@shware/security 0.4.8 → 1.0.0

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export { Auth } from './auth/index';\nexport { OAuth2Client, oauth2RedirectQuerySchema } from './oauth2/client';\nexport { RedisIndexedSessionRepository, PRINCIPAL_NAME_INDEX_NAME } from './session/redis-session';\n\nexport type { Namespace, SessionRepository } from './session/types';\nexport type { StandardClaims, OAuth2Token, UserInfo } from './oauth2/types';\nexport type { Principal } from './core/index';\n"],"mappings":";AAAA,SAAS,YAAY;AACrB,SAAS,cAAc,iCAAiC;AACxD,SAAS,+BAA+B,iCAAiC;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export { Auth } from './auth/index';\nexport { OAuth2Client, oauth2RedirectQuerySchema } from './oauth2/client';\nexport { RedisIndexedSessionRepository, PRINCIPAL_NAME_INDEX_NAME } from './session/redis-session';\n\nexport type { Namespace, SessionRepository } from './session/types';\nexport type { StandardClaims, OAuth2Token, UserInfo, OidcToken, OidcScopes } from './oauth2/types';\nexport type { Principal } from './core/index';\n"],"mappings":";AAAA,SAAS,YAAY;AACrB,SAAS,cAAc,iCAAiC;AACxD,SAAS,+BAA+B,iCAAiC;","names":[]}

