@rttnd/gau 1.4.2 → 1.4.4

package/dist/src/core/serverSession.d.ts

@@ -0,0 +1,13 @@
+import type { OAuthProvider } from '../oauth';
+import type { CreateAuthOptions, ProviderIds } from './createAuth';
+import type { GauServerSession, GauSession } from './index';
+import { createAuth } from './index';
+export type AuthInstance<TProviders extends OAuthProvider<any>[]> = ReturnType<typeof createAuth<TProviders>>;
+export declare function resolveAuth<const TProviders extends OAuthProvider<any>[]>(optionsOrAuth: CreateAuthOptions<TProviders> | AuthInstance<TProviders>): AuthInstance<TProviders>;
+export declare function getAuthProviders<const TProviders extends OAuthProvider<any>[]>(auth: AuthInstance<TProviders>): ProviderIds<AuthInstance<TProviders>>[];
+export declare function resolveServerSession<const TProviders extends OAuthProvider<any>[]>(auth: AuthInstance<TProviders>, request: Request): Promise<GauServerSession<ProviderIds<AuthInstance<TProviders>>>>;
+export declare function createRequestSessionCache<const TProviders extends OAuthProvider<any>[]>(auth: AuthInstance<TProviders>, request: Request, preloadedServerSession?: GauServerSession<ProviderIds<AuthInstance<TProviders>>>): {
+    getServerSession: () => Promise<GauServerSession<TProviders[number] extends infer T ? T extends TProviders[number] ? T extends OAuthProvider<infer T_1 extends string, import("../oauth").OAuthProviderConfig> ? T_1 : never : never : never>>;
+    getSession: () => Promise<GauSession<TProviders[number] extends infer T ? T extends TProviders[number] ? T extends OAuthProvider<infer T_1 extends string, import("../oauth").OAuthProviderConfig> ? T_1 : never : never : never>>;
+};
+//# sourceMappingURL=serverSession.d.ts.map

package/dist/src/core/serverSession.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serverSession.d.ts","sourceRoot":"","sources":["../../../src/core/serverSession.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAC3D,OAAO,EAAE,UAAU,EAAiC,MAAM,SAAS,CAAA;AAGnE,MAAM,MAAM,YAAY,CAAC,UAAU,SAAS,aAAa,CAAC,GAAG,CAAC,EAAE,IAAI,UAAU,CAAC,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC,CAAA;AAI7G,wBAAgB,WAAW,CAAC,KAAK,CAAC,UAAU,SAAS,aAAa,CAAC,GAAG,CAAC,EAAE,EACvE,aAAa,EAAE,iBAAiB,CAAC,UAAU,CAAC,GAAG,YAAY,CAAC,UAAU,CAAC,GACtE,YAAY,CAAC,UAAU,CAAC,CAK1B;AAED,wBAAgB,gBAAgB,CAAC,KAAK,CAAC,UAAU,SAAS,aAAa,CAAC,GAAG,CAAC,EAAE,EAC5E,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,GAC7B,WAAW,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,EAAE,CAOzC;AAED,wBAAsB,oBAAoB,CAAC,KAAK,CAAC,UAAU,SAAS,aAAa,CAAC,GAAG,CAAC,EAAE,EACtF,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,EAC9B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAiBlE;AAED,wBAAgB,yBAAyB,CAAC,KAAK,CAAC,UAAU,SAAS,aAAa,CAAC,GAAG,CAAC,EAAE,EACrF,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,EAC9B,OAAO,EAAE,OAAO,EAChB,sBAAsB,CAAC,EAAE,gBAAgB,CAAC,WAAW,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;;;EAmBjF"}

package/dist/src/index.js

@@ -1 +1 @@
-import{AuthError as o,CALLBACK_URI_COOKIE_NAME as r,CLIENT_CHALLENGE_COOKIE_NAME as m,CSRF_COOKIE_NAME as p,CSRF_MAX_AGE as t,Cookies as c,DEFAULT_COOKIE_SERIALIZE_OPTIONS as f,ErrorCodes as h,ErrorMessages as i,ErrorStatuses as j,GauError as k,LINKING_TOKEN_COOKIE_NAME as n,NULL_SESSION as s,PKCE_COOKIE_NAME as u,PROVIDER_OPTIONS_COOKIE_NAME as Q,REFRESHED_TOKEN_HEADER as e,SESSION_COOKIE_NAME as x,SESSION_STASH_COOKIE_NAME as A,SESSION_STRATEGY_COOKIE_NAME as B,createAuth as F,createErrorRedirectUrl as K,createHandler as L,getSessionTokenFromRequest as M,handleError as P,isImpersonating as R,isUserFacingRequest as T,json as U,parseCookies as V,redirect as a,toClientSession as b}from"../chunk-RPFUKTQA.js";import{htmlResponse as d,renderCancelledPage as g,renderErrorPage as l,renderSuccessPage as q}from"../chunk-VB2ML4Q5.js";export{o as AuthError,r as CALLBACK_URI_COOKIE_NAME,m as CLIENT_CHALLENGE_COOKIE_NAME,p as CSRF_COOKIE_NAME,t as CSRF_MAX_AGE,c as Cookies,f as DEFAULT_COOKIE_SERIALIZE_OPTIONS,h as ErrorCodes,i as ErrorMessages,j as ErrorStatuses,k as GauError,n as LINKING_TOKEN_COOKIE_NAME,s as NULL_SESSION,u as PKCE_COOKIE_NAME,Q as PROVIDER_OPTIONS_COOKIE_NAME,e as REFRESHED_TOKEN_HEADER,x as SESSION_COOKIE_NAME,A as SESSION_STASH_COOKIE_NAME,B as SESSION_STRATEGY_COOKIE_NAME,F as createAuth,K as createErrorRedirectUrl,L as createHandler,M as getSessionTokenFromRequest,P as handleError,d as htmlResponse,R as isImpersonating,T as isUserFacingRequest,U as json,V as parseCookies,a as redirect,g as renderCancelledPage,l as renderErrorPage,q as renderSuccessPage,b as toClientSession};//# sourceMappingURL=index.js.map
+import{AuthError as o,CALLBACK_URI_COOKIE_NAME as r,CLIENT_CHALLENGE_COOKIE_NAME as m,CSRF_COOKIE_NAME as p,CSRF_MAX_AGE as t,Cookies as c,DEFAULT_COOKIE_SERIALIZE_OPTIONS as h,ErrorCodes as i,ErrorMessages as j,ErrorStatuses as k,GauError as n,LINKING_TOKEN_COOKIE_NAME as s,NULL_SESSION as u,PKCE_COOKIE_NAME as f,PROVIDER_OPTIONS_COOKIE_NAME as H,REFRESHED_TOKEN_HEADER as I,SESSION_COOKIE_NAME as L,SESSION_STASH_COOKIE_NAME as N,SESSION_STRATEGY_COOKIE_NAME as Q,createAuth as V,createErrorRedirectUrl as e,createHandler as x,getSessionTokenFromRequest as B,handleError as D,isImpersonating as E,isUserFacingRequest as M,json as W,parseCookies as X,redirect as Y,toClientSession as a}from"../chunk-NHENQLYI.js";import{htmlResponse as b,renderCancelledPage as d,renderErrorPage as g,renderSuccessPage as l}from"../chunk-VB2ML4Q5.js";import"../chunk-VXWI4D7H.js";export{o as AuthError,r as CALLBACK_URI_COOKIE_NAME,m as CLIENT_CHALLENGE_COOKIE_NAME,p as CSRF_COOKIE_NAME,t as CSRF_MAX_AGE,c as Cookies,h as DEFAULT_COOKIE_SERIALIZE_OPTIONS,i as ErrorCodes,j as ErrorMessages,k as ErrorStatuses,n as GauError,s as LINKING_TOKEN_COOKIE_NAME,u as NULL_SESSION,f as PKCE_COOKIE_NAME,H as PROVIDER_OPTIONS_COOKIE_NAME,I as REFRESHED_TOKEN_HEADER,L as SESSION_COOKIE_NAME,N as SESSION_STASH_COOKIE_NAME,Q as SESSION_STRATEGY_COOKIE_NAME,V as createAuth,e as createErrorRedirectUrl,x as createHandler,B as getSessionTokenFromRequest,D as handleError,b as htmlResponse,E as isImpersonating,M as isUserFacingRequest,W as json,X as parseCookies,Y as redirect,d as renderCancelledPage,g as renderErrorPage,l as renderSuccessPage,a as toClientSession};//# sourceMappingURL=index.js.map

package/dist/src/jwt/index.js

@@ -1 +1 @@
-import{sign as o,verify as r}from"../../chunk-RPFUKTQA.js";import"../../chunk-VB2ML4Q5.js";export{o as sign,r as verify};//# sourceMappingURL=index.js.map
+import{sign as o,verify as r}from"../../chunk-NHENQLYI.js";import"../../chunk-VB2ML4Q5.js";import"../../chunk-VXWI4D7H.js";export{o as sign,r as verify};//# sourceMappingURL=index.js.map

package/dist/src/oauth/index.d.ts

@@ -12,6 +12,17 @@ export interface OAuthProviderConfig {
     linkOnly?: boolean;
     params?: Record<string, string>;
 }
+export interface OAuthAuthorizationOptions<C = OAuthProviderConfig> {
+    scopes?: string[];
+    redirectUri?: string;
+    params?: Record<string, string>;
+    overrides?: ProviderProfileOverrides<C>;
+}
+export interface OAuthRefreshOptions<C = OAuthProviderConfig> {
+    redirectUri?: string;
+    scopes?: string[];
+    overrides?: ProviderProfileOverrides<C>;
+}
 export interface RefreshedTokens {
     accessToken: string;
     refreshToken?: string | null;
@@ -33,20 +44,11 @@ export interface OAuthProvider<T extends string = string, C = OAuthProviderConfi
     id: T;
     requiresRedirectUri?: boolean;
     linkOnly?: boolean;
-    getAuthorizationUrl: (state: string, codeVerifier: string, options?: {
-        scopes?: string[];
-        redirectUri?: string;
-        params?: Record<string, string>;
-        overrides?: ProviderProfileOverrides<C>;
-    }) => Promise<URL>;
+    getAuthorizationUrl: (state: string, codeVerifier: string, options?: OAuthAuthorizationOptions<C>) => Promise<URL>;
     validateCallback: (code: string, codeVerifier: string, redirectUri?: string, overrides?: ProviderProfileOverrides<C>) => Promise<{
         tokens: OAuth2Tokens;
         user: AuthUser;
     }>;
-    refreshAccessToken?: (refreshToken: string, options?: {
-        redirectUri?: string;
-        scopes?: string[];
-        overrides?: ProviderProfileOverrides<C>;
-    }) => Promise<RefreshedTokens>;
+    refreshAccessToken?: (refreshToken: string, options?: OAuthRefreshOptions<C>) => Promise<RefreshedTokens>;
 }
 //# sourceMappingURL=index.d.ts.map

package/dist/src/oauth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAA;AAE1C,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAEjD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACtB;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,aAAa,EAAE,OAAO,GAAG,IAAI,CAAA;IAC7B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC7B;AAED,MAAM,MAAM,wBAAwB,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;AAEjG,MAAM,WAAW,aAAa,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,mBAAmB;IAC/E,EAAE,EAAE,CAAC,CAAA;IACL,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,mBAAmB,EAAE,CACnB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,SAAS,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAA;KAAE,KAC5H,OAAO,CAAC,GAAG,CAAC,CAAA;IACjB,gBAAgB,EAAE,CAChB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,WAAW,CAAC,EAAE,MAAM,EACpB,SAAS,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC,KACpC,OAAO,CAAC;QAAE,MAAM,EAAE,YAAY,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAA;IACtD,kBAAkB,CAAC,EAAE,CACnB,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAA;KAAE,KAC3F,OAAO,CAAC,eAAe,CAAC,CAAA;CAC9B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAA;AAE1C,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAEjD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC;AAED,MAAM,WAAW,yBAAyB,CAAC,CAAC,GAAG,mBAAmB;IAChE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,SAAS,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAA;CACxC;AAED,MAAM,WAAW,mBAAmB,CAAC,CAAC,GAAG,mBAAmB;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,SAAS,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAA;CACxC;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACtB;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,aAAa,EAAE,OAAO,GAAG,IAAI,CAAA;IAC7B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC7B;AAED,MAAM,MAAM,wBAAwB,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;AAEjG,MAAM,WAAW,aAAa,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,mBAAmB;IAC/E,EAAE,EAAE,CAAC,CAAA;IACL,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,mBAAmB,EAAE,CACnB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,yBAAyB,CAAC,CAAC,CAAC,KACnC,OAAO,CAAC,GAAG,CAAC,CAAA;IACjB,gBAAgB,EAAE,CAChB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,WAAW,CAAC,EAAE,MAAM,EACpB,SAAS,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC,KACpC,OAAO,CAAC;QAAE,MAAM,EAAE,YAAY,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAA;IACtD,kBAAkB,CAAC,EAAE,CACnB,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,KAC7B,OAAO,CAAC,eAAe,CAAC,CAAA;CAC9B"}

