@shware/security 2.5.3 → 3.0.0

package/dist/oauth2/error.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/oauth2/error.ts"],"sourcesContent":["// reference: https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.2.1\nexport type OAuth2ErrorType =\n  | 'invalid_request' // 400\n  | 'invalid_client' // 401\n  | 'invalid_grant' // 400\n  | 'invalid_token' // 401\n  | 'invalid_scope' // 400\n  | 'unauthorized_client' // 401\n  | 'unsupported_grant_type' // 400\n  | 'unsupported_response_type' // 400\n  | 'insufficient_scope' // 403\n  | 'redirect_uri_mismatch' // 400\n  | 'access_denied' // 400\n  | 'server_error' // 500\n  | 'temporarily_unavailable' // 503\n  | (string & {});\n\nexport class OAuth2Error extends Error {\n  readonly status: number;\n  readonly error: OAuth2ErrorType;\n\n  constructor(status: number, error: OAuth2ErrorType, message?: string) {\n    super(message ?? `OAuth2 error: ${error}`);\n    this.status = status;\n    this.error = error;\n    Object.setPrototypeOf(this, OAuth2Error.prototype);\n  }\n}\n\nexport class AuthenticationError extends Error {\n  constructor(message: string) {\n    super(message);\n    Object.setPrototypeOf(this, AuthenticationError.prototype);\n  }\n}\n"],"mappings":";AAiBO,IAAM,cAAN,MAAM,qBAAoB,MAAM;AAAA,EAC5B;AAAA,EACA;AAAA,EAET,YAAY,QAAgB,OAAwB,SAAkB;AACpE,UAAM,WAAW,iBAAiB,KAAK,EAAE;AACzC,SAAK,SAAS;AACd,SAAK,QAAQ;AACb,WAAO,eAAe,MAAM,aAAY,SAAS;AAAA,EACnD;AACF;AAEO,IAAM,sBAAN,MAAM,6BAA4B,MAAM;AAAA,EAC7C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,WAAO,eAAe,MAAM,qBAAoB,SAAS;AAAA,EAC3D;AACF;","names":[]}
+{"version":3,"file":"error.mjs","names":[],"sources":["../../src/oauth2/error.ts"],"sourcesContent":["// reference: https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.2.1\nexport type OAuth2ErrorType =\n  | 'invalid_request' // 400\n  | 'invalid_client' // 401\n  | 'invalid_grant' // 400\n  | 'invalid_token' // 401\n  | 'invalid_scope' // 400\n  | 'unauthorized_client' // 401\n  | 'unsupported_grant_type' // 400\n  | 'unsupported_response_type' // 400\n  | 'insufficient_scope' // 403\n  | 'redirect_uri_mismatch' // 400\n  | 'access_denied' // 400\n  | 'server_error' // 500\n  | 'temporarily_unavailable' // 503\n  | (string & {});\n\nexport class OAuth2Error extends Error {\n  readonly status: number;\n  readonly error: OAuth2ErrorType;\n\n  constructor(status: number, error: OAuth2ErrorType, message?: string) {\n    super(message ?? `OAuth2 error: ${error}`);\n    this.status = status;\n    this.error = error;\n    Object.setPrototypeOf(this, OAuth2Error.prototype);\n  }\n}\n\nexport class AuthenticationError extends Error {\n  constructor(message: string) {\n    super(message);\n    Object.setPrototypeOf(this, AuthenticationError.prototype);\n  }\n}\n"],"mappings":";AAiBA,IAAa,cAAb,MAAa,oBAAoB,MAAM;CACrC;CACA;CAEA,YAAY,QAAgB,OAAwB,SAAkB;EACpE,MAAM,WAAW,iBAAiB,OAAO;EACzC,KAAK,SAAS;EACd,KAAK,QAAQ;EACb,OAAO,eAAe,MAAM,YAAY,SAAS;CACnD;AACF;AAEA,IAAa,sBAAb,MAAa,4BAA4B,MAAM;CAC7C,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,OAAO,eAAe,MAAM,oBAAoB,SAAS;CAC3D;AACF"}

package/dist/oauth2/provider/apple.cjs

@@ -1,91 +1,78 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/oauth2/provider/apple.ts
-var apple_exports = {};
-__export(apple_exports, {
-  apple: () => apple,
-  createAppleProvider: () => createAppleProvider
-});
-module.exports = __toCommonJS(apple_exports);
-var import_utils = require("@shware/utils");
-var import_error = require("../error.cjs");
-var import_common = require("./common.cjs");
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_oauth2_error = require("../error.cjs");
+const require_oauth2_provider_common = require("./common.cjs");
+let _shware_utils = require("@shware/utils");
+//#region src/oauth2/provider/apple.ts
 function createAppleProvider() {
-  return {
-    // important notice: response_mode=form_post is required for apple
-    authorizationUri: "https://appleid.apple.com/auth/authorize?response_mode=form_post",
-    tokenUri: "https://appleid.apple.com/auth/token",
-    jwkSetUri: "https://appleid.apple.com/auth/keys",
-    userNameAttribute: "sub",
-    defaultScope: ["openid", "name", "email"],
-    createAuthorizationUri({ pkce: _, ...params }) {
-      return (0, import_common.createAuthorizationUri)({
-        ...params,