package/dist/oauth2/client.cjs

@@ -37,8 +37,8 @@ module.exports = __toCommonJS(client_exports);
 var import_zod = require("zod");
 var import_tiny_invariant = __toESM(require("tiny-invariant"), 1);
 var oauth2RedirectQuerySchema = import_zod.z.object({
-  code: import_zod.z.string(),
-  state: import_zod.z.string(),
+  code: import_zod.z.string().optional(),
+  state: import_zod.z.string().optional(),
   error: import_zod.z.string().optional(),
   error_description: import_zod.z.string().optional(),
   error_uri: import_zod.z.string().optional()
@@ -51,6 +51,9 @@ var OAuth2Client = class {
   get baseUri() {
     return this.config.baseUri;
   }
+  get successUri() {
+    return this.config.successUri;
+  }
   get errorUri() {
     return this.config.errorUri;
   }
@@ -61,35 +64,49 @@ var OAuth2Client = class {
     (0, import_tiny_invariant.default)(provider, `Provider ${registration.provider ?? registrationId} not found`);
     return { registration, provider };
   }
-  createAuthorizationUri(registrationId, state, codeVerifier) {
+  createAuthorizationUri({
+    registrationId,
+    state,
+    pkce
+  }) {
     const { provider, registration } = this.getClientConfig(registrationId);
     const { baseUri } = this.config;
     const { scope, clientId, redirectUri } = registration;
     return provider.createAuthorizationUri({
+      pkce,
       state,
       scope,
       clientId,
-      codeVerifier,
       redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`
     });
   }
-  async exchangeAuthorizationCode(registrationId, code, codeVerifier) {
+  async exchangeAuthorizationCode({
+    registrationId,
+    code,
+    pkce
+  }) {
     const { provider, registration } = this.getClientConfig(registrationId);
     const { baseUri } = this.config;
     const { clientId, clientSecret, redirectUri } = registration;
     return provider.exchangeAuthorizationCode({
       code,
-      codeVerifier,
+      pkce,
       clientId,
       clientSecret,
       redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`
     });
   }
-  async getUserInfo(registrationId, token) {
+  async getUserInfo({
+    registrationId,
+    token
+  }) {
     const { provider } = this.getClientConfig(registrationId);
     return provider.getUserInfo(token);
   }
-  async refreshAccessToken(registrationId, refreshToken) {
+  async refreshAccessToken({
+    registrationId,
+    refreshToken
+  }) {
     const { provider, registration } = this.getClientConfig(registrationId);
     const { clientId, clientSecret } = registration;
     (0, import_tiny_invariant.default)(provider.refreshAccessToken, "Provider does not support refreshAccessToken");
@@ -101,6 +118,23 @@ var OAuth2Client = class {
     (0, import_tiny_invariant.default)(provider.revokeToken, "Provider does not support revokeToken");
     await provider.revokeToken({ token, clientId, clientSecret });
   }
+  async loginOAuth2Native({
+    registrationId,
+    credentials,
+    pkce
+  }) {
+    const { provider, registration } = this.getClientConfig(registrationId);
+    (0, import_tiny_invariant.default)(provider.loginOAuth2Native, "Provider does not support loginOAuth2Native");
+    const { baseUri } = this.config;
+    const { clientId, clientSecret, redirectUri } = registration;
+    return provider.loginOAuth2Native({
+      clientId,
+      clientSecret,
+      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,
+      credentials,
+      pkce
+    });
+  }
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/oauth2/client.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { z } from 'zod';\nimport invariant from 'tiny-invariant';\nimport { OAuth2ClientConfig, OAuth2Token } from './types';\n\nexport const oauth2RedirectQuerySchema = z.object({\n  code: z.string(),\n  state: z.string(),\n  error: z.string().optional(),\n  error_description: z.string().optional(),\n  error_uri: z.string().optional(),\n});\n\nexport class OAuth2Client {\n  private config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  getClientConfig(registrationId: string) {\n    const registration = this.config.registration[registrationId];\n    invariant(registration, `Registration ${registrationId} not found`);\n    const provider = this.config.provider[registration.provider ?? registrationId];\n    invariant(provider, `Provider ${registration.provider ?? registrationId} not found`);\n    return { registration, provider };\n  }\n\n  createAuthorizationUri(registrationId: string, state: string, codeVerifier?: string): URL {\n    const { provider, registration } = this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { scope, clientId, redirectUri } = registration;\n    return provider.createAuthorizationUri({\n      state,\n      scope,\n      clientId,\n      codeVerifier,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async exchangeAuthorizationCode(\n    registrationId: string,\n    code: string,\n    codeVerifier?: string\n  ): Promise<OAuth2Token> {\n    const { provider, registration } = this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n    return provider.exchangeAuthorizationCode({\n      code,\n      codeVerifier,\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async getUserInfo(registrationId: string, token: OAuth2Token) {\n    const { provider } = this.getClientConfig(registrationId);\n    return provider.getUserInfo(token);\n  }\n\n  async refreshAccessToken(registrationId: string, refreshToken: string): Promise<OAuth2Token> {\n    const { provider, registration } = this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    return provider.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken(registrationId: string, token: string) {\n    const { provider, registration } = this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.revokeToken, 'Provider does not support revokeToken');\n    await provider.revokeToken({ token, clientId, clientSecret });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAAkB;AAClB,4BAAsB;AAGf,IAAM,4BAA4B,aAAE,OAAO;AAAA,EAChD,MAAM,aAAE,OAAO;AAAA,EACf,OAAO,aAAE,OAAO;AAAA,EAChB,OAAO,aAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,mBAAmB,aAAE,OAAO,EAAE,SAAS;AAAA,EACvC,WAAW,aAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAEM,IAAM,eAAN,MAAmB;AAAA,EAChB;AAAA,EACR,YAAY,QAA4B;AACtC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,IAAI,UAAU;AACZ,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,IAAI,WAAW;AACb,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,gBAAgB,gBAAwB;AACtC,UAAM,eAAe,KAAK,OAAO,aAAa,cAAc;AAC5D,8BAAAA,SAAU,cAAc,gBAAgB,cAAc,YAAY;AAClE,UAAM,WAAW,KAAK,OAAO,SAAS,aAAa,YAAY,cAAc;AAC7E,8BAAAA,SAAU,UAAU,YAAY,aAAa,YAAY,cAAc,YAAY;AACnF,WAAO,EAAE,cAAc,SAAS;AAAA,EAClC;AAAA,EAEA,uBAAuB,gBAAwB,OAAe,cAA4B;AACxF,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AAEtE,UAAM,EAAE,QAAQ,IAAI,KAAK;AACzB,UAAM,EAAE,OAAO,UAAU,YAAY,IAAI;AACzC,WAAO,SAAS,uBAAuB;AAAA,MACrC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,eAAe,GAAG,OAAO,sBAAsB,cAAc;AAAA,IAC5E,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,0BACJ,gBACA,MACA,cACsB;AACtB,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AAEtE,UAAM,EAAE,QAAQ,IAAI,KAAK;AACzB,UAAM,EAAE,UAAU,cAAc,YAAY,IAAI;AAChD,WAAO,SAAS,0BAA0B;AAAA,MACxC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,eAAe,GAAG,OAAO,sBAAsB,cAAc;AAAA,IAC5E,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,YAAY,gBAAwB,OAAoB;AAC5D,UAAM,EAAE,SAAS,IAAI,KAAK,gBAAgB,cAAc;AACxD,WAAO,SAAS,YAAY,KAAK;AAAA,EACnC;AAAA,EAEA,MAAM,mBAAmB,gBAAwB,cAA4C;AAC3F,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AACtE,UAAM,EAAE,UAAU,aAAa,IAAI;AAEnC,8BAAAA,SAAU,SAAS,oBAAoB,8CAA8C;AACrF,WAAO,SAAS,mBAAmB,EAAE,cAAc,UAAU,aAAa,CAAC;AAAA,EAC7E;AAAA,EAEA,MAAM,YAAY,gBAAwB,OAAe;AACvD,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AACtE,UAAM,EAAE,UAAU,aAAa,IAAI;AAEnC,8BAAAA,SAAU,SAAS,aAAa,uCAAuC;AACvE,UAAM,SAAS,YAAY,EAAE,OAAO,UAAU,aAAa,CAAC;AAAA,EAC9D;AACF;","names":["invariant"]}
+{"version":3,"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { z } from 'zod';\nimport invariant from 'tiny-invariant';\nimport {\n  NativeCredentials,\n  OAuth2ClientConfig,\n  OAuth2Token,\n  OidcToken,\n  PkceParameters,\n} from './types';\n\nexport const oauth2RedirectQuerySchema = z.object({\n  code: z.string().optional(),\n  state: z.string().optional(),\n  error: z.string().optional(),\n  error_description: z.string().optional(),\n  error_uri: z.string().optional(),\n});\n\nexport class OAuth2Client {\n  private config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get successUri() {\n    return this.config.successUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  getClientConfig(registrationId: string) {\n    const registration = this.config.registration[registrationId];\n    invariant(registration, `Registration ${registrationId} not found`);\n    const provider = this.config.provider[registration.provider ?? registrationId];\n    invariant(provider, `Provider ${registration.provider ?? registrationId} not found`);\n    return { registration, provider };\n  }\n\n  createAuthorizationUri({\n    registrationId,\n    state,\n    pkce,\n  }: {\n    registrationId: string;\n    state: string;\n    pkce?: PkceParameters;\n  }): URL {\n    const { provider, registration } = this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { scope, clientId, redirectUri } = registration;\n    return provider.createAuthorizationUri({\n      pkce,\n      state,\n      scope,\n      clientId,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async exchangeAuthorizationCode({\n    registrationId,\n    code,\n    pkce,\n  }: {\n    registrationId: string;\n    code: string;\n    pkce?: PkceParameters;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n    return provider.exchangeAuthorizationCode({\n      code,\n      pkce,\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async getUserInfo({\n    registrationId,\n    token,\n  }: {\n    registrationId: string;\n    token: OAuth2Token | OidcToken;\n  }) {\n    const { provider } = this.getClientConfig(registrationId);\n    return provider.getUserInfo(token);\n  }\n\n  async refreshAccessToken({\n    registrationId,\n    refreshToken,\n  }: {\n    registrationId: string;\n    refreshToken: string;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    return provider.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken(registrationId: string, token: string) {\n    const { provider, registration } = this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.revokeToken, 'Provider does not support revokeToken');\n    await provider.revokeToken({ token, clientId, clientSecret });\n  }\n\n  async loginOAuth2Native({\n    registrationId,\n    credentials,\n    pkce,\n  }: {\n    registrationId: string;\n    credentials: NativeCredentials;\n    pkce?: PkceParameters;\n  }) {\n    const { provider, registration } = this.getClientConfig(registrationId);\n    invariant(provider.loginOAuth2Native, 'Provider does not support loginOAuth2Native');\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n\n    return provider.loginOAuth2Native({\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n      credentials,\n      pkce,\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAAkB;AAClB,4BAAsB;AASf,IAAM,4BAA4B,aAAE,OAAO;AAAA,EAChD,MAAM,aAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,OAAO,aAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,OAAO,aAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,mBAAmB,aAAE,OAAO,EAAE,SAAS;AAAA,EACvC,WAAW,aAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAEM,IAAM,eAAN,MAAmB;AAAA,EAChB;AAAA,EACR,YAAY,QAA4B;AACtC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,IAAI,UAAU;AACZ,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,IAAI,aAAa;AACf,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,IAAI,WAAW;AACb,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,gBAAgB,gBAAwB;AACtC,UAAM,eAAe,KAAK,OAAO,aAAa,cAAc;AAC5D,8BAAAA,SAAU,cAAc,gBAAgB,cAAc,YAAY;AAClE,UAAM,WAAW,KAAK,OAAO,SAAS,aAAa,YAAY,cAAc;AAC7E,8BAAAA,SAAU,UAAU,YAAY,aAAa,YAAY,cAAc,YAAY;AACnF,WAAO,EAAE,cAAc,SAAS;AAAA,EAClC;AAAA,EAEA,uBAAuB;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIQ;AACN,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AAEtE,UAAM,EAAE,QAAQ,IAAI,KAAK;AACzB,UAAM,EAAE,OAAO,UAAU,YAAY,IAAI;AACzC,WAAO,SAAS,uBAAuB;AAAA,MACrC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,eAAe,GAAG,OAAO,sBAAsB,cAAc;AAAA,IAC5E,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,0BAA0B;AAAA,IAC9B;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIyB;AACvB,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AAEtE,UAAM,EAAE,QAAQ,IAAI,KAAK;AACzB,UAAM,EAAE,UAAU,cAAc,YAAY,IAAI;AAChD,WAAO,SAAS,0BAA0B;AAAA,MACxC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,eAAe,GAAG,OAAO,sBAAsB,cAAc;AAAA,IAC5E,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,YAAY;AAAA,IAChB;AAAA,IACA;AAAA,EACF,GAGG;AACD,UAAM,EAAE,SAAS,IAAI,KAAK,gBAAgB,cAAc;AACxD,WAAO,SAAS,YAAY,KAAK;AAAA,EACnC;AAAA,EAEA,MAAM,mBAAmB;AAAA,IACvB;AAAA,IACA;AAAA,EACF,GAGyB;AACvB,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AACtE,UAAM,EAAE,UAAU,aAAa,IAAI;AAEnC,8BAAAA,SAAU,SAAS,oBAAoB,8CAA8C;AACrF,WAAO,SAAS,mBAAmB,EAAE,cAAc,UAAU,aAAa,CAAC;AAAA,EAC7E;AAAA,EAEA,MAAM,YAAY,gBAAwB,OAAe;AACvD,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AACtE,UAAM,EAAE,UAAU,aAAa,IAAI;AAEnC,8BAAAA,SAAU,SAAS,aAAa,uCAAuC;AACvE,UAAM,SAAS,YAAY,EAAE,OAAO,UAAU,aAAa,CAAC;AAAA,EAC9D;AAAA,EAEA,MAAM,kBAAkB;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIG;AACD,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AACtE,8BAAAA,SAAU,SAAS,mBAAmB,6CAA6C;AACnF,UAAM,EAAE,QAAQ,IAAI,KAAK;AACzB,UAAM,EAAE,UAAU,cAAc,YAAY,IAAI;AAEhD,WAAO,SAAS,kBAAkB;AAAA,MAChC;AAAA,MACA;AAAA,MACA,aAAa,eAAe,GAAG,OAAO,sBAAsB,cAAc;AAAA,MAC1E;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AACF;","names":["invariant"]}

