@shware/security 0.4.3

package/dist/oauth2/client.cjs

@@ -0,0 +1,110 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/oauth2/client.ts
+var client_exports = {};
+__export(client_exports, {
+  OAuth2Client: () => OAuth2Client,
+  oauth2RedirectQuerySchema: () => oauth2RedirectQuerySchema
+});
+module.exports = __toCommonJS(client_exports);
+var import_zod = require("zod");
+var import_tiny_invariant = __toESM(require("tiny-invariant"), 1);
+var oauth2RedirectQuerySchema = import_zod.z.object({
+  code: import_zod.z.string(),
+  state: import_zod.z.string(),
+  error: import_zod.z.string().optional(),
+  error_description: import_zod.z.string().optional(),
+  error_uri: import_zod.z.string().optional()
+});
+var OAuth2Client = class {
+  config;
+  constructor(config) {
+    this.config = config;
+  }
+  get baseUri() {
+    return this.config.baseUri;
+  }
+  get errorUri() {
+    return this.config.errorUri;
+  }
+  getClientConfig(registrationId) {
+    const registration = this.config.registration[registrationId];
+    (0, import_tiny_invariant.default)(registration, `Registration ${registrationId} not found`);
+    const provider = this.config.provider[registration.provider ?? registrationId];
+    (0, import_tiny_invariant.default)(provider, `Provider ${registration.provider ?? registrationId} not found`);
+    return { registration, provider };
+  }
+  createAuthorizationUri(registrationId, state, codeVerifier) {
+    const { provider, registration } = this.getClientConfig(registrationId);
+    const { baseUri } = this.config;
+    const { scope, clientId, redirectUri } = registration;
+    return provider.createAuthorizationUri({
+      state,
+      scope,
+      clientId,
+      codeVerifier,
+      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`
+    });
+  }
+  async exchangeAuthorizationCode(registrationId, code, codeVerifier) {
+    const { provider, registration } = this.getClientConfig(registrationId);
+    const { baseUri } = this.config;
+    const { clientId, clientSecret, redirectUri } = registration;
+    return provider.exchangeAuthorizationCode({
+      code,
+      codeVerifier,
+      clientId,
+      clientSecret,
+      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`
+    });
+  }
+  async getUserInfo(registrationId, token) {
+    const { provider } = this.getClientConfig(registrationId);
+    return provider.getUserInfo(token);
+  }
+  async refreshAccessToken(registrationId, refreshToken) {
+    const { provider, registration } = this.getClientConfig(registrationId);
+    const { clientId, clientSecret } = registration;
+    (0, import_tiny_invariant.default)(provider.refreshAccessToken, "Provider does not support refreshAccessToken");
+    return provider.refreshAccessToken({ refreshToken, clientId, clientSecret });
+  }
+  async revokeToken(registrationId, token) {
+    const { provider, registration } = this.getClientConfig(registrationId);
+    const { clientId, clientSecret } = registration;
+    (0, import_tiny_invariant.default)(provider.revokeToken, "Provider does not support revokeToken");
+    await provider.revokeToken({ token, clientId, clientSecret });
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  OAuth2Client,
+  oauth2RedirectQuerySchema
+});
+//# sourceMappingURL=client.cjs.map

