');
-    }
-    const { agent, headers } = options;
-    const req = get(url.href, {
-        agent,
-        timeout,
-        headers,
-    });
-    const [response] = (await Promise.race([once(req, 'response'), once(req, 'timeout')]));
-    if (!response) {
-        req.destroy();
-        throw new JWKSTimeout();
-    }
-    if (response.statusCode !== 200) {
-        throw new JOSEError('Expected 200 OK from the JSON Web Key Set HTTP response');
-    }
-    const parts = [];
-    for await (const part of response) {
-        parts.push(part);
-    }
-    try {
-        return JSON.parse(decoder.decode(concat(...parts)));
-    }
-    catch {
-        throw new JOSEError('Failed to parse the JSON Web Key Set HTTP response as JSON');
-    }
-};
-
-function isCloudflareWorkers() {
-    return (typeof WebSocketPair !== 'undefined' ||
-        (typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers') ||
-        (typeof EdgeRuntime !== 'undefined' && EdgeRuntime === 'vercel'));
-}
-class RemoteJWKSet extends LocalJWKSet {
-    _url;
-    _timeoutDuration;
-    _cooldownDuration;
-    _cacheMaxAge;
-    _jwksTimestamp;
-    _pendingFetch;
-    _options;
-    constructor(url, options) {
-        super({ keys: [] });
-        this._jwks = undefined;
-        if (!(url instanceof URL)) {
-            throw new TypeError('url must be an instance of URL');
-        }
-        this._url = new URL(url.href);
-        this._options = { agent: options?.agent, headers: options?.headers };
-        this._timeoutDuration =
-            typeof options?.timeoutDuration === 'number' ? options?.timeoutDuration : 5000;
-        this._cooldownDuration =
-            typeof options?.cooldownDuration === 'number' ? options?.cooldownDuration : 30000;
-        this._cacheMaxAge = typeof options?.cacheMaxAge === 'number' ? options?.cacheMaxAge : 600000;
-    }
-    coolingDown() {
-        return typeof this._jwksTimestamp === 'number'
-            ? Date.now() < this._jwksTimestamp + this._cooldownDuration
-            : false;
-    }
-    fresh() {
-        return typeof this._jwksTimestamp === 'number'
-            ? Date.now() < this._jwksTimestamp + this._cacheMaxAge
-            : false;
-    }
-    async getKey(protectedHeader, token) {
-        if (!this._jwks || !this.fresh()) {
-            await this.reload();
-        }
-        try {
-            return await super.getKey(protectedHeader, token);
-        }
-        catch (err) {
-            if (err instanceof JWKSNoMatchingKey) {
-                if (this.coolingDown() === false) {
-                    await this.reload();
-                    return super.getKey(protectedHeader, token);
-                }
-            }
-            throw err;
-        }
-    }
-    async reload() {
-        if (this._pendingFetch && isCloudflareWorkers()) {
-            this._pendingFetch = undefined;
-        }
-        this._pendingFetch ||= fetchJwks(this._url, this._timeoutDuration, this._options)
-            .then((json) => {
-            if (!isJWKSLike(json)) {
-                throw new JWKSInvalid('JSON Web Key Set malformed');
-            }
-            this._jwks = { keys: json.keys };
-            this._jwksTimestamp = Date.now();
-            this._pendingFetch = undefined;
-        })
-            .catch((err) => {
-            this._pendingFetch = undefined;
-            throw err;
-        });
-        await this._pendingFetch;
-    }
-}
-function createRemoteJWKSet(url, options) {
-    const set = new RemoteJWKSet(url, options);
-    return async function (protectedHeader, token) {
-        return set.getKey(protectedHeader, token);
-    };
-}
-
-// https://appleid.apple.com/.well-known/openid-configuration
-const issuer = 'https://appleid.apple.com';
-const authorizationEndpoint = `${issuer}/auth/authorize`;
-const jwksUri = `${issuer}/auth/keys`;
-const defaultMetadata = {
-    id: 'apple-universal',
-    target: 'apple',
-    platform: ConnectorPlatform.Universal,
-    name: {
-        en: 'Apple',
-        'zh-CN': 'Apple',
-        'tr-TR': 'Apple',
-        ko: 'Apple',
-    },
-    logo: './logo.svg',