-        scope: params.scope ?? this.defaultScope,
-        authorizationUri: this.authorizationUri
-      });
-    },
-    async exchangeAuthorizationCode({ pkce: _, ...params }) {
-      const response = await (0, import_common.exchangeAuthorizationCode)({ ...params, tokenUri: this.tokenUri });
-      if (!response.ok) {
-        const { error } = await response.json();
-        throw new import_error.OAuth2Error(response.status, error);
-      }
-      return await response.json();
-    },
-    async getUserInfo({ id_token }) {
-      (0, import_utils.invariant)(id_token, "id_token is required");
-      (0, import_utils.invariant)(this.jwkSetUri, "jwkSetUri is required");
-      const data = await (0, import_common.verifyIdToken)(id_token, this.jwkSetUri);
-      return {
-        data,
-        claims: {
-          sub: data.sub,
-          name: data.name,
-          email: data.email,
-          email_verified: true,
-          picture: data.picture,
-          given_name: data.user?.name.firstName,
-          family_name: data.user?.name.lastName
-        }
-      };
-    },
-    async loginOAuth2Native({ pkce: _, credentials, ...params }) {
-      (0, import_utils.invariant)(credentials.code, "code is required");
-      const { tokenUri } = this;
-      const { code } = credentials;
-      const response = await (0, import_common.exchangeAuthorizationCode)({ code, tokenUri, ...params });
-      if (!response.ok) {
-        const { error } = await response.json();
-        throw new import_error.OAuth2Error(response.status, error);
-      }
-      const token = await response.json();
-      const userInfo = await this.getUserInfo(token);
-      return { token, userInfo };
-    }
-  };
+	return {
+		authorizationUri: "https://appleid.apple.com/auth/authorize?response_mode=form_post",
+		tokenUri: "https://appleid.apple.com/auth/token",
+		jwkSetUri: "https://appleid.apple.com/auth/keys",
+		userNameAttribute: "sub",
+		defaultScope: [
+			"openid",
+			"name",
+			"email"
+		],
+		createAuthorizationUri({ pkce: _, ...params }) {
+			return require_oauth2_provider_common.createAuthorizationUri({
+				...params,
+				scope: params.scope ?? this.defaultScope,
+				authorizationUri: this.authorizationUri
+			});
+		},
+		async exchangeAuthorizationCode({ pkce: _, ...params }) {
+			const response = await require_oauth2_provider_common.exchangeAuthorizationCode({
+				...params,
+				tokenUri: this.tokenUri
+			});
+			if (!response.ok) {
+				const { error } = await response.json();
+				throw new require_oauth2_error.OAuth2Error(response.status, error);
+			}
+			return await response.json();
+		},
+		async getUserInfo({ id_token }) {
+			(0, _shware_utils.invariant)(id_token, "id_token is required");
+			(0, _shware_utils.invariant)(this.jwkSetUri, "jwkSetUri is required");
+			const data = await require_oauth2_provider_common.verifyIdToken(id_token, this.jwkSetUri);
+			return {
+				data,
+				claims: {
+					sub: data.sub,
+					name: data.name,
+					email: data.email,
+					email_verified: true,
+					picture: data.picture,
+					given_name: data.user?.name.firstName,
+					family_name: data.user?.name.lastName
+				}
+			};
+		},
+		async loginOAuth2Native({ pkce: _, credentials, ...params }) {
+			(0, _shware_utils.invariant)(credentials.code, "code is required");
+			const { tokenUri } = this;
+			const { code } = credentials;
+			const response = await require_oauth2_provider_common.exchangeAuthorizationCode({
+				code,
+				tokenUri,
+				...params
+			});
+			if (!response.ok) {
+				const { error } = await response.json();
+				throw new require_oauth2_error.OAuth2Error(response.status, error);
+			}
+			const token = await response.json();
+			return {
+				token,
+				userInfo: await this.getUserInfo(token)
+			};
+		}
+	};
 }
-var apple = createAppleProvider();
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  apple,
-  createAppleProvider
-});
+const apple = createAppleProvider();
+//#endregion
+exports.apple = apple;
+exports.createAppleProvider = createAppleProvider;
+
 //# sourceMappingURL=apple.cjs.map