package/dist/oauth2/client.d.cts

@@ -1,21 +1,21 @@
-import { OAuth2ClientConfig, Registration, Provider, OAuth2Token, UserInfo } from './types.cjs';
+import { OAuth2ClientConfig, Registration, Provider, PkceParameters, OAuth2Token, OidcToken, UserInfo, NativeCredentials } from './types.cjs';
 import { z } from 'zod';
 
 declare const oauth2RedirectQuerySchema: z.ZodObject<{
-    code: z.ZodString;
-    state: z.ZodString;
+    code: z.ZodOptional<z.ZodString>;
+    state: z.ZodOptional<z.ZodString>;
     error: z.ZodOptional<z.ZodString>;
     error_description: z.ZodOptional<z.ZodString>;
     error_uri: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    code: string;
-    state: string;
+    code?: string | undefined;
+    state?: string | undefined;
     error?: string | undefined;
     error_description?: string | undefined;
     error_uri?: string | undefined;
 }, {
-    code: string;
-    state: string;
+    code?: string | undefined;
+    state?: string | undefined;
     error?: string | undefined;
     error_description?: string | undefined;
     error_uri?: string | undefined;
@@ -24,16 +24,39 @@ declare class OAuth2Client {
     private config;
     constructor(config: OAuth2ClientConfig);
     get baseUri(): string;
+    get successUri(): string;
     get errorUri(): string;
     getClientConfig(registrationId: string): {
         registration: Registration;
-        provider: Provider<Record<string, any>>;
+        provider: Provider;
     };
-    createAuthorizationUri(registrationId: string, state: string, codeVerifier?: string): URL;
-    exchangeAuthorizationCode(registrationId: string, code: string, codeVerifier?: string): Promise<OAuth2Token>;
-    getUserInfo(registrationId: string, token: OAuth2Token): Promise<UserInfo<Record<string, any>>>;
-    refreshAccessToken(registrationId: string, refreshToken: string): Promise<OAuth2Token>;
+    createAuthorizationUri({ registrationId, state, pkce, }: {
+        registrationId: string;
+        state: string;
+        pkce?: PkceParameters;
+    }): URL;
+    exchangeAuthorizationCode({ registrationId, code, pkce, }: {
+        registrationId: string;
+        code: string;
+        pkce?: PkceParameters;
+    }): Promise<OAuth2Token>;
+    getUserInfo({ registrationId, token, }: {
+        registrationId: string;
+        token: OAuth2Token | OidcToken;
+    }): Promise<UserInfo<unknown>>;
+    refreshAccessToken({ registrationId, refreshToken, }: {
+        registrationId: string;
+        refreshToken: string;
+    }): Promise<OAuth2Token>;
     revokeToken(registrationId: string, token: string): Promise<void>;
+    loginOAuth2Native({ registrationId, credentials, pkce, }: {
+        registrationId: string;
+        credentials: NativeCredentials;
+        pkce?: PkceParameters;
+    }): Promise<{
+        token: OAuth2Token;
+        userInfo: UserInfo;
+    }>;
 }
 
 export { OAuth2Client, oauth2RedirectQuerySchema };

package/dist/oauth2/client.d.ts

@@ -1,21 +1,21 @@
-import { OAuth2ClientConfig, Registration, Provider, OAuth2Token, UserInfo } from './types.js';
+import { OAuth2ClientConfig, Registration, Provider, PkceParameters, OAuth2Token, OidcToken, UserInfo, NativeCredentials } from './types.js';
 import { z } from 'zod';
 
 declare const oauth2RedirectQuerySchema: z.ZodObject<{
-    code: z.ZodString;
-    state: z.ZodString;
+    code: z.ZodOptional<z.ZodString>;
+    state: z.ZodOptional<z.ZodString>;
     error: z.ZodOptional<z.ZodString>;
     error_description: z.ZodOptional<z.ZodString>;
     error_uri: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    code: string;
-    state: string;
+    code?: string | undefined;
+    state?: string | undefined;
     error?: string | undefined;
     error_description?: string | undefined;
     error_uri?: string | undefined;
 }, {
-    code: string;
-    state: string;
+    code?: string | undefined;
+    state?: string | undefined;
     error?: string | undefined;
     error_description?: string | undefined;
     error_uri?: string | undefined;
@@ -24,16 +24,39 @@ declare class OAuth2Client {
     private config;
     constructor(config: OAuth2ClientConfig);
     get baseUri(): string;
+    get successUri(): string;
     get errorUri(): string;
     getClientConfig(registrationId: string): {
         registration: Registration;
-        provider: Provider<Record<string, any>>;
+        provider: Provider;
     };
-    createAuthorizationUri(registrationId: string, state: string, codeVerifier?: string): URL;
-    exchangeAuthorizationCode(registrationId: string, code: string, codeVerifier?: string): Promise<OAuth2Token>;
-    getUserInfo(registrationId: string, token: OAuth2Token): Promise<UserInfo<Record<string, any>>>;
-    refreshAccessToken(registrationId: string, refreshToken: string): Promise<OAuth2Token>;
+    createAuthorizationUri({ registrationId, state, pkce, }: {
+        registrationId: string;
+        state: string;
+        pkce?: PkceParameters;
+    }): URL;
+    exchangeAuthorizationCode({ registrationId, code, pkce, }: {
+        registrationId: string;
+        code: string;
+        pkce?: PkceParameters;
+    }): Promise<OAuth2Token>;
+    getUserInfo({ registrationId, token, }: {
+        registrationId: string;
+        token: OAuth2Token | OidcToken;
+    }): Promise<UserInfo<unknown>>;
+    refreshAccessToken({ registrationId, refreshToken, }: {
+        registrationId: string;
+        refreshToken: string;
+    }): Promise<OAuth2Token>;
     revokeToken(registrationId: string, token: string): Promise<void>;
+    loginOAuth2Native({ registrationId, credentials, pkce, }: {
+        registrationId: string;
+        credentials: NativeCredentials;
+        pkce?: PkceParameters;
+    }): Promise<{
+        token: OAuth2Token;
+        userInfo: UserInfo;
+    }>;
 }
 
 export { OAuth2Client, oauth2RedirectQuerySchema };

