@shware/security 2.5.3 → 2.6.0

package/dist/oauth2/provider/x.d.cts

@@ -1,68 +1,69 @@
-import { Provider, OAuth2Token } from '../types.cjs';
-
+import { OAuth2Token, Provider } from "../types.cjs";
+//#region src/oauth2/provider/x.d.ts
 interface XOptions {
-    userFields?: UserField[];
+  userFields?: UserField[];
 }
 declare function createXProvider(options?: XOptions): Provider;
 declare const x: Provider;
 type UserField = 'affiliation' | 'connection_status' | 'created_at' | 'description' | 'entities' | 'id' | 'is_identity_verified' | 'location' | 'most_recent_tweet_id' | 'name' | 'parody' | 'pinned_tweet_id' | 'profile_banner_url' | 'profile_image_url' | 'protected' | 'public_metrics' | 'receives_your_dm' | 'subscription' | 'subscription_type' | 'url' | 'username' | 'verified' | 'verified_followers_count' | 'verified_type' | 'withheld';
 interface XUser {
-    id: string;
-    name: string;
-    email?: string;
-    username: string;
-    location?: string;
-    entities?: {
-        url: {
-            urls: UrlEntity[];
-        };
-        description: {
-            hashtags: HashtagEntity[];
-            cashtags: HashtagEntity[];
-            mentions: MentionEntity[];
-        };
+  id: string;
+  name: string;
+  email?: string;
+  username: string;
+  location?: string;
+  entities?: {
+    url: {
+      urls: UrlEntity[];
     };
-    verified?: boolean;
-    description?: string;
-    url?: string;
-    profile_image_url?: string;
-    protected?: boolean;
-    pinned_tweet_id?: string;
-    created_at?: string;
+    description: {
+      hashtags: HashtagEntity[];
+      cashtags: HashtagEntity[];
+      mentions: MentionEntity[];
+    };
+  };
+  verified?: boolean;
+  description?: string;
+  url?: string;
+  profile_image_url?: string;
+  protected?: boolean;
+  pinned_tweet_id?: string;
+  created_at?: string;
 }
 interface XUserInfo {
-    data: XUser;
-    includes?: {
-        tweets?: {
-            id: string;
-            text: string;
-        }[];
-        users?: XUser[];
-    };
+  data: XUser;
+  includes?: {
+    tweets?: {
+      id: string;
+      text: string;
+    }[];
+    users?: XUser[];
+  };
 }
 type UrlEntity = {
-    start: number;
-    end: number;
-    url: string;
-    display_url: string;
-    expanded_url: string;
+  start: number;
+  end: number;
+  url: string;
+  display_url: string;
+  expanded_url: string;
 };
 type HashtagEntity = {
-    start: number;
-    end: number;
-    tag: string;
+  start: number;
+  end: number;
+  tag: string;
 };
 type MentionEntity = {
-    start: number;
-    end: string;
-    username: string;
+  start: number;
+  end: string;
+  username: string;
 };
 interface XToken extends OAuth2Token {
-    token_type: string;
-    expires_in: number;
-    access_token: string;
-    scope: string;
-    refresh_token: string;
+  token_type: string;
+  expires_in: number;
+  access_token: string;
+  scope: string;
+  refresh_token: string;
 }
-
-export { type XOptions, type XToken, type XUser, type XUserInfo, createXProvider, x };
+//#endregion
+export { XOptions, XToken, XUser, XUserInfo, createXProvider, x };
+//# sourceMappingURL=x.d.cts.map

package/dist/oauth2/provider/x.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x.d.cts","names":[],"sources":["../../../src/oauth2/provider/x.ts"],"mappings":";;UAUiB;EACf,aAAa;;iBAaC,gBAAgB,UAAU,WAAW;cAwFxC,GAAC;KAET;UA2BY;EACf;EACA;EACA;EACA;EACA;EACA;IACE;MAAO,MAAM;;IACb;MACE,UAAU;MACV,UAAU;MACV,UAAU;;;EAGd;EACA;EACA;EACA;EACA;EACA;EACA;;UAGe;EACf,MAAM;EACN;IAAa;MAAW;MAAY;;IAAkB,QAAQ;;;KAG3D;EACH;EACA;EACA;EACA;EACA;;KAEG;EAAkB;EAAe;EAAa;;KAC9C;EAAkB;EAAe;EAAa;;UAElC,eAAe;EAC9B;EACA;EACA;EACA;EACA"}

package/dist/oauth2/provider/x.d.mts

@@ -0,0 +1,69 @@
+import { OAuth2Token, Provider } from "../types.mjs";
+//#region src/oauth2/provider/x.d.ts
+interface XOptions {
+  userFields?: UserField[];
+}
+declare function createXProvider(options?: XOptions): Provider;
+declare const x: Provider;
+type UserField = 'affiliation' | 'connection_status' | 'created_at' | 'description' | 'entities' | 'id' | 'is_identity_verified' | 'location' | 'most_recent_tweet_id' | 'name' | 'parody' | 'pinned_tweet_id' | 'profile_banner_url' | 'profile_image_url' | 'protected' | 'public_metrics' | 'receives_your_dm' | 'subscription' | 'subscription_type' | 'url' | 'username' | 'verified' | 'verified_followers_count' | 'verified_type' | 'withheld';
+interface XUser {
+  id: string;
+  name: string;
+  email?: string;
+  username: string;
+  location?: string;
+  entities?: {
+    url: {
+      urls: UrlEntity[];
+    };
+    description: {
+      hashtags: HashtagEntity[];
+      cashtags: HashtagEntity[];
+      mentions: MentionEntity[];
+    };
+  };
+  verified?: boolean;
+  description?: string;
+  url?: string;
+  profile_image_url?: string;
+  protected?: boolean;
+  pinned_tweet_id?: string;
+  created_at?: string;
+}
+interface XUserInfo {
+  data: XUser;
+  includes?: {
+    tweets?: {
+      id: string;
+      text: string;
+    }[];
+    users?: XUser[];
+  };
+}
+type UrlEntity = {
+  start: number;
+  end: number;
+  url: string;
+  display_url: string;
+  expanded_url: string;
+};
+type HashtagEntity = {
+  start: number;
+  end: number;
+  tag: string;
+};
+type MentionEntity = {
+  start: number;
+  end: string;
+  username: string;
+};
