@logto/connector-google 1.4.0 → 1.6.0

package/lib/index.js

@@ -1,1399 +1,223 @@
-import { got, HTTPError } from 'got';
-import { GoogleConnector, ConnectorPlatform, ConnectorConfigFormItemType, OidcPrompt, parseJson, ConnectorError, ConnectorErrorCodes, ConnectorType, validateConfig } from '@logto/connector-kit';
-import { z } from 'zod';
-import { Buffer } from 'node:buffer';
-import * as crypto from 'node:crypto';
-import { KeyObject, createPrivateKey, createPublicKey, constants, createSecretKey } from 'node:crypto';
-import * as util from 'node:util';
-import { promisify } from 'node:util';
-import * as http from 'node:http';
-import * as https from 'node:https';
-import { once } from 'node:events';
-
-// https://github.com/facebook/jest/issues/7547
-const assert = (value, error) => {
-    if (!value) {
-        // https://github.com/typescript-eslint/typescript-eslint/issues/3814
-        // eslint-disable-next-line @typescript-eslint/no-throw-literal
-        throw error;
-    }
-};
-
-// eslint-disable-next-line id-length
-// eslint-disable-next-line unicorn/prefer-native-coercion-functions
-const notFalsy = (value) => Boolean(value);
-
-/**
- * Conditional return the expression result when it's not {@link Falsy};
- * otherwise return `undefined`.
- *
- * @example
- * ```ts
- * conditional(1 && '2') // '2'
- * conditional(false && '1') // undefined
- * ```
- */
-const conditional = (exp) => (notFalsy(exp) ? exp : undefined);
-
-const encoder = new TextEncoder();
-const decoder = new TextDecoder();
-function concat(...buffers) {
-    const size = buffers.reduce((acc, { length }) => acc + length, 0);
-    const buf = new Uint8Array(size);
-    let i = 0;
-    for (const buffer of buffers) {
-        buf.set(buffer, i);
-        i += buffer.length;
-    }
-    return buf;
-}
-
-function normalize(input) {
-    let encoded = input;
-    if (encoded instanceof Uint8Array) {
-        encoded = decoder.decode(encoded);
-    }
-    return encoded;
-}
-const decode = (input) => new Uint8Array(Buffer.from(normalize(input), 'base64'));
-
-class JOSEError extends Error {
-    static get code() {
-        return 'ERR_JOSE_GENERIC';
-    }
-    code = 'ERR_JOSE_GENERIC';
-    constructor(message) {
-        super(message);
-        this.name = this.constructor.name;
-        Error.captureStackTrace?.(this, this.constructor);
-    }
-}
-class JWTClaimValidationFailed extends JOSEError {
-    static get code() {
-        return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
-    }
-    code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
-    claim;
-    reason;
-    constructor(message, claim = 'unspecified', reason = 'unspecified') {
-        super(message);
-        this.claim = claim;
-        this.reason = reason;
-    }
-}
-class JWTExpired extends JOSEError {
-    static get code() {
-        return 'ERR_JWT_EXPIRED';
-    }
-    code = 'ERR_JWT_EXPIRED';
-    claim;
-    reason;
-    constructor(message, claim = 'unspecified', reason = 'unspecified') {
-        super(message);
-        this.claim = claim;
-        this.reason = reason;
-    }
-}
-class JOSEAlgNotAllowed extends JOSEError {
-    static get code() {
-        return 'ERR_JOSE_ALG_NOT_ALLOWED';
-    }
-    code = 'ERR_JOSE_ALG_NOT_ALLOWED';
-}
-class JOSENotSupported extends JOSEError {
-    static get code() {
-        return 'ERR_JOSE_NOT_SUPPORTED';
-    }
-    code = 'ERR_JOSE_NOT_SUPPORTED';
-}
-class JWSInvalid extends JOSEError {
-    static get code() {
-        return 'ERR_JWS_INVALID';
-    }
-    code = 'ERR_JWS_INVALID';
-}
-class JWTInvalid extends JOSEError {
-    static get code() {
-        return 'ERR_JWT_INVALID';
-    }
-    code = 'ERR_JWT_INVALID';
-}
-class JWKSInvalid extends JOSEError {
-    static get code() {
-        return 'ERR_JWKS_INVALID';
-    }
-    code = 'ERR_JWKS_INVALID';
-}
-class JWKSNoMatchingKey extends JOSEError {
-    static get code() {
-        return 'ERR_JWKS_NO_MATCHING_KEY';
-    }
-    code = 'ERR_JWKS_NO_MATCHING_KEY';
-    message = 'no applicable key found in the JSON Web Key Set';
-}
-class JWKSMultipleMatchingKeys extends JOSEError {
-    [Symbol.asyncIterator];
-    static get code() {
-        return 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
-    }
-    code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
-    message = 'multiple matching keys found in the JSON Web Key Set';
-}
-class JWKSTimeout extends JOSEError {
-    static get code() {
-        return 'ERR_JWKS_TIMEOUT';
-    }
-    code = 'ERR_JWKS_TIMEOUT';
-    message = 'request timed out';
-}
-class JWSSignatureVerificationFailed extends JOSEError {
-    static get code() {
-        return 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
-    }
-    code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
-    message = 'signature verification failed';
-}
-
-var isKeyObject = (obj) => util.types.isKeyObject(obj);
-
-const webcrypto = crypto.webcrypto;
-const isCryptoKey = (key) => util.types.isCryptoKey(key);
-
-function unusable(name, prop = 'algorithm.name') {
-    return new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
-}
-function isAlgorithm(algorithm, name) {
-    return algorithm.name === name;
-}
-function getHashLength(hash) {
-    return parseInt(hash.name.slice(4), 10);
-}
-function getNamedCurve$1(alg) {
-    switch (alg) {
-        case 'ES256':
-            return 'P-256';
-        case 'ES384':
-            return 'P-384';
-        case 'ES512':
-            return 'P-521';
-        default:
-            throw new Error('unreachable');
-    }
-}
-function checkUsage(key, usages) {
-    if (usages.length && !usages.some((expected) => key.usages.includes(expected))) {
-        let msg = 'CryptoKey does not support this operation, its usages must include ';
-        if (usages.length > 2) {
-            const last = usages.pop();
-            msg += `one of ${usages.join(', ')}, or ${last}.`;
-        }
-        else if (usages.length === 2) {
-            msg += `one of ${usages[0]} or ${usages[1]}.`;
-        }
-        else {
-            msg += `${usages[0]}.`;
-        }
-        throw new TypeError(msg);
-    }
-}
-function checkSigCryptoKey(key, alg, ...usages) {
-    switch (alg) {
-        case 'HS256':
-        case 'HS384':
-        case 'HS512': {
-            if (!isAlgorithm(key.algorithm, 'HMAC'))
-                throw unusable('HMAC');
-            const expected = parseInt(alg.slice(2), 10);
-            const actual = getHashLength(key.algorithm.hash);
-            if (actual !== expected)
-                throw unusable(`SHA-${expected}`, 'algorithm.hash');
-            break;
-        }
-        case 'RS256':
-        case 'RS384':
-        case 'RS512': {
-            if (!isAlgorithm(key.algorithm, 'RSASSA-PKCS1-v1_5'))
-                throw unusable('RSASSA-PKCS1-v1_5');
-            const expected = parseInt(alg.slice(2), 10);
-            const actual = getHashLength(key.algorithm.hash);
-            if (actual !== expected)
-                throw unusable(`SHA-${expected}`, 'algorithm.hash');