package/dist/oauth2/client.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { z } from 'zod';\nimport invariant from 'tiny-invariant';\nimport { OAuth2ClientConfig, OAuth2Token } from './types';\n\nexport const oauth2RedirectQuerySchema = z.object({\n  code: z.string(),\n  state: z.string(),\n  error: z.string().optional(),\n  error_description: z.string().optional(),\n  error_uri: z.string().optional(),\n});\n\nexport class OAuth2Client {\n  private config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  getClientConfig(registrationId: string) {\n    const registration = this.config.registration[registrationId];\n    invariant(registration, `Registration ${registrationId} not found`);\n    const provider = this.config.provider[registration.provider ?? registrationId];\n    invariant(provider, `Provider ${registration.provider ?? registrationId} not found`);\n    return { registration, provider };\n  }\n\n  createAuthorizationUri(registrationId: string, state: string, codeVerifier?: string): URL {\n    const { provider, registration } = this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { scope, clientId, redirectUri } = registration;\n    return provider.createAuthorizationUri({\n      state,\n      scope,\n      clientId,\n      codeVerifier,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async exchangeAuthorizationCode(\n    registrationId: string,\n    code: string,\n    codeVerifier?: string\n  ): Promise<OAuth2Token> {\n    const { provider, registration } = this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n    return provider.exchangeAuthorizationCode({\n      code,\n      codeVerifier,\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async getUserInfo(registrationId: string, token: OAuth2Token) {\n    const { provider } = this.getClientConfig(registrationId);\n    return provider.getUserInfo(token);\n  }\n\n  async refreshAccessToken(registrationId: string, refreshToken: string): Promise<OAuth2Token> {\n    const { provider, registration } = this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    return provider.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken(registrationId: string, token: string) {\n    const { provider, registration } = this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.revokeToken, 'Provider does not support revokeToken');\n    await provider.revokeToken({ token, clientId, clientSecret });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAAkB;AAClB,4BAAsB;AAGf,IAAM,4BAA4B,aAAE,OAAO;AAAA,EAChD,MAAM,aAAE,OAAO;AAAA,EACf,OAAO,aAAE,OAAO;AAAA,EAChB,OAAO,aAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,mBAAmB,aAAE,OAAO,EAAE,SAAS;AAAA,EACvC,WAAW,aAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAEM,IAAM,eAAN,MAAmB;AAAA,EAChB;AAAA,EACR,YAAY,QAA4B;AACtC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,IAAI,UAAU;AACZ,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,IAAI,WAAW;AACb,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,gBAAgB,gBAAwB;AACtC,UAAM,eAAe,KAAK,OAAO,aAAa,cAAc;AAC5D,8BAAAA,SAAU,cAAc,gBAAgB,cAAc,YAAY;AAClE,UAAM,WAAW,KAAK,OAAO,SAAS,aAAa,YAAY,cAAc;AAC7E,8BAAAA,SAAU,UAAU,YAAY,aAAa,YAAY,cAAc,YAAY;AACnF,WAAO,EAAE,cAAc,SAAS;AAAA,EAClC;AAAA,EAEA,uBAAuB,gBAAwB,OAAe,cAA4B;AACxF,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AAEtE,UAAM,EAAE,QAAQ,IAAI,KAAK;AACzB,UAAM,EAAE,OAAO,UAAU,YAAY,IAAI;AACzC,WAAO,SAAS,uBAAuB;AAAA,MACrC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,eAAe,GAAG,OAAO,sBAAsB,cAAc;AAAA,IAC5E,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,0BACJ,gBACA,MACA,cACsB;AACtB,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AAEtE,UAAM,EAAE,QAAQ,IAAI,KAAK;AACzB,UAAM,EAAE,UAAU,cAAc,YAAY,IAAI;AAChD,WAAO,SAAS,0BAA0B;AAAA,MACxC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,eAAe,GAAG,OAAO,sBAAsB,cAAc;AAAA,IAC5E,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,YAAY,gBAAwB,OAAoB;AAC5D,UAAM,EAAE,SAAS,IAAI,KAAK,gBAAgB,cAAc;AACxD,WAAO,SAAS,YAAY,KAAK;AAAA,EACnC;AAAA,EAEA,MAAM,mBAAmB,gBAAwB,cAA4C;AAC3F,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AACtE,UAAM,EAAE,UAAU,aAAa,IAAI;AAEnC,8BAAAA,SAAU,SAAS,oBAAoB,8CAA8C;AACrF,WAAO,SAAS,mBAAmB,EAAE,cAAc,UAAU,aAAa,CAAC;AAAA,EAC7E;AAAA,EAEA,MAAM,YAAY,gBAAwB,OAAe;AACvD,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AACtE,UAAM,EAAE,UAAU,aAAa,IAAI;AAEnC,8BAAAA,SAAU,SAAS,aAAa,uCAAuC;AACvE,UAAM,SAAS,YAAY,EAAE,OAAO,UAAU,aAAa,CAAC;AAAA,EAC9D;AACF;","names":["invariant"]}

package/dist/oauth2/client.d.cts

@@ -0,0 +1,39 @@
+import { OAuth2ClientConfig, Registration, Provider, OAuth2Token, UserInfo } from './types.cjs';
+import { z } from 'zod';
+
+declare const oauth2RedirectQuerySchema: z.ZodObject<{
+    code: z.ZodString;
+    state: z.ZodString;
+    error: z.ZodOptional<z.ZodString>;
+    error_description: z.ZodOptional<z.ZodString>;
+    error_uri: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    code: string;
+    state: string;
+    error?: string | undefined;
+    error_description?: string | undefined;
+    error_uri?: string | undefined;
+}, {
+    code: string;
+    state: string;
+    error?: string | undefined;
+    error_description?: string | undefined;
+    error_uri?: string | undefined;
+}>;
+declare class OAuth2Client {
+    private config;
+    constructor(config: OAuth2ClientConfig);
+    get baseUri(): string;
+    get errorUri(): string;
+    getClientConfig(registrationId: string): {
+        registration: Registration;
+        provider: Provider<Record<string, any>>;
+    };
+    createAuthorizationUri(registrationId: string, state: string, codeVerifier?: string): URL;
+    exchangeAuthorizationCode(registrationId: string, code: string, codeVerifier?: string): Promise<OAuth2Token>;
+    getUserInfo(registrationId: string, token: OAuth2Token): Promise<UserInfo<Record<string, any>>>;
+    refreshAccessToken(registrationId: string, refreshToken: string): Promise<OAuth2Token>;
+    revokeToken(registrationId: string, token: string): Promise<void>;
+}
+
+export { OAuth2Client, oauth2RedirectQuerySchema };