package/dist/src/oauth/index.js

@@ -1 +1 @@
-import{CodeChallengeMethod as e,OAuth2Client as t}from"arctic";var r="https://discord.com/api/oauth2/token";function a(a){const i=new t(a.clientId,a.clientSecret,a.redirectUri??null);function n(e){return e&&e!==a.redirectUri?new t(a.clientId,a.clientSecret,e):i}return{id:"discord",linkOnly:a.linkOnly,requiresRedirectUri:!0,async getAuthorizationUrl(t,r,i){const o=n(i?.redirectUri),c=i?.scopes??a.scope??["identify","email"],s=await o.createAuthorizationURLWithPKCE("https://discord.com/api/oauth2/authorize",t,e.S256,r,c);if(i?.params)for(const[e,t]of Object.entries(i.params))null!=t&&s.searchParams.set(e,String(t));return s},async validateCallback(e,t,a){const i=n(a),o=await i.validateAuthorizationCode(r,e,t),c=await async function(e){const t=await fetch("https://discord.com/api/users/@me",{headers:{Authorization:`Bearer ${e}`,"User-Agent":"gau"}}),r=await t.json();return{id:r.id,name:r.username,email:r.email,emailVerified:r.verified,avatar:r.avatar?`https://cdn.discordapp.com/avatars/${r.id}/${r.avatar}.png`:null,raw:r}}(o.accessToken());return{tokens:o,user:c}},async refreshAccessToken(e){const t=new URLSearchParams({client_id:a.clientId,client_secret:a.clientSecret,grant_type:"refresh_token",refresh_token:e}),i=await fetch(r,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t}),n=await i.json();if(!i.ok)throw n;const o=n.expires_in,c="number"==typeof o?Math.floor(Date.now()/1e3)+Math.floor(o):void 0;return{accessToken:n.access_token,refreshToken:n.refresh_token??e,expiresAt:c??null,idToken:n.id_token??null,tokenType:n.token_type??null,scope:n.scope??null}}}}import{CodeChallengeMethod as i,OAuth2Client as n}from"arctic";function o(e){const t=new n(e.clientId,e.clientSecret,e.redirectUri??null);function r(r){return r&&r!==e.redirectUri?new n(e.clientId,e.clientSecret,r):t}return{id:"facebook",linkOnly:e.linkOnly,requiresRedirectUri:!0,async getAuthorizationUrl(t,a,n){const o=r(n?.redirectUri),c=n?.scopes??e.scope??["email","public_profile"],s=await o.createAuthorizationURLWithPKCE("https://www.facebook.com/dialog/oauth",t,i.S256,a,c),l={...e.params??{},...n?.params??{}};if(Object.keys(l).length)for(const[e,t]of Object.entries(l))null!=t&&s.searchParams.set(e,String(t));return s},async validateCallback(e,t,a){const i=r(a),n=await i.validateAuthorizationCode("https://graph.facebook.com/oauth/access_token",e,t),o=await async function(e){const t=new URLSearchParams;t.set("fields",["id","name","picture","email"].join(","));const r=await fetch(`https://graph.facebook.com/me?${t.toString()}`,{headers:{Authorization:`Bearer ${e}`}}),a=await r.json();let i=null;return"string"==typeof a.picture?i=a.picture:a.picture&&"object"==typeof a.picture&&"data"in a.picture&&(i=a.picture.data?.url??null),{id:String(a.id),name:a.name??"",email:a.email??null,emailVerified:!!a.email||null,avatar:i,raw:a}}(n.accessToken());return{tokens:n,user:o}}}}import{CodeChallengeMethod as c,OAuth2Client as s}from"arctic";var l="https://api.github.com";function d(e){const t=new s(e.clientId,e.clientSecret,e.redirectUri??null);function r(r){return r&&r!==e.redirectUri?new s(e.clientId,e.clientSecret,r):t}return{id:"github",linkOnly:e.linkOnly,requiresRedirectUri:!0,async getAuthorizationUrl(t,a,i){const n=r(i?.redirectUri),o=i?.scopes??e.scope??["read:user","user:email"],s=await n.createAuthorizationURLWithPKCE("https://github.com/login/oauth/authorize",t,c.S256,a,o);if(i?.params)for(const[e,t]of Object.entries(i.params))null!=t&&s.searchParams.set(e,String(t));return s},async validateCallback(e,t,a){const i=r(a),n=await i.validateAuthorizationCode("https://github.com/login/oauth/access_token",e,t),o=await async function(e){const t=await fetch(`${l}/user`,{headers:{Authorization:`Bearer ${e}`,"User-Agent":"gau",Accept:"application/vnd.github+json"}}),r=await t.json();let a=r.email,i=!1;const n=await fetch(`${l}/user/emails`,{headers:{Authorization:`Bearer ${e}`,"User-Agent":"gau",Accept:"application/vnd.github+json"}});if(n.ok){const e=await n.json(),t=e.find(e=>e.primary&&e.verified);if(t)a=t.email,i=!0;else{const t=e.find(e=>e.verified);t&&(a=t.email,i=!0)}}return{id:r.id.toString(),name:r.name??r.login,email:a,emailVerified:i,avatar:r.avatar_url,raw:r}}(n.accessToken());return{tokens:n,user:o}}}}import{CodeChallengeMethod as u,OAuth2Client as h}from"arctic";var p="https://oauth2.googleapis.com/token";function m(e){const t=new h(e.clientId,e.clientSecret,e.redirectUri??null);function r(r){return r&&r!==e.redirectUri?new h(e.clientId,e.clientSecret,r):t}return{id:"google",linkOnly:e.linkOnly,requiresRedirectUri:!0,async getAuthorizationUrl(t,a,i){const n=r(i?.redirectUri),o=i?.scopes??e.scope??["openid","email","profile"],c=await n.createAuthorizationURLWithPKCE("https://accounts.google.com/o/oauth2/v2/auth",t,u.S256,a,o);if(i?.params)for(const[e,t]of Object.entries(i.params))null!=t&&c.searchParams.set(e,String(t));return c},async validateCallback(e,t,a){const i=r(a),n=await i.validateAuthorizationCode(p,e,t),o=await async function(e){const t=await fetch("https://openidconnect.googleapis.com/v1/userinfo",{headers:{Authorization:`Bearer ${e}`,"User-Agent":"gau"}}),r=await t.json();return{id:r.sub,name:r.name,email:r.email,emailVerified:r.email_verified,avatar:r.picture,raw:r}}(n.accessToken());return{tokens:n,user:o}},async refreshAccessToken(t){const r=new URLSearchParams({client_id:e.clientId,client_secret:e.clientSecret,grant_type:"refresh_token",refresh_token:t}),a=await fetch(p,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:r}),i=await a.json();if(!a.ok)throw i;const n=i.expires_in,o="number"==typeof n?Math.floor(Date.now()/1e3)+Math.floor(n):void 0;return{accessToken:i.access_token,refreshToken:i.refresh_token??t,expiresAt:o??null,idToken:i.id_token??null,tokenType:i.token_type??null,scope:i.scope??null}}}}import{CodeChallengeMethod as f,OAuth2Client as k}from"arctic";async function w(e,t){const r=await fetch("https://graph.microsoft.com/v1.0/me",{headers:{Authorization:`Bearer ${e}`}}),a=await r.json();let i=a.mail??a.userPrincipalName,n=!1;if(t)try{const e=t.split("."),r=JSON.parse((new TextDecoder).decode(function(e){const t=e.replace(/-/g,"+").replace(/_/g,"/"),r=(4-t.length%4)%4,a=t.padEnd(t.length+r,"="),i=atob(a),n=i.length,o=new Uint8Array(n);for(let e=0;e<n;e++)o[e]=i.charCodeAt(e);return o}(e[1]))),a="9188040d-6c67-4c5b-b112-36a304b66dad";if(r.verified_primary_email){const e=Array.isArray(r.verified_primary_email)?r.verified_primary_email[0]:r.verified_primary_email;"string"==typeof e&&(i=e,n=!0)}else(r.tid===a||!0===r.xms_edov)&&(i=r.email??i,n=!0)}catch{}const o=await fetch("https://graph.microsoft.com/v1.0/me/photo/$value",{headers:{Authorization:`Bearer ${e}`}});let c=null;if(o.ok)try{const e=await o.blob(),t=new FileReader,r=new Promise((r,a)=>{t.onloadend=()=>r(t.result),t.onerror=a,t.readAsDataURL(e)});c=await r}catch{}return{id:a.id,name:a.displayName,email:i,emailVerified:n,avatar:c,raw:a}}function y(e){const t=e=>({authURL:`https://login.microsoftonline.com/${e}/oauth2/v2.0/authorize`,tokenURL:`https://login.microsoftonline.com/${e}/oauth2/v2.0/token`}),r=new k(e.clientId,e.clientSecret,e.redirectUri??null);function a(t){return t&&t!==e.redirectUri?new k(e.clientId,e.clientSecret,t):r}return{id:"microsoft",linkOnly:e.linkOnly,requiresRedirectUri:!0,async getAuthorizationUrl(r,i,n){const o=a(n?.redirectUri),c=n?.scopes??e.scope??["openid","profile","email","User.Read"],s=n?.overrides?.tenant??e.tenant??"common",{authURL:l}=t(s),d=await o.createAuthorizationURLWithPKCE(l,r,f.S256,i,c),u=n?.overrides?.prompt??n?.params?.prompt??e.prompt;u&&d.searchParams.set("prompt",u);const h={...e.params??{},...n?.params??{}};if(Object.keys(h).length)for(const[e,t]of Object.entries(h))"prompt"!==e&&null!=t&&d.searchParams.set(e,String(t));return d},async validateCallback(r,i,n,o){const c=a(n),s=o?.tenant??e.tenant??"common",{tokenURL:l}=t(s),d=await c.validateAuthorizationCode(l,r,i),u=await w(d.accessToken(),d.idToken());return{tokens:d,user:u}},async refreshAccessToken(r,a){const i=a?.overrides?.tenant??e.tenant??"common",{tokenURL:n}=t(i),o=new URLSearchParams({client_id:e.clientId,client_secret:e.clientSecret,grant_type:"refresh_token",refresh_token:r,scope:(e.scope??["openid","profile","email","User.Read"]).join(" ")}),c=await fetch(n,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:o}),s=await c.json();if(!c.ok)throw s;const l=s.expires_in,d="number"==typeof l?Math.floor(Date.now()/1e3)+Math.floor(l):void 0;return{accessToken:s.access_token,refreshToken:s.refresh_token??r,expiresAt:d??null,idToken:s.id_token??null,tokenType:s.token_type??null,scope:s.scope??null}}}}export{a as Discord,o as Facebook,d as GitHub,m as Google,y as Microsoft};//# sourceMappingURL=index.js.map
+import{createOAuthAuthorizationUrl as e,createOAuthClientResolver as a,mergeOAuthParams as t,refreshOAuthAccessToken as i}from"../../chunk-VXWI4D7H.js";var r="https://discord.com/api/oauth2/token";function o(t){const o=a(t);return{id:"discord",linkOnly:t.linkOnly,requiresRedirectUri:!0,async getAuthorizationUrl(a,i,r){const n=r?.scopes??t.scope??["identify","email"];return e({client:o(r?.redirectUri),authorizationUrl:"https://discord.com/api/oauth2/authorize",state:a,codeVerifier:i,scopes:n,configParams:t.params,params:r?.params})},async validateCallback(e,a,t){const i=o(t),n=await i.validateAuthorizationCode(r,e,a),s=await async function(e){const a=await fetch("https://discord.com/api/users/@me",{headers:{Authorization:`Bearer ${e}`,"User-Agent":"gau"}}),t=await a.json();return{id:t.id,name:t.username,email:t.email,emailVerified:t.verified,avatar:t.avatar?`https://cdn.discordapp.com/avatars/${t.id}/${t.avatar}.png`:null,raw:t}}(n.accessToken());return{tokens:n,user:s}},refreshAccessToken:async e=>i({tokenUrl:r,clientId:t.clientId,clientSecret:t.clientSecret,refreshToken:e})}}function n(t){const i=a(t);return{id:"facebook",linkOnly:t.linkOnly,requiresRedirectUri:!0,async getAuthorizationUrl(a,r,o){const n=o?.scopes??t.scope??["email","public_profile"];return e({client:i(o?.redirectUri),authorizationUrl:"https://www.facebook.com/dialog/oauth",state:a,codeVerifier:r,scopes:n,configParams:t.params,params:o?.params})},async validateCallback(e,a,t){const r=i(t),o=await r.validateAuthorizationCode("https://graph.facebook.com/oauth/access_token",e,a),n=await async function(e){const a=new URLSearchParams;a.set("fields",["id","name","picture","email"].join(","));const t=await fetch(`https://graph.facebook.com/me?${a.toString()}`,{headers:{Authorization:`Bearer ${e}`}}),i=await t.json();let r=null;return"string"==typeof i.picture?r=i.picture:i.picture&&"object"==typeof i.picture&&"data"in i.picture&&(r=i.picture.data?.url??null),{id:String(i.id),name:i.name??"",email:i.email??null,emailVerified:!!i.email||null,avatar:r,raw:i}}(o.accessToken());return{tokens:o,user:n}}}}var s="https://api.github.com";function c(t){const i=a(t);return{id:"github",linkOnly:t.linkOnly,requiresRedirectUri:!0,async getAuthorizationUrl(a,r,o){const n=o?.scopes??t.scope??["read:user","user:email"];return e({client:i(o?.redirectUri),authorizationUrl:"https://github.com/login/oauth/authorize",state:a,codeVerifier:r,scopes:n,configParams:t.params,params:o?.params})},async validateCallback(e,a,t){const r=i(t),o=await r.validateAuthorizationCode("https://github.com/login/oauth/access_token",e,a),n=await async function(e){const a=await fetch(`${s}/user`,{headers:{Authorization:`Bearer ${e}`,"User-Agent":"gau",Accept:"application/vnd.github+json"}}),t=await a.json();let i=t.email,r=!1;const o=await fetch(`${s}/user/emails`,{headers:{Authorization:`Bearer ${e}`,"User-Agent":"gau",Accept:"application/vnd.github+json"}});if(o.ok){const e=await o.json(),a=e.find(e=>e.primary&&e.verified);if(a)i=a.email,r=!0;else{const a=e.find(e=>e.verified);a&&(i=a.email,r=!0)}}return{id:t.id.toString(),name:t.name??t.login,email:i,emailVerified:r,avatar:t.avatar_url,raw:t}}(o.accessToken());return{tokens:o,user:n}}}}var l="https://oauth2.googleapis.com/token";function u(t){const r=a(t);return{id:"google",linkOnly:t.linkOnly,requiresRedirectUri:!0,async getAuthorizationUrl(a,i,o){const n=o?.scopes??t.scope??["openid","email","profile"];return e({client:r(o?.redirectUri),authorizationUrl:"https://accounts.google.com/o/oauth2/v2/auth",state:a,codeVerifier:i,scopes:n,configParams:t.params,params:o?.params})},async validateCallback(e,a,t){const i=r(t),o=await i.validateAuthorizationCode(l,e,a),n=await async function(e){const a=await fetch("https://openidconnect.googleapis.com/v1/userinfo",{headers:{Authorization:`Bearer ${e}`,"User-Agent":"gau"}}),t=await a.json();return{id:t.sub,name:t.name,email:t.email,emailVerified:t.email_verified,avatar:t.picture,raw:t}}(o.accessToken());return{tokens:o,user:n}},refreshAccessToken:async e=>i({tokenUrl:l,clientId:t.clientId,clientSecret:t.clientSecret,refreshToken:e})}}async function d(e,a){const t=await fetch("https://graph.microsoft.com/v1.0/me",{headers:{Authorization:`Bearer ${e}`}}),i=await t.json();let r=i.mail??i.userPrincipalName,o=!1;if(a)try{const e=a.split("."),t=JSON.parse((new TextDecoder).decode(function(e){const a=e.replace(/-/g,"+").replace(/_/g,"/"),t=(4-a.length%4)%4,i=a.padEnd(a.length+t,"="),r=atob(i),o=r.length,n=new Uint8Array(o);for(let e=0;e<o;e++)n[e]=r.charCodeAt(e);return n}(e[1]))),i="9188040d-6c67-4c5b-b112-36a304b66dad";if(t.verified_primary_email){const e=Array.isArray(t.verified_primary_email)?t.verified_primary_email[0]:t.verified_primary_email;"string"==typeof e&&(r=e,o=!0)}else(t.tid===i||!0===t.xms_edov)&&(r=t.email??r,o=!0)}catch{}const n=await fetch("https://graph.microsoft.com/v1.0/me/photo/$value",{headers:{Authorization:`Bearer ${e}`}});let s=null;if(n.ok)try{const e=await n.blob(),a=new FileReader,t=new Promise((t,i)=>{a.onloadend=()=>t(a.result),a.onerror=i,a.readAsDataURL(e)});s=await t}catch{}return{id:i.id,name:i.displayName,email:r,emailVerified:o,avatar:s,raw:i}}function m(r){const o=e=>({authURL:`https://login.microsoftonline.com/${e}/oauth2/v2.0/authorize`,tokenURL:`https://login.microsoftonline.com/${e}/oauth2/v2.0/token`}),n=a(r);return{id:"microsoft",linkOnly:r.linkOnly,requiresRedirectUri:!0,async getAuthorizationUrl(a,i,s){const c=s?.scopes??r.scope??["openid","profile","email","User.Read"],l=s?.overrides?.tenant??r.tenant??"common",{authURL:u}=o(l),d=t(r.params,s?.params),m=s?.overrides?.prompt??d.prompt??r.prompt;return e({client:n(s?.redirectUri),authorizationUrl:u,state:a,codeVerifier:i,scopes:c,configParams:r.params,params:s?.params,omitParamKeys:["prompt"],extraParams:m?{prompt:m}:void 0})},async validateCallback(e,a,t,i){const s=n(t),c=i?.tenant??r.tenant??"common",{tokenURL:l}=o(c),u=await s.validateAuthorizationCode(l,e,a),m=await d(u.accessToken(),u.idToken());return{tokens:u,user:m}},async refreshAccessToken(e,a){const t=a?.overrides?.tenant??r.tenant??"common",{tokenURL:n}=o(t);return i({tokenUrl:n,clientId:r.clientId,clientSecret:r.clientSecret,refreshToken:e,scopes:a?.scopes??r.scope??["openid","profile","email","User.Read"]})}}}export{o as Discord,n as Facebook,c as GitHub,u as Google,m as Microsoft};//# sourceMappingURL=index.js.map

