@shware/security 3.4.1 → 4.1.0

package/dist/index.cjs

@@ -1,6 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_oauth2_client = require("./oauth2/client.cjs");
 const require_oauth2_error = require("./oauth2/error.cjs");
+const require_oauth2_name = require("./oauth2/name.cjs");
 const require_session_common = require("./session/common.cjs");
 const require_auth_index = require("./auth/index.cjs");
 const require_session_redis = require("./session/redis.cjs");
@@ -9,6 +10,7 @@ const require_core_index = require("./core/index.cjs");
 const require_oauth2_types = require("./oauth2/types.cjs");
 exports.Auth = require_auth_index.Auth;
 exports.DBIndexedSessionRepository = require_session_db.DBIndexedSessionRepository;
+exports.MAX_NAME_PART_LENGTH = require_oauth2_name.MAX_NAME_PART_LENGTH;
 exports.OAuth2Client = require_oauth2_client.OAuth2Client;
 exports.OAuth2Error = require_oauth2_error.OAuth2Error;
 exports.OIDC_SCOPES = require_oauth2_types.OIDC_SCOPES;
@@ -17,4 +19,5 @@ exports.PRINCIPAL_NAME_INDEX_NAME = require_session_common.PRINCIPAL_NAME_INDEX_
 exports.PROVIDERS = require_core_index.PROVIDERS;
 exports.RedisIndexedSessionRepository = require_session_redis.RedisIndexedSessionRepository;
 exports.RedisKVRepository = require_session_redis.RedisKVRepository;
+exports.composeName = require_oauth2_name.composeName;
 exports.oauth2RedirectQuerySchema = require_oauth2_client.oauth2RedirectQuerySchema;

package/dist/index.d.cts

@@ -1,11 +1,12 @@
 import { CsrfToken, PROVIDERS, Principal, Provider } from "./core/index.cjs";
 import { KVRepository, Namespace, Session, SessionRepository } from "./session/types.cjs";
-import { NativeCredential, OAuth2Token, OIDC_SCOPES, OidcScope, OidcToken, StandardClaims, UserInfo } from "./oauth2/types.cjs";
-import { AuthConfig, AuthService } from "./auth/types.cjs";
+import { AuthorizationResponse, NativeCredential, OAuth2Token, OIDC_SCOPES, OidcScope, OidcToken, PersonNameComponents, StandardClaims, UserInfo } from "./oauth2/types.cjs";
+import { AuthConfig, AuthService, Authorization, AuthorizedHandler, OAuth2AuthorizationOptions } from "./auth/types.cjs";
 import { Auth, PATH } from "./auth/index.cjs";
 import { OAuth2Client, oauth2RedirectQuerySchema } from "./oauth2/client.cjs";
 import { OAuth2Error, OAuth2ErrorType } from "./oauth2/error.cjs";
 import { RedisIndexedSessionRepository, RedisKVRepository } from "./session/redis.cjs";
 import { DBAdapter, DBIndexedSessionRepository } from "./session/db.cjs";
 import { PRINCIPAL_NAME_INDEX_NAME } from "./session/common.cjs";
-export { Auth, type AuthConfig, type AuthService, type CsrfToken, type DBAdapter, DBIndexedSessionRepository, type KVRepository, type Namespace, type NativeCredential, OAuth2Client, OAuth2Error, type OAuth2ErrorType, type OAuth2Token, OIDC_SCOPES, type OidcScope, type OidcToken, PATH, PRINCIPAL_NAME_INDEX_NAME, PROVIDERS, type Principal, type Provider, RedisIndexedSessionRepository, RedisKVRepository, type Session, type SessionRepository, type StandardClaims, type UserInfo, oauth2RedirectQuerySchema };
+import { MAX_NAME_PART_LENGTH, composeName } from "./oauth2/name.cjs";
+export { Auth, type AuthConfig, type AuthService, type Authorization, type AuthorizationResponse, type AuthorizedHandler, type CsrfToken, type DBAdapter, DBIndexedSessionRepository, type KVRepository, MAX_NAME_PART_LENGTH, type Namespace, type NativeCredential, type OAuth2AuthorizationOptions, OAuth2Client, OAuth2Error, type OAuth2ErrorType, type OAuth2Token, OIDC_SCOPES, type OidcScope, type OidcToken, PATH, PRINCIPAL_NAME_INDEX_NAME, PROVIDERS, type PersonNameComponents, type Principal, type Provider, RedisIndexedSessionRepository, RedisKVRepository, type Session, type SessionRepository, type StandardClaims, type UserInfo, composeName, oauth2RedirectQuerySchema };

package/dist/index.d.mts

@@ -1,11 +1,12 @@
 import { CsrfToken, PROVIDERS, Principal, Provider } from "./core/index.mjs";
 import { KVRepository, Namespace, Session, SessionRepository } from "./session/types.mjs";
-import { NativeCredential, OAuth2Token, OIDC_SCOPES, OidcScope, OidcToken, StandardClaims, UserInfo } from "./oauth2/types.mjs";
-import { AuthConfig, AuthService } from "./auth/types.mjs";
+import { AuthorizationResponse, NativeCredential, OAuth2Token, OIDC_SCOPES, OidcScope, OidcToken, PersonNameComponents, StandardClaims, UserInfo } from "./oauth2/types.mjs";
+import { AuthConfig, AuthService, Authorization, AuthorizedHandler, OAuth2AuthorizationOptions } from "./auth/types.mjs";
 import { Auth, PATH } from "./auth/index.mjs";
 import { OAuth2Client, oauth2RedirectQuerySchema } from "./oauth2/client.mjs";
 import { OAuth2Error, OAuth2ErrorType } from "./oauth2/error.mjs";
 import { RedisIndexedSessionRepository, RedisKVRepository } from "./session/redis.mjs";
 import { DBAdapter, DBIndexedSessionRepository } from "./session/db.mjs";
 import { PRINCIPAL_NAME_INDEX_NAME } from "./session/common.mjs";
-export { Auth, type AuthConfig, type AuthService, type CsrfToken, type DBAdapter, DBIndexedSessionRepository, type KVRepository, type Namespace, type NativeCredential, OAuth2Client, OAuth2Error, type OAuth2ErrorType, type OAuth2Token, OIDC_SCOPES, type OidcScope, type OidcToken, PATH, PRINCIPAL_NAME_INDEX_NAME, PROVIDERS, type Principal, type Provider, RedisIndexedSessionRepository, RedisKVRepository, type Session, type SessionRepository, type StandardClaims, type UserInfo, oauth2RedirectQuerySchema };
+import { MAX_NAME_PART_LENGTH, composeName } from "./oauth2/name.mjs";
+export { Auth, type AuthConfig, type AuthService, type Authorization, type AuthorizationResponse, type AuthorizedHandler, type CsrfToken, type DBAdapter, DBIndexedSessionRepository, type KVRepository, MAX_NAME_PART_LENGTH, type Namespace, type NativeCredential, type OAuth2AuthorizationOptions, OAuth2Client, OAuth2Error, type OAuth2ErrorType, type OAuth2Token, OIDC_SCOPES, type OidcScope, type OidcToken, PATH, PRINCIPAL_NAME_INDEX_NAME, PROVIDERS, type PersonNameComponents, type Principal, type Provider, RedisIndexedSessionRepository, RedisKVRepository, type Session, type SessionRepository, type StandardClaims, type UserInfo, composeName, oauth2RedirectQuerySchema };

package/dist/index.mjs

@@ -1,9 +1,10 @@
 import { OAuth2Client, oauth2RedirectQuerySchema } from "./oauth2/client.mjs";
 import { OAuth2Error } from "./oauth2/error.mjs";
+import { MAX_NAME_PART_LENGTH, composeName } from "./oauth2/name.mjs";
 import { PRINCIPAL_NAME_INDEX_NAME } from "./session/common.mjs";
 import { Auth, PATH } from "./auth/index.mjs";
 import { RedisIndexedSessionRepository, RedisKVRepository } from "./session/redis.mjs";
 import { DBIndexedSessionRepository } from "./session/db.mjs";
 import { PROVIDERS } from "./core/index.mjs";
 import { OIDC_SCOPES } from "./oauth2/types.mjs";
-export { Auth, DBIndexedSessionRepository, OAuth2Client, OAuth2Error, OIDC_SCOPES, PATH, PRINCIPAL_NAME_INDEX_NAME, PROVIDERS, RedisIndexedSessionRepository, RedisKVRepository, oauth2RedirectQuerySchema };
+export { Auth, DBIndexedSessionRepository, MAX_NAME_PART_LENGTH, OAuth2Client, OAuth2Error, OIDC_SCOPES, PATH, PRINCIPAL_NAME_INDEX_NAME, PROVIDERS, RedisIndexedSessionRepository, RedisKVRepository, composeName, oauth2RedirectQuerySchema };

package/dist/oauth2/client.cjs

@@ -7,7 +7,8 @@ const oauth2RedirectQuerySchema = (0, zod_v4_mini.object)({
 	state: (0, zod_v4_mini.optional)((0, zod_v4_mini.string)()),
 	error: (0, zod_v4_mini.optional)((0, zod_v4_mini.string)()),
 	error_description: (0, zod_v4_mini.optional)((0, zod_v4_mini.string)()),
-	error_uri: (0, zod_v4_mini.optional)((0, zod_v4_mini.string)())
+	error_uri: (0, zod_v4_mini.optional)((0, zod_v4_mini.string)()),
+	user: (0, zod_v4_mini.optional)((0, zod_v4_mini.string)())
 });
 const googleOneTapSchema = (0, zod_v4_mini.object)({
 	code: (0, zod_v4_mini.optional)((0, zod_v4_mini.string)()),
@@ -68,9 +69,9 @@ var OAuth2Client = class {
 			redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`
 		});
 	}
-	async getUserInfo({ registrationId, token }) {
+	async getUserInfo({ registrationId, token, response }) {
 		const { provider } = await this.getClientConfig(registrationId);
-		return provider.getUserInfo(token);
+		return provider.getUserInfo(token, response);
 	}
 	async refreshAccessToken({ registrationId, refreshToken }) {
 		const { provider, registration } = await this.getClientConfig(registrationId);