package/dist/oauth2/client.d.ts

@@ -0,0 +1,39 @@
+import { OAuth2ClientConfig, Registration, Provider, OAuth2Token, UserInfo } from './types.js';
+import { z } from 'zod';
+
+declare const oauth2RedirectQuerySchema: z.ZodObject<{
+    code: z.ZodString;
+    state: z.ZodString;
+    error: z.ZodOptional<z.ZodString>;
+    error_description: z.ZodOptional<z.ZodString>;
+    error_uri: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    code: string;
+    state: string;
+    error?: string | undefined;
+    error_description?: string | undefined;
+    error_uri?: string | undefined;
+}, {
+    code: string;
+    state: string;
+    error?: string | undefined;
+    error_description?: string | undefined;
+    error_uri?: string | undefined;
+}>;
+declare class OAuth2Client {
+    private config;
+    constructor(config: OAuth2ClientConfig);
+    get baseUri(): string;
+    get errorUri(): string;
+    getClientConfig(registrationId: string): {
+        registration: Registration;
+        provider: Provider<Record<string, any>>;
+    };
+    createAuthorizationUri(registrationId: string, state: string, codeVerifier?: string): URL;
+    exchangeAuthorizationCode(registrationId: string, code: string, codeVerifier?: string): Promise<OAuth2Token>;
+    getUserInfo(registrationId: string, token: OAuth2Token): Promise<UserInfo<Record<string, any>>>;
+    refreshAccessToken(registrationId: string, refreshToken: string): Promise<OAuth2Token>;
+    revokeToken(registrationId: string, token: string): Promise<void>;
+}
+
+export { OAuth2Client, oauth2RedirectQuerySchema };

package/dist/oauth2/client.mjs

@@ -0,0 +1,74 @@
+// src/oauth2/client.ts
+import { z } from "zod";
+import invariant from "tiny-invariant";
+var oauth2RedirectQuerySchema = z.object({
+  code: z.string(),
+  state: z.string(),
+  error: z.string().optional(),
+  error_description: z.string().optional(),
+  error_uri: z.string().optional()
+});
+var OAuth2Client = class {
+  config;
+  constructor(config) {
+    this.config = config;
+  }
+  get baseUri() {
+    return this.config.baseUri;
+  }
+  get errorUri() {
+    return this.config.errorUri;
+  }
+  getClientConfig(registrationId) {
+    const registration = this.config.registration[registrationId];
+    invariant(registration, `Registration ${registrationId} not found`);
+    const provider = this.config.provider[registration.provider ?? registrationId];
+    invariant(provider, `Provider ${registration.provider ?? registrationId} not found`);
+    return { registration, provider };
+  }
+  createAuthorizationUri(registrationId, state, codeVerifier) {
+    const { provider, registration } = this.getClientConfig(registrationId);
+    const { baseUri } = this.config;
+    const { scope, clientId, redirectUri } = registration;
+    return provider.createAuthorizationUri({
+      state,
+      scope,
+      clientId,
+      codeVerifier,
+      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`
+    });
+  }
+  async exchangeAuthorizationCode(registrationId, code, codeVerifier) {
+    const { provider, registration } = this.getClientConfig(registrationId);
+    const { baseUri } = this.config;
+    const { clientId, clientSecret, redirectUri } = registration;
+    return provider.exchangeAuthorizationCode({
+      code,
+      codeVerifier,
+      clientId,
+      clientSecret,
+      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`
+    });
+  }
+  async getUserInfo(registrationId, token) {
+    const { provider } = this.getClientConfig(registrationId);
+    return provider.getUserInfo(token);
+  }
+  async refreshAccessToken(registrationId, refreshToken) {
+    const { provider, registration } = this.getClientConfig(registrationId);
+    const { clientId, clientSecret } = registration;
+    invariant(provider.refreshAccessToken, "Provider does not support refreshAccessToken");
+    return provider.refreshAccessToken({ refreshToken, clientId, clientSecret });
+  }
+  async revokeToken(registrationId, token) {
+    const { provider, registration } = this.getClientConfig(registrationId);
+    const { clientId, clientSecret } = registration;
+    invariant(provider.revokeToken, "Provider does not support revokeToken");
+    await provider.revokeToken({ token, clientId, clientSecret });
+  }
+};
+export {
+  OAuth2Client,
+  oauth2RedirectQuerySchema
+};
+//# sourceMappingURL=client.mjs.map