+interface XToken extends OAuth2Token {
+  token_type: string;
+  expires_in: number;
+  access_token: string;
+  scope: string;
+  refresh_token: string;
+}
+//#endregion
+export { XOptions, XToken, XUser, XUserInfo, createXProvider, x };
+//# sourceMappingURL=x.d.mts.map

package/dist/oauth2/provider/x.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x.d.mts","names":[],"sources":["../../../src/oauth2/provider/x.ts"],"mappings":";;UAUiB;EACf,aAAa;;iBAaC,gBAAgB,UAAU,WAAW;cAwFxC,GAAC;KAET;UA2BY;EACf;EACA;EACA;EACA;EACA;EACA;IACE;MAAO,MAAM;;IACb;MACE,UAAU;MACV,UAAU;MACV,UAAU;;;EAGd;EACA;EACA;EACA;EACA;EACA;EACA;;UAGe;EACf,MAAM;EACN;IAAa;MAAW;MAAY;;IAAkB,QAAQ;;;KAG3D;EACH;EACA;EACA;EACA;EACA;;KAEG;EAAkB;EAAe;EAAa;;KAC9C;EAAkB;EAAe;EAAa;;UAElC,eAAe;EAC9B;EACA;EACA;EACA;EACA"}

package/dist/oauth2/provider/x.mjs

@@ -1,108 +1,104 @@
-// src/oauth2/provider/x.ts
-import { invariant } from "@shware/utils";
 import { OAuth2Error } from "../error.mjs";
-import {
-  createAuthorizationUri,
-  exchangeAuthorizationCode,
-  refreshAccessToken,
-  revokeToken
-} from "./common.mjs";
-var defaultUserFields = [
-  "id",
-  "name",
-  "profile_image_url",
-  "url",
-  "username",
-  "location",
-  "verified"
+import { createAuthorizationUri, exchangeAuthorizationCode, refreshAccessToken, revokeToken } from "./common.mjs";
+import { invariant } from "@shware/utils";
+//#region src/oauth2/provider/x.ts
+const defaultUserFields = [
+	"id",
+	"name",
+	"profile_image_url",
+	"url",
+	"username",
+	"location",
+	"verified"
 ];
 function createXProvider(options) {
-  return {
-    authorizationUri: "https://x.com/i/oauth2/authorize",
-    tokenUri: "https://api.x.com/2/oauth2/token",
-    tokenRefreshUri: "https://api.x.com/2/oauth2/token",
-    tokenRevokeUri: "https://api.x.com/2/oauth2/revoke",
-    // https://docs.x.com/x-api/users/user-lookup-me
-    userInfoUri: "https://api.x.com/2/users/me",
-    defaultScope: ["users.read", "tweet.read", "offline.access"],
-    createAuthorizationUri(params) {
-      if (!params.pkce) throw new Error("pkce is required for x");
-      return createAuthorizationUri({
-        ...params,
-        scope: params.scope ?? this.defaultScope,
-        authorizationUri: this.authorizationUri
-      });
-    },
-    async exchangeAuthorizationCode(params) {
-      if (!params.pkce) throw new Error("pkce is required for x");
-      const response = await exchangeAuthorizationCode({
-        ...params,
-        tokenUri: this.tokenUri,
-        authentication: "basic"
-      });
-      if (!response.ok) {
-        const { error, error_description } = await response.json();
-        throw new OAuth2Error(response.status, error, error_description);
-      }
-      return await response.json();
-    },
-    async getUserInfo({ access_token }) {
-      invariant(access_token, "access_token is required");
-      invariant(this.userInfoUri, "userInfoUri is required");
-      const userFields = options?.userFields ?? defaultUserFields;
-      const headers = { Accept: "application/json", Authorization: `Bearer ${access_token}` };
-      const url = new URL(this.userInfoUri);
-      userFields.forEach((field) => url.searchParams.append("user.fields", field));
-      const response = await fetch(this.userInfoUri, { headers });
-      if (!response.ok) {
-        const { errors } = await response.json();
-        throw new OAuth2Error(
-          response.status,
-          "invalid_request",
-          `Failed to fetch user info: ${errors.at(0)?.detail ?? errors.at(0)?.title}`
-        );
-      }
-      const profile = await response.json();
-      return {
-        data: profile,
-        claims: {
-          sub: profile.data.id,
-          name: profile.data.name,
-          picture: profile.data.profile_image_url,
-          email: profile.data.email,
-          email_verified: profile.data.verified || false,
-          preferred_username: profile.data.username,
-          profile: `https://x.com/${profile.data.username}`,
-          website: profile.data.url
-        }
-      };
-    },
-    async refreshAccessToken(params) {
-      invariant(this.tokenRefreshUri, "tokenRefreshUri is required");
-      const response = await refreshAccessToken({
-        ...params,
-        tokenUri: this.tokenRefreshUri,
-        authentication: "basic"
-      });
-      if (!response.ok) {
-        const { error, error_description } = await response.json();
-        throw new OAuth2Error(response.status, error, error_description);
-      }
-      return await response.json();
-    },
-    async revokeToken(params) {
-      invariant(this.tokenRevokeUri, "tokenRevokeUri is required");
-      return revokeToken({
-        ...params,
-        tokenRevokeUri: this.tokenRevokeUri,
-        authentication: "basic"
-      });
-    }
-  };
+	return {
+		authorizationUri: "https://x.com/i/oauth2/authorize",
+		tokenUri: "https://api.x.com/2/oauth2/token",
+		tokenRefreshUri: "https://api.x.com/2/oauth2/token",
+		tokenRevokeUri: "https://api.x.com/2/oauth2/revoke",
+		userInfoUri: "https://api.x.com/2/users/me",
+		defaultScope: [
+			"users.read",
+			"tweet.read",
+			"offline.access"
+		],
+		createAuthorizationUri(params) {
+			if (!params.pkce) throw new Error("pkce is required for x");
+			return createAuthorizationUri({
+				...params,
+				scope: params.scope ?? this.defaultScope,