-            break;
-        }
-        case 'PS256':
-        case 'PS384':
-        case 'PS512': {
-            if (!isAlgorithm(key.algorithm, 'RSA-PSS'))
-                throw unusable('RSA-PSS');
-            const expected = parseInt(alg.slice(2), 10);
-            const actual = getHashLength(key.algorithm.hash);
-            if (actual !== expected)
-                throw unusable(`SHA-${expected}`, 'algorithm.hash');
-            break;
-        }
-        case 'EdDSA': {
-            if (key.algorithm.name !== 'Ed25519' && key.algorithm.name !== 'Ed448') {
-                throw unusable('Ed25519 or Ed448');
-            }
-            break;
-        }
-        case 'ES256':
-        case 'ES384':
-        case 'ES512': {
-            if (!isAlgorithm(key.algorithm, 'ECDSA'))
-                throw unusable('ECDSA');
-            const expected = getNamedCurve$1(alg);
-            const actual = key.algorithm.namedCurve;
-            if (actual !== expected)
-                throw unusable(expected, 'algorithm.namedCurve');
-            break;
-        }
-        default:
-            throw new TypeError('CryptoKey does not support this operation');
-    }
-    checkUsage(key, usages);
-}
-
-function message(msg, actual, ...types) {
-    if (types.length > 2) {
-        const last = types.pop();
-        msg += `one of type ${types.join(', ')}, or ${last}.`;
-    }
-    else if (types.length === 2) {
-        msg += `one of type ${types[0]} or ${types[1]}.`;
-    }
-    else {
-        msg += `of type ${types[0]}.`;
-    }
-    if (actual == null) {
-        msg += ` Received ${actual}`;
-    }
-    else if (typeof actual === 'function' && actual.name) {
-        msg += ` Received function ${actual.name}`;
-    }
-    else if (typeof actual === 'object' && actual != null) {
-        if (actual.constructor?.name) {
-            msg += ` Received an instance of ${actual.constructor.name}`;
-        }
-    }
-    return msg;
-}
-var invalidKeyInput = (actual, ...types) => {
-    return message('Key must be ', actual, ...types);
-};
-function withAlg(alg, actual, ...types) {
-    return message(`Key for the ${alg} algorithm must be `, actual, ...types);
-}
-
-var isKeyLike = (key) => isKeyObject(key) || isCryptoKey(key);
-const types = ['KeyObject'];
-if (globalThis.CryptoKey || webcrypto?.CryptoKey) {
-    types.push('CryptoKey');
-}
-
-const isDisjoint = (...headers) => {
-    const sources = headers.filter(Boolean);
-    if (sources.length === 0 || sources.length === 1) {
-        return true;
-    }
-    let acc;
-    for (const header of sources) {
-        const parameters = Object.keys(header);
-        if (!acc || acc.size === 0) {
-            acc = new Set(parameters);
-            continue;
-        }
-        for (const parameter of parameters) {
-            if (acc.has(parameter)) {
-                return false;
-            }
-            acc.add(parameter);
-        }
-    }
-    return true;
-};
-
-function isObjectLike(value) {
-    return typeof value === 'object' && value !== null;
-}
-function isObject(input) {
-    if (!isObjectLike(input) || Object.prototype.toString.call(input) !== '[object Object]') {
-        return false;
-    }
-    if (Object.getPrototypeOf(input) === null) {
-        return true;
-    }
-    let proto = input;
-    while (Object.getPrototypeOf(proto) !== null) {
-        proto = Object.getPrototypeOf(proto);
-    }
-    return Object.getPrototypeOf(input) === proto;
-}
-
-const namedCurveToJOSE = (namedCurve) => {
-    switch (namedCurve) {
-        case 'prime256v1':
-            return 'P-256';
-        case 'secp384r1':
-            return 'P-384';
-        case 'secp521r1':
-            return 'P-521';
-        case 'secp256k1':
-            return 'secp256k1';
-        default:
-            throw new JOSENotSupported('Unsupported key curve for this operation');
-    }
-};
-const getNamedCurve = (kee, raw) => {
-    let key;
-    if (isCryptoKey(kee)) {
-        key = KeyObject.from(kee);
-    }
-    else if (isKeyObject(kee)) {
-        key = kee;
-    }
-    else {
-        throw new TypeError(invalidKeyInput(kee, ...types));
-    }
-    if (key.type === 'secret') {
-        throw new TypeError('only "private" or "public" type keys can be used for this operation');
-    }
-    switch (key.asymmetricKeyType) {
-        case 'ed25519':
-        case 'ed448':
-            return `Ed${key.asymmetricKeyType.slice(2)}`;
-        case 'x25519':
-        case 'x448':
-            return `X${key.asymmetricKeyType.slice(1)}`;
-        case 'ec': {
-            const namedCurve = key.asymmetricKeyDetails.namedCurve;
-            if (raw) {
-                return namedCurve;
-            }
-            return namedCurveToJOSE(namedCurve);
-        }
-        default:
-            throw new TypeError('Invalid asymmetric key type for this operation');
-    }
-};
-
-var checkKeyLength = (key, alg) => {
-    const { modulusLength } = key.asymmetricKeyDetails;
-    if (typeof modulusLength !== 'number' || modulusLength < 2048) {
-        throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
-    }
-};
-
-const parse = (jwk) => {
-    return (jwk.d ? createPrivateKey : createPublicKey)({ format: 'jwk', key: jwk });
-};
-
-async function importJWK(jwk, alg) {
-    if (!isObject(jwk)) {
-        throw new TypeError('JWK must be an object');
-    }
-    alg ||= jwk.alg;
-    switch (jwk.kty) {
-        case 'oct':
-            if (typeof jwk.k !== 'string' || !jwk.k) {
-                throw new TypeError('missing "k" (Key Value) Parameter value');
-            }
-            return decode(jwk.k);
-        case 'RSA':
-            if (jwk.oth !== undefined) {
-                throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
-            }
-        case 'EC':
-        case 'OKP':
-            return parse({ ...jwk, alg });
-        default:
-            throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
-    }
-}
-
-const symmetricTypeCheck = (alg, key) => {
-    if (key instanceof Uint8Array)
-        return;
-    if (!isKeyLike(key)) {
-        throw new TypeError(withAlg(alg, key, ...types, 'Uint8Array'));
-    }
-    if (key.type !== 'secret') {
-        throw new TypeError(`${types.join(' or ')} instances for symmetric algorithms must be of type "secret"`);
-    }
-};
-const asymmetricTypeCheck = (alg, key, usage) => {
-    if (!isKeyLike(key)) {
-        throw new TypeError(withAlg(alg, key, ...types));
-    }
-    if (key.type === 'secret') {
-        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithms must not be of type "secret"`);
-    }
-    if (usage === 'sign' && key.type === 'public') {
-        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithm signing must be of type "private"`);
-    }
-    if (usage === 'decrypt' && key.type === 'public') {
-        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithm decryption must be of type "private"`);
-    }
-    if (key.algorithm && usage === 'verify' && key.type === 'private') {