package/dist/oauth2/client.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { z } from 'zod';\nimport invariant from 'tiny-invariant';\nimport { OAuth2ClientConfig, OAuth2Token } from './types';\n\nexport const oauth2RedirectQuerySchema = z.object({\n  code: z.string(),\n  state: z.string(),\n  error: z.string().optional(),\n  error_description: z.string().optional(),\n  error_uri: z.string().optional(),\n});\n\nexport class OAuth2Client {\n  private config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  getClientConfig(registrationId: string) {\n    const registration = this.config.registration[registrationId];\n    invariant(registration, `Registration ${registrationId} not found`);\n    const provider = this.config.provider[registration.provider ?? registrationId];\n    invariant(provider, `Provider ${registration.provider ?? registrationId} not found`);\n    return { registration, provider };\n  }\n\n  createAuthorizationUri(registrationId: string, state: string, codeVerifier?: string): URL {\n    const { provider, registration } = this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { scope, clientId, redirectUri } = registration;\n    return provider.createAuthorizationUri({\n      state,\n      scope,\n      clientId,\n      codeVerifier,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async exchangeAuthorizationCode(\n    registrationId: string,\n    code: string,\n    codeVerifier?: string\n  ): Promise<OAuth2Token> {\n    const { provider, registration } = this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n    return provider.exchangeAuthorizationCode({\n      code,\n      codeVerifier,\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async getUserInfo(registrationId: string, token: OAuth2Token) {\n    const { provider } = this.getClientConfig(registrationId);\n    return provider.getUserInfo(token);\n  }\n\n  async refreshAccessToken(registrationId: string, refreshToken: string): Promise<OAuth2Token> {\n    const { provider, registration } = this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    return provider.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken(registrationId: string, token: string) {\n    const { provider, registration } = this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.revokeToken, 'Provider does not support revokeToken');\n    await provider.revokeToken({ token, clientId, clientSecret });\n  }\n}\n"],"mappings":";AAAA,SAAS,SAAS;AAClB,OAAO,eAAe;AAGf,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,MAAM,EAAE,OAAO;AAAA,EACf,OAAO,EAAE,OAAO;AAAA,EAChB,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAEM,IAAM,eAAN,MAAmB;AAAA,EAChB;AAAA,EACR,YAAY,QAA4B;AACtC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,IAAI,UAAU;AACZ,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,IAAI,WAAW;AACb,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,gBAAgB,gBAAwB;AACtC,UAAM,eAAe,KAAK,OAAO,aAAa,cAAc;AAC5D,cAAU,cAAc,gBAAgB,cAAc,YAAY;AAClE,UAAM,WAAW,KAAK,OAAO,SAAS,aAAa,YAAY,cAAc;AAC7E,cAAU,UAAU,YAAY,aAAa,YAAY,cAAc,YAAY;AACnF,WAAO,EAAE,cAAc,SAAS;AAAA,EAClC;AAAA,EAEA,uBAAuB,gBAAwB,OAAe,cAA4B;AACxF,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AAEtE,UAAM,EAAE,QAAQ,IAAI,KAAK;AACzB,UAAM,EAAE,OAAO,UAAU,YAAY,IAAI;AACzC,WAAO,SAAS,uBAAuB;AAAA,MACrC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,eAAe,GAAG,OAAO,sBAAsB,cAAc;AAAA,IAC5E,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,0BACJ,gBACA,MACA,cACsB;AACtB,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AAEtE,UAAM,EAAE,QAAQ,IAAI,KAAK;AACzB,UAAM,EAAE,UAAU,cAAc,YAAY,IAAI;AAChD,WAAO,SAAS,0BAA0B;AAAA,MACxC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,eAAe,GAAG,OAAO,sBAAsB,cAAc;AAAA,IAC5E,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,YAAY,gBAAwB,OAAoB;AAC5D,UAAM,EAAE,SAAS,IAAI,KAAK,gBAAgB,cAAc;AACxD,WAAO,SAAS,YAAY,KAAK;AAAA,EACnC;AAAA,EAEA,MAAM,mBAAmB,gBAAwB,cAA4C;AAC3F,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AACtE,UAAM,EAAE,UAAU,aAAa,IAAI;AAEnC,cAAU,SAAS,oBAAoB,8CAA8C;AACrF,WAAO,SAAS,mBAAmB,EAAE,cAAc,UAAU,aAAa,CAAC;AAAA,EAC7E;AAAA,EAEA,MAAM,YAAY,gBAAwB,OAAe;AACvD,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AACtE,UAAM,EAAE,UAAU,aAAa,IAAI;AAEnC,cAAU,SAAS,aAAa,uCAAuC;AACvE,UAAM,SAAS,YAAY,EAAE,OAAO,UAAU,aAAa,CAAC;AAAA,EAC9D;AACF;","names":[]}

package/dist/oauth2/error.cjs

@@ -0,0 +1,54 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/oauth2/error.ts
+var error_exports = {};
+__export(error_exports, {
+  AuthenticationError: () => AuthenticationError,
+  OAuth2Error: () => OAuth2Error
+});
+module.exports = __toCommonJS(error_exports);
+var OAuth2Error = class _OAuth2Error extends Error {
+  status;
+  error;
+  constructor(status, error, message) {
+    super(message ?? `OAuth2 error: ${error}`);
+    this.status = status;
+    this.error = error;
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, _OAuth2Error);
+    }
+    Object.setPrototypeOf(this, _OAuth2Error.prototype);
+  }
+};
+var AuthenticationError = class _AuthenticationError extends Error {
+  constructor(message) {
+    super(message);
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, _AuthenticationError);
+    }
+    Object.setPrototypeOf(this, _AuthenticationError.prototype);
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AuthenticationError,
+  OAuth2Error
+});
+//# sourceMappingURL=error.cjs.map

