@shware/security 2.6.0 → 3.0.1

package/dist/core/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../src/core/index.ts"],"sourcesContent":["export type JSONValue =\n  | null\n  | string\n  | number\n  | boolean\n  | { [value: string]: JSONValue }\n  | Array<JSONValue>;\n\nexport interface Principal {\n  name: string;\n}\n\nexport interface Authentication extends Principal {\n  authorities: string[];\n  authenticated: boolean;\n}\n\nexport interface CsrfToken {\n  token: string;\n  headerName: string;\n  parameterName: string;\n}\n\nexport enum Provider {\n  // oauth2\n  APPLE = 'APPLE',\n  DISCORD = 'DISCORD',\n  FACEBOOK = 'FACEBOOK',\n  GITHUB = 'GITHUB',\n  GOOGLE = 'GOOGLE',\n  LINKEDIN = 'LINKEDIN',\n  MICROSOFT = 'MICROSOFT',\n  SLACK = 'SLACK',\n  WECHAT = 'WECHAT',\n  X = 'X',\n  // contact\n  EMAIL = 'EMAIL',\n  PHONE = 'PHONE',\n}\n\nexport const ALL_PROVIDERS = [\n  Provider.APPLE,\n  Provider.DISCORD,\n  Provider.FACEBOOK,\n  Provider.GITHUB,\n  Provider.GOOGLE,\n  Provider.LINKEDIN,\n  Provider.MICROSOFT,\n  Provider.SLACK,\n  Provider.WECHAT,\n  Provider.X,\n  Provider.EMAIL,\n  Provider.PHONE,\n] as const;\n"],"mappings":";AAuBA,IAAY,WAAL,yBAAA,UAAA;CAEL,SAAA,WAAA;CACA,SAAA,aAAA;CACA,SAAA,cAAA;CACA,SAAA,YAAA;CACA,SAAA,YAAA;CACA,SAAA,cAAA;CACA,SAAA,eAAA;CACA,SAAA,WAAA;CACA,SAAA,YAAA;CACA,SAAA,OAAA;CAEA,SAAA,WAAA;CACA,SAAA,WAAA;;AACF,EAAA,CAAA,CAAA;AAEA,MAAa,gBAAgB;;;;;;;;;;;;;AAa7B"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/core/index.ts"],"sourcesContent":["export type JSONValue =\n  | null\n  | string\n  | number\n  | boolean\n  | { [value: string]: JSONValue }\n  | Array<JSONValue>;\n\nexport interface Principal {\n  name: string;\n}\n\nexport interface Authentication extends Principal {\n  authorities: string[];\n  authenticated: boolean;\n}\n\nexport interface CsrfToken {\n  token: string;\n  headerName: string;\n  parameterName: string;\n}\n\nexport const PROVIDERS = [\n  // oauth2\n  'APPLE',\n  'DISCORD',\n  'FACEBOOK',\n  'GITHUB',\n  'GOOGLE',\n  'LINKEDIN',\n  'MICROSOFT',\n  'SLACK',\n  'WECHAT',\n  'X',\n  // contact\n  'EMAIL',\n  'PHONE',\n] as const;\n\nexport type Provider = (typeof PROVIDERS)[number];\n"],"mappings":";AAuBA,MAAa,YAAY;CAEvB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA;CACA;AACF"}

package/dist/email/schema.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.cts","names":[],"sources":["../../src/email/schema.ts"],"mappings":";cAEa,oDAA+B;;;;cAK/B,qCAAgB"}
+{"version":3,"file":"schema.d.cts","names":[],"sources":["../../src/email/schema.ts"],"mappings":";cAEa,oDAA+B;;;yBAG1C;cAEW,qCAAgB;;;yBAG3B"}

package/dist/email/schema.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.mts","names":[],"sources":["../../src/email/schema.ts"],"mappings":";cAEa,oDAA+B;;;;cAK/B,qCAAgB"}
+{"version":3,"file":"schema.d.mts","names":[],"sources":["../../src/email/schema.ts"],"mappings":";cAEa,oDAA+B;;;yBAG1C;cAEW,qCAAgB;;;yBAG3B"}

package/dist/index.cjs

@@ -1,17 +1,18 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_core_index = require("./core/index.cjs");
 const require_oauth2_client = require("./oauth2/client.cjs");
 const require_session_common = require("./session/common.cjs");
 const require_auth_index = require("./auth/index.cjs");
 const require_session_redis = require("./session/redis.cjs");
 const require_session_db = require("./session/db.cjs");
-exports.ALL_PROVIDERS = require_core_index.ALL_PROVIDERS;
+const require_core_index = require("./core/index.cjs");
+const require_oauth2_types = require("./oauth2/types.cjs");
 exports.Auth = require_auth_index.Auth;
 exports.DBIndexedSessionRepository = require_session_db.DBIndexedSessionRepository;
 exports.OAuth2Client = require_oauth2_client.OAuth2Client;
+exports.OIDC_SCOPES = require_oauth2_types.OIDC_SCOPES;
 exports.PATH = require_auth_index.PATH;
 exports.PRINCIPAL_NAME_INDEX_NAME = require_session_common.PRINCIPAL_NAME_INDEX_NAME;
-exports.Provider = require_core_index.Provider;
+exports.PROVIDERS = require_core_index.PROVIDERS;
 exports.RedisIndexedSessionRepository = require_session_redis.RedisIndexedSessionRepository;
 exports.RedisKVRepository = require_session_redis.RedisKVRepository;
 exports.oauth2RedirectQuerySchema = require_oauth2_client.oauth2RedirectQuerySchema;

package/dist/index.d.cts

@@ -1,10 +1,10 @@
-import { ALL_PROVIDERS, CsrfToken, Principal, Provider } from "./core/index.cjs";
+import { CsrfToken, PROVIDERS, Principal, Provider } from "./core/index.cjs";
 import { KVRepository, Namespace, Session, SessionRepository } from "./session/types.cjs";
-import { NativeCredential, OAuth2Token, OidcScopes, OidcToken, StandardClaims, UserInfo } from "./oauth2/types.cjs";
+import { NativeCredential, OAuth2Token, OIDC_SCOPES, OidcScope, OidcToken, StandardClaims, UserInfo } from "./oauth2/types.cjs";
 import { AuthConfig, AuthService } from "./auth/types.cjs";
 import { Auth, PATH } from "./auth/index.cjs";
 import { OAuth2Client, oauth2RedirectQuerySchema } from "./oauth2/client.cjs";
 import { RedisIndexedSessionRepository, RedisKVRepository } from "./session/redis.cjs";
 import { DBAdapter, DBIndexedSessionRepository } from "./session/db.cjs";
 import { PRINCIPAL_NAME_INDEX_NAME } from "./session/common.cjs";
-export { ALL_PROVIDERS, Auth, type AuthConfig, type AuthService, type CsrfToken, type DBAdapter, DBIndexedSessionRepository, type KVRepository, type Namespace, type NativeCredential, OAuth2Client, type OAuth2Token, type OidcScopes, type OidcToken, PATH, PRINCIPAL_NAME_INDEX_NAME, type Principal, Provider, RedisIndexedSessionRepository, RedisKVRepository, type Session, type SessionRepository, type StandardClaims, type UserInfo, oauth2RedirectQuerySchema };
+export { Auth, type AuthConfig, type AuthService, type CsrfToken, type DBAdapter, DBIndexedSessionRepository, type KVRepository, type Namespace, type NativeCredential, OAuth2Client, type OAuth2Token, OIDC_SCOPES, type OidcScope, type OidcToken, PATH, PRINCIPAL_NAME_INDEX_NAME, PROVIDERS, type Principal, type Provider, RedisIndexedSessionRepository, RedisKVRepository, type Session, type SessionRepository, type StandardClaims, type UserInfo, oauth2RedirectQuerySchema };

package/dist/index.d.mts

@@ -1,10 +1,10 @@
-import { ALL_PROVIDERS, CsrfToken, Principal, Provider } from "./core/index.mjs";
+import { CsrfToken, PROVIDERS, Principal, Provider } from "./core/index.mjs";
 import { KVRepository, Namespace, Session, SessionRepository } from "./session/types.mjs";
-import { NativeCredential, OAuth2Token, OidcScopes, OidcToken, StandardClaims, UserInfo } from "./oauth2/types.mjs";
+import { NativeCredential, OAuth2Token, OIDC_SCOPES, OidcScope, OidcToken, StandardClaims, UserInfo } from "./oauth2/types.mjs";
 import { AuthConfig, AuthService } from "./auth/types.mjs";
 import { Auth, PATH } from "./auth/index.mjs";
 import { OAuth2Client, oauth2RedirectQuerySchema } from "./oauth2/client.mjs";
 import { RedisIndexedSessionRepository, RedisKVRepository } from "./session/redis.mjs";
 import { DBAdapter, DBIndexedSessionRepository } from "./session/db.mjs";
 import { PRINCIPAL_NAME_INDEX_NAME } from "./session/common.mjs";
-export { ALL_PROVIDERS, Auth, type AuthConfig, type AuthService, type CsrfToken, type DBAdapter, DBIndexedSessionRepository, type KVRepository, type Namespace, type NativeCredential, OAuth2Client, type OAuth2Token, type OidcScopes, type OidcToken, PATH, PRINCIPAL_NAME_INDEX_NAME, type Principal, Provider, RedisIndexedSessionRepository, RedisKVRepository, type Session, type SessionRepository, type StandardClaims, type UserInfo, oauth2RedirectQuerySchema };
+export { Auth, type AuthConfig, type AuthService, type CsrfToken, type DBAdapter, DBIndexedSessionRepository, type KVRepository, type Namespace, type NativeCredential, OAuth2Client, type OAuth2Token, OIDC_SCOPES, type OidcScope, type OidcToken, PATH, PRINCIPAL_NAME_INDEX_NAME, PROVIDERS, type Principal, type Provider, RedisIndexedSessionRepository, RedisKVRepository, type Session, type SessionRepository, type StandardClaims, type UserInfo, oauth2RedirectQuerySchema };

package/dist/index.mjs

@@ -1,7 +1,8 @@
-import { ALL_PROVIDERS, Provider } from "./core/index.mjs";
 import { OAuth2Client, oauth2RedirectQuerySchema } from "./oauth2/client.mjs";
 import { PRINCIPAL_NAME_INDEX_NAME } from "./session/common.mjs";
 import { Auth, PATH } from "./auth/index.mjs";
 import { RedisIndexedSessionRepository, RedisKVRepository } from "./session/redis.mjs";
 import { DBIndexedSessionRepository } from "./session/db.mjs";
-export { ALL_PROVIDERS, Auth, DBIndexedSessionRepository, OAuth2Client, PATH, PRINCIPAL_NAME_INDEX_NAME, Provider, RedisIndexedSessionRepository, RedisKVRepository, oauth2RedirectQuerySchema };
+import { PROVIDERS } from "./core/index.mjs";
+import { OIDC_SCOPES } from "./oauth2/types.mjs";
+export { Auth, DBIndexedSessionRepository, OAuth2Client, OIDC_SCOPES, PATH, PRINCIPAL_NAME_INDEX_NAME, PROVIDERS, RedisIndexedSessionRepository, RedisKVRepository, oauth2RedirectQuerySchema };