package/dist/oauth2/provider/apple.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth2/provider/apple.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { LoginOAuth2NativeParams, NativeCredential, OAuth2Token, Provider } from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n// ref: https://account.apple.com/.well-known/openid-configuration\nexport function createAppleProvider(): Provider {\n  return {\n    // important notice: response_mode=form_post is required for apple\n    authorizationUri: 'https://appleid.apple.com/auth/authorize?response_mode=form_post',\n    tokenUri: 'https://appleid.apple.com/auth/token',\n    jwkSetUri: 'https://appleid.apple.com/auth/keys',\n    userNameAttribute: 'sub',\n    defaultScope: ['openid', 'name', 'email'],\n    createAuthorizationUri({ pkce: _, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce: _, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      return (await response.json()) as AppleToken;\n    },\n    async getUserInfo({ id_token }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<AppleUserInfo>(id_token, this.jwkSetUri);\n      return {\n        data,\n        claims: {\n          sub: data.sub,\n          name: data.name,\n          email: data.email,\n          email_verified: true,\n          picture: data.picture,\n          given_name: data.user?.name.firstName,\n          family_name: data.user?.name.lastName,\n        },\n      };\n    },\n    async loginOAuth2Native({ pkce: _, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { tokenUri } = this;\n      const { code } = credentials;\n      const response = await exchangeAuthorizationCode({ code, tokenUri, ...params });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      const token = (await response.json()) as AppleToken;\n      const userInfo = await this.getUserInfo(token);\n      return { token, userInfo };\n    },\n  };\n}\n\nexport const apple = createAppleProvider();\n\n// https://developer.apple.com/documentation/sign_in_with_apple/authenticating-users-with-sign-in-with-apple\nexport interface AppleUserInfo {\n  sub: string;\n  email: string;\n  email_verified: true | 'true';\n  is_private_email: boolean;\n  real_user_status: number;\n  name: string;\n  picture: string;\n  user?: {\n    name: { firstName: string; lastName: string };\n    email: string;\n  };\n  nonce?: string;\n  nonce_supported?: boolean;\n}\n\n// https://developer.apple.com/documentation/devicemanagement/implementing-the-oauth2-authentication-user-enrollment-flow\n// https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens\nexport interface AppleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n}\n\nexport interface AppleNativeCredential extends NativeCredential {\n  state: string;\n  code: string;\n  id_token: string;\n  // no standard fields\n  user: string;\n  email?: string;\n}\n\n// https://developer.apple.com/documentation/sign_in_with_apple/errorresponse\nexport interface AppleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'invalid_scope';\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAA0B;AAC1B,mBAA4B;AAE5B,oBAAiF;AAG1E,SAAS,sBAAgC;AAC9C,SAAO;AAAA;AAAA,IAEL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,WAAW;AAAA,IACX,mBAAmB;AAAA,IACnB,cAAc,CAAC,UAAU,QAAQ,OAAO;AAAA,IACxC,uBAAuB,EAAE,MAAM,GAAG,GAAG,OAAO,GAAG;AAC7C,iBAAO,sCAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,GAAG,OAAO,GAAG;AACtD,YAAM,WAAW,UAAM,yCAA0B,EAAE,GAAG,QAAQ,UAAU,KAAK,SAAS,CAAC;AACvF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,MAAM,IAAK,MAAM,SAAS,KAAK;AACvC,cAAM,IAAI,yBAAY,SAAS,QAAQ,KAAK;AAAA,MAC9C;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,SAAS,GAAG;AAC9B,kCAAU,UAAU,sBAAsB;AAC1C,kCAAU,KAAK,WAAW,uBAAuB;AACjD,YAAM,OAAO,UAAM,6BAA6B,UAAU,KAAK,SAAS;AACxE,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,UACN,KAAK,KAAK;AAAA,UACV,MAAM,KAAK;AAAA,UACX,OAAO,KAAK;AAAA,UACZ,gBAAgB;AAAA,UAChB,SAAS,KAAK;AAAA,UACd,YAAY,KAAK,MAAM,KAAK;AAAA,UAC5B,aAAa,KAAK,MAAM,KAAK;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,kBAAkB,EAAE,MAAM,GAAG,aAAa,GAAG,OAAO,GAA4B;AACpF,kCAAU,YAAY,MAAM,kBAAkB;AAC9C,YAAM,EAAE,SAAS,IAAI;AACrB,YAAM,EAAE,KAAK,IAAI;AACjB,YAAM,WAAW,UAAM,yCAA0B,EAAE,MAAM,UAAU,GAAG,OAAO,CAAC;AAC9E,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,MAAM,IAAK,MAAM,SAAS,KAAK;AACvC,cAAM,IAAI,yBAAY,SAAS,QAAQ,KAAK;AAAA,MAC9C;AACA,YAAM,QAAS,MAAM,SAAS,KAAK;AACnC,YAAM,WAAW,MAAM,KAAK,YAAY,KAAK;AAC7C,aAAO,EAAE,OAAO,SAAS;AAAA,IAC3B;AAAA,EACF;AACF;AAEO,IAAM,QAAQ,oBAAoB;","names":[]}