package/dist/oauth2/error.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/oauth2/error.ts"],"sourcesContent":["export type OAuth2ErrorType =\n  | 'invalid_request' // 400\n  | 'invalid_client' // 401\n  | 'invalid_grant' // 400\n  | 'invalid_token' // 401\n  | 'invalid_scope' // 400\n  | 'unauthorized_client' // 401\n  | 'unsupported_grant_type' // 400\n  | 'unsupported_response_type' // 400\n  | 'insufficient_scope' // 403\n  | 'redirect_uri_mismatch' // 400\n  | 'access_denied' // 400\n  // added\n  | 'server_error'\n  | string;\n\nexport class OAuth2Error extends Error {\n  readonly status: number;\n  readonly error: OAuth2ErrorType;\n\n  constructor(status: number, error: OAuth2ErrorType, message?: string) {\n    super(message ?? `OAuth2 error: ${error}`);\n    this.status = status;\n    this.error = error;\n    if ((Error as any).captureStackTrace) {\n      (Error as any).captureStackTrace(this, OAuth2Error);\n    }\n    Object.setPrototypeOf(this, OAuth2Error.prototype);\n  }\n}\n\nexport class AuthenticationError extends Error {\n  constructor(message: string) {\n    super(message);\n    if ((Error as any).captureStackTrace) {\n      (Error as any).captureStackTrace(this, AuthenticationError);\n    }\n    Object.setPrototypeOf(this, AuthenticationError.prototype);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgBO,IAAM,cAAN,MAAM,qBAAoB,MAAM;AAAA,EAC5B;AAAA,EACA;AAAA,EAET,YAAY,QAAgB,OAAwB,SAAkB;AACpE,UAAM,WAAW,iBAAiB,KAAK,EAAE;AACzC,SAAK,SAAS;AACd,SAAK,QAAQ;AACb,QAAK,MAAc,mBAAmB;AACpC,MAAC,MAAc,kBAAkB,MAAM,YAAW;AAAA,IACpD;AACA,WAAO,eAAe,MAAM,aAAY,SAAS;AAAA,EACnD;AACF;AAEO,IAAM,sBAAN,MAAM,6BAA4B,MAAM;AAAA,EAC7C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,QAAK,MAAc,mBAAmB;AACpC,MAAC,MAAc,kBAAkB,MAAM,oBAAmB;AAAA,IAC5D;AACA,WAAO,eAAe,MAAM,qBAAoB,SAAS;AAAA,EAC3D;AACF;","names":[]}

package/dist/oauth2/error.d.cts

@@ -0,0 +1,11 @@
+type OAuth2ErrorType = 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'invalid_token' | 'invalid_scope' | 'unauthorized_client' | 'unsupported_grant_type' | 'unsupported_response_type' | 'insufficient_scope' | 'redirect_uri_mismatch' | 'access_denied' | 'server_error' | string;
+declare class OAuth2Error extends Error {
+    readonly status: number;
+    readonly error: OAuth2ErrorType;
+    constructor(status: number, error: OAuth2ErrorType, message?: string);
+}
+declare class AuthenticationError extends Error {
+    constructor(message: string);
+}
+
+export { AuthenticationError, OAuth2Error, type OAuth2ErrorType };

package/dist/oauth2/error.d.ts

@@ -0,0 +1,11 @@
+type OAuth2ErrorType = 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'invalid_token' | 'invalid_scope' | 'unauthorized_client' | 'unsupported_grant_type' | 'unsupported_response_type' | 'insufficient_scope' | 'redirect_uri_mismatch' | 'access_denied' | 'server_error' | string;
+declare class OAuth2Error extends Error {
+    readonly status: number;
+    readonly error: OAuth2ErrorType;
+    constructor(status: number, error: OAuth2ErrorType, message?: string);
+}
+declare class AuthenticationError extends Error {
+    constructor(message: string);
+}
+
+export { AuthenticationError, OAuth2Error, type OAuth2ErrorType };

package/dist/oauth2/error.mjs

@@ -0,0 +1,28 @@
+// src/oauth2/error.ts
+var OAuth2Error = class _OAuth2Error extends Error {
+  status;
+  error;
+  constructor(status, error, message) {
+    super(message ?? `OAuth2 error: ${error}`);
+    this.status = status;
+    this.error = error;
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, _OAuth2Error);
+    }
+    Object.setPrototypeOf(this, _OAuth2Error.prototype);
+  }
+};
+var AuthenticationError = class _AuthenticationError extends Error {
+  constructor(message) {
+    super(message);
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, _AuthenticationError);
+    }
+    Object.setPrototypeOf(this, _AuthenticationError.prototype);
+  }
+};
+export {
+  AuthenticationError,
+  OAuth2Error
+};
+//# sourceMappingURL=error.mjs.map