package/dist/oauth2/client.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"client.cjs","names":[],"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { object, optional, string } from 'zod/v4-mini';\nimport type {\n  NativeCredential,\n  OAuth2ClientConfig,\n  OAuth2Token,\n  OidcToken,\n  PkceParameters,\n} from './types';\n\nexport const oauth2RedirectQuerySchema = object({\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n});\n\nexport const googleOneTapSchema = object({\n  // login_uri\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  nonce: optional(string()),\n  g_csrf_token: optional(string()),\n  hd: optional(string()),\n  // callback\n  credential: optional(string()),\n});\n\nexport class OAuth2Client {\n  private config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get successUri() {\n    return this.config.successUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  private async getClientConfig(registrationId: string) {\n    const registrations =\n      typeof this.config.registration === 'function'\n        ? await this.config.registration()\n        : this.config.registration;\n\n    const registration = registrations[registrationId];\n    invariant(registration, `Registration ${registrationId} not found`);\n\n    const provider = this.config.provider[registration.provider ?? registrationId];\n    invariant(provider, `Provider ${registration.provider ?? registrationId} not found`);\n    return { registration, provider };\n  }\n\n  async createAuthorizationUri({\n    registrationId,\n    state,\n    pkce,\n  }: {\n    registrationId: string;\n    state: string;\n    pkce?: PkceParameters;\n  }): Promise<URL> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { scope, clientId, redirectUri } = registration;\n    return provider.createAuthorizationUri({\n      pkce,\n      state,\n      scope,\n      clientId,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async exchangeAuthorizationCode({\n    registrationId,\n    code,\n    pkce,\n  }: {\n    registrationId: string;\n    code: string;\n    pkce?: PkceParameters;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n    return provider.exchangeAuthorizationCode({\n      code,\n      pkce,\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async getUserInfo({\n    registrationId,\n    token,\n  }: {\n    registrationId: string;\n    token: OAuth2Token | OidcToken;\n  }) {\n    const { provider } = await this.getClientConfig(registrationId);\n    return provider.getUserInfo(token);\n  }\n\n  async refreshAccessToken({\n    registrationId,\n    refreshToken,\n  }: {\n    registrationId: string;\n    refreshToken: string;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    return provider.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken(registrationId: string, token: string) {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.revokeToken, 'Provider does not support revokeToken');\n    await provider.revokeToken({ token, clientId, clientSecret });\n  }\n\n  async loginOAuth2Native({\n    registrationId,\n    credentials,\n    pkce,\n  }: {\n    registrationId: string;\n    credentials: NativeCredential;\n    pkce?: PkceParameters;\n  }) {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    invariant(provider.loginOAuth2Native, 'Provider does not support loginOAuth2Native');\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n\n    return provider.loginOAuth2Native({\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n      credentials,\n      pkce,\n    });\n  }\n}\n"],"mappings":";;;;AAUA,MAAa,6BAAA,GAAA,YAAA,OAAA,CAAmC;CAC9C,OAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAAsB,CAAC;CACvB,QAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAAuB,CAAC;CACxB,QAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAAuB,CAAC;CACxB,oBAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAAmC,CAAC;CACpC,YAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAA2B,CAAC;AAC9B,CAAC;AAED,MAAa,sBAAA,GAAA,YAAA,OAAA,CAA4B;CAEvC,OAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAAsB,CAAC;CACvB,QAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAAuB,CAAC;CACxB,QAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAAuB,CAAC;CACxB,oBAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAAmC,CAAC;CACpC,YAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAA2B,CAAC;CAC5B,QAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAAuB,CAAC;CACxB,eAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAA8B,CAAC;CAC/B,KAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAAoB,CAAC;CAErB,aAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAA4B,CAAC;AAC/B,CAAC;AAED,IAAa,eAAb,MAA0B;CACxB;CACA,YAAY,QAA4B;EACtC,KAAK,SAAS;CAChB;CAEA,IAAI,UAAU;EACZ,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,aAAa;EACf,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,WAAW;EACb,OAAO,KAAK,OAAO;CACrB;CAEA,MAAc,gBAAgB,gBAAwB;EAMpD,MAAM,gBAJJ,OAAO,KAAK,OAAO,iBAAiB,aAChC,MAAM,KAAK,OAAO,aAAa,IAC/B,KAAK,OAAO,aAAA,CAEiB;EACnC,CAAA,GAAA,cAAA,UAAA,CAAU,cAAc,gBAAgB,eAAe,WAAW;EAElE,MAAM,WAAW,KAAK,OAAO,SAAS,aAAa,YAAY;EAC/D,CAAA,GAAA,cAAA,UAAA,CAAU,UAAU,YAAY,aAAa,YAAY,eAAe,WAAW;EACnF,OAAO;GAAE;GAAc;EAAS;CAClC;CAEA,MAAM,uBAAuB,EAC3B,gBACA,OACA,QAKe;EACf,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAE5E,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,OAAO,UAAU,gBAAgB;EACzC,OAAO,SAAS,uBAAuB;GACrC;GACA;GACA;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;EAC9D,CAAC;CACH;CAEA,MAAM,0BAA0B,EAC9B,gBACA,MACA,QAKuB;EACvB,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAE5E,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,UAAU,cAAc,gBAAgB;EAChD,OAAO,SAAS,0BAA0B;GACxC;GACA;GACA;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;EAC9D,CAAC;CACH;CAEA,MAAM,YAAY,EAChB,gBACA,SAIC;EACD,MAAM,EAAE,aAAa,MAAM,KAAK,gBAAgB,cAAc;EAC9D,OAAO,SAAS,YAAY,KAAK;CACnC;CAEA,MAAM,mBAAmB,EACvB,gBACA,gBAIuB;EACvB,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,MAAM,EAAE,UAAU,iBAAiB;EAEnC,CAAA,GAAA,cAAA,UAAA,CAAU,SAAS,oBAAoB,8CAA8C;EACrF,OAAO,SAAS,mBAAmB;GAAE;GAAc;GAAU;EAAa,CAAC;CAC7E;CAEA,MAAM,YAAY,gBAAwB,OAAe;EACvD,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,MAAM,EAAE,UAAU,iBAAiB;EAEnC,CAAA,GAAA,cAAA,UAAA,CAAU,SAAS,aAAa,uCAAuC;EACvE,MAAM,SAAS,YAAY;GAAE;GAAO;GAAU;EAAa,CAAC;CAC9D;CAEA,MAAM,kBAAkB,EACtB,gBACA,aACA,QAKC;EACD,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,CAAA,GAAA,cAAA,UAAA,CAAU,SAAS,mBAAmB,6CAA6C;EACnF,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,UAAU,cAAc,gBAAgB;EAEhD,OAAO,SAAS,kBAAkB;GAChC;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;GAC5D;GACA;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"client.cjs","names":[],"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { object, optional, string } from 'zod/v4-mini';\nimport type {\n  NativeCredential,\n  OAuth2ClientConfig,\n  OAuth2Token,\n  OidcToken,\n  PkceParameters,\n} from './types';\n\nexport const oauth2RedirectQuerySchema = object({\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n});\n\nexport const googleOneTapSchema = object({\n  // login_uri\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  nonce: optional(string()),\n  g_csrf_token: optional(string()),\n  hd: optional(string()),\n  // callback\n  credential: optional(string()),\n});\n\nexport class OAuth2Client {\n  private readonly config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get successUri() {\n    return this.config.successUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  private async getClientConfig(registrationId: string) {\n    const registrations =\n      typeof this.config.registration === 'function'\n        ? await this.config.registration()\n        : this.config.registration;\n\n    const registration = registrations[registrationId];\n    invariant(registration, `Registration ${registrationId} not found`);\n\n    const provider = this.config.provider[registration.provider ?? registrationId];\n    invariant(provider, `Provider ${registration.provider ?? registrationId} not found`);\n    return { registration, provider };\n  }\n\n  async createAuthorizationUri({\n    registrationId,\n    state,\n    pkce,\n  }: {\n    registrationId: string;\n    state: string;\n    pkce?: PkceParameters;\n  }): Promise<URL> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { scope, clientId, redirectUri } = registration;\n    return provider.createAuthorizationUri({\n      pkce,\n      state,\n      scope,\n      clientId,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async exchangeAuthorizationCode({\n    registrationId,\n    code,\n    pkce,\n  }: {\n    registrationId: string;\n    code: string;\n    pkce?: PkceParameters;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n    return provider.exchangeAuthorizationCode({\n      code,\n      pkce,\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async getUserInfo({\n    registrationId,\n    token,\n  }: {\n    registrationId: string;\n    token: OAuth2Token | OidcToken;\n  }) {\n    const { provider } = await this.getClientConfig(registrationId);\n    return provider.getUserInfo(token);\n  }\n\n  async refreshAccessToken({\n    registrationId,\n    refreshToken,\n  }: {\n    registrationId: string;\n    refreshToken: string;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    return provider.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken(registrationId: string, token: string) {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.revokeToken, 'Provider does not support revokeToken');\n    await provider.revokeToken({ token, clientId, clientSecret });\n  }\n\n  async loginOAuth2Native({\n    registrationId,\n    credentials,\n    pkce,\n  }: {\n    registrationId: string;\n    credentials: NativeCredential;\n    pkce?: PkceParameters;\n  }) {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    invariant(provider.loginOAuth2Native, 'Provider does not support loginOAuth2Native');\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n\n    return provider.loginOAuth2Native({\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n      credentials,\n      pkce,\n    });\n  }\n}\n"],"mappings":";;;;AAUA,MAAa,6BAAA,GAAA,YAAA,OAAA,CAAmC;CAC9C,OAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAAsB,CAAC;CACvB,QAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAAuB,CAAC;CACxB,QAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAAuB,CAAC;CACxB,oBAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAAmC,CAAC;CACpC,YAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAA2B,CAAC;AAC9B,CAAC;AAED,MAAa,sBAAA,GAAA,YAAA,OAAA,CAA4B;CAEvC,OAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAAsB,CAAC;CACvB,QAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAAuB,CAAC;CACxB,QAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAAuB,CAAC;CACxB,oBAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAAmC,CAAC;CACpC,YAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAA2B,CAAC;CAC5B,QAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAAuB,CAAC;CACxB,eAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAA8B,CAAC;CAC/B,KAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAAoB,CAAC;CAErB,aAAA,GAAA,YAAA,SAAA,EAAA,GAAA,YAAA,OAAA,CAA4B,CAAC;AAC/B,CAAC;AAED,IAAa,eAAb,MAA0B;CACxB;CACA,YAAY,QAA4B;EACtC,KAAK,SAAS;CAChB;CAEA,IAAI,UAAU;EACZ,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,aAAa;EACf,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,WAAW;EACb,OAAO,KAAK,OAAO;CACrB;CAEA,MAAc,gBAAgB,gBAAwB;EAMpD,MAAM,gBAJJ,OAAO,KAAK,OAAO,iBAAiB,aAChC,MAAM,KAAK,OAAO,aAAa,IAC/B,KAAK,OAAO,aAAA,CAEiB;EACnC,CAAA,GAAA,cAAA,UAAA,CAAU,cAAc,gBAAgB,eAAe,WAAW;EAElE,MAAM,WAAW,KAAK,OAAO,SAAS,aAAa,YAAY;EAC/D,CAAA,GAAA,cAAA,UAAA,CAAU,UAAU,YAAY,aAAa,YAAY,eAAe,WAAW;EACnF,OAAO;GAAE;GAAc;EAAS;CAClC;CAEA,MAAM,uBAAuB,EAC3B,gBACA,OACA,QAKe;EACf,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAE5E,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,OAAO,UAAU,gBAAgB;EACzC,OAAO,SAAS,uBAAuB;GACrC;GACA;GACA;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;EAC9D,CAAC;CACH;CAEA,MAAM,0BAA0B,EAC9B,gBACA,MACA,QAKuB;EACvB,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAE5E,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,UAAU,cAAc,gBAAgB;EAChD,OAAO,SAAS,0BAA0B;GACxC;GACA;GACA;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;EAC9D,CAAC;CACH;CAEA,MAAM,YAAY,EAChB,gBACA,SAIC;EACD,MAAM,EAAE,aAAa,MAAM,KAAK,gBAAgB,cAAc;EAC9D,OAAO,SAAS,YAAY,KAAK;CACnC;CAEA,MAAM,mBAAmB,EACvB,gBACA,gBAIuB;EACvB,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,MAAM,EAAE,UAAU,iBAAiB;EAEnC,CAAA,GAAA,cAAA,UAAA,CAAU,SAAS,oBAAoB,8CAA8C;EACrF,OAAO,SAAS,mBAAmB;GAAE;GAAc;GAAU;EAAa,CAAC;CAC7E;CAEA,MAAM,YAAY,gBAAwB,OAAe;EACvD,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,MAAM,EAAE,UAAU,iBAAiB;EAEnC,CAAA,GAAA,cAAA,UAAA,CAAU,SAAS,aAAa,uCAAuC;EACvE,MAAM,SAAS,YAAY;GAAE;GAAO;GAAU;EAAa,CAAC;CAC9D;CAEA,MAAM,kBAAkB,EACtB,gBACA,aACA,QAKC;EACD,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,CAAA,GAAA,cAAA,UAAA,CAAU,SAAS,mBAAmB,6CAA6C;EACnF,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,UAAU,cAAc,gBAAgB;EAEhD,OAAO,SAAS,kBAAkB;GAChC;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;GAC5D;GACA;EACF,CAAC;CACH;AACF"}

package/dist/oauth2/client.d.cts

@@ -19,7 +19,7 @@ declare const googleOneTapSchema: import("zod/mini").ZodMiniObject<{
   credential: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
 }, import("zod/v4/core").$strip>;
 declare class OAuth2Client {
-  private config;
+  private readonly config;
   constructor(config: OAuth2ClientConfig);
   get baseUri(): string;
   get successUri(): string;

package/dist/oauth2/client.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.cts","names":[],"sources":["../../src/oauth2/client.ts"],"mappings":";;cAUa,8CAAyB;;;;;;;cAQzB,uCAAkB;;;;;;;;;;;cAclB;UACH;EACR,YAAY,QAAQ;MAIhB;MAIA;MAIA;UAIU;EAcR,yBACJ,gBACA,OACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;EAcN,4BACJ,gBACA,MACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;EAcN,cACJ,gBACA;IAEA;IACA,OAAO,cAAc;MACtB,QADsB;EAMjB,qBACJ,gBACA;IAEA;IACA;MACE,QAAQ;EAQN,YAAY,wBAAwB,gBAAa;EAQjD,oBACJ,gBACA,aACA;IAEA;IACA,aAAa;IACb,OAAO;MACR"}
+{"version":3,"file":"client.d.cts","names":[],"sources":["../../src/oauth2/client.ts"],"mappings":";;cAUa,8CAAyB;;;;;;yBAMpC;cAEW,uCAAkB;;;;;;;;;;yBAY7B;cAEW;mBACM;EACjB,YAAY,QAAQ;MAIhB;MAIA;MAIA;UAIU;EAcR,yBACJ,gBACA,OACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;EAcN,4BACJ,gBACA,MACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;EAcN,cACJ,gBACA;IAEA;IACA,OAAO,cAAc;MACtB,QADsB;EAMjB,qBACJ,gBACA;IAEA;IACA;MACE,QAAQ;EAQN,YAAY,wBAAwB,gBAAa;EAQjD,oBACJ,gBACA,aACA;IAEA;IACA,aAAa;IACb,OAAO;MACR"}

package/dist/oauth2/client.d.mts

@@ -19,7 +19,7 @@ declare const googleOneTapSchema: import("zod/mini").ZodMiniObject<{
   credential: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
 }, import("zod/v4/core").$strip>;
 declare class OAuth2Client {
-  private config;
+  private readonly config;
   constructor(config: OAuth2ClientConfig);
   get baseUri(): string;
   get successUri(): string;

package/dist/oauth2/client.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.mts","names":[],"sources":["../../src/oauth2/client.ts"],"mappings":";;cAUa,8CAAyB;;;;;;;cAQzB,uCAAkB;;;;;;;;;;;cAclB;UACH;EACR,YAAY,QAAQ;MAIhB;MAIA;MAIA;UAIU;EAcR,yBACJ,gBACA,OACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;EAcN,4BACJ,gBACA,MACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;EAcN,cACJ,gBACA;IAEA;IACA,OAAO,cAAc;MACtB,QADsB;EAMjB,qBACJ,gBACA;IAEA;IACA;MACE,QAAQ;EAQN,YAAY,wBAAwB,gBAAa;EAQjD,oBACJ,gBACA,aACA;IAEA;IACA,aAAa;IACb,OAAO;MACR"}
+{"version":3,"file":"client.d.mts","names":[],"sources":["../../src/oauth2/client.ts"],"mappings":";;cAUa,8CAAyB;;;;;;yBAMpC;cAEW,uCAAkB;;;;;;;;;;yBAY7B;cAEW;mBACM;EACjB,YAAY,QAAQ;MAIhB;MAIA;MAIA;UAIU;EAcR,yBACJ,gBACA,OACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;EAcN,4BACJ,gBACA,MACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;EAcN,cACJ,gBACA;IAEA;IACA,OAAO,cAAc;MACtB,QADsB;EAMjB,qBACJ,gBACA;IAEA;IACA;MACE,QAAQ;EAQN,YAAY,wBAAwB,gBAAa;EAQjD,oBACJ,gBACA,aACA;IAEA;IACA,aAAa;IACb,OAAO;MACR"}

package/dist/oauth2/client.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"client.mjs","names":[],"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { object, optional, string } from 'zod/v4-mini';\nimport type {\n  NativeCredential,\n  OAuth2ClientConfig,\n  OAuth2Token,\n  OidcToken,\n  PkceParameters,\n} from './types';\n\nexport const oauth2RedirectQuerySchema = object({\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n});\n\nexport const googleOneTapSchema = object({\n  // login_uri\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  nonce: optional(string()),\n  g_csrf_token: optional(string()),\n  hd: optional(string()),\n  // callback\n  credential: optional(string()),\n});\n\nexport class OAuth2Client {\n  private config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get successUri() {\n    return this.config.successUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  private async getClientConfig(registrationId: string) {\n    const registrations =\n      typeof this.config.registration === 'function'\n        ? await this.config.registration()\n        : this.config.registration;\n\n    const registration = registrations[registrationId];\n    invariant(registration, `Registration ${registrationId} not found`);\n\n    const provider = this.config.provider[registration.provider ?? registrationId];\n    invariant(provider, `Provider ${registration.provider ?? registrationId} not found`);\n    return { registration, provider };\n  }\n\n  async createAuthorizationUri({\n    registrationId,\n    state,\n    pkce,\n  }: {\n    registrationId: string;\n    state: string;\n    pkce?: PkceParameters;\n  }): Promise<URL> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { scope, clientId, redirectUri } = registration;\n    return provider.createAuthorizationUri({\n      pkce,\n      state,\n      scope,\n      clientId,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async exchangeAuthorizationCode({\n    registrationId,\n    code,\n    pkce,\n  }: {\n    registrationId: string;\n    code: string;\n    pkce?: PkceParameters;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n    return provider.exchangeAuthorizationCode({\n      code,\n      pkce,\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async getUserInfo({\n    registrationId,\n    token,\n  }: {\n    registrationId: string;\n    token: OAuth2Token | OidcToken;\n  }) {\n    const { provider } = await this.getClientConfig(registrationId);\n    return provider.getUserInfo(token);\n  }\n\n  async refreshAccessToken({\n    registrationId,\n    refreshToken,\n  }: {\n    registrationId: string;\n    refreshToken: string;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    return provider.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken(registrationId: string, token: string) {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.revokeToken, 'Provider does not support revokeToken');\n    await provider.revokeToken({ token, clientId, clientSecret });\n  }\n\n  async loginOAuth2Native({\n    registrationId,\n    credentials,\n    pkce,\n  }: {\n    registrationId: string;\n    credentials: NativeCredential;\n    pkce?: PkceParameters;\n  }) {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    invariant(provider.loginOAuth2Native, 'Provider does not support loginOAuth2Native');\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n\n    return provider.loginOAuth2Native({\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n      credentials,\n      pkce,\n    });\n  }\n}\n"],"mappings":";;;AAUA,MAAa,4BAA4B,OAAO;CAC9C,MAAM,SAAS,OAAO,CAAC;CACvB,OAAO,SAAS,OAAO,CAAC;CACxB,OAAO,SAAS,OAAO,CAAC;CACxB,mBAAmB,SAAS,OAAO,CAAC;CACpC,WAAW,SAAS,OAAO,CAAC;AAC9B,CAAC;AAED,MAAa,qBAAqB,OAAO;CAEvC,MAAM,SAAS,OAAO,CAAC;CACvB,OAAO,SAAS,OAAO,CAAC;CACxB,OAAO,SAAS,OAAO,CAAC;CACxB,mBAAmB,SAAS,OAAO,CAAC;CACpC,WAAW,SAAS,OAAO,CAAC;CAC5B,OAAO,SAAS,OAAO,CAAC;CACxB,cAAc,SAAS,OAAO,CAAC;CAC/B,IAAI,SAAS,OAAO,CAAC;CAErB,YAAY,SAAS,OAAO,CAAC;AAC/B,CAAC;AAED,IAAa,eAAb,MAA0B;CACxB;CACA,YAAY,QAA4B;EACtC,KAAK,SAAS;CAChB;CAEA,IAAI,UAAU;EACZ,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,aAAa;EACf,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,WAAW;EACb,OAAO,KAAK,OAAO;CACrB;CAEA,MAAc,gBAAgB,gBAAwB;EAMpD,MAAM,gBAJJ,OAAO,KAAK,OAAO,iBAAiB,aAChC,MAAM,KAAK,OAAO,aAAa,IAC/B,KAAK,OAAO,aAAA,CAEiB;EACnC,UAAU,cAAc,gBAAgB,eAAe,WAAW;EAElE,MAAM,WAAW,KAAK,OAAO,SAAS,aAAa,YAAY;EAC/D,UAAU,UAAU,YAAY,aAAa,YAAY,eAAe,WAAW;EACnF,OAAO;GAAE;GAAc;EAAS;CAClC;CAEA,MAAM,uBAAuB,EAC3B,gBACA,OACA,QAKe;EACf,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAE5E,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,OAAO,UAAU,gBAAgB;EACzC,OAAO,SAAS,uBAAuB;GACrC;GACA;GACA;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;EAC9D,CAAC;CACH;CAEA,MAAM,0BAA0B,EAC9B,gBACA,MACA,QAKuB;EACvB,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAE5E,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,UAAU,cAAc,gBAAgB;EAChD,OAAO,SAAS,0BAA0B;GACxC;GACA;GACA;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;EAC9D,CAAC;CACH;CAEA,MAAM,YAAY,EAChB,gBACA,SAIC;EACD,MAAM,EAAE,aAAa,MAAM,KAAK,gBAAgB,cAAc;EAC9D,OAAO,SAAS,YAAY,KAAK;CACnC;CAEA,MAAM,mBAAmB,EACvB,gBACA,gBAIuB;EACvB,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,MAAM,EAAE,UAAU,iBAAiB;EAEnC,UAAU,SAAS,oBAAoB,8CAA8C;EACrF,OAAO,SAAS,mBAAmB;GAAE;GAAc;GAAU;EAAa,CAAC;CAC7E;CAEA,MAAM,YAAY,gBAAwB,OAAe;EACvD,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,MAAM,EAAE,UAAU,iBAAiB;EAEnC,UAAU,SAAS,aAAa,uCAAuC;EACvE,MAAM,SAAS,YAAY;GAAE;GAAO;GAAU;EAAa,CAAC;CAC9D;CAEA,MAAM,kBAAkB,EACtB,gBACA,aACA,QAKC;EACD,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,UAAU,SAAS,mBAAmB,6CAA6C;EACnF,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,UAAU,cAAc,gBAAgB;EAEhD,OAAO,SAAS,kBAAkB;GAChC;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;GAC5D;GACA;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"client.mjs","names":[],"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { object, optional, string } from 'zod/v4-mini';\nimport type {\n  NativeCredential,\n  OAuth2ClientConfig,\n  OAuth2Token,\n  OidcToken,\n  PkceParameters,\n} from './types';\n\nexport const oauth2RedirectQuerySchema = object({\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n});\n\nexport const googleOneTapSchema = object({\n  // login_uri\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  nonce: optional(string()),\n  g_csrf_token: optional(string()),\n  hd: optional(string()),\n  // callback\n  credential: optional(string()),\n});\n\nexport class OAuth2Client {\n  private readonly config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get successUri() {\n    return this.config.successUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  private async getClientConfig(registrationId: string) {\n    const registrations =\n      typeof this.config.registration === 'function'\n        ? await this.config.registration()\n        : this.config.registration;\n\n    const registration = registrations[registrationId];\n    invariant(registration, `Registration ${registrationId} not found`);\n\n    const provider = this.config.provider[registration.provider ?? registrationId];\n    invariant(provider, `Provider ${registration.provider ?? registrationId} not found`);\n    return { registration, provider };\n  }\n\n  async createAuthorizationUri({\n    registrationId,\n    state,\n    pkce,\n  }: {\n    registrationId: string;\n    state: string;\n    pkce?: PkceParameters;\n  }): Promise<URL> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { scope, clientId, redirectUri } = registration;\n    return provider.createAuthorizationUri({\n      pkce,\n      state,\n      scope,\n      clientId,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async exchangeAuthorizationCode({\n    registrationId,\n    code,\n    pkce,\n  }: {\n    registrationId: string;\n    code: string;\n    pkce?: PkceParameters;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n    return provider.exchangeAuthorizationCode({\n      code,\n      pkce,\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async getUserInfo({\n    registrationId,\n    token,\n  }: {\n    registrationId: string;\n    token: OAuth2Token | OidcToken;\n  }) {\n    const { provider } = await this.getClientConfig(registrationId);\n    return provider.getUserInfo(token);\n  }\n\n  async refreshAccessToken({\n    registrationId,\n    refreshToken,\n  }: {\n    registrationId: string;\n    refreshToken: string;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    return provider.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken(registrationId: string, token: string) {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.revokeToken, 'Provider does not support revokeToken');\n    await provider.revokeToken({ token, clientId, clientSecret });\n  }\n\n  async loginOAuth2Native({\n    registrationId,\n    credentials,\n    pkce,\n  }: {\n    registrationId: string;\n    credentials: NativeCredential;\n    pkce?: PkceParameters;\n  }) {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    invariant(provider.loginOAuth2Native, 'Provider does not support loginOAuth2Native');\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n\n    return provider.loginOAuth2Native({\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n      credentials,\n      pkce,\n    });\n  }\n}\n"],"mappings":";;;AAUA,MAAa,4BAA4B,OAAO;CAC9C,MAAM,SAAS,OAAO,CAAC;CACvB,OAAO,SAAS,OAAO,CAAC;CACxB,OAAO,SAAS,OAAO,CAAC;CACxB,mBAAmB,SAAS,OAAO,CAAC;CACpC,WAAW,SAAS,OAAO,CAAC;AAC9B,CAAC;AAED,MAAa,qBAAqB,OAAO;CAEvC,MAAM,SAAS,OAAO,CAAC;CACvB,OAAO,SAAS,OAAO,CAAC;CACxB,OAAO,SAAS,OAAO,CAAC;CACxB,mBAAmB,SAAS,OAAO,CAAC;CACpC,WAAW,SAAS,OAAO,CAAC;CAC5B,OAAO,SAAS,OAAO,CAAC;CACxB,cAAc,SAAS,OAAO,CAAC;CAC/B,IAAI,SAAS,OAAO,CAAC;CAErB,YAAY,SAAS,OAAO,CAAC;AAC/B,CAAC;AAED,IAAa,eAAb,MAA0B;CACxB;CACA,YAAY,QAA4B;EACtC,KAAK,SAAS;CAChB;CAEA,IAAI,UAAU;EACZ,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,aAAa;EACf,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,WAAW;EACb,OAAO,KAAK,OAAO;CACrB;CAEA,MAAc,gBAAgB,gBAAwB;EAMpD,MAAM,gBAJJ,OAAO,KAAK,OAAO,iBAAiB,aAChC,MAAM,KAAK,OAAO,aAAa,IAC/B,KAAK,OAAO,aAAA,CAEiB;EACnC,UAAU,cAAc,gBAAgB,eAAe,WAAW;EAElE,MAAM,WAAW,KAAK,OAAO,SAAS,aAAa,YAAY;EAC/D,UAAU,UAAU,YAAY,aAAa,YAAY,eAAe,WAAW;EACnF,OAAO;GAAE;GAAc;EAAS;CAClC;CAEA,MAAM,uBAAuB,EAC3B,gBACA,OACA,QAKe;EACf,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAE5E,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,OAAO,UAAU,gBAAgB;EACzC,OAAO,SAAS,uBAAuB;GACrC;GACA;GACA;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;EAC9D,CAAC;CACH;CAEA,MAAM,0BAA0B,EAC9B,gBACA,MACA,QAKuB;EACvB,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAE5E,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,UAAU,cAAc,gBAAgB;EAChD,OAAO,SAAS,0BAA0B;GACxC;GACA;GACA;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;EAC9D,CAAC;CACH;CAEA,MAAM,YAAY,EAChB,gBACA,SAIC;EACD,MAAM,EAAE,aAAa,MAAM,KAAK,gBAAgB,cAAc;EAC9D,OAAO,SAAS,YAAY,KAAK;CACnC;CAEA,MAAM,mBAAmB,EACvB,gBACA,gBAIuB;EACvB,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,MAAM,EAAE,UAAU,iBAAiB;EAEnC,UAAU,SAAS,oBAAoB,8CAA8C;EACrF,OAAO,SAAS,mBAAmB;GAAE;GAAc;GAAU;EAAa,CAAC;CAC7E;CAEA,MAAM,YAAY,gBAAwB,OAAe;EACvD,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,MAAM,EAAE,UAAU,iBAAiB;EAEnC,UAAU,SAAS,aAAa,uCAAuC;EACvE,MAAM,SAAS,YAAY;GAAE;GAAO;GAAU;EAAa,CAAC;CAC9D;CAEA,MAAM,kBAAkB,EACtB,gBACA,aACA,QAKC;EACD,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,UAAU,SAAS,mBAAmB,6CAA6C;EACnF,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,UAAU,cAAc,gBAAgB;EAEhD,OAAO,SAAS,kBAAkB;GAChC;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;GAC5D;GACA;EACF,CAAC;CACH;AACF"}