package/dist/oauth2/client.mjs

@@ -2,8 +2,8 @@
 import { z } from "zod";
 import invariant from "tiny-invariant";
 var oauth2RedirectQuerySchema = z.object({
-  code: z.string(),
-  state: z.string(),
+  code: z.string().optional(),
+  state: z.string().optional(),
   error: z.string().optional(),
   error_description: z.string().optional(),
   error_uri: z.string().optional()
@@ -16,6 +16,9 @@ var OAuth2Client = class {
   get baseUri() {
     return this.config.baseUri;
   }
+  get successUri() {
+    return this.config.successUri;
+  }
   get errorUri() {
     return this.config.errorUri;
   }
@@ -26,35 +29,49 @@ var OAuth2Client = class {
     invariant(provider, `Provider ${registration.provider ?? registrationId} not found`);
     return { registration, provider };
   }
-  createAuthorizationUri(registrationId, state, codeVerifier) {
+  createAuthorizationUri({
+    registrationId,
+    state,
+    pkce
+  }) {
     const { provider, registration } = this.getClientConfig(registrationId);
     const { baseUri } = this.config;
     const { scope, clientId, redirectUri } = registration;
     return provider.createAuthorizationUri({
+      pkce,
       state,
       scope,
       clientId,
-      codeVerifier,
       redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`
     });
   }
-  async exchangeAuthorizationCode(registrationId, code, codeVerifier) {
+  async exchangeAuthorizationCode({
+    registrationId,
+    code,
+    pkce
+  }) {
     const { provider, registration } = this.getClientConfig(registrationId);
     const { baseUri } = this.config;
     const { clientId, clientSecret, redirectUri } = registration;
     return provider.exchangeAuthorizationCode({
       code,
-      codeVerifier,
+      pkce,
       clientId,
       clientSecret,
       redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`
     });
   }
-  async getUserInfo(registrationId, token) {
+  async getUserInfo({
+    registrationId,
+    token
+  }) {
     const { provider } = this.getClientConfig(registrationId);
     return provider.getUserInfo(token);
   }
-  async refreshAccessToken(registrationId, refreshToken) {
+  async refreshAccessToken({
+    registrationId,
+    refreshToken
+  }) {
     const { provider, registration } = this.getClientConfig(registrationId);
     const { clientId, clientSecret } = registration;
     invariant(provider.refreshAccessToken, "Provider does not support refreshAccessToken");
@@ -66,6 +83,23 @@ var OAuth2Client = class {
     invariant(provider.revokeToken, "Provider does not support revokeToken");
     await provider.revokeToken({ token, clientId, clientSecret });
   }
+  async loginOAuth2Native({
+    registrationId,
+    credentials,
+    pkce
+  }) {
+    const { provider, registration } = this.getClientConfig(registrationId);
+    invariant(provider.loginOAuth2Native, "Provider does not support loginOAuth2Native");
+    const { baseUri } = this.config;
+    const { clientId, clientSecret, redirectUri } = registration;
+    return provider.loginOAuth2Native({
+      clientId,
+      clientSecret,
+      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,
+      credentials,
+      pkce
+    });
+  }
 };
 export {
   OAuth2Client,