package/dist/oauth2/client.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"client.cjs","names":["object","optional","string"],"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { object, optional, string } from 'zod/v4-mini';\nimport type {\n  NativeCredential,\n  OAuth2ClientConfig,\n  OAuth2Token,\n  OidcToken,\n  PkceParameters,\n} from './types';\n\nexport const oauth2RedirectQuerySchema = object({\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n});\n\nexport const googleOneTapSchema = object({\n  // login_uri\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  nonce: optional(string()),\n  g_csrf_token: optional(string()),\n  hd: optional(string()),\n  // callback\n  credential: optional(string()),\n});\n\nexport class OAuth2Client {\n  private readonly config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get successUri() {\n    return this.config.successUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  private async getClientConfig(registrationId: string) {\n    const registrations =\n      typeof this.config.registration === 'function'\n        ? await this.config.registration()\n        : this.config.registration;\n\n    const registration = registrations[registrationId];\n    invariant(registration, `Registration ${registrationId} not found`);\n\n    const provider = this.config.provider[registration.provider ?? registrationId];\n    invariant(provider, `Provider ${registration.provider ?? registrationId} not found`);\n    return { registration, provider };\n  }\n\n  async createAuthorizationUri({\n    registrationId,\n    state,\n    pkce,\n  }: {\n    registrationId: string;\n    state: string;\n    pkce?: PkceParameters;\n  }): Promise<URL> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { scope, clientId, redirectUri } = registration;\n    return provider.createAuthorizationUri({\n      pkce,\n      state,\n      scope,\n      clientId,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async exchangeAuthorizationCode({\n    registrationId,\n    code,\n    pkce,\n  }: {\n    registrationId: string;\n    code: string;\n    pkce?: PkceParameters;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n    return provider.exchangeAuthorizationCode({\n      code,\n      pkce,\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async getUserInfo({\n    registrationId,\n    token,\n  }: {\n    registrationId: string;\n    token: OAuth2Token | OidcToken;\n  }) {\n    const { provider } = await this.getClientConfig(registrationId);\n    return provider.getUserInfo(token);\n  }\n\n  async refreshAccessToken({\n    registrationId,\n    refreshToken,\n  }: {\n    registrationId: string;\n    refreshToken: string;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    return provider.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken(registrationId: string, token: string) {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.revokeToken, 'Provider does not support revokeToken');\n    await provider.revokeToken({ token, clientId, clientSecret });\n  }\n\n  async loginOAuth2Native({\n    registrationId,\n    credentials,\n    pkce,\n  }: {\n    registrationId: string;\n    credentials: NativeCredential;\n    pkce?: PkceParameters;\n  }) {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    invariant(provider.loginOAuth2Native, 'Provider does not support loginOAuth2Native');\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n\n    return provider.loginOAuth2Native({\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n      credentials,\n      pkce,\n    });\n  }\n}\n"],"mappings":";;;;AAUA,MAAa,6BAAA,GAA4BA,YAAAA,OAAAA,CAAO;CAC9C,OAAA,GAAMC,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACvB,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,oBAAA,GAAmBD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACpC,YAAA,GAAWD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;AAC9B,CAAC;AAED,MAAa,sBAAA,GAAqBF,YAAAA,OAAAA,CAAO;CAEvC,OAAA,GAAMC,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACvB,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,oBAAA,GAAmBD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACpC,YAAA,GAAWD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CAC5B,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,eAAA,GAAcD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CAC/B,KAAA,GAAID,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CAErB,aAAA,GAAYD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;AAC/B,CAAC;AAED,IAAa,eAAb,MAA0B;CACxB;CACA,YAAY,QAA4B;EACtC,KAAK,SAAS;CAChB;CAEA,IAAI,UAAU;EACZ,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,aAAa;EACf,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,WAAW;EACb,OAAO,KAAK,OAAO;CACrB;CAEA,MAAc,gBAAgB,gBAAwB;EAMpD,MAAM,gBAJJ,OAAO,KAAK,OAAO,iBAAiB,aAChC,MAAM,KAAK,OAAO,aAAa,IAC/B,KAAK,OAAO,aAAA,CAEiB;EACnC,CAAA,GAAA,cAAA,UAAA,CAAU,cAAc,gBAAgB,eAAe,WAAW;EAElE,MAAM,WAAW,KAAK,OAAO,SAAS,aAAa,YAAY;EAC/D,CAAA,GAAA,cAAA,UAAA,CAAU,UAAU,YAAY,aAAa,YAAY,eAAe,WAAW;EACnF,OAAO;GAAE;GAAc;EAAS;CAClC;CAEA,MAAM,uBAAuB,EAC3B,gBACA,OACA,QAKe;EACf,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAE5E,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,OAAO,UAAU,gBAAgB;EACzC,OAAO,SAAS,uBAAuB;GACrC;GACA;GACA;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;EAC9D,CAAC;CACH;CAEA,MAAM,0BAA0B,EAC9B,gBACA,MACA,QAKuB;EACvB,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAE5E,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,UAAU,cAAc,gBAAgB;EAChD,OAAO,SAAS,0BAA0B;GACxC;GACA;GACA;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;EAC9D,CAAC;CACH;CAEA,MAAM,YAAY,EAChB,gBACA,SAIC;EACD,MAAM,EAAE,aAAa,MAAM,KAAK,gBAAgB,cAAc;EAC9D,OAAO,SAAS,YAAY,KAAK;CACnC;CAEA,MAAM,mBAAmB,EACvB,gBACA,gBAIuB;EACvB,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,MAAM,EAAE,UAAU,iBAAiB;EAEnC,CAAA,GAAA,cAAA,UAAA,CAAU,SAAS,oBAAoB,8CAA8C;EACrF,OAAO,SAAS,mBAAmB;GAAE;GAAc;GAAU;EAAa,CAAC;CAC7E;CAEA,MAAM,YAAY,gBAAwB,OAAe;EACvD,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,MAAM,EAAE,UAAU,iBAAiB;EAEnC,CAAA,GAAA,cAAA,UAAA,CAAU,SAAS,aAAa,uCAAuC;EACvE,MAAM,SAAS,YAAY;GAAE;GAAO;GAAU;EAAa,CAAC;CAC9D;CAEA,MAAM,kBAAkB,EACtB,gBACA,aACA,QAKC;EACD,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,CAAA,GAAA,cAAA,UAAA,CAAU,SAAS,mBAAmB,6CAA6C;EACnF,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,UAAU,cAAc,gBAAgB;EAEhD,OAAO,SAAS,kBAAkB;GAChC;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;GAC5D;GACA;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"client.cjs","names":["object","optional","string"],"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { object, optional, string } from 'zod/v4-mini';\nimport type {\n  AuthorizationResponse,\n  NativeCredential,\n  OAuth2ClientConfig,\n  OAuth2Token,\n  OidcToken,\n  PkceParameters,\n} from './types';\n\nexport const oauth2RedirectQuerySchema = object({\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  // Apple's form_post: the user's name as JSON, first authorization only.\n  user: optional(string()),\n});\n\nexport const googleOneTapSchema = object({\n  // login_uri\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  nonce: optional(string()),\n  g_csrf_token: optional(string()),\n  hd: optional(string()),\n  // callback\n  credential: optional(string()),\n});\n\nexport class OAuth2Client {\n  private readonly config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get successUri() {\n    return this.config.successUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  private async getClientConfig(registrationId: string) {\n    const registrations =\n      typeof this.config.registration === 'function'\n        ? await this.config.registration()\n        : this.config.registration;\n\n    const registration = registrations[registrationId];\n    invariant(registration, `Registration ${registrationId} not found`);\n\n    const provider = this.config.provider[registration.provider ?? registrationId];\n    invariant(provider, `Provider ${registration.provider ?? registrationId} not found`);\n    return { registration, provider };\n  }\n\n  async createAuthorizationUri({\n    registrationId,\n    state,\n    pkce,\n  }: {\n    registrationId: string;\n    state: string;\n    pkce?: PkceParameters;\n  }): Promise<URL> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { scope, clientId, redirectUri } = registration;\n    return provider.createAuthorizationUri({\n      pkce,\n      state,\n      scope,\n      clientId,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async exchangeAuthorizationCode({\n    registrationId,\n    code,\n    pkce,\n  }: {\n    registrationId: string;\n    code: string;\n    pkce?: PkceParameters;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n    return provider.exchangeAuthorizationCode({\n      code,\n      pkce,\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async getUserInfo({\n    registrationId,\n    token,\n    response,\n  }: {\n    registrationId: string;\n    token: OAuth2Token | OidcToken;\n    response?: AuthorizationResponse;\n  }) {\n    const { provider } = await this.getClientConfig(registrationId);\n    return provider.getUserInfo(token, response);\n  }\n\n  async refreshAccessToken({\n    registrationId,\n    refreshToken,\n  }: {\n    registrationId: string;\n    refreshToken: string;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    return provider.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken(registrationId: string, token: string) {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.revokeToken, 'Provider does not support revokeToken');\n    await provider.revokeToken({ token, clientId, clientSecret });\n  }\n\n  async loginOAuth2Native({\n    registrationId,\n    credentials,\n    pkce,\n  }: {\n    registrationId: string;\n    credentials: NativeCredential;\n    pkce?: PkceParameters;\n  }) {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    invariant(provider.loginOAuth2Native, 'Provider does not support loginOAuth2Native');\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n\n    return provider.loginOAuth2Native({\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n      credentials,\n      pkce,\n    });\n  }\n}\n"],"mappings":";;;;AAWA,MAAa,6BAAA,GAA4BA,YAAAA,OAAAA,CAAO;CAC9C,OAAA,GAAMC,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACvB,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,oBAAA,GAAmBD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACpC,YAAA,GAAWD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CAE5B,OAAA,GAAMD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;AACzB,CAAC;AAED,MAAa,sBAAA,GAAqBF,YAAAA,OAAAA,CAAO;CAEvC,OAAA,GAAMC,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACvB,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,oBAAA,GAAmBD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACpC,YAAA,GAAWD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CAC5B,QAAA,GAAOD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CACxB,eAAA,GAAcD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CAC/B,KAAA,GAAID,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;CAErB,aAAA,GAAYD,YAAAA,SAAAA,EAAAA,GAASC,YAAAA,OAAAA,CAAO,CAAC;AAC/B,CAAC;AAED,IAAa,eAAb,MAA0B;CACxB;CACA,YAAY,QAA4B;EACtC,KAAK,SAAS;CAChB;CAEA,IAAI,UAAU;EACZ,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,aAAa;EACf,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,WAAW;EACb,OAAO,KAAK,OAAO;CACrB;CAEA,MAAc,gBAAgB,gBAAwB;EAMpD,MAAM,gBAJJ,OAAO,KAAK,OAAO,iBAAiB,aAChC,MAAM,KAAK,OAAO,aAAa,IAC/B,KAAK,OAAO,aAAA,CAEiB;EACnC,CAAA,GAAA,cAAA,UAAA,CAAU,cAAc,gBAAgB,eAAe,WAAW;EAElE,MAAM,WAAW,KAAK,OAAO,SAAS,aAAa,YAAY;EAC/D,CAAA,GAAA,cAAA,UAAA,CAAU,UAAU,YAAY,aAAa,YAAY,eAAe,WAAW;EACnF,OAAO;GAAE;GAAc;EAAS;CAClC;CAEA,MAAM,uBAAuB,EAC3B,gBACA,OACA,QAKe;EACf,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAE5E,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,OAAO,UAAU,gBAAgB;EACzC,OAAO,SAAS,uBAAuB;GACrC;GACA;GACA;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;EAC9D,CAAC;CACH;CAEA,MAAM,0BAA0B,EAC9B,gBACA,MACA,QAKuB;EACvB,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAE5E,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,UAAU,cAAc,gBAAgB;EAChD,OAAO,SAAS,0BAA0B;GACxC;GACA;GACA;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;EAC9D,CAAC;CACH;CAEA,MAAM,YAAY,EAChB,gBACA,OACA,YAKC;EACD,MAAM,EAAE,aAAa,MAAM,KAAK,gBAAgB,cAAc;EAC9D,OAAO,SAAS,YAAY,OAAO,QAAQ;CAC7C;CAEA,MAAM,mBAAmB,EACvB,gBACA,gBAIuB;EACvB,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,MAAM,EAAE,UAAU,iBAAiB;EAEnC,CAAA,GAAA,cAAA,UAAA,CAAU,SAAS,oBAAoB,8CAA8C;EACrF,OAAO,SAAS,mBAAmB;GAAE;GAAc;GAAU;EAAa,CAAC;CAC7E;CAEA,MAAM,YAAY,gBAAwB,OAAe;EACvD,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,MAAM,EAAE,UAAU,iBAAiB;EAEnC,CAAA,GAAA,cAAA,UAAA,CAAU,SAAS,aAAa,uCAAuC;EACvE,MAAM,SAAS,YAAY;GAAE;GAAO;GAAU;EAAa,CAAC;CAC9D;CAEA,MAAM,kBAAkB,EACtB,gBACA,aACA,QAKC;EACD,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,CAAA,GAAA,cAAA,UAAA,CAAU,SAAS,mBAAmB,6CAA6C;EACnF,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,UAAU,cAAc,gBAAgB;EAEhD,OAAO,SAAS,kBAAkB;GAChC;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;GAC5D;GACA;EACF,CAAC;CACH;AACF"}

