@shware/security 0.4.3

package/dist/oauth2/provider/x.cjs

@@ -0,0 +1,126 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/oauth2/provider/x.ts
+var x_exports = {};
+__export(x_exports, {
+  x: () => x
+});
+module.exports = __toCommonJS(x_exports);
+var import_tiny_invariant = __toESM(require("tiny-invariant"), 1);
+var import_undici = require("undici");
+var import_error = require("../error.cjs");
+var import_common = require("./common.cjs");
+var defaultUserFields = [
+  "id",
+  "name",
+  "profile_image_url",
+  "url",
+  "username",
+  "location",
+  "verified"
+];
+function x(options) {
+  return {
+    authorizationUri: "https://x.com/i/oauth2/authorize",
+    tokenUri: "https://api.x.com/2/oauth2/token",
+    tokenRevokeUri: "https://api.x.com/2/oauth2/revoke",
+    // https://docs.x.com/x-api/users/user-lookup-me
+    userInfoUri: "https://api.x.com/2/users/me",
+    defaultScope: ["users.read", "tweet.read", "offline.access"],
+    createAuthorizationUri(params) {
+      if (!params.codeVerifier) throw new Error("codeVerifier is required for x");
+      return (0, import_common.createAuthorizationUri)({
+        ...params,
+        scope: params.scope ?? this.defaultScope,
+        authorizationUri: this.authorizationUri
+      });
+    },
+    async exchangeAuthorizationCode(params) {
+      if (!params.codeVerifier) throw new Error("codeVerifier is required for x");
+      const response = await (0, import_common.exchangeAuthorizationCode)({
+        ...params,
+        tokenUri: this.tokenUri,
+        authentication: "basic"
+      });
+      if (!response.ok) {
+        const { error, error_description } = await response.json();
+        throw new import_error.OAuth2Error(response.status, error, error_description);
+      }
+      return await response.json();
+    },
+    async getUserInfo({ access_token }) {
+      (0, import_tiny_invariant.default)(access_token, "access_token is required");
+      (0, import_tiny_invariant.default)(this.userInfoUri, "userInfoUri is required");
+      const userFields = options?.userFields ?? defaultUserFields;
+      const headers = { Accept: "application/json", Authorization: `Bearer ${access_token}` };
+      const url = new URL(this.userInfoUri);
+      userFields.forEach((field) => url.searchParams.append("user.fields", field));
+      const response = await (0, import_undici.fetch)(this.userInfoUri, { headers, dispatcher: import_common.proxyAgent });
+      if (!response.ok) {
+        const { errors } = await response.json();
+        throw new import_error.OAuth2Error(
+          response.status,
+          "invalid_request",
+          "Failed to fetch user info: " + (errors.at(0)?.detail ?? errors.at(0)?.title)
+        );
+      }
+      const profile = await response.json();
+      return {
+        data: profile,
+        claims: {
+          sub: profile.data.id,
+          name: profile.data.name,
+          picture: profile.data.profile_image_url,
+          email: profile.data.email,
+          email_verified: profile.data.verified || false,
+          preferred_username: profile.data.username,
+          profile: `https://x.com/${profile.data.username}`,
+          website: profile.data.url
+        }
+      };
+    },
+    async refreshAccessToken(params) {
+      return (0, import_common.refreshAccessToken)({ ...params, tokenUri: this.tokenUri, authentication: "basic" });
+    },
+    async revokeToken(params) {
+      (0, import_tiny_invariant.default)(this.tokenRevokeUri, "tokenRevokeUri is required");
+      return (0, import_common.revokeToken)({
+        ...params,
+        tokenRevokeUri: this.tokenRevokeUri,
+        authentication: "basic"
+      });
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  x
+});
+//# sourceMappingURL=x.cjs.map