package/dist/oauth2/provider/github.cjs

@@ -42,7 +42,7 @@ function createGithubProvider() {
 			if (!emailResponse.ok) throw new require_oauth2_error.OAuth2Error(emailResponse.status, "invalid_request", "Failed to fetch user email");
 			const emails = await emailResponse.json();
 			data.email = emails.find((email) => email.primary)?.email || data.email;
-			const email_verified = emails.find((email) => email.email === data.email)?.verified || false;
+			const email_verified = emails.find((email) => email.email === data.email)?.verified ?? false;
 			return {
 				data,
 				claims: {

package/dist/oauth2/provider/github.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"github.cjs","names":["createAuthorizationUri","exchangeAuthorizationCode","OAuth2Error"],"sources":["../../../src/oauth2/provider/github.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { OAuth2Token, Provider } from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode } from './common';\n\nexport function createGithubProvider(): Provider {\n  return {\n    authorizationUri: 'https://github.com/login/oauth/authorize',\n    tokenUri: 'https://github.com/login/oauth/access_token',\n    userInfoUri: 'https://api.github.com/user',\n    userNameAttribute: 'id',\n    defaultScope: ['user:email'],\n    createAuthorizationUri({ pkce: _, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce: _, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GithubErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as GithubToken;\n    },\n    async getUserInfo({ access_token }) {\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n      const headers = { Accept: 'application/json', Authorization: `Bearer ${access_token}` };\n      const response = await fetch(this.userInfoUri, { headers });\n      if (!response.ok) {\n        throw new OAuth2Error(response.status, 'invalid_request', 'Failed to fetch user info');\n      }\n      const data = (await response.json()) as GithubUserInfo;\n      const emailResponse = await fetch('https://api.github.com/user/emails', { headers });\n      if (!emailResponse.ok) {\n        throw new OAuth2Error(\n          emailResponse.status,\n          'invalid_request',\n          'Failed to fetch user email'\n        );\n      }\n      const emails = (await emailResponse.json()) as GithubEmail[];\n      data.email = emails.find((email) => email.primary)?.email || data.email;\n      const email_verified = emails.find((email) => email.email === data.email)?.verified || false;\n      return {\n        data,\n        claims: {\n          sub: data.id,\n          name: data.name || data.login,\n          email_verified,\n          email: data.email,\n          picture: data.avatar_url,\n          profile: data.html_url,\n          website: data.html_url,\n          updated_at: data.updated_at ? Date.parse(data.updated_at) : undefined,\n        },\n      };\n    },\n  };\n}\n\nexport const github = createGithubProvider();\n\nexport interface GithubUserInfo {\n  login: string;\n  id: string;\n  node_id: string;\n  avatar_url: string;\n  gravatar_id: string;\n  url: string;\n  html_url: string;\n  followers_url: string;\n  following_url: string;\n  gists_url: string;\n  starred_url: string;\n  subscriptions_url: string;\n  organizations_url: string;\n  repos_url: string;\n  events_url: string;\n  received_events_url: string;\n  type: string;\n  site_admin: boolean;\n  name: string;\n  company: string;\n  blog: string;\n  location: string;\n  email: string;\n  hireable: boolean;\n  bio: string;\n  twitter_username: string;\n  public_repos: string;\n  public_gists: string;\n  followers: string;\n  following: string;\n  created_at: string;\n  updated_at: string;\n  private_gists: string;\n  total_private_repos: string;\n  owned_private_repos: string;\n  disk_usage: string;\n  collaborators: string;\n  two_factor_authentication: boolean;\n  plan: {\n    name: string;\n    space: string;\n    private_repos: string;\n    collaborators: string;\n  };\n}\n\ninterface GithubEmail {\n  email: string;\n  primary: boolean;\n  verified: boolean;\n  visibility: 'public' | 'private';\n}\n\nexport interface GithubToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  scope: string;\n  expires_in: number;\n  refresh_token: string;\n}\n\ninterface GithubErrorResponse {\n  error: string;\n  error_description: string;\n  error_uri: string;\n}\n"],"mappings":";;;;;AAKA,SAAgB,uBAAiC;CAC/C,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,aAAa;EACb,mBAAmB;EACnB,cAAc,CAAC,YAAY;EAC3B,uBAAuB,EAAE,MAAM,GAAG,GAAG,UAAU;GAC7C,OAAOA,+BAAAA,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,GAAG,UAAU;GACtD,MAAM,WAAW,MAAMC,+BAAAA,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,gBAAgB;GAClC,CAAA,GAAA,cAAA,UAAA,CAAU,cAAc,0BAA0B;GAClD,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,aAAa,yBAAyB;GACrD,MAAM,UAAU;IAAE,QAAQ;IAAoB,eAAe,UAAU;GAAe;GACtF,MAAM,WAAW,MAAM,MAAM,KAAK,aAAa,EAAE,QAAQ,CAAC;GAC1D,IAAI,CAAC,SAAS,IACZ,MAAM,IAAIA,qBAAAA,YAAY,SAAS,QAAQ,mBAAmB,2BAA2B;GAEvF,MAAM,OAAQ,MAAM,SAAS,KAAK;GAClC,MAAM,gBAAgB,MAAM,MAAM,sCAAsC,EAAE,QAAQ,CAAC;GACnF,IAAI,CAAC,cAAc,IACjB,MAAM,IAAIA,qBAAAA,YACR,cAAc,QACd,mBACA,4BACF;GAEF,MAAM,SAAU,MAAM,cAAc,KAAK;GACzC,KAAK,QAAQ,OAAO,MAAM,UAAU,MAAM,OAAO,CAAC,EAAE,SAAS,KAAK;GAClE,MAAM,iBAAiB,OAAO,MAAM,UAAU,MAAM,UAAU,KAAK,KAAK,CAAC,EAAE,YAAY;GACvF,OAAO;IACL;IACA,QAAQ;KACN,KAAK,KAAK;KACV,MAAM,KAAK,QAAQ,KAAK;KACxB;KACA,OAAO,KAAK;KACZ,SAAS,KAAK;KACd,SAAS,KAAK;KACd,SAAS,KAAK;KACd,YAAY,KAAK,aAAa,KAAK,MAAM,KAAK,UAAU,IAAI,KAAA;IAC9D;GACF;EACF;CACF;AACF;AAEA,MAAa,SAAS,qBAAqB"}
+{"version":3,"file":"github.cjs","names":["createAuthorizationUri","exchangeAuthorizationCode","OAuth2Error"],"sources":["../../../src/oauth2/provider/github.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { OAuth2Token, Provider } from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode } from './common';\n\nexport function createGithubProvider(): Provider {\n  return {\n    authorizationUri: 'https://github.com/login/oauth/authorize',\n    tokenUri: 'https://github.com/login/oauth/access_token',\n    userInfoUri: 'https://api.github.com/user',\n    userNameAttribute: 'id',\n    defaultScope: ['user:email'],\n    createAuthorizationUri({ pkce: _, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce: _, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GithubErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as GithubToken;\n    },\n    async getUserInfo({ access_token }) {\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n      const headers = { Accept: 'application/json', Authorization: `Bearer ${access_token}` };\n      const response = await fetch(this.userInfoUri, { headers });\n      if (!response.ok) {\n        throw new OAuth2Error(response.status, 'invalid_request', 'Failed to fetch user info');\n      }\n      const data = (await response.json()) as GithubUserInfo;\n      const emailResponse = await fetch('https://api.github.com/user/emails', { headers });\n      if (!emailResponse.ok) {\n        throw new OAuth2Error(\n          emailResponse.status,\n          'invalid_request',\n          'Failed to fetch user email'\n        );\n      }\n      const emails = (await emailResponse.json()) as GithubEmail[];\n      data.email = emails.find((email) => email.primary)?.email || data.email;\n      const email_verified = emails.find((email) => email.email === data.email)?.verified ?? false;\n      return {\n        data,\n        claims: {\n          sub: data.id,\n          name: data.name || data.login,\n          email_verified,\n          email: data.email,\n          picture: data.avatar_url,\n          profile: data.html_url,\n          website: data.html_url,\n          updated_at: data.updated_at ? Date.parse(data.updated_at) : undefined,\n        },\n      };\n    },\n  };\n}\n\nexport const github = createGithubProvider();\n\nexport interface GithubUserInfo {\n  login: string;\n  id: string;\n  node_id: string;\n  avatar_url: string;\n  gravatar_id: string;\n  url: string;\n  html_url: string;\n  followers_url: string;\n  following_url: string;\n  gists_url: string;\n  starred_url: string;\n  subscriptions_url: string;\n  organizations_url: string;\n  repos_url: string;\n  events_url: string;\n  received_events_url: string;\n  type: string;\n  site_admin: boolean;\n  name: string;\n  company: string;\n  blog: string;\n  location: string;\n  email: string;\n  hireable: boolean;\n  bio: string;\n  twitter_username: string;\n  public_repos: string;\n  public_gists: string;\n  followers: string;\n  following: string;\n  created_at: string;\n  updated_at: string;\n  private_gists: string;\n  total_private_repos: string;\n  owned_private_repos: string;\n  disk_usage: string;\n  collaborators: string;\n  two_factor_authentication: boolean;\n  plan: {\n    name: string;\n    space: string;\n    private_repos: string;\n    collaborators: string;\n  };\n}\n\ninterface GithubEmail {\n  email: string;\n  primary: boolean;\n  verified: boolean;\n  visibility: 'public' | 'private';\n}\n\nexport interface GithubToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  scope: string;\n  expires_in: number;\n  refresh_token: string;\n}\n\ninterface GithubErrorResponse {\n  error: string;\n  error_description: string;\n  error_uri: string;\n}\n"],"mappings":";;;;;AAKA,SAAgB,uBAAiC;CAC/C,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,aAAa;EACb,mBAAmB;EACnB,cAAc,CAAC,YAAY;EAC3B,uBAAuB,EAAE,MAAM,GAAG,GAAG,UAAU;GAC7C,OAAOA,+BAAAA,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,GAAG,UAAU;GACtD,MAAM,WAAW,MAAMC,+BAAAA,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,gBAAgB;GAClC,CAAA,GAAA,cAAA,UAAA,CAAU,cAAc,0BAA0B;GAClD,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,aAAa,yBAAyB;GACrD,MAAM,UAAU;IAAE,QAAQ;IAAoB,eAAe,UAAU;GAAe;GACtF,MAAM,WAAW,MAAM,MAAM,KAAK,aAAa,EAAE,QAAQ,CAAC;GAC1D,IAAI,CAAC,SAAS,IACZ,MAAM,IAAIA,qBAAAA,YAAY,SAAS,QAAQ,mBAAmB,2BAA2B;GAEvF,MAAM,OAAQ,MAAM,SAAS,KAAK;GAClC,MAAM,gBAAgB,MAAM,MAAM,sCAAsC,EAAE,QAAQ,CAAC;GACnF,IAAI,CAAC,cAAc,IACjB,MAAM,IAAIA,qBAAAA,YACR,cAAc,QACd,mBACA,4BACF;GAEF,MAAM,SAAU,MAAM,cAAc,KAAK;GACzC,KAAK,QAAQ,OAAO,MAAM,UAAU,MAAM,OAAO,CAAC,EAAE,SAAS,KAAK;GAClE,MAAM,iBAAiB,OAAO,MAAM,UAAU,MAAM,UAAU,KAAK,KAAK,CAAC,EAAE,YAAY;GACvF,OAAO;IACL;IACA,QAAQ;KACN,KAAK,KAAK;KACV,MAAM,KAAK,QAAQ,KAAK;KACxB;KACA,OAAO,KAAK;KACZ,SAAS,KAAK;KACd,SAAS,KAAK;KACd,SAAS,KAAK;KACd,YAAY,KAAK,aAAa,KAAK,MAAM,KAAK,UAAU,IAAI,KAAA;IAC9D;GACF;EACF;CACF;AACF;AAEA,MAAa,SAAS,qBAAqB"}