+{"version":3,"file":"apple.cjs","names":["createAuthorizationUri","exchangeAuthorizationCode","OAuth2Error","verifyIdToken"],"sources":["../../../src/oauth2/provider/apple.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { LoginOAuth2NativeParams, NativeCredential, OAuth2Token, Provider } from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n// ref: https://account.apple.com/.well-known/openid-configuration\nexport function createAppleProvider(): Provider {\n  return {\n    // important notice: response_mode=form_post is required for apple\n    authorizationUri: 'https://appleid.apple.com/auth/authorize?response_mode=form_post',\n    tokenUri: 'https://appleid.apple.com/auth/token',\n    jwkSetUri: 'https://appleid.apple.com/auth/keys',\n    userNameAttribute: 'sub',\n    defaultScope: ['openid', 'name', 'email'],\n    createAuthorizationUri({ pkce: _, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce: _, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      return (await response.json()) as AppleToken;\n    },\n    async getUserInfo({ id_token }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<AppleUserInfo>(id_token, this.jwkSetUri);\n      return {\n        data,\n        claims: {\n          sub: data.sub,\n          name: data.name,\n          email: data.email,\n          email_verified: true,\n          picture: data.picture,\n          given_name: data.user?.name.firstName,\n          family_name: data.user?.name.lastName,\n        },\n      };\n    },\n    async loginOAuth2Native({ pkce: _, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { tokenUri } = this;\n      const { code } = credentials;\n      const response = await exchangeAuthorizationCode({ code, tokenUri, ...params });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      const token = (await response.json()) as AppleToken;\n      const userInfo = await this.getUserInfo(token);\n      return { token, userInfo };\n    },\n  };\n}\n\nexport const apple = createAppleProvider();\n\n// https://developer.apple.com/documentation/sign_in_with_apple/authenticating-users-with-sign-in-with-apple\nexport interface AppleUserInfo {\n  sub: string;\n  email: string;\n  email_verified: true | 'true';\n  is_private_email: boolean;\n  real_user_status: number;\n  name: string;\n  picture: string;\n  user?: {\n    name: { firstName: string; lastName: string };\n    email: string;\n  };\n  nonce?: string;\n  nonce_supported?: boolean;\n}\n\n// https://developer.apple.com/documentation/devicemanagement/implementing-the-oauth2-authentication-user-enrollment-flow\n// https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens\nexport interface AppleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n}\n\nexport interface AppleNativeCredential extends NativeCredential {\n  state: string;\n  code: string;\n  id_token: string;\n  // no standard fields\n  user: string;\n  email?: string;\n}\n\n// https://developer.apple.com/documentation/sign_in_with_apple/errorresponse\nexport interface AppleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'invalid_scope';\n}\n"],"mappings":";;;;;AAMA,SAAgB,sBAAgC;CAC9C,OAAO;EAEL,kBAAkB;EAClB,UAAU;EACV,WAAW;EACX,mBAAmB;EACnB,cAAc;GAAC;GAAU;GAAQ;EAAO;EACxC,uBAAuB,EAAE,MAAM,GAAG,GAAG,UAAU;GAC7C,OAAOA,+BAAAA,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,GAAG,UAAU;GACtD,MAAM,WAAW,MAAMC,+BAAAA,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,UAAW,MAAM,SAAS,KAAK;IACvC,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,KAAK;GAC9C;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,YAAY;GAC9B,CAAA,GAAA,cAAA,UAAA,CAAU,UAAU,sBAAsB;GAC1C,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,WAAW,uBAAuB;GACjD,MAAM,OAAO,MAAMC,+BAAAA,cAA6B,UAAU,KAAK,SAAS;GACxE,OAAO;IACL;IACA,QAAQ;KACN,KAAK,KAAK;KACV,MAAM,KAAK;KACX,OAAO,KAAK;KACZ,gBAAgB;KAChB,SAAS,KAAK;KACd,YAAY,KAAK,MAAM,KAAK;KAC5B,aAAa,KAAK,MAAM,KAAK;IAC/B;GACF;EACF;EACA,MAAM,kBAAkB,EAAE,MAAM,GAAG,aAAa,GAAG,UAAmC;GACpF,CAAA,GAAA,cAAA,UAAA,CAAU,YAAY,MAAM,kBAAkB;GAC9C,MAAM,EAAE,aAAa;GACrB,MAAM,EAAE,SAAS;GACjB,MAAM,WAAW,MAAMF,+BAAAA,0BAA0B;IAAE;IAAM;IAAU,GAAG;GAAO,CAAC;GAC9E,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,UAAW,MAAM,SAAS,KAAK;IACvC,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,KAAK;GAC9C;GACA,MAAM,QAAS,MAAM,SAAS,KAAK;GAEnC,OAAO;IAAE;IAAO,UAAA,MADO,KAAK,YAAY,KAAK;GACpB;EAC3B;CACF;AACF;AAEA,MAAa,QAAQ,oBAAoB"}