package/dist/oauth2/provider/x.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/oauth2/provider/x.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { fetch } from 'undici';\nimport { Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport {\n  createAuthorizationUri,\n  exchangeAuthorizationCode,\n  proxyAgent,\n  refreshAccessToken,\n  revokeToken,\n} from './common';\n\nexport interface XOptions {\n  userFields?: UserField[];\n}\n\nconst defaultUserFields = [\n  'id',\n  'name',\n  'profile_image_url',\n  'url',\n  'username',\n  'location',\n  'verified',\n];\n\nexport function x(options?: XOptions): Provider<XUserInfo> {\n  return {\n    authorizationUri: 'https://x.com/i/oauth2/authorize',\n    tokenUri: 'https://api.x.com/2/oauth2/token',\n    tokenRevokeUri: 'https://api.x.com/2/oauth2/revoke',\n    // https://docs.x.com/x-api/users/user-lookup-me\n    userInfoUri: 'https://api.x.com/2/users/me',\n    defaultScope: ['users.read', 'tweet.read', 'offline.access'],\n    createAuthorizationUri(params) {\n      if (!params.codeVerifier) throw new Error('codeVerifier is required for x');\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      if (!params.codeVerifier) throw new Error('codeVerifier is required for x');\n      const response = await exchangeAuthorizationCode({\n        ...params,\n        tokenUri: this.tokenUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XOAuth2Token;\n    },\n    async getUserInfo({ access_token }) {\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n\n      const userFields = options?.userFields ?? defaultUserFields;\n      const headers = { Accept: 'application/json', Authorization: `Bearer ${access_token}` };\n\n      const url = new URL(this.userInfoUri);\n      userFields.forEach((field) => url.searchParams.append('user.fields', field));\n\n      const response = await fetch(this.userInfoUri, { headers, dispatcher: proxyAgent });\n      if (!response.ok) {\n        const { errors } = (await response.json()) as XAPIErrorResponse;\n        throw new OAuth2Error(\n          response.status,\n          'invalid_request',\n          'Failed to fetch user info: ' + (errors.at(0)?.detail ?? errors.at(0)?.title)\n        );\n      }\n      const profile = (await response.json()) as XUserInfo;\n      return {\n        data: profile,\n        claims: {\n          sub: profile.data.id,\n          name: profile.data.name,\n          picture: profile.data.profile_image_url,\n          email: profile.data.email,\n          email_verified: profile.data.verified || false,\n          preferred_username: profile.data.username,\n          profile: `https://x.com/${profile.data.username}`,\n          website: profile.data.url,\n        },\n      };\n    },\n    async refreshAccessToken(params) {\n      return refreshAccessToken({ ...params, tokenUri: this.tokenUri, authentication: 'basic' });\n    },\n    async revokeToken(params) {\n      invariant(this.tokenRevokeUri, 'tokenRevokeUri is required');\n      return revokeToken({\n        ...params,\n        tokenRevokeUri: this.tokenRevokeUri,\n        authentication: 'basic',\n      });\n    },\n  };\n}\n\ntype UserField =\n  | 'affiliation'\n  | 'connection_status'\n  | 'created_at'\n  | 'description'\n  | 'entities'\n  | 'id'\n  | 'is_identity_verified'\n  | 'location'\n  | 'most_recent_tweet_id'\n  | 