package/dist/src/oauth/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth/providers/discord.ts","../../../src/oauth/providers/facebook.ts","../../../src/oauth/providers/github.ts","../../../src/oauth/providers/google.ts","../../../src/oauth/providers/microsoft.ts"],"sourcesContent":["import type { AuthUser, OAuthProvider, OAuthProviderConfig, RefreshedTokens } from '../index'\nimport { CodeChallengeMethod, OAuth2Client } from 'arctic'\n\nconst DISCORD_AUTH_URL = 'https://discord.com/api/oauth2/authorize'\nconst DISCORD_TOKEN_URL = 'https://discord.com/api/oauth2/token'\nconst DISCORD_USER_URL = 'https://discord.com/api/users/@me'\n\ninterface DiscordUser {\n  id: string\n  username: string\n  discriminator: string\n  avatar: string | null\n  email: string | null\n  verified: boolean\n  [key: string]: unknown\n}\n\nasync function getUser(accessToken: string): Promise<AuthUser> {\n  const response = await fetch(DISCORD_USER_URL, {\n    headers: {\n      'Authorization': `Bearer ${accessToken}`,\n      'User-Agent': 'gau',\n    },\n  })\n  const data: DiscordUser = await response.json()\n  return {\n    id: data.id,\n    name: data.username,\n    email: data.email,\n    emailVerified: data.verified,\n    avatar: data.avatar ? `https://cdn.discordapp.com/avatars/${data.id}/${data.avatar}.png` : null,\n    raw: data,\n  }\n}\n\nexport function Discord(config: OAuthProviderConfig): OAuthProvider<'discord'> {\n  const defaultClient = new OAuth2Client(config.clientId, config.clientSecret, config.redirectUri ?? null)\n  function getClient(redirectUri?: string): OAuth2Client {\n    if (!redirectUri || redirectUri === config.redirectUri)\n      return defaultClient\n    return new OAuth2Client(config.clientId, config.clientSecret, redirectUri)\n  }\n  return {\n    id: 'discord',\n    linkOnly: config.linkOnly,\n    requiresRedirectUri: true,\n    async getAuthorizationUrl(state: string, codeVerifier: string, options?: { scopes?: string[], redirectUri?: string, params?: Record<string, string>, overrides?: any }) {\n      const client = getClient(options?.redirectUri)\n      const scopes = options?.scopes ?? config.scope ?? ['identify', 'email']\n      const url = await client.createAuthorizationURLWithPKCE(DISCORD_AUTH_URL, state, CodeChallengeMethod.S256, codeVerifier, scopes)\n      if (options?.params) {\n        for (const [k, v] of Object.entries(options.params)) {\n          if (v != null)\n            url.searchParams.set(k, String(v))\n        }\n      }\n      return url\n    },\n    async validateCallback(code: string, codeVerifier: string, redirectUri?: string) {\n      const client = getClient(redirectUri)\n      const tokens = await client.validateAuthorizationCode(DISCORD_TOKEN_URL, code, codeVerifier)\n      const user = await getUser(tokens.accessToken())\n      return { tokens, user }\n    },\n    async refreshAccessToken(refreshToken: string): Promise<RefreshedTokens> {\n      const body = new URLSearchParams({\n        client_id: config.clientId,\n        client_secret: config.clientSecret,\n        grant_type: 'refresh_token',\n        refresh_token: refreshToken,\n      })\n      const res = await fetch(DISCORD_TOKEN_URL, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n        },\n        body,\n      })\n      const json = await res.json()\n      if (!res.ok)\n        throw json\n      const expiresIn: number | undefined = json.expires_in\n      const expiresAt = typeof expiresIn === 'number' ? Math.floor(Date.now() / 1000) + Math.floor(expiresIn) : undefined\n      return {\n        accessToken: json.access_token,\n        refreshToken: json.refresh_token ?? refreshToken,\n        expiresAt: expiresAt ?? null,\n        idToken: json.id_token ?? null,\n        tokenType: json.token_type ?? null,\n        scope: json.scope ?? null,\n      }\n    },\n  }\n}\n","import type { AuthUser, OAuthProvider, OAuthProviderConfig } from '../index'\nimport { CodeChallengeMethod, OAuth2Client } from 'arctic'\n\nconst FB_GRAPH_ME_URL = 'https://graph.facebook.com/me'\nconst FB_AUTH_URL = 'https://www.facebook.com/dialog/oauth'\nconst FB_TOKEN_URL = 'https://graph.facebook.com/oauth/access_token'\n\ninterface FacebookUserResponse {\n  id: string\n  name?: string | null\n  email?: string | null\n  picture?: { data?: { url?: string | null } } | string | null\n  [key: string]: unknown\n}\n\nasync function getUser(accessToken: string): Promise<AuthUser> {\n  const searchParams = new URLSearchParams()\n  searchParams.set('fields', ['id', 'name', 'picture', 'email'].join(','))\n\n  const response = await fetch(`${FB_GRAPH_ME_URL}?${searchParams.toString()}`, {\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n    },\n  })\n  const data: FacebookUserResponse = await response.json()\n\n  let avatar: string | null = null\n  if (typeof data.picture === 'string')\n    avatar = data.picture\n  else if (data.picture && typeof data.picture === 'object' && 'data' in data.picture)\n    avatar = data.picture.data?.url ?? null\n\n  return {\n    id: String(data.id),\n    name: data.name ?? '',\n    email: data.email ?? null,\n    emailVerified: data.email ? true : null,\n    avatar,\n    raw: data,\n  }\n}\n\nexport function Facebook(config: OAuthProviderConfig): OAuthProvider<'facebook', OAuthProviderConfig> {\n  const defaultClient = new OAuth2Client(config.clientId, config.clientSecret, config.redirectUri ?? null)\n\n  function getClient(redirectUri?: string): OAuth2Client {\n    if (!redirectUri || redirectUri === config.redirectUri)\n      return defaultClient\n    return new OAuth2Client(config.clientId, config.clientSecret, redirectUri)\n  }\n\n  return {\n    id: 'facebook',\n    linkOnly: config.linkOnly,\n    requiresRedirectUri: true,\n\n    async getAuthorizationUrl(state, codeVerifier, options) {\n      const client = getClient(options?.redirectUri)\n      const scopes = options?.scopes ?? config.scope ?? ['email', 'public_profile']\n      const url = await client.createAuthorizationURLWithPKCE(\n        FB_AUTH_URL,\n        state,\n        CodeChallengeMethod.S256,\n        codeVerifier,\n        scopes,\n      )\n      const mergedParams = { ...(config.params ?? {}), ...(options?.params ?? {}) }\n      if (Object.keys(mergedParams).length) {\n        for (const [k, v] of Object.entries(mergedParams)) {\n          if (v != null)\n            url.searchParams.set(k, String(v))\n        }\n      }\n      return url\n    },\n\n    async validateCallback(code, codeVerifier, redirectUri) {\n      const client = getClient(redirectUri)\n      const tokens = await client.validateAuthorizationCode(FB_TOKEN_URL, code, codeVerifier)\n      const user = await getUser(tokens.accessToken())\n      return { tokens, user }\n    },\n  }\n}\n","import type { AuthUser, OAuthProvider, OAuthProviderConfig } from '../index'\nimport { CodeChallengeMethod, OAuth2Client } from 'arctic'\n\nconst GITHUB_AUTH_URL = 'https://github.com/login/oauth/authorize'\nconst GITHUB_TOKEN_URL = 'https://github.com/login/oauth/access_token'\nconst GITHUB_API_URL = 'https://api.github.com'\n\ninterface GitHubUser {\n  id: number\n  login: string\n  avatar_url: string\n  name: string\n  email: string | null\n  [key: string]: unknown\n}\n\ninterface GitHubEmail {\n  email: string\n  primary: boolean\n  verified: boolean\n  visibility: 'public' | 'private' | null\n}\n\nasync function getUser(accessToken: string): Promise<AuthUser> {\n  const response = await fetch(`${GITHUB_API_URL}/user`, {\n    headers: {\n      'Authorization': `Bearer ${accessToken}`,\n      'User-Agent': 'gau',\n      'Accept': 'application/vnd.github+json',\n    },\n  })\n  const data: GitHubUser = await response.json()\n\n  let email: string | null = data.email\n  let emailVerified = false\n\n  const emailsResponse = await fetch(`${GITHUB_API_URL}/user/emails`, {\n    headers: {\n      'Authorization': `Bearer ${accessToken}`,\n      'User-Agent': 'gau',\n      'Accept': 'application/vnd.github+json',\n    },\n  })\n\n  if (emailsResponse.ok) {\n    const emails: GitHubEmail[] = await emailsResponse.json()\n    const primaryEmail = emails.find(e => e.primary && e.verified)\n    if (primaryEmail) {\n      email = primaryEmail.email\n      emailVerified = true\n    }\n    else {\n      // Fallback to the first verified email if no primary is found\n      const verifiedEmail = emails.find(e => e.verified)\n      if (verifiedEmail) {\n        email = verifiedEmail.email\n        emailVerified = true\n      }\n    }\n  }\n\n  return {\n    id: data.id.toString(),\n    name: data.name ?? data.login,\n    email,\n    emailVerified,\n    avatar: data.avatar_url,\n    raw: data,\n  }\n}\n\nexport function GitHub(config: OAuthProviderConfig): OAuthProvider<'github', OAuthProviderConfig> {\n  const defaultClient = new OAuth2Client(config.clientId, config.clientSecret, config.redirectUri ?? null)\n\n  function getClient(redirectUri?: string): OAuth2Client {\n    if (!redirectUri || redirectUri === config.redirectUri)\n      return defaultClient\n\n    return new OAuth2Client(config.clientId, config.clientSecret, redirectUri)\n  }\n\n  return {\n    id: 'github',\n    linkOnly: config.linkOnly,\n    requiresRedirectUri: true,\n\n    async getAuthorizationUrl(state: string, codeVerifier: string, options?: { scopes?: string[], redirectUri?: string, params?: Record<string, string>, overrides?: any }) {\n      const client = getClient(options?.redirectUri)\n      const scopes = options?.scopes ?? config.scope ?? ['read:user', 'user:email']\n      const url = await client.createAuthorizationURLWithPKCE(GITHUB_AUTH_URL, state, CodeChallengeMethod.S256, codeVerifier, scopes)\n      if (options?.params) {\n        for (const [k, v] of Object.entries(options.params)) {\n          if (v != null)\n            url.searchParams.set(k, String(v))\n        }\n      }\n      return url\n    },\n\n    async validateCallback(code: string, codeVerifier: string, redirectUri?: string) {\n      const client = getClient(redirectUri)\n      const tokens = await client.validateAuthorizationCode(GITHUB_TOKEN_URL, code, codeVerifier)\n      const user = await getUser(tokens.accessToken())\n      return { tokens, user }\n    },\n  }\n}\n","import type { AuthUser, OAuthProvider, OAuthProviderConfig, RefreshedTokens } from '../index'\nimport { CodeChallengeMethod, OAuth2Client } from 'arctic'\n\nconst GOOGLE_AUTH_URL = 'https://accounts.google.com/o/oauth2/v2/auth'\nconst GOOGLE_TOKEN_URL = 'https://oauth2.googleapis.com/token'\nconst GOOGLE_USERINFO_URL = 'https://openidconnect.googleapis.com/v1/userinfo'\n\ninterface GoogleUser {\n  sub: string\n  name: string\n  email: string | null\n  email_verified: boolean\n  picture: string | null\n  [key: string]: unknown\n}\n\nasync function getUser(accessToken: string): Promise<AuthUser> {\n  const response = await fetch(GOOGLE_USERINFO_URL, {\n    headers: {\n      'Authorization': `Bearer ${accessToken}`,\n      'User-Agent': 'gau',\n    },\n  })\n  const data: GoogleUser = await response.json()\n\n  return {\n    id: data.sub,\n    name: data.name,\n    email: data.email,\n    emailVerified: data.email_verified,\n    avatar: data.picture,\n    raw: data,\n  }\n}\n\nexport function Google(config: OAuthProviderConfig): OAuthProvider<'google'> {\n  const defaultClient = new OAuth2Client(config.clientId, config.clientSecret, config.redirectUri ?? null)\n\n  function getClient(redirectUri?: string): OAuth2Client {\n    if (!redirectUri || redirectUri === config.redirectUri)\n      return defaultClient\n\n    return new OAuth2Client(config.clientId, config.clientSecret, redirectUri)\n  }\n\n  return {\n    id: 'google',\n    linkOnly: config.linkOnly,\n    requiresRedirectUri: true,\n\n    async getAuthorizationUrl(state: string, codeVerifier: string, options?: { scopes?: string[], redirectUri?: string, params?: Record<string, string>, overrides?: any }) {\n      const client = getClient(options?.redirectUri)\n      const scopes = options?.scopes ?? config.scope ?? ['openid', 'email', 'profile']\n      const url = await client.createAuthorizationURLWithPKCE(GOOGLE_AUTH_URL, state, CodeChallengeMethod.S256, codeVerifier, scopes)\n      if (options?.params) {\n        for (const [k, v] of Object.entries(options.params)) {\n          if (v != null)\n            url.searchParams.set(k, String(v))\n        }\n      }\n      return url\n    },\n\n    async validateCallback(code: string, codeVerifier: string, redirectUri?: string) {\n      const client = getClient(redirectUri)\n      const tokens = await client.validateAuthorizationCode(GOOGLE_TOKEN_URL, code, codeVerifier)\n      const user = await getUser(tokens.accessToken())\n      return { tokens, user }\n    },\n\n    async refreshAccessToken(refreshToken: string): Promise<RefreshedTokens> {\n      const body = new URLSearchParams({\n        client_id: config.clientId,\n        client_secret: config.clientSecret,\n        grant_type: 'refresh_token',\n        refresh_token: refreshToken,\n      })\n      const res = await fetch(GOOGLE_TOKEN_URL, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n        },\n        body,\n      })\n      const json = await res.json() as any\n      if (!res.ok)\n        throw json\n\n      const expiresIn: number | undefined = json.expires_in\n      const expiresAt = typeof expiresIn === 'number' ? Math.floor(Date.now() / 1000) + Math.floor(expiresIn) : undefined\n\n      return {\n        accessToken: json.access_token,\n        refreshToken: json.refresh_token ?? refreshToken,\n        expiresAt: expiresAt ?? null,\n        idToken: json.id_token ?? null,\n        tokenType: json.token_type ?? null,\n        scope: json.scope ?? null,\n      }\n    },\n  }\n}\n","import type { AuthUser, OAuthProvider, OAuthProviderConfig, RefreshedTokens } from '../index'\nimport { CodeChallengeMethod, OAuth2Client } from 'arctic'\n\n// https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc\nconst MICROSOFT_USER_INFO_URL = 'https://graph.microsoft.com/v1.0/me'\n\n// https://learn.microsoft.com/en-us/graph/api/profilephoto-get?view=graph-rest-1.0\nconst MICROSOFT_USER_PHOTO_URL = 'https://graph.microsoft.com/v1.0/me/photo/$value'\n\n// https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow#request-an-authorization-code\ninterface MicrosoftConfig extends OAuthProviderConfig {\n  tenant?: 'common' | 'organizations' | 'consumers' | (string & {})\n  prompt?: 'login' | 'none' | 'consent' | 'select_account' | (string & {})\n}\n\ninterface MicrosoftUser {\n  id: string\n  displayName: string\n  mail: string | null\n  userPrincipalName: string\n  [key: string]: unknown\n}\n\nfunction base64url_decode(str: string): Uint8Array {\n  const base64 = str.replace(/-/g, '+').replace(/_/g, '/')\n  const padLength = (4 - (base64.length % 4)) % 4\n  const padded = base64.padEnd(base64.length + padLength, '=')\n  const binary_string = atob(padded)\n  const len = binary_string.length\n  const bytes = new Uint8Array(len)\n  for (let i = 0; i < len; i++)\n    bytes[i] = binary_string.charCodeAt(i)\n\n  return bytes\n}\n\nasync function getUser(accessToken: string, idToken: string | null): Promise<AuthUser> {\n  const userResponse = await fetch(MICROSOFT_USER_INFO_URL, {\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n    },\n  })\n  const userData: MicrosoftUser = await userResponse.json()\n\n  let email: string | null = userData.mail ?? userData.userPrincipalName\n  let emailVerified = false\n  if (idToken) {\n    try {\n      const parts = idToken.split('.')\n      const payload = JSON.parse(new TextDecoder().decode(base64url_decode(parts[1]!))) as Record<string, any>\n      const personalTenantId = '9188040d-6c67-4c5b-b112-36a304b66dad'\n\n      // For work/school accounts, the `verified_primary_email` is the source of truth.\n      if (payload.verified_primary_email) {\n        const primaryEmail = Array.isArray(payload.verified_primary_email)\n          ? payload.verified_primary_email[0]\n          : payload.verified_primary_email\n\n        if (typeof primaryEmail === 'string') {\n          email = primaryEmail\n          emailVerified = true\n        }\n      }\n      // For personal accounts, the `email` claim is reliable and verified.\n      else if (payload.tid === personalTenantId) {\n        email = payload.email ?? email\n        emailVerified = true\n      }\n      // Legacy fallback for `xms_edov`.\n      else if (payload.xms_edov === true) {\n        email = payload.email ?? email\n        emailVerified = true\n      }\n    }\n    catch {\n    }\n  }\n\n  const photoResponse = await fetch(MICROSOFT_USER_PHOTO_URL, {\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n    },\n  })\n\n  let avatar: string | null = null\n  if (photoResponse.ok) {\n    try {\n      const blob = await photoResponse.blob()\n      const reader = new FileReader()\n      const dataUrlPromise = new Promise<string>((resolve, reject) => {\n        reader.onloadend = () => resolve(reader.result as string)\n        reader.onerror = reject\n        reader.readAsDataURL(blob)\n      })\n      avatar = await dataUrlPromise\n    }\n    catch {\n    }\n  }\n\n  return {\n    id: userData.id,\n    name: userData.displayName,\n    email,\n    emailVerified,\n    avatar,\n    raw: userData,\n  }\n}\n\nexport function Microsoft(config: MicrosoftConfig): OAuthProvider<'microsoft', MicrosoftConfig> {\n  const getEndpoints = (tenant: MicrosoftConfig['tenant']) => ({\n    authURL: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/authorize`,\n    tokenURL: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`,\n  })\n\n  const defaultClient = new OAuth2Client(config.clientId, config.clientSecret, config.redirectUri ?? null)\n\n  function getClient(redirectUri?: string): OAuth2Client {\n    if (!redirectUri || redirectUri === config.redirectUri)\n      return defaultClient\n\n    return new OAuth2Client(config.clientId, config.clientSecret, redirectUri)\n  }\n\n  return {\n    id: 'microsoft',\n    linkOnly: config.linkOnly,\n    requiresRedirectUri: true,\n\n    async getAuthorizationUrl(state: string, codeVerifier: string, options?: { scopes?: string[], redirectUri?: string, params?: Record<string, string>, overrides?: Partial<Pick<MicrosoftConfig, 'tenant' | 'prompt'>> }) {\n      const client = getClient(options?.redirectUri)\n      const scopes = options?.scopes ?? config.scope ?? ['openid', 'profile', 'email', 'User.Read']\n      const effectiveTenant: MicrosoftConfig['tenant'] = options?.overrides?.tenant ?? config.tenant ?? 'common'\n      const { authURL } = getEndpoints(effectiveTenant)\n      const url = await client.createAuthorizationURLWithPKCE(authURL, state, CodeChallengeMethod.S256, codeVerifier, scopes)\n      const prompt = options?.overrides?.prompt ?? options?.params?.prompt ?? config.prompt\n      if (prompt)\n        url.searchParams.set('prompt', prompt)\n      const mergedParams = { ...(config.params ?? {}), ...(options?.params ?? {}) }\n      if (Object.keys(mergedParams).length) {\n        for (const [k, v] of Object.entries(mergedParams)) {\n          if (k === 'prompt')\n            continue\n          if (v != null)\n            url.searchParams.set(k, String(v))\n        }\n      }\n      return url\n    },\n\n    async validateCallback(code: string, codeVerifier: string, redirectUri?: string, overrides?: Partial<Pick<MicrosoftConfig, 'tenant'>>) {\n      const client = getClient(redirectUri)\n      const effectiveTenant: MicrosoftConfig['tenant'] = overrides?.tenant ?? config.tenant ?? 'common'\n      const { tokenURL } = getEndpoints(effectiveTenant)\n      const tokens = await client.validateAuthorizationCode(tokenURL, code, codeVerifier)\n      const user = await getUser(tokens.accessToken(), tokens.idToken())\n      return { tokens, user }\n    },\n\n    async refreshAccessToken(refreshToken: string, options?: { overrides?: Partial<Pick<MicrosoftConfig, 'tenant'>> }): Promise<RefreshedTokens> {\n      const effectiveTenant: MicrosoftConfig['tenant'] = options?.overrides?.tenant ?? config.tenant ?? 'common'\n      const { tokenURL } = getEndpoints(effectiveTenant)\n      const body = new URLSearchParams({\n        client_id: config.clientId,\n        client_secret: config.clientSecret,\n        grant_type: 'refresh_token',\n        refresh_token: refreshToken,\n        scope: (config.scope ?? ['openid', 'profile', 'email', 'User.Read']).join(' '),\n      })\n      const res = await fetch(tokenURL, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n        },\n        body,\n      })\n      const json = await res.json() as any\n      if (!res.ok)\n        throw json\n\n      const expiresIn: number | undefined = json.expires_in\n      const expiresAt = typeof expiresIn === 'number' ? Math.floor(Date.now() / 1000) + Math.floor(expiresIn) : undefined\n\n      return {\n        accessToken: json.access_token,\n        refreshToken: json.refresh_token ?? refreshToken,\n        expiresAt: expiresAt ?? null,\n        idToken: json.id_token ?? null,\n        tokenType: json.token_type ?? null,\n        scope: json.scope ?? null,\n      }\n    },\n  }\n}\n"],"mappings":";AACA,SAAS,qBAAqB,oBAAoB;AAElD,IAAM,mBAAmB;AACzB,IAAM,oBAAoB;AAC1B,IAAM,mBAAmB;AAYzB,eAAe,QAAQ,aAAwC;AAC7D,QAAM,WAAW,MAAM,MAAM,kBAAkB;AAAA,IAC7C,SAAS;AAAA,MACP,iBAAiB,UAAU,WAAW;AAAA,MACtC,cAAc;AAAA,IAChB;AAAA,EACF,CAAC;AACD,QAAM,OAAoB,MAAM,SAAS,KAAK;AAC9C,SAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT,MAAM,KAAK;AAAA,IACX,OAAO,KAAK;AAAA,IACZ,eAAe,KAAK;AAAA,IACpB,QAAQ,KAAK,SAAS,sCAAsC,KAAK,EAAE,IAAI,KAAK,MAAM,SAAS;AAAA,IAC3F,KAAK;AAAA,EACP;AACF;AAEO,SAAS,QAAQ,QAAuD;AAC7E,QAAM,gBAAgB,IAAI,aAAa,OAAO,UAAU,OAAO,cAAc,OAAO,eAAe,IAAI;AACvG,WAAS,UAAU,aAAoC;AACrD,QAAI,CAAC,eAAe,gBAAgB,OAAO;AACzC,aAAO;AACT,WAAO,IAAI,aAAa,OAAO,UAAU,OAAO,cAAc,WAAW;AAAA,EAC3E;AACA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,UAAU,OAAO;AAAA,IACjB,qBAAqB;AAAA,IACrB,MAAM,oBAAoB,OAAe,cAAsB,SAAyG;AACtK,YAAM,SAAS,UAAU,SAAS,WAAW;AAC7C,YAAM,SAAS,SAAS,UAAU,OAAO,SAAS,CAAC,YAAY,OAAO;AACtE,YAAM,MAAM,MAAM,OAAO,+BAA+B,kBAAkB,OAAO,oBAAoB,MAAM,cAAc,MAAM;AAC/H,UAAI,SAAS,QAAQ;AACnB,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,QAAQ,MAAM,GAAG;AACnD,cAAI,KAAK;AACP,gBAAI,aAAa,IAAI,GAAG,OAAO,CAAC,CAAC;AAAA,QACrC;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,IACA,MAAM,iBAAiB,MAAc,cAAsB,aAAsB;AAC/E,YAAM,SAAS,UAAU,WAAW;AACpC,YAAM,SAAS,MAAM,OAAO,0BAA0B,mBAAmB,MAAM,YAAY;AAC3F,YAAM,OAAO,MAAM,QAAQ,OAAO,YAAY,CAAC;AAC/C,aAAO,EAAE,QAAQ,KAAK;AAAA,IACxB;AAAA,IACA,MAAM,mBAAmB,cAAgD;AACvE,YAAM,OAAO,IAAI,gBAAgB;AAAA,QAC/B,WAAW,OAAO;AAAA,QAClB,eAAe,OAAO;AAAA,QACtB,YAAY;AAAA,QACZ,eAAe;AAAA,MACjB,CAAC;AACD,YAAM,MAAM,MAAM,MAAM,mBAAmB;AAAA,QACzC,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,QAClB;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,UAAI,CAAC,IAAI;AACP,cAAM;AACR,YAAM,YAAgC,KAAK;AAC3C,YAAM,YAAY,OAAO,cAAc,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,KAAK,MAAM,SAAS,IAAI;AAC1G,aAAO;AAAA,QACL,aAAa,KAAK;AAAA,QAClB,cAAc,KAAK,iBAAiB;AAAA,QACpC,WAAW,aAAa;AAAA,QACxB,SAAS,KAAK,YAAY;AAAA,QAC1B,WAAW,KAAK,cAAc;AAAA,QAC9B,OAAO,KAAK,SAAS;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACF;;;AC5FA,SAAS,uBAAAA,sBAAqB,gBAAAC,qBAAoB;AAElD,IAAM,kBAAkB;AACxB,IAAM,cAAc;AACpB,IAAM,eAAe;AAUrB,eAAeC,SAAQ,aAAwC;AAC7D,QAAM,eAAe,IAAI,gBAAgB;AACzC,eAAa,IAAI,UAAU,CAAC,MAAM,QAAQ,WAAW,OAAO,EAAE,KAAK,GAAG,CAAC;AAEvE,QAAM,WAAW,MAAM,MAAM,GAAG,eAAe,IAAI,aAAa,SAAS,CAAC,IAAI;AAAA,IAC5E,SAAS;AAAA,MACP,eAAe,UAAU,WAAW;AAAA,IACtC;AAAA,EACF,CAAC;AACD,QAAM,OAA6B,MAAM,SAAS,KAAK;AAEvD,MAAI,SAAwB;AAC5B,MAAI,OAAO,KAAK,YAAY;AAC1B,aAAS,KAAK;AAAA,WACP,KAAK,WAAW,OAAO,KAAK,YAAY,YAAY,UAAU,KAAK;AAC1E,aAAS,KAAK,QAAQ,MAAM,OAAO;AAErC,SAAO;AAAA,IACL,IAAI,OAAO,KAAK,EAAE;AAAA,IAClB,MAAM,KAAK,QAAQ;AAAA,IACnB,OAAO,KAAK,SAAS;AAAA,IACrB,eAAe,KAAK,QAAQ,OAAO;AAAA,IACnC;AAAA,IACA,KAAK;AAAA,EACP;AACF;AAEO,SAAS,SAAS,QAA6E;AACpG,QAAM,gBAAgB,IAAID,cAAa,OAAO,UAAU,OAAO,cAAc,OAAO,eAAe,IAAI;AAEvG,WAAS,UAAU,aAAoC;AACrD,QAAI,CAAC,eAAe,gBAAgB,OAAO;AACzC,aAAO;AACT,WAAO,IAAIA,cAAa,OAAO,UAAU,OAAO,cAAc,WAAW;AAAA,EAC3E;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,UAAU,OAAO;AAAA,IACjB,qBAAqB;AAAA,IAErB,MAAM,oBAAoB,OAAO,cAAc,SAAS;AACtD,YAAM,SAAS,UAAU,SAAS,WAAW;AAC7C,YAAM,SAAS,SAAS,UAAU,OAAO,SAAS,CAAC,SAAS,gBAAgB;AAC5E,YAAM,MAAM,MAAM,OAAO;AAAA,QACvB;AAAA,QACA;AAAA,QACAD,qBAAoB;AAAA,QACpB;AAAA,QACA;AAAA,MACF;AACA,YAAM,eAAe,EAAE,GAAI,OAAO,UAAU,CAAC,GAAI,GAAI,SAAS,UAAU,CAAC,EAAG;AAC5E,UAAI,OAAO,KAAK,YAAY,EAAE,QAAQ;AACpC,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,YAAY,GAAG;AACjD,cAAI,KAAK;AACP,gBAAI,aAAa,IAAI,GAAG,OAAO,CAAC,CAAC;AAAA,QACrC;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,iBAAiB,MAAM,cAAc,aAAa;AACtD,YAAM,SAAS,UAAU,WAAW;AACpC,YAAM,SAAS,MAAM,OAAO,0BAA0B,cAAc,MAAM,YAAY;AACtF,YAAM,OAAO,MAAME,SAAQ,OAAO,YAAY,CAAC;AAC/C,aAAO,EAAE,QAAQ,KAAK;AAAA,IACxB;AAAA,EACF;AACF;;;AClFA,SAAS,uBAAAC,sBAAqB,gBAAAC,qBAAoB;AAElD,IAAM,kBAAkB;AACxB,IAAM,mBAAmB;AACzB,IAAM,iBAAiB;AAkBvB,eAAeC,SAAQ,aAAwC;AAC7D,QAAM,WAAW,MAAM,MAAM,GAAG,cAAc,SAAS;AAAA,IACrD,SAAS;AAAA,MACP,iBAAiB,UAAU,WAAW;AAAA,MACtC,cAAc;AAAA,MACd,UAAU;AAAA,IACZ;AAAA,EACF,CAAC;AACD,QAAM,OAAmB,MAAM,SAAS,KAAK;AAE7C,MAAI,QAAuB,KAAK;AAChC,MAAI,gBAAgB;AAEpB,QAAM,iBAAiB,MAAM,MAAM,GAAG,cAAc,gBAAgB;AAAA,IAClE,SAAS;AAAA,MACP,iBAAiB,UAAU,WAAW;AAAA,MACtC,cAAc;AAAA,MACd,UAAU;AAAA,IACZ;AAAA,EACF,CAAC;AAED,MAAI,eAAe,IAAI;AACrB,UAAM,SAAwB,MAAM,eAAe,KAAK;AACxD,UAAM,eAAe,OAAO,KAAK,OAAK,EAAE,WAAW,EAAE,QAAQ;AAC7D,QAAI,cAAc;AAChB,cAAQ,aAAa;AACrB,sBAAgB;AAAA,IAClB,OACK;AAEH,YAAM,gBAAgB,OAAO,KAAK,OAAK,EAAE,QAAQ;AACjD,UAAI,eAAe;AACjB,gBAAQ,cAAc;AACtB,wBAAgB;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,IAAI,KAAK,GAAG,SAAS;AAAA,IACrB,MAAM,KAAK,QAAQ,KAAK;AAAA,IACxB;AAAA,IACA;AAAA,IACA,QAAQ,KAAK;AAAA,IACb,KAAK;AAAA,EACP;AACF;AAEO,SAAS,OAAO,QAA2E;AAChG,QAAM,gBAAgB,IAAID,cAAa,OAAO,UAAU,OAAO,cAAc,OAAO,eAAe,IAAI;AAEvG,WAAS,UAAU,aAAoC;AACrD,QAAI,CAAC,eAAe,gBAAgB,OAAO;AACzC,aAAO;AAET,WAAO,IAAIA,cAAa,OAAO,UAAU,OAAO,cAAc,WAAW;AAAA,EAC3E;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,UAAU,OAAO;AAAA,IACjB,qBAAqB;AAAA,IAErB,MAAM,oBAAoB,OAAe,cAAsB,SAAyG;AACtK,YAAM,SAAS,UAAU,SAAS,WAAW;AAC7C,YAAM,SAAS,SAAS,UAAU,OAAO,SAAS,CAAC,aAAa,YAAY;AAC5E,YAAM,MAAM,MAAM,OAAO,+BAA+B,iBAAiB,OAAOD,qBAAoB,MAAM,cAAc,MAAM;AAC9H,UAAI,SAAS,QAAQ;AACnB,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,QAAQ,MAAM,GAAG;AACnD,cAAI,KAAK;AACP,gBAAI,aAAa,IAAI,GAAG,OAAO,CAAC,CAAC;AAAA,QACrC;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,iBAAiB,MAAc,cAAsB,aAAsB;AAC/E,YAAM,SAAS,UAAU,WAAW;AACpC,YAAM,SAAS,MAAM,OAAO,0BAA0B,kBAAkB,MAAM,YAAY;AAC1F,YAAM,OAAO,MAAME,SAAQ,OAAO,YAAY,CAAC;AAC/C,aAAO,EAAE,QAAQ,KAAK;AAAA,IACxB;AAAA,EACF;AACF;;;ACzGA,SAAS,uBAAAC,sBAAqB,gBAAAC,qBAAoB;AAElD,IAAM,kBAAkB;AACxB,IAAM,mBAAmB;AACzB,IAAM,sBAAsB;AAW5B,eAAeC,SAAQ,aAAwC;AAC7D,QAAM,WAAW,MAAM,MAAM,qBAAqB;AAAA,IAChD,SAAS;AAAA,MACP,iBAAiB,UAAU,WAAW;AAAA,MACtC,cAAc;AAAA,IAChB;AAAA,EACF,CAAC;AACD,QAAM,OAAmB,MAAM,SAAS,KAAK;AAE7C,SAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT,MAAM,KAAK;AAAA,IACX,OAAO,KAAK;AAAA,IACZ,eAAe,KAAK;AAAA,IACpB,QAAQ,KAAK;AAAA,IACb,KAAK;AAAA,EACP;AACF;AAEO,SAAS,OAAO,QAAsD;AAC3E,QAAM,gBAAgB,IAAID,cAAa,OAAO,UAAU,OAAO,cAAc,OAAO,eAAe,IAAI;AAEvG,WAAS,UAAU,aAAoC;AACrD,QAAI,CAAC,eAAe,gBAAgB,OAAO;AACzC,aAAO;AAET,WAAO,IAAIA,cAAa,OAAO,UAAU,OAAO,cAAc,WAAW;AAAA,EAC3E;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,UAAU,OAAO;AAAA,IACjB,qBAAqB;AAAA,IAErB,MAAM,oBAAoB,OAAe,cAAsB,SAAyG;AACtK,YAAM,SAAS,UAAU,SAAS,WAAW;AAC7C,YAAM,SAAS,SAAS,UAAU,OAAO,SAAS,CAAC,UAAU,SAAS,SAAS;AAC/E,YAAM,MAAM,MAAM,OAAO,+BAA+B,iBAAiB,OAAOD,qBAAoB,MAAM,cAAc,MAAM;AAC9H,UAAI,SAAS,QAAQ;AACnB,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,QAAQ,MAAM,GAAG;AACnD,cAAI,KAAK;AACP,gBAAI,aAAa,IAAI,GAAG,OAAO,CAAC,CAAC;AAAA,QACrC;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,iBAAiB,MAAc,cAAsB,aAAsB;AAC/E,YAAM,SAAS,UAAU,WAAW;AACpC,YAAM,SAAS,MAAM,OAAO,0BAA0B,kBAAkB,MAAM,YAAY;AAC1F,YAAM,OAAO,MAAME,SAAQ,OAAO,YAAY,CAAC;AAC/C,aAAO,EAAE,QAAQ,KAAK;AAAA,IACxB;AAAA,IAEA,MAAM,mBAAmB,cAAgD;AACvE,YAAM,OAAO,IAAI,gBAAgB;AAAA,QAC/B,WAAW,OAAO;AAAA,QAClB,eAAe,OAAO;AAAA,QACtB,YAAY;AAAA,QACZ,eAAe;AAAA,MACjB,CAAC;AACD,YAAM,MAAM,MAAM,MAAM,kBAAkB;AAAA,QACxC,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,QAClB;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,UAAI,CAAC,IAAI;AACP,cAAM;AAER,YAAM,YAAgC,KAAK;AAC3C,YAAM,YAAY,OAAO,cAAc,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,KAAK,MAAM,SAAS,IAAI;AAE1G,aAAO;AAAA,QACL,aAAa,KAAK;AAAA,QAClB,cAAc,KAAK,iBAAiB;AAAA,QACpC,WAAW,aAAa;AAAA,QACxB,SAAS,KAAK,YAAY;AAAA,QAC1B,WAAW,KAAK,cAAc;AAAA,QAC9B,OAAO,KAAK,SAAS;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACF;;;ACpGA,SAAS,uBAAAC,sBAAqB,gBAAAC,qBAAoB;AAGlD,IAAM,0BAA0B;AAGhC,IAAM,2BAA2B;AAgBjC,SAAS,iBAAiB,KAAyB;AACjD,QAAM,SAAS,IAAI,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACvD,QAAM,aAAa,IAAK,OAAO,SAAS,KAAM;AAC9C,QAAM,SAAS,OAAO,OAAO,OAAO,SAAS,WAAW,GAAG;AAC3D,QAAM,gBAAgB,KAAK,MAAM;AACjC,QAAM,MAAM,cAAc;AAC1B,QAAM,QAAQ,IAAI,WAAW,GAAG;AAChC,WAAS,IAAI,GAAG,IAAI,KAAK;AACvB,UAAM,CAAC,IAAI,cAAc,WAAW,CAAC;AAEvC,SAAO;AACT;AAEA,eAAeC,SAAQ,aAAqB,SAA2C;AACrF,QAAM,eAAe,MAAM,MAAM,yBAAyB;AAAA,IACxD,SAAS;AAAA,MACP,eAAe,UAAU,WAAW;AAAA,IACtC;AAAA,EACF,CAAC;AACD,QAAM,WAA0B,MAAM,aAAa,KAAK;AAExD,MAAI,QAAuB,SAAS,QAAQ,SAAS;AACrD,MAAI,gBAAgB;AACpB,MAAI,SAAS;AACX,QAAI;AACF,YAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,YAAM,UAAU,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,iBAAiB,MAAM,CAAC,CAAE,CAAC,CAAC;AAChF,YAAM,mBAAmB;AAGzB,UAAI,QAAQ,wBAAwB;AAClC,cAAM,eAAe,MAAM,QAAQ,QAAQ,sBAAsB,IAC7D,QAAQ,uBAAuB,CAAC,IAChC,QAAQ;AAEZ,YAAI,OAAO,iBAAiB,UAAU;AACpC,kBAAQ;AACR,0BAAgB;AAAA,QAClB;AAAA,MACF,WAES,QAAQ,QAAQ,kBAAkB;AACzC,gBAAQ,QAAQ,SAAS;AACzB,wBAAgB;AAAA,MAClB,WAES,QAAQ,aAAa,MAAM;AAClC,gBAAQ,QAAQ,SAAS;AACzB,wBAAgB;AAAA,MAClB;AAAA,IACF,QACM;AAAA,IACN;AAAA,EACF;AAEA,QAAM,gBAAgB,MAAM,MAAM,0BAA0B;AAAA,IAC1D,SAAS;AAAA,MACP,eAAe,UAAU,WAAW;AAAA,IACtC;AAAA,EACF,CAAC;AAED,MAAI,SAAwB;AAC5B,MAAI,cAAc,IAAI;AACpB,QAAI;AACF,YAAM,OAAO,MAAM,cAAc,KAAK;AACtC,YAAM,SAAS,IAAI,WAAW;AAC9B,YAAM,iBAAiB,IAAI,QAAgB,CAAC,SAAS,WAAW;AAC9D,eAAO,YAAY,MAAM,QAAQ,OAAO,MAAgB;AACxD,eAAO,UAAU;AACjB,eAAO,cAAc,IAAI;AAAA,MAC3B,CAAC;AACD,eAAS,MAAM;AAAA,IACjB,QACM;AAAA,IACN;AAAA,EACF;AAEA,SAAO;AAAA,IACL,IAAI,SAAS;AAAA,IACb,MAAM,SAAS;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,IACA,KAAK;AAAA,EACP;AACF;AAEO,SAAS,UAAU,QAAsE;AAC9F,QAAM,eAAe,CAAC,YAAuC;AAAA,IAC3D,SAAS,qCAAqC,MAAM;AAAA,IACpD,UAAU,qCAAqC,MAAM;AAAA,EACvD;AAEA,QAAM,gBAAgB,IAAID,cAAa,OAAO,UAAU,OAAO,cAAc,OAAO,eAAe,IAAI;AAEvG,WAAS,UAAU,aAAoC;AACrD,QAAI,CAAC,eAAe,gBAAgB,OAAO;AACzC,aAAO;AAET,WAAO,IAAIA,cAAa,OAAO,UAAU,OAAO,cAAc,WAAW;AAAA,EAC3E;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,UAAU,OAAO;AAAA,IACjB,qBAAqB;AAAA,IAErB,MAAM,oBAAoB,OAAe,cAAsB,SAAyJ;AACtN,YAAM,SAAS,UAAU,SAAS,WAAW;AAC7C,YAAM,SAAS,SAAS,UAAU,OAAO,SAAS,CAAC,UAAU,WAAW,SAAS,WAAW;AAC5F,YAAM,kBAA6C,SAAS,WAAW,UAAU,OAAO,UAAU;AAClG,YAAM,EAAE,QAAQ,IAAI,aAAa,eAAe;AAChD,YAAM,MAAM,MAAM,OAAO,+BAA+B,SAAS,OAAOD,qBAAoB,MAAM,cAAc,MAAM;AACtH,YAAM,SAAS,SAAS,WAAW,UAAU,SAAS,QAAQ,UAAU,OAAO;AAC/E,UAAI;AACF,YAAI,aAAa,IAAI,UAAU,MAAM;AACvC,YAAM,eAAe,EAAE,GAAI,OAAO,UAAU,CAAC,GAAI,GAAI,SAAS,UAAU,CAAC,EAAG;AAC5E,UAAI,OAAO,KAAK,YAAY,EAAE,QAAQ;AACpC,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,YAAY,GAAG;AACjD,cAAI,MAAM;AACR;AACF,cAAI,KAAK;AACP,gBAAI,aAAa,IAAI,GAAG,OAAO,CAAC,CAAC;AAAA,QACrC;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,iBAAiB,MAAc,cAAsB,aAAsB,WAAsD;AACrI,YAAM,SAAS,UAAU,WAAW;AACpC,YAAM,kBAA6C,WAAW,UAAU,OAAO,UAAU;AACzF,YAAM,EAAE,SAAS,IAAI,aAAa,eAAe;AACjD,YAAM,SAAS,MAAM,OAAO,0BAA0B,UAAU,MAAM,YAAY;AAClF,YAAM,OAAO,MAAME,SAAQ,OAAO,YAAY,GAAG,OAAO,QAAQ,CAAC;AACjE,aAAO,EAAE,QAAQ,KAAK;AAAA,IACxB;AAAA,IAEA,MAAM,mBAAmB,cAAsB,SAA8F;AAC3I,YAAM,kBAA6C,SAAS,WAAW,UAAU,OAAO,UAAU;AAClG,YAAM,EAAE,SAAS,IAAI,aAAa,eAAe;AACjD,YAAM,OAAO,IAAI,gBAAgB;AAAA,QAC/B,WAAW,OAAO;AAAA,QAClB,eAAe,OAAO;AAAA,QACtB,YAAY;AAAA,QACZ,eAAe;AAAA,QACf,QAAQ,OAAO,SAAS,CAAC,UAAU,WAAW,SAAS,WAAW,GAAG,KAAK,GAAG;AAAA,MAC/E,CAAC;AACD,YAAM,MAAM,MAAM,MAAM,UAAU;AAAA,QAChC,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,QAClB;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,UAAI,CAAC,IAAI;AACP,cAAM;AAER,YAAM,YAAgC,KAAK;AAC3C,YAAM,YAAY,OAAO,cAAc,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,KAAK,MAAM,SAAS,IAAI;AAE1G,aAAO;AAAA,QACL,aAAa,KAAK;AAAA,QAClB,cAAc,KAAK,iBAAiB;AAAA,QACpC,WAAW,aAAa;AAAA,QACxB,SAAS,KAAK,YAAY;AAAA,QAC1B,WAAW,KAAK,cAAc;AAAA,QAC9B,OAAO,KAAK,SAAS;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACF;","names":["CodeChallengeMethod","OAuth2Client","getUser","CodeChallengeMethod","OAuth2Client","getUser","CodeChallengeMethod","OAuth2Client","getUser","CodeChallengeMethod","OAuth2Client","getUser"]}