package/dist/oauth2/provider/github.mjs

@@ -41,7 +41,7 @@ function createGithubProvider() {
 			if (!emailResponse.ok) throw new OAuth2Error(emailResponse.status, "invalid_request", "Failed to fetch user email");
 			const emails = await emailResponse.json();
 			data.email = emails.find((email) => email.primary)?.email || data.email;
-			const email_verified = emails.find((email) => email.email === data.email)?.verified || false;
+			const email_verified = emails.find((email) => email.email === data.email)?.verified ?? false;
 			return {
 				data,
 				claims: {

package/dist/oauth2/provider/github.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"github.mjs","names":[],"sources":["../../../src/oauth2/provider/github.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { OAuth2Token, Provider } from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode } from './common';\n\nexport function createGithubProvider(): Provider {\n  return {\n    authorizationUri: 'https://github.com/login/oauth/authorize',\n    tokenUri: 'https://github.com/login/oauth/access_token',\n    userInfoUri: 'https://api.github.com/user',\n    userNameAttribute: 'id',\n    defaultScope: ['user:email'],\n    createAuthorizationUri({ pkce: _, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce: _, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GithubErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as GithubToken;\n    },\n    async getUserInfo({ access_token }) {\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n      const headers = { Accept: 'application/json', Authorization: `Bearer ${access_token}` };\n      const response = await fetch(this.userInfoUri, { headers });\n      if (!response.ok) {\n        throw new OAuth2Error(response.status, 'invalid_request', 'Failed to fetch user info');\n      }\n      const data = (await response.json()) as GithubUserInfo;\n      const emailResponse = await fetch('https://api.github.com/user/emails', { headers });\n      if (!emailResponse.ok) {\n        throw new OAuth2Error(\n          emailResponse.status,\n          'invalid_request',\n          'Failed to fetch user email'\n        );\n      }\n      const emails = (await emailResponse.json()) as GithubEmail[];\n      data.email = emails.find((email) => email.primary)?.email || data.email;\n      const email_verified = emails.find((email) => email.email === data.email)?.verified || false;\n      return {\n        data,\n        claims: {\n          sub: data.id,\n          name: data.name || data.login,\n          email_verified,\n          email: data.email,\n          picture: data.avatar_url,\n          profile: data.html_url,\n          website: data.html_url,\n          updated_at: data.updated_at ? Date.parse(data.updated_at) : undefined,\n        },\n      };\n    },\n  };\n}\n\nexport const github = createGithubProvider();\n\nexport interface GithubUserInfo {\n  login: string;\n  id: string;\n  node_id: string;\n  avatar_url: string;\n  gravatar_id: string;\n  url: string;\n  html_url: string;\n  followers_url: string;\n  following_url: string;\n  gists_url: string;\n  starred_url: string;\n  subscriptions_url: string;\n  organizations_url: string;\n  repos_url: string;\n  events_url: string;\n  received_events_url: string;\n  type: string;\n  site_admin: boolean;\n  name: string;\n  company: string;\n  blog: string;\n  location: string;\n  email: string;\n  hireable: boolean;\n  bio: string;\n  twitter_username: string;\n  public_repos: string;\n  public_gists: string;\n  followers: string;\n  following: string;\n  created_at: string;\n  updated_at: string;\n  private_gists: string;\n  total_private_repos: string;\n  owned_private_repos: string;\n  disk_usage: string;\n  collaborators: string;\n  two_factor_authentication: boolean;\n  plan: {\n    name: string;\n    space: string;\n    private_repos: string;\n    collaborators: string;\n  };\n}\n\ninterface GithubEmail {\n  email: string;\n  primary: boolean;\n  verified: boolean;\n  visibility: 'public' | 'private';\n}\n\nexport interface GithubToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  scope: string;\n  expires_in: number;\n  refresh_token: string;\n}\n\ninterface GithubErrorResponse {\n  error: string;\n  error_description: string;\n  error_uri: string;\n}\n"],"mappings":";;;;AAKA,SAAgB,uBAAiC;CAC/C,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,aAAa;EACb,mBAAmB;EACnB,cAAc,CAAC,YAAY;EAC3B,uBAAuB,EAAE,MAAM,GAAG,GAAG,UAAU;GAC7C,OAAO,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,GAAG,UAAU;GACtD,MAAM,WAAW,MAAM,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,gBAAgB;GAClC,UAAU,cAAc,0BAA0B;GAClD,UAAU,KAAK,aAAa,yBAAyB;GACrD,MAAM,UAAU;IAAE,QAAQ;IAAoB,eAAe,UAAU;GAAe;GACtF,MAAM,WAAW,MAAM,MAAM,KAAK,aAAa,EAAE,QAAQ,CAAC;GAC1D,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,YAAY,SAAS,QAAQ,mBAAmB,2BAA2B;GAEvF,MAAM,OAAQ,MAAM,SAAS,KAAK;GAClC,MAAM,gBAAgB,MAAM,MAAM,sCAAsC,EAAE,QAAQ,CAAC;GACnF,IAAI,CAAC,cAAc,IACjB,MAAM,IAAI,YACR,cAAc,QACd,mBACA,4BACF;GAEF,MAAM,SAAU,MAAM,cAAc,KAAK;GACzC,KAAK,QAAQ,OAAO,MAAM,UAAU,MAAM,OAAO,CAAC,EAAE,SAAS,KAAK;GAClE,MAAM,iBAAiB,OAAO,MAAM,UAAU,MAAM,UAAU,KAAK,KAAK,CAAC,EAAE,YAAY;GACvF,OAAO;IACL;IACA,QAAQ;KACN,KAAK,KAAK;KACV,MAAM,KAAK,QAAQ,KAAK;KACxB;KACA,OAAO,KAAK;KACZ,SAAS,KAAK;KACd,SAAS,KAAK;KACd,SAAS,KAAK;KACd,YAAY,KAAK,aAAa,KAAK,MAAM,KAAK,UAAU,IAAI,KAAA;IAC9D;GACF;EACF;CACF;AACF;AAEA,MAAa,SAAS,qBAAqB"}
+{"version":3,"file":"github.mjs","names":[],"sources":["../../../src/oauth2/provider/github.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { OAuth2Token, Provider } from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode } from './common';\n\nexport function createGithubProvider(): Provider {\n  return {\n    authorizationUri: 'https://github.com/login/oauth/authorize',\n    tokenUri: 'https://github.com/login/oauth/access_token',\n    userInfoUri: 'https://api.github.com/user',\n    userNameAttribute: 'id',\n    defaultScope: ['user:email'],\n    createAuthorizationUri({ pkce: _, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce: _, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GithubErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as GithubToken;\n    },\n    async getUserInfo({ access_token }) {\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n      const headers = { Accept: 'application/json', Authorization: `Bearer ${access_token}` };\n      const response = await fetch(this.userInfoUri, { headers });\n      if (!response.ok) {\n        throw new OAuth2Error(response.status, 'invalid_request', 'Failed to fetch user info');\n      }\n      const data = (await response.json()) as GithubUserInfo;\n      const emailResponse = await fetch('https://api.github.com/user/emails', { headers });\n      if (!emailResponse.ok) {\n        throw new OAuth2Error(\n          emailResponse.status,\n          'invalid_request',\n          'Failed to fetch user email'\n        );\n      }\n      const emails = (await emailResponse.json()) as GithubEmail[];\n      data.email = emails.find((email) => email.primary)?.email || data.email;\n      const email_verified = emails.find((email) => email.email === data.email)?.verified ?? false;\n      return {\n        data,\n        claims: {\n          sub: data.id,\n          name: data.name || data.login,\n          email_verified,\n          email: data.email,\n          picture: data.avatar_url,\n          profile: data.html_url,\n          website: data.html_url,\n          updated_at: data.updated_at ? Date.parse(data.updated_at) : undefined,\n        },\n      };\n    },\n  };\n}\n\nexport const github = createGithubProvider();\n\nexport interface GithubUserInfo {\n  login: string;\n  id: string;\n  node_id: string;\n  avatar_url: string;\n  gravatar_id: string;\n  url: string;\n  html_url: string;\n  followers_url: string;\n  following_url: string;\n  gists_url: string;\n  starred_url: string;\n  subscriptions_url: string;\n  organizations_url: string;\n  repos_url: string;\n  events_url: string;\n  received_events_url: string;\n  type: string;\n  site_admin: boolean;\n  name: string;\n  company: string;\n  blog: string;\n  location: string;\n  email: string;\n  hireable: boolean;\n  bio: string;\n  twitter_username: string;\n  public_repos: string;\n  public_gists: string;\n  followers: string;\n  following: string;\n  created_at: string;\n  updated_at: string;\n  private_gists: string;\n  total_private_repos: string;\n  owned_private_repos: string;\n  disk_usage: string;\n  collaborators: string;\n  two_factor_authentication: boolean;\n  plan: {\n    name: string;\n    space: string;\n    private_repos: string;\n    collaborators: string;\n  };\n}\n\ninterface GithubEmail {\n  email: string;\n  primary: boolean;\n  verified: boolean;\n  visibility: 'public' | 'private';\n}\n\nexport interface GithubToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  scope: string;\n  expires_in: number;\n  refresh_token: string;\n}\n\ninterface GithubErrorResponse {\n  error: string;\n  error_description: string;\n  error_uri: string;\n}\n"],"mappings":";;;;AAKA,SAAgB,uBAAiC;CAC/C,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,aAAa;EACb,mBAAmB;EACnB,cAAc,CAAC,YAAY;EAC3B,uBAAuB,EAAE,MAAM,GAAG,GAAG,UAAU;GAC7C,OAAO,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,GAAG,UAAU;GACtD,MAAM,WAAW,MAAM,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,gBAAgB;GAClC,UAAU,cAAc,0BAA0B;GAClD,UAAU,KAAK,aAAa,yBAAyB;GACrD,MAAM,UAAU;IAAE,QAAQ;IAAoB,eAAe,UAAU;GAAe;GACtF,MAAM,WAAW,MAAM,MAAM,KAAK,aAAa,EAAE,QAAQ,CAAC;GAC1D,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,YAAY,SAAS,QAAQ,mBAAmB,2BAA2B;GAEvF,MAAM,OAAQ,MAAM,SAAS,KAAK;GAClC,MAAM,gBAAgB,MAAM,MAAM,sCAAsC,EAAE,QAAQ,CAAC;GACnF,IAAI,CAAC,cAAc,IACjB,MAAM,IAAI,YACR,cAAc,QACd,mBACA,4BACF;GAEF,MAAM,SAAU,MAAM,cAAc,KAAK;GACzC,KAAK,QAAQ,OAAO,MAAM,UAAU,MAAM,OAAO,CAAC,EAAE,SAAS,KAAK;GAClE,MAAM,iBAAiB,OAAO,MAAM,UAAU,MAAM,UAAU,KAAK,KAAK,CAAC,EAAE,YAAY;GACvF,OAAO;IACL;IACA,QAAQ;KACN,KAAK,KAAK;KACV,MAAM,KAAK,QAAQ,KAAK;KACxB;KACA,OAAO,KAAK;KACZ,SAAS,KAAK;KACd,SAAS,KAAK;KACd,SAAS,KAAK;KACd,YAAY,KAAK,aAAa,KAAK,MAAM,KAAK,UAAU,IAAI,KAAA;IAC9D;GACF;EACF;CACF;AACF;AAEA,MAAa,SAAS,qBAAqB"}

package/dist/oauth2/provider/x.cjs

@@ -68,7 +68,7 @@ function createXProvider(options) {
 					name: profile.data.name,
 					picture: profile.data.profile_image_url,
 					email: profile.data.email,
-					email_verified: profile.data.verified || false,
+					email_verified: profile.data.verified ?? false,
 					preferred_username: profile.data.username,
 					profile: `https://x.com/${profile.data.username}`,
 					website: profile.data.url