-        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithm verifying must be of type "public"`);
-    }
-    if (key.algorithm && usage === 'encrypt' && key.type === 'private') {
-        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithm encryption must be of type "public"`);
-    }
-};
-const checkKeyType = (alg, key, usage) => {
-    const symmetric = alg.startsWith('HS') ||
-        alg === 'dir' ||
-        alg.startsWith('PBES2') ||
-        /^A\d{3}(?:GCM)?KW$/.test(alg);
-    if (symmetric) {
-        symmetricTypeCheck(alg, key);
-    }
-    else {
-        asymmetricTypeCheck(alg, key, usage);
-    }
-};
-
-function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
-    if (joseHeader.crit !== undefined && protectedHeader?.crit === undefined) {
-        throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
-    }
-    if (!protectedHeader || protectedHeader.crit === undefined) {
-        return new Set();
-    }
-    if (!Array.isArray(protectedHeader.crit) ||
-        protectedHeader.crit.length === 0 ||
-        protectedHeader.crit.some((input) => typeof input !== 'string' || input.length === 0)) {
-        throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
-    }
-    let recognized;
-    if (recognizedOption !== undefined) {
-        recognized = new Map([...Object.entries(recognizedOption), ...recognizedDefault.entries()]);
-    }
-    else {
-        recognized = recognizedDefault;
-    }
-    for (const parameter of protectedHeader.crit) {
-        if (!recognized.has(parameter)) {
-            throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
-        }
-        if (joseHeader[parameter] === undefined) {
-            throw new Err(`Extension Header Parameter "${parameter}" is missing`);
-        }
-        if (recognized.get(parameter) && protectedHeader[parameter] === undefined) {
-            throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
-        }
-    }
-    return new Set(protectedHeader.crit);
-}
-
-const validateAlgorithms = (option, algorithms) => {
-    if (algorithms !== undefined &&
-        (!Array.isArray(algorithms) || algorithms.some((s) => typeof s !== 'string'))) {
-        throw new TypeError(`"${option}" option must be an array of strings`);
-    }
-    if (!algorithms) {
-        return undefined;
-    }
-    return new Set(algorithms);
-};
-
-function dsaDigest(alg) {
-    switch (alg) {
-        case 'PS256':
-        case 'RS256':
-        case 'ES256':
-        case 'ES256K':
-            return 'sha256';
-        case 'PS384':
-        case 'RS384':
-        case 'ES384':
-            return 'sha384';
-        case 'PS512':
-        case 'RS512':
-        case 'ES512':
-            return 'sha512';
-        case 'EdDSA':
-            return undefined;
-        default:
-            throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
-    }
-}
-
-const PSS = {
-    padding: constants.RSA_PKCS1_PSS_PADDING,
-    saltLength: constants.RSA_PSS_SALTLEN_DIGEST,
-};
-const ecCurveAlgMap = new Map([
-    ['ES256', 'P-256'],
-    ['ES256K', 'secp256k1'],
-    ['ES384', 'P-384'],
-    ['ES512', 'P-521'],
-]);
-function keyForCrypto(alg, key) {
-    switch (alg) {
-        case 'EdDSA':
-            if (!['ed25519', 'ed448'].includes(key.asymmetricKeyType)) {
-                throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be ed25519 or ed448');
-            }
-            return key;
-        case 'RS256':
-        case 'RS384':
-        case 'RS512':
-            if (key.asymmetricKeyType !== 'rsa') {
-                throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa');
-            }
-            checkKeyLength(key, alg);
-            return key;
-        case 'PS256':
-        case 'PS384':
-        case 'PS512':
-            if (key.asymmetricKeyType === 'rsa-pss') {
-                const { hashAlgorithm, mgf1HashAlgorithm, saltLength } = key.asymmetricKeyDetails;
-                const length = parseInt(alg.slice(-3), 10);
-                if (hashAlgorithm !== undefined &&
-                    (hashAlgorithm !== `sha${length}` || mgf1HashAlgorithm !== hashAlgorithm)) {
-                    throw new TypeError(`Invalid key for this operation, its RSA-PSS parameters do not meet the requirements of "alg" ${alg}`);
-                }
-                if (saltLength !== undefined && saltLength > length >> 3) {
-                    throw new TypeError(`Invalid key for this operation, its RSA-PSS parameter saltLength does not meet the requirements of "alg" ${alg}`);
-                }
-            }
-            else if (key.asymmetricKeyType !== 'rsa') {
-                throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa or rsa-pss');
-            }
-            checkKeyLength(key, alg);
-            return { key, ...PSS };
-        case 'ES256':
-        case 'ES256K':
-        case 'ES384':
-        case 'ES512': {
-            if (key.asymmetricKeyType !== 'ec') {
-                throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be ec');
-            }
-            const actual = getNamedCurve(key);
-            const expected = ecCurveAlgMap.get(alg);
-            if (actual !== expected) {
-                throw new TypeError(`Invalid key curve for the algorithm, its curve must be ${expected}, got ${actual}`);
-            }
-            return { dsaEncoding: 'ieee-p1363', key };
-        }
-        default:
-            throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
-    }
-}
-
-function hmacDigest(alg) {
-    switch (alg) {
-        case 'HS256':
-            return 'sha256';
-        case 'HS384':
-            return 'sha384';
-        case 'HS512':
-            return 'sha512';
-        default:
-            throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
-    }
-}
-
-function getSignVerifyKey(alg, key, usage) {
-    if (key instanceof Uint8Array) {
-        if (!alg.startsWith('HS')) {
-            throw new TypeError(invalidKeyInput(key, ...types));
-        }
-        return createSecretKey(key);
-    }
-    if (key instanceof KeyObject) {
-        return key;
-    }
-    if (isCryptoKey(key)) {
-        checkSigCryptoKey(key, alg, usage);
-        return KeyObject.from(key);
-    }
-    throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
-}
-
-const oneShotSign = promisify(crypto.sign);
-const sign = async (alg, key, data) => {
-    const keyObject = getSignVerifyKey(alg, key, 'sign');
-    if (alg.startsWith('HS')) {
-        const hmac = crypto.createHmac(hmacDigest(alg), keyObject);
-        hmac.update(data);
-        return hmac.digest();
-    }
-    return oneShotSign(dsaDigest(alg), data, keyForCrypto(alg, keyObject));
-};
-
-const oneShotVerify = promisify(crypto.verify);
-const verify = async (alg, key, signature, data) => {
-    const keyObject = getSignVerifyKey(alg, key, 'verify');
-    if (alg.startsWith('HS')) {
-        const expected = await sign(alg, keyObject, data);
-        const actual = signature;
-        try {
-            return crypto.timingSafeEqual(actual, expected);
-        }
-        catch {
-            return false;