+{"version":3,"sources":["../../../src/oauth/providers/discord.ts","../../../src/oauth/providers/facebook.ts","../../../src/oauth/providers/github.ts","../../../src/oauth/providers/google.ts","../../../src/oauth/providers/microsoft.ts"],"sourcesContent":["import type { AuthUser, OAuthProvider, OAuthProviderConfig } from '../index'\nimport { createOAuthAuthorizationUrl, createOAuthClientResolver, refreshOAuthAccessToken } from '../utils'\n\nconst DISCORD_AUTH_URL = 'https://discord.com/api/oauth2/authorize'\nconst DISCORD_TOKEN_URL = 'https://discord.com/api/oauth2/token'\nconst DISCORD_USER_URL = 'https://discord.com/api/users/@me'\n\ninterface DiscordUser {\n  id: string\n  username: string\n  discriminator: string\n  avatar: string | null\n  email: string | null\n  verified: boolean\n  [key: string]: unknown\n}\n\nasync function getUser(accessToken: string): Promise<AuthUser> {\n  const response = await fetch(DISCORD_USER_URL, {\n    headers: {\n      'Authorization': `Bearer ${accessToken}`,\n      'User-Agent': 'gau',\n    },\n  })\n  const data: DiscordUser = await response.json()\n  return {\n    id: data.id,\n    name: data.username,\n    email: data.email,\n    emailVerified: data.verified,\n    avatar: data.avatar ? `https://cdn.discordapp.com/avatars/${data.id}/${data.avatar}.png` : null,\n    raw: data,\n  }\n}\n\nexport function Discord(config: OAuthProviderConfig): OAuthProvider<'discord'> {\n  const getClient = createOAuthClientResolver(config)\n  return {\n    id: 'discord',\n    linkOnly: config.linkOnly,\n    requiresRedirectUri: true,\n    async getAuthorizationUrl(state, codeVerifier, options) {\n      const scopes = options?.scopes ?? config.scope ?? ['identify', 'email']\n      return createOAuthAuthorizationUrl({\n        client: getClient(options?.redirectUri),\n        authorizationUrl: DISCORD_AUTH_URL,\n        state,\n        codeVerifier,\n        scopes,\n        configParams: config.params,\n        params: options?.params,\n      })\n    },\n    async validateCallback(code: string, codeVerifier: string, redirectUri?: string) {\n      const client = getClient(redirectUri)\n      const tokens = await client.validateAuthorizationCode(DISCORD_TOKEN_URL, code, codeVerifier)\n      const user = await getUser(tokens.accessToken())\n      return { tokens, user }\n    },\n    async refreshAccessToken(refreshToken) {\n      return refreshOAuthAccessToken({\n        tokenUrl: DISCORD_TOKEN_URL,\n        clientId: config.clientId,\n        clientSecret: config.clientSecret,\n        refreshToken,\n      })\n    },\n  }\n}\n","import type { AuthUser, OAuthProvider, OAuthProviderConfig } from '../index'\nimport { createOAuthAuthorizationUrl, createOAuthClientResolver } from '../utils'\n\nconst FB_GRAPH_ME_URL = 'https://graph.facebook.com/me'\nconst FB_AUTH_URL = 'https://www.facebook.com/dialog/oauth'\nconst FB_TOKEN_URL = 'https://graph.facebook.com/oauth/access_token'\n\ninterface FacebookUserResponse {\n  id: string\n  name?: string | null\n  email?: string | null\n  picture?: { data?: { url?: string | null } } | string | null\n  [key: string]: unknown\n}\n\nasync function getUser(accessToken: string): Promise<AuthUser> {\n  const searchParams = new URLSearchParams()\n  searchParams.set('fields', ['id', 'name', 'picture', 'email'].join(','))\n\n  const response = await fetch(`${FB_GRAPH_ME_URL}?${searchParams.toString()}`, {\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n    },\n  })\n  const data: FacebookUserResponse = await response.json()\n\n  let avatar: string | null = null\n  if (typeof data.picture === 'string')\n    avatar = data.picture\n  else if (data.picture && typeof data.picture === 'object' && 'data' in data.picture)\n    avatar = data.picture.data?.url ?? null\n\n  return {\n    id: String(data.id),\n    name: data.name ?? '',\n    email: data.email ?? null,\n    emailVerified: data.email ? true : null,\n    avatar,\n    raw: data,\n  }\n}\n\nexport function Facebook(config: OAuthProviderConfig): OAuthProvider<'facebook', OAuthProviderConfig> {\n  const getClient = createOAuthClientResolver(config)\n\n  return {\n    id: 'facebook',\n    linkOnly: config.linkOnly,\n    requiresRedirectUri: true,\n\n    async getAuthorizationUrl(state, codeVerifier, options) {\n      const scopes = options?.scopes ?? config.scope ?? ['email', 'public_profile']\n      return createOAuthAuthorizationUrl({\n        client: getClient(options?.redirectUri),\n        authorizationUrl: FB_AUTH_URL,\n        state,\n        codeVerifier,\n        scopes,\n        configParams: config.params,\n        params: options?.params,\n      })\n    },\n\n    async validateCallback(code, codeVerifier, redirectUri) {\n      const client = getClient(redirectUri)\n      const tokens = await client.validateAuthorizationCode(FB_TOKEN_URL, code, codeVerifier)\n      const user = await getUser(tokens.accessToken())\n      return { tokens, user }\n    },\n  }\n}\n","import type { AuthUser, OAuthProvider, OAuthProviderConfig } from '../index'\nimport { createOAuthAuthorizationUrl, createOAuthClientResolver } from '../utils'\n\nconst GITHUB_AUTH_URL = 'https://github.com/login/oauth/authorize'\nconst GITHUB_TOKEN_URL = 'https://github.com/login/oauth/access_token'\nconst GITHUB_API_URL = 'https://api.github.com'\n\ninterface GitHubUser {\n  id: number\n  login: string\n  avatar_url: string\n  name: string\n  email: string | null\n  [key: string]: unknown\n}\n\ninterface GitHubEmail {\n  email: string\n  primary: boolean\n  verified: boolean\n  visibility: 'public' | 'private' | null\n}\n\nasync function getUser(accessToken: string): Promise<AuthUser> {\n  const response = await fetch(`${GITHUB_API_URL}/user`, {\n    headers: {\n      'Authorization': `Bearer ${accessToken}`,\n      'User-Agent': 'gau',\n      'Accept': 'application/vnd.github+json',\n    },\n  })\n  const data: GitHubUser = await response.json()\n\n  let email: string | null = data.email\n  let emailVerified = false\n\n  const emailsResponse = await fetch(`${GITHUB_API_URL}/user/emails`, {\n    headers: {\n      'Authorization': `Bearer ${accessToken}`,\n      'User-Agent': 'gau',\n      'Accept': 'application/vnd.github+json',\n    },\n  })\n\n  if (emailsResponse.ok) {\n    const emails: GitHubEmail[] = await emailsResponse.json()\n    const primaryEmail = emails.find(e => e.primary && e.verified)\n    if (primaryEmail) {\n      email = primaryEmail.email\n      emailVerified = true\n    }\n    else {\n      // Fallback to the first verified email if no primary is found\n      const verifiedEmail = emails.find(e => e.verified)\n      if (verifiedEmail) {\n        email = verifiedEmail.email\n        emailVerified = true\n      }\n    }\n  }\n\n  return {\n    id: data.id.toString(),\n    name: data.name ?? data.login,\n    email,\n    emailVerified,\n    avatar: data.avatar_url,\n    raw: data,\n  }\n}\n\nexport function GitHub(config: OAuthProviderConfig): OAuthProvider<'github', OAuthProviderConfig> {\n  const getClient = createOAuthClientResolver(config)\n\n  return {\n    id: 'github',\n    linkOnly: config.linkOnly,\n    requiresRedirectUri: true,\n\n    async getAuthorizationUrl(state, codeVerifier, options) {\n      const scopes = options?.scopes ?? config.scope ?? ['read:user', 'user:email']\n      return createOAuthAuthorizationUrl({\n        client: getClient(options?.redirectUri),\n        authorizationUrl: GITHUB_AUTH_URL,\n        state,\n        codeVerifier,\n        scopes,\n        configParams: config.params,\n        params: options?.params,\n      })\n    },\n\n    async validateCallback(code: string, codeVerifier: string, redirectUri?: string) {\n      const client = getClient(redirectUri)\n      const tokens = await client.validateAuthorizationCode(GITHUB_TOKEN_URL, code, codeVerifier)\n      const user = await getUser(tokens.accessToken())\n      return { tokens, user }\n    },\n  }\n}\n","import type { AuthUser, OAuthProvider, OAuthProviderConfig } from '../index'\nimport { createOAuthAuthorizationUrl, createOAuthClientResolver, refreshOAuthAccessToken } from '../utils'\n\nconst GOOGLE_AUTH_URL = 'https://accounts.google.com/o/oauth2/v2/auth'\nconst GOOGLE_TOKEN_URL = 'https://oauth2.googleapis.com/token'\nconst GOOGLE_USERINFO_URL = 'https://openidconnect.googleapis.com/v1/userinfo'\n\ninterface GoogleUser {\n  sub: string\n  name: string\n  email: string | null\n  email_verified: boolean\n  picture: string | null\n  [key: string]: unknown\n}\n\nasync function getUser(accessToken: string): Promise<AuthUser> {\n  const response = await fetch(GOOGLE_USERINFO_URL, {\n    headers: {\n      'Authorization': `Bearer ${accessToken}`,\n      'User-Agent': 'gau',\n    },\n  })\n  const data: GoogleUser = await response.json()\n\n  return {\n    id: data.sub,\n    name: data.name,\n    email: data.email,\n    emailVerified: data.email_verified,\n    avatar: data.picture,\n    raw: data,\n  }\n}\n\nexport function Google(config: OAuthProviderConfig): OAuthProvider<'google'> {\n  const getClient = createOAuthClientResolver(config)\n\n  return {\n    id: 'google',\n    linkOnly: config.linkOnly,\n    requiresRedirectUri: true,\n\n    async getAuthorizationUrl(state, codeVerifier, options) {\n      const scopes = options?.scopes ?? config.scope ?? ['openid', 'email', 'profile']\n      return createOAuthAuthorizationUrl({\n        client: getClient(options?.redirectUri),\n        authorizationUrl: GOOGLE_AUTH_URL,\n        state,\n        codeVerifier,\n        scopes,\n        configParams: config.params,\n        params: options?.params,\n      })\n    },\n\n    async validateCallback(code: string, codeVerifier: string, redirectUri?: string) {\n      const client = getClient(redirectUri)\n      const tokens = await client.validateAuthorizationCode(GOOGLE_TOKEN_URL, code, codeVerifier)\n      const user = await getUser(tokens.accessToken())\n      return { tokens, user }\n    },\n\n    async refreshAccessToken(refreshToken) {\n      return refreshOAuthAccessToken({\n        tokenUrl: GOOGLE_TOKEN_URL,\n        clientId: config.clientId,\n        clientSecret: config.clientSecret,\n        refreshToken,\n      })\n    },\n  }\n}\n","import type { AuthUser, OAuthProvider, OAuthProviderConfig } from '../index'\nimport { createOAuthAuthorizationUrl, createOAuthClientResolver, mergeOAuthParams, refreshOAuthAccessToken } from '../utils'\n\n// https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc\nconst MICROSOFT_USER_INFO_URL = 'https://graph.microsoft.com/v1.0/me'\n\n// https://learn.microsoft.com/en-us/graph/api/profilephoto-get?view=graph-rest-1.0\nconst MICROSOFT_USER_PHOTO_URL = 'https://graph.microsoft.com/v1.0/me/photo/$value'\n\n// https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow#request-an-authorization-code\ninterface MicrosoftConfig extends OAuthProviderConfig {\n  tenant?: 'common' | 'organizations' | 'consumers' | (string & {})\n  prompt?: 'login' | 'none' | 'consent' | 'select_account' | (string & {})\n}\n\ninterface MicrosoftUser {\n  id: string\n  displayName: string\n  mail: string | null\n  userPrincipalName: string\n  [key: string]: unknown\n}\n\nfunction base64url_decode(str: string): Uint8Array {\n  const base64 = str.replace(/-/g, '+').replace(/_/g, '/')\n  const padLength = (4 - (base64.length % 4)) % 4\n  const padded = base64.padEnd(base64.length + padLength, '=')\n  const binary_string = atob(padded)\n  const len = binary_string.length\n  const bytes = new Uint8Array(len)\n  for (let i = 0; i < len; i++)\n    bytes[i] = binary_string.charCodeAt(i)\n\n  return bytes\n}\n\nasync function getUser(accessToken: string, idToken: string | null): Promise<AuthUser> {\n  const userResponse = await fetch(MICROSOFT_USER_INFO_URL, {\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n    },\n  })\n  const userData: MicrosoftUser = await userResponse.json()\n\n  let email: string | null = userData.mail ?? userData.userPrincipalName\n  let emailVerified = false\n  if (idToken) {\n    try {\n      const parts = idToken.split('.')\n      const payload = JSON.parse(new TextDecoder().decode(base64url_decode(parts[1]!))) as Record<string, any>\n      const personalTenantId = '9188040d-6c67-4c5b-b112-36a304b66dad'\n\n      // For work/school accounts, the `verified_primary_email` is the source of truth.\n      if (payload.verified_primary_email) {\n        const primaryEmail = Array.isArray(payload.verified_primary_email)\n          ? payload.verified_primary_email[0]\n          : payload.verified_primary_email\n\n        if (typeof primaryEmail === 'string') {\n          email = primaryEmail\n          emailVerified = true\n        }\n      }\n      // For personal accounts, the `email` claim is reliable and verified.\n      else if (payload.tid === personalTenantId) {\n        email = payload.email ?? email\n        emailVerified = true\n      }\n      // Legacy fallback for `xms_edov`.\n      else if (payload.xms_edov === true) {\n        email = payload.email ?? email\n        emailVerified = true\n      }\n    }\n    catch {\n    }\n  }\n\n  const photoResponse = await fetch(MICROSOFT_USER_PHOTO_URL, {\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n    },\n  })\n\n  let avatar: string | null = null\n  if (photoResponse.ok) {\n    try {\n      const blob = await photoResponse.blob()\n      const reader = new FileReader()\n      const dataUrlPromise = new Promise<string>((resolve, reject) => {\n        reader.onloadend = () => resolve(reader.result as string)\n        reader.onerror = reject\n        reader.readAsDataURL(blob)\n      })\n      avatar = await dataUrlPromise\n    }\n    catch {\n    }\n  }\n\n  return {\n    id: userData.id,\n    name: userData.displayName,\n    email,\n    emailVerified,\n    avatar,\n    raw: userData,\n  }\n}\n\nexport function Microsoft(config: MicrosoftConfig): OAuthProvider<'microsoft', MicrosoftConfig> {\n  const getEndpoints = (tenant: MicrosoftConfig['tenant']) => ({\n    authURL: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/authorize`,\n    tokenURL: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`,\n  })\n\n  const getClient = createOAuthClientResolver(config)\n\n  return {\n    id: 'microsoft',\n    linkOnly: config.linkOnly,\n    requiresRedirectUri: true,\n\n    async getAuthorizationUrl(state, codeVerifier, options) {\n      const scopes = options?.scopes ?? config.scope ?? ['openid', 'profile', 'email', 'User.Read']\n      const effectiveTenant: MicrosoftConfig['tenant'] = options?.overrides?.tenant ?? config.tenant ?? 'common'\n      const { authURL } = getEndpoints(effectiveTenant)\n      const params = mergeOAuthParams(config.params, options?.params)\n      const prompt = options?.overrides?.prompt ?? params.prompt ?? config.prompt\n\n      return createOAuthAuthorizationUrl({\n        client: getClient(options?.redirectUri),\n        authorizationUrl: authURL,\n        state,\n        codeVerifier,\n        scopes,\n        configParams: config.params,\n        params: options?.params,\n        omitParamKeys: ['prompt'],\n        extraParams: prompt ? { prompt } : undefined,\n      })\n    },\n\n    async validateCallback(code: string, codeVerifier: string, redirectUri?: string, overrides?: Partial<Pick<MicrosoftConfig, 'tenant'>>) {\n      const client = getClient(redirectUri)\n      const effectiveTenant: MicrosoftConfig['tenant'] = overrides?.tenant ?? config.tenant ?? 'common'\n      const { tokenURL } = getEndpoints(effectiveTenant)\n      const tokens = await client.validateAuthorizationCode(tokenURL, code, codeVerifier)\n      const user = await getUser(tokens.accessToken(), tokens.idToken())\n      return { tokens, user }\n    },\n\n    async refreshAccessToken(refreshToken, options) {\n      const effectiveTenant: MicrosoftConfig['tenant'] = options?.overrides?.tenant ?? config.tenant ?? 'common'\n      const { tokenURL } = getEndpoints(effectiveTenant)\n      return refreshOAuthAccessToken({\n        tokenUrl: tokenURL,\n        clientId: config.clientId,\n        clientSecret: config.clientSecret,\n        refreshToken,\n        scopes: options?.scopes ?? config.scope ?? ['openid', 'profile', 'email', 'User.Read'],\n      })\n    },\n  }\n}\n"],"mappings":";;;;;;;;AAGA,IAAM,mBAAmB;AACzB,IAAM,oBAAoB;AAC1B,IAAM,mBAAmB;AAYzB,eAAe,QAAQ,aAAwC;AAC7D,QAAM,WAAW,MAAM,MAAM,kBAAkB;AAAA,IAC7C,SAAS;AAAA,MACP,iBAAiB,UAAU,WAAW;AAAA,MACtC,cAAc;AAAA,IAChB;AAAA,EACF,CAAC;AACD,QAAM,OAAoB,MAAM,SAAS,KAAK;AAC9C,SAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT,MAAM,KAAK;AAAA,IACX,OAAO,KAAK;AAAA,IACZ,eAAe,KAAK;AAAA,IACpB,QAAQ,KAAK,SAAS,sCAAsC,KAAK,EAAE,IAAI,KAAK,MAAM,SAAS;AAAA,IAC3F,KAAK;AAAA,EACP;AACF;AAEO,SAAS,QAAQ,QAAuD;AAC7E,QAAM,YAAY,0BAA0B,MAAM;AAClD,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,UAAU,OAAO;AAAA,IACjB,qBAAqB;AAAA,IACrB,MAAM,oBAAoB,OAAO,cAAc,SAAS;AACtD,YAAM,SAAS,SAAS,UAAU,OAAO,SAAS,CAAC,YAAY,OAAO;AACtE,aAAO,4BAA4B;AAAA,QACjC,QAAQ,UAAU,SAAS,WAAW;AAAA,QACtC,kBAAkB;AAAA,QAClB;AAAA,QACA;AAAA,QACA;AAAA,QACA,cAAc,OAAO;AAAA,QACrB,QAAQ,SAAS;AAAA,MACnB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,iBAAiB,MAAc,cAAsB,aAAsB;AAC/E,YAAM,SAAS,UAAU,WAAW;AACpC,YAAM,SAAS,MAAM,OAAO,0BAA0B,mBAAmB,MAAM,YAAY;AAC3F,YAAM,OAAO,MAAM,QAAQ,OAAO,YAAY,CAAC;AAC/C,aAAO,EAAE,QAAQ,KAAK;AAAA,IACxB;AAAA,IACA,MAAM,mBAAmB,cAAc;AACrC,aAAO,wBAAwB;AAAA,QAC7B,UAAU;AAAA,QACV,UAAU,OAAO;AAAA,QACjB,cAAc,OAAO;AAAA,QACrB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;ACjEA,IAAM,kBAAkB;AACxB,IAAM,cAAc;AACpB,IAAM,eAAe;AAUrB,eAAeA,SAAQ,aAAwC;AAC7D,QAAM,eAAe,IAAI,gBAAgB;AACzC,eAAa,IAAI,UAAU,CAAC,MAAM,QAAQ,WAAW,OAAO,EAAE,KAAK,GAAG,CAAC;AAEvE,QAAM,WAAW,MAAM,MAAM,GAAG,eAAe,IAAI,aAAa,SAAS,CAAC,IAAI;AAAA,IAC5E,SAAS;AAAA,MACP,eAAe,UAAU,WAAW;AAAA,IACtC;AAAA,EACF,CAAC;AACD,QAAM,OAA6B,MAAM,SAAS,KAAK;AAEvD,MAAI,SAAwB;AAC5B,MAAI,OAAO,KAAK,YAAY;AAC1B,aAAS,KAAK;AAAA,WACP,KAAK,WAAW,OAAO,KAAK,YAAY,YAAY,UAAU,KAAK;AAC1E,aAAS,KAAK,QAAQ,MAAM,OAAO;AAErC,SAAO;AAAA,IACL,IAAI,OAAO,KAAK,EAAE;AAAA,IAClB,MAAM,KAAK,QAAQ;AAAA,IACnB,OAAO,KAAK,SAAS;AAAA,IACrB,eAAe,KAAK,QAAQ,OAAO;AAAA,IACnC;AAAA,IACA,KAAK;AAAA,EACP;AACF;AAEO,SAAS,SAAS,QAA6E;AACpG,QAAM,YAAY,0BAA0B,MAAM;AAElD,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,UAAU,OAAO;AAAA,IACjB,qBAAqB;AAAA,IAErB,MAAM,oBAAoB,OAAO,cAAc,SAAS;AACtD,YAAM,SAAS,SAAS,UAAU,OAAO,SAAS,CAAC,SAAS,gBAAgB;AAC5E,aAAO,4BAA4B;AAAA,QACjC,QAAQ,UAAU,SAAS,WAAW;AAAA,QACtC,kBAAkB;AAAA,QAClB;AAAA,QACA;AAAA,QACA;AAAA,QACA,cAAc,OAAO;AAAA,QACrB,QAAQ,SAAS;AAAA,MACnB,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,iBAAiB,MAAM,cAAc,aAAa;AACtD,YAAM,SAAS,UAAU,WAAW;AACpC,YAAM,SAAS,MAAM,OAAO,0BAA0B,cAAc,MAAM,YAAY;AACtF,YAAM,OAAO,MAAMA,SAAQ,OAAO,YAAY,CAAC;AAC/C,aAAO,EAAE,QAAQ,KAAK;AAAA,IACxB;AAAA,EACF;AACF;;;ACnEA,IAAM,kBAAkB;AACxB,IAAM,mBAAmB;AACzB,IAAM,iBAAiB;AAkBvB,eAAeC,SAAQ,aAAwC;AAC7D,QAAM,WAAW,MAAM,MAAM,GAAG,cAAc,SAAS;AAAA,IACrD,SAAS;AAAA,MACP,iBAAiB,UAAU,WAAW;AAAA,MACtC,cAAc;AAAA,MACd,UAAU;AAAA,IACZ;AAAA,EACF,CAAC;AACD,QAAM,OAAmB,MAAM,SAAS,KAAK;AAE7C,MAAI,QAAuB,KAAK;AAChC,MAAI,gBAAgB;AAEpB,QAAM,iBAAiB,MAAM,MAAM,GAAG,cAAc,gBAAgB;AAAA,IAClE,SAAS;AAAA,MACP,iBAAiB,UAAU,WAAW;AAAA,MACtC,cAAc;AAAA,MACd,UAAU;AAAA,IACZ;AAAA,EACF,CAAC;AAED,MAAI,eAAe,IAAI;AACrB,UAAM,SAAwB,MAAM,eAAe,KAAK;AACxD,UAAM,eAAe,OAAO,KAAK,OAAK,EAAE,WAAW,EAAE,QAAQ;AAC7D,QAAI,cAAc;AAChB,cAAQ,aAAa;AACrB,sBAAgB;AAAA,IAClB,OACK;AAEH,YAAM,gBAAgB,OAAO,KAAK,OAAK,EAAE,QAAQ;AACjD,UAAI,eAAe;AACjB,gBAAQ,cAAc;AACtB,wBAAgB;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,IAAI,KAAK,GAAG,SAAS;AAAA,IACrB,MAAM,KAAK,QAAQ,KAAK;AAAA,IACxB;AAAA,IACA;AAAA,IACA,QAAQ,KAAK;AAAA,IACb,KAAK;AAAA,EACP;AACF;AAEO,SAAS,OAAO,QAA2E;AAChG,QAAM,YAAY,0BAA0B,MAAM;AAElD,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,UAAU,OAAO;AAAA,IACjB,qBAAqB;AAAA,IAErB,MAAM,oBAAoB,OAAO,cAAc,SAAS;AACtD,YAAM,SAAS,SAAS,UAAU,OAAO,SAAS,CAAC,aAAa,YAAY;AAC5E,aAAO,4BAA4B;AAAA,QACjC,QAAQ,UAAU,SAAS,WAAW;AAAA,QACtC,kBAAkB;AAAA,QAClB;AAAA,QACA;AAAA,QACA;AAAA,QACA,cAAc,OAAO;AAAA,QACrB,QAAQ,SAAS;AAAA,MACnB,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,iBAAiB,MAAc,cAAsB,aAAsB;AAC/E,YAAM,SAAS,UAAU,WAAW;AACpC,YAAM,SAAS,MAAM,OAAO,0BAA0B,kBAAkB,MAAM,YAAY;AAC1F,YAAM,OAAO,MAAMA,SAAQ,OAAO,YAAY,CAAC;AAC/C,aAAO,EAAE,QAAQ,KAAK;AAAA,IACxB;AAAA,EACF;AACF;;;AChGA,IAAM,kBAAkB;AACxB,IAAM,mBAAmB;AACzB,IAAM,sBAAsB;AAW5B,eAAeC,SAAQ,aAAwC;AAC7D,QAAM,WAAW,MAAM,MAAM,qBAAqB;AAAA,IAChD,SAAS;AAAA,MACP,iBAAiB,UAAU,WAAW;AAAA,MACtC,cAAc;AAAA,IAChB;AAAA,EACF,CAAC;AACD,QAAM,OAAmB,MAAM,SAAS,KAAK;AAE7C,SAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT,MAAM,KAAK;AAAA,IACX,OAAO,KAAK;AAAA,IACZ,eAAe,KAAK;AAAA,IACpB,QAAQ,KAAK;AAAA,IACb,KAAK;AAAA,EACP;AACF;AAEO,SAAS,OAAO,QAAsD;AAC3E,QAAM,YAAY,0BAA0B,MAAM;AAElD,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,UAAU,OAAO;AAAA,IACjB,qBAAqB;AAAA,IAErB,MAAM,oBAAoB,OAAO,cAAc,SAAS;AACtD,YAAM,SAAS,SAAS,UAAU,OAAO,SAAS,CAAC,UAAU,SAAS,SAAS;AAC/E,aAAO,4BAA4B;AAAA,QACjC,QAAQ,UAAU,SAAS,WAAW;AAAA,QACtC,kBAAkB;AAAA,QAClB;AAAA,QACA;AAAA,QACA;AAAA,QACA,cAAc,OAAO;AAAA,QACrB,QAAQ,SAAS;AAAA,MACnB,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,iBAAiB,MAAc,cAAsB,aAAsB;AAC/E,YAAM,SAAS,UAAU,WAAW;AACpC,YAAM,SAAS,MAAM,OAAO,0BAA0B,kBAAkB,MAAM,YAAY;AAC1F,YAAM,OAAO,MAAMA,SAAQ,OAAO,YAAY,CAAC;AAC/C,aAAO,EAAE,QAAQ,KAAK;AAAA,IACxB;AAAA,IAEA,MAAM,mBAAmB,cAAc;AACrC,aAAO,wBAAwB;AAAA,QAC7B,UAAU;AAAA,QACV,UAAU,OAAO;AAAA,QACjB,cAAc,OAAO;AAAA,QACrB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;ACpEA,IAAM,0BAA0B;AAGhC,IAAM,2BAA2B;AAgBjC,SAAS,iBAAiB,KAAyB;AACjD,QAAM,SAAS,IAAI,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACvD,QAAM,aAAa,IAAK,OAAO,SAAS,KAAM;AAC9C,QAAM,SAAS,OAAO,OAAO,OAAO,SAAS,WAAW,GAAG;AAC3D,QAAM,gBAAgB,KAAK,MAAM;AACjC,QAAM,MAAM,cAAc;AAC1B,QAAM,QAAQ,IAAI,WAAW,GAAG;AAChC,WAAS,IAAI,GAAG,IAAI,KAAK;AACvB,UAAM,CAAC,IAAI,cAAc,WAAW,CAAC;AAEvC,SAAO;AACT;AAEA,eAAeC,SAAQ,aAAqB,SAA2C;AACrF,QAAM,eAAe,MAAM,MAAM,yBAAyB;AAAA,IACxD,SAAS;AAAA,MACP,eAAe,UAAU,WAAW;AAAA,IACtC;AAAA,EACF,CAAC;AACD,QAAM,WAA0B,MAAM,aAAa,KAAK;AAExD,MAAI,QAAuB,SAAS,QAAQ,SAAS;AACrD,MAAI,gBAAgB;AACpB,MAAI,SAAS;AACX,QAAI;AACF,YAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,YAAM,UAAU,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,iBAAiB,MAAM,CAAC,CAAE,CAAC,CAAC;AAChF,YAAM,mBAAmB;AAGzB,UAAI,QAAQ,wBAAwB;AAClC,cAAM,eAAe,MAAM,QAAQ,QAAQ,sBAAsB,IAC7D,QAAQ,uBAAuB,CAAC,IAChC,QAAQ;AAEZ,YAAI,OAAO,iBAAiB,UAAU;AACpC,kBAAQ;AACR,0BAAgB;AAAA,QAClB;AAAA,MACF,WAES,QAAQ,QAAQ,kBAAkB;AACzC,gBAAQ,QAAQ,SAAS;AACzB,wBAAgB;AAAA,MAClB,WAES,QAAQ,aAAa,MAAM;AAClC,gBAAQ,QAAQ,SAAS;AACzB,wBAAgB;AAAA,MAClB;AAAA,IACF,QACM;AAAA,IACN;AAAA,EACF;AAEA,QAAM,gBAAgB,MAAM,MAAM,0BAA0B;AAAA,IAC1D,SAAS;AAAA,MACP,eAAe,UAAU,WAAW;AAAA,IACtC;AAAA,EACF,CAAC;AAED,MAAI,SAAwB;AAC5B,MAAI,cAAc,IAAI;AACpB,QAAI;AACF,YAAM,OAAO,MAAM,cAAc,KAAK;AACtC,YAAM,SAAS,IAAI,WAAW;AAC9B,YAAM,iBAAiB,IAAI,QAAgB,CAAC,SAAS,WAAW;AAC9D,eAAO,YAAY,MAAM,QAAQ,OAAO,MAAgB;AACxD,eAAO,UAAU;AACjB,eAAO,cAAc,IAAI;AAAA,MAC3B,CAAC;AACD,eAAS,MAAM;AAAA,IACjB,QACM;AAAA,IACN;AAAA,EACF;AAEA,SAAO;AAAA,IACL,IAAI,SAAS;AAAA,IACb,MAAM,SAAS;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,IACA,KAAK;AAAA,EACP;AACF;AAEO,SAAS,UAAU,QAAsE;AAC9F,QAAM,eAAe,CAAC,YAAuC;AAAA,IAC3D,SAAS,qCAAqC,MAAM;AAAA,IACpD,UAAU,qCAAqC,MAAM;AAAA,EACvD;AAEA,QAAM,YAAY,0BAA0B,MAAM;AAElD,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,UAAU,OAAO;AAAA,IACjB,qBAAqB;AAAA,IAErB,MAAM,oBAAoB,OAAO,cAAc,SAAS;AACtD,YAAM,SAAS,SAAS,UAAU,OAAO,SAAS,CAAC,UAAU,WAAW,SAAS,WAAW;AAC5F,YAAM,kBAA6C,SAAS,WAAW,UAAU,OAAO,UAAU;AAClG,YAAM,EAAE,QAAQ,IAAI,aAAa,eAAe;AAChD,YAAM,SAAS,iBAAiB,OAAO,QAAQ,SAAS,MAAM;AAC9D,YAAM,SAAS,SAAS,WAAW,UAAU,OAAO,UAAU,OAAO;AAErE,aAAO,4BAA4B;AAAA,QACjC,QAAQ,UAAU,SAAS,WAAW;AAAA,QACtC,kBAAkB;AAAA,QAClB;AAAA,QACA;AAAA,QACA;AAAA,QACA,cAAc,OAAO;AAAA,QACrB,QAAQ,SAAS;AAAA,QACjB,eAAe,CAAC,QAAQ;AAAA,QACxB,aAAa,SAAS,EAAE,OAAO,IAAI;AAAA,MACrC,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,iBAAiB,MAAc,cAAsB,aAAsB,WAAsD;AACrI,YAAM,SAAS,UAAU,WAAW;AACpC,YAAM,kBAA6C,WAAW,UAAU,OAAO,UAAU;AACzF,YAAM,EAAE,SAAS,IAAI,aAAa,eAAe;AACjD,YAAM,SAAS,MAAM,OAAO,0BAA0B,UAAU,MAAM,YAAY;AAClF,YAAM,OAAO,MAAMA,SAAQ,OAAO,YAAY,GAAG,OAAO,QAAQ,CAAC;AACjE,aAAO,EAAE,QAAQ,KAAK;AAAA,IACxB;AAAA,IAEA,MAAM,mBAAmB,cAAc,SAAS;AAC9C,YAAM,kBAA6C,SAAS,WAAW,UAAU,OAAO,UAAU;AAClG,YAAM,EAAE,SAAS,IAAI,aAAa,eAAe;AACjD,aAAO,wBAAwB;AAAA,QAC7B,UAAU;AAAA,QACV,UAAU,OAAO;AAAA,QACjB,cAAc,OAAO;AAAA,QACrB;AAAA,QACA,QAAQ,SAAS,UAAU,OAAO,SAAS,CAAC,UAAU,WAAW,SAAS,WAAW;AAAA,MACvF,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":["getUser","getUser","getUser","getUser"]}