package/dist/oauth2/provider/x.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"x.cjs","names":["createAuthorizationUri","exchangeAuthorizationCode","OAuth2Error","refreshAccessToken","revokeToken"],"sources":["../../../src/oauth2/provider/x.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { OAuth2Token, Provider } from '../types';\nimport {\n  createAuthorizationUri,\n  exchangeAuthorizationCode,\n  refreshAccessToken,\n  revokeToken,\n} from './common';\n\nexport interface XOptions {\n  userFields?: UserField[];\n}\n\nconst defaultUserFields = [\n  'id',\n  'name',\n  'profile_image_url',\n  'url',\n  'username',\n  'location',\n  'verified',\n];\n\nexport function createXProvider(options?: XOptions): Provider {\n  return {\n    authorizationUri: 'https://x.com/i/oauth2/authorize',\n    tokenUri: 'https://api.x.com/2/oauth2/token',\n    tokenRefreshUri: 'https://api.x.com/2/oauth2/token',\n    tokenRevokeUri: 'https://api.x.com/2/oauth2/revoke',\n    // https://docs.x.com/x-api/users/user-lookup-me\n    userInfoUri: 'https://api.x.com/2/users/me',\n    defaultScope: ['users.read', 'tweet.read', 'offline.access'],\n    createAuthorizationUri(params) {\n      if (!params.pkce) throw new Error('pkce is required for x');\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      if (!params.pkce) throw new Error('pkce is required for x');\n      const response = await exchangeAuthorizationCode({\n        ...params,\n        tokenUri: this.tokenUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XToken;\n    },\n    async getUserInfo({ access_token }) {\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n\n      const userFields = options?.userFields ?? defaultUserFields;\n      const headers = { Accept: 'application/json', Authorization: `Bearer ${access_token}` };\n\n      const url = new URL(this.userInfoUri);\n      userFields.forEach((field) => url.searchParams.append('user.fields', field));\n\n      const response = await fetch(this.userInfoUri, { headers });\n      if (!response.ok) {\n        const { errors } = (await response.json()) as XAPIErrorResponse;\n        throw new OAuth2Error(\n          response.status,\n          'invalid_request',\n          `Failed to fetch user info: ${errors.at(0)?.detail ?? errors.at(0)?.title}`\n        );\n      }\n      const profile = (await response.json()) as XUserInfo;\n      return {\n        data: profile,\n        claims: {\n          sub: profile.data.id,\n          name: profile.data.name,\n          picture: profile.data.profile_image_url,\n          email: profile.data.email,\n          email_verified: profile.data.verified || false,\n          preferred_username: profile.data.username,\n          profile: `https://x.com/${profile.data.username}`,\n          website: profile.data.url,\n        },\n      };\n    },\n    async refreshAccessToken(params) {\n      invariant(this.tokenRefreshUri, 'tokenRefreshUri is required');\n      const response = await refreshAccessToken({\n        ...params,\n        tokenUri: this.tokenRefreshUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XToken;\n    },\n    async revokeToken(params) {\n      invariant(this.tokenRevokeUri, 'tokenRevokeUri is required');\n      return revokeToken({\n        ...params,\n        tokenRevokeUri: this.tokenRevokeUri,\n        authentication: 'basic',\n      });\n    },\n  };\n}\n\nexport const x = createXProvider();\n\ntype UserField =\n  | 'affiliation'\n  | 'connection_status'\n  | 'created_at'\n  | 'description'\n  | 'entities'\n  | 'id'\n  | 'is_identity_verified'\n  | 'location'\n  | 'most_recent_tweet_id'\n  | 'name'\n  | 'parody'\n  | 'pinned_tweet_id'\n  | 'profile_banner_url'\n  | 'profile_image_url'\n  | 'protected'\n  | 'public_metrics'\n  | 'receives_your_dm'\n  | 'subscription'\n  | 'subscription_type'\n  | 'url'\n  | 'username'\n  | 'verified'\n  | 'verified_followers_count'\n  | 'verified_type'\n  | 'withheld';\n\nexport interface XUser {\n  id: string;\n  name: string;\n  email?: string;\n  username: string;\n  location?: string;\n  entities?: {\n    url: { urls: UrlEntity[] };\n    description: {\n      hashtags: HashtagEntity[];\n      cashtags: HashtagEntity[];\n      mentions: MentionEntity[];\n    };\n  };\n  verified?: boolean;\n  description?: string;\n  url?: string;\n  profile_image_url?: string;\n  protected?: boolean;\n  pinned_tweet_id?: string;\n  created_at?: string;\n}\n\nexport interface XUserInfo {\n  data: XUser;\n  includes?: { tweets?: { id: string; text: string }[]; users?: XUser[] };\n}\n\ntype UrlEntity = {\n  start: number;\n  end: number;\n  url: string;\n  display_url: string;\n  expanded_url: string;\n};\ntype HashtagEntity = { start: number; end: number; tag: string };\ntype MentionEntity = { start: number; end: string; username: string };\n\nexport interface XToken extends OAuth2Token {\n  token_type: string;\n  expires_in: number;\n  access_token: string;\n  scope: string;\n  refresh_token: string;\n}\n\ntype XErrorResponse = { error: string; error_description: string };\ntype XAPIErrorResponse = {\n  errors: { title: string; type: string; detail?: string; status?: number }[];\n};\n"],"mappings":";;;;;AAcA,MAAM,oBAAoB;CACxB;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,SAAgB,gBAAgB,SAA8B;CAC5D,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,iBAAiB;EACjB,gBAAgB;EAEhB,aAAa;EACb,cAAc;GAAC;GAAc;GAAc;EAAgB;EAC3D,uBAAuB,QAAQ;GAC7B,IAAI,CAAC,OAAO,MAAM,MAAM,IAAI,MAAM,wBAAwB;GAC1D,OAAOA,+BAAAA,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,QAAQ;GACtC,IAAI,CAAC,OAAO,MAAM,MAAM,IAAI,MAAM,wBAAwB;GAC1D,MAAM,WAAW,MAAMC,+BAAAA,0BAA0B;IAC/C,GAAG;IACH,UAAU,KAAK;IACf,gBAAgB;GAClB,CAAC;GACD,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,gBAAgB;GAClC,CAAA,GAAA,cAAA,UAAA,CAAU,cAAc,0BAA0B;GAClD,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,aAAa,yBAAyB;GAErD,MAAM,aAAa,SAAS,cAAc;GAC1C,MAAM,UAAU;IAAE,QAAQ;IAAoB,eAAe,UAAU;GAAe;GAEtF,MAAM,MAAM,IAAI,IAAI,KAAK,WAAW;GACpC,WAAW,SAAS,UAAU,IAAI,aAAa,OAAO,eAAe,KAAK,CAAC;GAE3E,MAAM,WAAW,MAAM,MAAM,KAAK,aAAa,EAAE,QAAQ,CAAC;GAC1D,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,WAAY,MAAM,SAAS,KAAK;IACxC,MAAM,IAAIA,qBAAAA,YACR,SAAS,QACT,mBACA,8BAA8B,OAAO,GAAG,CAAC,CAAC,EAAE,UAAU,OAAO,GAAG,CAAC,CAAC,EAAE,OACtE;GACF;GACA,MAAM,UAAW,MAAM,SAAS,KAAK;GACrC,OAAO;IACL,MAAM;IACN,QAAQ;KACN,KAAK,QAAQ,KAAK;KAClB,MAAM,QAAQ,KAAK;KACnB,SAAS,QAAQ,KAAK;KACtB,OAAO,QAAQ,KAAK;KACpB,gBAAgB,QAAQ,KAAK,YAAY;KACzC,oBAAoB,QAAQ,KAAK;KACjC,SAAS,iBAAiB,QAAQ,KAAK;KACvC,SAAS,QAAQ,KAAK;IACxB;GACF;EACF;EACA,MAAM,mBAAmB,QAAQ;GAC/B,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,iBAAiB,6BAA6B;GAC7D,MAAM,WAAW,MAAMC,+BAAAA,mBAAmB;IACxC,GAAG;IACH,UAAU,KAAK;IACf,gBAAgB;GAClB,CAAC;GACD,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAID,qBAAAA,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,QAAQ;GACxB,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,gBAAgB,4BAA4B;GAC3D,OAAOE,+BAAAA,YAAY;IACjB,GAAG;IACH,gBAAgB,KAAK;IACrB,gBAAgB;GAClB,CAAC;EACH;CACF;AACF;AAEA,MAAa,IAAI,gBAAgB"}
+{"version":3,"file":"x.cjs","names":["createAuthorizationUri","exchangeAuthorizationCode","OAuth2Error","refreshAccessToken","revokeToken"],"sources":["../../../src/oauth2/provider/x.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { OAuth2Token, Provider } from '../types';\nimport {\n  createAuthorizationUri,\n  exchangeAuthorizationCode,\n  refreshAccessToken,\n  revokeToken,\n} from './common';\n\nexport interface XOptions {\n  userFields?: UserField[];\n}\n\nconst defaultUserFields = [\n  'id',\n  'name',\n  'profile_image_url',\n  'url',\n  'username',\n  'location',\n  'verified',\n];\n\nexport function createXProvider(options?: XOptions): Provider {\n  return {\n    authorizationUri: 'https://x.com/i/oauth2/authorize',\n    tokenUri: 'https://api.x.com/2/oauth2/token',\n    tokenRefreshUri: 'https://api.x.com/2/oauth2/token',\n    tokenRevokeUri: 'https://api.x.com/2/oauth2/revoke',\n    // https://docs.x.com/x-api/users/user-lookup-me\n    userInfoUri: 'https://api.x.com/2/users/me',\n    defaultScope: ['users.read', 'tweet.read', 'offline.access'],\n    createAuthorizationUri(params) {\n      if (!params.pkce) throw new Error('pkce is required for x');\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      if (!params.pkce) throw new Error('pkce is required for x');\n      const response = await exchangeAuthorizationCode({\n        ...params,\n        tokenUri: this.tokenUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XToken;\n    },\n    async getUserInfo({ access_token }) {\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n\n      const userFields = options?.userFields ?? defaultUserFields;\n      const headers = { Accept: 'application/json', Authorization: `Bearer ${access_token}` };\n\n      const url = new URL(this.userInfoUri);\n      userFields.forEach((field) => url.searchParams.append('user.fields', field));\n\n      const response = await fetch(this.userInfoUri, { headers });\n      if (!response.ok) {\n        const { errors } = (await response.json()) as XAPIErrorResponse;\n        throw new OAuth2Error(\n          response.status,\n          'invalid_request',\n          `Failed to fetch user info: ${errors.at(0)?.detail ?? errors.at(0)?.title}`\n        );\n      }\n      const profile = (await response.json()) as XUserInfo;\n      return {\n        data: profile,\n        claims: {\n          sub: profile.data.id,\n          name: profile.data.name,\n          picture: profile.data.profile_image_url,\n          email: profile.data.email,\n          email_verified: profile.data.verified ?? false,\n          preferred_username: profile.data.username,\n          profile: `https://x.com/${profile.data.username}`,\n          website: profile.data.url,\n        },\n      };\n    },\n    async refreshAccessToken(params) {\n      invariant(this.tokenRefreshUri, 'tokenRefreshUri is required');\n      const response = await refreshAccessToken({\n        ...params,\n        tokenUri: this.tokenRefreshUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XToken;\n    },\n    async revokeToken(params) {\n      invariant(this.tokenRevokeUri, 'tokenRevokeUri is required');\n      return revokeToken({\n        ...params,\n        tokenRevokeUri: this.tokenRevokeUri,\n        authentication: 'basic',\n      });\n    },\n  };\n}\n\nexport const x = createXProvider();\n\ntype UserField =\n  | 'affiliation'\n  | 'connection_status'\n  | 'created_at'\n  | 'description'\n  | 'entities'\n  | 'id'\n  | 'is_identity_verified'\n  | 'location'\n  | 'most_recent_tweet_id'\n  | 'name'\n  | 'parody'\n  | 'pinned_tweet_id'\n  | 'profile_banner_url'\n  | 'profile_image_url'\n  | 'protected'\n  | 'public_metrics'\n  | 'receives_your_dm'\n  | 'subscription'\n  | 'subscription_type'\n  | 'url'\n  | 'username'\n  | 'verified'\n  | 'verified_followers_count'\n  | 'verified_type'\n  | 'withheld';\n\nexport interface XUser {\n  id: string;\n  name: string;\n  email?: string;\n  username: string;\n  location?: string;\n  entities?: {\n    url: { urls: UrlEntity[] };\n    description: {\n      hashtags: HashtagEntity[];\n      cashtags: HashtagEntity[];\n      mentions: MentionEntity[];\n    };\n  };\n  verified?: boolean;\n  description?: string;\n  url?: string;\n  profile_image_url?: string;\n  protected?: boolean;\n  pinned_tweet_id?: string;\n  created_at?: string;\n}\n\nexport interface XUserInfo {\n  data: XUser;\n  includes?: { tweets?: { id: string; text: string }[]; users?: XUser[] };\n}\n\ntype UrlEntity = {\n  start: number;\n  end: number;\n  url: string;\n  display_url: string;\n  expanded_url: string;\n};\ntype HashtagEntity = { start: number; end: number; tag: string };\ntype MentionEntity = { start: number; end: string; username: string };\n\nexport interface XToken extends OAuth2Token {\n  token_type: string;\n  expires_in: number;\n  access_token: string;\n  scope: string;\n  refresh_token: string;\n}\n\ntype XErrorResponse = { error: string; error_description: string };\ntype XAPIErrorResponse = {\n  errors: { title: string; type: string; detail?: string; status?: number }[];\n};\n"],"mappings":";;;;;AAcA,MAAM,oBAAoB;CACxB;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,SAAgB,gBAAgB,SAA8B;CAC5D,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,iBAAiB;EACjB,gBAAgB;EAEhB,aAAa;EACb,cAAc;GAAC;GAAc;GAAc;EAAgB;EAC3D,uBAAuB,QAAQ;GAC7B,IAAI,CAAC,OAAO,MAAM,MAAM,IAAI,MAAM,wBAAwB;GAC1D,OAAOA,+BAAAA,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,QAAQ;GACtC,IAAI,CAAC,OAAO,MAAM,MAAM,IAAI,MAAM,wBAAwB;GAC1D,MAAM,WAAW,MAAMC,+BAAAA,0BAA0B;IAC/C,GAAG;IACH,UAAU,KAAK;IACf,gBAAgB;GAClB,CAAC;GACD,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,gBAAgB;GAClC,CAAA,GAAA,cAAA,UAAA,CAAU,cAAc,0BAA0B;GAClD,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,aAAa,yBAAyB;GAErD,MAAM,aAAa,SAAS,cAAc;GAC1C,MAAM,UAAU;IAAE,QAAQ;IAAoB,eAAe,UAAU;GAAe;GAEtF,MAAM,MAAM,IAAI,IAAI,KAAK,WAAW;GACpC,WAAW,SAAS,UAAU,IAAI,aAAa,OAAO,eAAe,KAAK,CAAC;GAE3E,MAAM,WAAW,MAAM,MAAM,KAAK,aAAa,EAAE,QAAQ,CAAC;GAC1D,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,WAAY,MAAM,SAAS,KAAK;IACxC,MAAM,IAAIA,qBAAAA,YACR,SAAS,QACT,mBACA,8BAA8B,OAAO,GAAG,CAAC,CAAC,EAAE,UAAU,OAAO,GAAG,CAAC,CAAC,EAAE,OACtE;GACF;GACA,MAAM,UAAW,MAAM,SAAS,KAAK;GACrC,OAAO;IACL,MAAM;IACN,QAAQ;KACN,KAAK,QAAQ,KAAK;KAClB,MAAM,QAAQ,KAAK;KACnB,SAAS,QAAQ,KAAK;KACtB,OAAO,QAAQ,KAAK;KACpB,gBAAgB,QAAQ,KAAK,YAAY;KACzC,oBAAoB,QAAQ,KAAK;KACjC,SAAS,iBAAiB,QAAQ,KAAK;KACvC,SAAS,QAAQ,KAAK;IACxB;GACF;EACF;EACA,MAAM,mBAAmB,QAAQ;GAC/B,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,iBAAiB,6BAA6B;GAC7D,MAAM,WAAW,MAAMC,+BAAAA,mBAAmB;IACxC,GAAG;IACH,UAAU,KAAK;IACf,gBAAgB;GAClB,CAAC;GACD,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAID,qBAAAA,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,QAAQ;GACxB,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,gBAAgB,4BAA4B;GAC3D,OAAOE,+BAAAA,YAAY;IACjB,GAAG;IACH,gBAAgB,KAAK;IACrB,gBAAgB;GAClB,CAAC;EACH;CACF;AACF;AAEA,MAAa,IAAI,gBAAgB"}

package/dist/oauth2/provider/x.mjs

@@ -67,7 +67,7 @@ function createXProvider(options) {
 					name: profile.data.name,
 					picture: profile.data.profile_image_url,
 					email: profile.data.email,
-					email_verified: profile.data.verified || false,
+					email_verified: profile.data.verified ?? false,
 					preferred_username: profile.data.username,
 					profile: `https://x.com/${profile.data.username}`,
 					website: profile.data.url