+				authorizationUri: this.authorizationUri
+			});
+		},
+		async exchangeAuthorizationCode(params) {
+			if (!params.pkce) throw new Error("pkce is required for x");
+			const response = await exchangeAuthorizationCode({
+				...params,
+				tokenUri: this.tokenUri,
+				authentication: "basic"
+			});
+			if (!response.ok) {
+				const { error, error_description } = await response.json();
+				throw new OAuth2Error(response.status, error, error_description);
+			}
+			return await response.json();
+		},
+		async getUserInfo({ access_token }) {
+			invariant(access_token, "access_token is required");
+			invariant(this.userInfoUri, "userInfoUri is required");
+			const userFields = options?.userFields ?? defaultUserFields;
+			const headers = {
+				Accept: "application/json",
+				Authorization: `Bearer ${access_token}`
+			};
+			const url = new URL(this.userInfoUri);
+			userFields.forEach((field) => url.searchParams.append("user.fields", field));
+			const response = await fetch(this.userInfoUri, { headers });
+			if (!response.ok) {
+				const { errors } = await response.json();
+				throw new OAuth2Error(response.status, "invalid_request", `Failed to fetch user info: ${errors.at(0)?.detail ?? errors.at(0)?.title}`);
+			}
+			const profile = await response.json();
+			return {
+				data: profile,
+				claims: {
+					sub: profile.data.id,
+					name: profile.data.name,
+					picture: profile.data.profile_image_url,
+					email: profile.data.email,
+					email_verified: profile.data.verified || false,
+					preferred_username: profile.data.username,
+					profile: `https://x.com/${profile.data.username}`,
+					website: profile.data.url
+				}
+			};
+		},
+		async refreshAccessToken(params) {
+			invariant(this.tokenRefreshUri, "tokenRefreshUri is required");
+			const response = await refreshAccessToken({
+				...params,
+				tokenUri: this.tokenRefreshUri,
+				authentication: "basic"
+			});
+			if (!response.ok) {
+				const { error, error_description } = await response.json();
+				throw new OAuth2Error(response.status, error, error_description);
+			}
+			return await response.json();
+		},
+		async revokeToken(params) {
+			invariant(this.tokenRevokeUri, "tokenRevokeUri is required");
+			return revokeToken({
+				...params,
+				tokenRevokeUri: this.tokenRevokeUri,
+				authentication: "basic"
+			});
+		}
+	};
 }
-var x = createXProvider();
-export {
-  createXProvider,
-  x
-};
+const x = createXProvider();
+//#endregion
+export { createXProvider, x };
+
 //# sourceMappingURL=x.mjs.map

package/dist/oauth2/provider/x.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth2/provider/x.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { OAuth2Token, Provider } from '../types';\nimport {\n  createAuthorizationUri,\n  exchangeAuthorizationCode,\n  refreshAccessToken,\n  revokeToken,\n} from './common';\n\nexport interface XOptions {\n  userFields?: UserField[];\n}\n\nconst defaultUserFields = [\n  'id',\n  'name',\n  'profile_image_url',\n  'url',\n  'username',\n  'location',\n  'verified',\n];\n\nexport function createXProvider(options?: XOptions): Provider {\n  return {\n    authorizationUri: 'https://x.com/i/oauth2/authorize',\n    tokenUri: 'https://api.x.com/2/oauth2/token',\n    tokenRefreshUri: 'https://api.x.com/2/oauth2/token',\n    tokenRevokeUri: 'https://api.x.com/2/oauth2/revoke',\n    // https://docs.x.com/x-api/users/user-lookup-me\n    userInfoUri: 'https://api.x.com/2/users/me',\n    defaultScope: ['users.read', 'tweet.read', 'offline.access'],\n    createAuthorizationUri(params) {\n      if (!params.pkce) throw new Error('pkce is required for x');\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      if (!params.pkce) throw new Error('pkce is required for x');\n      const response = await exchangeAuthorizationCode({\n        ...params,\n        tokenUri: this.tokenUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XToken;\n    },\n    async getUserInfo({ access_token }) {\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n\n      const userFields = options?.userFields ?? defaultUserFields;\n      const headers = { Accept: 'application/json', Authorization: `Bearer ${access_token}` };\n\n      const url = new URL(this.userInfoUri);\n      userFields.forEach((field) => url.searchParams.append('user.fields', field));\n\n      const response = await fetch(this.userInfoUri, { headers });\n      if (!response.ok) {\n        const { errors } = (await response.json()) as XAPIErrorResponse;\n        throw new OAuth2Error(\n          response.status,\n          'invalid_request',\n          `Failed to fetch user info: ${errors.at(0)?.detail ?? errors.at(0)?.title}`\n        );\n      }\n      const profile = (await response.json()) as XUserInfo;\n      return {\n        data: profile,\n        claims: {\n          sub: profile.data.id,\n          name: profile.data.name,\n          picture: profile.data.profile_image_url,\n          email: profile.data.email,\n          email_verified: profile.data.verified || false,\n          preferred_username: profile.data.username,\n          profile: `https://x.com/${profile.data.username}`,\n          website: profile.data.url,\n        },\n      };\n    },\n    async refreshAccessToken(params) {\n      invariant(this.tokenRefreshUri, 'tokenRefreshUri is required');\n      const response = await refreshAccessToken({\n        ...params,\n        tokenUri: this.tokenRefreshUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XToken;\n    },\n    async revokeToken(params) {\n      invariant(this.tokenRevokeUri, 'tokenRevokeUri is required');\n      return revokeToken({\n        ...params,\n        tokenRevokeUri: this.tokenRevokeUri,\n        authentication: 'basic',\n      });\n    },\n  };\n}\n\nexport const x = createXProvider();\n\ntype UserField =\n  | 'affiliation'\n  | 'connection_status'\n  | 'created_at'\n  | 'description'\n  | 'entities'\n  | 'id'\n  | 'is_identity_verified'\n  | 'location'\n  | 'most_recent_tweet_id'\n  | 'name'\n  | 'parody'\n  | 'pinned_tweet_id'\n  | 'profile_banner_url'\n  | 'profile_image_url'\n  | 'protected'\n  | 'public_metrics'\n  | 'receives_your_dm'\n  | 'subscription'\n  | 'subscription_type'\n  | 'url'\n  | 'username'\n  | 'verified'\n  | 'verified_followers_count'\n  | 'verified_type'\n  | 'withheld';\n\nexport interface XUser {\n  id: string;\n  name: string;\n  email?: string;\n  username: string;\n  location?: string;\n  entities?: {\n    url: { urls: UrlEntity[] };\n    description: {\n      hashtags: HashtagEntity[];\n      cashtags: HashtagEntity[];\n      mentions: MentionEntity[];\n    };\n  };\n  verified?: boolean;\n  description?: string;\n  url?: string;\n  profile_image_url?: string;\n  protected?: boolean;\n  pinned_tweet_id?: string;\n  created_at?: string;\n}\n\nexport interface XUserInfo {\n  data: XUser;\n  includes?: { tweets?: { id: string; text: string }[]; users?: XUser[] };\n}\n\ntype UrlEntity = {\n  start: number;\n  end: number;\n  url: string;\n  display_url: string;\n  expanded_url: string;\n};\ntype HashtagEntity = { start: number; end: number; tag: string };\ntype MentionEntity = { start: number; end: string; username: string };\n\nexport interface XToken extends OAuth2Token {\n  token_type: string;\n  expires_in: number;\n  access_token: string;\n  scope: string;\n  refresh_token: string;\n}\n\ntype XErrorResponse = { error: string; error_description: string };\ntype XAPIErrorResponse = {\n  errors: { title: string; type: string; detail?: string; status?: number }[];\n};\n"],"mappings":";AAAA,SAAS,iBAAiB;AAC1B,SAAS,mBAAmB;AAE5B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP,IAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,gBAAgB,SAA8B;AAC5D,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,iBAAiB;AAAA,IACjB,gBAAgB;AAAA;AAAA,IAEhB,aAAa;AAAA,IACb,cAAc,CAAC,cAAc,cAAc,gBAAgB;AAAA,IAC3D,uBAAuB,QAAQ;AAC7B,UAAI,CAAC,OAAO,KAAM,OAAM,IAAI,MAAM,wBAAwB;AAC1D,aAAO,uBAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,QAAQ;AACtC,UAAI,CAAC,OAAO,KAAM,OAAM,IAAI,MAAM,wBAAwB;AAC1D,YAAM,WAAW,MAAM,0BAA0B;AAAA,QAC/C,GAAG;AAAA,QACH,UAAU,KAAK;AAAA,QACf,gBAAgB;AAAA,MAClB,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,aAAa,GAAG;AAClC,gBAAU,cAAc,0BAA0B;AAClD,gBAAU,KAAK,aAAa,yBAAyB;AAErD,YAAM,aAAa,SAAS,cAAc;AAC1C,YAAM,UAAU,EAAE,QAAQ,oBAAoB,eAAe,UAAU,YAAY,GAAG;AAEtF,YAAM,MAAM,IAAI,IAAI,KAAK,WAAW;AACpC,iBAAW,QAAQ,CAAC,UAAU,IAAI,aAAa,OAAO,eAAe,KAAK,CAAC;AAE3E,YAAM,WAAW,MAAM,MAAM,KAAK,aAAa,EAAE,QAAQ,CAAC;AAC1D,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,IAAK,MAAM,SAAS,KAAK;AACxC,cAAM,IAAI;AAAA,UACR,SAAS;AAAA,UACT;AAAA,UACA,8BAA8B,OAAO,GAAG,CAAC,GAAG,UAAU,OAAO,GAAG,CAAC,GAAG,KAAK;AAAA,QAC3E;AAAA,MACF;AACA,YAAM,UAAW,MAAM,SAAS,KAAK;AACrC,aAAO;AAAA,QACL,MAAM;AAAA,QACN,QAAQ;AAAA,UACN,KAAK,QAAQ,KAAK;AAAA,UAClB,MAAM,QAAQ,KAAK;AAAA,UACnB,SAAS,QAAQ,KAAK;AAAA,UACtB,OAAO,QAAQ,KAAK;AAAA,UACpB,gBAAgB,QAAQ,KAAK,YAAY;AAAA,UACzC,oBAAoB,QAAQ,KAAK;AAAA,UACjC,SAAS,iBAAiB,QAAQ,KAAK,QAAQ;AAAA,UAC/C,SAAS,QAAQ,KAAK;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,mBAAmB,QAAQ;AAC/B,gBAAU,KAAK,iBAAiB,6BAA6B;AAC7D,YAAM,WAAW,MAAM,mBAAmB;AAAA,QACxC,GAAG;AAAA,QACH,UAAU,KAAK;AAAA,QACf,gBAAgB;AAAA,MAClB,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,OAAO,kBAAkB,IAAK,MAAM,SAAS,KAAK;AAC1D,cAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;AAAA,MACjE;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,QAAQ;AACxB,gBAAU,KAAK,gBAAgB,4BAA4B;AAC3D,aAAO,YAAY;AAAA,QACjB,GAAG;AAAA,QACH,gBAAgB,KAAK;AAAA,QACrB,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEO,IAAM,IAAI,gBAAgB;","names":[]}
+{"version":3,"file":"x.mjs","names":[],"sources":["../../../src/oauth2/provider/x.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { OAuth2Token, Provider } from '../types';\nimport {\n  createAuthorizationUri,\n  exchangeAuthorizationCode,\n  refreshAccessToken,\n  revokeToken,\n} from './common';\n\nexport interface XOptions {\n  userFields?: UserField[];\n}\n\nconst defaultUserFields = [\n  'id',\n  'name',\n  'profile_image_url',\n  'url',\n  'username',\n  'location',\n  'verified',\n];\n\nexport function createXProvider(options?: XOptions): Provider {\n  return {\n    authorizationUri: 'https://x.com/i/oauth2/authorize',\n    tokenUri: 'https://api.x.com/2/oauth2/token',\n    tokenRefreshUri: 'https://api.x.com/2/oauth2/token',\n    tokenRevokeUri: 'https://api.x.com/2/oauth2/revoke',\n    // https://docs.x.com/x-api/users/user-lookup-me\n    userInfoUri: 'https://api.x.com/2/users/me',\n    defaultScope: ['users.read', 'tweet.read', 'offline.access'],\n    createAuthorizationUri(params) {\n      if (!params.pkce) throw new Error('pkce is required for x');\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      