package/dist/oauth2/provider/apple.d.cts

@@ -1,41 +1,42 @@
-import { NativeCredential, OAuth2Token, Provider } from '../types.cjs';
-
+import { NativeCredential, OAuth2Token, Provider } from "../types.cjs";
+//#region src/oauth2/provider/apple.d.ts
 declare function createAppleProvider(): Provider;
 declare const apple: Provider;
 interface AppleUserInfo {
-    sub: string;
-    email: string;
-    email_verified: true | 'true';
-    is_private_email: boolean;
-    real_user_status: number;
-    name: string;
-    picture: string;
-    user?: {
-        name: {
-            firstName: string;
-            lastName: string;
-        };
-        email: string;
+  sub: string;
+  email: string;
+  email_verified: true | 'true';
+  is_private_email: boolean;
+  real_user_status: number;
+  name: string;
+  picture: string;
+  user?: {
+    name: {
+      firstName: string;
+      lastName: string;
     };
-    nonce?: string;
-    nonce_supported?: boolean;
+    email: string;
+  };
+  nonce?: string;
+  nonce_supported?: boolean;
 }
 interface AppleToken extends OAuth2Token {
-    access_token: string;
-    token_type: string;
-    expires_in: number;
-    refresh_token: string;
-    id_token: string;
+  access_token: string;
+  token_type: string;
+  expires_in: number;
+  refresh_token: string;
+  id_token: string;
 }
 interface AppleNativeCredential extends NativeCredential {
-    state: string;
-    code: string;
-    id_token: string;
-    user: string;
-    email?: string;
+  state: string;
+  code: string;
+  id_token: string;
+  user: string;
+  email?: string;
 }
 interface AppleErrorResponse {
-    error: 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'invalid_scope';
+  error: 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'invalid_scope';
 }
-
-export { type AppleErrorResponse, type AppleNativeCredential, type AppleToken, type AppleUserInfo, apple, createAppleProvider };
+//#endregion
+export { AppleErrorResponse, AppleNativeCredential, AppleToken, AppleUserInfo, apple, createAppleProvider };
+//# sourceMappingURL=apple.d.cts.map

package/dist/oauth2/provider/apple.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple.d.cts","names":[],"sources":["../../../src/oauth2/provider/apple.ts"],"mappings":";;iBAMgB,uBAAuB;cAwD1B,OAAK;UAGD;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;IACE;MAAQ;MAAmB;;IAC3B;;EAEF;EACA;;UAKe,mBAAmB;EAClC;EACA;EACA;EACA;EACA;;UAGe,8BAA8B;EAC7C;EACA;EACA;EAEA;EACA;;UAIe;EACf"}

package/dist/oauth2/provider/apple.d.mts

@@ -0,0 +1,42 @@
+import { NativeCredential, OAuth2Token, Provider } from "../types.mjs";
+//#region src/oauth2/provider/apple.d.ts
+declare function createAppleProvider(): Provider;
+declare const apple: Provider;
+interface AppleUserInfo {
+  sub: string;
+  email: string;
+  email_verified: true | 'true';
+  is_private_email: boolean;
+  real_user_status: number;
+  name: string;
+  picture: string;
+  user?: {
+    name: {
+      firstName: string;
+      lastName: string;
+    };
+    email: string;
+  };
+  nonce?: string;
+  nonce_supported?: boolean;
+}
+interface AppleToken extends OAuth2Token {
+  access_token: string;
+  token_type: string;
+  expires_in: number;
+  refresh_token: string;
+  id_token: string;
+}
+interface AppleNativeCredential extends NativeCredential {
+  state: string;
+  code: string;
+  id_token: string;
+  user: string;
+  email?: string;
+}
+interface AppleErrorResponse {
+  error: 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'invalid_scope';
+}
+//#endregion
+export { AppleErrorResponse, AppleNativeCredential, AppleToken, AppleUserInfo, apple, createAppleProvider };
+//# sourceMappingURL=apple.d.mts.map

package/dist/oauth2/provider/apple.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple.d.mts","names":[],"sources":["../../../src/oauth2/provider/apple.ts"],"mappings":";;iBAMgB,uBAAuB;cAwD1B,OAAK;UAGD;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;IACE;MAAQ;MAAmB;;IAC3B;;EAEF;EACA;;UAKe,mBAAmB;EAClC;EACA;EACA;EACA;EACA;;UAGe,8BAA8B;EAC7C;EACA;EACA;EAEA;EACA;;UAIe;EACf"}

package/dist/oauth2/provider/apple.mjs

@@ -1,65 +1,76 @@
-// src/oauth2/provider/apple.ts
-import { invariant } from "@shware/utils";
 import { OAuth2Error } from "../error.mjs";
 import { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from "./common.mjs";