package/dist/oauth2/provider/x.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"x.mjs","names":[],"sources":["../../../src/oauth2/provider/x.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { OAuth2Token, Provider } from '../types';\nimport {\n  createAuthorizationUri,\n  exchangeAuthorizationCode,\n  refreshAccessToken,\n  revokeToken,\n} from './common';\n\nexport interface XOptions {\n  userFields?: UserField[];\n}\n\nconst defaultUserFields = [\n  'id',\n  'name',\n  'profile_image_url',\n  'url',\n  'username',\n  'location',\n  'verified',\n];\n\nexport function createXProvider(options?: XOptions): Provider {\n  return {\n    authorizationUri: 'https://x.com/i/oauth2/authorize',\n    tokenUri: 'https://api.x.com/2/oauth2/token',\n    tokenRefreshUri: 'https://api.x.com/2/oauth2/token',\n    tokenRevokeUri: 'https://api.x.com/2/oauth2/revoke',\n    // https://docs.x.com/x-api/users/user-lookup-me\n    userInfoUri: 'https://api.x.com/2/users/me',\n    defaultScope: ['users.read', 'tweet.read', 'offline.access'],\n    createAuthorizationUri(params) {\n      if (!params.pkce) throw new Error('pkce is required for x');\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      if (!params.pkce) throw new Error('pkce is required for x');\n      const response = await exchangeAuthorizationCode({\n        ...params,\n        tokenUri: this.tokenUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XToken;\n    },\n    async getUserInfo({ access_token }) {\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n\n      const userFields = options?.userFields ?? defaultUserFields;\n      const headers = { Accept: 'application/json', Authorization: `Bearer ${access_token}` };\n\n      const url = new URL(this.userInfoUri);\n      userFields.forEach((field) => url.searchParams.append('user.fields', field));\n\n      const response = await fetch(this.userInfoUri, { headers });\n      if (!response.ok) {\n        const { errors } = (await response.json()) as XAPIErrorResponse;\n        throw new OAuth2Error(\n          response.status,\n          'invalid_request',\n          `Failed to fetch user info: ${errors.at(0)?.detail ?? errors.at(0)?.title}`\n        );\n      }\n      const profile = (await response.json()) as XUserInfo;\n      return {\n        data: profile,\n        claims: {\n          sub: profile.data.id,\n          name: profile.data.name,\n          picture: profile.data.profile_image_url,\n          email: profile.data.email,\n          email_verified: profile.data.verified || false,\n          preferred_username: profile.data.username,\n          profile: `https://x.com/${profile.data.username}`,\n          website: profile.data.url,\n        },\n      };\n    },\n    async refreshAccessToken(params) {\n      invariant(this.tokenRefreshUri, 'tokenRefreshUri is required');\n      const response = await refreshAccessToken({\n        ...params,\n        tokenUri: this.tokenRefreshUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XToken;\n    },\n    async revokeToken(params) {\n      invariant(this.tokenRevokeUri, 'tokenRevokeUri is required');\n      return revokeToken({\n        ...params,\n        tokenRevokeUri: this.tokenRevokeUri,\n        authentication: 'basic',\n      });\n    },\n  };\n}\n\nexport const x = createXProvider();\n\ntype UserField =\n  | 'affiliation'\n  | 'connection_status'\n  | 'created_at'\n  | 'description'\n  | 'entities'\n  | 'id'\n  | 'is_identity_verified'\n  | 'location'\n  | 'most_recent_tweet_id'\n  | 'name'\n  | 'parody'\n  | 'pinned_tweet_id'\n  | 'profile_banner_url'\n  | 'profile_image_url'\n  | 'protected'\n  | 'public_metrics'\n  | 'receives_your_dm'\n  | 'subscription'\n  | 'subscription_type'\n  | 'url'\n  | 'username'\n  | 'verified'\n  | 'verified_followers_count'\n  | 'verified_type'\n  | 'withheld';\n\nexport interface XUser {\n  id: string;\n  name: string;\n  email?: string;\n  username: string;\n  location?: string;\n  entities?: {\n    url: { urls: UrlEntity[] };\n    description: {\n      hashtags: HashtagEntity[];\n      cashtags: HashtagEntity[];\n      mentions: MentionEntity[];\n    };\n  };\n  verified?: boolean;\n  description?: string;\n  url?: string;\n  profile_image_url?: string;\n  protected?: boolean;\n  pinned_tweet_id?: string;\n  created_at?: string;\n}\n\nexport interface XUserInfo {\n  data: XUser;\n  includes?: { tweets?: { id: string; text: string }[]; users?: XUser[] };\n}\n\ntype UrlEntity = {\n  start: number;\n  end: number;\n  url: string;\n  display_url: string;\n  expanded_url: string;\n};\ntype HashtagEntity = { start: number; end: number; tag: string };\ntype MentionEntity = { start: number; end: string; username: string };\n\nexport interface XToken extends OAuth2Token {\n  token_type: string;\n  expires_in: number;\n  access_token: string;\n  scope: string;\n  refresh_token: string;\n}\n\ntype XErrorResponse = { error: string; error_description: string };\ntype XAPIErrorResponse = {\n  errors: { title: string; type: string; detail?: string; status?: number }[];\n};\n"],"mappings":";;;;AAcA,MAAM,oBAAoB;CACxB;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,SAAgB,gBAAgB,SAA8B;CAC5D,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,iBAAiB;EACjB,gBAAgB;EAEhB,aAAa;EACb,cAAc;GAAC;GAAc;GAAc;EAAgB;EAC3D,uBAAuB,QAAQ;GAC7B,IAAI,CAAC,OAAO,MAAM,MAAM,IAAI,MAAM,wBAAwB;GAC1D,OAAO,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,QAAQ;GACtC,IAAI,CAAC,OAAO,MAAM,MAAM,IAAI,MAAM,wBAAwB;GAC1D,MAAM,WAAW,MAAM,0BAA0B;IAC/C,GAAG;IACH,UAAU,KAAK;IACf,gBAAgB;GAClB,CAAC;GACD,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,gBAAgB;GAClC,UAAU,cAAc,0BAA0B;GAClD,UAAU,KAAK,aAAa,yBAAyB;GAErD,MAAM,aAAa,SAAS,cAAc;GAC1C,MAAM,UAAU;IAAE,QAAQ;IAAoB,eAAe,UAAU;GAAe;GAEtF,MAAM,MAAM,IAAI,IAAI,KAAK,WAAW;GACpC,WAAW,SAAS,UAAU,IAAI,aAAa,OAAO,eAAe,KAAK,CAAC;GAE3E,MAAM,WAAW,MAAM,MAAM,KAAK,aAAa,EAAE,QAAQ,CAAC;GAC1D,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,WAAY,MAAM,SAAS,KAAK;IACxC,MAAM,IAAI,YACR,SAAS,QACT,mBACA,8BAA8B,OAAO,GAAG,CAAC,CAAC,EAAE,UAAU,OAAO,GAAG,CAAC,CAAC,EAAE,OACtE;GACF;GACA,MAAM,UAAW,MAAM,SAAS,KAAK;GACrC,OAAO;IACL,MAAM;IACN,QAAQ;KACN,KAAK,QAAQ,KAAK;KAClB,MAAM,QAAQ,KAAK;KACnB,SAAS,QAAQ,KAAK;KACtB,OAAO,QAAQ,KAAK;KACpB,gBAAgB,QAAQ,KAAK,YAAY;KACzC,oBAAoB,QAAQ,KAAK;KACjC,SAAS,iBAAiB,QAAQ,KAAK;KACvC,SAAS,QAAQ,KAAK;IACxB;GACF;EACF;EACA,MAAM,mBAAmB,QAAQ;GAC/B,UAAU,KAAK,iBAAiB,6BAA6B;GAC7D,MAAM,WAAW,MAAM,mBAAmB;IACxC,GAAG;IACH,UAAU,KAAK;IACf,gBAAgB;GAClB,CAAC;GACD,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,QAAQ;GACxB,UAAU,KAAK,gBAAgB,4BAA4B;GAC3D,OAAO,YAAY;IACjB,GAAG;IACH,gBAAgB,KAAK;IACrB,gBAAgB;GAClB,CAAC;EACH;CACF;AACF;AAEA,MAAa,IAAI,gBAAgB"}
+{"version":3,"file":"x.mjs","names":[],"sources":["../../../src/oauth2/provider/x.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type { OAuth2Token, Provider } from '../types';\nimport {\n  createAuthorizationUri,\n  exchangeAuthorizationCode,\n  refreshAccessToken,\n  revokeToken,\n} from './common';\n\nexport interface XOptions {\n  userFields?: UserField[];\n}\n\nconst defaultUserFields = [\n  'id',\n  'name',\n  'profile_image_url',\n  'url',\n  'username',\n  'location',\n  'verified',\n];\n\nexport function createXProvider(options?: XOptions): Provider {\n  return {\n    authorizationUri: 'https://x.com/i/oauth2/authorize',\n    tokenUri: 'https://api.x.com/2/oauth2/token',\n    tokenRefreshUri: 'https://api.x.com/2/oauth2/token',\n    tokenRevokeUri: 'https://api.x.com/2/oauth2/revoke',\n    // https://docs.x.com/x-api/users/user-lookup-me\n    userInfoUri: 'https://api.x.com/2/users/me',\n    defaultScope: ['users.read', 'tweet.read', 'offline.access'],\n    createAuthorizationUri(params) {\n      if (!params.pkce) throw new Error('pkce is required for x');\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      if (!params.pkce) throw new Error('pkce is required for x');\n      const response = await exchangeAuthorizationCode({\n        ...params,\n        tokenUri: this.tokenUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XToken;\n    },\n    async getUserInfo({ access_token }) {\n      invariant(access_token, 'access_token is required');\n      invariant(this.userInfoUri, 'userInfoUri is required');\n\n      const userFields = options?.userFields ?? defaultUserFields;\n      const headers = { Accept: 'application/json', Authorization: `Bearer ${access_token}` };\n\n      const url = new URL(this.userInfoUri);\n      userFields.forEach((field) => url.searchParams.append('user.fields', field));\n\n      const response = await fetch(this.userInfoUri, { headers });\n      if (!response.ok) {\n        const { errors } = (await response.json()) as XAPIErrorResponse;\n        throw new OAuth2Error(\n          response.status,\n          'invalid_request',\n          `Failed to fetch user info: ${errors.at(0)?.detail ?? errors.at(0)?.title}`\n        );\n      }\n      const profile = (await response.json()) as XUserInfo;\n      return {\n        data: profile,\n        claims: {\n          sub: profile.data.id,\n          name: profile.data.name,\n          picture: profile.data.profile_image_url,\n          email: profile.data.email,\n          email_verified: profile.data.verified ?? false,\n          preferred_username: profile.data.username,\n          profile: `https://x.com/${profile.data.username}`,\n          website: profile.data.url,\n        },\n      };\n    },\n    async refreshAccessToken(params) {\n      invariant(this.tokenRefreshUri, 'tokenRefreshUri is required');\n      const response = await refreshAccessToken({\n        ...params,\n        tokenUri: this.tokenRefreshUri,\n        authentication: 'basic',\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as XErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as XToken;\n    },\n    async revokeToken(params) {\n      invariant(this.tokenRevokeUri, 'tokenRevokeUri is required');\n      return revokeToken({\n        ...params,\n        tokenRevokeUri: this.tokenRevokeUri,\n        authentication: 'basic',\n      });\n    },\n  };\n}\n\nexport const x = createXProvider();\n\ntype UserField =\n  | 'affiliation'\n  | 'connection_status'\n  | 'created_at'\n  | 'description'\n  | 'entities'\n  | 'id'\n  | 'is_identity_verified'\n  | 'location'\n  | 'most_recent_tweet_id'\n  | 'name'\n  | 'parody'\n  | 'pinned_tweet_id'\n  | 'profile_banner_url'\n  | 'profile_image_url'\n  | 'protected'\n  | 'public_metrics'\n  | 'receives_your_dm'\n  | 'subscription'\n  | 'subscription_type'\n  | 'url'\n  | 'username'\n  | 'verified'\n  | 'verified_followers_count'\n  | 'verified_type'\n  | 'withheld';\n\nexport interface XUser {\n  id: string;\n  name: string;\n  email?: string;\n  username: string;\n  location?: string;\n  entities?: {\n    url: { urls: UrlEntity[] };\n    description: {\n      hashtags: HashtagEntity[];\n      cashtags: HashtagEntity[];\n      mentions: MentionEntity[];\n    };\n  };\n  verified?: boolean;\n  description?: string;\n  url?: string;\n  profile_image_url?: string;\n  protected?: boolean;\n  pinned_tweet_id?: string;\n  created_at?: string;\n}\n\nexport interface XUserInfo {\n  data: XUser;\n  includes?: { tweets?: { id: string; text: string }[]; users?: XUser[] };\n}\n\ntype UrlEntity = {\n  start: number;\n  end: number;\n  url: string;\n  display_url: string;\n  expanded_url: string;\n};\ntype HashtagEntity = { start: number; end: number; tag: string };\ntype MentionEntity = { start: number; end: string; username: string };\n\nexport interface XToken extends OAuth2Token {\n  token_type: string;\n  expires_in: number;\n  access_token: string;\n  scope: string;\n  refresh_token: string;\n}\n\ntype XErrorResponse = { error: string; error_description: string };\ntype XAPIErrorResponse = {\n  errors: { title: string; type: string; detail?: string; status?: number }[];\n};\n"],"mappings":";;;;AAcA,MAAM,oBAAoB;CACxB;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,SAAgB,gBAAgB,SAA8B;CAC5D,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,iBAAiB;EACjB,gBAAgB;EAEhB,aAAa;EACb,cAAc;GAAC;GAAc;GAAc;EAAgB;EAC3D,uBAAuB,QAAQ;GAC7B,IAAI,CAAC,OAAO,MAAM,MAAM,IAAI,MAAM,wBAAwB;GAC1D,OAAO,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,QAAQ;GACtC,IAAI,CAAC,OAAO,MAAM,MAAM,IAAI,MAAM,wBAAwB;GAC1D,MAAM,WAAW,MAAM,0BAA0B;IAC/C,GAAG;IACH,UAAU,KAAK;IACf,gBAAgB;GAClB,CAAC;GACD,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,gBAAgB;GAClC,UAAU,cAAc,0BAA0B;GAClD,UAAU,KAAK,aAAa,yBAAyB;GAErD,MAAM,aAAa,SAAS,cAAc;GAC1C,MAAM,UAAU;IAAE,QAAQ;IAAoB,eAAe,UAAU;GAAe;GAEtF,MAAM,MAAM,IAAI,IAAI,KAAK,WAAW;GACpC,WAAW,SAAS,UAAU,IAAI,aAAa,OAAO,eAAe,KAAK,CAAC;GAE3E,MAAM,WAAW,MAAM,MAAM,KAAK,aAAa,EAAE,QAAQ,CAAC;GAC1D,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,WAAY,MAAM,SAAS,KAAK;IACxC,MAAM,IAAI,YACR,SAAS,QACT,mBACA,8BAA8B,OAAO,GAAG,CAAC,CAAC,EAAE,UAAU,OAAO,GAAG,CAAC,CAAC,EAAE,OACtE;GACF;GACA,MAAM,UAAW,MAAM,SAAS,KAAK;GACrC,OAAO;IACL,MAAM;IACN,QAAQ;KACN,KAAK,QAAQ,KAAK;KAClB,MAAM,QAAQ,KAAK;KACnB,SAAS,QAAQ,KAAK;KACtB,OAAO,QAAQ,KAAK;KACpB,gBAAgB,QAAQ,KAAK,YAAY;KACzC,oBAAoB,QAAQ,KAAK;KACjC,SAAS,iBAAiB,QAAQ,KAAK;KACvC,SAAS,QAAQ,KAAK;IACxB;GACF;EACF;EACA,MAAM,mBAAmB,QAAQ;GAC/B,UAAU,KAAK,iBAAiB,6BAA6B;GAC7D,MAAM,WAAW,MAAM,mBAAmB;IACxC,GAAG;IACH,UAAU,KAAK;IACf,gBAAgB;GAClB,CAAC;GACD,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,QAAQ;GACxB,UAAU,KAAK,gBAAgB,4BAA4B;GAC3D,OAAO,YAAY;IACjB,GAAG;IACH,gBAAgB,KAAK;IACrB,gBAAgB;GAClB,CAAC;EACH;CACF;AACF;AAEA,MAAa,IAAI,gBAAgB"}

package/dist/oauth2/types.cjs

@@ -1,15 +1,14 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 //#region src/oauth2/types.ts
-let OidcScopes = /* @__PURE__ */ function(OidcScopes) {
-	OidcScopes["openid"] = "openid";
-	OidcScopes["profile"] = "profile";
-	OidcScopes["email"] = "email";
-	OidcScopes["phone"] = "phone";
-	OidcScopes["address"] = "address";
-	OidcScopes["offline_access"] = "offline_access";
-	return OidcScopes;
-}({});
+const OIDC_SCOPES = [
+	"openid",
+	"profile",
+	"email",
+	"phone",
+	"address",
+	"offline_access"
+];
 //#endregion
-exports.OidcScopes = OidcScopes;
+exports.OIDC_SCOPES = OIDC_SCOPES;
 