package/dist/oauth2/client.d.cts

@@ -1,4 +1,4 @@
-import { NativeCredential, OAuth2ClientConfig, OAuth2Token, OidcToken, PkceParameters, UserInfo } from "./types.cjs";
+import { AuthorizationResponse, NativeCredential, OAuth2ClientConfig, OAuth2Token, OidcToken, PkceParameters, UserInfo } from "./types.cjs";
 //#region src/oauth2/client.d.ts
 export declare const oauth2RedirectQuerySchema: import("zod/mini").ZodMiniObject<{
   code: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
@@ -6,6 +6,7 @@ export declare const oauth2RedirectQuerySchema: import("zod/mini").ZodMiniObject
   error: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
   error_description: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
   error_uri: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+  user: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
 }, import("zod/v4/core").$strip>;
 export declare const googleOneTapSchema: import("zod/mini").ZodMiniObject<{
   code: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
@@ -35,9 +36,10 @@ export declare class OAuth2Client {
     code: string;
     pkce?: PkceParameters;
   }): Promise<OAuth2Token>;
-  getUserInfo({ registrationId, token }: {
+  getUserInfo({ registrationId, token, response }: {
     registrationId: string;
     token: OAuth2Token | OidcToken;
+    response?: AuthorizationResponse;
   }): Promise<UserInfo<unknown>>;
   refreshAccessToken({ registrationId, refreshToken }: {
     registrationId: string;

package/dist/oauth2/client.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.cts","names":["_$__types0.UserInfo"],"sources":["../../src/oauth2/client.ts"],"mappings":";;qBAUa,8CAAyB;;;;;;yBAMpC;qBAEW,uCAAkB;;;;;;;;;;yBAY7B;qBAEW;mBACM;EACjB,YAAY,QAAQ;MAIhB;MAIA;MAIA;UAIU;EAcR,yBACJ,gBACA,OACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;EAcN,4BACJ,gBACA,MACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;EAcN,cACJ,gBACA;IAEA;IACA,OAAO,cAAc;MACtB,QADsBA;EAMjB,qBACJ,gBACA;IAEA;IACA;MACE,QAAQ;EAQN,YAAY,wBAAwB,gBAAa;EAQjD,oBACJ,gBACA,aACA;IAEA;IACA,aAAa;IACb,OAAO;MACR"}
+{"version":3,"file":"client.d.cts","names":["_$__types0.UserInfo"],"sources":["../../src/oauth2/client.ts"],"mappings":";;qBAWa,8CAAyB;;;;;;;yBAQpC;qBAEW,uCAAkB;;;;;;;;;;yBAY7B;qBAEW;mBACM;EACjB,YAAY,QAAQ;MAIhB;MAIA;MAIA;UAIU;EAcR,yBACJ,gBACA,OACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;EAcN,4BACJ,gBACA,MACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;EAcN,cACJ,gBACA,OACA;IAEA;IACA,OAAO,cAAc;IACrB,WAAW;MACZ,QADYA;EAMP,qBACJ,gBACA;IAEA;IACA;MACE,QAAQ;EAQN,YAAY,wBAAwB,gBAAa;EAQjD,oBACJ,gBACA,aACA;IAEA;IACA,aAAa;IACb,OAAO;MACR"}

package/dist/oauth2/client.d.mts

@@ -1,4 +1,4 @@
-import { NativeCredential, OAuth2ClientConfig, OAuth2Token, OidcToken, PkceParameters, UserInfo } from "./types.mjs";
+import { AuthorizationResponse, NativeCredential, OAuth2ClientConfig, OAuth2Token, OidcToken, PkceParameters, UserInfo } from "./types.mjs";
 //#region src/oauth2/client.d.ts
 export declare const oauth2RedirectQuerySchema: import("zod/mini").ZodMiniObject<{
   code: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
@@ -6,6 +6,7 @@ export declare const oauth2RedirectQuerySchema: import("zod/mini").ZodMiniObject
   error: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
   error_description: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
   error_uri: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+  user: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
 }, import("zod/v4/core").$strip>;
 export declare const googleOneTapSchema: import("zod/mini").ZodMiniObject<{
   code: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
@@ -35,9 +36,10 @@ export declare class OAuth2Client {
     code: string;
     pkce?: PkceParameters;
   }): Promise<OAuth2Token>;
-  getUserInfo({ registrationId, token }: {
+  getUserInfo({ registrationId, token, response }: {
     registrationId: string;
     token: OAuth2Token | OidcToken;
+    response?: AuthorizationResponse;
   }): Promise<UserInfo<unknown>>;
   refreshAccessToken({ registrationId, refreshToken }: {
     registrationId: string;