package/dist/oauth2/error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/oauth2/error.ts"],"sourcesContent":["export type OAuth2ErrorType =\n  | 'invalid_request' // 400\n  | 'invalid_client' // 401\n  | 'invalid_grant' // 400\n  | 'invalid_token' // 401\n  | 'invalid_scope' // 400\n  | 'unauthorized_client' // 401\n  | 'unsupported_grant_type' // 400\n  | 'unsupported_response_type' // 400\n  | 'insufficient_scope' // 403\n  | 'redirect_uri_mismatch' // 400\n  | 'access_denied' // 400\n  // added\n  | 'server_error'\n  | string;\n\nexport class OAuth2Error extends Error {\n  readonly status: number;\n  readonly error: OAuth2ErrorType;\n\n  constructor(status: number, error: OAuth2ErrorType, message?: string) {\n    super(message ?? `OAuth2 error: ${error}`);\n    this.status = status;\n    this.error = error;\n    if ((Error as any).captureStackTrace) {\n      (Error as any).captureStackTrace(this, OAuth2Error);\n    }\n    Object.setPrototypeOf(this, OAuth2Error.prototype);\n  }\n}\n\nexport class AuthenticationError extends Error {\n  constructor(message: string) {\n    super(message);\n    if ((Error as any).captureStackTrace) {\n      (Error as any).captureStackTrace(this, AuthenticationError);\n    }\n    Object.setPrototypeOf(this, AuthenticationError.prototype);\n  }\n}\n"],"mappings":";AAgBO,IAAM,cAAN,MAAM,qBAAoB,MAAM;AAAA,EAC5B;AAAA,EACA;AAAA,EAET,YAAY,QAAgB,OAAwB,SAAkB;AACpE,UAAM,WAAW,iBAAiB,KAAK,EAAE;AACzC,SAAK,SAAS;AACd,SAAK,QAAQ;AACb,QAAK,MAAc,mBAAmB;AACpC,MAAC,MAAc,kBAAkB,MAAM,YAAW;AAAA,IACpD;AACA,WAAO,eAAe,MAAM,aAAY,SAAS;AAAA,EACnD;AACF;AAEO,IAAM,sBAAN,MAAM,6BAA4B,MAAM;AAAA,EAC7C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,QAAK,MAAc,mBAAmB;AACpC,MAAC,MAAc,kBAAkB,MAAM,oBAAmB;AAAA,IAC5D;AACA,WAAO,eAAe,MAAM,qBAAoB,SAAS;AAAA,EAC3D;AACF;","names":[]}

package/dist/oauth2/provider/apple.cjs

@@ -0,0 +1,85 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/oauth2/provider/apple.ts
+var apple_exports = {};
+__export(apple_exports, {
+  apple: () => apple
+});
+module.exports = __toCommonJS(apple_exports);
+var import_tiny_invariant = __toESM(require("tiny-invariant"), 1);
+var import_error = require("../error.cjs");
+var import_common = require("./common.cjs");
+function apple() {
+  return {
+    // important notice: response_mode=form_post is required for apple
+    authorizationUri: "https://appleid.apple.com/auth/authorize?response_mode=form_post",
+    tokenUri: "https://appleid.apple.com/auth/token",
+    jwkSetUri: "https://appleid.apple.com/auth/keys",
+    userNameAttribute: "sub",
+    defaultScope: ["openid", "name", "email"],
+    createAuthorizationUri({ codeVerifier, ...params }) {
+      return (0, import_common.createAuthorizationUri)({
+        ...params,
+        scope: params.scope ?? this.defaultScope,
+        authorizationUri: this.authorizationUri
+      });
+    },
+    async exchangeAuthorizationCode({ codeVerifier, ...params }) {
+      const response = await (0, import_common.exchangeAuthorizationCode)({ ...params, tokenUri: this.tokenUri });
+      if (!response.ok) {
+        const { error } = await response.json();
+        throw new import_error.OAuth2Error(response.status, error);
+      }
+      return await response.json();
+    },
+    async getUserInfo({ id_token }) {
+      (0, import_tiny_invariant.default)(id_token, "id_token is required");
+      (0, import_tiny_invariant.default)(this.jwkSetUri, "jwkSetUri is required");
+      const data = await (0, import_common.verifyIdToken)(id_token, this.jwkSetUri);
+      return {
+        data,
+        claims: {
+          sub: data.sub,
+          name: data.name,
+          email: data.email,
+          email_verified: true,
+          picture: data.picture,
+          given_name: data.user?.name.firstName,
+          family_name: data.user?.name.lastName
+        }
+      };
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  apple
+});
+//# sourceMappingURL=apple.cjs.map