package/dist/src/oauth/providers/discord.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discord.d.ts","sourceRoot":"","sources":["../../../../src/oauth/providers/discord.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAY,aAAa,EAAE,mBAAmB,EAAmB,MAAM,UAAU,CAAA;AAmC7F,wBAAgB,OAAO,CAAC,MAAM,EAAE,mBAAmB,GAAG,aAAa,CAAC,SAAS,CAAC,CA0D7E"}
+{"version":3,"file":"discord.d.ts","sourceRoot":"","sources":["../../../../src/oauth/providers/discord.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAY,aAAa,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAmC5E,wBAAgB,OAAO,CAAC,MAAM,EAAE,mBAAmB,GAAG,aAAa,CAAC,SAAS,CAAC,CAiC7E"}

package/dist/src/oauth/providers/facebook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"facebook.d.ts","sourceRoot":"","sources":["../../../../src/oauth/providers/facebook.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAY,aAAa,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AA0C5E,wBAAgB,QAAQ,CAAC,MAAM,EAAE,mBAAmB,GAAG,aAAa,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAyCpG"}
+{"version":3,"file":"facebook.d.ts","sourceRoot":"","sources":["../../../../src/oauth/providers/facebook.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAY,aAAa,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AA0C5E,wBAAgB,QAAQ,CAAC,MAAM,EAAE,mBAAmB,GAAG,aAAa,CAAC,UAAU,EAAE,mBAAmB,CAAC,CA4BpG"}