-    logoDark: './logo-dark.svg',
-    description: {
-        en: 'Apple is a multinational high-end provider of hardware and software.',
-        'zh-CN': 'Apple 是全球领先的高端消费者软硬件提供商。',
-        'tr-TR': 'Apple, çok uluslu bir üst düzey donanım ve yazılım sağlayıcısıdır.',
-        ko: 'Apple은 하드웨어와 소프트웨어의 다국적 공급자 입니다.',
+// src/index.ts
+import { assert } from "@silverhand/essentials";
+import {
+  ConnectorError,
+  ConnectorErrorCodes,
+  validateConfig,
+  ConnectorType,
+  jsonGuard
+} from "@logto/connector-kit";
+import { generateStandardId } from "@logto/shared/universal";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+
+// src/constant.ts
+import { ConnectorPlatform, ConnectorConfigFormItemType } from "@logto/connector-kit";
+var issuer = "https://appleid.apple.com";
+var authorizationEndpoint = `${issuer}/auth/authorize`;
+var accessTokenEndpoint = `${issuer}/auth/token`;
+var jwksUri = `${issuer}/auth/keys`;
+var defaultMetadata = {
+  id: "apple-universal",
+  target: "apple",
+  platform: ConnectorPlatform.Universal,
+  name: {
+    en: "Apple",
+    "zh-CN": "Apple",
+    "tr-TR": "Apple",
+    ko: "Apple"
+  },
+  logo: "./logo.svg",
+  logoDark: "./logo-dark.svg",
+  description: {
+    en: "Apple is a multinational high-end provider of hardware and software.",
+    "zh-CN": "Apple \u662F\u5168\u7403\u9886\u5148\u7684\u9AD8\u7AEF\u6D88\u8D39\u8005\u8F6F\u786C\u4EF6\u63D0\u4F9B\u5546\u3002",
+    "tr-TR": "Apple, \xE7ok uluslu bir \xFCst d\xFCzey donan\u0131m ve yaz\u0131l\u0131m sa\u011Flay\u0131c\u0131s\u0131d\u0131r.",
+    ko: "Apple\uC740 \uD558\uB4DC\uC6E8\uC5B4\uC640 \uC18C\uD504\uD2B8\uC6E8\uC5B4\uC758 \uB2E4\uAD6D\uC801 \uACF5\uAE09\uC790 \uC785\uB2C8\uB2E4."
+  },
+  readme: "./README.md",
+  formItems: [
+    {
+      key: "clientId",
+      type: ConnectorConfigFormItemType.Text,
+      required: true,
+      label: "Identifier",
+      placeholder: "<your-registered-identifier>"
     },
-    readme: './README.md',
-    formItems: [
-        {
-            key: 'clientId',
-            type: ConnectorConfigFormItemType.Text,
-            required: true,
-            label: 'Identifier',
-            placeholder: '<your-registered-identifier>',
-        },
-        {
-            key: 'scope',
-            type: ConnectorConfigFormItemType.Text,
-            required: false,
-            label: 'Scope',
-            placeholder: 'email name',
-        },
-    ],
+    {
+      key: "scope",
+      type: ConnectorConfigFormItemType.Text,
+      required: false,
+      label: "Scope",
+      placeholder: "email name"
+    }
+  ]
 };
 
-const appleConfigGuard = z.object({
-    clientId: z.string(),
-    scope: z.string().optional(),
+// src/types.ts
+import { z } from "zod";
+var appleConfigGuard = z.object({
+  clientId: z.string(),
+  scope: z.string().optional()
 });
-const stringToJson = () => z.string().transform((value, ctx) => {
-    try {
-        // eslint-disable-next-line @typescript-eslint/no-unsafe-return
-        return JSON.parse(value);
-    }
-    catch {
-        ctx.addIssue({ code: 'custom', message: 'Invalid JSON' });
-        return z.NEVER;
-    }
+var stringToJson = () => z.string().transform((value, ctx) => {
+  try {
+    return JSON.parse(value);
+  } catch {
+    ctx.addIssue({ code: "custom", message: "Invalid JSON" });
+    return z.NEVER;
+  }
 });
-// https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js/configuring_your_webpage_for_sign_in_with_apple#3331292
-// https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js/incorporating_sign_in_with_apple_into_other_platforms#3332113
-const dataGuard = z.object({
-    id_token: z.string(),
-    user: stringToJson()
-        .pipe(z
-        .object({
-        name: z
-            .object({
-            firstName: z.string(),
-            lastName: z.string(),
-        })
-            .partial(),
-        email: z.string(),
-    })
-        .partial())
-        .optional(),
+var dataGuard = z.object({
+  id_token: z.string(),
+  user: stringToJson().pipe(
+    z.object({
+      name: z.object({
+        firstName: z.string(),
+        lastName: z.string()
+      }).partial(),