'name'\n  | 'parody'\n  | 'pinned_tweet_id'\n  | 'profile_banner_url'\n  | 'profile_image_url'\n  | 'protected'\n  | 'public_metrics'\n  | 'receives_your_dm'\n  | 'subscription'\n  | 'subscription_type'\n  | 'url'\n  | 'username'\n  | 'verified'\n  | 'verified_followers_count'\n  | 'verified_type'\n  | 'withheld';\n\nexport interface XUser {\n  id: string;\n  name: string;\n  email?: string;\n  username: string;\n  location?: string;\n  entities?: {\n    url: { urls: UrlEntity[] };\n    description: {\n      hashtags: HashtagEntity[];\n      cashtags: HashtagEntity[];\n      mentions: MentionEntity[];\n    };\n  };\n  verified?: boolean;\n  description?: string;\n  url?: string;\n  profile_image_url?: string;\n  protected?: boolean;\n  pinned_tweet_id?: string;\n  created_at?: string;\n}\n\nexport interface XUserInfo {\n  data: XUser;\n  includes?: { tweets?: { id: string; text: string }[]; users?: XUser[] };\n}\n\n// prettier-ignore\ntype UrlEntity = { start: number; end: number; url: string; display_url: string; expanded_url: string; }\ntype HashtagEntity = { start: number; end: number; tag: string };\ntype MentionEntity = { start: number; end: string; username: string };\n\ntype XOAuth2Token = {\n  token_type: string;\n  expires_in: number;\n  access_token: string;\n  scope: string;\n  refresh_token: string;\n};\n\ntype XErrorResponse = { error: string; error_description: string };\ntype XAPIErrorResponse = {\n  errors: { title: string; type: string; detail?: string; status?: number }[];\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4BAAsB;AACtB,oBAAsB;AAEtB,mBAA4B;AAC5B,oBAMO;AAMP,IAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,EAAE,SAAyC;AACzD,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,gBAAgB;AAAA;AAAA,IAEhB,aAAa;AAAA,IACb,cAAc,CAAC,cAAc,cAAc,gBAAgB;AAAA,IAC3D,uBAAuB,QAAQ;AAC7B,UAAI,CAAC,OAAO,aAAc,OAAM,IAAI,MAAM,gCAAgC;AAC1E,iBAAO,sCAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,QAAQ;AACtC,UAAI,CAAC,OAAO,aAAc,OAAM,IAAI,MAAM,gCAAgC;AAC1E,YAAM,WAAW,UAAM,yCAA0B;AAAA,QAC/C,GAAG;AAAA,QACH,UAAU,KAAK;AAAA,QACf,gBAAgB;AAAA,MAClB,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,yBAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,aAAa,GAAG;AAClC,gCAAAA,SAAU,cAAc,0BAA0B;AAClD,gCAAAA,SAAU,KAAK,aAAa,yBAAyB;AAErD,YAAM,aAAa,SAAS,cAAc;AAC1C,YAAM,UAAU,EAAE,QAAQ,oBAAoB,eAAe,UAAU,YAAY,GAAG;AAEtF,YAAM,MAAM,IAAI,IAAI,KAAK,WAAW;AACpC,iBAAW,QAAQ,CAAC,UAAU,IAAI,aAAa,OAAO,eAAe,KAAK,CAAC;AAE3E,YAAM,WAAW,UAAM,qBAAM,KAAK,aAAa,EAAE,SAAS,YAAY,yBAAW,CAAC;AAClF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,IAAK,MAAM,SAAS,KAAK;AACxC,cAAM,IAAI;AAAA,UACR,SAAS;AAAA,UACT;AAAA,UACA,iCAAiC,OAAO,GAAG,CAAC,GAAG,UAAU,OAAO,GAAG,CAAC,GAAG;AAAA,QACzE;AAAA,MACF;AACA,YAAM,UAAW,MAAM,SAAS,KAAK;AACrC,aAAO;AAAA,QACL,MAAM;AAAA,QACN,QAAQ;AAAA,UACN,KAAK,QAAQ,KAAK;AAAA,UAClB,MAAM,QAAQ,KAAK;AAAA,UACnB,SAAS,QAAQ,KAAK;AAAA,UACtB,OAAO,QAAQ,KAAK;AAAA,UACpB,gBAAgB,QAAQ,KAAK,YAAY;AAAA,UACzC,oBAAoB,QAAQ,KAAK;AAAA,UACjC,SAAS,iBAAiB,QAAQ,KAAK,QAAQ;AAAA,UAC/C,SAAS,QAAQ,KAAK;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,mBAAmB,QAAQ;AAC/B,iBAAO,kCAAmB,EAAE,GAAG,QAAQ,UAAU,KAAK,UAAU,gBAAgB,QAAQ,CAAC;AAAA,IAC3F;AAAA,IACA,MAAM,YAAY,QAAQ;AACxB,gCAAAA,SAAU,KAAK,gBAAgB,4BAA4B;AAC3D,iBAAO,2BAAY;AAAA,QACjB,GAAG;AAAA,QACH,gBAAgB,KAAK;AAAA,QACrB,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":["invariant"]}