if (!params.pkce) throw new Error('pkce is required for x');\n      const response = await exchangeAuthorizationCode({\n        ...params,\n        tokenUri: this.tokenUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XToken;\n    },\n    async getUserInfo({ access_token }) {\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n\n      const userFields = options?.userFields ?? defaultUserFields;\n      const headers = { Accept: 'application/json', Authorization: `Bearer ${access_token}` };\n\n      const url = new URL(this.userInfoUri);\n      userFields.forEach((field) => url.searchParams.append('user.fields', field));\n\n      const response = await fetch(this.userInfoUri, { headers });\n      if (!response.ok) {\n        const { errors } = (await response.json()) as XAPIErrorResponse;\n        throw new OAuth2Error(\n          response.status,\n          'invalid_request',\n          `Failed to fetch user info: ${errors.at(0)?.detail ?? errors.at(0)?.title}`\n        );\n      }\n      const profile = (await response.json()) as XUserInfo;\n      return {\n        data: profile,\n        claims: {\n          sub: profile.data.id,\n          name: profile.data.name,\n          picture: profile.data.profile_image_url,\n          email: profile.data.email,\n          email_verified: profile.data.verified || false,\n          preferred_username: profile.data.username,\n          profile: `https://x.com/${profile.data.username}`,\n          website: profile.data.url,\n        },\n      };\n    },\n    async refreshAccessToken(params) {\n      invariant(this.tokenRefreshUri, 'tokenRefreshUri is required');\n      const response = await refreshAccessToken({\n        ...params,\n        tokenUri: this.tokenRefreshUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XToken;\n    },\n    async revokeToken(params) {\n      invariant(this.tokenRevokeUri, 'tokenRevokeUri is required');\n      return revokeToken({\n        ...params,\n        tokenRevokeUri: this.tokenRevokeUri,\n        authentication: 'basic',\n      });\n    },\n  };\n}\n\nexport const x = createXProvider();\n\ntype UserField =\n  | 'affiliation'\n  | 'connection_status'\n  | 'created_at'\n  | 'description'\n  | 'entities'\n  | 'id'\n  | 'is_identity_verified'\n  | 'location'\n  | 'most_recent_tweet_id'\n  | 'name'\n  | 'parody'\n  | 'pinned_tweet_id'\n  | 'profile_banner_url'\n  | 'profile_image_url'\n  | 'protected'\n  | 'public_metrics'\n  | 'receives_your_dm'\n  | 'subscription'\n  | 'subscription_type'\n  | 'url'\n  | 'username'\n  | 'verified'\n  | 'verified_followers_count'\n  | 'verified_type'\n  | 'withheld';\n\nexport interface XUser {\n  id: string;\n  name: string;\n  email?: string;\n  username: string;\n  location?: string;\n  entities?: {\n    url: { urls: UrlEntity[] };\n    description: {\n      hashtags: HashtagEntity[];\n      cashtags: HashtagEntity[];\n      mentions: MentionEntity[];\n    };\n  };\n  verified?: boolean;\n  description?: string;\n  url?: string;\n  profile_image_url?: string;\n  protected?: boolean;\n  pinned_tweet_id?: string;\n  created_at?: string;\n}\n\nexport interface XUserInfo {\n  data: XUser;\n  includes?: { tweets?: { id: string; text: string }[]; users?: XUser[] };\n}\n\ntype UrlEntity = {\n  start: number;\n  end: number;\n  url: string;\n  display_url: string;\n  expanded_url: string;\n};\ntype HashtagEntity = { start: number; end: number; tag: string };\ntype MentionEntity = { start: number; end: string; username: string };\n\nexport interface XToken extends OAuth2Token {\n  token_type: string;\n  expires_in: number;\n  access_token: string;\n  scope: string;\n  refresh_token: string;\n}\n\ntype XErrorResponse = { error: string; error_description: string };\ntype XAPIErrorResponse = {\n  errors: { title: string; type: string; detail?: string; status?: number }[];\n};\n"],"mappings":";;;;AAcA,MAAM,oBAAoB;CACxB;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,SAAgB,gBAAgB,SAA8B;CAC5D,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,iBAAiB;EACjB,gBAAgB;EAEhB,aAAa;EACb,cAAc;GAAC;GAAc;GAAc;EAAgB;EAC3D,uBAAuB,QAAQ;GAC7B,IAAI,CAAC,OAAO,MAAM,MAAM,IAAI,MAAM,wBAAwB;GAC1D,OAAO,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,QAAQ;GACtC,IAAI,CAAC,OAAO,MAAM,MAAM,IAAI,MAAM,wBAAwB;GAC1D,MAAM,WAAW,MAAM,0BAA0B;IAC/C,GAAG;IACH,UAAU,KAAK;IACf,gBAAgB;GAClB,CAAC;GACD,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,gBAAgB;GAClC,UAAU,cAAc,0BAA0B;GAClD,UAAU,KAAK,aAAa,yBAAyB;GAErD,MAAM,aAAa,SAAS,cAAc;GAC1C,MAAM,UAAU;IAAE,QAAQ;IAAoB,eAAe,UAAU;GAAe;GAEtF,MAAM,MAAM,IAAI,IAAI,KAAK,WAAW;GACpC,WAAW,SAAS,UAAU,IAAI,aAAa,OAAO,eAAe,KAAK,CAAC;GAE3E,MAAM,WAAW,MAAM,MAAM,KAAK,aAAa,EAAE,QAAQ,CAAC;GAC1D,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,WAAY,MAAM,SAAS,KAAK;IACxC,MAAM,IAAI,YACR,SAAS,QACT,mBACA,8BAA8B,OAAO,GAAG,CAAC,CAAC,EAAE,UAAU,OAAO,GAAG,CAAC,CAAC,EAAE,OACtE;GACF;GACA,MAAM,UAAW,MAAM,SAAS,KAAK;GACrC,OAAO;IACL,MAAM;IACN,QAAQ;KACN,KAAK,QAAQ,KAAK;KAClB,MAAM,QAAQ,KAAK;KACnB,SAAS,QAAQ,KAAK;KACtB,OAAO,QAAQ,KAAK;KACpB,gBAAgB,QAAQ,KAAK,YAAY;KACzC,oBAAoB,QAAQ,KAAK;KACjC,SAAS,iBAAiB,QAAQ,KAAK;KACvC,SAAS,QAAQ,KAAK;IACxB;GACF;EACF;EACA,MAAM,mBAAmB,QAAQ;GAC/B,UAAU,KAAK,iBAAiB,6BAA6B;GAC7D,MAAM,WAAW,MAAM,mBAAmB;IACxC,GAAG;IACH,UAAU,KAAK;IACf,gBAAgB;GAClB,CAAC;GACD,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,QAAQ;GACxB,UAAU,KAAK,gBAAgB,4BAA4B;GAC3D,OAAO,YAAY;IACjB,GAAG;IACH,gBAAgB,KAAK;IACrB,gBAAgB;GAClB,CAAC;EACH;CACF;AACF;AAEA,MAAa,IAAI,gBAAgB"}