+import { invariant } from "@shware/utils";
+//#region src/oauth2/provider/apple.ts
 function createAppleProvider() {
-  return {
-    // important notice: response_mode=form_post is required for apple
-    authorizationUri: "https://appleid.apple.com/auth/authorize?response_mode=form_post",
-    tokenUri: "https://appleid.apple.com/auth/token",
-    jwkSetUri: "https://appleid.apple.com/auth/keys",
-    userNameAttribute: "sub",
-    defaultScope: ["openid", "name", "email"],
-    createAuthorizationUri({ pkce: _, ...params }) {
-      return createAuthorizationUri({
-        ...params,
-        scope: params.scope ?? this.defaultScope,
-        authorizationUri: this.authorizationUri
-      });
-    },
-    async exchangeAuthorizationCode({ pkce: _, ...params }) {
-      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });
-      if (!response.ok) {
-        const { error } = await response.json();
-        throw new OAuth2Error(response.status, error);
-      }
-      return await response.json();
-    },
-    async getUserInfo({ id_token }) {
-      invariant(id_token, "id_token is required");
-      invariant(this.jwkSetUri, "jwkSetUri is required");
-      const data = await verifyIdToken(id_token, this.jwkSetUri);
-      return {
-        data,
-        claims: {
-          sub: data.sub,
-          name: data.name,
-          email: data.email,
-          email_verified: true,
-          picture: data.picture,
-          given_name: data.user?.name.firstName,
-          family_name: data.user?.name.lastName
-        }
-      };
-    },
-    async loginOAuth2Native({ pkce: _, credentials, ...params }) {
-      invariant(credentials.code, "code is required");
-      const { tokenUri } = this;
-      const { code } = credentials;
-      const response = await exchangeAuthorizationCode({ code, tokenUri, ...params });
-      if (!response.ok) {
-        const { error } = await response.json();
-        throw new OAuth2Error(response.status, error);
-      }
-      const token = await response.json();
-      const userInfo = await this.getUserInfo(token);
-      return { token, userInfo };
-    }
-  };
+	return {
+		authorizationUri: "https://appleid.apple.com/auth/authorize?response_mode=form_post",
+		tokenUri: "https://appleid.apple.com/auth/token",
+		jwkSetUri: "https://appleid.apple.com/auth/keys",
+		userNameAttribute: "sub",
+		defaultScope: [
+			"openid",
+			"name",
+			"email"
+		],
+		createAuthorizationUri({ pkce: _, ...params }) {
+			return createAuthorizationUri({
+				...params,
+				scope: params.scope ?? this.defaultScope,
+				authorizationUri: this.authorizationUri
+			});
+		},
+		async exchangeAuthorizationCode({ pkce: _, ...params }) {
+			const response = await exchangeAuthorizationCode({
+				...params,
+				tokenUri: this.tokenUri
+			});
+			if (!response.ok) {
+				const { error } = await response.json();
+				throw new OAuth2Error(response.status, error);
+			}
+			return await response.json();
+		},
+		async getUserInfo({ id_token }) {
+			invariant(id_token, "id_token is required");
+			invariant(this.jwkSetUri, "jwkSetUri is required");
+			const data = await verifyIdToken(id_token, this.jwkSetUri);
+			return {
+				data,
+				claims: {
+					sub: data.sub,
+					name: data.name,
+					email: data.email,
+					email_verified: true,
+					picture: data.picture,
+					given_name: data.user?.name.firstName,
+					family_name: data.user?.name.lastName
+				}
+			};
+		},
+		async loginOAuth2Native({ pkce: _, credentials, ...params }) {
+			invariant(credentials.code, "code is required");
+			const { tokenUri } = this;
+			const { code } = credentials;
+			const response = await exchangeAuthorizationCode({
+				code,
+				tokenUri,
+				...params
+			});
+			if (!response.ok) {
+				const { error } = await response.json();
+				throw new OAuth2Error(response.status, error);
+			}
+			const token = await response.json();
+			return {
+				token,
+				userInfo: await this.getUserInfo(token)
+			};
+		}
+	};
 }
-var apple = createAppleProvider();
-export {
-  apple,
-  createAppleProvider
-};
+const apple = createAppleProvider();
+//#endregion
+export { apple, createAppleProvider };
+
 //# sourceMappingURL=apple.mjs.map