package/dist/src/oauth/providers/github.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../../../src/oauth/providers/github.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAY,aAAa,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAuE5E,wBAAgB,MAAM,CAAC,MAAM,EAAE,mBAAmB,GAAG,aAAa,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAmChG"}
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../../../src/oauth/providers/github.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAY,aAAa,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAuE5E,wBAAgB,MAAM,CAAC,MAAM,EAAE,mBAAmB,GAAG,aAAa,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CA4BhG"}

package/dist/src/oauth/providers/google.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google.d.ts","sourceRoot":"","sources":["../../../../src/oauth/providers/google.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAY,aAAa,EAAE,mBAAmB,EAAmB,MAAM,UAAU,CAAA;AAmC7F,wBAAgB,MAAM,CAAC,MAAM,EAAE,mBAAmB,GAAG,aAAa,CAAC,QAAQ,CAAC,CAkE3E"}
+{"version":3,"file":"google.d.ts","sourceRoot":"","sources":["../../../../src/oauth/providers/google.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAY,aAAa,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAmC5E,wBAAgB,MAAM,CAAC,MAAM,EAAE,mBAAmB,GAAG,aAAa,CAAC,QAAQ,CAAC,CAqC3E"}

package/dist/src/oauth/providers/microsoft.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"microsoft.d.ts","sourceRoot":"","sources":["../../../../src/oauth/providers/microsoft.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAY,aAAa,EAAE,mBAAmB,EAAmB,MAAM,UAAU,CAAA;AAU7F,UAAU,eAAgB,SAAQ,mBAAmB;IACnD,MAAM,CAAC,EAAE,QAAQ,GAAG,eAAe,GAAG,WAAW,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;IACjE,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,gBAAgB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;CACzE;AAiGD,wBAAgB,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,aAAa,CAAC,WAAW,EAAE,eAAe,CAAC,CAoF9F"}
+{"version":3,"file":"microsoft.d.ts","sourceRoot":"","sources":["../../../../src/oauth/providers/microsoft.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAY,aAAa,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAU5E,UAAU,eAAgB,SAAQ,mBAAmB;IACnD,MAAM,CAAC,EAAE,QAAQ,GAAG,eAAe,GAAG,WAAW,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;IACjE,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,gBAAgB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;CACzE;AAiGD,wBAAgB,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,aAAa,CAAC,WAAW,EAAE,eAAe,CAAC,CAsD9F"}

package/dist/src/oauth/utils.d.ts

@@ -1,5 +1,31 @@
+import type { OAuthProviderConfig, RefreshedTokens } from './index';
+import { OAuth2Client } from 'arctic';
 export declare function createOAuthUris(): {
     state: string;
     codeVerifier: string;
 };
+export declare function createOAuthClientResolver(config: Pick<OAuthProviderConfig, 'clientId' | 'clientSecret' | 'redirectUri'>): (redirectUri?: string | undefined) => OAuth2Client;
+export declare function mergeOAuthParams(configParams?: Record<string, string>, optionParams?: Record<string, string>): {
+    [x: string]: string;
+};
+export declare function applyOAuthParams(url: URL, params?: Record<string, string>, omitKeys?: string[]): URL;
+export declare function createOAuthAuthorizationUrl(options: {
+    client: OAuth2Client;
+    authorizationUrl: string;
+    state: string;
+    codeVerifier: string;
+    scopes: string[];
+    configParams?: Record<string, string>;
+    params?: Record<string, string>;
+    extraParams?: Record<string, string>;
+    omitParamKeys?: string[];
+}): Promise<URL>;
+export declare function normalizeRefreshedTokens(tokens: Record<string, any>, refreshToken: string): RefreshedTokens;
+export declare function refreshOAuthAccessToken(options: {
+    tokenUrl: string;
+    clientId: string;
+    clientSecret: string;
+    refreshToken: string;
+    scopes?: string[];
+}): Promise<RefreshedTokens>;
 //# sourceMappingURL=utils.d.ts.map

package/dist/src/oauth/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/oauth/utils.ts"],"names":[],"mappings":"AAEA,wBAAgB,eAAe;;;EAQ9B"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/oauth/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AACnE,OAAO,EAA4D,YAAY,EAAE,MAAM,QAAQ,CAAA;AAE/F,wBAAgB,eAAe;;;EAQ9B;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,UAAU,GAAG,cAAc,GAAG,aAAa,CAAC,sDASvH;AAED,wBAAgB,gBAAgB,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;;EAE5G;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAE,MAAM,EAAO,OASlG;AAED,wBAAsB,2BAA2B,CAAC,OAAO,EAAE;IACzD,MAAM,EAAE,YAAY,CAAA;IACpB,gBAAgB,EAAE,MAAM,CAAA;IACxB,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;CACzB,gBAaA;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,MAAM,GAAG,eAAe,CAkB3G;AAED,wBAAsB,uBAAuB,CAAC,OAAO,EAAE;IACrD,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB,4BAwBA"}

package/dist/src/runtimes/index.js

@@ -1 +1 @@
-import{handleTauriDeepLink as o,isTauri as r,linkAccountWithTauri as m,setupTauriListener as p,signInWithTauri as t,startAuthBridge as c}from"../../chunk-PL7MV7OC.js";export{o as handleTauriDeepLink,r as isTauri,m as linkAccountWithTauri,p as setupTauriListener,t as signInWithTauri,c as startAuthBridge};//# sourceMappingURL=index.js.map
+import{handleTauriDeepLink as o,isTauri as r,linkAccountWithTauri as m,setupTauriListener as p,signInWithTauri as t,startAuthBridge as H}from"../../chunk-6HKZAQHT.js";export{o as handleTauriDeepLink,r as isTauri,m as linkAccountWithTauri,p as setupTauriListener,t as signInWithTauri,H as startAuthBridge};//# sourceMappingURL=index.js.map

package/dist/src/runtimes/tauri/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/runtimes/tauri/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAI1D,wBAAgB,OAAO,IAAI,OAAO,CAEjC;AAmBD,wBAAsB,eAAe,CAAC,KAAK,CAAC,KAAK,GAAG,OAAO,EAAE,CAAC,SAAS,WAAW,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,SAAS,GAAG,SAAS,EACjL,QAAQ,EAAE,CAAC,EACX,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAc,EACtB,gBAAgB,CAAC,EAAE,MAAM,EACzB,OAAO,CAAC,EAAE,EAAE,iBA4Cb;AAED,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GACtC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,CAc9B;AAED,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,iBAmCvH;AAED,wBAAsB,oBAAoB,CAAC,KAAK,CAAC,KAAK,GAAG,OAAO,EAAE,CAAC,SAAS,WAAW,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,SAAS,GAAG,SAAS,EACtL,QAAQ,EAAE,CAAC,EACX,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAc,EACtB,gBAAgB,CAAC,EAAE,MAAM,EACzB,OAAO,CAAC,EAAE,EAAE,iBA6Cb;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAC/C,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,CAQ9B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/runtimes/tauri/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAI1D,wBAAgB,OAAO,IAAI,OAAO,CAEjC;AAwCD,wBAAsB,eAAe,CAAC,KAAK,CAAC,KAAK,GAAG,OAAO,EAAE,CAAC,SAAS,WAAW,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,SAAS,GAAG,SAAS,EACjL,QAAQ,EAAE,CAAC,EACX,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAc,EACtB,gBAAgB,CAAC,EAAE,MAAM,EACzB,OAAO,CAAC,EAAE,EAAE,iBAkBb;AAED,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GACtC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,CAc9B;AAED,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,iBAmCvH;AAED,wBAAsB,oBAAoB,CAAC,KAAK,CAAC,KAAK,GAAG,OAAO,EAAE,CAAC,SAAS,WAAW,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,SAAS,GAAG,SAAS,EACtL,QAAQ,EAAE,CAAC,EACX,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAc,EACtB,gBAAgB,CAAC,EAAE,MAAM,EACzB,OAAO,CAAC,EAAE,EAAE,iBAsBb;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAC/C,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,CAQ9B"}

package/dist/src/runtimes/tauri/index.js

@@ -1 +1 @@
-import{handleTauriDeepLink as o,isTauri as r,linkAccountWithTauri as m,setupTauriListener as p,signInWithTauri as t,startAuthBridge as c}from"../../../chunk-PL7MV7OC.js";export{o as handleTauriDeepLink,r as isTauri,m as linkAccountWithTauri,p as setupTauriListener,t as signInWithTauri,c as startAuthBridge};//# sourceMappingURL=index.js.map
+import{handleTauriDeepLink as o,isTauri as r,linkAccountWithTauri as m,setupTauriListener as p,signInWithTauri as t,startAuthBridge as H}from"../../../chunk-6HKZAQHT.js";export{o as handleTauriDeepLink,r as isTauri,m as linkAccountWithTauri,p as setupTauriListener,t as signInWithTauri,H as startAuthBridge};//# sourceMappingURL=index.js.map

package/dist/src/solidstart/index.d.ts

@@ -1,8 +1,8 @@
-import type { CreateAuthOptions, GauServerSession, RefreshSessionOptions } from '../core';
+import type { CreateAuthOptions, RefreshSessionOptions } from '../core';
+import type { AuthInstance } from '../core/serverSession';
 import type { OAuthProvider } from '../oauth';
-import { createAuth, REFRESHED_TOKEN_HEADER } from '../core';
+import { REFRESHED_TOKEN_HEADER } from '../core';
 export { REFRESHED_TOKEN_HEADER };
-type AuthInstance<TProviders extends OAuthProvider<any>[]> = ReturnType<typeof createAuth<TProviders>>;
 /**
  * Creates GET and POST handlers for SolidStart.
  *
@@ -25,7 +25,7 @@ export declare function SolidAuth<const TProviders extends OAuthProvider<any>[]>
  * Returns full session data including access tokens - for server-side use only.
  * @internal
  */
-export declare function createSolidStartGetServerSession<const TProviders extends OAuthProvider<any>[]>(auth: AuthInstance<TProviders>): (request: Request) => Promise<GauServerSession<TProviders[number] extends infer T ? T extends TProviders[number] ? T extends OAuthProvider<infer T_1 extends string, import("../oauth").OAuthProviderConfig> ? T_1 : never : never : never>>;
+export declare function createSolidStartGetServerSession<const TProviders extends OAuthProvider<any>[]>(auth: AuthInstance<TProviders>): (request: Request) => Promise<import("..").GauServerSession<TProviders[number] extends infer T ? T extends TProviders[number] ? T extends OAuthProvider<infer T_1 extends string, import("../oauth").OAuthProviderConfig> ? T_1 : never : never : never>>;
 /**
  * SolidStart middleware factory to attach `locals.getSession` and `locals.getServerSession`.
  *

package/dist/src/solidstart/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/solidstart/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAA2B,qBAAqB,EAAE,MAAM,SAAS,CAAA;AAClH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAE7C,OAAO,EAAE,UAAU,EAA2D,sBAAsB,EAAmB,MAAM,SAAS,CAAA;AAEtI,OAAO,EAAE,sBAAsB,EAAE,CAAA;AAEjC,KAAK,YAAY,CAAC,UAAU,SAAS,aAAa,CAAC,GAAG,CAAC,EAAE,IAAI,UAAU,CAAC,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC,CAAA;AAEtG;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,KAAK,CAAC,UAAU,SAAS,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,iBAAiB,CAAC,UAAU,CAAC,GAAG,YAAY,CAAC,UAAU,CAAC;;;;EAe/I;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAAC,KAAK,CAAC,UAAU,SAAS,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,gPAsB7H;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,CAAC,KAAK,CAAC,UAAU,SAAS,aAAa,CAAC,GAAG,CAAC,EAAE,EAC1E,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,EAClC,aAAa,EAAE,iBAAiB,CAAC,UAAU,CAAC,GAAG,YAAY,CAAC,UAAU,CAAC,iCA0BxE;AAWD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,UAAU,SAAS,aAAa,CAAC,GAAG,CAAC,EAAE,EAC7E,aAAa,EAAE,iBAAiB,CAAC,UAAU,CAAC,GAAG,YAAY,CAAC,UAAU,CAAC,EACvE,OAAO,GAAE,qBAA0B,iCAcpC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/solidstart/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAE7C,OAAO,EAAiB,sBAAsB,EAAE,MAAM,SAAS,CAAA;AAG/D,OAAO,EAAE,sBAAsB,EAAE,CAAA;AAEjC;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,KAAK,CAAC,UAAU,SAAS,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,iBAAiB,CAAC,UAAU,CAAC,GAAG,YAAY,CAAC,UAAU,CAAC;;;;EAe/I;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAAC,KAAK,CAAC,UAAU,SAAS,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,6PAE7H;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,CAAC,KAAK,CAAC,UAAU,SAAS,aAAa,CAAC,GAAG,CAAC,EAAE,EAC1E,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,EAClC,aAAa,EAAE,iBAAiB,CAAC,UAAU,CAAC,GAAG,YAAY,CAAC,UAAU,CAAC,iCAwBxE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,UAAU,SAAS,aAAa,CAAC,GAAG,CAAC,EAAE,EAC7E,aAAa,EAAE,iBAAiB,CAAC,UAAU,CAAC,GAAG,YAAY,CAAC,UAAU,CAAC,EACvE,OAAO,GAAE,qBAA0B,iCAcpC"}