-        }
-    }
-    const algorithm = dsaDigest(alg);
-    const keyInput = keyForCrypto(alg, keyObject);
-    try {
-        return await oneShotVerify(algorithm, data, keyInput, signature);
-    }
-    catch {
-        return false;
-    }
-};
-
-async function flattenedVerify(jws, key, options) {
-    if (!isObject(jws)) {
-        throw new JWSInvalid('Flattened JWS must be an object');
-    }
-    if (jws.protected === undefined && jws.header === undefined) {
-        throw new JWSInvalid('Flattened JWS must have either of the "protected" or "header" members');
-    }
-    if (jws.protected !== undefined && typeof jws.protected !== 'string') {
-        throw new JWSInvalid('JWS Protected Header incorrect type');
-    }
-    if (jws.payload === undefined) {
-        throw new JWSInvalid('JWS Payload missing');
-    }
-    if (typeof jws.signature !== 'string') {
-        throw new JWSInvalid('JWS Signature missing or incorrect type');
-    }
-    if (jws.header !== undefined && !isObject(jws.header)) {
-        throw new JWSInvalid('JWS Unprotected Header incorrect type');
-    }
-    let parsedProt = {};
-    if (jws.protected) {
-        try {
-            const protectedHeader = decode(jws.protected);
-            parsedProt = JSON.parse(decoder.decode(protectedHeader));
-        }
-        catch {
-            throw new JWSInvalid('JWS Protected Header is invalid');
-        }
-    }
-    if (!isDisjoint(parsedProt, jws.header)) {
-        throw new JWSInvalid('JWS Protected and JWS Unprotected Header Parameter names must be disjoint');
-    }
-    const joseHeader = {
-        ...parsedProt,
-        ...jws.header,
-    };
-    const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options?.crit, parsedProt, joseHeader);
-    let b64 = true;
-    if (extensions.has('b64')) {
-        b64 = parsedProt.b64;
-        if (typeof b64 !== 'boolean') {
-            throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
-        }
-    }
-    const { alg } = joseHeader;
-    if (typeof alg !== 'string' || !alg) {
-        throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
-    }
-    const algorithms = options && validateAlgorithms('algorithms', options.algorithms);
-    if (algorithms && !algorithms.has(alg)) {
-        throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
-    }
-    if (b64) {
-        if (typeof jws.payload !== 'string') {
-            throw new JWSInvalid('JWS Payload must be a string');
-        }
-    }
-    else if (typeof jws.payload !== 'string' && !(jws.payload instanceof Uint8Array)) {
-        throw new JWSInvalid('JWS Payload must be a string or an Uint8Array instance');
-    }
-    let resolvedKey = false;
-    if (typeof key === 'function') {
-        key = await key(parsedProt, jws);
-        resolvedKey = true;
-    }
-    checkKeyType(alg, key, 'verify');
-    const data = concat(encoder.encode(jws.protected ?? ''), encoder.encode('.'), typeof jws.payload === 'string' ? encoder.encode(jws.payload) : jws.payload);
-    let signature;
-    try {
-        signature = decode(jws.signature);
-    }
-    catch {
-        throw new JWSInvalid('Failed to base64url decode the signature');
-    }
-    const verified = await verify(alg, key, signature, data);
-    if (!verified) {
-        throw new JWSSignatureVerificationFailed();
-    }
-    let payload;
-    if (b64) {
-        try {
-            payload = decode(jws.payload);
-        }
-        catch {
-            throw new JWSInvalid('Failed to base64url decode the payload');
-        }
-    }
-    else if (typeof jws.payload === 'string') {
-        payload = encoder.encode(jws.payload);
-    }
-    else {
-        payload = jws.payload;
-    }
-    const result = { payload };
-    if (jws.protected !== undefined) {
-        result.protectedHeader = parsedProt;
-    }
-    if (jws.header !== undefined) {
-        result.unprotectedHeader = jws.header;
-    }
-    if (resolvedKey) {
-        return { ...result, key };
-    }
-    return result;
-}
-
-async function compactVerify(jws, key, options) {
-    if (jws instanceof Uint8Array) {
-        jws = decoder.decode(jws);
-    }
-    if (typeof jws !== 'string') {
-        throw new JWSInvalid('Compact JWS must be a string or Uint8Array');
-    }
-    const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split('.');
-    if (length !== 3) {
-        throw new JWSInvalid('Invalid Compact JWS');
-    }
-    const verified = await flattenedVerify({ payload, protected: protectedHeader, signature }, key, options);
-    const result = { payload: verified.payload, protectedHeader: verified.protectedHeader };
-    if (typeof key === 'function') {
-        return { ...result, key: verified.key };
-    }
-    return result;
-}
-
-var epoch = (date) => Math.floor(date.getTime() / 1000);
-
-const minute = 60;
-const hour = minute * 60;
-const day = hour * 24;
-const week = day * 7;
-const year = day * 365.25;
-const REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
-var secs = (str) => {
-    const matched = REGEX.exec(str);
-    if (!matched || (matched[4] && matched[1])) {
-        throw new TypeError('Invalid time period format');
-    }
-    const value = parseFloat(matched[2]);
-    const unit = matched[3].toLowerCase();
-    let numericDate;
-    switch (unit) {
-        case 'sec':
-        case 'secs':
-        case 'second':
-        case 'seconds':
-        case 's':
-            numericDate = Math.round(value);
-            break;
-        case 'minute':
-        case 'minutes':
-        case 'min':
-        case 'mins':
-        case 'm':
-            numericDate = Math.round(value * minute);
-            break;
-        case 'hour':
-        case 'hours':
-        case 'hr':
-        case 'hrs':
-        case 'h':
-            numericDate = Math.round(value * hour);
-            break;
-        case 'day':
-        case 'days':
-        case 'd':
-            numericDate = Math.round(value * day);
-            break;
-        case 'week':
-        case 'weeks':
-        case 'w':
-            numericDate = Math.round(value * week);
-            break;
-        default:
-            numericDate = Math.round(value * year);
-            break;
-    }
-    if (matched[1] === '-' || matched[4] === 'ago') {
-        return -numericDate;
-    }
-    return numericDate;
-};
-
-const normalizeTyp = (value) => value.toLowerCase().replace(/^application\//, '');
-const checkAudiencePresence = (audPayload, audOption) => {
-    if (typeof audPayload === 'string') {
-        return audOption.includes(audPayload);
-    }
-    if (Array.isArray(audPayload)) {
-        return audOption.some(Set.prototype.has.bind(new Set(audPayload)));
-    }
-    return false;
-};
-var jwtPayload = (protectedHeader, encodedPayload, options = {}) => {
-    const { typ } = options;
-    if (typ &&
-        (typeof protectedHeader.typ !== 'string' ||
-            normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
-        throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', 'typ', 'check_failed');
-    }