package/dist/oauth2/provider/x.d.cts

@@ -0,0 +1,60 @@
+import { Provider } from '../types.cjs';
+
+interface XOptions {
+    userFields?: UserField[];
+}
+declare function x(options?: XOptions): Provider<XUserInfo>;
+type UserField = 'affiliation' | 'connection_status' | 'created_at' | 'description' | 'entities' | 'id' | 'is_identity_verified' | 'location' | 'most_recent_tweet_id' | 'name' | 'parody' | 'pinned_tweet_id' | 'profile_banner_url' | 'profile_image_url' | 'protected' | 'public_metrics' | 'receives_your_dm' | 'subscription' | 'subscription_type' | 'url' | 'username' | 'verified' | 'verified_followers_count' | 'verified_type' | 'withheld';
+interface XUser {
+    id: string;
+    name: string;
+    email?: string;
+    username: string;
+    location?: string;
+    entities?: {
+        url: {
+            urls: UrlEntity[];
+        };
+        description: {
+            hashtags: HashtagEntity[];
+            cashtags: HashtagEntity[];
+            mentions: MentionEntity[];
+        };
+    };
+    verified?: boolean;
+    description?: string;
+    url?: string;
+    profile_image_url?: string;
+    protected?: boolean;
+    pinned_tweet_id?: string;
+    created_at?: string;
+}
+interface XUserInfo {
+    data: XUser;
+    includes?: {
+        tweets?: {
+            id: string;
+            text: string;
+        }[];
+        users?: XUser[];
+    };
+}
+type UrlEntity = {
+    start: number;
+    end: number;
+    url: string;
+    display_url: string;
+    expanded_url: string;
+};
+type HashtagEntity = {
+    start: number;
+    end: number;
+    tag: string;
+};
+type MentionEntity = {
+    start: number;
+    end: string;
+    username: string;
+};
+
+export { type XOptions, type XUser, type XUserInfo, x };