package/dist/src/solidstart/index.js

@@ -1 +1 @@
-import{NULL_SESSION as e,REFRESHED_TOKEN_HEADER as r,createAuth as n,createHandler as o,getSessionTokenFromRequest as s,toClientSession as t}from"../../chunk-RPFUKTQA.js";import"../../chunk-VB2ML4Q5.js";import i from"process";function c(e){const r=l(e);r.development="development"===i.env.NODE_ENV,r.errorRedirect||(r.errorRedirect="/auth/error");const n=o(r),s=e=>n(e.request);return{GET:s,POST:s,OPTIONS:s}}function a(r){return async function(n){const{token:o}=s(n),t=Array.from(r.providerMap.keys());if(!o)return{...e,providers:t};try{const n=await r.validateSession(o);return n?{...n,providers:t}:{...e,providers:t}}catch{return{...e,providers:t}}}}function u(e,r){const n=a(l(r));return async r=>{const o=new URL(r.request.url);if("boolean"==typeof e?e:e.includes(o.pathname)){const e=await n(r.request),o=t(e);return r.locals.getSession=async()=>o,void(r.locals.getServerSession=async()=>e)}let s=null,i=null;r.locals.getServerSession=()=>s??=n(r.request),r.locals.getSession=()=>i??=r.locals.getServerSession().then(t)}}function l(e){return"providerMap"in e&&"signJWT"in e?e:n(e)}function p(e,n={}){const o=l(e);return async e=>{const s=await o.refreshSession(e.request,n);s&&("cookie"===s.source?e.response.headers.set("Set-Cookie",s.cookie):e.response.headers.set(r,s.token))}}export{r as REFRESHED_TOKEN_HEADER,c as SolidAuth,u as authMiddleware,a as createSolidStartGetServerSession,p as refreshMiddleware};//# sourceMappingURL=index.js.map
+import{createRequestSessionCache as e,resolveAuth as s,resolveServerSession as o}from"../../chunk-MXZ363UZ.js";import{REFRESHED_TOKEN_HEADER as r,createHandler as t}from"../../chunk-NHENQLYI.js";import"../../chunk-VB2ML4Q5.js";import"../../chunk-VXWI4D7H.js";import n from"process";function c(e){const o=s(e);o.development="development"===n.env.NODE_ENV,o.errorRedirect||(o.errorRedirect="/auth/error");const r=t(o),c=e=>r(e.request);return{GET:c,POST:c,OPTIONS:c}}function i(e){return async s=>o(e,s)}function u(o,r){const t=s(r),n=i(t);return async s=>{const r=new URL(s.request.url);if("boolean"==typeof o?o:o.includes(r.pathname)){const o=await n(s.request),r=e(t,s.request,o);return s.locals.getSession=r.getSession,void(s.locals.getServerSession=r.getServerSession)}const c=e(t,s.request);s.locals.getServerSession=c.getServerSession,s.locals.getSession=c.getSession}}function a(e,o={}){const t=s(e);return async e=>{const s=await t.refreshSession(e.request,o);s&&("cookie"===s.source?e.response.headers.set("Set-Cookie",s.cookie):e.response.headers.set(r,s.token))}}export{r as REFRESHED_TOKEN_HEADER,c as SolidAuth,u as authMiddleware,i as createSolidStartGetServerSession,a as refreshMiddleware};//# sourceMappingURL=index.js.map

package/dist/src/solidstart/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/solidstart/index.ts"],"sourcesContent":["import type { CreateAuthOptions, GauServerSession, GauSession, ProviderIds, RefreshSessionOptions } from '../core'\nimport type { OAuthProvider } from '../oauth'\nimport process from 'node:process'\nimport { createAuth, createHandler, getSessionTokenFromRequest, NULL_SESSION, REFRESHED_TOKEN_HEADER, toClientSession } from '../core'\n\nexport { REFRESHED_TOKEN_HEADER }\n\ntype AuthInstance<TProviders extends OAuthProvider<any>[]> = ReturnType<typeof createAuth<TProviders>>\n\n/**\n * Creates GET and POST handlers for SolidStart.\n *\n * @example\n * ```ts\n * // src/routes/api/auth/[...auth].ts\n * import { SolidAuth } from '@rttnd/gau/solid-start'\n * import { authOptions } from '~/server/auth'\n *\n * export const { GET, POST } = SolidAuth(authOptions)\n * ```\n */\nexport function SolidAuth<const TProviders extends OAuthProvider<any>[]>(optionsOrAuth: CreateAuthOptions<TProviders> | AuthInstance<TProviders>) {\n  const auth = resolveAuth(optionsOrAuth)\n\n  auth.development = process.env.NODE_ENV === 'development'\n\n  if (!auth.errorRedirect)\n    auth.errorRedirect = '/auth/error'\n\n  const handler = createHandler(auth)\n  const solidHandler = (event: any) => handler(event.request)\n  return {\n    GET: solidHandler,\n    POST: solidHandler,\n    OPTIONS: solidHandler,\n  }\n}\n\n/**\n * Creates a SolidStart-compatible getServerSession resolver to validate a session from a Request.\n * Returns full session data including access tokens - for server-side use only.\n * @internal\n */\nexport function createSolidStartGetServerSession<const TProviders extends OAuthProvider<any>[]>(auth: AuthInstance<TProviders>) {\n  return async function getServerSessionFromRequest(\n    request: Request,\n  ): Promise<GauServerSession<ProviderIds<AuthInstance<TProviders>>>> {\n    const { token: sessionToken } = getSessionTokenFromRequest(request)\n\n    const providers = Array.from(auth.providerMap.keys()) as ProviderIds<AuthInstance<TProviders>>[]\n\n    if (!sessionToken)\n      return { ...NULL_SESSION, providers }\n\n    try {\n      const validated = await auth.validateSession(sessionToken)\n      if (!validated)\n        return { ...NULL_SESSION, providers }\n\n      return { ...validated, providers }\n    }\n    catch {\n      return { ...NULL_SESSION, providers }\n    }\n  }\n}\n\n/**\n * SolidStart middleware factory to attach `locals.getSession` and `locals.getServerSession`.\n *\n * - `getSession()` - Returns client-safe session (no tokens). Safe to serialize to browser.\n * - `getServerSession()` - Returns full session with access/refresh tokens. Server-only.\n *\n * @param pathsToPreLoad - Control eager vs lazy session loading:\n *   - `true` - Preload session on all routes\n *   - `false` - Lazy load (resolve on first `getSession()` call)\n *   - `string[]` - Preload only on specific paths\n *\n * @example\n * ```ts\n * // middleware.ts\n * export default createMiddleware({\n *   onRequest: [authMiddleware(true, auth)],\n * })\n */\nexport function authMiddleware<const TProviders extends OAuthProvider<any>[]>(\n  pathsToPreLoad: string[] | boolean,\n  optionsOrAuth: CreateAuthOptions<TProviders> | AuthInstance<TProviders>,\n) {\n  const auth = resolveAuth(optionsOrAuth)\n\n  const getServerSessionFromRequest = createSolidStartGetServerSession(auth)\n\n  return async (event: any) => {\n    const url = new URL(event.request.url)\n    const shouldPreload = typeof pathsToPreLoad === 'boolean'\n      ? pathsToPreLoad\n      : pathsToPreLoad.includes(url.pathname)\n\n    if (shouldPreload) {\n      const preloaded = await getServerSessionFromRequest(event.request)\n      const clientSession = toClientSession(preloaded)\n      event.locals.getSession = async () => clientSession\n      event.locals.getServerSession = async () => preloaded\n      return\n    }\n\n    let cachedServer: Promise<GauServerSession<ProviderIds<AuthInstance<TProviders>>>> | null = null\n    let cachedClient: Promise<GauSession<ProviderIds<AuthInstance<TProviders>>>> | null = null\n\n    event.locals.getServerSession = () => cachedServer ??= getServerSessionFromRequest(event.request)\n    event.locals.getSession = () => cachedClient ??= event.locals.getServerSession().then(toClientSession)\n  }\n}\n\nfunction resolveAuth<const TProviders extends OAuthProvider<any>[]>(\n  optionsOrAuth: CreateAuthOptions<TProviders> | AuthInstance<TProviders>,\n): AuthInstance<TProviders> {\n  const isInstance = 'providerMap' in optionsOrAuth && 'signJWT' in optionsOrAuth\n  return isInstance\n    ? (optionsOrAuth as AuthInstance<TProviders>)\n    : createAuth(optionsOrAuth as CreateAuthOptions<TProviders>)\n}\n\n/**\n * SolidStart middleware to automatically refresh sessions.\n * Sets the appropriate header based on how the token was provided:\n * - Cookie → Set-Cookie header\n * - Bearer token → X-Refreshed-Token header (for Tauri/mobile clients)\n *\n * @example\n * ```ts\n * // middleware.ts\n * import { authMiddleware, refreshMiddleware } from '@rttnd/gau/solidstart'\n *\n * export default createMiddleware({\n *   onRequest: [\n *     authMiddleware(true, auth),\n *     refreshMiddleware(auth, { threshold: 0.5 }),\n *   ],\n * })\n * ```\n */\nexport function refreshMiddleware<const TProviders extends OAuthProvider<any>[]>(\n  optionsOrAuth: CreateAuthOptions<TProviders> | AuthInstance<TProviders>,\n  options: RefreshSessionOptions = {},\n) {\n  const auth = resolveAuth(optionsOrAuth)\n\n  return async (event: any) => {\n    const refreshed = await auth.refreshSession(event.request, options)\n\n    if (refreshed) {\n      if (refreshed.source === 'cookie')\n        event.response.headers.set('Set-Cookie', refreshed.cookie)\n      else\n        event.response.headers.set(REFRESHED_TOKEN_HEADER, refreshed.token)\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;AAEA,OAAO,aAAa;AAmBb,SAAS,UAAyD,eAAyE;AAChJ,QAAM,OAAO,YAAY,aAAa;AAEtC,OAAK,cAAc,QAAQ,IAAI,aAAa;AAE5C,MAAI,CAAC,KAAK;AACR,SAAK,gBAAgB;AAEvB,QAAM,UAAU,cAAc,IAAI;AAClC,QAAM,eAAe,CAAC,UAAe,QAAQ,MAAM,OAAO;AAC1D,SAAO;AAAA,IACL,KAAK;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AACF;AAOO,SAAS,iCAAgF,MAAgC;AAC9H,SAAO,eAAe,4BACpB,SACkE;AAClE,UAAM,EAAE,OAAO,aAAa,IAAI,2BAA2B,OAAO;AAElE,UAAM,YAAY,MAAM,KAAK,KAAK,YAAY,KAAK,CAAC;AAEpD,QAAI,CAAC;AACH,aAAO,EAAE,GAAG,cAAc,UAAU;AAEtC,QAAI;AACF,YAAM,YAAY,MAAM,KAAK,gBAAgB,YAAY;AACzD,UAAI,CAAC;AACH,eAAO,EAAE,GAAG,cAAc,UAAU;AAEtC,aAAO,EAAE,GAAG,WAAW,UAAU;AAAA,IACnC,QACM;AACJ,aAAO,EAAE,GAAG,cAAc,UAAU;AAAA,IACtC;AAAA,EACF;AACF;AAoBO,SAAS,eACd,gBACA,eACA;AACA,QAAM,OAAO,YAAY,aAAa;AAEtC,QAAM,8BAA8B,iCAAiC,IAAI;AAEzE,SAAO,OAAO,UAAe;AAC3B,UAAM,MAAM,IAAI,IAAI,MAAM,QAAQ,GAAG;AACrC,UAAM,gBAAgB,OAAO,mBAAmB,YAC5C,iBACA,eAAe,SAAS,IAAI,QAAQ;AAExC,QAAI,eAAe;AACjB,YAAM,YAAY,MAAM,4BAA4B,MAAM,OAAO;AACjE,YAAM,gBAAgB,gBAAgB,SAAS;AAC/C,YAAM,OAAO,aAAa,YAAY;AACtC,YAAM,OAAO,mBAAmB,YAAY;AAC5C;AAAA,IACF;AAEA,QAAI,eAAwF;AAC5F,QAAI,eAAkF;AAEtF,UAAM,OAAO,mBAAmB,MAAM,iBAAiB,4BAA4B,MAAM,OAAO;AAChG,UAAM,OAAO,aAAa,MAAM,iBAAiB,MAAM,OAAO,iBAAiB,EAAE,KAAK,eAAe;AAAA,EACvG;AACF;AAEA,SAAS,YACP,eAC0B;AAC1B,QAAM,aAAa,iBAAiB,iBAAiB,aAAa;AAClE,SAAO,aACF,gBACD,WAAW,aAA8C;AAC/D;AAqBO,SAAS,kBACd,eACA,UAAiC,CAAC,GAClC;AACA,QAAM,OAAO,YAAY,aAAa;AAEtC,SAAO,OAAO,UAAe;AAC3B,UAAM,YAAY,MAAM,KAAK,eAAe,MAAM,SAAS,OAAO;AAElE,QAAI,WAAW;AACb,UAAI,UAAU,WAAW;AACvB,cAAM,SAAS,QAAQ,IAAI,cAAc,UAAU,MAAM;AAAA;AAEzD,cAAM,SAAS,QAAQ,IAAI,wBAAwB,UAAU,KAAK;AAAA,IACtE;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../src/solidstart/index.ts"],"sourcesContent":["import type { CreateAuthOptions, RefreshSessionOptions } from '../core'\nimport type { AuthInstance } from '../core/serverSession'\nimport type { OAuthProvider } from '../oauth'\nimport process from 'node:process'\nimport { createHandler, REFRESHED_TOKEN_HEADER } from '../core'\nimport { createRequestSessionCache, resolveAuth, resolveServerSession } from '../core/serverSession'\n\nexport { REFRESHED_TOKEN_HEADER }\n\n/**\n * Creates GET and POST handlers for SolidStart.\n *\n * @example\n * ```ts\n * // src/routes/api/auth/[...auth].ts\n * import { SolidAuth } from '@rttnd/gau/solid-start'\n * import { authOptions } from '~/server/auth'\n *\n * export const { GET, POST } = SolidAuth(authOptions)\n * ```\n */\nexport function SolidAuth<const TProviders extends OAuthProvider<any>[]>(optionsOrAuth: CreateAuthOptions<TProviders> | AuthInstance<TProviders>) {\n  const auth = resolveAuth(optionsOrAuth)\n\n  auth.development = process.env.NODE_ENV === 'development'\n\n  if (!auth.errorRedirect)\n    auth.errorRedirect = '/auth/error'\n\n  const handler = createHandler(auth)\n  const solidHandler = (event: any) => handler(event.request)\n  return {\n    GET: solidHandler,\n    POST: solidHandler,\n    OPTIONS: solidHandler,\n  }\n}\n\n/**\n * Creates a SolidStart-compatible getServerSession resolver to validate a session from a Request.\n * Returns full session data including access tokens - for server-side use only.\n * @internal\n */\nexport function createSolidStartGetServerSession<const TProviders extends OAuthProvider<any>[]>(auth: AuthInstance<TProviders>) {\n  return async (request: Request) => resolveServerSession(auth, request)\n}\n\n/**\n * SolidStart middleware factory to attach `locals.getSession` and `locals.getServerSession`.\n *\n * - `getSession()` - Returns client-safe session (no tokens). Safe to serialize to browser.\n * - `getServerSession()` - Returns full session with access/refresh tokens. Server-only.\n *\n * @param pathsToPreLoad - Control eager vs lazy session loading:\n *   - `true` - Preload session on all routes\n *   - `false` - Lazy load (resolve on first `getSession()` call)\n *   - `string[]` - Preload only on specific paths\n *\n * @example\n * ```ts\n * // middleware.ts\n * export default createMiddleware({\n *   onRequest: [authMiddleware(true, auth)],\n * })\n */\nexport function authMiddleware<const TProviders extends OAuthProvider<any>[]>(\n  pathsToPreLoad: string[] | boolean,\n  optionsOrAuth: CreateAuthOptions<TProviders> | AuthInstance<TProviders>,\n) {\n  const auth = resolveAuth(optionsOrAuth)\n\n  const getServerSession = createSolidStartGetServerSession(auth)\n\n  return async (event: any) => {\n    const url = new URL(event.request.url)\n    const shouldPreload = typeof pathsToPreLoad === 'boolean'\n      ? pathsToPreLoad\n      : pathsToPreLoad.includes(url.pathname)\n\n    if (shouldPreload) {\n      const preloaded = await getServerSession(event.request)\n      const sessionCache = createRequestSessionCache(auth, event.request, preloaded)\n      event.locals.getSession = sessionCache.getSession\n      event.locals.getServerSession = sessionCache.getServerSession\n      return\n    }\n\n    const sessionCache = createRequestSessionCache(auth, event.request)\n    event.locals.getServerSession = sessionCache.getServerSession\n    event.locals.getSession = sessionCache.getSession\n  }\n}\n\n/**\n * SolidStart middleware to automatically refresh sessions.\n * Sets the appropriate header based on how the token was provided:\n * - Cookie → Set-Cookie header\n * - Bearer token → X-Refreshed-Token header (for Tauri/mobile clients)\n *\n * @example\n * ```ts\n * // middleware.ts\n * import { authMiddleware, refreshMiddleware } from '@rttnd/gau/solidstart'\n *\n * export default createMiddleware({\n *   onRequest: [\n *     authMiddleware(true, auth),\n *     refreshMiddleware(auth, { threshold: 0.5 }),\n *   ],\n * })\n * ```\n */\nexport function refreshMiddleware<const TProviders extends OAuthProvider<any>[]>(\n  optionsOrAuth: CreateAuthOptions<TProviders> | AuthInstance<TProviders>,\n  options: RefreshSessionOptions = {},\n) {\n  const auth = resolveAuth(optionsOrAuth)\n\n  return async (event: any) => {\n    const refreshed = await auth.refreshSession(event.request, options)\n\n    if (refreshed) {\n      if (refreshed.source === 'cookie')\n        event.response.headers.set('Set-Cookie', refreshed.cookie)\n      else\n        event.response.headers.set(REFRESHED_TOKEN_HEADER, refreshed.token)\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAGA,OAAO,aAAa;AAkBb,SAAS,UAAyD,eAAyE;AAChJ,QAAM,OAAO,YAAY,aAAa;AAEtC,OAAK,cAAc,QAAQ,IAAI,aAAa;AAE5C,MAAI,CAAC,KAAK;AACR,SAAK,gBAAgB;AAEvB,QAAM,UAAU,cAAc,IAAI;AAClC,QAAM,eAAe,CAAC,UAAe,QAAQ,MAAM,OAAO;AAC1D,SAAO;AAAA,IACL,KAAK;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AACF;AAOO,SAAS,iCAAgF,MAAgC;AAC9H,SAAO,OAAO,YAAqB,qBAAqB,MAAM,OAAO;AACvE;AAoBO,SAAS,eACd,gBACA,eACA;AACA,QAAM,OAAO,YAAY,aAAa;AAEtC,QAAM,mBAAmB,iCAAiC,IAAI;AAE9D,SAAO,OAAO,UAAe;AAC3B,UAAM,MAAM,IAAI,IAAI,MAAM,QAAQ,GAAG;AACrC,UAAM,gBAAgB,OAAO,mBAAmB,YAC5C,iBACA,eAAe,SAAS,IAAI,QAAQ;AAExC,QAAI,eAAe;AACjB,YAAM,YAAY,MAAM,iBAAiB,MAAM,OAAO;AACtD,YAAMA,gBAAe,0BAA0B,MAAM,MAAM,SAAS,SAAS;AAC7E,YAAM,OAAO,aAAaA,cAAa;AACvC,YAAM,OAAO,mBAAmBA,cAAa;AAC7C;AAAA,IACF;AAEA,UAAM,eAAe,0BAA0B,MAAM,MAAM,OAAO;AAClE,UAAM,OAAO,mBAAmB,aAAa;AAC7C,UAAM,OAAO,aAAa,aAAa;AAAA,EACzC;AACF;AAqBO,SAAS,kBACd,eACA,UAAiC,CAAC,GAClC;AACA,QAAM,OAAO,YAAY,aAAa;AAEtC,SAAO,OAAO,UAAe;AAC3B,UAAM,YAAY,MAAM,KAAK,eAAe,MAAM,SAAS,OAAO;AAElE,QAAI,WAAW;AACb,UAAI,UAAU,WAAW;AACvB,cAAM,SAAS,QAAQ,IAAI,cAAc,UAAU,MAAM;AAAA;AAEzD,cAAM,SAAS,QAAQ,IAAI,wBAAwB,UAAU,KAAK;AAAA,IACtE;AAAA,EACF;AACF;","names":["sessionCache"]}