 //# sourceMappingURL=types.cjs.map

package/dist/oauth2/types.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.cjs","names":[],"sources":["../../src/oauth2/types.ts"],"sourcesContent":["// reference: https://datatracker.ietf.org/doc/html/rfc7636\nexport interface PkceParameters {\n  code_verifier: string;\n  code_challenge: string;\n  code_challenge_method: 'S256' | 'plain';\n}\n\nexport interface OAuth2AuthorizationRequest {\n  state: string;\n  registrationId: string;\n  authorizationRequestUri: string;\n  additionalParameters: PkceParameters;\n}\n\ninterface CreateAuthorizationUriParams {\n  state: string;\n  clientId: string;\n  redirectUri: string;\n  scope: string[] | undefined;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n}\n\nexport interface ExchangeCodeParams {\n  code: string;\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  pkce?: Omit<PkceParameters, 'code_challenge' | 'code_challenge_method'>;\n}\n\nexport interface RefreshTokenParams {\n  clientId: string;\n  clientSecret: string;\n  refreshToken: string;\n}\n\nexport interface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret: string;\n}\n\nexport interface LoginOAuth2NativeParams {\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  pkce?: PkceParameters;\n  credentials: NativeCredential;\n}\n\n// reference: https://datatracker.ietf.org/doc/html/rfc6749#section-5.1\nexport interface OAuth2Token {\n  /**\n   * REQUIRED.\n   * The access token issued by the authorization server.\n   */\n  access_token: string;\n\n  /**\n   * REQUIRED.\n   * The type of the token issued as described in Section 7.1.  Value is case insensitive.\n   */\n  token_type: 'Bearer' | 'bearer' | 'mac' | (string & {});\n\n  /**\n   * RECOMMENDED.\n   * The lifetime in seconds of the access token. For example, the value \"3600\" denotes that the\n   * access token will expire in one hour from the time the response was generated. If omitted, the\n   * authorization server SHOULD provide the expiration time via other means or document the default\n   * value.\n   */\n  expires_in?: number;\n\n  /**\n   * OPTIONAL.\n   * The refresh token, which can be used to obtain new access tokens using the same authorization\n   * grant as described in Section 6.\n   */\n  refresh_token?: string;\n\n  /**\n   * OPTIONAL.\n   * If identical to the scope requested by the client; otherwise, REQUIRED. The scope of the\n   * access token as described by Section 3.3.\n   */\n  scope?: string;\n\n  id_token?: string;\n\n  [key: string]: unknown;\n}\n\nexport interface OidcToken extends OAuth2Token {\n  id_token: string;\n}\n\nexport type NativeCredential = {\n  state?: string;\n  code?: string;\n  client_id?: string;\n  redirect_uri?: string;\n  id_token?: string;\n  access_token?: string;\n};\n\nexport enum OidcScopes {\n  openid = 'openid',\n  profile = 'profile',\n  email = 'email',\n  phone = 'phone',\n  address = 'address',\n  offline_access = 'offline_access',\n}\n\n// https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims\nexport interface StandardClaims {\n  sub: string;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  middle_name?: string;\n  nickname?: string;\n  preferred_username?: string;\n  profile?: string;\n  picture?: string;\n  website?: string;\n  email?: string;\n  email_verified?: boolean;\n  gender?: 'female' | 'male' | (string & {});\n  birthdate?: string; // ISO 8601-1 [ISO8601‑1] YYYY-MM-DD format.\n  zoneinfo?: string; // IANA Time Zone Database [IANA.time‑zones]\n  locale?: string; // BCP47 [RFC5646] language tag.\n  phone_number?: string; // E.164\n  phone_number_verified?: boolean;\n  address?: {\n    formatted: string;\n    street_address: string;\n    locality: string;\n    region: string;\n    postal_code: string;\n    country: string;\n  }; // [RFC8259] JSON object\n  updated_at?: number;\n}\n\nexport interface UserInfo<T = unknown> {\n  claims: StandardClaims;\n  data: T;\n}\n\nexport interface Provider {\n  /** Authorization URI for the provider. */\n  authorizationUri: string;\n\n  /** Token URI for the provider. */\n  tokenUri: string;\n\n  /** Token revoke URI for the provider. */\n  tokenRevokeUri?: string;\n\n  /** Token refresh URI for the provider. */\n  tokenRefreshUri?: string;\n\n  /** User info URI for the provider. */\n  userInfoUri?: string;\n\n  /** User info authentication method for the provider. */\n  userInfoAuthenticationMethod?: string;\n\n  /**\n   * Name of the attribute that will be used to extract the username from the call to 'userInfoUri'.\n   * */\n  userNameAttribute?: string;\n\n  /** JWK set URI for the provider */\n  jwkSetUri?: string;\n\n  /**\n   * URI that can either be an OpenID Connect discovery endpoint or an OAuth 2.0 Authorization\n   * Server Metadata endpoint defined by RFC 8414.\n   * */\n  issuerUri?: string;\n\n  /** Default scopes for the provider. */\n  defaultScope: string[];\n\n  /** step 1: generate authorization uri and redirect user to it */\n  createAuthorizationUri: (params: CreateAuthorizationUriParams) => URL;\n\n  /** step 2: exchange code for token */\n  exchangeAuthorizationCode: (params: ExchangeCodeParams) => Promise<OAuth2Token>;\n\n  /** step 3: get user info */\n  getUserInfo: (token: OAuth2Token) => Promise<UserInfo>;\n\n  /** others: refresh access token */\n  refreshAccessToken?: (params: RefreshTokenParams) => Promise<OAuth2Token>;\n\n  /** others: revoke token */\n  revokeToken?: (params: RevokeTokenParams) => Promise<void>;\n\n  loginOAuth2Native?: (\n    params: LoginOAuth2NativeParams\n  ) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface OneTapProvider extends Provider {\n  getTokenInfo: (id_token: string) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface Registration {\n  /**\n   * Reference to the OAuth 2.0 provider to use. May reference an element from the 'provider'\n   * property or used one of the commonly used providers (google, github, facebook, okta).\n   * */\n  provider?: string;\n\n  /** Client ID for the registration. */\n  clientId: string;\n\n  /** Client secret of the registration. */\n  clientSecret: string;\n\n  /** Client authentication method. May be left blank when using a pre-defined provider. */\n  clientAuthenticationMethod?: string;\n\n  /** Authorization grant type. May be left blank when using a pre-defined provider. */\n  authorizationGrantType?:\n    | 'authorization_code' // default\n    | 'client_credentials'\n    | 'device_code'\n    | 'jwt_bearer'\n    // Deprecated. The latest OAuth 2.0 Security Best Current Practice disallows the use of the\n    // Resource Owner Password Credentials grant.\n    | 'password'\n    | 'refresh_token'\n    | 'token_exchange';\n\n  /** Redirect URI. May be left blank when using a pre-defined provider. */\n  redirectUri?: string;\n\n  /** Authorization scopes. When left blank the provider's default scopes, if any, will be used. */\n  scope?: string[];\n\n  /** Client name. May be left blank when using a pre-defined provider. */\n  clientName?: string;\n}\n\nexport interface OAuth2ClientConfig {\n  baseUri: string;\n  errorUri: string;\n  successUri: string;\n  provider: { [name: string]: Provider | undefined };\n  registration:\n    | { [name: string]: Registration | undefined }\n    | (() => Promise<{ [name: string]: Registration | undefined }>);\n}\n"],"mappings":";;AAyGA,IAAY,aAAL,yBAAA,YAAA;CACL,WAAA,YAAA;CACA,WAAA,aAAA;CACA,WAAA,WAAA;CACA,WAAA,WAAA;CACA,WAAA,aAAA;CACA,WAAA,oBAAA;;AACF,EAAA,CAAA,CAAA"}
+{"version":3,"file":"types.cjs","names":[],"sources":["../../src/oauth2/types.ts"],"sourcesContent":["// reference: https://datatracker.ietf.org/doc/html/rfc7636\nexport interface PkceParameters {\n  code_verifier: string;\n  code_challenge: string;\n  code_challenge_method: 'S256' | 'plain';\n}\n\nexport interface OAuth2AuthorizationRequest {\n  state: string;\n  registrationId: string;\n  authorizationRequestUri: string;\n  additionalParameters: PkceParameters;\n}\n\ninterface CreateAuthorizationUriParams {\n  state: string;\n  clientId: string;\n  redirectUri: string;\n  scope: string[] | undefined;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n}\n\nexport interface ExchangeCodeParams {\n  code: string;\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  pkce?: Omit<PkceParameters, 'code_challenge' | 'code_challenge_method'>;\n}\n\nexport interface RefreshTokenParams {\n  clientId: string;\n  clientSecret: string;\n  refreshToken: string;\n}\n\nexport interface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret: string;\n}\n\nexport interface LoginOAuth2NativeParams {\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  pkce?: PkceParameters;\n  credentials: NativeCredential;\n}\n\n// reference: https://datatracker.ietf.org/doc/html/rfc6749#section-5.1\nexport interface OAuth2Token {\n  /**\n   * REQUIRED.\n   * The access token issued by the authorization server.\n   */\n  access_token: string;\n\n  /**\n   * REQUIRED.\n   * The type of the token issued as described in Section 7.1.  Value is case insensitive.\n   */\n  token_type: 'Bearer' | 'bearer' | 'mac' | (string & {});\n\n  /**\n   * RECOMMENDED.\n   * The lifetime in seconds of the access token. For example, the value \"3600\" denotes that the\n   * access token will expire in one hour from the time the response was generated. If omitted, the\n   * authorization server SHOULD provide the expiration time via other means or document the default\n   * value.\n   */\n  expires_in?: number;\n\n  /**\n   * OPTIONAL.\n   * The refresh token, which can be used to obtain new access tokens using the same authorization\n   * grant as described in Section 6.\n   */\n  refresh_token?: string;\n\n  /**\n   * OPTIONAL.\n   * If identical to the scope requested by the client; otherwise, REQUIRED. The scope of the\n   * access token as described by Section 3.3.\n   */\n  scope?: string;\n\n  id_token?: string;\n\n  [key: string]: unknown;\n}\n\nexport interface OidcToken extends OAuth2Token {\n  id_token: string;\n}\n\nexport type NativeCredential = {\n  state?: string;\n  code?: string;\n  client_id?: string;\n  redirect_uri?: string;\n  id_token?: string;\n  access_token?: string;\n};\n\nexport const OIDC_SCOPES = [\n  'openid',\n  'profile',\n  'email',\n  'phone',\n  'address',\n  'offline_access',\n] as const;\n\nexport type OidcScope = (typeof OIDC_SCOPES)[number];\n\n// https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims\nexport interface StandardClaims {\n  sub: string;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  middle_name?: string;\n  nickname?: string;\n  preferred_username?: string;\n  profile?: string;\n  picture?: string;\n  website?: string;\n  email?: string;\n  email_verified?: boolean;\n  gender?: 'female' | 'male' | (string & {});\n  birthdate?: string; // ISO 8601-1 [ISO8601‑1] YYYY-MM-DD format.\n  zoneinfo?: string; // IANA Time Zone Database [IANA.time‑zones]\n  locale?: string; // BCP47 [RFC5646] language tag.\n  phone_number?: string; // E.164\n  phone_number_verified?: boolean;\n  address?: {\n    formatted: string;\n    street_address: string;\n    locality: string;\n    region: string;\n    postal_code: string;\n    country: string;\n  }; // [RFC8259] JSON object\n  updated_at?: number;\n}\n\nexport interface UserInfo<T = unknown> {\n  claims: StandardClaims;\n  data: T;\n}\n\nexport interface Provider {\n  /** Authorization URI for the provider. */\n  authorizationUri: string;\n\n  /** Token URI for the provider. */\n  tokenUri: string;\n\n  /** Token revoke URI for the provider. */\n  tokenRevokeUri?: string;\n\n  /** Token refresh URI for the provider. */\n  tokenRefreshUri?: string;\n\n  /** User info URI for the provider. */\n  userInfoUri?: string;\n\n  /** User info authentication method for the provider. */\n  userInfoAuthenticationMethod?: string;\n\n  /**\n   * Name of the attribute that will be used to extract the username from the call to 'userInfoUri'.\n   * */\n  userNameAttribute?: string;\n\n  /** JWK set URI for the provider */\n  jwkSetUri?: string;\n\n  /**\n   * URI that can either be an OpenID Connect discovery endpoint or an OAuth 2.0 Authorization\n   * Server Metadata endpoint defined by RFC 8414.\n   * */\n  issuerUri?: string;\n\n  /** Default scopes for the provider. */\n  defaultScope: string[];\n\n  /** step 1: generate authorization uri and redirect user to it */\n  createAuthorizationUri: (params: CreateAuthorizationUriParams) => URL;\n\n  /** step 2: exchange code for token */\n  exchangeAuthorizationCode: (params: ExchangeCodeParams) => Promise<OAuth2Token>;\n\n  /** step 3: get user info */\n  getUserInfo: (token: OAuth2Token) => Promise<UserInfo>;\n\n  /** others: refresh access token */\n  refreshAccessToken?: (params: RefreshTokenParams) => Promise<OAuth2Token>;\n\n  /** others: revoke token */\n  revokeToken?: (params: RevokeTokenParams) => Promise<void>;\n\n  loginOAuth2Native?: (\n    params: LoginOAuth2NativeParams\n  ) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface OneTapProvider extends Provider {\n  getTokenInfo: (id_token: string) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface Registration {\n  /**\n   * Reference to the OAuth 2.0 provider to use. May reference an element from the 'provider'\n   * property or used one of the commonly used providers (google, github, facebook, okta).\n   * */\n  provider?: string;\n\n  /** Client ID for the registration. */\n  clientId: string;\n\n  /** Client secret of the registration. */\n  clientSecret: string;\n\n  /** Client authentication method. May be left blank when using a pre-defined provider. */\n  clientAuthenticationMethod?: string;\n\n  /** Authorization grant type. May be left blank when using a pre-defined provider. */\n  authorizationGrantType?:\n    | 'authorization_code' // default\n    | 'client_credentials'\n    | 'device_code'\n    | 'jwt_bearer'\n    // Deprecated. The latest OAuth 2.0 Security Best Current Practice disallows the use of the\n    // Resource Owner Password Credentials grant.\n    | 'password'\n    | 'refresh_token'\n    | 'token_exchange';\n\n  /** Redirect URI. May be left blank when using a pre-defined provider. */\n  redirectUri?: string;\n\n  /** Authorization scopes. When left blank the provider's default scopes, if any, will be used. */\n  scope?: string[];\n\n  /** Client name. May be left blank when using a pre-defined provider. */\n  clientName?: string;\n}\n\nexport interface OAuth2ClientConfig {\n  baseUri: string;\n  errorUri: string;\n  successUri: string;\n  provider: { [name: string]: Provider | undefined };\n  registration:\n    | { [name: string]: Registration | undefined }\n    | (() => Promise<{ [name: string]: Registration | undefined }>);\n}\n"],"mappings":";;AAyGA,MAAa,cAAc;CACzB;CACA;CACA;CACA;CACA;CACA;AACF"}

package/dist/oauth2/types.d.cts

@@ -86,14 +86,8 @@ type NativeCredential = {
   id_token?: string;
   access_token?: string;
 };
-declare enum OidcScopes {
-  openid = "openid",
-  profile = "profile",
-  email = "email",
-  phone = "phone",
-  address = "address",
-  offline_access = "offline_access"
-}
+declare const OIDC_SCOPES: readonly ['openid', 'profile', 'email', 'phone', 'address', 'offline_access'];
+type OidcScope = (typeof OIDC_SCOPES)[number];
 interface StandardClaims {
   sub: string;
   name?: string;
@@ -209,5 +203,5 @@ interface OAuth2ClientConfig {
   }>);
 }
 //#endregion
-export { ExchangeCodeParams, LoginOAuth2NativeParams, NativeCredential, OAuth2AuthorizationRequest, OAuth2ClientConfig, OAuth2Token, OidcScopes, OidcToken, OneTapProvider, PkceParameters, Provider, RefreshTokenParams, Registration, RevokeTokenParams, StandardClaims, UserInfo };
+export { ExchangeCodeParams, LoginOAuth2NativeParams, NativeCredential, OAuth2AuthorizationRequest, OAuth2ClientConfig, OAuth2Token, OIDC_SCOPES, OidcScope, OidcToken, OneTapProvider, PkceParameters, Provider, RefreshTokenParams, Registration, RevokeTokenParams, StandardClaims, UserInfo };
 //# sourceMappingURL=types.d.cts.map

package/dist/oauth2/types.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.cts","names":[],"sources":["../../src/oauth2/types.ts"],"mappings":";UACiB;EACf;EACA;EACA;;UAGe;EACf;EACA;EACA;EACA,sBAAsB;;UAGd;EACR;EACA;EACA;EACA;EACA,OAAO,KAAK;;UAGG;EACf;EACA;EACA;EACA;EACA,OAAO,KAAK;;UAGG;EACf;EACA;EACA;;UAGe;EACf;EACA;EACA;;UAGe;EACf;EACA;EACA;EACA,OAAO;EACP,aAAa;;UAIE;;;;;EAKf;;;;;EAMA;;;;;;;;EASA;;;;;;EAOA;;;;;;EAOA;EAEA;GAEC;;UAGc,kBAAkB;EACjC;;KAGU;EACV;EACA;EACA;EACA;EACA;EACA;;aAGU;EACV;EACA;EACA;EACA;EACA;EACA;;UAIe;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;IACE;IACA;IACA;IACA;IACA;IACA;;EAEF;;UAGe,SAAS;EACxB,QAAQ;EACR,MAAM;;UAGS;;EAEf;;EAGA;;EAGA;;EAGA;;EAGA;;EAGA;;;;EAKA;;EAGA;;;;;EAMA;;EAGA;;EAGA,yBAAyB,QAAQ,iCAAiC;;EAGlE,4BAA4B,QAAQ,uBAAuB,QAAQ;;EAGnE,cAAc,OAAO,gBAAgB,QAAQ;;EAG7C,sBAAsB,QAAQ,uBAAuB,QAAQ;;EAG7D,eAAe,QAAQ,sBAAsB;EAE7C,qBACE,QAAQ,4BACL;IAAU,OAAO;IAAa,UAAU;;;UAG9B,uBAAuB;EACtC,eAAe,qBAAqB;IAAU,OAAO;IAAa,UAAU;;;UAG7D;;;;;EAKf;;EAGA;;EAGA;;EAGA;;EAGA;;EAYA;;EAGA;;EAGA;;UAGe;EACf;EACA;EACA;EACA;KAAa,eAAe;;EAC5B;KACO,eAAe;aACX;KAAW,eAAe"}
+{"version":3,"file":"types.d.cts","names":[],"sources":["../../src/oauth2/types.ts"],"mappings":";UACiB;EACf;EACA;EACA;;UAGe;EACf;EACA;EACA;EACA,sBAAsB;;UAGd;EACR;EACA;EACA;EACA;EACA,OAAO,KAAK;;UAGG;EACf;EACA;EACA;EACA;EACA,OAAO,KAAK;;UAGG;EACf;EACA;EACA;;UAGe;EACf;EACA;EACA;;UAGe;EACf;EACA;EACA;EACA,OAAO;EACP,aAAa;;UAIE;;;;;EAKf;;;;;EAMA;;;;;;;;EASA;;;;;;EAOA;;;;;;EAOA;EAEA;GAEC;;UAGc,kBAAkB;EACjC;;KAGU;EACV;EACA;EACA;EACA;EACA;EACA;;cAGW;KASD,oBAAoB;UAGf;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;IACE;IACA;IACA;IACA;IACA;IACA;;EAEF;;UAGe,SAAS;EACxB,QAAQ;EACR,MAAM;;UAGS;;EAEf;;EAGA;;EAGA;;EAGA;;EAGA;;EAGA;;;;EAKA;;EAGA;;;;;EAMA;;EAGA;;EAGA,yBAAyB,QAAQ,iCAAiC;;EAGlE,4BAA4B,QAAQ,uBAAuB,QAAQ;;EAGnE,cAAc,OAAO,gBAAgB,QAAQ;;EAG7C,sBAAsB,QAAQ,uBAAuB,QAAQ;;EAG7D,eAAe,QAAQ,sBAAsB;EAE7C,qBACE,QAAQ,4BACL;IAAU,OAAO;IAAa,UAAU;;;UAG9B,uBAAuB;EACtC,eAAe,qBAAqB;IAAU,OAAO;IAAa,UAAU;;;UAG7D;;;;;EAKf;;EAGA;;EAGA;;EAGA;;EAGA;;EAYA;;EAGA;;EAGA;;UAGe;EACf;EACA;EACA;EACA;KAAa,eAAe;;EAC5B;KACO,eAAe;aACX;KAAW,eAAe"}

package/dist/oauth2/types.d.mts

@@ -86,14 +86,8 @@ type NativeCredential = {
   id_token?: string;
   access_token?: string;
 };
-declare enum OidcScopes {
-  openid = "openid",
-  profile = "profile",
-  email = "email",
-  phone = "phone",
-  address = "address",
-  offline_access = "offline_access"
-}
+declare const OIDC_SCOPES: readonly ['openid', 'profile', 'email', 'phone', 'address', 'offline_access'];
+type OidcScope = (typeof OIDC_SCOPES)[number];
 interface StandardClaims {
   sub: string;
   name?: string;
@@ -209,5 +203,5 @@ interface OAuth2ClientConfig {
   }>);
 }
 //#endregion
-export { ExchangeCodeParams, LoginOAuth2NativeParams, NativeCredential, OAuth2AuthorizationRequest, OAuth2ClientConfig, OAuth2Token, OidcScopes, OidcToken, OneTapProvider, PkceParameters, Provider, RefreshTokenParams, Registration, RevokeTokenParams, StandardClaims, UserInfo };
+export { ExchangeCodeParams, LoginOAuth2NativeParams, NativeCredential, OAuth2AuthorizationRequest, OAuth2ClientConfig, OAuth2Token, OIDC_SCOPES, OidcScope, OidcToken, OneTapProvider, PkceParameters, Provider, RefreshTokenParams, Registration, RevokeTokenParams, StandardClaims, UserInfo };
 //# sourceMappingURL=types.d.mts.map

package/dist/oauth2/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","names":[],"sources":["../../src/oauth2/types.ts"],"mappings":";UACiB;EACf;EACA;EACA;;UAGe;EACf;EACA;EACA;EACA,sBAAsB;;UAGd;EACR;EACA;EACA;EACA;EACA,OAAO,KAAK;;UAGG;EACf;EACA;EACA;EACA;EACA,OAAO,KAAK;;UAGG;EACf;EACA;EACA;;UAGe;EACf;EACA;EACA;;UAGe;EACf;EACA;EACA;EACA,OAAO;EACP,aAAa;;UAIE;;;;;EAKf;;;;;EAMA;;;;;;;;EASA;;;;;;EAOA;;;;;;EAOA;EAEA;GAEC;;UAGc,kBAAkB;EACjC;;KAGU;EACV;EACA;EACA;EACA;EACA;EACA;;aAGU;EACV;EACA;EACA;EACA;EACA;EACA;;UAIe;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;IACE;IACA;IACA;IACA;IACA;IACA;;EAEF;;UAGe,SAAS;EACxB,QAAQ;EACR,MAAM;;UAGS;;EAEf;;EAGA;;EAGA;;EAGA;;EAGA;;EAGA;;;;EAKA;;EAGA;;;;;EAMA;;EAGA;;EAGA,yBAAyB,QAAQ,iCAAiC;;EAGlE,4BAA4B,QAAQ,uBAAuB,QAAQ;;EAGnE,cAAc,OAAO,gBAAgB,QAAQ;;EAG7C,sBAAsB,QAAQ,uBAAuB,QAAQ;;EAG7D,eAAe,QAAQ,sBAAsB;EAE7C,qBACE,QAAQ,4BACL;IAAU,OAAO;IAAa,UAAU;;;UAG9B,uBAAuB;EACtC,eAAe,qBAAqB;IAAU,OAAO;IAAa,UAAU;;;UAG7D;;;;;EAKf;;EAGA;;EAGA;;EAGA;;EAGA;;EAYA;;EAGA;;EAGA;;UAGe;EACf;EACA;EACA;EACA;KAAa,eAAe;;EAC5B;KACO,eAAe;aACX;KAAW,eAAe"}
+{"version":3,"file":"types.d.mts","names":[],"sources":["../../src/oauth2/types.ts"],"mappings":";UACiB;EACf;EACA;EACA;;UAGe;EACf;EACA;EACA;EACA,sBAAsB;;UAGd;EACR;EACA;EACA;EACA;EACA,OAAO,KAAK;;UAGG;EACf;EACA;EACA;EACA;EACA,OAAO,KAAK;;UAGG;EACf;EACA;EACA;;UAGe;EACf;EACA;EACA;;UAGe;EACf;EACA;EACA;EACA,OAAO;EACP,aAAa;;UAIE;;;;;EAKf;;;;;EAMA;;;;;;;;EASA;;;;;;EAOA;;;;;;EAOA;EAEA;GAEC;;UAGc,kBAAkB;EACjC;;KAGU;EACV;EACA;EACA;EACA;EACA;EACA;;cAGW;KASD,oBAAoB;UAGf;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;IACE;IACA;IACA;IACA;IACA;IACA;;EAEF;;UAGe,SAAS;EACxB,QAAQ;EACR,MAAM;;UAGS;;EAEf;;EAGA;;EAGA;;EAGA;;EAGA;;EAGA;;;;EAKA;;EAGA;;;;;EAMA;;EAGA;;EAGA,yBAAyB,QAAQ,iCAAiC;;EAGlE,4BAA4B,QAAQ,uBAAuB,QAAQ;;EAGnE,cAAc,OAAO,gBAAgB,QAAQ;;EAG7C,sBAAsB,QAAQ,uBAAuB,QAAQ;;EAG7D,eAAe,QAAQ,sBAAsB;EAE7C,qBACE,QAAQ,4BACL;IAAU,OAAO;IAAa,UAAU;;;UAG9B,uBAAuB;EACtC,eAAe,qBAAqB;IAAU,OAAO;IAAa,UAAU;;;UAG7D;;;;;EAKf;;EAGA;;EAGA;;EAGA;;EAGA;;EAYA;;EAGA;;EAGA;;UAGe;EACf;EACA;EACA;EACA;KAAa,eAAe;;EAC5B;KACO,eAAe;aACX;KAAW,eAAe"}