package/dist/oauth2/client.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { z } from 'zod';\nimport invariant from 'tiny-invariant';\nimport { OAuth2ClientConfig, OAuth2Token } from './types';\n\nexport const oauth2RedirectQuerySchema = z.object({\n  code: z.string(),\n  state: z.string(),\n  error: z.string().optional(),\n  error_description: z.string().optional(),\n  error_uri: z.string().optional(),\n});\n\nexport class OAuth2Client {\n  private config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  getClientConfig(registrationId: string) {\n    const registration = this.config.registration[registrationId];\n    invariant(registration, `Registration ${registrationId} not found`);\n    const provider = this.config.provider[registration.provider ?? registrationId];\n    invariant(provider, `Provider ${registration.provider ?? registrationId} not found`);\n    return { registration, provider };\n  }\n\n  createAuthorizationUri(registrationId: string, state: string, codeVerifier?: string): URL {\n    const { provider, registration } = this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { scope, clientId, redirectUri } = registration;\n    return provider.createAuthorizationUri({\n      state,\n      scope,\n      clientId,\n      codeVerifier,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async exchangeAuthorizationCode(\n    registrationId: string,\n    code: string,\n    codeVerifier?: string\n  ): Promise<OAuth2Token> {\n    const { provider, registration } = this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n    return provider.exchangeAuthorizationCode({\n      code,\n      codeVerifier,\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async getUserInfo(registrationId: string, token: OAuth2Token) {\n    const { provider } = this.getClientConfig(registrationId);\n    return provider.getUserInfo(token);\n  }\n\n  async refreshAccessToken(registrationId: string, refreshToken: string): Promise<OAuth2Token> {\n    const { provider, registration } = this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    return provider.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken(registrationId: string, token: string) {\n    const { provider, registration } = this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.revokeToken, 'Provider does not support revokeToken');\n    await provider.revokeToken({ token, clientId, clientSecret });\n  }\n}\n"],"mappings":";AAAA,SAAS,SAAS;AAClB,OAAO,eAAe;AAGf,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,MAAM,EAAE,OAAO;AAAA,EACf,OAAO,EAAE,OAAO;AAAA,EAChB,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAEM,IAAM,eAAN,MAAmB;AAAA,EAChB;AAAA,EACR,YAAY,QAA4B;AACtC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,IAAI,UAAU;AACZ,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,IAAI,WAAW;AACb,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,gBAAgB,gBAAwB;AACtC,UAAM,eAAe,KAAK,OAAO,aAAa,cAAc;AAC5D,cAAU,cAAc,gBAAgB,cAAc,YAAY;AAClE,UAAM,WAAW,KAAK,OAAO,SAAS,aAAa,YAAY,cAAc;AAC7E,cAAU,UAAU,YAAY,aAAa,YAAY,cAAc,YAAY;AACnF,WAAO,EAAE,cAAc,SAAS;AAAA,EAClC;AAAA,EAEA,uBAAuB,gBAAwB,OAAe,cAA4B;AACxF,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AAEtE,UAAM,EAAE,QAAQ,IAAI,KAAK;AACzB,UAAM,EAAE,OAAO,UAAU,YAAY,IAAI;AACzC,WAAO,SAAS,uBAAuB;AAAA,MACrC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,eAAe,GAAG,OAAO,sBAAsB,cAAc;AAAA,IAC5E,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,0BACJ,gBACA,MACA,cACsB;AACtB,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AAEtE,UAAM,EAAE,QAAQ,IAAI,KAAK;AACzB,UAAM,EAAE,UAAU,cAAc,YAAY,IAAI;AAChD,WAAO,SAAS,0BAA0B;AAAA,MACxC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,eAAe,GAAG,OAAO,sBAAsB,cAAc;AAAA,IAC5E,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,YAAY,gBAAwB,OAAoB;AAC5D,UAAM,EAAE,SAAS,IAAI,KAAK,gBAAgB,cAAc;AACxD,WAAO,SAAS,YAAY,KAAK;AAAA,EACnC;AAAA,EAEA,MAAM,mBAAmB,gBAAwB,cAA4C;AAC3F,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AACtE,UAAM,EAAE,UAAU,aAAa,IAAI;AAEnC,cAAU,SAAS,oBAAoB,8CAA8C;AACrF,WAAO,SAAS,mBAAmB,EAAE,cAAc,UAAU,aAAa,CAAC;AAAA,EAC7E;AAAA,EAEA,MAAM,YAAY,gBAAwB,OAAe;AACvD,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AACtE,UAAM,EAAE,UAAU,aAAa,IAAI;AAEnC,cAAU,SAAS,aAAa,uCAAuC;AACvE,UAAM,SAAS,YAAY,EAAE,OAAO,UAAU,aAAa,CAAC;AAAA,EAC9D;AACF;","names":[]}
+{"version":3,"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { z } from 'zod';\nimport invariant from 'tiny-invariant';\nimport {\n  NativeCredentials,\n  OAuth2ClientConfig,\n  OAuth2Token,\n  OidcToken,\n  PkceParameters,\n} from './types';\n\nexport const oauth2RedirectQuerySchema = z.object({\n  code: z.string().optional(),\n  state: z.string().optional(),\n  error: z.string().optional(),\n  error_description: z.string().optional(),\n  error_uri: z.string().optional(),\n});\n\nexport class OAuth2Client {\n  private config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get successUri() {\n    return this.config.successUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  getClientConfig(registrationId: string) {\n    const registration = this.config.registration[registrationId];\n    invariant(registration, `Registration ${registrationId} not found`);\n    const provider = this.config.provider[registration.provider ?? registrationId];\n    invariant(provider, `Provider ${registration.provider ?? registrationId} not found`);\n    return { registration, provider };\n  }\n\n  createAuthorizationUri({\n    registrationId,\n    state,\n    pkce,\n  }: {\n    registrationId: string;\n    state: string;\n    pkce?: PkceParameters;\n  }): URL {\n    const { provider, registration } = this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { scope, clientId, redirectUri } = registration;\n    return provider.createAuthorizationUri({\n      pkce,\n      state,\n      scope,\n      clientId,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async exchangeAuthorizationCode({\n    registrationId,\n    code,\n    pkce,\n  }: {\n    registrationId: string;\n    code: string;\n    pkce?: PkceParameters;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n    return provider.exchangeAuthorizationCode({\n      code,\n      pkce,\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async getUserInfo({\n    registrationId,\n    token,\n  }: {\n    registrationId: string;\n    token: OAuth2Token | OidcToken;\n  }) {\n    const { provider } = this.getClientConfig(registrationId);\n    return provider.getUserInfo(token);\n  }\n\n  async refreshAccessToken({\n    registrationId,\n    refreshToken,\n  }: {\n    registrationId: string;\n    refreshToken: string;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    return provider.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken(registrationId: string, token: string) {\n    const { provider, registration } = this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.revokeToken, 'Provider does not support revokeToken');\n    await provider.revokeToken({ token, clientId, clientSecret });\n  }\n\n  async loginOAuth2Native({\n    registrationId,\n    credentials,\n    pkce,\n  }: {\n    registrationId: string;\n    credentials: NativeCredentials;\n    pkce?: PkceParameters;\n  }) {\n    const { provider, registration } = this.getClientConfig(registrationId);\n    invariant(provider.loginOAuth2Native, 'Provider does not support loginOAuth2Native');\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n\n    return provider.loginOAuth2Native({\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n      credentials,\n      pkce,\n    });\n  }\n}\n"],"mappings":";AAAA,SAAS,SAAS;AAClB,OAAO,eAAe;AASf,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAEM,IAAM,eAAN,MAAmB;AAAA,EAChB;AAAA,EACR,YAAY,QAA4B;AACtC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,IAAI,UAAU;AACZ,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,IAAI,aAAa;AACf,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,IAAI,WAAW;AACb,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,gBAAgB,gBAAwB;AACtC,UAAM,eAAe,KAAK,OAAO,aAAa,cAAc;AAC5D,cAAU,cAAc,gBAAgB,cAAc,YAAY;AAClE,UAAM,WAAW,KAAK,OAAO,SAAS,aAAa,YAAY,cAAc;AAC7E,cAAU,UAAU,YAAY,aAAa,YAAY,cAAc,YAAY;AACnF,WAAO,EAAE,cAAc,SAAS;AAAA,EAClC;AAAA,EAEA,uBAAuB;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIQ;AACN,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AAEtE,UAAM,EAAE,QAAQ,IAAI,KAAK;AACzB,UAAM,EAAE,OAAO,UAAU,YAAY,IAAI;AACzC,WAAO,SAAS,uBAAuB;AAAA,MACrC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,eAAe,GAAG,OAAO,sBAAsB,cAAc;AAAA,IAC5E,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,0BAA0B;AAAA,IAC9B;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIyB;AACvB,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AAEtE,UAAM,EAAE,QAAQ,IAAI,KAAK;AACzB,UAAM,EAAE,UAAU,cAAc,YAAY,IAAI;AAChD,WAAO,SAAS,0BAA0B;AAAA,MACxC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,eAAe,GAAG,OAAO,sBAAsB,cAAc;AAAA,IAC5E,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,YAAY;AAAA,IAChB;AAAA,IACA;AAAA,EACF,GAGG;AACD,UAAM,EAAE,SAAS,IAAI,KAAK,gBAAgB,cAAc;AACxD,WAAO,SAAS,YAAY,KAAK;AAAA,EACnC;AAAA,EAEA,MAAM,mBAAmB;AAAA,IACvB;AAAA,IACA;AAAA,EACF,GAGyB;AACvB,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AACtE,UAAM,EAAE,UAAU,aAAa,IAAI;AAEnC,cAAU,SAAS,oBAAoB,8CAA8C;AACrF,WAAO,SAAS,mBAAmB,EAAE,cAAc,UAAU,aAAa,CAAC;AAAA,EAC7E;AAAA,EAEA,MAAM,YAAY,gBAAwB,OAAe;AACvD,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AACtE,UAAM,EAAE,UAAU,aAAa,IAAI;AAEnC,cAAU,SAAS,aAAa,uCAAuC;AACvE,UAAM,SAAS,YAAY,EAAE,OAAO,UAAU,aAAa,CAAC;AAAA,EAC9D;AAAA,EAEA,MAAM,kBAAkB;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAIG;AACD,UAAM,EAAE,UAAU,aAAa,IAAI,KAAK,gBAAgB,cAAc;AACtE,cAAU,SAAS,mBAAmB,6CAA6C;AACnF,UAAM,EAAE,QAAQ,IAAI,KAAK;AACzB,UAAM,EAAE,UAAU,cAAc,YAAY,IAAI;AAEhD,WAAO,SAAS,kBAAkB;AAAA,MAChC;AAAA,MACA;AAAA,MACA,aAAa,eAAe,GAAG,OAAO,sBAAsB,cAAc;AAAA,MAC1E;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AACF;","names":[]}