package/dist/src/sveltekit/index.d.ts

@@ -1,9 +1,9 @@
 import type { Handle, RequestEvent } from '@sveltejs/kit';
 import type { CreateAuthOptions, RefreshSessionOptions } from '../core';
+import type { AuthInstance } from '../core/serverSession';
 import type { OAuthProvider } from '../oauth';
-import { createAuth, REFRESHED_TOKEN_HEADER } from '../core';
+import { REFRESHED_TOKEN_HEADER } from '../core';
 export { REFRESHED_TOKEN_HEADER };
-type AuthInstance<TProviders extends OAuthProvider<any>[]> = ReturnType<typeof createAuth<TProviders>>;
 /**
  * Creates GET and POST handlers for SvelteKit.
  *

package/dist/src/sveltekit/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/sveltekit/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAA6C,qBAAqB,EAAE,MAAM,SAAS,CAAA;AAClH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,EAAE,UAAU,EAA2D,sBAAsB,EAAmB,MAAM,SAAS,CAAA;AAEtI,OAAO,EAAE,sBAAsB,EAAE,CAAA;AAEjC,KAAK,YAAY,CAAC,UAAU,SAAS,aAAa,CAAC,GAAG,CAAC,EAAE,IAAI,UAAU,CAAC,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC,CAAA;AAEtG;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,KAAK,CAAC,UAAU,SAAS,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,iBAAiB,CAAC,UAAU,CAAC,GAAG,YAAY,CAAC,UAAU,CAAC;;;;;EA+DnJ;AAWD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,CAAC,UAAU,SAAS,aAAa,CAAC,GAAG,CAAC,EAAE,EAC/E,aAAa,EAAE,iBAAiB,CAAC,UAAU,CAAC,GAAG,YAAY,CAAC,UAAU,CAAC,EACvE,OAAO,GAAE,qBAA0B,GAClC,MAAM,CAiBR"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/sveltekit/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,EAAiB,sBAAsB,EAAE,MAAM,SAAS,CAAA;AAG/D,OAAO,EAAE,sBAAsB,EAAE,CAAA;AAEjC;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,KAAK,CAAC,UAAU,SAAS,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,iBAAiB,CAAC,UAAU,CAAC,GAAG,YAAY,CAAC,UAAU,CAAC;;;;;EAiCnJ;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,CAAC,UAAU,SAAS,aAAa,CAAC,GAAG,CAAC,EAAE,EAC/E,aAAa,EAAE,iBAAiB,CAAC,UAAU,CAAC,GAAG,YAAY,CAAC,UAAU,CAAC,EACvE,OAAO,GAAE,qBAA0B,GAClC,MAAM,CAiBR"}

package/dist/src/sveltekit/index.js

@@ -1 +1 @@
-import{NULL_SESSION as e,REFRESHED_TOKEN_HEADER as r,createAuth as t,createHandler as n,getSessionTokenFromRequest as o,toClientSession as s}from"../../chunk-RPFUKTQA.js";import"../../chunk-VB2ML4Q5.js";function i(r){const i="providerMap"in r&&"signJWT"in r?r:t(r);i.errorRedirect||(i.errorRedirect="/auth/error"),(async()=>{try{i.development=(await import("$app/environment")).dev}catch{i.development=!1}})();const a=n(i),c=e=>a(e.request);return{GET:c,POST:c,OPTIONS:c,handle:async({event:r,resolve:t})=>{let n=null,a=null;const c=()=>n??=(async()=>{const{token:t}=o(r.request),n=Array.from(i.providerMap.keys());if(!t)return{...e,providers:n};try{const r=await i.validateSession(t);return r?{...r,providers:n}:{...e,providers:n}}catch{return{...e,providers:n}}})();return r.locals.getServerSession=c,r.locals.getSession=()=>a??=c().then(s),t(r)}}}function a(e,n={}){const o=function(e){return"providerMap"in e&&"signJWT"in e?e:t(e)}(e);return async({event:e,resolve:t})=>{const s=await o.refreshSession(e.request,n),i=await t(e);return s&&("cookie"===s.source?i.headers.set("Set-Cookie",s.cookie):i.headers.set(r,s.token)),i}}export{r as REFRESHED_TOKEN_HEADER,i as SvelteKitAuth,a as createRefreshHandle};//# sourceMappingURL=index.js.map
+import{createRequestSessionCache as e,resolveAuth as r}from"../../chunk-MXZ363UZ.js";import{REFRESHED_TOKEN_HEADER as t,createHandler as o}from"../../chunk-NHENQLYI.js";import"../../chunk-VB2ML4Q5.js";import"../../chunk-VXWI4D7H.js";function s(t){const s=r(t);s.errorRedirect||(s.errorRedirect="/auth/error"),(async()=>{try{s.development=(await import("$app/environment")).dev}catch{s.development=!1}})();const n=o(s),c=e=>n(e.request);return{GET:c,POST:c,OPTIONS:c,handle:async({event:r,resolve:t})=>{const{getServerSession:o,getSession:n}=e(s,r.request);return r.locals.getServerSession=o,r.locals.getSession=n,t(r)}}}function n(e,o={}){const s=r(e);return async({event:e,resolve:r})=>{const n=await s.refreshSession(e.request,o),c=await r(e);return n&&("cookie"===n.source?c.headers.set("Set-Cookie",n.cookie):c.headers.set(t,n.token)),c}}export{t as REFRESHED_TOKEN_HEADER,s as SvelteKitAuth,n as createRefreshHandle};//# sourceMappingURL=index.js.map

package/dist/src/sveltekit/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/sveltekit/index.ts"],"sourcesContent":["import type { Handle, RequestEvent } from '@sveltejs/kit'\nimport type { CreateAuthOptions, GauServerSession, GauSession, ProviderIds, RefreshSessionOptions } from '../core'\nimport type { OAuthProvider } from '../oauth'\nimport { createAuth, createHandler, getSessionTokenFromRequest, NULL_SESSION, REFRESHED_TOKEN_HEADER, toClientSession } from '../core'\n\nexport { REFRESHED_TOKEN_HEADER }\n\ntype AuthInstance<TProviders extends OAuthProvider<any>[]> = ReturnType<typeof createAuth<TProviders>>\n\n/**\n * Creates GET and POST handlers for SvelteKit.\n *\n * The returned `handle` hook attaches two methods to `event.locals`:\n * - `getSession()` - Returns client-safe session (no tokens). Safe to serialize to browser.\n * - `getServerSession()` - Returns full session with access/refresh tokens. Server-only.\n *\n * @example\n * ```ts\n * // src/routes/api/auth/[...gau]/+server.ts\n * import { SvelteKitAuth } from '@rttnd/gau/sveltekit'\n * import { auth } from '$lib/server/auth'\n *\n * export const { GET, POST, handle } = SvelteKitAuth(auth)\n * ```\n */\nexport function SvelteKitAuth<const TProviders extends OAuthProvider<any>[]>(optionsOrAuth: CreateAuthOptions<TProviders> | AuthInstance<TProviders>) {\n  // TODO: Duck-type to check if we have an instance or raw options\n  const isInstance = 'providerMap' in optionsOrAuth && 'signJWT' in optionsOrAuth\n\n  const auth = isInstance\n    ? (optionsOrAuth as AuthInstance<TProviders>)\n    : createAuth(optionsOrAuth as CreateAuthOptions<TProviders>)\n\n  if (!auth.errorRedirect)\n    auth.errorRedirect = '/auth/error'\n\n  void (async () => {\n    try {\n      auth.development = (await import('$app/environment')).dev\n    }\n    catch {\n      auth.development = false\n    }\n  })()\n\n  const handler = createHandler(auth)\n  const sveltekitHandler = (event: RequestEvent) => handler(event.request)\n\n  const handle: Handle = async ({ event, resolve }) => {\n    let cachedServer: Promise<GauServerSession<ProviderIds<AuthInstance<TProviders>>>> | null = null\n    let cachedClient: Promise<GauSession<ProviderIds<AuthInstance<TProviders>>>> | null = null\n\n    const getServerSession = (): Promise<GauServerSession<ProviderIds<AuthInstance<TProviders>>>> => {\n      return cachedServer ??= (async () => {\n        const { token: sessionToken } = getSessionTokenFromRequest(event.request)\n\n        const providers = Array.from(auth.providerMap.keys()) as ProviderIds<AuthInstance<TProviders>>[]\n\n        if (!sessionToken)\n          return { ...NULL_SESSION, providers }\n\n        try {\n          const validated = await auth.validateSession(sessionToken)\n          if (!validated)\n            return { ...NULL_SESSION, providers }\n\n          return { ...validated, providers }\n        }\n        catch {\n          return { ...NULL_SESSION, providers }\n        }\n      })()\n    };\n\n    (event.locals as any).getServerSession = getServerSession;\n    (event.locals as any).getSession = (): Promise<GauSession<ProviderIds<AuthInstance<TProviders>>>> => {\n      return cachedClient ??= getServerSession().then(toClientSession)\n    }\n\n    return resolve(event)\n  }\n\n  return {\n    GET: sveltekitHandler,\n    POST: sveltekitHandler,\n    OPTIONS: sveltekitHandler,\n    handle,\n  }\n}\n\nfunction resolveAuth<const TProviders extends OAuthProvider<any>[]>(\n  optionsOrAuth: CreateAuthOptions<TProviders> | AuthInstance<TProviders>,\n): AuthInstance<TProviders> {\n  const isInstance = 'providerMap' in optionsOrAuth && 'signJWT' in optionsOrAuth\n  return isInstance\n    ? (optionsOrAuth as AuthInstance<TProviders>)\n    : createAuth(optionsOrAuth as CreateAuthOptions<TProviders>)\n}\n\n/**\n * Creates a SvelteKit handle that automatically refreshes sessions.\n * Sets the appropriate header based on how the token was provided:\n * - Cookie → Set-Cookie header\n * - Bearer token → X-Refreshed-Token header (for Tauri/mobile clients)\n *\n * @example\n * ```ts\n * // hooks.server.ts\n * import { sequence } from '@sveltejs/kit/hooks'\n * import { handle as authHandle } from './routes/api/auth/[...gau]/+server'\n * import { createRefreshHandle } from '@rttnd/gau/sveltekit'\n * import { auth } from '$lib/server/auth'\n *\n * export const handle = sequence(authHandle, createRefreshHandle(auth, { threshold: 0.5 }))\n * ```\n */\nexport function createRefreshHandle<const TProviders extends OAuthProvider<any>[]>(\n  optionsOrAuth: CreateAuthOptions<TProviders> | AuthInstance<TProviders>,\n  options: RefreshSessionOptions = {},\n): Handle {\n  const auth = resolveAuth(optionsOrAuth)\n\n  return async ({ event, resolve }) => {\n    const refreshed = await auth.refreshSession(event.request, options)\n\n    const response = await resolve(event)\n\n    if (refreshed) {\n      if (refreshed.source === 'cookie')\n        response.headers.set('Set-Cookie', refreshed.cookie)\n      else\n        response.headers.set(REFRESHED_TOKEN_HEADER, refreshed.token)\n    }\n\n    return response\n  }\n}\n"],"mappings":";;;;;;;;;;;AAyBO,SAAS,cAA6D,eAAyE;AAEpJ,QAAM,aAAa,iBAAiB,iBAAiB,aAAa;AAElE,QAAM,OAAO,aACR,gBACD,WAAW,aAA8C;AAE7D,MAAI,CAAC,KAAK;AACR,SAAK,gBAAgB;AAEvB,QAAM,YAAY;AAChB,QAAI;AACF,WAAK,eAAe,MAAM,OAAO,kBAAkB,GAAG;AAAA,IACxD,QACM;AACJ,WAAK,cAAc;AAAA,IACrB;AAAA,EACF,GAAG;AAEH,QAAM,UAAU,cAAc,IAAI;AAClC,QAAM,mBAAmB,CAAC,UAAwB,QAAQ,MAAM,OAAO;AAEvE,QAAM,SAAiB,OAAO,EAAE,OAAO,QAAQ,MAAM;AACnD,QAAI,eAAwF;AAC5F,QAAI,eAAkF;AAEtF,UAAM,mBAAmB,MAAwE;AAC/F,aAAO,kBAAkB,YAAY;AACnC,cAAM,EAAE,OAAO,aAAa,IAAI,2BAA2B,MAAM,OAAO;AAExE,cAAM,YAAY,MAAM,KAAK,KAAK,YAAY,KAAK,CAAC;AAEpD,YAAI,CAAC;AACH,iBAAO,EAAE,GAAG,cAAc,UAAU;AAEtC,YAAI;AACF,gBAAM,YAAY,MAAM,KAAK,gBAAgB,YAAY;AACzD,cAAI,CAAC;AACH,mBAAO,EAAE,GAAG,cAAc,UAAU;AAEtC,iBAAO,EAAE,GAAG,WAAW,UAAU;AAAA,QACnC,QACM;AACJ,iBAAO,EAAE,GAAG,cAAc,UAAU;AAAA,QACtC;AAAA,MACF,GAAG;AAAA,IACL;AAEA,IAAC,MAAM,OAAe,mBAAmB;AACzC,IAAC,MAAM,OAAe,aAAa,MAAkE;AACnG,aAAO,iBAAiB,iBAAiB,EAAE,KAAK,eAAe;AAAA,IACjE;AAEA,WAAO,QAAQ,KAAK;AAAA,EACtB;AAEA,SAAO;AAAA,IACL,KAAK;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,YACP,eAC0B;AAC1B,QAAM,aAAa,iBAAiB,iBAAiB,aAAa;AAClE,SAAO,aACF,gBACD,WAAW,aAA8C;AAC/D;AAmBO,SAAS,oBACd,eACA,UAAiC,CAAC,GAC1B;AACR,QAAM,OAAO,YAAY,aAAa;AAEtC,SAAO,OAAO,EAAE,OAAO,QAAQ,MAAM;AACnC,UAAM,YAAY,MAAM,KAAK,eAAe,MAAM,SAAS,OAAO;AAElE,UAAM,WAAW,MAAM,QAAQ,KAAK;AAEpC,QAAI,WAAW;AACb,UAAI,UAAU,WAAW;AACvB,iBAAS,QAAQ,IAAI,cAAc,UAAU,MAAM;AAAA;AAEnD,iBAAS,QAAQ,IAAI,wBAAwB,UAAU,KAAK;AAAA,IAChE;AAEA,WAAO;AAAA,EACT;AACF;","names":[]}
+{"version":3,"sources":["../../../src/sveltekit/index.ts"],"sourcesContent":["import type { Handle, RequestEvent } from '@sveltejs/kit'\nimport type { CreateAuthOptions, RefreshSessionOptions } from '../core'\nimport type { AuthInstance } from '../core/serverSession'\nimport type { OAuthProvider } from '../oauth'\nimport { createHandler, REFRESHED_TOKEN_HEADER } from '../core'\nimport { createRequestSessionCache, resolveAuth } from '../core/serverSession'\n\nexport { REFRESHED_TOKEN_HEADER }\n\n/**\n * Creates GET and POST handlers for SvelteKit.\n *\n * The returned `handle` hook attaches two methods to `event.locals`:\n * - `getSession()` - Returns client-safe session (no tokens). Safe to serialize to browser.\n * - `getServerSession()` - Returns full session with access/refresh tokens. Server-only.\n *\n * @example\n * ```ts\n * // src/routes/api/auth/[...gau]/+server.ts\n * import { SvelteKitAuth } from '@rttnd/gau/sveltekit'\n * import { auth } from '$lib/server/auth'\n *\n * export const { GET, POST, handle } = SvelteKitAuth(auth)\n * ```\n */\nexport function SvelteKitAuth<const TProviders extends OAuthProvider<any>[]>(optionsOrAuth: CreateAuthOptions<TProviders> | AuthInstance<TProviders>) {\n  const auth = resolveAuth(optionsOrAuth)\n\n  if (!auth.errorRedirect)\n    auth.errorRedirect = '/auth/error'\n\n  void (async () => {\n    try {\n      auth.development = (await import('$app/environment')).dev\n    }\n    catch {\n      auth.development = false\n    }\n  })()\n\n  const handler = createHandler(auth)\n  const sveltekitHandler = (event: RequestEvent) => handler(event.request)\n\n  const handle: Handle = async ({ event, resolve }) => {\n    const { getServerSession, getSession } = createRequestSessionCache(auth, event.request)\n\n    ;(event.locals as any).getServerSession = getServerSession\n    ;(event.locals as any).getSession = getSession\n\n    return resolve(event)\n  }\n\n  return {\n    GET: sveltekitHandler,\n    POST: sveltekitHandler,\n    OPTIONS: sveltekitHandler,\n    handle,\n  }\n}\n\n/**\n * Creates a SvelteKit handle that automatically refreshes sessions.\n * Sets the appropriate header based on how the token was provided:\n * - Cookie → Set-Cookie header\n * - Bearer token → X-Refreshed-Token header (for Tauri/mobile clients)\n *\n * @example\n * ```ts\n * // hooks.server.ts\n * import { sequence } from '@sveltejs/kit/hooks'\n * import { handle as authHandle } from './routes/api/auth/[...gau]/+server'\n * import { createRefreshHandle } from '@rttnd/gau/sveltekit'\n * import { auth } from '$lib/server/auth'\n *\n * export const handle = sequence(authHandle, createRefreshHandle(auth, { threshold: 0.5 }))\n * ```\n */\nexport function createRefreshHandle<const TProviders extends OAuthProvider<any>[]>(\n  optionsOrAuth: CreateAuthOptions<TProviders> | AuthInstance<TProviders>,\n  options: RefreshSessionOptions = {},\n): Handle {\n  const auth = resolveAuth(optionsOrAuth)\n\n  return async ({ event, resolve }) => {\n    const refreshed = await auth.refreshSession(event.request, options)\n\n    const response = await resolve(event)\n\n    if (refreshed) {\n      if (refreshed.source === 'cookie')\n        response.headers.set('Set-Cookie', refreshed.cookie)\n      else\n        response.headers.set(REFRESHED_TOKEN_HEADER, refreshed.token)\n    }\n\n    return response\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAyBO,SAAS,cAA6D,eAAyE;AACpJ,QAAM,OAAO,YAAY,aAAa;AAEtC,MAAI,CAAC,KAAK;AACR,SAAK,gBAAgB;AAEvB,QAAM,YAAY;AAChB,QAAI;AACF,WAAK,eAAe,MAAM,OAAO,kBAAkB,GAAG;AAAA,IACxD,QACM;AACJ,WAAK,cAAc;AAAA,IACrB;AAAA,EACF,GAAG;AAEH,QAAM,UAAU,cAAc,IAAI;AAClC,QAAM,mBAAmB,CAAC,UAAwB,QAAQ,MAAM,OAAO;AAEvE,QAAM,SAAiB,OAAO,EAAE,OAAO,QAAQ,MAAM;AACnD,UAAM,EAAE,kBAAkB,WAAW,IAAI,0BAA0B,MAAM,MAAM,OAAO;AAErF,IAAC,MAAM,OAAe,mBAAmB;AACzC,IAAC,MAAM,OAAe,aAAa;AAEpC,WAAO,QAAQ,KAAK;AAAA,EACtB;AAEA,SAAO;AAAA,IACL,KAAK;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,IACT;AAAA,EACF;AACF;AAmBO,SAAS,oBACd,eACA,UAAiC,CAAC,GAC1B;AACR,QAAM,OAAO,YAAY,aAAa;AAEtC,SAAO,OAAO,EAAE,OAAO,QAAQ,MAAM;AACnC,UAAM,YAAY,MAAM,KAAK,eAAe,MAAM,SAAS,OAAO;AAElE,UAAM,WAAW,MAAM,QAAQ,KAAK;AAEpC,QAAI,WAAW;AACb,UAAI,UAAU,WAAW;AACvB,iBAAS,QAAQ,IAAI,cAAc,UAAU,MAAM;AAAA;AAEnD,iBAAS,QAAQ,IAAI,wBAAwB,UAAU,KAAK;AAAA,IAChE;AAEA,WAAO;AAAA,EACT;AACF;","names":[]}