+      email: z.string()
+    }).partial()
+  ).optional()
 });
 
-const generateNonce = () => generateStandardId();
-const getAuthorizationUri = (getConfig) => async ({ state, redirectUri }, setSession) => {
-    const config = await getConfig(defaultMetadata.id);
-    validateConfig(config, appleConfigGuard);
-    const nonce = generateNonce();
-    const queryParameters = new URLSearchParams({
-        client_id: config.clientId,
-        redirect_uri: redirectUri,
-        scope: config.scope ?? '',
-        state,
-        nonce,
-        // https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js/incorporating_sign_in_with_apple_into_other_platforms#3332113
-        response_type: 'code id_token',
-        response_mode: 'form_post',
+// src/index.ts
+var generateNonce = () => generateStandardId();
+var getAuthorizationUri = (getConfig) => async ({ state, redirectUri }, setSession) => {
+  const config = await getConfig(defaultMetadata.id);
+  validateConfig(config, appleConfigGuard);
+  const nonce = generateNonce();
+  const queryParameters = new URLSearchParams({
+    client_id: config.clientId,
+    redirect_uri: redirectUri,
+    scope: config.scope ?? "",
+    state,
+    nonce,
+    // https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js/incorporating_sign_in_with_apple_into_other_platforms#3332113
+    response_type: "code id_token",
+    response_mode: "form_post"
+  });
+  assert(
+    setSession,
+    new ConnectorError(ConnectorErrorCodes.NotImplemented, {
+      message: "'setSession' is not implemented."
+    })
+  );
+  await setSession({ nonce });
+  return `${authorizationEndpoint}?${queryParameters.toString()}`;
+};
+var getUserInfo = (getConfig) => async (data, getSession) => {
+  const { id_token: idToken, user } = await authorizationCallbackHandler(data);
+  if (!idToken) {
+    throw new ConnectorError(ConnectorErrorCodes.SocialIdTokenInvalid);
+  }
+  const config = await getConfig(defaultMetadata.id);
+  validateConfig(config, appleConfigGuard);
+  const { clientId } = config;
+  try {
+    const { payload } = await jwtVerify(idToken, createRemoteJWKSet(new URL(jwksUri)), {
+      issuer,
+      audience: clientId
     });
-    assert(setSession, new ConnectorError(ConnectorErrorCodes.NotImplemented, {
-        message: "'setSession' is not implemented.",
-    }));
-    await setSession({ nonce });
-    return `${authorizationEndpoint}?${queryParameters.toString()}`;
-};
-const getUserInfo = (getConfig) => async (data, getSession) => {
-    const { id_token: idToken, user } = await authorizationCallbackHandler(data);
-    if (!idToken) {
-        throw new ConnectorError(ConnectorErrorCodes.SocialIdTokenInvalid);
-    }
-    const config = await getConfig(defaultMetadata.id);
-    validateConfig(config, appleConfigGuard);
-    const { clientId } = config;
-    try {
-        const { payload } = await jwtVerify(idToken, createRemoteJWKSet(new URL(jwksUri)), {
-            issuer,
-            audience: clientId,
-        });
-        if (payload.nonce) {
-            // TODO @darcy: need to specify error code
-            assert(getSession, new ConnectorError(ConnectorErrorCodes.NotImplemented, {
-                message: "'getSession' is not implemented.",
-            }));
-            const { nonce: validationNonce } = await getSession();
-            assert(validationNonce, new ConnectorError(ConnectorErrorCodes.General, {
-                message: "'nonce' not presented in session storage.",
-            }));
-            assert(validationNonce === payload.nonce, new ConnectorError(ConnectorErrorCodes.SocialIdTokenInvalid, {
-                message: "IdToken validation failed due to 'nonce' mismatch.",
-            }));
-        }
-        if (!payload.sub) {
-            throw new ConnectorError(ConnectorErrorCodes.SocialIdTokenInvalid);
-        }
-        return {
-            id: payload.sub,
-            // The `user` object is only available at the first sign-in. Didn't find this in Apple's
-            // docs but it seems to be the case. Fallback to the `email` field in the ID token just in
-            // case.