package/dist/oauth2/provider/apple.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/oauth2/provider/apple.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n// ref: https://account.apple.com/.well-known/openid-configuration\nexport function apple(): Provider<AppleUserInfo> {\n  return {\n    // important notice: response_mode=form_post is required for apple\n    authorizationUri: 'https://appleid.apple.com/auth/authorize?response_mode=form_post',\n    tokenUri: 'https://appleid.apple.com/auth/token',\n    jwkSetUri: 'https://appleid.apple.com/auth/keys',\n    userNameAttribute: 'sub',\n    defaultScope: ['openid', 'name', 'email'],\n    createAuthorizationUri({ codeVerifier, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ codeVerifier, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      return (await response.json()) as AppleOAuth2Token;\n    },\n    async getUserInfo({ id_token }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<AppleUserInfo>(id_token, this.jwkSetUri);\n      return {\n        data,\n        claims: {\n          sub: data.sub,\n          name: data.name,\n          email: data.email,\n          email_verified: true,\n          picture: data.picture,\n          given_name: data.user?.name.firstName,\n          family_name: data.user?.name.lastName,\n        },\n      };\n    },\n  };\n}\n\n// https://developer.apple.com/documentation/sign_in_with_apple/authenticating-users-with-sign-in-with-apple\nexport interface AppleUserInfo {\n  sub: string;\n  email: string;\n  email_verified: true | 'true';\n  is_private_email: boolean;\n  real_user_status: number;\n  name: string;\n  picture: string;\n  user?: {\n    name: { firstName: string; lastName: string };\n    email: string;\n  };\n}\n\n// https://developer.apple.com/documentation/devicemanagement/implementing-the-oauth2-authentication-user-enrollment-flow\n// https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens\nexport interface AppleOAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n}\n\n// https://developer.apple.com/documentation/sign_in_with_apple/errorresponse\nexport interface AppleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'invalid_scope';\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4BAAsB;AAEtB,mBAA4B;AAC5B,oBAAiF;AAG1E,SAAS,QAAiC;AAC/C,SAAO;AAAA;AAAA,IAEL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,WAAW;AAAA,IACX,mBAAmB;AAAA,IACnB,cAAc,CAAC,UAAU,QAAQ,OAAO;AAAA,IACxC,uBAAuB,EAAE,cAAc,GAAG,OAAO,GAAG;AAClD,iBAAO,sCAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,EAAE,cAAc,GAAG,OAAO,GAAG;AAC3D,YAAM,WAAW,UAAM,yCAA0B,EAAE,GAAG,QAAQ,UAAU,KAAK,SAAS,CAAC;AACvF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,MAAM,IAAK,MAAM,SAAS,KAAK;AACvC,cAAM,IAAI,yBAAY,SAAS,QAAQ,KAAK;AAAA,MAC9C;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,SAAS,GAAG;AAC9B,gCAAAA,SAAU,UAAU,sBAAsB;AAC1C,gCAAAA,SAAU,KAAK,WAAW,uBAAuB;AACjD,YAAM,OAAO,UAAM,6BAA6B,UAAU,KAAK,SAAS;AACxE,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,UACN,KAAK,KAAK;AAAA,UACV,MAAM,KAAK;AAAA,UACX,OAAO,KAAK;AAAA,UACZ,gBAAgB;AAAA,UAChB,SAAS,KAAK;AAAA,UACd,YAAY,KAAK,MAAM,KAAK;AAAA,UAC5B,aAAa,KAAK,MAAM,KAAK;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":["invariant"]}

package/dist/oauth2/provider/apple.d.cts

@@ -0,0 +1,31 @@
+import { Provider } from '../types.cjs';
+
+declare function apple(): Provider<AppleUserInfo>;
+interface AppleUserInfo {
+    sub: string;
+    email: string;
+    email_verified: true | 'true';
+    is_private_email: boolean;
+    real_user_status: number;
+    name: string;
+    picture: string;
+    user?: {
+        name: {
+            firstName: string;
+            lastName: string;
+        };
+        email: string;
+    };
+}
+interface AppleOAuth2Token {
+    access_token: string;
+    token_type: string;
+    expires_in: number;
+    refresh_token: string;
+    id_token: string;
+}
+interface AppleErrorResponse {
+    error: 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'invalid_scope';
+}
+
+export { type AppleErrorResponse, type AppleOAuth2Token, type AppleUserInfo, apple };

package/dist/oauth2/provider/apple.d.ts

@@ -0,0 +1,31 @@
+import { Provider } from '../types.js';
+
+declare function apple(): Provider<AppleUserInfo>;
+interface AppleUserInfo {
+    sub: string;
+    email: string;
+    email_verified: true | 'true';
+    is_private_email: boolean;
+    real_user_status: number;
+    name: string;
+    picture: string;
+    user?: {
+        name: {
+            firstName: string;
+            lastName: string;
+        };
+        email: string;
+    };
+}
+interface AppleOAuth2Token {
+    access_token: string;
+    token_type: string;
+    expires_in: number;
+    refresh_token: string;
+    id_token: string;
+}
+interface AppleErrorResponse {
+    error: 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'invalid_scope';
+}
+
+export { type AppleErrorResponse, type AppleOAuth2Token, type AppleUserInfo, apple };