-    let payload;
-    try {
-        payload = JSON.parse(decoder.decode(encodedPayload));
-    }
-    catch {
-    }
-    if (!isObject(payload)) {
-        throw new JWTInvalid('JWT Claims Set must be a top-level JSON object');
-    }
-    const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
-    const presenceCheck = [...requiredClaims];
-    if (maxTokenAge !== undefined)
-        presenceCheck.push('iat');
-    if (audience !== undefined)
-        presenceCheck.push('aud');
-    if (subject !== undefined)
-        presenceCheck.push('sub');
-    if (issuer !== undefined)
-        presenceCheck.push('iss');
-    for (const claim of new Set(presenceCheck.reverse())) {
-        if (!(claim in payload)) {
-            throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, claim, 'missing');
-        }
-    }
-    if (issuer && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {
-        throw new JWTClaimValidationFailed('unexpected "iss" claim value', 'iss', 'check_failed');
-    }
-    if (subject && payload.sub !== subject) {
-        throw new JWTClaimValidationFailed('unexpected "sub" claim value', 'sub', 'check_failed');
-    }
-    if (audience &&
-        !checkAudiencePresence(payload.aud, typeof audience === 'string' ? [audience] : audience)) {
-        throw new JWTClaimValidationFailed('unexpected "aud" claim value', 'aud', 'check_failed');
-    }
-    let tolerance;
-    switch (typeof options.clockTolerance) {
-        case 'string':
-            tolerance = secs(options.clockTolerance);
-            break;
-        case 'number':
-            tolerance = options.clockTolerance;
-            break;
-        case 'undefined':
-            tolerance = 0;
-            break;
-        default:
-            throw new TypeError('Invalid clockTolerance option type');
-    }
-    const { currentDate } = options;
-    const now = epoch(currentDate || new Date());
-    if ((payload.iat !== undefined || maxTokenAge) && typeof payload.iat !== 'number') {
-        throw new JWTClaimValidationFailed('"iat" claim must be a number', 'iat', 'invalid');
-    }
-    if (payload.nbf !== undefined) {
-        if (typeof payload.nbf !== 'number') {
-            throw new JWTClaimValidationFailed('"nbf" claim must be a number', 'nbf', 'invalid');
-        }
-        if (payload.nbf > now + tolerance) {
-            throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', 'nbf', 'check_failed');
-        }
-    }
-    if (payload.exp !== undefined) {
-        if (typeof payload.exp !== 'number') {
-            throw new JWTClaimValidationFailed('"exp" claim must be a number', 'exp', 'invalid');
-        }
-        if (payload.exp <= now - tolerance) {
-            throw new JWTExpired('"exp" claim timestamp check failed', 'exp', 'check_failed');
-        }
-    }
-    if (maxTokenAge) {
-        const age = now - payload.iat;
-        const max = typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge);
-        if (age - tolerance > max) {
-            throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', 'iat', 'check_failed');
-        }
-        if (age < 0 - tolerance) {
-            throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', 'iat', 'check_failed');
-        }
-    }
-    return payload;
-};
-
-async function jwtVerify(jwt, key, options) {
-    const verified = await compactVerify(jwt, key, options);
-    if (verified.protectedHeader.crit?.includes('b64') && verified.protectedHeader.b64 === false) {
-        throw new JWTInvalid('JWTs MUST NOT use unencoded payload');
-    }
-    const payload = jwtPayload(verified.protectedHeader, verified.payload, options);
-    const result = { payload, protectedHeader: verified.protectedHeader };
-    if (typeof key === 'function') {
-        return { ...result, key: verified.key };
-    }
-    return result;
-}
-
-function getKtyFromAlg(alg) {
-    switch (typeof alg === 'string' && alg.slice(0, 2)) {
-        case 'RS':
-        case 'PS':
-            return 'RSA';
-        case 'ES':
-            return 'EC';
-        case 'Ed':
-            return 'OKP';
-        default:
-            throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
-    }
-}
-function isJWKSLike(jwks) {
-    return (jwks &&
-        typeof jwks === 'object' &&
-        Array.isArray(jwks.keys) &&
-        jwks.keys.every(isJWKLike));
-}
-function isJWKLike(key) {
-    return isObject(key);
-}
-function clone(obj) {
-    if (typeof structuredClone === 'function') {
-        return structuredClone(obj);
-    }
-    return JSON.parse(JSON.stringify(obj));
-}
-class LocalJWKSet {
-    _jwks;
-    _cached = new WeakMap();
-    constructor(jwks) {
-        if (!isJWKSLike(jwks)) {
-            throw new JWKSInvalid('JSON Web Key Set malformed');
-        }
-        this._jwks = clone(jwks);
-    }
-    async getKey(protectedHeader, token) {
-        const { alg, kid } = { ...protectedHeader, ...token?.header };
-        const kty = getKtyFromAlg(alg);
-        const candidates = this._jwks.keys.filter((jwk) => {
-            let candidate = kty === jwk.kty;
-            if (candidate && typeof kid === 'string') {
-                candidate = kid === jwk.kid;
-            }
-            if (candidate && typeof jwk.alg === 'string') {
-                candidate = alg === jwk.alg;
-            }
-            if (candidate && typeof jwk.use === 'string') {
-                candidate = jwk.use === 'sig';
-            }
-            if (candidate && Array.isArray(jwk.key_ops)) {
-                candidate = jwk.key_ops.includes('verify');
-            }
-            if (candidate && alg === 'EdDSA') {
-                candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
-            }
-            if (candidate) {
-                switch (alg) {
-                    case 'ES256':
-                        candidate = jwk.crv === 'P-256';
-                        break;
-                    case 'ES256K':
-                        candidate = jwk.crv === 'secp256k1';
-                        break;
-                    case 'ES384':
-                        candidate = jwk.crv === 'P-384';
-                        break;
-                    case 'ES512':
-                        candidate = jwk.crv === 'P-521';
-                        break;
-                }
-            }
-            return candidate;
-        });
-        const { 0: jwk, length } = candidates;
-        if (length === 0) {
-            throw new JWKSNoMatchingKey();
-        }
-        if (length !== 1) {
-            const error = new JWKSMultipleMatchingKeys();
-            const { _cached } = this;
-            error[Symbol.asyncIterator] = async function* () {
-                for (const jwk of candidates) {
-                    try {
-                        yield await importWithAlgCache(_cached, jwk, alg);
-                    }
-                    catch { }
-                }
-            };
-            throw error;
-        }
-        return importWithAlgCache(this._cached, jwk, alg);
-    }
-}
-async function importWithAlgCache(cache, jwk, alg) {