package/dist/oauth2/provider/x.d.ts

@@ -0,0 +1,60 @@
+import { Provider } from '../types.js';
+
+interface XOptions {
+    userFields?: UserField[];
+}
+declare function x(options?: XOptions): Provider<XUserInfo>;
+type UserField = 'affiliation' | 'connection_status' | 'created_at' | 'description' | 'entities' | 'id' | 'is_identity_verified' | 'location' | 'most_recent_tweet_id' | 'name' | 'parody' | 'pinned_tweet_id' | 'profile_banner_url' | 'profile_image_url' | 'protected' | 'public_metrics' | 'receives_your_dm' | 'subscription' | 'subscription_type' | 'url' | 'username' | 'verified' | 'verified_followers_count' | 'verified_type' | 'withheld';
+interface XUser {
+    id: string;
+    name: string;
+    email?: string;
+    username: string;
+    location?: string;
+    entities?: {
+        url: {
+            urls: UrlEntity[];
+        };
+        description: {
+            hashtags: HashtagEntity[];
+            cashtags: HashtagEntity[];
+            mentions: MentionEntity[];
+        };
+    };
+    verified?: boolean;
+    description?: string;
+    url?: string;
+    profile_image_url?: string;
+    protected?: boolean;
+    pinned_tweet_id?: string;
+    created_at?: string;
+}
+interface XUserInfo {
+    data: XUser;
+    includes?: {
+        tweets?: {
+            id: string;
+            text: string;
+        }[];
+        users?: XUser[];
+    };
+}
+type UrlEntity = {
+    start: number;
+    end: number;
+    url: string;
+    display_url: string;
+    expanded_url: string;
+};
+type HashtagEntity = {
+    start: number;
+    end: number;
+    tag: string;
+};
+type MentionEntity = {
+    start: number;
+    end: string;
+    username: string;
+};
+
+export { type XOptions, type XUser, type XUserInfo, x };

package/dist/oauth2/provider/x.mjs

@@ -0,0 +1,97 @@
+// src/oauth2/provider/x.ts
+import invariant from "tiny-invariant";
+import { fetch } from "undici";
+import { OAuth2Error } from "../error.mjs";
+import {
+  createAuthorizationUri,
+  exchangeAuthorizationCode,
+  proxyAgent,
+  refreshAccessToken,
+  revokeToken
+} from "./common.mjs";
+var defaultUserFields = [
+  "id",
+  "name",
+  "profile_image_url",
+  "url",
+  "username",
+  "location",
+  "verified"
+];
+function x(options) {
+  return {
+    authorizationUri: "https://x.com/i/oauth2/authorize",
+    tokenUri: "https://api.x.com/2/oauth2/token",
+    tokenRevokeUri: "https://api.x.com/2/oauth2/revoke",
+    // https://docs.x.com/x-api/users/user-lookup-me
+    userInfoUri: "https://api.x.com/2/users/me",
+    defaultScope: ["users.read", "tweet.read", "offline.access"],
+    createAuthorizationUri(params) {
+      if (!params.codeVerifier) throw new Error("codeVerifier is required for x");
+      return createAuthorizationUri({
+        ...params,
+        scope: params.scope ?? this.defaultScope,
+        authorizationUri: this.authorizationUri
+      });
+    },
+    async exchangeAuthorizationCode(params) {
+      if (!params.codeVerifier) throw new Error("codeVerifier is required for x");
+      const response = await exchangeAuthorizationCode({
+        ...params,
+        tokenUri: this.tokenUri,
+        authentication: "basic"
+      });
+      if (!response.ok) {
+        const { error, error_description } = await response.json();
+        throw new OAuth2Error(response.status, error, error_description);
+      }
+      return await response.json();
+    },
+    async getUserInfo({ access_token }) {
+      invariant(access_token, "access_token is required");
+      invariant(this.userInfoUri, "userInfoUri is required");
+      const userFields = options?.userFields ?? defaultUserFields;
+      const headers = { Accept: "application/json", Authorization: `Bearer ${access_token}` };
+      const url = new URL(this.userInfoUri);
+      userFields.forEach((field) => url.searchParams.append("user.fields", field));
+      const response = await fetch(this.userInfoUri, { headers, dispatcher: proxyAgent });
+      if (!response.ok) {
+        const { errors } = await response.json();
+        throw new OAuth2Error(
+          response.status,
+          "invalid_request",
+          "Failed to fetch user info: " + (errors.at(0)?.detail ?? errors.at(0)?.title)
+        );
+      }
+      const profile = await response.json();
+      return {
+        data: profile,
+        claims: {
+          sub: profile.data.id,
+          name: profile.data.name,
+          picture: profile.data.profile_image_url,
+          email: profile.data.email,
+          email_verified: profile.data.verified || false,
+          preferred_username: profile.data.username,
+          profile: `https://x.com/${profile.data.username}`,
+          website: profile.data.url
+        }
+      };
+    },
+    async refreshAccessToken(params) {
+      return refreshAccessToken({ ...params, tokenUri: this.tokenUri, authentication: "basic" });
+    },
+    async revokeToken(params) {
+      invariant(this.tokenRevokeUri, "tokenRevokeUri is required");
+      return revokeToken({
+        ...params,
+        tokenRevokeUri: this.tokenRevokeUri,
+        authentication: "basic"
+      });
+    }
+  };
+}
+export {
+  x
+};
+//# sourceMappingURL=x.mjs.map