package/dist/oauth2/types.mjs

@@ -1,14 +1,13 @@
 //#region src/oauth2/types.ts
-let OidcScopes = /* @__PURE__ */ function(OidcScopes) {
-	OidcScopes["openid"] = "openid";
-	OidcScopes["profile"] = "profile";
-	OidcScopes["email"] = "email";
-	OidcScopes["phone"] = "phone";
-	OidcScopes["address"] = "address";
-	OidcScopes["offline_access"] = "offline_access";
-	return OidcScopes;
-}({});
+const OIDC_SCOPES = [
+	"openid",
+	"profile",
+	"email",
+	"phone",
+	"address",
+	"offline_access"
+];
 //#endregion
-export { OidcScopes };
+export { OIDC_SCOPES };
 
 //# sourceMappingURL=types.mjs.map

package/dist/oauth2/types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.mjs","names":[],"sources":["../../src/oauth2/types.ts"],"sourcesContent":["// reference: https://datatracker.ietf.org/doc/html/rfc7636\nexport interface PkceParameters {\n  code_verifier: string;\n  code_challenge: string;\n  code_challenge_method: 'S256' | 'plain';\n}\n\nexport interface OAuth2AuthorizationRequest {\n  state: string;\n  registrationId: string;\n  authorizationRequestUri: string;\n  additionalParameters: PkceParameters;\n}\n\ninterface CreateAuthorizationUriParams {\n  state: string;\n  clientId: string;\n  redirectUri: string;\n  scope: string[] | undefined;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n}\n\nexport interface ExchangeCodeParams {\n  code: string;\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  pkce?: Omit<PkceParameters, 'code_challenge' | 'code_challenge_method'>;\n}\n\nexport interface RefreshTokenParams {\n  clientId: string;\n  clientSecret: string;\n  refreshToken: string;\n}\n\nexport interface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret: string;\n}\n\nexport interface LoginOAuth2NativeParams {\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  pkce?: PkceParameters;\n  credentials: NativeCredential;\n}\n\n// reference: https://datatracker.ietf.org/doc/html/rfc6749#section-5.1\nexport interface OAuth2Token {\n  /**\n   * REQUIRED.\n   * The access token issued by the authorization server.\n   */\n  access_token: string;\n\n  /**\n   * REQUIRED.\n   * The type of the token issued as described in Section 7.1.  Value is case insensitive.\n   */\n  token_type: 'Bearer' | 'bearer' | 'mac' | (string & {});\n\n  /**\n   * RECOMMENDED.\n   * The lifetime in seconds of the access token. For example, the value \"3600\" denotes that the\n   * access token will expire in one hour from the time the response was generated. If omitted, the\n   * authorization server SHOULD provide the expiration time via other means or document the default\n   * value.\n   */\n  expires_in?: number;\n\n  /**\n   * OPTIONAL.\n   * The refresh token, which can be used to obtain new access tokens using the same authorization\n   * grant as described in Section 6.\n   */\n  refresh_token?: string;\n\n  /**\n   * OPTIONAL.\n   * If identical to the scope requested by the client; otherwise, REQUIRED. The scope of the\n   * access token as described by Section 3.3.\n   */\n  scope?: string;\n\n  id_token?: string;\n\n  [key: string]: unknown;\n}\n\nexport interface OidcToken extends OAuth2Token {\n  id_token: string;\n}\n\nexport type NativeCredential = {\n  state?: string;\n  code?: string;\n  client_id?: string;\n  redirect_uri?: string;\n  id_token?: string;\n  access_token?: string;\n};\n\nexport enum OidcScopes {\n  openid = 'openid',\n  profile = 'profile',\n  email = 'email',\n  phone = 'phone',\n  address = 'address',\n  offline_access = 'offline_access',\n}\n\n// https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims\nexport interface StandardClaims {\n  sub: string;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  middle_name?: string;\n  nickname?: string;\n  preferred_username?: string;\n  profile?: string;\n  picture?: string;\n  website?: string;\n  email?: string;\n  email_verified?: boolean;\n  gender?: 'female' | 'male' | (string & {});\n  birthdate?: string; // ISO 8601-1 [ISO8601‑1] YYYY-MM-DD format.\n  zoneinfo?: string; // IANA Time Zone Database [IANA.time‑zones]\n  locale?: string; // BCP47 [RFC5646] language tag.\n  phone_number?: string; // E.164\n  phone_number_verified?: boolean;\n  address?: {\n    formatted: string;\n    street_address: string;\n    locality: string;\n    region: string;\n    postal_code: string;\n    country: string;\n  }; // [RFC8259] JSON object\n  updated_at?: number;\n}\n\nexport interface UserInfo<T = unknown> {\n  claims: StandardClaims;\n  data: T;\n}\n\nexport interface Provider {\n  /** Authorization URI for the provider. */\n  authorizationUri: string;\n\n  /** Token URI for the provider. */\n  tokenUri: string;\n\n  /** Token revoke URI for the provider. */\n  tokenRevokeUri?: string;\n\n  /** Token refresh URI for the provider. */\n  tokenRefreshUri?: string;\n\n  /** User info URI for the provider. */\n  userInfoUri?: string;\n\n  /** User info authentication method for the provider. */\n  userInfoAuthenticationMethod?: string;\n\n  /**\n   * Name of the attribute that will be used to extract the username from the call to 'userInfoUri'.\n   * */\n  userNameAttribute?: string;\n\n  /** JWK set URI for the provider */\n  jwkSetUri?: string;\n\n  /**\n   * URI that can either be an OpenID Connect discovery endpoint or an OAuth 2.0 Authorization\n   * Server Metadata endpoint defined by RFC 8414.\n   * */\n  issuerUri?: string;\n\n  /** Default scopes for the provider. */\n  defaultScope: string[];\n\n  /** step 1: generate authorization uri and redirect user to it */\n  createAuthorizationUri: (params: CreateAuthorizationUriParams) => URL;\n\n  /** step 2: exchange code for token */\n  exchangeAuthorizationCode: (params: ExchangeCodeParams) => Promise<OAuth2Token>;\n\n  /** step 3: get user info */\n  getUserInfo: (token: OAuth2Token) => Promise<UserInfo>;\n\n  /** others: refresh access token */\n  refreshAccessToken?: (params: RefreshTokenParams) => Promise<OAuth2Token>;\n\n  /** others: revoke token */\n  revokeToken?: (params: RevokeTokenParams) => Promise<void>;\n\n  loginOAuth2Native?: (\n    params: LoginOAuth2NativeParams\n  ) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface OneTapProvider extends Provider {\n  getTokenInfo: (id_token: string) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface Registration {\n  /**\n   * Reference to the OAuth 2.0 provider to use. May reference an element from the 'provider'\n   * property or used one of the commonly used providers (google, github, facebook, okta).\n   * */\n  provider?: string;\n\n  /** Client ID for the registration. */\n  clientId: string;\n\n  /** Client secret of the registration. */\n  clientSecret: string;\n\n  /** Client authentication method. May be left blank when using a pre-defined provider. */\n  clientAuthenticationMethod?: string;\n\n  /** Authorization grant type. May be left blank when using a pre-defined provider. */\n  authorizationGrantType?:\n    | 'authorization_code' // default\n    | 'client_credentials'\n    | 'device_code'\n    | 'jwt_bearer'\n    // Deprecated. The latest OAuth 2.0 Security Best Current Practice disallows the use of the\n    // Resource Owner Password Credentials grant.\n    | 'password'\n    | 'refresh_token'\n    | 'token_exchange';\n\n  /** Redirect URI. May be left blank when using a pre-defined provider. */\n  redirectUri?: string;\n\n  /** Authorization scopes. When left blank the provider's default scopes, if any, will be used. */\n  scope?: string[];\n\n  /** Client name. May be left blank when using a pre-defined provider. */\n  clientName?: string;\n}\n\nexport interface OAuth2ClientConfig {\n  baseUri: string;\n  errorUri: string;\n  successUri: string;\n  provider: { [name: string]: Provider | undefined };\n  registration:\n    | { [name: string]: Registration | undefined }\n    | (() => Promise<{ [name: string]: Registration | undefined }>);\n}\n"],"mappings":";AAyGA,IAAY,aAAL,yBAAA,YAAA;CACL,WAAA,YAAA;CACA,WAAA,aAAA;CACA,WAAA,WAAA;CACA,WAAA,WAAA;CACA,WAAA,aAAA;CACA,WAAA,oBAAA;;AACF,EAAA,CAAA,CAAA"}
+{"version":3,"file":"types.mjs","names":[],"sources":["../../src/oauth2/types.ts"],"sourcesContent":["// reference: https://datatracker.ietf.org/doc/html/rfc7636\nexport interface PkceParameters {\n  code_verifier: string;\n  code_challenge: string;\n  code_challenge_method: 'S256' | 'plain';\n}\n\nexport interface OAuth2AuthorizationRequest {\n  state: string;\n  registrationId: string;\n  authorizationRequestUri: string;\n  additionalParameters: PkceParameters;\n}\n\ninterface CreateAuthorizationUriParams {\n  state: string;\n  clientId: string;\n  redirectUri: string;\n  scope: string[] | undefined;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n}\n\nexport interface ExchangeCodeParams {\n  code: string;\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  pkce?: Omit<PkceParameters, 'code_challenge' | 'code_challenge_method'>;\n}\n\nexport interface RefreshTokenParams {\n  clientId: string;\n  clientSecret: string;\n  refreshToken: string;\n}\n\nexport interface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret: string;\n}\n\nexport interface LoginOAuth2NativeParams {\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  pkce?: PkceParameters;\n  credentials: NativeCredential;\n}\n\n// reference: https://datatracker.ietf.org/doc/html/rfc6749#section-5.1\nexport interface OAuth2Token {\n  /**\n   * REQUIRED.\n   * The access token issued by the authorization server.\n   */\n  access_token: string;\n\n  /**\n   * REQUIRED.\n   * The type of the token issued as described in Section 7.1.  Value is case insensitive.\n   */\n  token_type: 'Bearer' | 'bearer' | 'mac' | (string & {});\n\n  /**\n   * RECOMMENDED.\n   * The lifetime in seconds of the access token. For example, the value \"3600\" denotes that the\n   * access token will expire in one hour from the time the response was generated. If omitted, the\n   * authorization server SHOULD provide the expiration time via other means or document the default\n   * value.\n   */\n  expires_in?: number;\n\n  /**\n   * OPTIONAL.\n   * The refresh token, which can be used to obtain new access tokens using the same authorization\n   * grant as described in Section 6.\n   */\n  refresh_token?: string;\n\n  /**\n   * OPTIONAL.\n   * If identical to the scope requested by the client; otherwise, REQUIRED. The scope of the\n   * access token as described by Section 3.3.\n   */\n  scope?: string;\n\n  id_token?: string;\n\n  [key: string]: unknown;\n}\n\nexport interface OidcToken extends OAuth2Token {\n  id_token: string;\n}\n\nexport type NativeCredential = {\n  state?: string;\n  code?: string;\n  client_id?: string;\n  redirect_uri?: string;\n  id_token?: string;\n  access_token?: string;\n};\n\nexport const OIDC_SCOPES = [\n  'openid',\n  'profile',\n  'email',\n  'phone',\n  'address',\n  'offline_access',\n] as const;\n\nexport type OidcScope = (typeof OIDC_SCOPES)[number];\n\n// https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims\nexport interface StandardClaims {\n  sub: string;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  middle_name?: string;\n  nickname?: string;\n  preferred_username?: string;\n  profile?: string;\n  picture?: string;\n  website?: string;\n  email?: string;\n  email_verified?: boolean;\n  gender?: 'female' | 'male' | (string & {});\n  birthdate?: string; // ISO 8601-1 [ISO8601‑1] YYYY-MM-DD format.\n  zoneinfo?: string; // IANA Time Zone Database [IANA.time‑zones]\n  locale?: string; // BCP47 [RFC5646] language tag.\n  phone_number?: string; // E.164\n  phone_number_verified?: boolean;\n  address?: {\n    formatted: string;\n    street_address: string;\n    locality: string;\n    region: string;\n    postal_code: string;\n    country: string;\n  }; // [RFC8259] JSON object\n  updated_at?: number;\n}\n\nexport interface UserInfo<T = unknown> {\n  claims: StandardClaims;\n  data: T;\n}\n\nexport interface Provider {\n  /** Authorization URI for the provider. */\n  authorizationUri: string;\n\n  /** Token URI for the provider. */\n  tokenUri: string;\n\n  /** Token revoke URI for the provider. */\n  tokenRevokeUri?: string;\n\n  /** Token refresh URI for the provider. */\n  tokenRefreshUri?: string;\n\n  /** User info URI for the provider. */\n  userInfoUri?: string;\n\n  /** User info authentication method for the provider. */\n  userInfoAuthenticationMethod?: string;\n\n  /**\n   * Name of the attribute that will be used to extract the username from the call to 'userInfoUri'.\n   * */\n  userNameAttribute?: string;\n\n  /** JWK set URI for the provider */\n  jwkSetUri?: string;\n\n  /**\n   * URI that can either be an OpenID Connect discovery endpoint or an OAuth 2.0 Authorization\n   * Server Metadata endpoint defined by RFC 8414.\n   * */\n  issuerUri?: string;\n\n  /** Default scopes for the provider. */\n  defaultScope: string[];\n\n  /** step 1: generate authorization uri and redirect user to it */\n  createAuthorizationUri: (params: CreateAuthorizationUriParams) => URL;\n\n  /** step 2: exchange code for token */\n  exchangeAuthorizationCode: (params: ExchangeCodeParams) => Promise<OAuth2Token>;\n\n  /** step 3: get user info */\n  getUserInfo: (token: OAuth2Token) => Promise<UserInfo>;\n\n  /** others: refresh access token */\n  refreshAccessToken?: (params: RefreshTokenParams) => Promise<OAuth2Token>;\n\n  /** others: revoke token */\n  revokeToken?: (params: RevokeTokenParams) => Promise<void>;\n\n  loginOAuth2Native?: (\n    params: LoginOAuth2NativeParams\n  ) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface OneTapProvider extends Provider {\n  getTokenInfo: (id_token: string) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface Registration {\n  /**\n   * Reference to the OAuth 2.0 provider to use. May reference an element from the 'provider'\n   * property or used one of the commonly used providers (google, github, facebook, okta).\n   * */\n  provider?: string;\n\n  /** Client ID for the registration. */\n  clientId: string;\n\n  /** Client secret of the registration. */\n  clientSecret: string;\n\n  /** Client authentication method. May be left blank when using a pre-defined provider. */\n  clientAuthenticationMethod?: string;\n\n  /** Authorization grant type. May be left blank when using a pre-defined provider. */\n  authorizationGrantType?:\n    | 'authorization_code' // default\n    | 'client_credentials'\n    | 'device_code'\n    | 'jwt_bearer'\n    // Deprecated. The latest OAuth 2.0 Security Best Current Practice disallows the use of the\n    // Resource Owner Password Credentials grant.\n    | 'password'\n    | 'refresh_token'\n    | 'token_exchange';\n\n  /** Redirect URI. May be left blank when using a pre-defined provider. */\n  redirectUri?: string;\n\n  /** Authorization scopes. When left blank the provider's default scopes, if any, will be used. */\n  scope?: string[];\n\n  /** Client name. May be left blank when using a pre-defined provider. */\n  clientName?: string;\n}\n\nexport interface OAuth2ClientConfig {\n  baseUri: string;\n  errorUri: string;\n  successUri: string;\n  provider: { [name: string]: Provider | undefined };\n  registration:\n    | { [name: string]: Registration | undefined }\n    | (() => Promise<{ [name: string]: Registration | undefined }>);\n}\n"],"mappings":";AAyGA,MAAa,cAAc;CACzB;CACA;CACA;CACA;CACA;CACA;AACF"}