-    const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk);
-    if (cached[alg] === undefined) {
-        const key = await importJWK({ ...jwk, ext: true }, alg);
-        if (key instanceof Uint8Array || key.type !== 'public') {
-            throw new JWKSInvalid('JSON Web Key Set members must be public keys');
-        }
-        cached[alg] = key;
-    }
-    return cached[alg];
-}
-function createLocalJWKSet(jwks) {
-    const set = new LocalJWKSet(jwks);
-    return async (protectedHeader, token) => set.getKey(protectedHeader, token);
-}
-
-const fetchJwks = async (url, timeout, options) => {
-    let get;
-    switch (url.protocol) {
-        case 'https:':
-            get = https.get;
-            break;
-        case 'http:':
-            get = http.get;
-            break;
-        default:
-            throw new TypeError('Unsupported URL protocol.');
-    }
-    const { agent, headers } = options;
-    const req = get(url.href, {
-        agent,
-        timeout,
-        headers,
-    });
-    const [response] = (await Promise.race([once(req, 'response'), once(req, 'timeout')]));
-    if (!response) {
-        req.destroy();
-        throw new JWKSTimeout();
-    }
-    if (response.statusCode !== 200) {
-        throw new JOSEError('Expected 200 OK from the JSON Web Key Set HTTP response');
-    }
-    const parts = [];
-    for await (const part of response) {
-        parts.push(part);
-    }
-    try {
-        return JSON.parse(decoder.decode(concat(...parts)));
-    }
-    catch {
-        throw new JOSEError('Failed to parse the JSON Web Key Set HTTP response as JSON');
-    }
-};
-
-function isCloudflareWorkers() {
-    return (typeof WebSocketPair !== 'undefined' ||
-        (typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers') ||
-        (typeof EdgeRuntime !== 'undefined' && EdgeRuntime === 'vercel'));
-}
-let USER_AGENT;
-if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
-    const NAME = 'jose';
-    const VERSION = 'v5.2.4';
-    USER_AGENT = `${NAME}/${VERSION}`;
-}
-class RemoteJWKSet {
-    _url;
-    _timeoutDuration;
-    _cooldownDuration;
-    _cacheMaxAge;
-    _jwksTimestamp;
-    _pendingFetch;
-    _options;
-    _local;
-    constructor(url, options) {
-        if (!(url instanceof URL)) {
-            throw new TypeError('url must be an instance of URL');
-        }
-        this._url = new URL(url.href);
-        this._options = { agent: options?.agent, headers: options?.headers };
-        this._timeoutDuration =
-            typeof options?.timeoutDuration === 'number' ? options?.timeoutDuration : 5000;
-        this._cooldownDuration =
-            typeof options?.cooldownDuration === 'number' ? options?.cooldownDuration : 30000;
-        this._cacheMaxAge = typeof options?.cacheMaxAge === 'number' ? options?.cacheMaxAge : 600000;
-    }
-    coolingDown() {
-        return typeof this._jwksTimestamp === 'number'
-            ? Date.now() < this._jwksTimestamp + this._cooldownDuration
-            : false;
-    }
-    fresh() {
-        return typeof this._jwksTimestamp === 'number'
-            ? Date.now() < this._jwksTimestamp + this._cacheMaxAge
-            : false;
-    }
-    async getKey(protectedHeader, token) {
-        if (!this._local || !this.fresh()) {
-            await this.reload();
-        }
-        try {
-            return await this._local(protectedHeader, token);
-        }
-        catch (err) {
-            if (err instanceof JWKSNoMatchingKey) {
-                if (this.coolingDown() === false) {
-                    await this.reload();
-                    return this._local(protectedHeader, token);
-                }
-            }
-            throw err;
-        }
-    }
-    async reload() {
-        if (this._pendingFetch && isCloudflareWorkers()) {
-            this._pendingFetch = undefined;
-        }
-        const headers = new Headers(this._options.headers);
-        if (USER_AGENT && !headers.has('User-Agent')) {
-            headers.set('User-Agent', USER_AGENT);
-            this._options.headers = Object.fromEntries(headers.entries());
-        }
-        this._pendingFetch ||= fetchJwks(this._url, this._timeoutDuration, this._options)
-            .then((json) => {
-            this._local = createLocalJWKSet(json);
-            this._jwksTimestamp = Date.now();
-            this._pendingFetch = undefined;
-        })
-            .catch((err) => {
-            this._pendingFetch = undefined;
-            throw err;
-        });
-        await this._pendingFetch;
-    }
-}
-function createRemoteJWKSet(url, options) {
-    const set = new RemoteJWKSet(url, options);
-    return async (protectedHeader, token) => set.getKey(protectedHeader, token);
-}
-
-const authorizationEndpoint = 'https://accounts.google.com/o/oauth2/v2/auth';
-const accessTokenEndpoint = 'https://oauth2.googleapis.com/token';
-const userInfoEndpoint = 'https://openidconnect.googleapis.com/v1/userinfo';
-const scope = 'openid profile email';
-// Instead of defining the metadata in the connector, we reuse the metadata from the connector-kit.
-// This is not the normal practice, but Google One Tap is a special case.
-// @see {@link GoogleConnector} for more information.
-const defaultMetadata = {
-    id: GoogleConnector.factoryId,
-    target: GoogleConnector.target,
-    platform: ConnectorPlatform.Universal,
-    name: {
-        en: 'Google',
-        'zh-CN': 'Google',
-        'tr-TR': 'Google',
-        ko: 'Google',
+// src/index.ts
+import { conditional, assert } from "@silverhand/essentials";
+import { got, HTTPError } from "got";
+import {
+  ConnectorError,
+  ConnectorErrorCodes,
+  validateConfig,
+  ConnectorType,
+  parseJson,
+  GoogleConnector as GoogleConnector3
+} from "@logto/connector-kit";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+
+// src/constant.ts
+import {
+  ConnectorConfigFormItemType,
+  ConnectorPlatform,
+  GoogleConnector,
+  OidcPrompt
+} from "@logto/connector-kit";
+var authorizationEndpoint = "https://accounts.google.com/o/oauth2/v2/auth";
+var accessTokenEndpoint = "https://oauth2.googleapis.com/token";
+var userInfoEndpoint = "https://openidconnect.googleapis.com/v1/userinfo";
+var scope = "openid profile email";
+var defaultMetadata = {
+  id: GoogleConnector.factoryId,
+  target: GoogleConnector.target,
+  platform: ConnectorPlatform.Universal,
+  name: {
+    en: "Google",
+    "zh-CN": "Google",
+    "tr-TR": "Google",
+    ko: "Google"
+  },
+  logo: "./logo.svg",
+  logoDark: null,
+  description: {
+    en: "Google is a principal search engine technology and email service provider.",
+    "zh-CN": "Google \u662F\u5168\u7403\u6027\u7684\u641C\u7D22\u5F15\u64CE\u548C\u90AE\u4EF6\u670D\u52A1\u63D0\u4F9B\u5546\u3002",
+    "tr-TR": "Google, en b\xFCy\xFCk arama motoru teknolojisi ve e-posta servis sa\u011Flay\u0131c\u0131s\u0131d\u0131r.",
+    ko: "Google\uC740 \uAC00\uC7A5 \uD070 \uAC80\uC0C9 \uC5D4\uC9C4 \uAE30\uC220\uACFC \uC774\uBA54\uC77C \uC11C\uBE44\uC2A4 \uC81C\uACF5\uC790\uC785\uB2C8\uB2E4."