package/dist/oauth2/provider/x.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/oauth2/provider/x.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { fetch } from 'undici';\nimport { Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport {\n  createAuthorizationUri,\n  exchangeAuthorizationCode,\n  proxyAgent,\n  refreshAccessToken,\n  revokeToken,\n} from './common';\n\nexport interface XOptions {\n  userFields?: UserField[];\n}\n\nconst defaultUserFields = [\n  'id',\n  'name',\n  'profile_image_url',\n  'url',\n  'username',\n  'location',\n  'verified',\n];\n\nexport function x(options?: XOptions): Provider<XUserInfo> {\n  return {\n    authorizationUri: 'https://x.com/i/oauth2/authorize',\n    tokenUri: 'https://api.x.com/2/oauth2/token',\n    tokenRevokeUri: 'https://api.x.com/2/oauth2/revoke',\n    // https://docs.x.com/x-api/users/user-lookup-me\n    userInfoUri: 'https://api.x.com/2/users/me',\n    defaultScope: ['users.read', 'tweet.read', 'offline.access'],\n    createAuthorizationUri(params) {\n      if (!params.codeVerifier) throw new Error('codeVerifier is required for x');\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      if (!params.codeVerifier) throw new Error('codeVerifier is required for x');\n      const response = await exchangeAuthorizationCode({\n        ...params,\n        tokenUri: this.tokenUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XOAuth2Token;\n    },\n    async getUserInfo({ access_token }) {\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n\n      const userFields = options?.userFields ?? defaultUserFields;\n      const headers = { Accept: 'application/json', Authorization: `Bearer ${access_token}` };\n\n      const url = new URL(this.userInfoUri);\n      userFields.forEach((field) => url.searchParams.append('user.fields', field));\n\n      const response = await fetch(this.userInfoUri, { headers, dispatcher: proxyAgent });\n      if (!response.ok) {\n        const { errors } = (await response.json()) as XAPIErrorResponse;\n        throw new OAuth2Error(\n          response.status,\n          'invalid_request',\n          'Failed to fetch user info: ' + (errors.at(0)?.detail ?? errors.at(0)?.title)\n        );\n      }\n      const profile = (await response.json()) as XUserInfo;\n      return {\n        data: profile,\n        claims: {\n          sub: profile.data.id,\n          name: profile.data.name,\n          picture: profile.data.profile_image_url,\n          email: profile.data.email,\n          email_verified: profile.data.verified || false,\n          preferred_username: profile.data.username,\n          profile: `https://x.com/${profile.data.username}`,\n          website: profile.data.url,\n        },\n      };\n    },\n    async refreshAccessToken(params) {\n      return refreshAccessToken({ ...params, tokenUri: this.tokenUri, authentication: 'basic' });\n    },\n    async revokeToken(params) {\n      invariant(this.tokenRevokeUri, 'tokenRevokeUri is required');\n      return revokeToken({\n        ...params,\n        tokenRevokeUri: this.tokenRevokeUri,\n        authentication: 'basic',\n      });\n    },\n  };\n}\n\ntype UserField =\n  | 'affiliation'\n  | 'connection_status'\n  | 'created_at'\n  | 'description'\n  | 'entities'\n  | 'id'\n  | 'is_identity_verified'\n  | 'location'\n  | 'most_recent_tweet_id'\n  | 'name'\n  | 'parody'\n  | 'pinned_tweet_id'\n  | 'profile_banner_url'\n  | 'profile_image_url'\n  | 'protected'\n  | 'public_metrics'\n  | 'receives_your_dm'\n  | 'subscription'\n  | 'subscription_type'\n  | 'url'\n  | 'username'\n  | 'verified'\n  | 'verified_followers_count'\n  | 'verified_type'\n  | 'withheld';\n\nexport interface XUser {\n  id: string;\n  name: string;\n  email?: string;\n  username: string;\n  location?: string;\n  entities?: {\n    url: { urls: UrlEntity[] };\n    description: {\n      hashtags: HashtagEntity[];\n      cashtags: HashtagEntity[];\n      mentions: MentionEntity[];\n    };\n  };\n  verified?: boolean;\n  description?: string;\n  url?: string;\n  profile_image_url?: string;\n  protected?: boolean;\n  pinned_tweet_id?: string;\n  created_at?: string;\n}\n\nexport interface XUserInfo {\n  data: XUser;\n  includes?: { tweets?: { id: string; text: string }[]; users?: XUser[] };\n}\n\n// prettier-ignore\ntype UrlEntity = { start: number; end: number; url: string; display_url: string; expanded_url: string; }\ntype HashtagEntity = { start: number; end: number; tag: string };\ntype MentionEntity = { start: number; end: string; username: string };\n\ntype XOAuth2Token = {\n  token_type: string;\n  expires_in: number;\n  access_token: string;\n  scope: string;\n  refresh_token: string;\n};\n\ntype XErrorResponse = { error: string; error_description: string };\ntype XAPIErrorResponse = {\n  errors: { title: string; type: string; detail?: string; status?: number }[];\n};\n"],"mappings":";AAAA,OAAO,eAAe;AACtB,SAAS,aAAa;AAEtB,SAAS,mBAAmB;AAC5B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP,IAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,EAAE,SAAyC;AACzD,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,gBAAgB;AAAA;AAAA,IAEhB,aAAa;AAAA,IACb,cAAc,CAAC,cAAc,cAAc,gBAAgB;AAAA,IAC3D,uBAAuB,QAAQ;AAC7B,UAAI,CAAC,OAAO,aAAc,OAAM,IAAI,MAAM,gCAAgC;AAC1E,aAAO,uBAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,QAAQ;AACtC,UAAI,CAAC,OAAO,aAAc,OAAM,IAAI,MAAM,gCAAgC;AAC1E,YAAM,WAAW,MAAM,0BAA0B;AAAA,QAC/C,GAAG;AAAA,QACH,UAAU,KAAK;AAAA,QACf,gBAAgB;AAAA,MAClB,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,aAAa,GAAG;AAClC,gBAAU,cAAc,0BAA0B;AAClD,gBAAU,KAAK,aAAa,yBAAyB;AAErD,YAAM,aAAa,SAAS,cAAc;AAC1C,YAAM,UAAU,EAAE,QAAQ,oBAAoB,eAAe,UAAU,YAAY,GAAG;AAEtF,YAAM,MAAM,IAAI,IAAI,KAAK,WAAW;AACpC,iBAAW,QAAQ,CAAC,UAAU,IAAI,aAAa,OAAO,eAAe,KAAK,CAAC;AAE3E,YAAM,WAAW,MAAM,MAAM,KAAK,aAAa,EAAE,SAAS,YAAY,WAAW,CAAC;AAClF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,IAAK,MAAM,SAAS,KAAK;AACxC,cAAM,IAAI;AAAA,UACR,SAAS;AAAA,UACT;AAAA,UACA,iCAAiC,OAAO,GAAG,CAAC,GAAG,UAAU,OAAO,GAAG,CAAC,GAAG;AAAA,QACzE;AAAA,MACF;AACA,YAAM,UAAW,MAAM,SAAS,KAAK;AACrC,aAAO;AAAA,QACL,MAAM;AAAA,QACN,QAAQ;AAAA,UACN,KAAK,QAAQ,KAAK;AAAA,UAClB,MAAM,QAAQ,KAAK;AAAA,UACnB,SAAS,QAAQ,KAAK;AAAA,UACtB,OAAO,QAAQ,KAAK;AAAA,UACpB,gBAAgB,QAAQ,KAAK,YAAY;AAAA,UACzC,oBAAoB,QAAQ,KAAK;AAAA,UACjC,SAAS,iBAAiB,QAAQ,KAAK,QAAQ;AAAA,UAC/C,SAAS,QAAQ,KAAK;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,mBAAmB,QAAQ;AAC/B,aAAO,mBAAmB,EAAE,GAAG,QAAQ,UAAU,KAAK,UAAU,gBAAgB,QAAQ,CAAC;AAAA,IAC3F;AAAA,IACA,MAAM,YAAY,QAAQ;AACxB,gBAAU,KAAK,gBAAgB,4BAA4B;AAC3D,aAAO,YAAY;AAAA,QACjB,GAAG;AAAA,QACH,gBAAgB,KAAK;AAAA,QACrB,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":[]}