package/dist/oauth2/client.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.mts","names":["_$__types0.UserInfo"],"sources":["../../src/oauth2/client.ts"],"mappings":";;qBAUa,8CAAyB;;;;;;yBAMpC;qBAEW,uCAAkB;;;;;;;;;;yBAY7B;qBAEW;mBACM;EACjB,YAAY,QAAQ;MAIhB;MAIA;MAIA;UAIU;EAcR,yBACJ,gBACA,OACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;EAcN,4BACJ,gBACA,MACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;EAcN,cACJ,gBACA;IAEA;IACA,OAAO,cAAc;MACtB,QADsBA;EAMjB,qBACJ,gBACA;IAEA;IACA;MACE,QAAQ;EAQN,YAAY,wBAAwB,gBAAa;EAQjD,oBACJ,gBACA,aACA;IAEA;IACA,aAAa;IACb,OAAO;MACR"}
+{"version":3,"file":"client.d.mts","names":["_$__types0.UserInfo"],"sources":["../../src/oauth2/client.ts"],"mappings":";;qBAWa,8CAAyB;;;;;;;yBAQpC;qBAEW,uCAAkB;;;;;;;;;;yBAY7B;qBAEW;mBACM;EACjB,YAAY,QAAQ;MAIhB;MAIA;MAIA;UAIU;EAcR,yBACJ,gBACA,OACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;EAcN,4BACJ,gBACA,MACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;EAcN,cACJ,gBACA,OACA;IAEA;IACA,OAAO,cAAc;IACrB,WAAW;MACZ,QADYA;EAMP,qBACJ,gBACA;IAEA;IACA;MACE,QAAQ;EAQN,YAAY,wBAAwB,gBAAa;EAQjD,oBACJ,gBACA,aACA;IAEA;IACA,aAAa;IACb,OAAO;MACR"}

package/dist/oauth2/client.mjs

@@ -6,7 +6,8 @@ const oauth2RedirectQuerySchema = object({
 	state: optional(string()),
 	error: optional(string()),
 	error_description: optional(string()),
-	error_uri: optional(string())
+	error_uri: optional(string()),
+	user: optional(string())
 });
 const googleOneTapSchema = object({
 	code: optional(string()),
@@ -67,9 +68,9 @@ var OAuth2Client = class {
 			redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`
 		});
 	}
-	async getUserInfo({ registrationId, token }) {
+	async getUserInfo({ registrationId, token, response }) {
 		const { provider } = await this.getClientConfig(registrationId);
-		return provider.getUserInfo(token);
+		return provider.getUserInfo(token, response);
 	}
 	async refreshAccessToken({ registrationId, refreshToken }) {
 		const { provider, registration } = await this.getClientConfig(registrationId);