+  },
+  readme: "./README.md",
+  formItems: [
+    {
+      key: "clientId",
+      type: ConnectorConfigFormItemType.Text,
+      label: "Client ID",
+      required: true,
+      placeholder: "<client-id>"
     },
-    logo: './logo.svg',
-    logoDark: null,
-    description: {
-        en: 'Google is a principal search engine technology and email service provider.',
-        'zh-CN': 'Google 是全球性的搜索引擎和邮件服务提供商。',
-        'tr-TR': 'Google, en büyük arama motoru teknolojisi ve e-posta servis sağlayıcısıdır.',
-        ko: 'Google은 가장 큰 검색 엔진 기술과 이메일 서비스 제공자입니다.',
+    {
+      key: "clientSecret",
+      type: ConnectorConfigFormItemType.Text,
+      label: "Client Secret",
+      required: true,
+      placeholder: "<client-secret>"
     },
-    readme: './README.md',
-    formItems: [
-        {
-            key: 'clientId',
-            type: ConnectorConfigFormItemType.Text,
-            label: 'Client ID',
-            required: true,
-            placeholder: '<client-id>',
-        },
-        {
-            key: 'clientSecret',
-            type: ConnectorConfigFormItemType.Text,
-            label: 'Client Secret',
-            required: true,
-            placeholder: '<client-secret>',
-        },
-        {
-            key: 'scope',
-            type: ConnectorConfigFormItemType.Text,
-            label: 'Scope',
-            required: false,
-            placeholder: '<scope>',
-            description: "The `scope` determines permissions granted by the user's authorization. If you are not sure what to enter, do not worry, just leave it blank.",
-        },
-        {
-            key: 'prompts',
-            type: ConnectorConfigFormItemType.MultiSelect,
-            required: false,
-            label: 'Prompts',
-            // Google does not support `login` prompt.
-            // Ref: https://developers.google.com/identity/openid-connect/openid-connect#authenticationuriparameters
-            selectItems: Object.values(OidcPrompt)
-                .filter((prompt) => prompt !== OidcPrompt.Login)
-                .map((prompt) => ({
-                value: prompt,
-            })),
-        },
-    ],
-};
-const defaultTimeout = 5000;
-// https://developers.google.com/identity/gsi/web/guides/verify-google-id-token
-const jwksUri = 'https://www.googleapis.com/oauth2/v3/certs';
-
-const accessTokenResponseGuard = z.object({
-    access_token: z.string(),
-    scope: z.string(),
-    token_type: z.string(),
+    {
+      key: "scope",
+      type: ConnectorConfigFormItemType.Text,
+      label: "Scope",
+      required: false,
+      placeholder: "<scope>",
+      description: "The `scope` determines permissions granted by the user's authorization. If you are not sure what to enter, do not worry, just leave it blank."
+    },
+    {
+      key: "prompts",
+      type: ConnectorConfigFormItemType.MultiSelect,
+      required: false,
+      label: "Prompts",
+      // Google does not support `login` prompt.
+      // Ref: https://developers.google.com/identity/openid-connect/openid-connect#authenticationuriparameters
+      selectItems: Object.values(OidcPrompt).filter((prompt) => prompt !== OidcPrompt.Login).map((prompt) => ({
+        value: prompt
+      })),
+      defaultValue: [OidcPrompt.SelectAccount]
+    }
+  ]
+};
+var defaultTimeout = 5e3;
+var jwksUri = "https://www.googleapis.com/oauth2/v3/certs";
+
+// src/types.ts
+import { z } from "zod";
+import { GoogleConnector as GoogleConnector2 } from "@logto/connector-kit";
+var accessTokenResponseGuard = z.object({
+  access_token: z.string(),
+  scope: z.string(),
+  token_type: z.string()
 });
-const userInfoResponseGuard = z.object({
-    sub: z.string(),
-    name: z.string().optional(),
-    given_name: z.string().optional(),
-    family_name: z.string().optional(),
-    picture: z.string().optional(),
-    email: z.string().optional(),
-    email_verified: z.boolean().optional(),
-    locale: z.string().optional(),
+var userInfoResponseGuard = z.object({
+  sub: z.string(),
+  name: z.string().optional(),
+  given_name: z.string().optional(),
+  family_name: z.string().optional(),
+  picture: z.string().optional(),
+  email: z.string().optional(),
+  email_verified: z.boolean().optional(),
+  locale: z.string().optional()
 });
-const authResponseGuard = z.object({
-    code: z.string(),
-    redirectUri: z.string(),
+var authResponseGuard = z.object({
+  code: z.string(),
+  redirectUri: z.string()
 });
-/**
- * Response payload from Google One Tap. Note the CSRF token is not included since it should be
- * verified by the web server.
- */
-const googleOneTapDataGuard = z.object({
-    [GoogleConnector.oneTapParams.credential]: z.string(),
+var googleOneTapDataGuard = z.object({
+  [GoogleConnector2.oneTapParams.credential]: z.string()
 });
 
-/**
- * The Implementation of OpenID Connect of Google Identity Platform.
- * https://developers.google.com/identity/protocols/oauth2/openid-connect
- */
-const getAuthorizationUri = (getConfig) => async ({ state, redirectUri }) => {
-    const config = await getConfig(defaultMetadata.id);
-    validateConfig(config, GoogleConnector.configGuard);
-    const { clientId, scope: scope$1, prompts } = config;
-    const queryParameters = new URLSearchParams({
-        client_id: clientId,
-        redirect_uri: redirectUri,
-        response_type: 'code',
-        state,
-        scope: scope$1 ?? scope,
-        ...conditional(prompts && prompts.length > 0 && { prompt: prompts.join(' ') }),
-    });
-    return `${authorizationEndpoint}?${queryParameters.toString()}`;
-};
-const getAccessToken = async (config, codeObject) => {
-    const { code, redirectUri } = codeObject;
-    const { clientId, clientSecret } = config;
-    // Note：Need to decodeURIComponent on code
-    // https://stackoverflow.com/questions/51058256/google-api-node-js-invalid-grant-malformed-auth-code
-    const httpResponse = await got.post(accessTokenEndpoint, {
-        form: {
-            code: decodeURIComponent(code),
-            client_id: clientId,
-            client_secret: clientSecret,
-            redirect_uri: redirectUri,
-            grant_type: 'authorization_code',
-        },
-        timeout: { request: defaultTimeout },
-    });
-    const result = accessTokenResponseGuard.safeParse(parseJson(httpResponse.body));
-    if (!result.success) {
-        throw new ConnectorError(ConnectorErrorCodes.InvalidResponse, result.error);
-    }
-    const { access_token: accessToken } = result.data;
-    assert(accessToken, new ConnectorError(ConnectorErrorCodes.SocialAuthCodeInvalid));
-    return { accessToken };
-};
-/**
- * Get user information JSON from Google Identity Platform. It will use the following order to
- * retrieve user information:
- *
- * 1. Google One Tap: https://developers.google.com/identity/gsi/web/guides/verify-google-id-token
- * 2. Normal Google OAuth: https://developers.google.com/identity/protocols/oauth2/openid-connect
- *
- * @param data The data from the client.
- * @param config The configuration of the connector.