package/dist/oauth2/provider/apple.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/oauth2/provider/apple.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { LoginOAuth2NativeParams, NativeCredential, OAuth2Token, Provider } from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n// ref: https://account.apple.com/.well-known/openid-configuration\nexport function createAppleProvider(): Provider {\n  return {\n    // important notice: response_mode=form_post is required for apple\n    authorizationUri: 'https://appleid.apple.com/auth/authorize?response_mode=form_post',\n    tokenUri: 'https://appleid.apple.com/auth/token',\n    jwkSetUri: 'https://appleid.apple.com/auth/keys',\n    userNameAttribute: 'sub',\n    defaultScope: ['openid', 'name', 'email'],\n    createAuthorizationUri({ pkce: _, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce: _, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      return (await response.json()) as AppleToken;\n    },\n    async getUserInfo({ id_token }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<AppleUserInfo>(id_token, this.jwkSetUri);\n      return {\n        data,\n        claims: {\n          sub: data.sub,\n          name: data.name,\n          email: data.email,\n          email_verified: true,\n          picture: data.picture,\n          given_name: data.user?.name.firstName,\n          family_name: data.user?.name.lastName,\n        },\n      };\n    },\n    async loginOAuth2Native({ pkce: _, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { tokenUri } = this;\n      const { code } = credentials;\n      const response = await exchangeAuthorizationCode({ code, tokenUri, ...params });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      const token = (await response.json()) as AppleToken;\n      const userInfo = await this.getUserInfo(token);\n      return { token, userInfo };\n    },\n  };\n}\n\nexport const apple = createAppleProvider();\n\n// https://developer.apple.com/documentation/sign_in_with_apple/authenticating-users-with-sign-in-with-apple\nexport interface AppleUserInfo {\n  sub: string;\n  email: string;\n  email_verified: true | 'true';\n  is_private_email: boolean;\n  real_user_status: number;\n  name: string;\n  picture: string;\n  user?: {\n    name: { firstName: string; lastName: string };\n    email: string;\n  };\n  nonce?: string;\n  nonce_supported?: boolean;\n}\n\n// https://developer.apple.com/documentation/devicemanagement/implementing-the-oauth2-authentication-user-enrollment-flow\n// https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens\nexport interface AppleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n}\n\nexport interface AppleNativeCredential extends NativeCredential {\n  state: string;\n  code: string;\n  id_token: string;\n  // no standard fields\n  user: string;\n  email?: string;\n}\n\n// https://developer.apple.com/documentation/sign_in_with_apple/errorresponse\nexport interface AppleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'invalid_scope';\n}\n"],"mappings":";AAAA,SAAS,iBAAiB;AAC1B,SAAS,mBAAmB;AAE5B,SAAS,wBAAwB,2BAA2B,qBAAqB;AAG1E,SAAS,sBAAgC;AAC9C,SAAO;AAAA;AAAA,IAEL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,WAAW;AAAA,IACX,mBAAmB;AAAA,IACnB,cAAc,CAAC,UAAU,QAAQ,OAAO;AAAA,IACxC,uBAAuB,EAAE,MAAM,GAAG,GAAG,OAAO,GAAG;AAC7C,aAAO,uBAAuB;AAAA,QAC5B,GAAG;AAAA,QACH,OAAO,OAAO,SAAS,KAAK;AAAA,QAC5B,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,GAAG,OAAO,GAAG;AACtD,YAAM,WAAW,MAAM,0BAA0B,EAAE,GAAG,QAAQ,UAAU,KAAK,SAAS,CAAC;AACvF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,MAAM,IAAK,MAAM,SAAS,KAAK;AACvC,cAAM,IAAI,YAAY,SAAS,QAAQ,KAAK;AAAA,MAC9C;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,EAAE,SAAS,GAAG;AAC9B,gBAAU,UAAU,sBAAsB;AAC1C,gBAAU,KAAK,WAAW,uBAAuB;AACjD,YAAM,OAAO,MAAM,cAA6B,UAAU,KAAK,SAAS;AACxE,aAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,UACN,KAAK,KAAK;AAAA,UACV,MAAM,KAAK;AAAA,UACX,OAAO,KAAK;AAAA,UACZ,gBAAgB;AAAA,UAChB,SAAS,KAAK;AAAA,UACd,YAAY,KAAK,MAAM,KAAK;AAAA,UAC5B,aAAa,KAAK,MAAM,KAAK;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,kBAAkB,EAAE,MAAM,GAAG,aAAa,GAAG,OAAO,GAA4B;AACpF,gBAAU,YAAY,MAAM,kBAAkB;AAC9C,YAAM,EAAE,SAAS,IAAI;AACrB,YAAM,EAAE,KAAK,IAAI;AACjB,YAAM,WAAW,MAAM,0BAA0B,EAAE,MAAM,UAAU,GAAG,OAAO,CAAC;AAC9E,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,EAAE,MAAM,IAAK,MAAM,SAAS,KAAK;AACvC,cAAM,IAAI,YAAY,SAAS,QAAQ,KAAK;AAAA,MAC9C;AACA,YAAM,QAAS,MAAM,SAAS,KAAK;AACnC,YAAM,WAAW,MAAM,KAAK,YAAY,KAAK;AAC7C,aAAO,EAAE,OAAO,SAAS;AAAA,IAC3B;AAAA,EACF;AACF;AAEO,IAAM,QAAQ,oBAAoB;","names":[]}