package/dist/oauth2/client.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"client.mjs","names":[],"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { object, optional, string } from 'zod/v4-mini';\nimport type {\n  NativeCredential,\n  OAuth2ClientConfig,\n  OAuth2Token,\n  OidcToken,\n  PkceParameters,\n} from './types';\n\nexport const oauth2RedirectQuerySchema = object({\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n});\n\nexport const googleOneTapSchema = object({\n  // login_uri\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  nonce: optional(string()),\n  g_csrf_token: optional(string()),\n  hd: optional(string()),\n  // callback\n  credential: optional(string()),\n});\n\nexport class OAuth2Client {\n  private readonly config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get successUri() {\n    return this.config.successUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  private async getClientConfig(registrationId: string) {\n    const registrations =\n      typeof this.config.registration === 'function'\n        ? await this.config.registration()\n        : this.config.registration;\n\n    const registration = registrations[registrationId];\n    invariant(registration, `Registration ${registrationId} not found`);\n\n    const provider = this.config.provider[registration.provider ?? registrationId];\n    invariant(provider, `Provider ${registration.provider ?? registrationId} not found`);\n    return { registration, provider };\n  }\n\n  async createAuthorizationUri({\n    registrationId,\n    state,\n    pkce,\n  }: {\n    registrationId: string;\n    state: string;\n    pkce?: PkceParameters;\n  }): Promise<URL> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { scope, clientId, redirectUri } = registration;\n    return provider.createAuthorizationUri({\n      pkce,\n      state,\n      scope,\n      clientId,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async exchangeAuthorizationCode({\n    registrationId,\n    code,\n    pkce,\n  }: {\n    registrationId: string;\n    code: string;\n    pkce?: PkceParameters;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n    return provider.exchangeAuthorizationCode({\n      code,\n      pkce,\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async getUserInfo({\n    registrationId,\n    token,\n  }: {\n    registrationId: string;\n    token: OAuth2Token | OidcToken;\n  }) {\n    const { provider } = await this.getClientConfig(registrationId);\n    return provider.getUserInfo(token);\n  }\n\n  async refreshAccessToken({\n    registrationId,\n    refreshToken,\n  }: {\n    registrationId: string;\n    refreshToken: string;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    return provider.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken(registrationId: string, token: string) {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.revokeToken, 'Provider does not support revokeToken');\n    await provider.revokeToken({ token, clientId, clientSecret });\n  }\n\n  async loginOAuth2Native({\n    registrationId,\n    credentials,\n    pkce,\n  }: {\n    registrationId: string;\n    credentials: NativeCredential;\n    pkce?: PkceParameters;\n  }) {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    invariant(provider.loginOAuth2Native, 'Provider does not support loginOAuth2Native');\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n\n    return provider.loginOAuth2Native({\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n      credentials,\n      pkce,\n    });\n  }\n}\n"],"mappings":";;;AAUA,MAAa,4BAA4B,OAAO;CAC9C,MAAM,SAAS,OAAO,CAAC;CACvB,OAAO,SAAS,OAAO,CAAC;CACxB,OAAO,SAAS,OAAO,CAAC;CACxB,mBAAmB,SAAS,OAAO,CAAC;CACpC,WAAW,SAAS,OAAO,CAAC;AAC9B,CAAC;AAED,MAAa,qBAAqB,OAAO;CAEvC,MAAM,SAAS,OAAO,CAAC;CACvB,OAAO,SAAS,OAAO,CAAC;CACxB,OAAO,SAAS,OAAO,CAAC;CACxB,mBAAmB,SAAS,OAAO,CAAC;CACpC,WAAW,SAAS,OAAO,CAAC;CAC5B,OAAO,SAAS,OAAO,CAAC;CACxB,cAAc,SAAS,OAAO,CAAC;CAC/B,IAAI,SAAS,OAAO,CAAC;CAErB,YAAY,SAAS,OAAO,CAAC;AAC/B,CAAC;AAED,IAAa,eAAb,MAA0B;CACxB;CACA,YAAY,QAA4B;EACtC,KAAK,SAAS;CAChB;CAEA,IAAI,UAAU;EACZ,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,aAAa;EACf,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,WAAW;EACb,OAAO,KAAK,OAAO;CACrB;CAEA,MAAc,gBAAgB,gBAAwB;EAMpD,MAAM,gBAJJ,OAAO,KAAK,OAAO,iBAAiB,aAChC,MAAM,KAAK,OAAO,aAAa,IAC/B,KAAK,OAAO,aAAA,CAEiB;EACnC,UAAU,cAAc,gBAAgB,eAAe,WAAW;EAElE,MAAM,WAAW,KAAK,OAAO,SAAS,aAAa,YAAY;EAC/D,UAAU,UAAU,YAAY,aAAa,YAAY,eAAe,WAAW;EACnF,OAAO;GAAE;GAAc;EAAS;CAClC;CAEA,MAAM,uBAAuB,EAC3B,gBACA,OACA,QAKe;EACf,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAE5E,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,OAAO,UAAU,gBAAgB;EACzC,OAAO,SAAS,uBAAuB;GACrC;GACA;GACA;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;EAC9D,CAAC;CACH;CAEA,MAAM,0BAA0B,EAC9B,gBACA,MACA,QAKuB;EACvB,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAE5E,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,UAAU,cAAc,gBAAgB;EAChD,OAAO,SAAS,0BAA0B;GACxC;GACA;GACA;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;EAC9D,CAAC;CACH;CAEA,MAAM,YAAY,EAChB,gBACA,SAIC;EACD,MAAM,EAAE,aAAa,MAAM,KAAK,gBAAgB,cAAc;EAC9D,OAAO,SAAS,YAAY,KAAK;CACnC;CAEA,MAAM,mBAAmB,EACvB,gBACA,gBAIuB;EACvB,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,MAAM,EAAE,UAAU,iBAAiB;EAEnC,UAAU,SAAS,oBAAoB,8CAA8C;EACrF,OAAO,SAAS,mBAAmB;GAAE;GAAc;GAAU;EAAa,CAAC;CAC7E;CAEA,MAAM,YAAY,gBAAwB,OAAe;EACvD,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,MAAM,EAAE,UAAU,iBAAiB;EAEnC,UAAU,SAAS,aAAa,uCAAuC;EACvE,MAAM,SAAS,YAAY;GAAE;GAAO;GAAU;EAAa,CAAC;CAC9D;CAEA,MAAM,kBAAkB,EACtB,gBACA,aACA,QAKC;EACD,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,UAAU,SAAS,mBAAmB,6CAA6C;EACnF,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,UAAU,cAAc,gBAAgB;EAEhD,OAAO,SAAS,kBAAkB;GAChC;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;GAC5D;GACA;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"client.mjs","names":[],"sources":["../../src/oauth2/client.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { object, optional, string } from 'zod/v4-mini';\nimport type {\n  AuthorizationResponse,\n  NativeCredential,\n  OAuth2ClientConfig,\n  OAuth2Token,\n  OidcToken,\n  PkceParameters,\n} from './types';\n\nexport const oauth2RedirectQuerySchema = object({\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  // Apple's form_post: the user's name as JSON, first authorization only.\n  user: optional(string()),\n});\n\nexport const googleOneTapSchema = object({\n  // login_uri\n  code: optional(string()),\n  state: optional(string()),\n  error: optional(string()),\n  error_description: optional(string()),\n  error_uri: optional(string()),\n  nonce: optional(string()),\n  g_csrf_token: optional(string()),\n  hd: optional(string()),\n  // callback\n  credential: optional(string()),\n});\n\nexport class OAuth2Client {\n  private readonly config: OAuth2ClientConfig;\n  constructor(config: OAuth2ClientConfig) {\n    this.config = config;\n  }\n\n  get baseUri() {\n    return this.config.baseUri;\n  }\n\n  get successUri() {\n    return this.config.successUri;\n  }\n\n  get errorUri() {\n    return this.config.errorUri;\n  }\n\n  private async getClientConfig(registrationId: string) {\n    const registrations =\n      typeof this.config.registration === 'function'\n        ? await this.config.registration()\n        : this.config.registration;\n\n    const registration = registrations[registrationId];\n    invariant(registration, `Registration ${registrationId} not found`);\n\n    const provider = this.config.provider[registration.provider ?? registrationId];\n    invariant(provider, `Provider ${registration.provider ?? registrationId} not found`);\n    return { registration, provider };\n  }\n\n  async createAuthorizationUri({\n    registrationId,\n    state,\n    pkce,\n  }: {\n    registrationId: string;\n    state: string;\n    pkce?: PkceParameters;\n  }): Promise<URL> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { scope, clientId, redirectUri } = registration;\n    return provider.createAuthorizationUri({\n      pkce,\n      state,\n      scope,\n      clientId,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async exchangeAuthorizationCode({\n    registrationId,\n    code,\n    pkce,\n  }: {\n    registrationId: string;\n    code: string;\n    pkce?: PkceParameters;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n    return provider.exchangeAuthorizationCode({\n      code,\n      pkce,\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n    });\n  }\n\n  async getUserInfo({\n    registrationId,\n    token,\n    response,\n  }: {\n    registrationId: string;\n    token: OAuth2Token | OidcToken;\n    response?: AuthorizationResponse;\n  }) {\n    const { provider } = await this.getClientConfig(registrationId);\n    return provider.getUserInfo(token, response);\n  }\n\n  async refreshAccessToken({\n    registrationId,\n    refreshToken,\n  }: {\n    registrationId: string;\n    refreshToken: string;\n  }): Promise<OAuth2Token> {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.refreshAccessToken, 'Provider does not support refreshAccessToken');\n    return provider.refreshAccessToken({ refreshToken, clientId, clientSecret });\n  }\n\n  async revokeToken(registrationId: string, token: string) {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    const { clientId, clientSecret } = registration;\n\n    invariant(provider.revokeToken, 'Provider does not support revokeToken');\n    await provider.revokeToken({ token, clientId, clientSecret });\n  }\n\n  async loginOAuth2Native({\n    registrationId,\n    credentials,\n    pkce,\n  }: {\n    registrationId: string;\n    credentials: NativeCredential;\n    pkce?: PkceParameters;\n  }) {\n    const { provider, registration } = await this.getClientConfig(registrationId);\n    invariant(provider.loginOAuth2Native, 'Provider does not support loginOAuth2Native');\n    const { baseUri } = this.config;\n    const { clientId, clientSecret, redirectUri } = registration;\n\n    return provider.loginOAuth2Native({\n      clientId,\n      clientSecret,\n      redirectUri: redirectUri ?? `${baseUri}/login/oauth2/code/${registrationId}`,\n      credentials,\n      pkce,\n    });\n  }\n}\n"],"mappings":";;;AAWA,MAAa,4BAA4B,OAAO;CAC9C,MAAM,SAAS,OAAO,CAAC;CACvB,OAAO,SAAS,OAAO,CAAC;CACxB,OAAO,SAAS,OAAO,CAAC;CACxB,mBAAmB,SAAS,OAAO,CAAC;CACpC,WAAW,SAAS,OAAO,CAAC;CAE5B,MAAM,SAAS,OAAO,CAAC;AACzB,CAAC;AAED,MAAa,qBAAqB,OAAO;CAEvC,MAAM,SAAS,OAAO,CAAC;CACvB,OAAO,SAAS,OAAO,CAAC;CACxB,OAAO,SAAS,OAAO,CAAC;CACxB,mBAAmB,SAAS,OAAO,CAAC;CACpC,WAAW,SAAS,OAAO,CAAC;CAC5B,OAAO,SAAS,OAAO,CAAC;CACxB,cAAc,SAAS,OAAO,CAAC;CAC/B,IAAI,SAAS,OAAO,CAAC;CAErB,YAAY,SAAS,OAAO,CAAC;AAC/B,CAAC;AAED,IAAa,eAAb,MAA0B;CACxB;CACA,YAAY,QAA4B;EACtC,KAAK,SAAS;CAChB;CAEA,IAAI,UAAU;EACZ,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,aAAa;EACf,OAAO,KAAK,OAAO;CACrB;CAEA,IAAI,WAAW;EACb,OAAO,KAAK,OAAO;CACrB;CAEA,MAAc,gBAAgB,gBAAwB;EAMpD,MAAM,gBAJJ,OAAO,KAAK,OAAO,iBAAiB,aAChC,MAAM,KAAK,OAAO,aAAa,IAC/B,KAAK,OAAO,aAAA,CAEiB;EACnC,UAAU,cAAc,gBAAgB,eAAe,WAAW;EAElE,MAAM,WAAW,KAAK,OAAO,SAAS,aAAa,YAAY;EAC/D,UAAU,UAAU,YAAY,aAAa,YAAY,eAAe,WAAW;EACnF,OAAO;GAAE;GAAc;EAAS;CAClC;CAEA,MAAM,uBAAuB,EAC3B,gBACA,OACA,QAKe;EACf,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAE5E,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,OAAO,UAAU,gBAAgB;EACzC,OAAO,SAAS,uBAAuB;GACrC;GACA;GACA;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;EAC9D,CAAC;CACH;CAEA,MAAM,0BAA0B,EAC9B,gBACA,MACA,QAKuB;EACvB,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAE5E,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,UAAU,cAAc,gBAAgB;EAChD,OAAO,SAAS,0BAA0B;GACxC;GACA;GACA;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;EAC9D,CAAC;CACH;CAEA,MAAM,YAAY,EAChB,gBACA,OACA,YAKC;EACD,MAAM,EAAE,aAAa,MAAM,KAAK,gBAAgB,cAAc;EAC9D,OAAO,SAAS,YAAY,OAAO,QAAQ;CAC7C;CAEA,MAAM,mBAAmB,EACvB,gBACA,gBAIuB;EACvB,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,MAAM,EAAE,UAAU,iBAAiB;EAEnC,UAAU,SAAS,oBAAoB,8CAA8C;EACrF,OAAO,SAAS,mBAAmB;GAAE;GAAc;GAAU;EAAa,CAAC;CAC7E;CAEA,MAAM,YAAY,gBAAwB,OAAe;EACvD,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,MAAM,EAAE,UAAU,iBAAiB;EAEnC,UAAU,SAAS,aAAa,uCAAuC;EACvE,MAAM,SAAS,YAAY;GAAE;GAAO;GAAU;EAAa,CAAC;CAC9D;CAEA,MAAM,kBAAkB,EACtB,gBACA,aACA,QAKC;EACD,MAAM,EAAE,UAAU,iBAAiB,MAAM,KAAK,gBAAgB,cAAc;EAC5E,UAAU,SAAS,mBAAmB,6CAA6C;EACnF,MAAM,EAAE,YAAY,KAAK;EACzB,MAAM,EAAE,UAAU,cAAc,gBAAgB;EAEhD,OAAO,SAAS,kBAAkB;GAChC;GACA;GACA,aAAa,eAAe,GAAG,QAAQ,qBAAqB;GAC5D;GACA;EACF,CAAC;CACH;AACF"}