package/dist/oauth2/schema.cjs

@@ -0,0 +1,2 @@
+"use strict";
+//# sourceMappingURL=schema.cjs.map

package/dist/oauth2/schema.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/oauth2/schema.d.cts

@@ -0,0 +1,2 @@
+
+export {  }

package/dist/oauth2/schema.d.ts

@@ -0,0 +1,2 @@
+
+export {  }

package/dist/oauth2/schema.mjs

@@ -0,0 +1 @@
+//# sourceMappingURL=schema.mjs.map

package/dist/oauth2/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/oauth2/types.cjs

@@ -0,0 +1,19 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/oauth2/types.ts
+var types_exports = {};
+module.exports = __toCommonJS(types_exports);
+//# sourceMappingURL=types.cjs.map

package/dist/oauth2/types.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/oauth2/types.ts"],"sourcesContent":["export interface OAuth2AuthorizationRequest {\n  state: string;\n  codeVerifier: string;\n  registrationId: string;\n  authorizationRequestUri: string;\n}\n\ninterface CreateAuthorizationUriParams {\n  state: string;\n  clientId: string;\n  redirectUri: string;\n  scope: string[] | undefined;\n  codeVerifier?: string;\n}\n\nexport interface CodeExchangeParams {\n  code: string;\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  codeVerifier?: string;\n}\n\nexport interface RefreshTokenParams {\n  clientId: string;\n  clientSecret: string;\n  refreshToken: string;\n}\n\nexport interface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret: string;\n}\n\nexport interface OAuth2Token {\n  access_token?: string;\n  token_type?: 'Bearer' | 'bearer' | string;\n  expires_in?: number;\n  refresh_token?: string;\n  id_token?: string;\n  scope?: string;\n}\n\n// https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims\nexport interface StandardClaims {\n  sub: string;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  middle_name?: string;\n  nickname?: string;\n  preferred_username?: string;\n  profile?: string;\n  picture?: string;\n  website?: string;\n  email?: string;\n  email_verified?: boolean;\n  gender?: 'female' | 'male' | string;\n  birthdate?: string; // ISO 8601-1 [ISO8601‑1] YYYY-MM-DD format.\n  zoneinfo?: string; // IANA Time Zone Database [IANA.time‑zones]\n  locale?: string; // BCP47 [RFC5646] language tag.\n  phone_number?: string; // E.164\n  phone_number_verified?: boolean;\n  address?: {\n    formatted: string;\n    street_address: string;\n    locality: string;\n    region: string;\n    postal_code: string;\n    country: string;\n  }; // [RFC8259] JSON object\n  updated_at?: number;\n}\n\nexport interface UserInfo<T extends Record<string, any> = Record<string, any>> {\n  claims: StandardClaims;\n  data: T;\n}\n\nexport interface Provider<T extends Record<string, any> = Record<string, any>> {\n  /** Authorization URI for the provider. */\n  authorizationUri: string;\n\n  /** Token URI for the provider. */\n  tokenUri: string;\n\n  tokenRevokeUri?: string;\n\n  /** User info URI for the provider. */\n  userInfoUri?: string;\n\n  /** User info authentication method for the provider. */\n  userInfoAuthenticationMethod?: string;\n\n  /**\n   * Name of the attribute that will be used to extract the username from the call to 'userInfoUri'.\n   * */\n  userNameAttribute?: string;\n\n  /** JWK set URI for the provider */\n  jwkSetUri?: string;\n\n  /**\n   * URI that can either be an OpenID Connect discovery endpoint or an OAuth 2.0 Authorization\n   * Server Metadata endpoint defined by RFC 8414.\n   * */\n  issuerUri?: string;\n\n  /** Default scopes for the provider. */\n  defaultScope: string[];\n\n  /** step 1: generate authorization uri and redirect user to it */\n  createAuthorizationUri: (params: CreateAuthorizationUriParams) => URL;\n\n  /** step 2: exchange code for token */\n  exchangeAuthorizationCode: (params: CodeExchangeParams) => Promise<OAuth2Token>;\n\n  /** step 3: get user info */\n  getUserInfo: (token: OAuth2Token) => Promise<UserInfo<T>>;\n\n  /** others: refresh access token */\n  refreshAccessToken?: (params: RefreshTokenParams) => Promise<OAuth2Token>;\n\n  /** others: revoke token */\n  revokeToken?: (params: RevokeTokenParams) => Promise<void>;\n}\n\nexport interface Registration {\n  /**\n   * Reference to the OAuth 2.0 provider to use. May reference an element from the 'provider'\n   * property or used one of the commonly used providers (google, github, facebook, okta).\n   * */\n  provider?: string;\n\n  /** Client ID for the registration. */\n  clientId: string;\n\n  /** Client secret of the registration. */\n  clientSecret: string;\n\n  /** Client authentication method. May be left blank when using a pre-defined provider. */\n  clientAuthenticationMethod?: string;\n\n  /** Authorization grant type. May be left blank when using a pre-defined provider. */\n  authorizationGrantType?:\n    | 'authorization_code' // default\n    | 'client_credentials'\n    | 'device_code'\n    | 'jwt_bearer'\n    // Deprecated. The latest OAuth 2.0 Security Best Current Practice disallows the use of the\n    // Resource Owner Password Credentials grant.\n    | 'password'\n    | 'refresh_token'\n    | 'token_exchange';\n\n  /** Redirect URI. May be left blank when using a pre-defined provider. */\n  redirectUri?: string;\n\n  /** Authorization scopes. When left blank the provider's default scopes, if any, will be used. */\n  scope?: string[];\n\n  /** Client name. May be left blank when using a pre-defined provider. */\n  clientName?: string;\n}\n\nexport interface OAuth2ClientConfig {\n  baseUri: string;\n  errorUri: string;\n  provider: { [name: string]: Provider | undefined };\n  registration: { [name: string]: Registration | undefined };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA;AAAA;","names":[]}