+{"version":3,"file":"apple.mjs","names":[],"sources":["../../../src/oauth2/provider/apple.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { LoginOAuth2NativeParams, NativeCredential, OAuth2Token, Provider } from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n// ref: https://account.apple.com/.well-known/openid-configuration\nexport function createAppleProvider(): Provider {\n  return {\n    // important notice: response_mode=form_post is required for apple\n    authorizationUri: 'https://appleid.apple.com/auth/authorize?response_mode=form_post',\n    tokenUri: 'https://appleid.apple.com/auth/token',\n    jwkSetUri: 'https://appleid.apple.com/auth/keys',\n    userNameAttribute: 'sub',\n    defaultScope: ['openid', 'name', 'email'],\n    createAuthorizationUri({ pkce: _, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce: _, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      return (await response.json()) as AppleToken;\n    },\n    async getUserInfo({ id_token }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<AppleUserInfo>(id_token, this.jwkSetUri);\n      return {\n        data,\n        claims: {\n          sub: data.sub,\n          name: data.name,\n          email: data.email,\n          email_verified: true,\n          picture: data.picture,\n          given_name: data.user?.name.firstName,\n          family_name: data.user?.name.lastName,\n        },\n      };\n    },\n    async loginOAuth2Native({ pkce: _, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { tokenUri } = this;\n      const { code } = credentials;\n      const response = await exchangeAuthorizationCode({ code, tokenUri, ...params });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      const token = (await response.json()) as AppleToken;\n      const userInfo = await this.getUserInfo(token);\n      return { token, userInfo };\n    },\n  };\n}\n\nexport const apple = createAppleProvider();\n\n// https://developer.apple.com/documentation/sign_in_with_apple/authenticating-users-with-sign-in-with-apple\nexport interface AppleUserInfo {\n  sub: string;\n  email: string;\n  email_verified: true | 'true';\n  is_private_email: boolean;\n  real_user_status: number;\n  name: string;\n  picture: string;\n  user?: {\n    name: { firstName: string; lastName: string };\n    email: string;\n  };\n  nonce?: string;\n  nonce_supported?: boolean;\n}\n\n// https://developer.apple.com/documentation/devicemanagement/implementing-the-oauth2-authentication-user-enrollment-flow\n// https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens\nexport interface AppleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n}\n\nexport interface AppleNativeCredential extends NativeCredential {\n  state: string;\n  code: string;\n  id_token: string;\n  // no standard fields\n  user: string;\n  email?: string;\n}\n\n// https://developer.apple.com/documentation/sign_in_with_apple/errorresponse\nexport interface AppleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'invalid_scope';\n}\n"],"mappings":";;;;AAMA,SAAgB,sBAAgC;CAC9C,OAAO;EAEL,kBAAkB;EAClB,UAAU;EACV,WAAW;EACX,mBAAmB;EACnB,cAAc;GAAC;GAAU;GAAQ;EAAO;EACxC,uBAAuB,EAAE,MAAM,GAAG,GAAG,UAAU;GAC7C,OAAO,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,GAAG,UAAU;GACtD,MAAM,WAAW,MAAM,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,UAAW,MAAM,SAAS,KAAK;IACvC,MAAM,IAAI,YAAY,SAAS,QAAQ,KAAK;GAC9C;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,YAAY;GAC9B,UAAU,UAAU,sBAAsB;GAC1C,UAAU,KAAK,WAAW,uBAAuB;GACjD,MAAM,OAAO,MAAM,cAA6B,UAAU,KAAK,SAAS;GACxE,OAAO;IACL;IACA,QAAQ;KACN,KAAK,KAAK;KACV,MAAM,KAAK;KACX,OAAO,KAAK;KACZ,gBAAgB;KAChB,SAAS,KAAK;KACd,YAAY,KAAK,MAAM,KAAK;KAC5B,aAAa,KAAK,MAAM,KAAK;IAC/B;GACF;EACF;EACA,MAAM,kBAAkB,EAAE,MAAM,GAAG,aAAa,GAAG,UAAmC;GACpF,UAAU,YAAY,MAAM,kBAAkB;GAC9C,MAAM,EAAE,aAAa;GACrB,MAAM,EAAE,SAAS;GACjB,MAAM,WAAW,MAAM,0BAA0B;IAAE;IAAM;IAAU,GAAG;GAAO,CAAC;GAC9E,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,UAAW,MAAM,SAAS,KAAK;IACvC,MAAM,IAAI,YAAY,SAAS,QAAQ,KAAK;GAC9C;GACA,MAAM,QAAS,MAAM,SAAS,KAAK;GAEnC,OAAO;IAAE;IAAO,UAAA,MADO,KAAK,YAAY,KAAK;GACpB;EAC3B;CACF;AACF;AAEA,MAAa,QAAQ,oBAAoB"}