package/dist/oauth2/name.cjs

@@ -0,0 +1,107 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/oauth2/name.ts
+/**
+* Upper bound, in characters, on each name part taken from the client. Names that reach us outside
+* a signed token (Apple's form_post `user`, a native login body) are plain client input, so they
+* are capped before a host stores them; 64 leaves room for any real given or family name.
+*/
+const MAX_NAME_PART_LENGTH = 64;
+/** Apple's form_post `user` is a few dozen bytes; anything far larger is not Apple's. */
+const MAX_APPLE_USER_LENGTH = 1024;
+const CJK = /^[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Hangul}]+$/u;
+/**
+* Composes a display `name` from its parts, for providers that hand out the parts only. Chinese,
+* Japanese and Korean names are written family name first without a space (`王小明`), every other
+* name given name first (`John Appleseed`), which is also the safe choice for mixed scripts. With
+* one part only, that part is the name.
+*/
+function composeName({ given_name, family_name }) {
+	const given = given_name?.trim();
+	const family = family_name?.trim();
+	if (given && family) return CJK.test(given) && CJK.test(family) ? `${family}${given}` : `${given} ${family}`;
+	return given || family || void 0;
+}
+/**
+* One untrusted name part: a non-blank string, trimmed and capped at `MAX_NAME_PART_LENGTH`
+* characters (code points, so a cut never splits one). Anything else is dropped rather than refused,
+* because the name is a nicety and must never cost the user their login.
+*/
+function cleanNamePart(value) {
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	if (!trimmed) return void 0;
+	return Array.from(trimmed).slice(0, 64).join("");
+}
+/**
+* Parses Apple's form_post `user` (JSON, first authorization only). Malformed JSON or a wrong shape
+* yields `undefined`, never an error. Only known fields are kept, each cleaned, so what a host
+* persists stays small.
+*/
+function parseAppleUser(raw) {
+	if (!raw || raw.length > MAX_APPLE_USER_LENGTH) return void 0;
+	let json;
+	try {
+		json = JSON.parse(raw);
+	} catch {
+		return;
+	}
+	if (!isObject(json)) return void 0;
+	const user = {};
+	if (isObject(json.name)) {
+		const firstName = cleanNamePart(json.name.firstName);
+		const lastName = cleanNamePart(json.name.lastName);
+		if (firstName || lastName) user.name = withoutUndefined({
+			firstName,
+			lastName
+		});
+	}
+	const email = typeof json.email === "string" ? json.email.trim().slice(0, 320) : void 0;
+	if (email) user.email = email;
+	return user.name || user.email ? user : void 0;
+}
+const PERSON_NAME_KEYS = [
+	"givenName",
+	"familyName",
+	"middleName",
+	"namePrefix",
+	"nameSuffix",
+	"nickname"
+];
+/**
+* Cleans the `fullName` of a native login body (iOS `PersonNameComponents`): known keys only,
+* each a cleaned string; `undefined` when nothing usable is left.
+*/
+function cleanPersonName(value) {
+	if (!isObject(value)) return void 0;
+	const name = {};
+	for (const key of PERSON_NAME_KEYS) {
+		const part = cleanNamePart(value[key]);
+		if (part) name[key] = part;
+	}
+	return Object.keys(name).length > 0 ? name : void 0;
+}
+/**
+* The standard name claims from cleaned parts, with `name` composed from given and family name.
+* Undefined parts are left out, so spreading the result never overwrites a claim with `undefined`.
+*/
+function nameClaims(parts) {
+	return withoutUndefined({
+		...parts,
+		name: composeName(parts)
+	});
+}
+function isObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function withoutUndefined(value) {
+	return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== void 0));
+}
+//#endregion
+exports.MAX_NAME_PART_LENGTH = MAX_NAME_PART_LENGTH;
+exports.cleanNamePart = cleanNamePart;
+exports.cleanPersonName = cleanPersonName;
+exports.composeName = composeName;
+exports.nameClaims = nameClaims;
+exports.parseAppleUser = parseAppleUser;
+
+//# sourceMappingURL=name.cjs.map

package/dist/oauth2/name.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"name.cjs","names":[],"sources":["../../src/oauth2/name.ts"],"sourcesContent":["import type { PersonNameComponents, StandardClaims } from './types';\n\n/**\n * Upper bound, in characters, on each name part taken from the client. Names that reach us outside\n * a signed token (Apple's form_post `user`, a native login body) are plain client input, so they\n * are capped before a host stores them; 64 leaves room for any real given or family name.\n */\nexport const MAX_NAME_PART_LENGTH = 64;\n\n/** Apple's form_post `user` is a few dozen bytes; anything far larger is not Apple's. */\nconst MAX_APPLE_USER_LENGTH = 1024;\n\nconst CJK = /^[\\p{Script=Han}\\p{Script=Hiragana}\\p{Script=Katakana}\\p{Script=Hangul}]+$/u;\n\n/**\n * Composes a display `name` from its parts, for providers that hand out the parts only. Chinese,\n * Japanese and Korean names are written family name first without a space (`王小明`), every other\n * name given name first (`John Appleseed`), which is also the safe choice for mixed scripts. With\n * one part only, that part is the name.\n */\nexport function composeName({\n  given_name,\n  family_name,\n}: Pick<StandardClaims, 'given_name' | 'family_name'>): string | undefined {\n  const given = given_name?.trim();\n  const family = family_name?.trim();\n  if (given && family) {\n    return CJK.test(given) && CJK.test(family) ? `${family}${given}` : `${given} ${family}`;\n  }\n  return given || family || undefined;\n}\n\n/**\n * One untrusted name part: a non-blank string, trimmed and capped at `MAX_NAME_PART_LENGTH`\n * characters (code points, so a cut never splits one). Anything else is dropped rather than refused,\n * because the name is a nicety and must never cost the user their login.\n */\nexport function cleanNamePart(value: unknown): string | undefined {\n  if (typeof value !== 'string') return undefined;\n  const trimmed = value.trim();\n  if (!trimmed) return undefined;\n  return Array.from(trimmed).slice(0, MAX_NAME_PART_LENGTH).join('');\n}\n\n/** Name parts as Apple's form_post `user` carries them, after cleaning. */\nexport interface AppleUser {\n  name?: { firstName?: string; lastName?: string };\n  email?: string;\n}\n\n/**\n * Parses Apple's form_post `user` (JSON, first authorization only). Malformed JSON or a wrong shape\n * yields `undefined`, never an error. Only known fields are kept, each cleaned, so what a host\n * persists stays small.\n */\nexport function parseAppleUser(raw: string | undefined): AppleUser | undefined {\n  if (!raw || raw.length > MAX_APPLE_USER_LENGTH) return undefined;\n  let json: unknown;\n  try {\n    json = JSON.parse(raw);\n  } catch {\n    return undefined;\n  }\n  if (!isObject(json)) return undefined;\n  const user: AppleUser = {};\n  if (isObject(json.name)) {\n    const firstName = cleanNamePart(json.name.firstName);\n    const lastName = cleanNamePart(json.name.lastName);\n    if (firstName || lastName) user.name = withoutUndefined({ firstName, lastName });\n  }\n  // Kept as Apple sent it for the record only: the id token's email is signed, this one is not.\n  const email = typeof json.email === 'string' ? json.email.trim().slice(0, 320) : undefined;\n  if (email) user.email = email;\n  return user.name || user.email ? user : undefined;\n}\n\nconst PERSON_NAME_KEYS = [\n  'givenName',\n  'familyName',\n  'middleName',\n  'namePrefix',\n  'nameSuffix',\n  'nickname',\n] as const satisfies (keyof PersonNameComponents)[];\n\n/**\n * Cleans the `fullName` of a native login body (iOS `PersonNameComponents`): known keys only,\n * each a cleaned string; `undefined` when nothing usable is left.\n */\nexport function cleanPersonName(value: unknown): PersonNameComponents | undefined {\n  if (!isObject(value)) return undefined;\n  const name: PersonNameComponents = {};\n  for (const key of PERSON_NAME_KEYS) {\n    const part = cleanNamePart(value[key]);\n    if (part) name[key] = part;\n  }\n  return Object.keys(name).length > 0 ? name : undefined;\n}\n\ntype NameClaims = Pick<\n  StandardClaims,\n  'name' | 'given_name' | 'family_name' | 'middle_name' | 'nickname'\n>;\n\n/**\n * The standard name claims from cleaned parts, with `name` composed from given and family name.\n * Undefined parts are left out, so spreading the result never overwrites a claim with `undefined`.\n */\nexport function nameClaims(parts: Omit<NameClaims, 'name'>): NameClaims {\n  return withoutUndefined({ ...parts, name: composeName(parts) });\n}\n\nfunction isObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction withoutUndefined<T extends object>(value: T): T {\n  return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== undefined)) as T;\n}\n"],"mappings":";;;;;;;AAOA,MAAa,uBAAuB;;AAGpC,MAAM,wBAAwB;AAE9B,MAAM,MAAM;;;;;;;AAQZ,SAAgB,YAAY,EAC1B,YACA,eACyE;CACzE,MAAM,QAAQ,YAAY,KAAK;CAC/B,MAAM,SAAS,aAAa,KAAK;CACjC,IAAI,SAAS,QACX,OAAO,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,MAAM,IAAI,GAAG,SAAS,UAAU,GAAG,MAAM,GAAG;CAEjF,OAAO,SAAS,UAAU,KAAA;AAC5B;;;;;;AAOA,SAAgB,cAAc,OAAoC;CAChE,IAAI,OAAO,UAAU,UAAU,OAAO,KAAA;CACtC,MAAM,UAAU,MAAM,KAAK;CAC3B,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,OAAO,MAAM,KAAK,OAAO,CAAC,CAAC,MAAM,GAAA,EAAuB,CAAC,CAAC,KAAK,EAAE;AACnE;;;;;;AAaA,SAAgB,eAAe,KAAgD;CAC7E,IAAI,CAAC,OAAO,IAAI,SAAS,uBAAuB,OAAO,KAAA;CACvD,IAAI;CACJ,IAAI;EACF,OAAO,KAAK,MAAM,GAAG;CACvB,QAAQ;EACN;CACF;CACA,IAAI,CAAC,SAAS,IAAI,GAAG,OAAO,KAAA;CAC5B,MAAM,OAAkB,CAAC;CACzB,IAAI,SAAS,KAAK,IAAI,GAAG;EACvB,MAAM,YAAY,cAAc,KAAK,KAAK,SAAS;EACnD,MAAM,WAAW,cAAc,KAAK,KAAK,QAAQ;EACjD,IAAI,aAAa,UAAU,KAAK,OAAO,iBAAiB;GAAE;GAAW;EAAS,CAAC;CACjF;CAEA,MAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,MAAM,KAAK,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,KAAA;CACjF,IAAI,OAAO,KAAK,QAAQ;CACxB,OAAO,KAAK,QAAQ,KAAK,QAAQ,OAAO,KAAA;AAC1C;AAEA,MAAM,mBAAmB;CACvB;CACA;CACA;CACA;CACA;CACA;AACF;;;;;AAMA,SAAgB,gBAAgB,OAAkD;CAChF,IAAI,CAAC,SAAS,KAAK,GAAG,OAAO,KAAA;CAC7B,MAAM,OAA6B,CAAC;CACpC,KAAK,MAAM,OAAO,kBAAkB;EAClC,MAAM,OAAO,cAAc,MAAM,IAAI;EACrC,IAAI,MAAM,KAAK,OAAO;CACxB;CACA,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,SAAS,IAAI,OAAO,KAAA;AAC/C;;;;;AAWA,SAAgB,WAAW,OAA6C;CACtE,OAAO,iBAAiB;EAAE,GAAG;EAAO,MAAM,YAAY,KAAK;CAAE,CAAC;AAChE;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,iBAAmC,OAAa;CACvD,OAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CAAC,QAAQ,GAAG,OAAO,MAAM,KAAA,CAAS,CAAC;AACpF"}