package/dist/oauth2/types.cjs

@@ -1,39 +1,15 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/oauth2/types.ts
+let OidcScopes = /* @__PURE__ */ function(OidcScopes) {
+	OidcScopes["openid"] = "openid";
+	OidcScopes["profile"] = "profile";
+	OidcScopes["email"] = "email";
+	OidcScopes["phone"] = "phone";
+	OidcScopes["address"] = "address";
+	OidcScopes["offline_access"] = "offline_access";
+	return OidcScopes;
+}({});
+//#endregion
+exports.OidcScopes = OidcScopes;
 
-// src/oauth2/types.ts
-var types_exports = {};
-__export(types_exports, {
-  OidcScopes: () => OidcScopes
-});
-module.exports = __toCommonJS(types_exports);
-var OidcScopes = /* @__PURE__ */ ((OidcScopes2) => {
-  OidcScopes2["openid"] = "openid";
-  OidcScopes2["profile"] = "profile";
-  OidcScopes2["email"] = "email";
-  OidcScopes2["phone"] = "phone";
-  OidcScopes2["address"] = "address";
-  OidcScopes2["offline_access"] = "offline_access";
-  return OidcScopes2;
-})(OidcScopes || {});
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  OidcScopes
-});
 //# sourceMappingURL=types.cjs.map

package/dist/oauth2/types.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/oauth2/types.ts"],"sourcesContent":["// reference: https://datatracker.ietf.org/doc/html/rfc7636\nexport interface PkceParameters {\n  code_verifier: string;\n  code_challenge: string;\n  code_challenge_method: 'S256' | 'plain';\n}\n\nexport interface OAuth2AuthorizationRequest {\n  state: string;\n  registrationId: string;\n  authorizationRequestUri: string;\n  additionalParameters: PkceParameters;\n}\n\ninterface CreateAuthorizationUriParams {\n  state: string;\n  clientId: string;\n  redirectUri: string;\n  scope: string[] | undefined;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n}\n\nexport interface ExchangeCodeParams {\n  code: string;\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  pkce?: Omit<PkceParameters, 'code_challenge' | 'code_challenge_method'>;\n}\n\nexport interface RefreshTokenParams {\n  clientId: string;\n  clientSecret: string;\n  refreshToken: string;\n}\n\nexport interface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret: string;\n}\n\nexport interface LoginOAuth2NativeParams {\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  pkce?: PkceParameters;\n  credentials: NativeCredential;\n}\n\n// reference: https://datatracker.ietf.org/doc/html/rfc6749#section-5.1\nexport interface OAuth2Token {\n  /**\n   * REQUIRED.\n   * The access token issued by the authorization server.\n   */\n  access_token: string;\n\n  /**\n   * REQUIRED.\n   * The type of the token issued as described in Section 7.1.  Value is case insensitive.\n   */\n  token_type: 'Bearer' | 'bearer' | 'mac' | (string & {});\n\n  /**\n   * RECOMMENDED.\n   * The lifetime in seconds of the access token. For example, the value \"3600\" denotes that the\n   * access token will expire in one hour from the time the response was generated. If omitted, the\n   * authorization server SHOULD provide the expiration time via other means or document the default\n   * value.\n   */\n  expires_in?: number;\n\n  /**\n   * OPTIONAL.\n   * The refresh token, which can be used to obtain new access tokens using the same authorization\n   * grant as described in Section 6.\n   */\n  refresh_token?: string;\n\n  /**\n   * OPTIONAL.\n   * If identical to the scope requested by the client; otherwise, REQUIRED. The scope of the\n   * access token as described by Section 3.3.\n   */\n  scope?: string;\n\n  id_token?: string;\n\n  [key: string]: unknown;\n}\n\nexport interface OidcToken extends OAuth2Token {\n  id_token: string;\n}\n\nexport type NativeCredential = {\n  state?: string;\n  code?: string;\n  client_id?: string;\n  redirect_uri?: string;\n  id_token?: string;\n  access_token?: string;\n};\n\nexport enum OidcScopes {\n  openid = 'openid',\n  profile = 'profile',\n  email = 'email',\n  phone = 'phone',\n  address = 'address',\n  offline_access = 'offline_access',\n}\n\n// https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims\nexport interface StandardClaims {\n  sub: string;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  middle_name?: string;\n  nickname?: string;\n  preferred_username?: string;\n  profile?: string;\n  picture?: string;\n  website?: string;\n  email?: string;\n  email_verified?: boolean;\n  gender?: 'female' | 'male' | (string & {});\n  birthdate?: string; // ISO 8601-1 [ISO8601‑1] YYYY-MM-DD format.\n  zoneinfo?: string; // IANA Time Zone Database [IANA.time‑zones]\n  locale?: string; // BCP47 [RFC5646] language tag.\n  phone_number?: string; // E.164\n  phone_number_verified?: boolean;\n  address?: {\n    formatted: string;\n    street_address: string;\n    locality: string;\n    region: string;\n    postal_code: string;\n    country: string;\n  }; // [RFC8259] JSON object\n  updated_at?: number;\n}\n\nexport interface UserInfo<T = unknown> {\n  claims: StandardClaims;\n  data: T;\n}\n\nexport interface Provider {\n  /** Authorization URI for the provider. */\n  authorizationUri: string;\n\n  /** Token URI for the provider. */\n  tokenUri: string;\n\n  /** Token revoke URI for the provider. */\n  tokenRevokeUri?: string;\n\n  /** Token refresh URI for the provider. */\n  tokenRefreshUri?: string;\n\n  /** User info URI for the provider. */\n  userInfoUri?: string;\n\n  /** User info authentication method for the provider. */\n  userInfoAuthenticationMethod?: string;\n\n  /**\n   * Name of the attribute that will be used to extract the username from the call to 'userInfoUri'.