-            // See desperate developer discussion here:
-            // https://forums.developer.apple.com/forums/thread/132223
-            email: user?.email ??
-                (payload.email && payload.email_verified === true ? String(payload.email) : undefined),
-            name: [user?.name?.firstName, user?.name?.lastName].filter(Boolean).join(' ') || undefined,
-            rawData: jsonGuard.parse(data),
-        };
-    }
-    catch {
-        throw new ConnectorError(ConnectorErrorCodes.SocialIdTokenInvalid);
+    if (payload.nonce) {
+      assert(
+        getSession,
+        new ConnectorError(ConnectorErrorCodes.NotImplemented, {
+          message: "'getSession' is not implemented."
+        })
+      );
+      const { nonce: validationNonce } = await getSession();
+      assert(
+        validationNonce,
+        new ConnectorError(ConnectorErrorCodes.General, {
+          message: "'nonce' not presented in session storage."
+        })
+      );
+      assert(
+        validationNonce === payload.nonce,
+        new ConnectorError(ConnectorErrorCodes.SocialIdTokenInvalid, {
+          message: "IdToken validation failed due to 'nonce' mismatch."
+        })
+      );
     }
-};
-const authorizationCallbackHandler = async (parameterObject) => {
-    const result = dataGuard.safeParse(parameterObject);
-    if (!result.success) {
-        throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(parameterObject));
+    if (!payload.sub) {
+      throw new ConnectorError(ConnectorErrorCodes.SocialIdTokenInvalid);
     }
-    return result.data;
-};
-const createAppleConnector = async ({ getConfig }) => {
     return {
-        metadata: defaultMetadata,
-        type: ConnectorType.Social,
-        configGuard: appleConfigGuard,
-        getAuthorizationUri: getAuthorizationUri(getConfig),
-        getUserInfo: getUserInfo(getConfig),
+      id: payload.sub,
+      // The `user` object is only available at the first sign-in. Didn't find this in Apple's
+      // docs but it seems to be the case. Fallback to the `email` field in the ID token just in
+      // case.
+      // See desperate developer discussion here:
+      // https://forums.developer.apple.com/forums/thread/132223
+      email: user?.email ?? (payload.email && payload.email_verified === true ? String(payload.email) : void 0),
+      name: [user?.name?.firstName, user?.name?.lastName].filter(Boolean).join(" ") || void 0,
+      rawData: jsonGuard.parse(data)
     };
+  } catch {
+    throw new ConnectorError(ConnectorErrorCodes.SocialIdTokenInvalid);
+  }
 };
-
-export { createAppleConnector as default };
+var authorizationCallbackHandler = async (parameterObject) => {
+  const result = dataGuard.safeParse(parameterObject);
+  if (!result.success) {
+    throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(parameterObject));
+  }
+  return result.data;
+};
+var createAppleConnector = async ({ getConfig }) => {
+  return {
+    metadata: defaultMetadata,
+    type: ConnectorType.Social,
+    configGuard: appleConfigGuard,
+    getAuthorizationUri: getAuthorizationUri(getConfig),
+    getUserInfo: getUserInfo(getConfig)
+  };
+};
+var src_default = createAppleConnector;
+export {
+  src_default as default
+};
+//# sourceMappingURL=index.js.map