package/dist/oauth2/types.d.cts

@@ -0,0 +1,138 @@
+interface OAuth2AuthorizationRequest {
+    state: string;
+    codeVerifier: string;
+    registrationId: string;
+    authorizationRequestUri: string;
+}
+interface CreateAuthorizationUriParams {
+    state: string;
+    clientId: string;
+    redirectUri: string;
+    scope: string[] | undefined;
+    codeVerifier?: string;
+}
+interface CodeExchangeParams {
+    code: string;
+    clientId: string;
+    clientSecret: string;
+    redirectUri: string;
+    codeVerifier?: string;
+}
+interface RefreshTokenParams {
+    clientId: string;
+    clientSecret: string;
+    refreshToken: string;
+}
+interface RevokeTokenParams {
+    token: string;
+    clientId: string;
+    clientSecret: string;
+}
+interface OAuth2Token {
+    access_token?: string;
+    token_type?: 'Bearer' | 'bearer' | string;
+    expires_in?: number;
+    refresh_token?: string;
+    id_token?: string;
+    scope?: string;
+}
+interface StandardClaims {
+    sub: string;
+    name?: string;
+    given_name?: string;
+    family_name?: string;
+    middle_name?: string;
+    nickname?: string;
+    preferred_username?: string;
+    profile?: string;
+    picture?: string;
+    website?: string;
+    email?: string;
+    email_verified?: boolean;
+    gender?: 'female' | 'male' | string;
+    birthdate?: string;
+    zoneinfo?: string;
+    locale?: string;
+    phone_number?: string;
+    phone_number_verified?: boolean;
+    address?: {
+        formatted: string;
+        street_address: string;
+        locality: string;
+        region: string;
+        postal_code: string;
+        country: string;
+    };
+    updated_at?: number;
+}
+interface UserInfo<T extends Record<string, any> = Record<string, any>> {
+    claims: StandardClaims;
+    data: T;
+}
+interface Provider<T extends Record<string, any> = Record<string, any>> {
+    /** Authorization URI for the provider. */
+    authorizationUri: string;
+    /** Token URI for the provider. */
+    tokenUri: string;
+    tokenRevokeUri?: string;
+    /** User info URI for the provider. */
+    userInfoUri?: string;
+    /** User info authentication method for the provider. */
+    userInfoAuthenticationMethod?: string;
+    /**
+     * Name of the attribute that will be used to extract the username from the call to 'userInfoUri'.
+     * */
+    userNameAttribute?: string;
+    /** JWK set URI for the provider */
+    jwkSetUri?: string;
+    /**
+     * URI that can either be an OpenID Connect discovery endpoint or an OAuth 2.0 Authorization
+     * Server Metadata endpoint defined by RFC 8414.
+     * */
+    issuerUri?: string;
+    /** Default scopes for the provider. */
+    defaultScope: string[];
+    /** step 1: generate authorization uri and redirect user to it */
+    createAuthorizationUri: (params: CreateAuthorizationUriParams) => URL;
+    /** step 2: exchange code for token */
+    exchangeAuthorizationCode: (params: CodeExchangeParams) => Promise<OAuth2Token>;
+    /** step 3: get user info */
+    getUserInfo: (token: OAuth2Token) => Promise<UserInfo<T>>;
+    /** others: refresh access token */
+    refreshAccessToken?: (params: RefreshTokenParams) => Promise<OAuth2Token>;
+    /** others: revoke token */
+    revokeToken?: (params: RevokeTokenParams) => Promise<void>;
+}
+interface Registration {
+    /**
+     * Reference to the OAuth 2.0 provider to use. May reference an element from the 'provider'
+     * property or used one of the commonly used providers (google, github, facebook, okta).
+     * */
+    provider?: string;
+    /** Client ID for the registration. */
+    clientId: string;
+    /** Client secret of the registration. */
+    clientSecret: string;
+    /** Client authentication method. May be left blank when using a pre-defined provider. */
+    clientAuthenticationMethod?: string;
+    /** Authorization grant type. May be left blank when using a pre-defined provider. */
+    authorizationGrantType?: 'authorization_code' | 'client_credentials' | 'device_code' | 'jwt_bearer' | 'password' | 'refresh_token' | 'token_exchange';
+    /** Redirect URI. May be left blank when using a pre-defined provider. */
+    redirectUri?: string;
+    /** Authorization scopes. When left blank the provider's default scopes, if any, will be used. */
+    scope?: string[];
+    /** Client name. May be left blank when using a pre-defined provider. */
+    clientName?: string;
+}
+interface OAuth2ClientConfig {
+    baseUri: string;
+    errorUri: string;
+    provider: {
+        [name: string]: Provider | undefined;
+    };
+    registration: {
+        [name: string]: Registration | undefined;
+    };
+}
+
+export type { CodeExchangeParams, OAuth2AuthorizationRequest, OAuth2ClientConfig, OAuth2Token, Provider, RefreshTokenParams, Registration, RevokeTokenParams, StandardClaims, UserInfo };