\n   * */\n  userNameAttribute?: string;\n\n  /** JWK set URI for the provider */\n  jwkSetUri?: string;\n\n  /**\n   * URI that can either be an OpenID Connect discovery endpoint or an OAuth 2.0 Authorization\n   * Server Metadata endpoint defined by RFC 8414.\n   * */\n  issuerUri?: string;\n\n  /** Default scopes for the provider. */\n  defaultScope: string[];\n\n  /** step 1: generate authorization uri and redirect user to it */\n  createAuthorizationUri: (params: CreateAuthorizationUriParams) => URL;\n\n  /** step 2: exchange code for token */\n  exchangeAuthorizationCode: (params: ExchangeCodeParams) => Promise<OAuth2Token>;\n\n  /** step 3: get user info */\n  getUserInfo: (token: OAuth2Token) => Promise<UserInfo>;\n\n  /** others: refresh access token */\n  refreshAccessToken?: (params: RefreshTokenParams) => Promise<OAuth2Token>;\n\n  /** others: revoke token */\n  revokeToken?: (params: RevokeTokenParams) => Promise<void>;\n\n  loginOAuth2Native?: (\n    params: LoginOAuth2NativeParams\n  ) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface OneTapProvider extends Provider {\n  getTokenInfo: (id_token: string) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface Registration {\n  /**\n   * Reference to the OAuth 2.0 provider to use. May reference an element from the 'provider'\n   * property or used one of the commonly used providers (google, github, facebook, okta).\n   * */\n  provider?: string;\n\n  /** Client ID for the registration. */\n  clientId: string;\n\n  /** Client secret of the registration. */\n  clientSecret: string;\n\n  /** Client authentication method. May be left blank when using a pre-defined provider. */\n  clientAuthenticationMethod?: string;\n\n  /** Authorization grant type. May be left blank when using a pre-defined provider. */\n  authorizationGrantType?:\n    | 'authorization_code' // default\n    | 'client_credentials'\n    | 'device_code'\n    | 'jwt_bearer'\n    // Deprecated. The latest OAuth 2.0 Security Best Current Practice disallows the use of the\n    // Resource Owner Password Credentials grant.\n    | 'password'\n    | 'refresh_token'\n    | 'token_exchange';\n\n  /** Redirect URI. May be left blank when using a pre-defined provider. */\n  redirectUri?: string;\n\n  /** Authorization scopes. When left blank the provider's default scopes, if any, will be used. */\n  scope?: string[];\n\n  /** Client name. May be left blank when using a pre-defined provider. */\n  clientName?: string;\n}\n\nexport interface OAuth2ClientConfig {\n  baseUri: string;\n  errorUri: string;\n  successUri: string;\n  provider: { [name: string]: Provider | undefined };\n  registration:\n    | { [name: string]: Registration | undefined }\n    | (() => Promise<{ [name: string]: Registration | undefined }>);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAyGO,IAAK,aAAL,kBAAKA,gBAAL;AACL,EAAAA,YAAA,YAAS;AACT,EAAAA,YAAA,aAAU;AACV,EAAAA,YAAA,WAAQ;AACR,EAAAA,YAAA,WAAQ;AACR,EAAAA,YAAA,aAAU;AACV,EAAAA,YAAA,oBAAiB;AANP,SAAAA;AAAA,GAAA;","names":["OidcScopes"]}
+{"version":3,"file":"types.cjs","names":[],"sources":["../../src/oauth2/types.ts"],"sourcesContent":["// reference: https://datatracker.ietf.org/doc/html/rfc7636\nexport interface PkceParameters {\n  code_verifier: string;\n  code_challenge: string;\n  code_challenge_method: 'S256' | 'plain';\n}\n\nexport interface OAuth2AuthorizationRequest {\n  state: string;\n  registrationId: string;\n  authorizationRequestUri: string;\n  additionalParameters: PkceParameters;\n}\n\ninterface CreateAuthorizationUriParams {\n  state: string;\n  clientId: string;\n  redirectUri: string;\n  scope: string[] | undefined;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n}\n\nexport interface ExchangeCodeParams {\n  code: string;\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  pkce?: Omit<PkceParameters, 'code_challenge' | 'code_challenge_method'>;\n}\n\nexport interface RefreshTokenParams {\n  clientId: string;\n  clientSecret: string;\n  refreshToken: string;\n}\n\nexport interface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret: string;\n}\n\nexport interface LoginOAuth2NativeParams {\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  pkce?: PkceParameters;\n  credentials: NativeCredential;\n}\n\n// reference: https://datatracker.ietf.org/doc/html/rfc6749#section-5.1\nexport interface OAuth2Token {\n  /**\n   * REQUIRED.\n   * The access token issued by the authorization server.\n   */\n  access_token: string;\n\n  /**\n   * REQUIRED.\n   * The type of the token issued as described in Section 7.1.  Value is case insensitive.\n   */\n  token_type: 'Bearer' | 'bearer' | 'mac' | (string & {});\n\n  /**\n   * RECOMMENDED.\n   * The lifetime in seconds of the access token. For example, the value \"3600\" denotes that the\n   * access token will expire in one hour from the time the response was generated. If omitted, the\n   * authorization server SHOULD provide the expiration time via other means or document the default\n   * value.\n   */\n  expires_in?: number;\n\n  /**\n   * OPTIONAL.