package/dist/oauth2/error.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/oauth2/error.ts"],"sourcesContent":["export type OAuth2ErrorType =\n  | 'invalid_request' // 400\n  | 'invalid_client' // 401\n  | 'invalid_grant' // 400\n  | 'invalid_token' // 401\n  | 'invalid_scope' // 400\n  | 'unauthorized_client' // 401\n  | 'unsupported_grant_type' // 400\n  | 'unsupported_response_type' // 400\n  | 'insufficient_scope' // 403\n  | 'redirect_uri_mismatch' // 400\n  | 'access_denied' // 400\n  // added\n  | 'server_error'\n  | string;\n\nexport class OAuth2Error extends Error {\n  readonly status: number;\n  readonly error: OAuth2ErrorType;\n\n  constructor(status: number, error: OAuth2ErrorType, message?: string) {\n    super(message ?? `OAuth2 error: ${error}`);\n    this.status = status;\n    this.error = error;\n    if ((Error as any).captureStackTrace) {\n      (Error as any).captureStackTrace(this, OAuth2Error);\n    }\n    Object.setPrototypeOf(this, OAuth2Error.prototype);\n  }\n}\n\nexport class AuthenticationError extends Error {\n  constructor(message: string) {\n    super(message);\n    if ((Error as any).captureStackTrace) {\n      (Error as any).captureStackTrace(this, AuthenticationError);\n    }\n    Object.setPrototypeOf(this, AuthenticationError.prototype);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgBO,IAAM,cAAN,MAAM,qBAAoB,MAAM;AAAA,EAC5B;AAAA,EACA;AAAA,EAET,YAAY,QAAgB,OAAwB,SAAkB;AACpE,UAAM,WAAW,iBAAiB,KAAK,EAAE;AACzC,SAAK,SAAS;AACd,SAAK,QAAQ;AACb,QAAK,MAAc,mBAAmB;AACpC,MAAC,MAAc,kBAAkB,MAAM,YAAW;AAAA,IACpD;AACA,WAAO,eAAe,MAAM,aAAY,SAAS;AAAA,EACnD;AACF;AAEO,IAAM,sBAAN,MAAM,6BAA4B,MAAM;AAAA,EAC7C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,QAAK,MAAc,mBAAmB;AACpC,MAAC,MAAc,kBAAkB,MAAM,oBAAmB;AAAA,IAC5D;AACA,WAAO,eAAe,MAAM,qBAAoB,SAAS;AAAA,EAC3D;AACF;","names":[]}
+{"version":3,"sources":["../../src/oauth2/error.ts"],"sourcesContent":["// reference: https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.2.1\nexport type OAuth2ErrorType =\n  | 'invalid_request' // 400\n  | 'invalid_client' // 401\n  | 'invalid_grant' // 400\n  | 'invalid_token' // 401\n  | 'invalid_scope' // 400\n  | 'unauthorized_client' // 401\n  | 'unsupported_grant_type' // 400\n  | 'unsupported_response_type' // 400\n  | 'insufficient_scope' // 403\n  | 'redirect_uri_mismatch' // 400\n  | 'access_denied' // 400\n  | 'server_error' // 500\n  | 'temporarily_unavailable' // 503\n  | (string & {});\n\nexport class OAuth2Error extends Error {\n  readonly status: number;\n  readonly error: OAuth2ErrorType;\n\n  constructor(status: number, error: OAuth2ErrorType, message?: string) {\n    super(message ?? `OAuth2 error: ${error}`);\n    this.status = status;\n    this.error = error;\n    if ((Error as any).captureStackTrace) {\n      (Error as any).captureStackTrace(this, OAuth2Error);\n    }\n    Object.setPrototypeOf(this, OAuth2Error.prototype);\n  }\n}\n\nexport class AuthenticationError extends Error {\n  constructor(message: string) {\n    super(message);\n    if ((Error as any).captureStackTrace) {\n      (Error as any).captureStackTrace(this, AuthenticationError);\n    }\n    Object.setPrototypeOf(this, AuthenticationError.prototype);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiBO,IAAM,cAAN,MAAM,qBAAoB,MAAM;AAAA,EAC5B;AAAA,EACA;AAAA,EAET,YAAY,QAAgB,OAAwB,SAAkB;AACpE,UAAM,WAAW,iBAAiB,KAAK,EAAE;AACzC,SAAK,SAAS;AACd,SAAK,QAAQ;AACb,QAAK,MAAc,mBAAmB;AACpC,MAAC,MAAc,kBAAkB,MAAM,YAAW;AAAA,IACpD;AACA,WAAO,eAAe,MAAM,aAAY,SAAS;AAAA,EACnD;AACF;AAEO,IAAM,sBAAN,MAAM,6BAA4B,MAAM;AAAA,EAC7C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,QAAK,MAAc,mBAAmB;AACpC,MAAC,MAAc,kBAAkB,MAAM,oBAAmB;AAAA,IAC5D;AACA,WAAO,eAAe,MAAM,qBAAoB,SAAS;AAAA,EAC3D;AACF;","names":[]}

package/dist/oauth2/error.d.cts

@@ -1,4 +1,4 @@
-type OAuth2ErrorType = 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'invalid_token' | 'invalid_scope' | 'unauthorized_client' | 'unsupported_grant_type' | 'unsupported_response_type' | 'insufficient_scope' | 'redirect_uri_mismatch' | 'access_denied' | 'server_error' | string;
+type OAuth2ErrorType = 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'invalid_token' | 'invalid_scope' | 'unauthorized_client' | 'unsupported_grant_type' | 'unsupported_response_type' | 'insufficient_scope' | 'redirect_uri_mismatch' | 'access_denied' | 'server_error' | 'temporarily_unavailable' | (string & {});
 declare class OAuth2Error extends Error {
     readonly status: number;
     readonly error: OAuth2ErrorType;

package/dist/oauth2/error.d.ts

@@ -1,4 +1,4 @@
-type OAuth2ErrorType = 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'invalid_token' | 'invalid_scope' | 'unauthorized_client' | 'unsupported_grant_type' | 'unsupported_response_type' | 'insufficient_scope' | 'redirect_uri_mismatch' | 'access_denied' | 'server_error' | string;
+type OAuth2ErrorType = 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'invalid_token' | 'invalid_scope' | 'unauthorized_client' | 'unsupported_grant_type' | 'unsupported_response_type' | 'insufficient_scope' | 'redirect_uri_mismatch' | 'access_denied' | 'server_error' | 'temporarily_unavailable' | (string & {});
 declare class OAuth2Error extends Error {
     readonly status: number;
     readonly error: OAuth2ErrorType;

package/dist/oauth2/error.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/oauth2/error.ts"],"sourcesContent":["export type OAuth2ErrorType =\n  | 'invalid_request' // 400\n  | 'invalid_client' // 401\n  | 'invalid_grant' // 400\n  | 'invalid_token' // 401\n  | 'invalid_scope' // 400\n  | 'unauthorized_client' // 401\n  | 'unsupported_grant_type' // 400\n  | 'unsupported_response_type' // 400\n  | 'insufficient_scope' // 403\n  | 'redirect_uri_mismatch' // 400\n  | 'access_denied' // 400\n  // added\n  | 'server_error'\n  | string;\n\nexport class OAuth2Error extends Error {\n  readonly status: number;\n  readonly error: OAuth2ErrorType;\n\n  constructor(status: number, error: OAuth2ErrorType, message?: string) {\n    super(message ?? `OAuth2 error: ${error}`);\n    this.status = status;\n    this.error = error;\n    if ((Error as any).captureStackTrace) {\n      (Error as any).captureStackTrace(this, OAuth2Error);\n    }\n    Object.setPrototypeOf(this, OAuth2Error.prototype);\n  }\n}\n\nexport class AuthenticationError extends Error {\n  constructor(message: string) {\n    super(message);\n    if ((Error as any).captureStackTrace) {\n      (Error as any).captureStackTrace(this, AuthenticationError);\n    }\n    Object.setPrototypeOf(this, AuthenticationError.prototype);\n  }\n}\n"],"mappings":";AAgBO,IAAM,cAAN,MAAM,qBAAoB,MAAM;AAAA,EAC5B;AAAA,EACA;AAAA,EAET,YAAY,QAAgB,OAAwB,SAAkB;AACpE,UAAM,WAAW,iBAAiB,KAAK,EAAE;AACzC,SAAK,SAAS;AACd,SAAK,QAAQ;AACb,QAAK,MAAc,mBAAmB;AACpC,MAAC,MAAc,kBAAkB,MAAM,YAAW;AAAA,IACpD;AACA,WAAO,eAAe,MAAM,aAAY,SAAS;AAAA,EACnD;AACF;AAEO,IAAM,sBAAN,MAAM,6BAA4B,MAAM;AAAA,EAC7C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,QAAK,MAAc,mBAAmB;AACpC,MAAC,MAAc,kBAAkB,MAAM,oBAAmB;AAAA,IAC5D;AACA,WAAO,eAAe,MAAM,qBAAoB,SAAS;AAAA,EAC3D;AACF;","names":[]}
+{"version":3,"sources":["../../src/oauth2/error.ts"],"sourcesContent":["// reference: https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.2.1\nexport type OAuth2ErrorType =\n  | 'invalid_request' // 400\n  | 'invalid_client' // 401\n  | 'invalid_grant' // 400\n  | 'invalid_token' // 401\n  | 'invalid_scope' // 400\n  | 'unauthorized_client' // 401\n  | 'unsupported_grant_type' // 400\n  | 'unsupported_response_type' // 400\n  | 'insufficient_scope' // 403\n  | 'redirect_uri_mismatch' // 400\n  | 'access_denied' // 400\n  | 'server_error' // 500\n  | 'temporarily_unavailable' // 503\n  | (string & {});\n\nexport class OAuth2Error extends Error {\n  readonly status: number;\n  readonly error: OAuth2ErrorType;\n\n  constructor(status: number, error: OAuth2ErrorType, message?: string) {\n    super(message ?? `OAuth2 error: ${error}`);\n    this.status = status;\n    this.error = error;\n    if ((Error as any).captureStackTrace) {\n      (Error as any).captureStackTrace(this, OAuth2Error);\n    }\n    Object.setPrototypeOf(this, OAuth2Error.prototype);\n  }\n}\n\nexport class AuthenticationError extends Error {\n  constructor(message: string) {\n    super(message);\n    if ((Error as any).captureStackTrace) {\n      (Error as any).captureStackTrace(this, AuthenticationError);\n    }\n    Object.setPrototypeOf(this, AuthenticationError.prototype);\n  }\n}\n"],"mappings":";AAiBO,IAAM,cAAN,MAAM,qBAAoB,MAAM;AAAA,EAC5B;AAAA,EACA;AAAA,EAET,YAAY,QAAgB,OAAwB,SAAkB;AACpE,UAAM,WAAW,iBAAiB,KAAK,EAAE;AACzC,SAAK,SAAS;AACd,SAAK,QAAQ;AACb,QAAK,MAAc,mBAAmB;AACpC,MAAC,MAAc,kBAAkB,MAAM,YAAW;AAAA,IACpD;AACA,WAAO,eAAe,MAAM,aAAY,SAAS;AAAA,EACnD;AACF;AAEO,IAAM,sBAAN,MAAM,6BAA4B,MAAM;AAAA,EAC7C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,QAAK,MAAc,mBAAmB;AACpC,MAAC,MAAc,kBAAkB,MAAM,oBAAmB;AAAA,IAC5D;AACA,WAAO,eAAe,MAAM,qBAAoB,SAAS;AAAA,EAC3D;AACF;","names":[]}