package/dist/oauth2/name.d.cts

@@ -0,0 +1,49 @@
+import { PersonNameComponents, StandardClaims } from "./types.cjs";
+//#region src/oauth2/name.d.ts
+/**
+ * Upper bound, in characters, on each name part taken from the client. Names that reach us outside
+ * a signed token (Apple's form_post `user`, a native login body) are plain client input, so they
+ * are capped before a host stores them; 64 leaves room for any real given or family name.
+ */
+export declare const MAX_NAME_PART_LENGTH = 64;
+/**
+ * Composes a display `name` from its parts, for providers that hand out the parts only. Chinese,
+ * Japanese and Korean names are written family name first without a space (`王小明`), every other
+ * name given name first (`John Appleseed`), which is also the safe choice for mixed scripts. With
+ * one part only, that part is the name.
+ */
+export declare function composeName({ given_name, family_name }: Pick<StandardClaims, 'given_name' | 'family_name'>): string | undefined;
+/**
+ * One untrusted name part: a non-blank string, trimmed and capped at `MAX_NAME_PART_LENGTH`
+ * characters (code points, so a cut never splits one). Anything else is dropped rather than refused,
+ * because the name is a nicety and must never cost the user their login.
+ */
+export declare function cleanNamePart(value: unknown): string | undefined;
+/** Name parts as Apple's form_post `user` carries them, after cleaning. */
+export interface AppleUser {
+  name?: {
+    firstName?: string;
+    lastName?: string;
+  };
+  email?: string;
+}
+/**
+ * Parses Apple's form_post `user` (JSON, first authorization only). Malformed JSON or a wrong shape
+ * yields `undefined`, never an error. Only known fields are kept, each cleaned, so what a host
+ * persists stays small.
+ */
+export declare function parseAppleUser(raw: string | undefined): AppleUser | undefined;
+/**
+ * Cleans the `fullName` of a native login body (iOS `PersonNameComponents`): known keys only,
+ * each a cleaned string; `undefined` when nothing usable is left.
+ */
+export declare function cleanPersonName(value: unknown): PersonNameComponents | undefined;
+type NameClaims = Pick<StandardClaims, 'name' | 'given_name' | 'family_name' | 'middle_name' | 'nickname'>;
+/**
+ * The standard name claims from cleaned parts, with `name` composed from given and family name.
+ * Undefined parts are left out, so spreading the result never overwrites a claim with `undefined`.
+ */
+export declare function nameClaims(parts: Omit<NameClaims, 'name'>): NameClaims;
+//#endregion
+export {};
+//# sourceMappingURL=name.d.cts.map

package/dist/oauth2/name.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"name.d.cts","names":[],"sources":["../../src/oauth2/name.ts"],"mappings":";;;;;;;qBAOa;;;;;;;wBAaG,cACd,YACA,eACC,KAAK;;;;;;wBAcQ,cAAc;;iBAQb;EACf;IAAS;IAAoB;;EAC7B;;;;;;;wBAQc,eAAe,0BAA0B;;;;;wBAkCzC,gBAAgB,iBAAiB;KAU5C,aAAa,KAChB;;;;;wBAQc,WAAW,OAAO,KAAK,sBAAsB"}

package/dist/oauth2/name.d.mts

@@ -0,0 +1,49 @@
+import { PersonNameComponents, StandardClaims } from "./types.mjs";
+//#region src/oauth2/name.d.ts
+/**
+ * Upper bound, in characters, on each name part taken from the client. Names that reach us outside
+ * a signed token (Apple's form_post `user`, a native login body) are plain client input, so they
+ * are capped before a host stores them; 64 leaves room for any real given or family name.
+ */
+export declare const MAX_NAME_PART_LENGTH = 64;
+/**
+ * Composes a display `name` from its parts, for providers that hand out the parts only. Chinese,
+ * Japanese and Korean names are written family name first without a space (`王小明`), every other
+ * name given name first (`John Appleseed`), which is also the safe choice for mixed scripts. With
+ * one part only, that part is the name.
+ */
+export declare function composeName({ given_name, family_name }: Pick<StandardClaims, 'given_name' | 'family_name'>): string | undefined;
+/**
+ * One untrusted name part: a non-blank string, trimmed and capped at `MAX_NAME_PART_LENGTH`
+ * characters (code points, so a cut never splits one). Anything else is dropped rather than refused,
+ * because the name is a nicety and must never cost the user their login.
+ */
+export declare function cleanNamePart(value: unknown): string | undefined;
+/** Name parts as Apple's form_post `user` carries them, after cleaning. */
+export interface AppleUser {
+  name?: {
+    firstName?: string;
+    lastName?: string;
+  };
+  email?: string;
+}
+/**
+ * Parses Apple's form_post `user` (JSON, first authorization only). Malformed JSON or a wrong shape
+ * yields `undefined`, never an error. Only known fields are kept, each cleaned, so what a host
+ * persists stays small.
+ */
+export declare function parseAppleUser(raw: string | undefined): AppleUser | undefined;
+/**
+ * Cleans the `fullName` of a native login body (iOS `PersonNameComponents`): known keys only,
+ * each a cleaned string; `undefined` when nothing usable is left.
+ */
+export declare function cleanPersonName(value: unknown): PersonNameComponents | undefined;
+type NameClaims = Pick<StandardClaims, 'name' | 'given_name' | 'family_name' | 'middle_name' | 'nickname'>;
+/**
+ * The standard name claims from cleaned parts, with `name` composed from given and family name.
+ * Undefined parts are left out, so spreading the result never overwrites a claim with `undefined`.
+ */
+export declare function nameClaims(parts: Omit<NameClaims, 'name'>): NameClaims;
+//#endregion
+export {};
+//# sourceMappingURL=name.d.mts.map

package/dist/oauth2/name.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"name.d.mts","names":[],"sources":["../../src/oauth2/name.ts"],"mappings":";;;;;;;qBAOa;;;;;;;wBAaG,cACd,YACA,eACC,KAAK;;;;;;wBAcQ,cAAc;;iBAQb;EACf;IAAS;IAAoB;;EAC7B;;;;;;;wBAQc,eAAe,0BAA0B;;;;;wBAkCzC,gBAAgB,iBAAiB;KAU5C,aAAa,KAChB;;;;;wBAQc,WAAW,OAAO,KAAK,sBAAsB"}

package/dist/oauth2/name.mjs

@@ -0,0 +1,101 @@
+//#region src/oauth2/name.ts
+/**
+* Upper bound, in characters, on each name part taken from the client. Names that reach us outside
+* a signed token (Apple's form_post `user`, a native login body) are plain client input, so they
+* are capped before a host stores them; 64 leaves room for any real given or family name.
+*/
+const MAX_NAME_PART_LENGTH = 64;
+/** Apple's form_post `user` is a few dozen bytes; anything far larger is not Apple's. */
+const MAX_APPLE_USER_LENGTH = 1024;
+const CJK = /^[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Hangul}]+$/u;
+/**
+* Composes a display `name` from its parts, for providers that hand out the parts only. Chinese,
+* Japanese and Korean names are written family name first without a space (`王小明`), every other
+* name given name first (`John Appleseed`), which is also the safe choice for mixed scripts. With
+* one part only, that part is the name.
+*/
+function composeName({ given_name, family_name }) {
+	const given = given_name?.trim();
+	const family = family_name?.trim();
+	if (given && family) return CJK.test(given) && CJK.test(family) ? `${family}${given}` : `${given} ${family}`;
+	return given || family || void 0;
+}
+/**
+* One untrusted name part: a non-blank string, trimmed and capped at `MAX_NAME_PART_LENGTH`
+* characters (code points, so a cut never splits one). Anything else is dropped rather than refused,
+* because the name is a nicety and must never cost the user their login.
+*/
+function cleanNamePart(value) {
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	if (!trimmed) return void 0;
+	return Array.from(trimmed).slice(0, 64).join("");
+}
+/**
+* Parses Apple's form_post `user` (JSON, first authorization only). Malformed JSON or a wrong shape
+* yields `undefined`, never an error. Only known fields are kept, each cleaned, so what a host
+* persists stays small.
+*/
+function parseAppleUser(raw) {
+	if (!raw || raw.length > MAX_APPLE_USER_LENGTH) return void 0;
+	let json;
+	try {
+		json = JSON.parse(raw);
+	} catch {
+		return;
+	}
+	if (!isObject(json)) return void 0;
+	const user = {};
+	if (isObject(json.name)) {
+		const firstName = cleanNamePart(json.name.firstName);
+		const lastName = cleanNamePart(json.name.lastName);
+		if (firstName || lastName) user.name = withoutUndefined({
+			firstName,
+			lastName
+		});
+	}
+	const email = typeof json.email === "string" ? json.email.trim().slice(0, 320) : void 0;
+	if (email) user.email = email;
+	return user.name || user.email ? user : void 0;
+}
+const PERSON_NAME_KEYS = [
+	"givenName",
+	"familyName",
+	"middleName",
+	"namePrefix",
+	"nameSuffix",
+	"nickname"
+];
+/**
+* Cleans the `fullName` of a native login body (iOS `PersonNameComponents`): known keys only,
+* each a cleaned string; `undefined` when nothing usable is left.
+*/
+function cleanPersonName(value) {
+	if (!isObject(value)) return void 0;
+	const name = {};
+	for (const key of PERSON_NAME_KEYS) {
+		const part = cleanNamePart(value[key]);
+		if (part) name[key] = part;
+	}
+	return Object.keys(name).length > 0 ? name : void 0;
+}
+/**
+* The standard name claims from cleaned parts, with `name` composed from given and family name.
+* Undefined parts are left out, so spreading the result never overwrites a claim with `undefined`.
+*/
+function nameClaims(parts) {
+	return withoutUndefined({
+		...parts,
+		name: composeName(parts)
+	});
+}
+function isObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function withoutUndefined(value) {
+	return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== void 0));
+}
+//#endregion
+export { MAX_NAME_PART_LENGTH, cleanNamePart, cleanPersonName, composeName, nameClaims, parseAppleUser };
+
+//# sourceMappingURL=name.mjs.map