\n   * The refresh token, which can be used to obtain new access tokens using the same authorization\n   * grant as described in Section 6.\n   */\n  refresh_token?: string;\n\n  /**\n   * OPTIONAL.\n   * If identical to the scope requested by the client; otherwise, REQUIRED. The scope of the\n   * access token as described by Section 3.3.\n   */\n  scope?: string;\n\n  id_token?: string;\n\n  [key: string]: unknown;\n}\n\nexport interface OidcToken extends OAuth2Token {\n  id_token: string;\n}\n\nexport type NativeCredential = {\n  state?: string;\n  code?: string;\n  client_id?: string;\n  redirect_uri?: string;\n  id_token?: string;\n  access_token?: string;\n};\n\nexport enum OidcScopes {\n  openid = 'openid',\n  profile = 'profile',\n  email = 'email',\n  phone = 'phone',\n  address = 'address',\n  offline_access = 'offline_access',\n}\n\n// https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims\nexport interface StandardClaims {\n  sub: string;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  middle_name?: string;\n  nickname?: string;\n  preferred_username?: string;\n  profile?: string;\n  picture?: string;\n  website?: string;\n  email?: string;\n  email_verified?: boolean;\n  gender?: 'female' | 'male' | (string & {});\n  birthdate?: string; // ISO 8601-1 [ISO8601‑1] YYYY-MM-DD format.\n  zoneinfo?: string; // IANA Time Zone Database [IANA.time‑zones]\n  locale?: string; // BCP47 [RFC5646] language tag.\n  phone_number?: string; // E.164\n  phone_number_verified?: boolean;\n  address?: {\n    formatted: string;\n    street_address: string;\n    locality: string;\n    region: string;\n    postal_code: string;\n    country: string;\n  }; // [RFC8259] JSON object\n  updated_at?: number;\n}\n\nexport interface UserInfo<T = unknown> {\n  claims: StandardClaims;\n  data: T;\n}\n\nexport interface Provider {\n  /** Authorization URI for the provider. */\n  authorizationUri: string;\n\n  /** Token URI for the provider. */\n  tokenUri: string;\n\n  /** Token revoke URI for the provider. */\n  tokenRevokeUri?: string;\n\n  /** Token refresh URI for the provider. */\n  tokenRefreshUri?: string;\n\n  /** User info URI for the provider. */\n  userInfoUri?: string;\n\n  /** User info authentication method for the provider. */\n  userInfoAuthenticationMethod?: string;\n\n  /**\n   * Name of the attribute that will be used to extract the username from the call to 'userInfoUri'.\n   * */\n  userNameAttribute?: string;\n\n  /** JWK set URI for the provider */\n  jwkSetUri?: string;\n\n  /**\n   * URI that can either be an OpenID Connect discovery endpoint or an OAuth 2.0 Authorization\n   * Server Metadata endpoint defined by RFC 8414.\n   * */\n  issuerUri?: string;\n\n  /** Default scopes for the provider. */\n  defaultScope: string[];\n\n  /** step 1: generate authorization uri and redirect user to it */\n  createAuthorizationUri: (params: CreateAuthorizationUriParams) => URL;\n\n  /** step 2: exchange code for token */\n  exchangeAuthorizationCode: (params: ExchangeCodeParams) => Promise<OAuth2Token>;\n\n  /** step 3: get user info */\n  getUserInfo: (token: OAuth2Token) => Promise<UserInfo>;\n\n  /** others: refresh access token */\n  refreshAccessToken?: (params: RefreshTokenParams) => Promise<OAuth2Token>;\n\n  /** others: revoke token */\n  revokeToken?: (params: RevokeTokenParams) => Promise<void>;\n\n  loginOAuth2Native?: (\n    params: LoginOAuth2NativeParams\n  ) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface OneTapProvider extends Provider {\n  getTokenInfo: (id_token: string) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface Registration {\n  /**\n   * Reference to the OAuth 2.0 provider to use. May reference an element from the 'provider'\n   * property or used one of the commonly used providers (google, github, facebook, okta).\n   * */\n  provider?: string;\n\n  /** Client ID for the registration. */\n  clientId: string;\n\n  /** Client secret of the registration. */\n  clientSecret: string;\n\n  /** Client authentication method. May be left blank when using a pre-defined provider. */\n  clientAuthenticationMethod?: string;\n\n  /** Authorization grant type. May be left blank when using a pre-defined provider. */\n  authorizationGrantType?:\n    | 'authorization_code' // default\n    | 'client_credentials'\n    | 'device_code'\n    | 'jwt_bearer'\n    // Deprecated. The latest OAuth 2.0 Security Best Current Practice disallows the use of the\n    // Resource Owner Password Credentials grant.\n    | 'password'\n    | 'refresh_token'\n    | 'token_exchange';\n\n  /** Redirect URI. May be left blank when using a pre-defined provider. */\n  redirectUri?: string;\n\n  /** Authorization scopes. When left blank the provider's default scopes, if any, will be used. */\n  scope?: string[];\n\n  /** Client name. May be left blank when using a pre-defined provider. */\n  clientName?: string;\n}\n\nexport interface OAuth2ClientConfig {\n  baseUri: string;\n  errorUri: string;\n  successUri: string;\n  provider: { [name: string]: Provider | undefined };\n  registration:\n    | { [name: string]: Registration | undefined }\n    | (() => Promise<{ [name: string]: Registration | undefined }>);\n}\n"],"mappings":";;AAyGA,IAAY,aAAL,yBAAA,YAAA;CACL,WAAA,YAAA;CACA,WAAA,aAAA;CACA,WAAA,WAAA;CACA,WAAA,WAAA;CACA,WAAA,aAAA;CACA,WAAA,oBAAA;;AACF,EAAA,CAAA,CAAA"}