package/dist/oauth2/provider/apple.cjs

@@ -30,13 +30,14 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/oauth2/provider/apple.ts
 var apple_exports = {};
 __export(apple_exports, {
-  apple: () => apple
+  apple: () => apple,
+  createAppleProvider: () => createAppleProvider
 });
 module.exports = __toCommonJS(apple_exports);
 var import_tiny_invariant = __toESM(require("tiny-invariant"), 1);
 var import_error = require("../error.cjs");
 var import_common = require("./common.cjs");
-function apple() {
+function createAppleProvider() {
   return {
     // important notice: response_mode=form_post is required for apple
     authorizationUri: "https://appleid.apple.com/auth/authorize?response_mode=form_post",
@@ -44,14 +45,14 @@ function apple() {
     jwkSetUri: "https://appleid.apple.com/auth/keys",
     userNameAttribute: "sub",
     defaultScope: ["openid", "name", "email"],
-    createAuthorizationUri({ codeVerifier, ...params }) {
+    createAuthorizationUri({ pkce, ...params }) {
       return (0, import_common.createAuthorizationUri)({
         ...params,
         scope: params.scope ?? this.defaultScope,
         authorizationUri: this.authorizationUri
       });
     },
-    async exchangeAuthorizationCode({ codeVerifier, ...params }) {
+    async exchangeAuthorizationCode({ pkce, ...params }) {
       const response = await (0, import_common.exchangeAuthorizationCode)({ ...params, tokenUri: this.tokenUri });
       if (!response.ok) {
         const { error } = await response.json();
@@ -75,11 +76,26 @@ function apple() {
           family_name: data.user?.name.lastName
         }
       };
+    },
+    async loginOAuth2Native({ pkce, credentials, ...params }) {
+      (0, import_tiny_invariant.default)(credentials.code, "code is required");
+      const { tokenUri } = this;
+      const { code } = credentials;
+      const response = await (0, import_common.exchangeAuthorizationCode)({ code, tokenUri, ...params });
+      if (!response.ok) {
+        const { error } = await response.json();
+        throw new import_error.OAuth2Error(response.status, error);
+      }
+      const token = await response.json();
+      const userInfo = await this.getUserInfo(token);
+      return { token, userInfo };
     }
   };
 }
+var apple = createAppleProvider();
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  apple
+  apple,
+  createAppleProvider
 });
 //# sourceMappingURL=apple.cjs.map