- * @returns A Promise that resolves to the user information JSON.
- */
-const getUserInfoJson = async (data, config) => {
-    // Google One Tap
-    const oneTapResult = googleOneTapDataGuard.safeParse(data);
-    if (oneTapResult.success) {
-        const { payload } = await jwtVerify(oneTapResult.data.credential, createRemoteJWKSet(new URL(jwksUri)), {
-            // https://developers.google.com/identity/gsi/web/guides/verify-google-id-token
-            issuer: ['https://accounts.google.com', 'accounts.google.com'],
-            audience: config.clientId,
-            clockTolerance: 10,
-        });
-        return payload;
-    }
-    // Normal Google OAuth
-    const { code, redirectUri } = await authorizationCallbackHandler(data);
-    const { accessToken } = await getAccessToken(config, { code, redirectUri });
-    const httpResponse = await got.post(userInfoEndpoint, {
-        headers: {
-            authorization: `Bearer ${accessToken}`,
-        },
-        timeout: { request: defaultTimeout },
-    });
-    return parseJson(httpResponse.body);
-};
-const getUserInfo = (getConfig) => async (data) => {
-    const config = await getConfig(defaultMetadata.id);
-    validateConfig(config, GoogleConnector.configGuard);
-    try {
-        const rawData = await getUserInfoJson(data, config);
-        const result = userInfoResponseGuard.safeParse(rawData);
-        if (!result.success) {
-            throw new ConnectorError(ConnectorErrorCodes.InvalidResponse, result.error);
-        }
-        const { sub: id, picture: avatar, email, email_verified, name } = result.data;
-        return {
-            id,
-            avatar,
-            email: conditional(email_verified && email),
-            name,
-            rawData,
-        };
-    }
-    catch (error) {
-        return getUserInfoErrorHandler(error);
-    }
-};
-const authorizationCallbackHandler = async (parameterObject) => {
-    const result = authResponseGuard.safeParse(parameterObject);
+// src/index.ts
+var getAuthorizationUri = (getConfig) => async ({ state, redirectUri }) => {
+  const config = await getConfig(defaultMetadata.id);
+  validateConfig(config, GoogleConnector3.configGuard);
+  const { clientId, scope: scope2, prompts } = config;
+  const queryParameters = new URLSearchParams({
+    client_id: clientId,
+    redirect_uri: redirectUri,
+    response_type: "code",
+    state,
+    scope: scope2 ?? scope,
+    ...conditional(prompts && prompts.length > 0 && { prompt: prompts.join(" ") })
+  });
+  return `${authorizationEndpoint}?${queryParameters.toString()}`;
+};
+var getAccessToken = async (config, codeObject) => {
+  const { code, redirectUri } = codeObject;
+  const { clientId, clientSecret } = config;
+  const httpResponse = await got.post(accessTokenEndpoint, {
+    form: {
+      code: decodeURIComponent(code),
+      client_id: clientId,
+      client_secret: clientSecret,
+      redirect_uri: redirectUri,
+      grant_type: "authorization_code"
+    },
+    timeout: { request: defaultTimeout }
+  });
+  const result = accessTokenResponseGuard.safeParse(parseJson(httpResponse.body));
+  if (!result.success) {
+    throw new ConnectorError(ConnectorErrorCodes.InvalidResponse, result.error);
+  }
+  const { access_token: accessToken } = result.data;
+  assert(accessToken, new ConnectorError(ConnectorErrorCodes.SocialAuthCodeInvalid));
+  return { accessToken };
+};
+var getUserInfoJson = async (data, config) => {
+  const oneTapResult = googleOneTapDataGuard.safeParse(data);
+  if (oneTapResult.success) {
+    const { payload } = await jwtVerify(
+      oneTapResult.data.credential,
+      createRemoteJWKSet(new URL(jwksUri)),
+      {
+        // https://developers.google.com/identity/gsi/web/guides/verify-google-id-token
+        issuer: ["https://accounts.google.com", "accounts.google.com"],
+        audience: config.clientId,
+        clockTolerance: 10
+      }
+    );
+    return payload;
+  }
+  const { code, redirectUri } = await authorizationCallbackHandler(data);
+  const { accessToken } = await getAccessToken(config, { code, redirectUri });
+  const httpResponse = await got.post(userInfoEndpoint, {
+    headers: {
+      authorization: `Bearer ${accessToken}`
+    },
+    timeout: { request: defaultTimeout }
+  });
+  return parseJson(httpResponse.body);
+};
+var getUserInfo = (getConfig) => async (data) => {
+  const config = await getConfig(defaultMetadata.id);
+  validateConfig(config, GoogleConnector3.configGuard);
+  try {
+    const rawData = await getUserInfoJson(data, config);
+    const result = userInfoResponseGuard.safeParse(rawData);
     if (!result.success) {
-        throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(parameterObject));
-    }
-    return result.data;
-};
-const getUserInfoErrorHandler = (error) => {
-    if (error instanceof HTTPError) {
-        const { statusCode, body: rawBody } = error.response;
-        if (statusCode === 401) {
-            throw new ConnectorError(ConnectorErrorCodes.SocialAccessTokenInvalid);
-        }
-        throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(rawBody));
+      throw new ConnectorError(ConnectorErrorCodes.InvalidResponse, result.error);
     }
-    throw error;
-};
-const createGoogleConnector = async ({ getConfig }) => {
+    const { sub: id, picture: avatar, email, email_verified, name } = result.data;
     return {
-        metadata: defaultMetadata,
-        type: ConnectorType.Social,
-        configGuard: GoogleConnector.configGuard,
-        getAuthorizationUri: getAuthorizationUri(getConfig),
-        getUserInfo: getUserInfo(getConfig),
+      id,
+      avatar,
+      email: conditional(email_verified && email),
+      name,
+      rawData
     };
-};
-
-export { createGoogleConnector as default, getAccessToken };
+  } catch (error) {
+    return getUserInfoErrorHandler(error);
+  }
+};
+var authorizationCallbackHandler = async (parameterObject) => {
+  const result = authResponseGuard.safeParse(parameterObject);
+  if (!result.success) {
+    throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(parameterObject));
+  }
+  return result.data;
+};
+var getUserInfoErrorHandler = (error) => {
+  if (error instanceof HTTPError) {
+    const { statusCode, body: rawBody } = error.response;
+    if (statusCode === 401) {
+      throw new ConnectorError(ConnectorErrorCodes.SocialAccessTokenInvalid);
+    }
+    throw new ConnectorError(ConnectorErrorCodes.General, JSON.stringify(rawBody));
+  }
+  throw error;
+};
+var createGoogleConnector = async ({ getConfig }) => {
+  return {
+    metadata: defaultMetadata,
+    type: ConnectorType.Social,
+    configGuard: GoogleConnector3.configGuard,
+    getAuthorizationUri: getAuthorizationUri(getConfig),
+    getUserInfo: getUserInfo(getConfig)
+  };
+};
+var src_default = createGoogleConnector;
+export {
+  src_default as default,
+  getAccessToken
+};
+//# sourceMappingURL=index.js.map