package/dist/oauth2/provider/apple.mjs

@@ -0,0 +1,50 @@
+// src/oauth2/provider/apple.ts
+import invariant from "tiny-invariant";
+import { OAuth2Error } from "../error.mjs";
+import { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from "./common.mjs";
+function apple() {
+  return {
+    // important notice: response_mode=form_post is required for apple
+    authorizationUri: "https://appleid.apple.com/auth/authorize?response_mode=form_post",
+    tokenUri: "https://appleid.apple.com/auth/token",
+    jwkSetUri: "https://appleid.apple.com/auth/keys",
+    userNameAttribute: "sub",
+    defaultScope: ["openid", "name", "email"],
+    createAuthorizationUri({ codeVerifier, ...params }) {
+      return createAuthorizationUri({
+        ...params,
+        scope: params.scope ?? this.defaultScope,
+        authorizationUri: this.authorizationUri
+      });
+    },
+    async exchangeAuthorizationCode({ codeVerifier, ...params }) {
+      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });
+      if (!response.ok) {
+        const { error } = await response.json();
+        throw new OAuth2Error(response.status, error);
+      }
+      return await response.json();
+    },
+    async getUserInfo({ id_token }) {
+      invariant(id_token, "id_token is required");
+      invariant(this.jwkSetUri, "jwkSetUri is required");
+      const data = await verifyIdToken(id_token, this.jwkSetUri);
+      return {
+        data,
+        claims: {
+          sub: data.sub,
+          name: data.name,
+          email: data.email,
+          email_verified: true,
+          picture: data.picture,
+          given_name: data.user?.name.firstName,
+          family_name: data.user?.name.lastName
+        }
+      };
+    }
+  };
+}
+export {
+  apple
+};
+//# sourceMappingURL=apple.mjs.map

package/dist/oauth2/provider/apple.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/oauth2/provider/apple.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n// ref: https://account.apple.com/.well-known/openid-configuration\nexport function apple(): Provider<AppleUserInfo> {\n  return {\n    // important notice: response_mode=form_post is required for apple\n    authorizationUri: 'https://appleid.apple.com/auth/authorize?response_mode=form_post',\n    tokenUri: 'https://appleid.apple.com/auth/token',\n    jwkSetUri: 'https://appleid.apple.com/auth/keys',\n    userNameAttribute: 'sub',\n    defaultScope: ['openid', 'name', 'email'],\n    createAuthorizationUri({ codeVerifier, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ codeVerifier, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      return (await response.json()) as AppleOAuth2Token;\n    },\n    async getUserInfo({ id_token }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<AppleUserInfo>(id_token, this.jwkSetUri);\n      return {\n        data,\n        claims: {\n          sub: data.sub,\n          name: data.name,\n          email: data.email,\n          email_verified: true,\n          picture: data.picture,\n          given_name: data.user?.name.firstName,\n          family_name: data.user?.name.lastName,\n        },\n      };\n    },\n  };\n}\n\n// https://developer.apple.com/documentation/sign_in_with_apple/authenticating-users-with-sign-in-with-apple\nexport interface AppleUserInfo {\n  sub: string;\n  email: string;\n  email_verified: true | 'true';\n  is_private_email: boolean;\n  real_user_status: number;\n  name: string;\n  picture: string;\n  user?: {\n    name: { firstName: string; lastName: string };\n    email: string;\n  };\n}\n\n// https://developer.apple.com/documentation/devicemanagement/implementing-the-oauth2-authentication-user-enrollment-flow\n// https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens\nexport interface AppleOAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n}\n\n// https://developer.apple.com/documentation/sign_in_with_apple/errorresponse\nexport interface AppleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'invalid_scope';\n}\n"],"mappings":";AAAA,OAAO,eAAe;AAEtB,SAAS,mBAAmB;AAC5B,SAAS,wBAAwB,2BAA2B,qBAAqB;AAG1E,SAAS,QAAiC;AAC/C,SAAO;AAAA;AAAA,IAEL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,WAAW;AAAA,IACX,mBAAmB;AAAA,IACnB,cAAc,CAAC,UAAU,QAAQ,OAAO;AAAA,IACxC,uBAAuB,EAAE,cAAc,GAAG,OAAO,GAAG;AAClD,aAAO,uBAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,EAAE,cAAc,GAAG,OAAO,GAAG;AAC3D,YAAM,WAAW,MAAM,0BAA0B,EAAE,GAAG,QAAQ,UAAU,KAAK,SAAS,CAAC;AACvF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,MAAM,IAAK,MAAM,SAAS,KAAK;AACvC,cAAM,IAAI,YAAY,SAAS,QAAQ,KAAK;AAAA,MAC9C;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,SAAS,GAAG;AAC9B,gBAAU,UAAU,sBAAsB;AAC1C,gBAAU,KAAK,WAAW,uBAAuB;AACjD,YAAM,OAAO,MAAM,cAA6B,UAAU,KAAK,SAAS;AACxE,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,UACN,KAAK,KAAK;AAAA,UACV,MAAM,KAAK;AAAA,UACX,OAAO,KAAK;AAAA,UACZ,gBAAgB;AAAA,UAChB,SAAS,KAAK;AAAA,UACd,YAAY,KAAK,MAAM,KAAK;AAAA,UAC5B,aAAa,KAAK,MAAM,KAAK;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":[]}