package/dist/oauth2/name.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"name.mjs","names":[],"sources":["../../src/oauth2/name.ts"],"sourcesContent":["import type { PersonNameComponents, StandardClaims } from './types';\n\n/**\n * Upper bound, in characters, on each name part taken from the client. Names that reach us outside\n * a signed token (Apple's form_post `user`, a native login body) are plain client input, so they\n * are capped before a host stores them; 64 leaves room for any real given or family name.\n */\nexport const MAX_NAME_PART_LENGTH = 64;\n\n/** Apple's form_post `user` is a few dozen bytes; anything far larger is not Apple's. */\nconst MAX_APPLE_USER_LENGTH = 1024;\n\nconst CJK = /^[\\p{Script=Han}\\p{Script=Hiragana}\\p{Script=Katakana}\\p{Script=Hangul}]+$/u;\n\n/**\n * Composes a display `name` from its parts, for providers that hand out the parts only. Chinese,\n * Japanese and Korean names are written family name first without a space (`王小明`), every other\n * name given name first (`John Appleseed`), which is also the safe choice for mixed scripts. With\n * one part only, that part is the name.\n */\nexport function composeName({\n  given_name,\n  family_name,\n}: Pick<StandardClaims, 'given_name' | 'family_name'>): string | undefined {\n  const given = given_name?.trim();\n  const family = family_name?.trim();\n  if (given && family) {\n    return CJK.test(given) && CJK.test(family) ? `${family}${given}` : `${given} ${family}`;\n  }\n  return given || family || undefined;\n}\n\n/**\n * One untrusted name part: a non-blank string, trimmed and capped at `MAX_NAME_PART_LENGTH`\n * characters (code points, so a cut never splits one). Anything else is dropped rather than refused,\n * because the name is a nicety and must never cost the user their login.\n */\nexport function cleanNamePart(value: unknown): string | undefined {\n  if (typeof value !== 'string') return undefined;\n  const trimmed = value.trim();\n  if (!trimmed) return undefined;\n  return Array.from(trimmed).slice(0, MAX_NAME_PART_LENGTH).join('');\n}\n\n/** Name parts as Apple's form_post `user` carries them, after cleaning. */\nexport interface AppleUser {\n  name?: { firstName?: string; lastName?: string };\n  email?: string;\n}\n\n/**\n * Parses Apple's form_post `user` (JSON, first authorization only). Malformed JSON or a wrong shape\n * yields `undefined`, never an error. Only known fields are kept, each cleaned, so what a host\n * persists stays small.\n */\nexport function parseAppleUser(raw: string | undefined): AppleUser | undefined {\n  if (!raw || raw.length > MAX_APPLE_USER_LENGTH) return undefined;\n  let json: unknown;\n  try {\n    json = JSON.parse(raw);\n  } catch {\n    return undefined;\n  }\n  if (!isObject(json)) return undefined;\n  const user: AppleUser = {};\n  if (isObject(json.name)) {\n    const firstName = cleanNamePart(json.name.firstName);\n    const lastName = cleanNamePart(json.name.lastName);\n    if (firstName || lastName) user.name = withoutUndefined({ firstName, lastName });\n  }\n  // Kept as Apple sent it for the record only: the id token's email is signed, this one is not.\n  const email = typeof json.email === 'string' ? json.email.trim().slice(0, 320) : undefined;\n  if (email) user.email = email;\n  return user.name || user.email ? user : undefined;\n}\n\nconst PERSON_NAME_KEYS = [\n  'givenName',\n  'familyName',\n  'middleName',\n  'namePrefix',\n  'nameSuffix',\n  'nickname',\n] as const satisfies (keyof PersonNameComponents)[];\n\n/**\n * Cleans the `fullName` of a native login body (iOS `PersonNameComponents`): known keys only,\n * each a cleaned string; `undefined` when nothing usable is left.\n */\nexport function cleanPersonName(value: unknown): PersonNameComponents | undefined {\n  if (!isObject(value)) return undefined;\n  const name: PersonNameComponents = {};\n  for (const key of PERSON_NAME_KEYS) {\n    const part = cleanNamePart(value[key]);\n    if (part) name[key] = part;\n  }\n  return Object.keys(name).length > 0 ? name : undefined;\n}\n\ntype NameClaims = Pick<\n  StandardClaims,\n  'name' | 'given_name' | 'family_name' | 'middle_name' | 'nickname'\n>;\n\n/**\n * The standard name claims from cleaned parts, with `name` composed from given and family name.\n * Undefined parts are left out, so spreading the result never overwrites a claim with `undefined`.\n */\nexport function nameClaims(parts: Omit<NameClaims, 'name'>): NameClaims {\n  return withoutUndefined({ ...parts, name: composeName(parts) });\n}\n\nfunction isObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction withoutUndefined<T extends object>(value: T): T {\n  return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== undefined)) as T;\n}\n"],"mappings":";;;;;;AAOA,MAAa,uBAAuB;;AAGpC,MAAM,wBAAwB;AAE9B,MAAM,MAAM;;;;;;;AAQZ,SAAgB,YAAY,EAC1B,YACA,eACyE;CACzE,MAAM,QAAQ,YAAY,KAAK;CAC/B,MAAM,SAAS,aAAa,KAAK;CACjC,IAAI,SAAS,QACX,OAAO,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,MAAM,IAAI,GAAG,SAAS,UAAU,GAAG,MAAM,GAAG;CAEjF,OAAO,SAAS,UAAU,KAAA;AAC5B;;;;;;AAOA,SAAgB,cAAc,OAAoC;CAChE,IAAI,OAAO,UAAU,UAAU,OAAO,KAAA;CACtC,MAAM,UAAU,MAAM,KAAK;CAC3B,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,OAAO,MAAM,KAAK,OAAO,CAAC,CAAC,MAAM,GAAA,EAAuB,CAAC,CAAC,KAAK,EAAE;AACnE;;;;;;AAaA,SAAgB,eAAe,KAAgD;CAC7E,IAAI,CAAC,OAAO,IAAI,SAAS,uBAAuB,OAAO,KAAA;CACvD,IAAI;CACJ,IAAI;EACF,OAAO,KAAK,MAAM,GAAG;CACvB,QAAQ;EACN;CACF;CACA,IAAI,CAAC,SAAS,IAAI,GAAG,OAAO,KAAA;CAC5B,MAAM,OAAkB,CAAC;CACzB,IAAI,SAAS,KAAK,IAAI,GAAG;EACvB,MAAM,YAAY,cAAc,KAAK,KAAK,SAAS;EACnD,MAAM,WAAW,cAAc,KAAK,KAAK,QAAQ;EACjD,IAAI,aAAa,UAAU,KAAK,OAAO,iBAAiB;GAAE;GAAW;EAAS,CAAC;CACjF;CAEA,MAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,MAAM,KAAK,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,KAAA;CACjF,IAAI,OAAO,KAAK,QAAQ;CACxB,OAAO,KAAK,QAAQ,KAAK,QAAQ,OAAO,KAAA;AAC1C;AAEA,MAAM,mBAAmB;CACvB;CACA;CACA;CACA;CACA;CACA;AACF;;;;;AAMA,SAAgB,gBAAgB,OAAkD;CAChF,IAAI,CAAC,SAAS,KAAK,GAAG,OAAO,KAAA;CAC7B,MAAM,OAA6B,CAAC;CACpC,KAAK,MAAM,OAAO,kBAAkB;EAClC,MAAM,OAAO,cAAc,MAAM,IAAI;EACrC,IAAI,MAAM,KAAK,OAAO;CACxB;CACA,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,SAAS,IAAI,OAAO,KAAA;AAC/C;;;;;AAWA,SAAgB,WAAW,OAA6C;CACtE,OAAO,iBAAiB;EAAE,GAAG;EAAO,MAAM,YAAY,KAAK;CAAE,CAAC;AAChE;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,iBAAmC,OAAa;CACvD,OAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CAAC,QAAQ,GAAG,OAAO,MAAM,KAAA,CAAS,CAAC;AACpF"}