package/dist/oauth2/provider/apple.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth2/provider/apple.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n// ref: https://account.apple.com/.well-known/openid-configuration\nexport function apple(): Provider<AppleUserInfo> {\n  return {\n    // important notice: response_mode=form_post is required for apple\n    authorizationUri: 'https://appleid.apple.com/auth/authorize?response_mode=form_post',\n    tokenUri: 'https://appleid.apple.com/auth/token',\n    jwkSetUri: 'https://appleid.apple.com/auth/keys',\n    userNameAttribute: 'sub',\n    defaultScope: ['openid', 'name', 'email'],\n    createAuthorizationUri({ codeVerifier, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ codeVerifier, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      return (await response.json()) as AppleOAuth2Token;\n    },\n    async getUserInfo({ id_token }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<AppleUserInfo>(id_token, this.jwkSetUri);\n      return {\n        data,\n        claims: {\n          sub: data.sub,\n          name: data.name,\n          email: data.email,\n          email_verified: true,\n          picture: data.picture,\n          given_name: data.user?.name.firstName,\n          family_name: data.user?.name.lastName,\n        },\n      };\n    },\n  };\n}\n\n// https://developer.apple.com/documentation/sign_in_with_apple/authenticating-users-with-sign-in-with-apple\nexport interface AppleUserInfo {\n  sub: string;\n  email: string;\n  email_verified: true | 'true';\n  is_private_email: boolean;\n  real_user_status: number;\n  name: string;\n  picture: string;\n  user?: {\n    name: { firstName: string; lastName: string };\n    email: string;\n  };\n}\n\n// https://developer.apple.com/documentation/devicemanagement/implementing-the-oauth2-authentication-user-enrollment-flow\n// https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens\nexport interface AppleOAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n}\n\n// https://developer.apple.com/documentation/sign_in_with_apple/errorresponse\nexport interface AppleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'invalid_scope';\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4BAAsB;AAEtB,mBAA4B;AAC5B,oBAAiF;AAG1E,SAAS,QAAiC;AAC/C,SAAO;AAAA;AAAA,IAEL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,WAAW;AAAA,IACX,mBAAmB;AAAA,IACnB,cAAc,CAAC,UAAU,QAAQ,OAAO;AAAA,IACxC,uBAAuB,EAAE,cAAc,GAAG,OAAO,GAAG;AAClD,iBAAO,sCAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,EAAE,cAAc,GAAG,OAAO,GAAG;AAC3D,YAAM,WAAW,UAAM,yCAA0B,EAAE,GAAG,QAAQ,UAAU,KAAK,SAAS,CAAC;AACvF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,MAAM,IAAK,MAAM,SAAS,KAAK;AACvC,cAAM,IAAI,yBAAY,SAAS,QAAQ,KAAK;AAAA,MAC9C;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,SAAS,GAAG;AAC9B,gCAAAA,SAAU,UAAU,sBAAsB;AAC1C,gCAAAA,SAAU,KAAK,WAAW,uBAAuB;AACjD,YAAM,OAAO,UAAM,6BAA6B,UAAU,KAAK,SAAS;AACxE,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,UACN,KAAK,KAAK;AAAA,UACV,MAAM,KAAK;AAAA,UACX,OAAO,KAAK;AAAA,UACZ,gBAAgB;AAAA,UAChB,SAAS,KAAK;AAAA,UACd,YAAY,KAAK,MAAM,KAAK;AAAA,UAC5B,aAAa,KAAK,MAAM,KAAK;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":["invariant"]}
+{"version":3,"sources":["../../../src/oauth2/provider/apple.ts"],"sourcesContent":["import invariant from 'tiny-invariant';\nimport { NativeCredentials, LoginOAuth2NativeParams, OAuth2Token, Provider } from '../types';\nimport { OAuth2Error } from '../error';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n// ref: https://account.apple.com/.well-known/openid-configuration\nexport function createAppleProvider(): Provider {\n  return {\n    // important notice: response_mode=form_post is required for apple\n    authorizationUri: 'https://appleid.apple.com/auth/authorize?response_mode=form_post',\n    tokenUri: 'https://appleid.apple.com/auth/token',\n    jwkSetUri: 'https://appleid.apple.com/auth/keys',\n    userNameAttribute: 'sub',\n    defaultScope: ['openid', 'name', 'email'],\n    createAuthorizationUri({ pkce, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      return (await response.json()) as AppleToken;\n    },\n    async getUserInfo({ id_token }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<AppleUserInfo>(id_token, this.jwkSetUri);\n      return {\n        data,\n        claims: {\n          sub: data.sub,\n          name: data.name,\n          email: data.email,\n          email_verified: true,\n          picture: data.picture,\n          given_name: data.user?.name.firstName,\n          family_name: data.user?.name.lastName,\n        },\n      };\n    },\n    async loginOAuth2Native({ pkce, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { tokenUri } = this;\n      const { code } = credentials;\n      const response = await exchangeAuthorizationCode({ code, tokenUri, ...params });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      const token = (await response.json()) as AppleToken;\n      const userInfo = await this.getUserInfo(token);\n      return { token, userInfo };\n    },\n  };\n}\n\nexport const apple = createAppleProvider();\n\n// https://developer.apple.com/documentation/sign_in_with_apple/authenticating-users-with-sign-in-with-apple\nexport interface AppleUserInfo {\n  sub: string;\n  email: string;\n  email_verified: true | 'true';\n  is_private_email: boolean;\n  real_user_status: number;\n  name: string;\n  picture: string;\n  user?: {\n    name: { firstName: string; lastName: string };\n    email: string;\n  };\n}\n\n// https://developer.apple.com/documentation/devicemanagement/implementing-the-oauth2-authentication-user-enrollment-flow\n// https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens\nexport interface AppleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n}\n\nexport interface AppleNativeCredentials extends NativeCredentials {\n  state: string;\n  code: string;\n  id_token: string;\n  // no standard fields\n  user: string;\n  email?: string;\n}\n\n// https://developer.apple.com/documentation/sign_in_with_apple/errorresponse\nexport interface AppleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'invalid_scope';\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4BAAsB;AAEtB,mBAA4B;AAC5B,oBAAiF;AAG1E,SAAS,sBAAgC;AAC9C,SAAO;AAAA;AAAA,IAEL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,WAAW;AAAA,IACX,mBAAmB;AAAA,IACnB,cAAc,CAAC,UAAU,QAAQ,OAAO;AAAA,IACxC,uBAAuB,EAAE,MAAM,GAAG,OAAO,GAAG;AAC1C,iBAAO,sCAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,OAAO,GAAG;AACnD,YAAM,WAAW,UAAM,yCAA0B,EAAE,GAAG,QAAQ,UAAU,KAAK,SAAS,CAAC;AACvF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,MAAM,IAAK,MAAM,SAAS,KAAK;AACvC,cAAM,IAAI,yBAAY,SAAS,QAAQ,KAAK;AAAA,MAC9C;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,SAAS,GAAG;AAC9B,gCAAAA,SAAU,UAAU,sBAAsB;AAC1C,gCAAAA,SAAU,KAAK,WAAW,uBAAuB;AACjD,YAAM,OAAO,UAAM,6BAA6B,UAAU,KAAK,SAAS;AACxE,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,UACN,KAAK,KAAK;AAAA,UACV,MAAM,KAAK;AAAA,UACX,OAAO,KAAK;AAAA,UACZ,gBAAgB;AAAA,UAChB,SAAS,KAAK;AAAA,UACd,YAAY,KAAK,MAAM,KAAK;AAAA,UAC5B,aAAa,KAAK,MAAM,KAAK;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,kBAAkB,EAAE,MAAM,aAAa,GAAG,OAAO,GAA4B;AACjF,gCAAAA,SAAU,YAAY,MAAM,kBAAkB;AAC9C,YAAM,EAAE,SAAS,IAAI;AACrB,YAAM,EAAE,KAAK,IAAI;AACjB,YAAM,WAAW,UAAM,yCAA0B,EAAE,MAAM,UAAU,GAAG,OAAO,CAAC;AAC9E,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,MAAM,IAAK,MAAM,SAAS,KAAK;AACvC,cAAM,IAAI,yBAAY,SAAS,QAAQ,KAAK;AAAA,MAC9C;AACA,YAAM,QAAS,MAAM,SAAS,KAAK;AACnC,YAAM,WAAW,MAAM,KAAK,YAAY,KAAK;AAC7C,aAAO,EAAE,OAAO,SAAS;AAAA,IAC3B;AAAA,EACF;AACF;AAEO,IAAM,QAAQ,oBAAoB;","names":["invariant"]}

package/dist/oauth2/provider/apple.d.cts

@@ -1,6 +1,7 @@
-import { Provider } from '../types.cjs';
+import { Provider, OAuth2Token, NativeCredentials } from '../types.cjs';
 
-declare function apple(): Provider<AppleUserInfo>;
+declare function createAppleProvider(): Provider;
+declare const apple: Provider;
 interface AppleUserInfo {
     sub: string;
     email: string;
@@ -17,15 +18,22 @@ interface AppleUserInfo {
         email: string;
     };
 }
-interface AppleOAuth2Token {
+interface AppleToken extends OAuth2Token {
     access_token: string;
     token_type: string;
     expires_in: number;
     refresh_token: string;
     id_token: string;
 }
+interface AppleNativeCredentials extends NativeCredentials {
+    state: string;
+    code: string;
+    id_token: string;
+    user: string;
+    email?: string;
+}
 interface AppleErrorResponse {
     error: 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'invalid_scope';
 }
 
-export { type AppleErrorResponse, type AppleOAuth2Token, type AppleUserInfo, apple };
+export { type AppleErrorResponse, type AppleNativeCredentials, type AppleToken, type AppleUserInfo, apple, createAppleProvider };

package/dist/oauth2/provider/apple.d.ts

@@ -1,6 +1,7 @@
-import { Provider } from '../types.js';
+import { Provider, OAuth2Token, NativeCredentials } from '../types.js';
 
-declare function apple(): Provider<AppleUserInfo>;
+declare function createAppleProvider(): Provider;
+declare const apple: Provider;
 interface AppleUserInfo {
     sub: string;
     email: string;
@@ -17,15 +18,22 @@ interface AppleUserInfo {
         email: string;
     };
 }
-interface AppleOAuth2Token {
+interface AppleToken extends OAuth2Token {
     access_token: string;
     token_type: string;
     expires_in: number;
     refresh_token: string;
     id_token: string;
 }
+interface AppleNativeCredentials extends NativeCredentials {
+    state: string;
+    code: string;
+    id_token: string;
+    user: string;
+    email?: string;
+}
 interface AppleErrorResponse {
     error: 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'invalid_scope';
 }
 
-export { type AppleErrorResponse, type AppleOAuth2Token, type AppleUserInfo, apple };
+export { type AppleErrorResponse, type AppleNativeCredentials, type AppleToken, type AppleUserInfo, apple, createAppleProvider };